@kky42/pievo-server 2.4.13 → 3.0.0

package/.output/server/_ssr/{boot-U-CFI65B.mjs → boot-CYRi-wez.mjs}

@@ -1,9 +1,9 @@
-import { o as __toESM } from "../_runtime.mjs";
+import { o as __toESM, r as __exportAll$1 } from "../_runtime.mjs";
 import { t as Ve } from "../_libs/electric-sql__pglite.mjs";
-import { A as boolean, C as notInArray, D as text, E as timestamp, O as jsonb, S as ne, T as pgTable, _ as isNotNull, a as uniqueIndex, b as lt, c as relations, d as and, f as eq, g as inArray, i as index, j as sql, k as integer, l as asc, m as gte, n as src_default, o as check, p as gt, r as drizzle$1, t as drizzle, u as desc, v as isNull, w as or, x as lte } from "../_libs/drizzle-orm+postgres.mjs";
+import { C as integer, S as jsonb, T as sql, _ as notInArray, a as asc, b as timestamp, c as eq, d as inArray, f as isNotNull, g as ne, h as lte, i as check, l as gt, m as lt, n as index, o as desc, p as isNull, r as uniqueIndex, s as and, t as drizzle, u as gte, v as or, w as boolean, x as text, y as pgTable } from "../_libs/drizzle-orm.mjs";
+import { t as E } from "../_libs/croner.mjs";
 import { t as require_pino } from "../_libs/pino+[...].mjs";
 import { t as require_pino_pretty } from "../_libs/pino-pretty+[...].mjs";
-import { t as E } from "../_libs/croner.mjs";
 import { t as createTwoFilesPatch } from "../_libs/diff.mjs";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import fs from "node:fs";
@@ -11,1394 +11,158 @@ import { fileURLToPath } from "node:url";
 import path from "node:path";
 import os from "node:os";
 import fs$1 from "node:fs/promises";
-//#region node_modules/.nitro/vite/services/ssr/assets/boot-U-CFI65B.js
+//#region node_modules/.nitro/vite/services/ssr/assets/loopTags-C6vATFCp.js
+var loopTags_C6vATFCp_exports = /* @__PURE__ */ __exportAll$1({
+	$: () => lastRun,
+	A: () => buildLoopManifest,
+	At: () => runningRunForLoop,
+	B: () => forceDeleteLoop,
+	Bt: () => upsertConfiguredArtifactFile,
+	C: () => acknowledgeRetiredReport,
+	Ct: () => recordRunReportOnce,
+	D: () => blobExists,
+	Dt: () => repairTerminalRunLeases,
+	E: () => artifactFileReferencesHash,
+	Et: () => releaseAbsentReconciliations,
+	F: () => createMachine,
+	Ft: () => stopLoop,
+	G: () => getMachine,
+	Gt: () => CODING_AGENTS,
+	H: () => getArtifactFile,
+	Ht: () => db,
+	I: () => deleteBlob,
+	It: () => store_exports,
+	J: () => getRunSnapshot,
+	Jt: () => logger_exports,
+	K: () => getReportReceipt,
+	Kt: () => coerceCodingAgent,
+	L: () => enqueueRun,
+	Lt: () => tryDeleteLoop,
+	M: () => countRunSnapshots,
+	Mt: () => setMachineOnline,
+	N: () => countRuns,
+	Nt: () => snapshotBlobRefs,
+	O: () => blobHashesOlderThan,
+	Ot: () => requestDeleteLoop,
+	P: () => createLoop,
+	Pt: () => startLoop,
+	Q: () => initializeCronCadence,
+	Qt: () => __exportAll,
+	R: () => expirePendingRun,
+	Rt: () => updateLoop,
+	S: () => sha256Buf,
+	St: () => recordBlob,
+	T: () => advanceDueSchedules,
+	Tt: () => rejectTerminalReport,
+	U: () => getExactTerminalReportIncident,
+	Ut: () => runMigrations,
+	V: () => forceDeleteMachine,
+	Vt: () => closeClient,
+	W: () => getLoop,
+	Wt: () => runs,
+	X: () => hasPendingRun,
+	Xt: () => GC_INTERVAL_MS,
+	Y: () => getTerminalReportIncidents,
+	Yt: () => BLOB_GC_GRACE_MS,
+	Z: () => hasRunningRun,
+	Zt: () => dataDir,
+	_: () => BLOB_CAP,
+	_t: () => recentLoopUsage,
+	a: () => TERMINAL_GRACE_MS,
+	at: () => liveBlobRefs,
+	b: () => parseArtifactSyncBody,
+	bt: () => reconcileReclaimedRun,
+	c: () => machineIdFromToken,
+	ct: () => machineReferencesBlob,
+	d: () => readNewIdempotency,
+	dt: () => pauseLoopState,
+	et: () => listArtifacts,
+	f: () => recordNewIdempotency,
+	ft: () => prevRunSnapshot,
+	g: () => tokens_exports,
+	gt: () => putTerminalReportIncidentIfAbsent,
+	h: () => sha256,
+	ht: () => putRunSnapshot,
+	i: () => machinePresence,
+	it: () => listRunsBefore,
+	j: () => claimReadyRunForMachine,
+	jt: () => runningRunsForMachine,
+	k: () => blobSizes,
+	kt: () => requestRunCancel,
+	l: () => mintDeviceToken,
+	lt: () => openRuns,
+	m: () => retireLease,
+	mt: () => putReportReceiptIfAbsent,
+	n: () => isOutdated,
+	nt: () => listMachines,
+	o: () => connectKeyValid,
+	ot: () => loopIdsWithSnapshots,
+	p: () => resolveLease,
+	pt: () => pruneRunSnapshots,
+	q: () => getRun,
+	qt: () => logger,
+	r: () => isValidSemver,
+	rt: () => listRuns,
+	s: () => isDeviceTokenShape,
+	st: () => loopsForMachine,
+	t: () => validateLoopTags,
+	tt: () => listLoops,
+	u: () => pruneExpiredLeases,
+	ut: () => pauseLoop,
+	v: () => artifacts_exports,
+	vt: () => reclaimRun,
+	w: () => acknowledgeRetiredTerminalIncident,
+	wt: () => refreshRunHeartbeats,
+	x: () => safeRelPath,
+	xt: () => reconciliationStatesForRuns,
+	y: () => isValidHash,
+	yt: () => reconcileConfiguredArtifacts,
+	z: () => finalizeRunningRun,
+	zt: () => updateMachine
+});
 var import_pino = /* @__PURE__ */ __toESM(require_pino());
 var import_pino_pretty = /* @__PURE__ */ __toESM(require_pino_pretty());
-function defineErrorCodes(codes) {
-	return Object.fromEntries(Object.entries(codes).map(([key, value]) => [key, {
-		code: key,
-		message: value,
-		toString: () => key
-	}]));
-}
-var BASE_ERROR_CODES = defineErrorCodes({
-	USER_NOT_FOUND: "User not found",
-	FAILED_TO_CREATE_USER: "Failed to create user",
-	FAILED_TO_CREATE_SESSION: "Failed to create session",
-	FAILED_TO_UPDATE_USER: "Failed to update user",
-	FAILED_TO_GET_SESSION: "Failed to get session",
-	INVALID_PASSWORD: "Invalid password",
-	INVALID_EMAIL: "Invalid email",
-	INVALID_EMAIL_OR_PASSWORD: "Invalid email or password",
-	INVALID_USER: "Invalid user",
-	SOCIAL_ACCOUNT_ALREADY_LINKED: "Social account already linked",
-	PROVIDER_NOT_FOUND: "Provider not found",
-	INVALID_TOKEN: "Invalid token",
-	TOKEN_EXPIRED: "Token expired",
-	ID_TOKEN_NOT_SUPPORTED: "id_token not supported",
-	FAILED_TO_GET_USER_INFO: "Failed to get user info",
-	USER_EMAIL_NOT_FOUND: "User email not found",
-	EMAIL_NOT_VERIFIED: "Email not verified",
-	PASSWORD_TOO_SHORT: "Password too short",
-	PASSWORD_TOO_LONG: "Password too long",
-	USER_ALREADY_EXISTS: "User already exists.",
-	USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL: "User already exists. Use another email.",
-	EMAIL_CAN_NOT_BE_UPDATED: "Email can not be updated",
-	CHANGE_EMAIL_DISABLED: "Change email is disabled",
-	CREDENTIAL_ACCOUNT_NOT_FOUND: "Credential account not found",
-	SESSION_EXPIRED: "Session expired. Re-authenticate to perform this action.",
-	FAILED_TO_UNLINK_LAST_ACCOUNT: "You can't unlink your last account",
-	ACCOUNT_NOT_FOUND: "Account not found",
-	USER_ALREADY_HAS_PASSWORD: "User already has a password. Provide that to delete the account.",
-	CROSS_SITE_NAVIGATION_LOGIN_BLOCKED: "Cross-site navigation login blocked. This request appears to be a CSRF attack.",
-	VERIFICATION_EMAIL_NOT_ENABLED: "Verification email isn't enabled",
-	EMAIL_ALREADY_VERIFIED: "Email is already verified",
-	EMAIL_MISMATCH: "Email mismatch",
-	SESSION_NOT_FRESH: "Session is not fresh",
-	LINKED_ACCOUNT_ALREADY_EXISTS: "Linked account already exists",
-	INVALID_ORIGIN: "Invalid origin",
-	INVALID_CALLBACK_URL: "Invalid callbackURL",
-	INVALID_REDIRECT_URL: "Invalid redirectURL",
-	INVALID_ERROR_CALLBACK_URL: "Invalid errorCallbackURL",
-	INVALID_NEW_USER_CALLBACK_URL: "Invalid newUserCallbackURL",
-	MISSING_OR_NULL_ORIGIN: "Missing or null Origin",
-	CALLBACK_URL_REQUIRED: "callbackURL is required",
-	FAILED_TO_CREATE_VERIFICATION: "Unable to create verification",
-	FIELD_NOT_ALLOWED: "Field not allowed to be set",
-	ASYNC_VALIDATION_NOT_SUPPORTED: "Async validation is not supported",
-	VALIDATION_ERROR: "Validation Error",
-	MISSING_FIELD: "Field is required",
-	METHOD_NOT_ALLOWED_DEFER_SESSION_REQUIRED: "POST method requires deferSessionRefresh to be enabled in session config",
-	BODY_MUST_BE_AN_OBJECT: "Body must be an object",
-	PASSWORD_ALREADY_SET: "User already has a password set"
-});
-function isErrorStackTraceLimitWritable() {
-	const desc = Object.getOwnPropertyDescriptor(Error, "stackTraceLimit");
-	if (desc === void 0) return Object.isExtensible(Error);
-	return Object.prototype.hasOwnProperty.call(desc, "writable") ? desc.writable : desc.set !== void 0;
-}
-/**
-* Hide internal stack frames from the error stack trace.
-*/
-function hideInternalStackFrames(stack) {
-	const lines = stack.split("\n    at ");
-	if (lines.length <= 1) return stack;
-	lines.splice(1, 1);
-	return lines.join("\n    at ");
-}
-/**
-* Creates a custom error class that hides stack frames.
-*/
-function makeErrorForHideStackFrame(Base, clazz) {
-	class HideStackFramesError extends Base {
-		#hiddenStack;
-		constructor(...args) {
-			if (isErrorStackTraceLimitWritable()) {
-				const limit = Error.stackTraceLimit;
-				Error.stackTraceLimit = 0;
-				super(...args);
-				Error.stackTraceLimit = limit;
-			} else super(...args);
-			const stack = (/* @__PURE__ */ new Error()).stack;
-			if (stack) this.#hiddenStack = hideInternalStackFrames(stack.replace(/^Error/, this.name));
-		}
-		get errorStack() {
-			return this.#hiddenStack;
-		}
-	}
-	Object.defineProperty(HideStackFramesError.prototype, "constructor", {
-		get() {
-			return clazz;
-		},
-		enumerable: false,
-		configurable: true
-	});
-	return HideStackFramesError;
-}
-var statusCodes = {
-	OK: 200,
-	CREATED: 201,
-	ACCEPTED: 202,
-	NO_CONTENT: 204,
-	MULTIPLE_CHOICES: 300,
-	MOVED_PERMANENTLY: 301,
-	FOUND: 302,
-	SEE_OTHER: 303,
-	NOT_MODIFIED: 304,
-	TEMPORARY_REDIRECT: 307,
-	BAD_REQUEST: 400,
-	UNAUTHORIZED: 401,
-	PAYMENT_REQUIRED: 402,
-	FORBIDDEN: 403,
-	NOT_FOUND: 404,
-	METHOD_NOT_ALLOWED: 405,
-	NOT_ACCEPTABLE: 406,
-	PROXY_AUTHENTICATION_REQUIRED: 407,
-	REQUEST_TIMEOUT: 408,
-	CONFLICT: 409,
-	GONE: 410,
-	LENGTH_REQUIRED: 411,
-	PRECONDITION_FAILED: 412,
-	PAYLOAD_TOO_LARGE: 413,
-	URI_TOO_LONG: 414,
-	UNSUPPORTED_MEDIA_TYPE: 415,
-	RANGE_NOT_SATISFIABLE: 416,
-	EXPECTATION_FAILED: 417,
-	"I'M_A_TEAPOT": 418,
-	MISDIRECTED_REQUEST: 421,
-	UNPROCESSABLE_ENTITY: 422,
-	LOCKED: 423,
-	FAILED_DEPENDENCY: 424,
-	TOO_EARLY: 425,
-	UPGRADE_REQUIRED: 426,
-	PRECONDITION_REQUIRED: 428,
-	TOO_MANY_REQUESTS: 429,
-	REQUEST_HEADER_FIELDS_TOO_LARGE: 431,
-	UNAVAILABLE_FOR_LEGAL_REASONS: 451,
-	INTERNAL_SERVER_ERROR: 500,
-	NOT_IMPLEMENTED: 501,
-	BAD_GATEWAY: 502,
-	SERVICE_UNAVAILABLE: 503,
-	GATEWAY_TIMEOUT: 504,
-	HTTP_VERSION_NOT_SUPPORTED: 505,
-	VARIANT_ALSO_NEGOTIATES: 506,
-	INSUFFICIENT_STORAGE: 507,
-	LOOP_DETECTED: 508,
-	NOT_EXTENDED: 510,
-	NETWORK_AUTHENTICATION_REQUIRED: 511
-};
-var InternalAPIError = class extends Error {
-	constructor(status = "INTERNAL_SERVER_ERROR", body = void 0, headers = {}, statusCode = typeof status === "number" ? status : statusCodes[status]) {
-		super(body?.message, body?.cause ? { cause: body.cause } : void 0);
-		this.status = status;
-		this.body = body;
-		this.headers = headers;
-		this.statusCode = statusCode;
-		this.name = "APIError";
-		this.status = status;
-		this.headers = headers;
-		this.statusCode = statusCode;
-		this.body = body;
-	}
-};
-var ValidationError$1 = class extends InternalAPIError {
-	constructor(message, issues) {
-		super(400, {
-			message,
-			code: "VALIDATION_ERROR"
-		});
-		this.message = message;
-		this.issues = issues;
-		this.issues = issues;
-	}
-};
-var BetterCallError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "BetterCallError";
-	}
-};
-var kAPIErrorHeaderSymbol = Symbol.for("better-call:api-error-headers");
-var APIError$1 = makeErrorForHideStackFrame(InternalAPIError, Error);
-var BetterAuthError = class extends Error {
-	constructor(message, options) {
-		super(message, options);
-		this.name = "BetterAuthError";
-		this.message = message;
-		this.stack = "";
-	}
-};
-var APIError = class APIError extends APIError$1 {
-	constructor(...args) {
-		super(...args);
-	}
-	static fromStatus(status, body) {
-		return new APIError(status, body);
-	}
-	static from(status, error) {
-		return new APIError(status, {
-			message: error.message,
-			code: error.code
-		});
-	}
-};
-var _envShim = Object.create(null);
-var _getEnv = (useShim) => globalThis.process?.env || globalThis.Deno?.env.toObject() || globalThis.__env__ || (useShim ? _envShim : globalThis);
-var env = new Proxy(_envShim, {
-	get(_, prop) {
-		return _getEnv()[prop] ?? _envShim[prop];
-	},
-	has(_, prop) {
-		return prop in _getEnv() || prop in _envShim;
-	},
-	set(_, prop, value) {
-		const env = _getEnv(true);
-		env[prop] = value;
-		return true;
-	},
-	deleteProperty(_, prop) {
-		if (!prop) return false;
-		const env = _getEnv(true);
-		delete env[prop];
-		return true;
-	},
-	ownKeys() {
-		const env = _getEnv(true);
-		return Object.keys(env);
-	}
-});
-function toBoolean(val) {
-	return val ? val !== "false" : false;
-}
-var nodeENV = env.NODE_ENV ?? "";
-/** Detect if `NODE_ENV` environment variable is `production` */
-var isProduction = nodeENV === "production";
-/** Detect if `NODE_ENV` environment variable is `dev` or `development` */
-var isDevelopment = () => nodeENV === "dev" || nodeENV === "development";
-/** Detect if `NODE_ENV` environment variable is `test` */
-var isTest = () => nodeENV === "test" || toBoolean(env.TEST);
-/**
-* Get environment variable with fallback
-*/
-function getEnvVar(key, fallback) {
-	if (typeof process !== "undefined" && process.env) return process.env[key] ?? fallback;
-	if (typeof Deno !== "undefined") return Deno.env.get(key) ?? fallback;
-	if (typeof Bun !== "undefined") return Bun.env[key] ?? fallback;
-	return fallback;
-}
-/**
-* Get boolean environment variable
-*/
-function getBooleanEnvVar(key, fallback = true) {
-	const value = getEnvVar(key);
-	if (!value) return fallback;
-	return value !== "0" && value.toLowerCase() !== "false" && value !== "";
-}
-/**
-* Common environment variables used in Better Auth
-*/
-var ENV = Object.freeze({
-	get BETTER_AUTH_SECRET() {
-		return getEnvVar("BETTER_AUTH_SECRET");
-	},
-	get AUTH_SECRET() {
-		return getEnvVar("AUTH_SECRET");
-	},
-	get BETTER_AUTH_TELEMETRY() {
-		return getEnvVar("BETTER_AUTH_TELEMETRY");
-	},
-	get BETTER_AUTH_TELEMETRY_ID() {
-		return getEnvVar("BETTER_AUTH_TELEMETRY_ID");
-	},
-	get NODE_ENV() {
-		return getEnvVar("NODE_ENV", "development");
-	},
-	get PACKAGE_VERSION() {
-		return getEnvVar("PACKAGE_VERSION", "0.0.0");
-	},
-	get BETTER_AUTH_TELEMETRY_ENDPOINT() {
-		return getEnvVar("BETTER_AUTH_TELEMETRY_ENDPOINT", "");
-	}
-});
-function capitalizeFirstLetter(str) {
-	return str.charAt(0).toUpperCase() + str.slice(1);
-}
-var WORD_PATTERN = /[\p{Ll}\d]+|\p{Lu}+(?!\p{Ll})|\p{Lu}[\p{Ll}\d]+|\p{Lo}+/gu;
-var APOSTROPHE_PATTERN = /['\u2019]/g;
-function splitWords(input) {
-	return input.replace(APOSTROPHE_PATTERN, "").match(WORD_PATTERN) ?? [];
-}
-function toKebabCase(input) {
-	return splitWords(input).map((word) => word.toLowerCase()).join("-");
-}
-/**
-* Escapes a character if it has a special meaning in regular expressions
-* and returns the character as is if it doesn't
-*/
-function escapeRegExpChar(char) {
-	if (char === "-" || char === "^" || char === "$" || char === "+" || char === "." || char === "(" || char === ")" || char === "|" || char === "[" || char === "]" || char === "{" || char === "}" || char === "*" || char === "?" || char === "\\") return `\\${char}`;
-	else return char;
-}
-/**
-* Escapes all characters in a given string that have a special meaning in regular expressions
-*/
-function escapeRegExpString(str) {
-	let result = "";
-	for (let i = 0; i < str.length; i++) result += escapeRegExpChar(str[i]);
-	return result;
-}
-/**
-* Transforms one or more glob patterns into a RegExp pattern
-*/
-function transform(pattern, separator = true) {
-	if (Array.isArray(pattern)) return `(?:${pattern.map((p) => `^${transform(p, separator)}$`).join("|")})`;
-	let separatorSplitter = "";
-	let separatorMatcher = "";
-	let wildcard = ".";
-	if (separator === true) {
-		separatorSplitter = "/";
-		separatorMatcher = "[/\\\\]";
-		wildcard = "[^/\\\\]";
-	} else if (separator) {
-		separatorSplitter = separator;
-		separatorMatcher = escapeRegExpString(separatorSplitter);
-		if (separatorMatcher.length > 1) {
-			separatorMatcher = `(?:${separatorMatcher})`;
-			wildcard = `((?!${separatorMatcher}).)`;
-		} else wildcard = `[^${separatorMatcher}]`;
-	}
-	const requiredSeparator = separator ? `${separatorMatcher}+?` : "";
-	const optionalSeparator = separator ? `${separatorMatcher}*?` : "";
-	const segments = separator ? pattern.split(separatorSplitter) : [pattern];
-	let result = "";
-	for (let s = 0; s < segments.length; s++) {
-		const segment = segments[s];
-		const nextSegment = segments[s + 1];
-		let currentSeparator = "";
-		if (!segment && s > 0) continue;
-		if (separator) if (s === segments.length - 1) currentSeparator = optionalSeparator;
-		else if (nextSegment !== "**") currentSeparator = requiredSeparator;
-		else currentSeparator = "";
-		if (separator && segment === "**") {
-			if (currentSeparator) {
-				result += s === 0 ? "" : currentSeparator;
-				result += `(?:${wildcard}*?${currentSeparator})*?`;
-			}
-			continue;
-		}
-		for (let c = 0; c < segment.length; c++) {
-			const char = segment[c];
-			if (char === "\\") {
-				if (c < segment.length - 1) {
-					result += escapeRegExpChar(segment[c + 1]);
-					c++;
-				}
-			} else if (char === "?") result += wildcard;
-			else if (char === "*") result += `${wildcard}*?`;
-			else result += escapeRegExpChar(char);
-		}
-		result += currentSeparator;
-	}
-	return result;
-}
-function isMatch(regexp, sample) {
-	if (typeof sample !== "string") throw new TypeError(`Sample must be a string, but ${typeof sample} given`);
-	return regexp.test(sample);
-}
-/**
-* Compiles one or more glob patterns into a RegExp and returns an isMatch function.
-* The isMatch function takes a sample string as its only argument and returns `true`
-* if the string matches the pattern(s).
-*
-* ```js
-* wildcardMatch('src/*.js')('src/index.js') //=> true
-* ```
-*
-* ```js
-* const isMatch = wildcardMatch('*.example.com', '.')
-* isMatch('foo.example.com') //=> true
-* isMatch('foo.bar.com') //=> false
-* ```
-*/
-function wildcardMatch(pattern, options) {
-	if (typeof pattern !== "string" && !Array.isArray(pattern)) throw new TypeError(`The first argument must be a single pattern string or an array of patterns, but ${typeof pattern} given`);
-	if (typeof options === "string" || typeof options === "boolean") options = { separator: options };
-	if (arguments.length === 2 && !(typeof options === "undefined" || typeof options === "object" && options !== null && !Array.isArray(options))) throw new TypeError(`The second argument must be an options object or a string/boolean separator, but ${typeof options} given`);
-	options = options || {};
-	if (options.separator === "\\") throw new Error("\\ is not a valid separator because it is used for escaping. Try setting the separator to `true` instead");
-	const regexpPattern = transform(pattern, options.separator);
-	const regexp = new RegExp(`^${regexpPattern}$`, options.flags);
-	const fn = isMatch.bind(null, regexp);
-	fn.options = options;
-	fn.pattern = pattern;
-	fn.regexp = regexp;
-	return fn;
-}
-var SLASH_CHAR_CODE = "/".charCodeAt(0);
-/**
-* Minimal loopback check for dev scheme inference only. Reachable from
-* `client/config.ts` via `getBaseURL`, so we MUST NOT import the full
-* `@better-auth/core/utils/host` classifier here: its `utils/ip` dependency
-* on zod would leak into the client bundle (see `e2e/smoke/test/vite.spec.ts`).
-*
-* Server-side SSRF/loopback checks (oauth redirect matching, trusted-origin
-* resolution, electron fetch gate) continue to use the authoritative
-* `isLoopbackHost` from `@better-auth/core/utils/host`. This helper's only
-* job is picking `http` vs `https` for dev ergonomics.
-*/
-function isLoopbackForDevScheme(host) {
-	const hostname = host.replace(/:\d+$/, "").replace(/^\[|\]$/g, "").toLowerCase();
-	return hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "::1" || hostname.startsWith("127.");
-}
-function trimTrailingSlashes(value) {
-	let end = value.length;
-	while (end > 0 && value.charCodeAt(end - 1) === SLASH_CHAR_CODE) end--;
-	return end === value.length ? value : value.slice(0, end);
-}
-function checkHasPath(url) {
-	try {
-		return (trimTrailingSlashes(new URL(url).pathname) || "/") !== "/";
-	} catch {
-		throw new BetterAuthError(`Invalid base URL: ${url}. Please provide a valid base URL.`);
-	}
-}
-function assertHasProtocol(url) {
-	try {
-		const parsedUrl = new URL(url);
-		if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") throw new BetterAuthError(`Invalid base URL: ${url}. URL must include 'http://' or 'https://'`);
-	} catch (error) {
-		if (error instanceof BetterAuthError) throw error;
-		throw new BetterAuthError(`Invalid base URL: ${url}. Please provide a valid base URL.`, { cause: error });
-	}
-}
-function withPath(url, path = "/api/auth") {
-	assertHasProtocol(url);
-	if (checkHasPath(url)) return url;
-	const trimmedUrl = trimTrailingSlashes(url);
-	if (!path || path === "/") return trimmedUrl;
-	path = path.startsWith("/") ? path : `/${path}`;
-	return `${trimmedUrl}${path}`;
-}
-function validateProxyHeader(header, type) {
-	if (!header || header.trim() === "") return false;
-	if (type === "proto") return header === "http" || header === "https";
-	if (type === "host") {
-		if ([
-			/\.\./,
-			/\0/,
-			/[\s]/,
-			/^[.]/,
-			/[<>'"]/,
-			/javascript:/i,
-			/file:/i,
-			/data:/i
-		].some((pattern) => pattern.test(header))) return false;
-		return /^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*(:[0-9]{1,5})?$/.test(header) || /^(\d{1,3}\.){3}\d{1,3}(:[0-9]{1,5})?$/.test(header) || /^\[[0-9a-fA-F:]+\](:[0-9]{1,5})?$/.test(header) || /^localhost(:[0-9]{1,5})?$/i.test(header);
-	}
-	return false;
-}
-function getBaseURL(url, path, request, loadEnv, trustedProxyHeaders) {
-	if (url) return withPath(url, path);
-	if (loadEnv !== false) {
-		const fromEnv = env.BETTER_AUTH_URL || env.NEXT_PUBLIC_BETTER_AUTH_URL || env.PUBLIC_BETTER_AUTH_URL || env.NUXT_PUBLIC_BETTER_AUTH_URL || env.NUXT_PUBLIC_AUTH_URL || (env.BASE_URL !== "/" ? env.BASE_URL : void 0);
-		if (fromEnv) return withPath(fromEnv, path);
-	}
-	const fromRequest = request?.headers.get("x-forwarded-host");
-	const fromRequestProto = request?.headers.get("x-forwarded-proto");
-	if (fromRequest && fromRequestProto && trustedProxyHeaders) {
-		if (validateProxyHeader(fromRequestProto, "proto") && validateProxyHeader(fromRequest, "host")) try {
-			return withPath(`${fromRequestProto}://${fromRequest}`, path);
-		} catch (_error) {}
-	}
-	if (request) {
-		const url = getOrigin(request.url);
-		if (!url) throw new BetterAuthError("Could not get origin from request. Please provide a valid base URL.");
-		return withPath(url, path);
-	}
-	if (typeof window !== "undefined" && window.location) return withPath(window.location.origin, path);
-}
-function getOrigin(url) {
-	try {
-		const parsedUrl = new URL(url);
-		return parsedUrl.origin === "null" ? null : parsedUrl.origin;
-	} catch {
-		return null;
-	}
-}
-function getProtocol(url) {
-	try {
-		return new URL(url).protocol;
-	} catch {
-		return null;
-	}
-}
-function getHost(url) {
-	try {
-		return new URL(url).host;
-	} catch {
-		return null;
-	}
-}
-/**
-* Checks if the baseURL config is a dynamic config object
-*/
-function isDynamicBaseURLConfig(config) {
-	return typeof config === "object" && config !== null && "allowedHosts" in config && Array.isArray(config.allowedHosts);
-}
-/**
-* Check if a value is a `Request`
-* - `instanceof`: works for native Request instances
-* - `toString`: handles where instanceof check fails but the object is still a
-*   valid Request (e.g. cross-realm, polyfills). Paired with a shape check so
-*   an object that only spoofs `Symbol.toStringTag` without the real shape is
-*   rejected before downstream code tries to read `.headers` / `.url`.
-*
-* @param value The value to check
-* @returns `true` if the value is a Request instance
-*/
-function isRequestLike(value) {
-	if (value instanceof Request) return true;
-	if (typeof value !== "object" || value === null || Object.prototype.toString.call(value) !== "[object Request]") return false;
-	const v = value;
-	return typeof v.url === "string" && typeof v.headers === "object" && v.headers !== null && typeof v.headers.get === "function";
-}
-/**
-* Extracts the host from a `Request` or `Headers`.
-* Honors `x-forwarded-host` only when `trustedProxyHeaders` is enabled,
-* then falls back to the `host` header and finally the request URL.
-*/
-function getHostFromSource(source, trustedProxyHeaders) {
-	const headers = isRequestLike(source) ? source.headers : source;
-	if (trustedProxyHeaders) {
-		const forwardedHost = headers.get("x-forwarded-host");
-		if (forwardedHost && validateProxyHeader(forwardedHost, "host")) return forwardedHost;
-	}
-	const host = headers.get("host");
-	if (host && validateProxyHeader(host, "host")) return host;
-	if (isRequestLike(source)) try {
-		return new URL(source.url).host;
-	} catch {
-		return null;
-	}
-	return null;
-}
-/**
-* Extracts the protocol from a `Request` or `Headers`.
-* Honors `x-forwarded-proto` only when `trustedProxyHeaders` is enabled,
-* then falls back to the request URL, then to "https".
-*/
-function getProtocolFromSource(source, configProtocol, trustedProxyHeaders) {
-	if (configProtocol === "http" || configProtocol === "https") return configProtocol;
-	const headers = isRequestLike(source) ? source.headers : source;
-	if (trustedProxyHeaders) {
-		const forwardedProto = headers.get("x-forwarded-proto");
-		if (forwardedProto && validateProxyHeader(forwardedProto, "proto")) return forwardedProto;
-	}
-	if (isRequestLike(source)) try {
-		const url = new URL(source.url);
-		if (url.protocol === "http:" || url.protocol === "https:") return url.protocol.slice(0, -1);
-	} catch {}
-	const host = getHostFromSource(source, trustedProxyHeaders);
-	if (host && isLoopbackForDevScheme(host)) return "http";
-	return "https";
-}
-/**
-* Matches a hostname against a host pattern.
-* Supports wildcard patterns like `*.vercel.app` or `preview-*.myapp.com`.
-*
-* @param host The hostname to test (e.g., "myapp.com", "preview-123.vercel.app")
-* @param pattern The host pattern (e.g., "myapp.com", "*.vercel.app")
-* @returns {boolean} true if the host matches the pattern, false otherwise.
-*
-* @example
-* ```ts
-* matchesHostPattern("myapp.com", "myapp.com") // true
-* matchesHostPattern("preview-123.vercel.app", "*.vercel.app") // true
-* matchesHostPattern("preview-123.myapp.com", "preview-*.myapp.com") // true
-* matchesHostPattern("evil.com", "myapp.com") // false
-* ```
-*/
-var matchesHostPattern = (host, pattern) => {
-	if (!host || !pattern) return false;
-	const normalizedHost = host.replace(/^https?:\/\//, "").split("/")[0].toLowerCase();
-	const normalizedPattern = pattern.replace(/^https?:\/\//, "").split("/")[0].toLowerCase();
-	if (normalizedPattern.includes("*") || normalizedPattern.includes("?")) return wildcardMatch(normalizedPattern)(normalizedHost);
-	return normalizedHost.toLowerCase() === normalizedPattern.toLowerCase();
-};
-/**
-* Resolves the base URL from a dynamic config based on the incoming request.
-* Validates the derived host against the allowedHosts allowlist.
-*
-* @param config The dynamic base URL config
-* @param request The incoming request
-* @param basePath The base path to append
-* @returns The resolved base URL with path
-* @throws BetterAuthError if host is not in allowedHosts and no fallback is set
-*/
-function resolveDynamicBaseURL(config, source, basePath, trustedProxyHeaders) {
-	const host = getHostFromSource(source, trustedProxyHeaders);
-	if (!host) {
-		if (config.fallback) return withPath(config.fallback, basePath);
-		throw new BetterAuthError("Could not determine host from request headers. Please provide a fallback URL in your baseURL config.");
-	}
-	if (config.allowedHosts.some((pattern) => matchesHostPattern(host, pattern))) return withPath(`${getProtocolFromSource(source, config.protocol, trustedProxyHeaders)}://${host}`, basePath);
-	if (config.fallback) return withPath(config.fallback, basePath);
-	throw new BetterAuthError(`Host "${host}" is not in the allowed hosts list. Allowed hosts: ${config.allowedHosts.join(", ")}. Add this host to your allowedHosts config or provide a fallback URL.`);
-}
-/**
-* Resolves the base URL from any config type (static string or dynamic object).
-* This is the main entry point for base URL resolution.
-*
-* @param config The base URL config (string or object)
-* @param basePath The base path to append
-* @param request Optional request for dynamic resolution
-* @param loadEnv Whether to load from environment variables
-* @param trustedProxyHeaders Whether to trust proxy headers (for legacy behavior)
-* @returns The resolved base URL with path
-*/
-function resolveBaseURL(config, basePath, source, loadEnv, trustedProxyHeaders) {
-	if (isDynamicBaseURLConfig(config)) {
-		if (source) return resolveDynamicBaseURL(config, source, basePath, trustedProxyHeaders);
-		if (config.fallback) return withPath(config.fallback, basePath);
-		return getBaseURL(void 0, basePath, void 0, loadEnv, trustedProxyHeaders);
-	}
-	const request = isRequestLike(source) ? source : void 0;
-	if (typeof config === "string") return getBaseURL(config, basePath, request, loadEnv, trustedProxyHeaders);
-	return getBaseURL(void 0, basePath, request, loadEnv, trustedProxyHeaders);
-}
-/**
-* Normalizes a request pathname by removing the basePath prefix and trailing slashes.
-* This is useful for matching paths against configured path lists.
-*
-* @param requestUrl - The full request URL
-* @param basePath - The base path of the auth API (e.g., "/api/auth")
-* @returns The normalized path without basePath prefix or trailing slashes,
-*          or "/" if URL parsing fails
-*
-* @example
-* normalizePathname("http://localhost:3000/api/auth/sso/saml2/callback/provider1", "/api/auth")
-* // Returns: "/sso/saml2/callback/provider1"
-*
-* normalizePathname("http://localhost:3000/sso/saml2/callback/provider1/", "/")
-* // Returns: "/sso/saml2/callback/provider1"
-*/
-function normalizePathname(requestUrl, basePath) {
-	let pathname;
-	try {
-		pathname = new URL(requestUrl).pathname.replace(/\/+$/, "") || "/";
-	} catch {
-		return "/";
-	}
-	const normalizedBasePath = basePath.replace(/\/+$/, "");
-	if (normalizedBasePath === "") return pathname;
-	if (pathname === normalizedBasePath) return "/";
-	if (pathname.startsWith(normalizedBasePath + "/")) return pathname.slice(normalizedBasePath.length).replace(/\/+$/, "") || "/";
-	return pathname;
-}
-/**
-* Schemes that execute or embed code when navigated to or accepted as a
-* redirect target. These are never safe as an OAuth `redirect_uri` or as a
-* client-side navigation target (`window.location.href`, `location.assign`, ...).
-*/
-var DANGEROUS_URL_SCHEMES = [
-	"javascript:",
-	"data:",
-	"vbscript:"
-];
-/**
-* Returns `false` only when `value` is an absolute URL using a dangerous scheme
-* (`javascript:`, `data:`, `vbscript:`). Relative URLs (e.g. `/dashboard`) and
-* safe absolute schemes (`http`, `https`, custom app schemes such as
-* `myapp://`) return `true`.
-*
-* Use this to guard browser navigation sinks and any redirect target that may
-* originate from untrusted input. It is intentionally narrow: it blocks code
-* execution schemes without rejecting relative paths or mobile deep links.
-*/
-function isSafeUrlScheme(value) {
-	let parsed;
-	try {
-		parsed = new URL(value);
-	} catch {
-		return true;
-	}
-	return !DANGEROUS_URL_SCHEMES.includes(parsed.protocol);
-}
-function isPlainObject(value) {
-	if (value === null || typeof value !== "object") return false;
-	const prototype = Object.getPrototypeOf(value);
-	if (prototype !== null && prototype !== Object.prototype && Object.getPrototypeOf(prototype) !== null) return false;
-	if (Symbol.iterator in value) return false;
-	if (Symbol.toStringTag in value) return Object.prototype.toString.call(value) === "[object Module]";
-	return true;
-}
-function _defu(baseObject, defaults, namespace = ".", merger) {
-	if (!isPlainObject(defaults)) return _defu(baseObject, {}, namespace, merger);
-	const object = { ...defaults };
-	for (const key of Object.keys(baseObject)) {
-		if (key === "__proto__" || key === "constructor") continue;
-		const value = baseObject[key];
-		if (value === null || value === void 0) continue;
-		if (merger && merger(object, key, value, namespace)) continue;
-		if (Array.isArray(value) && Array.isArray(object[key])) object[key] = [...value, ...object[key]];
-		else if (isPlainObject(value) && isPlainObject(object[key])) object[key] = _defu(value, object[key], (namespace ? `${namespace}.` : "") + key.toString(), merger);
-		else object[key] = value;
-	}
-	return object;
-}
-function createDefu(merger) {
-	return (...arguments_) => arguments_.reduce((p, c) => _defu(p, c, "", merger), {});
-}
-var defu = createDefu();
 var __defProp = Object.defineProperty;
-var __defProps = Object.defineProperties;
-var __getOwnPropDescs = Object.getOwnPropertyDescriptors;
-var __getOwnPropSymbols = Object.getOwnPropertySymbols;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __propIsEnum = Object.prototype.propertyIsEnumerable;
-var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, {
-	enumerable: true,
-	configurable: true,
-	writable: true,
-	value
-}) : obj[key] = value;
-var __spreadValues = (a, b) => {
-	for (var prop in b || (b = {})) if (__hasOwnProp.call(b, prop)) __defNormalProp(a, prop, b[prop]);
-	if (__getOwnPropSymbols) {
-		for (var prop of __getOwnPropSymbols(b)) if (__propIsEnum.call(b, prop)) __defNormalProp(a, prop, b[prop]);
-	}
-	return a;
-};
-var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
-var BetterFetchError = class extends Error {
-	constructor(status, statusText, error) {
-		super(statusText || status.toString(), { cause: error });
-		this.status = status;
-		this.statusText = statusText;
-		this.error = error;
-		Error.captureStackTrace(this, this.constructor);
-	}
-};
-var initializePlugins = async (url, options) => {
-	var _a, _b, _c, _d, _e, _f;
-	let opts = options || {};
-	const hooks = {
-		onRequest: [options == null ? void 0 : options.onRequest],
-		onResponse: [options == null ? void 0 : options.onResponse],
-		onSuccess: [options == null ? void 0 : options.onSuccess],
-		onError: [options == null ? void 0 : options.onError],
-		onRetry: [options == null ? void 0 : options.onRetry]
-	};
-	if (!options || !(options == null ? void 0 : options.plugins)) return {
-		url,
-		options: opts,
-		hooks
-	};
-	for (const plugin of (options == null ? void 0 : options.plugins) || []) {
-		if (plugin.init) {
-			const pluginRes = await ((_a = plugin.init) == null ? void 0 : _a.call(plugin, url.toString(), options));
-			opts = pluginRes.options || opts;
-			url = pluginRes.url;
-		}
-		hooks.onRequest.push((_b = plugin.hooks) == null ? void 0 : _b.onRequest);
-		hooks.onResponse.push((_c = plugin.hooks) == null ? void 0 : _c.onResponse);
-		hooks.onSuccess.push((_d = plugin.hooks) == null ? void 0 : _d.onSuccess);
-		hooks.onError.push((_e = plugin.hooks) == null ? void 0 : _e.onError);
-		hooks.onRetry.push((_f = plugin.hooks) == null ? void 0 : _f.onRetry);
-	}
-	return {
-		url,
-		options: opts,
-		hooks
-	};
-};
-var LinearRetryStrategy = class {
-	constructor(options) {
-		this.options = options;
-	}
-	shouldAttemptRetry(attempt, response) {
-		if (this.options.shouldRetry) return Promise.resolve(attempt < this.options.attempts && this.options.shouldRetry(response));
-		return Promise.resolve(attempt < this.options.attempts);
-	}
-	getDelay() {
-		return this.options.delay;
-	}
-};
-var ExponentialRetryStrategy = class {
-	constructor(options) {
-		this.options = options;
-	}
-	shouldAttemptRetry(attempt, response) {
-		if (this.options.shouldRetry) return Promise.resolve(attempt < this.options.attempts && this.options.shouldRetry(response));
-		return Promise.resolve(attempt < this.options.attempts);
-	}
-	getDelay(attempt) {
-		return Math.min(this.options.maxDelay, this.options.baseDelay * 2 ** attempt);
-	}
-};
-function createRetryStrategy(options) {
-	if (typeof options === "number") return new LinearRetryStrategy({
-		type: "linear",
-		attempts: options,
-		delay: 1e3
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
 	});
-	switch (options.type) {
-		case "linear": return new LinearRetryStrategy(options);
-		case "exponential": return new ExponentialRetryStrategy(options);
-		default: throw new Error("Invalid retry strategy");
-	}
-}
-var getAuthHeader = async (options) => {
-	const headers = {};
-	const getValue = async (value) => typeof value === "function" ? await value() : value;
-	if (options == null ? void 0 : options.auth) {
-		if (options.auth.type === "Bearer") {
-			const token = await getValue(options.auth.token);
-			if (!token) return headers;
-			headers["authorization"] = `Bearer ${token}`;
-		} else if (options.auth.type === "Basic") {
-			const [username, password] = await Promise.all([getValue(options.auth.username), getValue(options.auth.password)]);
-			if (!username || !password) return headers;
-			headers["authorization"] = `Basic ${btoa(`${username}:${password}`)}`;
-		} else if (options.auth.type === "Custom") {
-			const [prefix, value] = await Promise.all([getValue(options.auth.prefix), getValue(options.auth.value)]);
-			if (!value) return headers;
-			headers["authorization"] = `${prefix != null ? prefix : ""} ${value}`;
-		}
-	}
-	return headers;
-};
-var JSON_RE = /^application\/(?:[\w!#$%&*.^`~-]*\+)?json(;.+)?$/i;
-function detectResponseType(request) {
-	const _contentType = request.headers.get("content-type");
-	const textTypes = /* @__PURE__ */ new Set([
-		"image/svg",
-		"application/xml",
-		"application/xhtml",
-		"application/html"
-	]);
-	if (!_contentType) return "json";
-	const contentType = _contentType.split(";").shift() || "";
-	if (JSON_RE.test(contentType)) return "json";
-	if (textTypes.has(contentType) || contentType.startsWith("text/")) return "text";
-	return "blob";
-}
-function isJSONParsable(value) {
-	try {
-		JSON.parse(value);
-		return true;
-	} catch (error) {
-		return false;
-	}
-}
-function isJSONSerializable(value) {
-	if (value === void 0) return false;
-	const t = typeof value;
-	if (t === "string" || t === "number" || t === "boolean" || t === null) return true;
-	if (t !== "object") return false;
-	if (Array.isArray(value)) return true;
-	if (value.buffer) return false;
-	return value.constructor && value.constructor.name === "Object" || typeof value.toJSON === "function";
-}
-function jsonParse(text) {
-	try {
-		return JSON.parse(text);
-	} catch (error) {
-		return text;
-	}
-}
-function isFunction(value) {
-	return typeof value === "function";
-}
-function getFetch(options) {
-	if (options == null ? void 0 : options.customFetchImpl) return options.customFetchImpl;
-	if (typeof globalThis !== "undefined" && isFunction(globalThis.fetch)) return globalThis.fetch;
-	if (typeof window !== "undefined" && isFunction(window.fetch)) return window.fetch;
-	throw new Error("No fetch implementation found");
-}
-function mergeHeaders(...sources) {
-	const merged = {};
-	for (const source of sources) {
-		if (!source) continue;
-		if (source instanceof Headers) source.forEach((value, key) => {
-			merged[key] = value;
-		});
-		else {
-			const entries = Array.isArray(source) ? source : Object.entries(source);
-			for (const [key, value] of entries) if (value !== null && value !== void 0) merged[key] = value;
-		}
-	}
-	return merged;
-}
-async function getHeaders(opts) {
-	const headers = new Headers(mergeHeaders(opts == null ? void 0 : opts.headers, await getAuthHeader(opts)));
-	if (!headers.has("content-type")) {
-		const contentType = detectContentType(opts == null ? void 0 : opts.body);
-		if (contentType) headers.set("content-type", contentType);
-	}
-	return headers;
-}
-function detectContentType(body) {
-	if (isJSONSerializable(body)) return "application/json";
-	return null;
-}
-function getMediaType(headers) {
-	const contentType = headers.get("content-type");
-	return contentType ? contentType.split(";")[0].trim().toLowerCase() : null;
-}
-function getBody(options, headers) {
-	const { body } = options;
-	if (!body) return null;
-	if (!isJSONSerializable(body)) return body;
-	if (typeof body === "string") return body;
-	if (getMediaType(headers) === "application/x-www-form-urlencoded") return new URLSearchParams(body).toString();
-	return JSON.stringify(body);
-}
-function getMethod(url, options) {
-	var _a;
-	if (options == null ? void 0 : options.method) return options.method.toUpperCase();
-	if (url.startsWith("@")) {
-		const pMethod = (_a = url.split("@")[1]) == null ? void 0 : _a.split("/")[0];
-		if (!methods.includes(pMethod)) return (options == null ? void 0 : options.body) ? "POST" : "GET";
-		return pMethod.toUpperCase();
-	}
-	return (options == null ? void 0 : options.body) ? "POST" : "GET";
-}
-function getTimeout(options, controller) {
-	let abortTimeout;
-	if (!(options == null ? void 0 : options.signal) && (options == null ? void 0 : options.timeout)) abortTimeout = setTimeout(() => controller == null ? void 0 : controller.abort(), options == null ? void 0 : options.timeout);
-	return {
-		abortTimeout,
-		clearTimeout: () => {
-			if (abortTimeout) clearTimeout(abortTimeout);
-		}
-	};
-}
-var ValidationError = class _ValidationError extends Error {
-	constructor(issues, message) {
-		super(message || JSON.stringify(issues, null, 2));
-		this.issues = issues;
-		Object.setPrototypeOf(this, _ValidationError.prototype);
-	}
-};
-async function parseStandardSchema(schema, input) {
-	const result = await schema["~standard"].validate(input);
-	if (result.issues) throw new ValidationError(result.issues);
-	return result.value;
-}
-var methods = [
-	"get",
-	"post",
-	"put",
-	"patch",
-	"delete"
-];
-var applySchemaPlugin = (config) => ({
-	id: "apply-schema",
-	name: "Apply Schema",
-	version: "1.0.0",
-	async init(url, options) {
-		var _a, _b, _c, _d;
-		const schema = ((_b = (_a = config.plugins) == null ? void 0 : _a.find((plugin) => {
-			var _a2;
-			return ((_a2 = plugin.schema) == null ? void 0 : _a2.config) ? url.startsWith(plugin.schema.config.baseURL || "") || url.startsWith(plugin.schema.config.prefix || "") : false;
-		})) == null ? void 0 : _b.schema) || config.schema;
-		if (schema) {
-			let urlKey = url;
-			if ((_c = schema.config) == null ? void 0 : _c.prefix) {
-				if (urlKey.startsWith(schema.config.prefix)) {
-					urlKey = urlKey.replace(schema.config.prefix, "");
-					if (schema.config.baseURL) url = url.replace(schema.config.prefix, schema.config.baseURL);
-				}
-			}
-			if ((_d = schema.config) == null ? void 0 : _d.baseURL) {
-				if (urlKey.startsWith(schema.config.baseURL)) urlKey = urlKey.replace(schema.config.baseURL, "");
-			}
-			if (urlKey.startsWith("/") && urlKey.charAt(1) === "@") urlKey = urlKey.substring(1);
-			const keySchema = schema.schema[urlKey];
-			if (keySchema) {
-				let validatedHeaders = options == null ? void 0 : options.headers;
-				if (keySchema.headers && !(options == null ? void 0 : options.disableValidation)) {
-					const normalizedHeaders = {};
-					if (options == null ? void 0 : options.headers) {
-						if (options.headers instanceof Headers) options.headers.forEach((value, key) => {
-							normalizedHeaders[key.toLowerCase()] = value;
-						});
-						else if (typeof options.headers === "object") {
-							for (const [key, value] of Object.entries(options.headers)) if (value !== null && value !== void 0) normalizedHeaders[key.toLowerCase()] = value;
-						}
-					}
-					const validated = await parseStandardSchema(keySchema.headers, normalizedHeaders);
-					const finalHeaders = {};
-					for (const [key, value] of Object.entries(validated)) finalHeaders[key.toLowerCase()] = value;
-					validatedHeaders = finalHeaders;
-				}
-				let opts = __spreadProps(__spreadValues({}, options), {
-					method: keySchema.method,
-					output: keySchema.output,
-					headers: validatedHeaders
-				});
-				if (!(options == null ? void 0 : options.disableValidation)) opts = __spreadProps(__spreadValues({}, opts), {
-					body: keySchema.input ? await parseStandardSchema(keySchema.input, options == null ? void 0 : options.body) : options == null ? void 0 : options.body,
-					params: keySchema.params ? await parseStandardSchema(keySchema.params, options == null ? void 0 : options.params) : options == null ? void 0 : options.params,
-					query: keySchema.query ? await parseStandardSchema(keySchema.query, options == null ? void 0 : options.query) : options == null ? void 0 : options.query
-				});
-				return {
-					url,
-					options: opts
-				};
-			}
-		}
-		return {
-			url,
-			options
-		};
-	}
-});
-var createFetch = (config) => {
-	async function $fetch(url, options) {
-		const opts = __spreadProps(__spreadValues(__spreadValues({}, config), options), {
-			headers: mergeHeaders(config == null ? void 0 : config.headers, options == null ? void 0 : options.headers),
-			plugins: [
-				...(config == null ? void 0 : config.plugins) || [],
-				applySchemaPlugin(config || {}),
-				...(options == null ? void 0 : options.plugins) || []
-			]
-		});
-		if (config == null ? void 0 : config.catchAllError) try {
-			return await betterFetch(url, opts);
-		} catch (error) {
-			return {
-				data: null,
-				error: {
-					status: 500,
-					statusText: "Fetch Error",
-					message: "Fetch related error. Captured by catchAllError option. See error property for more details.",
-					error
-				}
-			};
-		}
-		return await betterFetch(url, opts);
-	}
-	return $fetch;
-};
-var isReservedPathSegment = (value) => value === "." || value === "..";
-function encodePathSegment(segment, pathParams) {
-	let pathSegment = segment;
-	for (const [key, value] of pathParams) pathSegment = pathSegment.replace(key, value);
-	if (isReservedPathSegment(pathSegment)) throw new TypeError("Path parameters cannot be reserved path segments");
-	return encodeURIComponent(pathSegment);
-}
-function getURL2(url, option) {
-	const { baseURL, params, query } = option || {
-		query: {},
-		params: {},
-		baseURL: ""
-	};
-	let basePath = url.startsWith("http") ? url.split("/").slice(0, 3).join("/") : baseURL || "";
-	if (url.startsWith("@")) {
-		const m = url.toString().split("@")[1].split("/")[0];
-		if (methods.includes(m)) url = url.replace(`@${m}/`, "/");
-	}
-	if (!basePath.endsWith("/")) basePath += "/";
-	let [path, urlQuery] = url.replace(basePath, "").split("?");
-	const queryParams = new URLSearchParams(urlQuery);
-	for (const [key, value] of Object.entries(query || {})) {
-		if (value == null) continue;
-		let serializedValue;
-		if (typeof value === "string") serializedValue = value;
-		else if (Array.isArray(value)) {
-			for (const val of value) queryParams.append(key, val);
-			continue;
-		} else serializedValue = JSON.stringify(value);
-		queryParams.set(key, serializedValue);
-	}
-	const pathParams = /* @__PURE__ */ new Map();
-	if (params) if (Array.isArray(params)) {
-		const paramPaths = path.split("/").filter((p) => p.startsWith(":"));
-		for (const [index, key] of paramPaths.entries()) {
-			const value = params[index];
-			pathParams.set(key, String(value));
-		}
-	} else for (const [key, value] of Object.entries(params)) pathParams.set(`:${key}`, String(value));
-	path = path.split("/").map((segment) => encodePathSegment(segment, pathParams)).join("/");
-	path = path.replace(/^\/+/, "");
-	let queryParamString = queryParams.toString();
-	queryParamString = queryParamString.length > 0 ? `?${queryParamString}`.replace(/\+/g, "%20") : "";
-	if (!basePath.startsWith("http")) return `${basePath}${path}${queryParamString}`;
-	return new URL(`${path}${queryParamString}`, basePath);
-}
-var betterFetch = async (url, options) => {
-	var _a, _b, _c, _d, _e, _f, _g, _h;
-	const { hooks, url: __url, options: opts } = await initializePlugins(url, options);
-	const fetch = getFetch(opts);
-	const controller = new AbortController();
-	const signal = (_a = opts.signal) != null ? _a : controller.signal;
-	const _url = getURL2(__url, opts);
-	const headers = await getHeaders(opts);
-	const body = getBody(opts, headers);
-	const method = getMethod(__url, opts);
-	const context = __spreadProps(__spreadValues({}, opts), {
-		url: _url,
-		headers,
-		body,
-		method,
-		signal
-	});
-	for (const onRequest of hooks.onRequest) if (onRequest) {
-		const res = await onRequest(context);
-		if (typeof res === "object" && res !== null) Object.assign(context, res);
-	}
-	if ("pipeTo" in context && typeof context.pipeTo === "function" || typeof ((_b = options == null ? void 0 : options.body) == null ? void 0 : _b.pipe) === "function") {
-		if (!("duplex" in context)) context.duplex = "half";
-	}
-	const { clearTimeout: clearTimeout2 } = getTimeout(opts, controller);
-	let response = await fetch(context.url, context);
-	clearTimeout2();
-	const responseContext = {
-		response,
-		request: context
-	};
-	for (const onResponse of hooks.onResponse) if (onResponse) {
-		const r = await onResponse(__spreadProps(__spreadValues({}, responseContext), { response: ((_c = options == null ? void 0 : options.hookOptions) == null ? void 0 : _c.cloneResponse) ? response.clone() : response }));
-		if (r instanceof Response) response = r;
-		else if (typeof r === "object" && r !== null) response = r.response;
-	}
-	if (response.ok) {
-		if (!(context.method !== "HEAD")) return {
-			data: "",
-			error: null
-		};
-		const responseType = detectResponseType(response);
-		const successContext = {
-			data: null,
-			response,
-			request: context
-		};
-		if (responseType === "json" || responseType === "text") {
-			const text = await response.text();
-			successContext.data = await ((_d = context.jsonParser) != null ? _d : jsonParse)(text);
-		} else successContext.data = await response[responseType]();
-		if (context == null ? void 0 : context.output) {
-			if (context.output && !context.disableValidation) successContext.data = await parseStandardSchema(context.output, successContext.data);
-		}
-		for (const onSuccess of hooks.onSuccess) if (onSuccess) await onSuccess(__spreadProps(__spreadValues({}, successContext), { response: ((_e = options == null ? void 0 : options.hookOptions) == null ? void 0 : _e.cloneResponse) ? response.clone() : response }));
-		if (options == null ? void 0 : options.throw) return successContext.data;
-		return {
-			data: successContext.data,
-			error: null
-		};
-	}
-	const parser = (_f = options == null ? void 0 : options.jsonParser) != null ? _f : jsonParse;
-	const responseText = await response.text();
-	const isJSONResponse = isJSONParsable(responseText);
-	const errorObject = isJSONResponse ? await parser(responseText) : null;
-	const errorContext = {
-		response,
-		responseText,
-		request: context,
-		error: __spreadProps(__spreadValues({}, errorObject), {
-			status: response.status,
-			statusText: response.statusText
-		})
-	};
-	for (const onError of hooks.onError) if (onError) await onError(__spreadProps(__spreadValues({}, errorContext), { response: ((_g = options == null ? void 0 : options.hookOptions) == null ? void 0 : _g.cloneResponse) ? response.clone() : response }));
-	if (options == null ? void 0 : options.retry) {
-		const retryStrategy = createRetryStrategy(options.retry);
-		const _retryAttempt = (_h = options.retryAttempt) != null ? _h : 0;
-		if (await retryStrategy.shouldAttemptRetry(_retryAttempt, response)) {
-			for (const onRetry of hooks.onRetry) if (onRetry) await onRetry(responseContext);
-			const delay = retryStrategy.getDelay(_retryAttempt);
-			await new Promise((resolve) => setTimeout(resolve, delay));
-			return await betterFetch(url, __spreadProps(__spreadValues({}, options), { retryAttempt: _retryAttempt + 1 }));
-		}
-	}
-	if (options == null ? void 0 : options.throw) throw new BetterFetchError(response.status, response.statusText, isJSONResponse ? errorObject : responseText);
-	return {
-		data: null,
-		error: __spreadProps(__spreadValues({}, errorObject), {
-			status: response.status,
-			statusText: response.statusText
-		})
-	};
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
 };
 /**
-* Pievo server data directory — server-side file state, and (for the embedded
-* pglite tier) the on-disk Postgres data dir at `<dataDir>/pgdata`. Locally it
-* defaults to `~/.pievo`. Override with `PIEVO_DATA_DIR`. A hosted-Postgres tier
-* still uses `<dataDir>/blobs` unless R2 is configured.
+* Server data directory: the embedded database (`pgdata/`), artifact bytes
+* (`blobs/`), and the launcher's pid/lock/log files. Kept apart from the
+* daemon's `~/.pievo` so a device running both never mixes their state.
+* Override with `PIEVO_DATA_DIR` (absolute; `~` is not expanded).
 */
 function dataDir() {
-	return process.env.PIEVO_DATA_DIR?.trim() || path.join(os.homedir(), ".pievo");
-}
-/**
-* Supabase (or any Postgres) connection string for the RUNTIME app process. When
-* set, the server uses the postgres-js driver (hosted prod/staging). Pool options
-* are MODE-AWARE (`db/poolOptions.ts`): a Supabase TRANSACTION pooler URL
-* (`:6543`) gets `prepare:false`; a SESSION pooler / direct URL (`:5432`) gets
-* `prepare:true` (backend pinned per connection — safe and faster). Either form
-* is supported; `dbPoolMode()` below overrides the port-based detection.
-* When UNSET, the server falls back to the embedded, file-backed pglite database
-* at `<dataDir>/pgdata` (local dev + light self-host + tests) — zero external DB.
-*/
-function databaseUrl() {
-	return process.env.DATABASE_URL?.trim() || void 0;
-}
-/**
-* Explicit pool-mode override for the runtime postgres-js pool
-* (`PIEVO_DB_POOL_MODE=transaction|session`). Normally UNSET — the mode is
-* detected from `DATABASE_URL`'s port (`:6543` ⇒ transaction pooler; see
-* `db/poolOptions.ts` `isTransactionPooler`). This is the escape hatch for a
-* NONSTANDARD-PORT or self-hosted pooler the port heuristic can't classify.
-* Getting it wrong on a real transaction pooler (`session` when the pooler is
-* transaction-mode) re-arms the prepared-statement breakage the detection
-* exists to prevent — set it only when you know the pooler's mode.
-*/
-function dbPoolMode() {
-	const raw = process.env.PIEVO_DB_POOL_MODE?.trim().toLowerCase();
-	if (raw === "transaction" || raw === "session") return raw;
-}
-function r2Config() {
-	const accountId = process.env.PIEVO_R2_ACCOUNT_ID?.trim();
-	const bucket = process.env.PIEVO_R2_BUCKET?.trim();
-	const accessKeyId = process.env.PIEVO_R2_ACCESS_KEY_ID?.trim();
-	const secretAccessKey = process.env.PIEVO_R2_SECRET_ACCESS_KEY?.trim();
-	const explicitEndpoint = process.env.PIEVO_R2_ENDPOINT?.trim();
-	const region = process.env.PIEVO_R2_REGION?.trim();
-	const endpoint = explicitEndpoint || (accountId ? `https://${accountId}.r2.cloudflarestorage.com` : void 0);
-	if (!!!(accountId || bucket || accessKeyId || secretAccessKey || explicitEndpoint || region)) return null;
-	const missing = [
-		!bucket && "PIEVO_R2_BUCKET",
-		!accessKeyId && "PIEVO_R2_ACCESS_KEY_ID",
-		!secretAccessKey && "PIEVO_R2_SECRET_ACCESS_KEY",
-		!endpoint && "PIEVO_R2_ACCOUNT_ID or PIEVO_R2_ENDPOINT"
-	].filter(Boolean);
-	if (missing.length) throw new Error(`incomplete R2 configuration — missing ${missing.join(", ")}`);
-	return {
-		bucket,
-		endpoint,
-		accessKeyId,
-		secretAccessKey,
-		region: region || "auto"
-	};
-}
-/**
-* Artifact-storage retention / GC knobs (see gateway/retention.ts). Read lazily
-* from env at call time (not at module load) so tests can set them per-case and
-* a deploy can tune them without a rebuild. Each has a safe, generous default —
-* the bias is "keep storage bounded without ever surprising a healthy loop".
-*/
-function posIntEnv(name, fallback) {
-	const raw = process.env[name]?.trim();
-	if (!raw) return fallback;
-	const n = Number(raw);
-	return Number.isFinite(n) && n > 0 ? Math.floor(n) : fallback;
-}
-/**
-* How many of the most recent run snapshots to keep per loop. Older ones are
-* pruned (their now-unreferenced blobs then become GC-collectable). The per-run
-* diff only needs the immediately-prior snapshot, so 20 keeps ample history for
-* the "Changes" view while bounding the table + blob retention. Default 20.
-*/
-function snapshotRetention() {
-	return posIntEnv("PIEVO_SNAPSHOT_RETENTION", 20);
-}
-/**
-* GC grace window: a blob whose metadata row is younger than this is NEVER
-* collected, even if currently unreferenced. This is the concurrency guard —
-* a blob a sync just wrote (and is about to reference) can't be swept out from
-* under it. Generous default (1h) since a leaked blob is only a cost bug that
-* the next GC pass reclaims anyway. Default 3,600,000ms (1 hour).
-*/
-function blobGcGraceMs() {
-	return posIntEnv("PIEVO_BLOB_GC_GRACE_MS", 3600 * 1e3);
-}
-/**
-* How often the periodic storage-maintenance pass runs (prune snapshots → GC
-* blobs). Default 15 minutes. Kept independent of the faster offline-sweep tick.
-*/
-function gcIntervalMs() {
-	return posIntEnv("PIEVO_GC_INTERVAL_MS", 900 * 1e3);
-}
-/**
-* DB watchdog (`server/dbWatchdog.ts`) — the ACTUAL auto-recovery backstop for a
-* wedged postgres-js pool. Fly's `[http_service.checks]` failing only pulls the
-* machine from load balancing; it never restarts the VM (the 2026-07-12 outage:
-* the pool wedged, `/api/health/db` hung, the check went critical, and the box
-* stayed down ~9h with no auto-restart). The watchdog turns a HANG into a process
-* EXIT so Fly's `restart.policy = "on-failure"` kicks in with a fresh pool.
-*
-* Enabled by default ONLY on the hosted postgres tier (a wedged transaction-pooler
-* connection is the failure mode); OFF for the embedded pglite tier and under
-* vitest (a test must never `process.exit`). Force either way with
-* `PIEVO_DB_WATCHDOG=on|off`.
-*/
-function dbWatchdogEnabled() {
-	const raw = process.env.PIEVO_DB_WATCHDOG?.trim().toLowerCase();
-	if (raw === "on") return true;
-	if (raw === "off") return false;
-	if (process.env.VITEST || false) return false;
-	return Boolean(databaseUrl());
-}
-function dbWatchdogIntervalMs() {
-	return posIntEnv("PIEVO_DB_WATCHDOG_INTERVAL_MS", 2e4);
-}
-function dbWatchdogTimeoutMs() {
-	return posIntEnv("PIEVO_DB_WATCHDOG_TIMEOUT_MS", 5e3);
-}
-/**
-* Consecutive failed/timed-out pings before the watchdog exits the process. A
-* healthy ping resets the counter, so this only trips on a SUSTAINED wedge — a
-* brief blip never restarts the box. Default 3 (≈60-75s to detect at 20s cadence).
-*/
-function dbWatchdogFailureThreshold() {
-	return posIntEnv("PIEVO_DB_WATCHDOG_FAILURES", 3);
+	return process.env.PIEVO_DATA_DIR?.trim() || path.join(os.homedir(), ".pievo-server");
 }
 /**
-* Uses pino-pretty as a *synchronous* destination stream (not a worker-thread
-* transport) so logs flush before process.exit() in the one-shot CLIs. Writes to
-* stderr (fd 2) to keep stdout clean for QR codes and human CLI output.
-*/
-var level = (process.env.PIEVO_LOG_LEVEL || "info").toLowerCase();
-var stream = (0, import_pino_pretty.default)({
-	destination: 2,
-	colorize: true,
-	translateTime: "SYS:HH:MM:ss",
-	ignore: "pid,hostname"
-});
-var logger = (0, import_pino.default)({ level }, stream);
-/**
-* Pure pool-option derivation for the hosted postgres-js tier. LEAF module by
-* design: no env reads, no DB opens — `db/index.ts` supplies the URL (and the
-* optional `PIEVO_DB_POOL_MODE` override via `env.ts`), tests import this
-* directly without booting a database.
-*/
-/**
-* Whether `url` points at a pgBouncer/Supavisor TRANSACTION pooler. Detection
-* is by the conventional port `:6543` (Supabase's transaction-mode port).
-*
-* Why it matters: postgres-js pipelines queries and caches prepared statements
-* per connection, but a transaction pooler reassigns the backend connection per
-* transaction, which both breaks cached prepared statements and is implicated
-* in the pool-wedge failure mode (porsager/postgres#970). Session mode (:5432)
-* pins one backend per client connection, so neither problem exists there.
-*
-* LIMITATION: a nonstandard-port or self-hosted transaction pooler will NOT be
-* detected here — set `PIEVO_DB_POOL_MODE=transaction` (see `env.ts`
-* `dbPoolMode`) to override. Getting that wrong on a real transaction pooler
-* re-arms the prepared-statement breakage.
-*/
-function isTransactionPooler(url) {
-	try {
-		return new URL(url).port === "6543";
-	} catch {
-		return false;
-	}
-}
+* A blob whose metadata row is younger than this is never collected, so a
+* sync that just wrote a blob can still reference it. A leaked blob is only a
+* storage cost that the next pass reclaims. 1 hour.
+*/
+var BLOB_GC_GRACE_MS = 3600 * 1e3;
+/** Storage-maintenance cadence (prune snapshots, then GC blobs). 15 minutes. */
+var GC_INTERVAL_MS = 900 * 1e3;
 /**
-* Mode-aware pool options:
-*
-*   - TRANSACTION pooler (:6543): `prepare:false` is mandatory — the backend is
-*     reassigned per transaction, so cached prepared statements break.
-*   - SESSION pooler / direct (:5432): the backend is pinned per connection, so
-*     `prepare:true` is safe AND faster (cached plans), and the session-scoped
-*     `statement_timeout` is actually enforced on the executing backend.
-*
-* The shared knobs are the conservative self-healing ring for one always-on
-* machine (see `db/index.ts` + api.health.db.ts for the incident history).
-* Pass `transactionPooler` explicitly to override the port-based detection
-* (the `PIEVO_DB_POOL_MODE` escape hatch).
+* Uses pino-pretty as a *synchronous* destination stream (not a worker-thread
+* transport) so logs flush before process.exit() in the one-shot CLIs. Writes to
+* stderr (fd 2) to keep stdout clean for QR codes and human CLI output.
 */
-function poolOptionsFor(url, transactionPooler = isTransactionPooler(url)) {
-	return {
-		prepare: !transactionPooler,
-		max: 10,
-		idle_timeout: 30,
-		connect_timeout: 15,
-		max_lifetime: 1800,
-		connection: { statement_timeout: 3e4 }
-	};
-}
+var logger_exports = /* @__PURE__ */ __exportAll({ logger: () => logger });
+var level = (process.env.PIEVO_LOG_LEVEL || "info").toLowerCase();
+var stream = (0, import_pino_pretty.default)({
+	destination: 2,
+	colorize: true,
+	translateTime: "SYS:HH:MM:ss",
+	ignore: "pid,hostname"
+});
+var logger = (0, import_pino.default)({ level }, stream);
 /** The coding agent a loop is bound to AND executed with (BYOA on the owner's
 *  machine): `claude-code` → Claude Code, `codex` → `codex exec`, `pi` → Pi.
 *  Non-Claude agents may still have thinner daemon telemetry until stream
@@ -1418,21 +182,23 @@ var CODING_AGENTS = [
 function coerceCodingAgent(value) {
 	return typeof value === "string" && CODING_AGENTS.includes(value) ? value : null;
 }
+var RESERVED_LOOP_TAGS = [
+	"all loops",
+	"active",
+	"paused",
+	"blocked"
+];
 /**
-* Pievo business schema (Drizzle, Postgres `pg-core` dialect).
-*
-* Core machine / loop / run tables live alongside Better Auth ownership data.
-* `userId` is the owning user's id. We use
-* Drizzle (not raw SQL) so the store is single-sourced across the driver tiers
-* (postgres-js on Supabase; embedded pglite for local/self-host + tests) — the
-* query-builder API is identical, only `db/index.ts` branches the driver.
-*
-* Timestamp values are represented as ISO strings across both drivers. JSON
-* columns use `jsonb().$type<>()`; booleans use native `boolean()`.
+* Pievo schema (Drizzle, Postgres `pg-core` dialect, served by embedded PGlite).
+* Pievo is single-user: no row carries an owner. Timestamp values are ISO
+* strings; JSON columns use `jsonb().$type<>()`.
 */
+/** `skipped`: a pending run retired without executing (pause/retention cleanup,
+*  queue coalescing, or the offline catch-up window elapsed).
+*  Neither success nor failure — excluded from the failure streak (it rides
+*  phase `canceled`, and the streak counts only phase `error`). */
 var machines = pgTable("machines", {
 	id: text("id").primaryKey(),
-	userId: text("user_id").notNull(),
 	name: text("name").notNull(),
 	hostname: text("hostname"),
 	platform: text("platform"),
@@ -1451,13 +217,13 @@ var machines = pgTable("machines", {
 	lastSeen: text("last_seen"),
 	online: boolean("online").notNull().default(false),
 	createdAt: text("created_at").notNull()
-}, (t) => [index("machines_user_idx").on(t.userId)]);
+});
 var loops = pgTable("loops", {
 	id: text("id").primaryKey(),
-	userId: text("user_id").notNull(),
 	/** Execution machine (set at creation; no cross-machine fallback). */
 	machineId: text("machine_id").notNull(),
 	name: text("name").notNull(),
+	tags: text("tags").array().notNull().default(sql`ARRAY[]::text[]`),
 	prompt: text("prompt").notNull(),
 	statusKeep: text("status_keep").notNull(),
 	statusNoChange: text("status_no_change").notNull(),
@@ -1495,10 +261,11 @@ var loops = pgTable("loops", {
 	createdAt: text("created_at").notNull(),
 	updatedAt: text("updated_at").notNull()
 }, (t) => [
-	index("loops_user_idx").on(t.userId),
 	index("loops_machine_idx").on(t.machineId),
 	index("delete_requested_loops").on(t.deleteRequestedAt).where(sql`${t.deleteRequestedAt} IS NOT NULL`),
 	check("loops_agent_check", sql`${t.agent} IN ('claude-code', 'codex', 'pi')`),
+	check("loops_tags_count_check", sql`cardinality(${t.tags}) <= 4`),
+	check("loops_tags_reserved_check", sql`NOT (${t.tags} && ARRAY['all loops', 'active', 'paused', 'blocked']::text[])`),
 	check("loops_schedule_mode_check", sql`${t.scheduleMode} IN ('cron', 'continuous')`),
 	check("loops_cron_overlap_check", sql`${t.cronOverlap} IN ('skip', 'queue-one')`)
 ]);
@@ -1607,7 +374,6 @@ var terminalReportIncidents = pgTable("terminal_report_incidents", {
 ]);
 var connectKeys = pgTable("connect_keys", {
 	machineId: text("machine_id").primaryKey(),
-	userId: text("user_id").notNull(),
 	/** Mint time (ISO) — drives the TTL. */
 	mintedAt: text("minted_at").notNull()
 });
@@ -1656,80 +422,11 @@ var runSnapshots = pgTable("run_snapshots", {
 	manifest: jsonb("manifest").$type().notNull(),
 	createdAt: text("created_at").notNull()
 }, (t) => [index("run_snapshots_loop_idx").on(t.loopId)]);
-var user = pgTable("user", {
-	id: text("id").primaryKey(),
-	name: text("name").notNull(),
-	email: text("email").notNull().unique(),
-	emailVerified: boolean("email_verified").default(false).notNull(),
-	image: text("image"),
-	createdAt: timestamp("created_at").defaultNow().notNull(),
-	updatedAt: timestamp("updated_at").defaultNow().$onUpdate(() => /* @__PURE__ */ new Date()).notNull()
-});
-var session = pgTable("session", {
-	id: text("id").primaryKey(),
-	expiresAt: timestamp("expires_at").notNull(),
-	token: text("token").notNull().unique(),
-	createdAt: timestamp("created_at").defaultNow().notNull(),
-	updatedAt: timestamp("updated_at").$onUpdate(() => /* @__PURE__ */ new Date()).notNull(),
-	ipAddress: text("ip_address"),
-	userAgent: text("user_agent"),
-	userId: text("user_id").notNull().references(() => user.id, { onDelete: "cascade" })
-}, (table) => [index("session_userId_idx").on(table.userId)]);
-var account = pgTable("account", {
-	id: text("id").primaryKey(),
-	accountId: text("account_id").notNull(),
-	providerId: text("provider_id").notNull(),
-	userId: text("user_id").notNull().references(() => user.id, { onDelete: "cascade" }),
-	accessToken: text("access_token"),
-	refreshToken: text("refresh_token"),
-	idToken: text("id_token"),
-	accessTokenExpiresAt: timestamp("access_token_expires_at"),
-	refreshTokenExpiresAt: timestamp("refresh_token_expires_at"),
-	scope: text("scope"),
-	password: text("password"),
-	createdAt: timestamp("created_at").defaultNow().notNull(),
-	updatedAt: timestamp("updated_at").$onUpdate(() => /* @__PURE__ */ new Date()).notNull()
-}, (table) => [index("account_userId_idx").on(table.userId)]);
-var verification = pgTable("verification", {
-	id: text("id").primaryKey(),
-	identifier: text("identifier").notNull(),
-	value: text("value").notNull(),
-	expiresAt: timestamp("expires_at").notNull(),
-	createdAt: timestamp("created_at").defaultNow().notNull(),
-	updatedAt: timestamp("updated_at").defaultNow().$onUpdate(() => /* @__PURE__ */ new Date()).notNull()
-}, (table) => [index("verification_identifier_idx").on(table.identifier)]);
-relations(user, ({ many }) => ({
-	sessions: many(session),
-	accounts: many(account)
-}));
-relations(session, ({ one }) => ({ user: one(user, {
-	fields: [session.userId],
-	references: [user.id]
-}) }));
-relations(account, ({ one }) => ({ user: one(user, {
-	fields: [account.userId],
-	references: [user.id]
-}) }));
 /**
-* Postgres connection + Drizzle handle. The driver is chosen at boot from env
-* from environment configuration:
-*
-*   - `DATABASE_URL` SET   → postgres-js against Supabase (hosted prod/staging).
-*                            Pool options are mode-aware (`db/poolOptions.ts`):
-*                            `prepare:false` on the `:6543` transaction pooler,
-*                            `prepare:true` on a `:5432` session/direct URL.
-*   - `DATABASE_URL` UNSET → embedded pglite, file-backed at `<dataDir>/pgdata`
-*                            (local dev + light self-host + tests). Same pg
-*                            dialect, same migrations, zero external database.
-*
-* `store.ts` is single-sourced across both — the drizzle query-builder API is
-* identical; only this file branches. A `globalThis` guard keeps the handle a
-* true singleton across dev HMR reloads (the Scheduler shares it in-process).
-*
-* The fresh-deploy baseline lives in `packages/server/drizzle`. In
-* the HOSTED tier they're applied out-of-process via `pnpm db:migrate` before
-* `start` (over the DIRECT `:5432` URL); `runMigrations()` also applies them
-* in-process (the pglite tier's only path, plus dev boot + tests).
+* Embedded PGlite (WASM Postgres) database, file-backed at `<dataDir>/pgdata`,
+* plus the Drizzle handle. A `globalThis` guard keeps the handle a singleton
+* across dev HMR reloads (the Scheduler shares it in-process). Exactly one
+* server process may own a data directory.
 */
 var schema = {
 	machines,
@@ -1741,62 +438,24 @@ var schema = {
 	runLeases,
 	runReportReceipts,
 	terminalReportIncidents,
-	connectKeys,
-	user,
-	session,
-	account,
-	verification
+	connectKeys
 };
 var g$1 = globalThis;
-/** Host (host:port, NEVER credentials) of a Postgres URL, for boot logging. */
-function pgHost(url) {
-	try {
-		return new URL(url).host || "unknown";
-	} catch {
-		return "unparseable";
-	}
-}
 function open() {
-	if (g$1.__pievoDb && g$1.__pievoClient && g$1.__pievoDriver) return {
+	if (g$1.__pievoDb && g$1.__pievoClient) return {
 		db: g$1.__pievoDb,
-		client: g$1.__pievoClient,
-		driver: g$1.__pievoDriver
+		client: g$1.__pievoClient
 	};
-	const url = databaseUrl();
-	if (url) {
-		logger.info({
-			tier: "postgres",
-			host: pgHost(url)
-		}, "database tier: postgres");
-		if (!/sslmode=/i.test(url)) logger.warn({ host: pgHost(url) }, "DATABASE_URL has no sslmode — the connection may be plaintext; append ?sslmode=require");
-		const mode = dbPoolMode();
-		const client = src_default(url, poolOptionsFor(url, mode ? mode === "transaction" : isTransactionPooler(url)));
-		const db = drizzle(client, { schema });
-		g$1.__pievoClient = client;
-		g$1.__pievoDb = db;
-		g$1.__pievoDriver = "postgres";
-		return {
-			db,
-			client,
-			driver: "postgres"
-		};
-	}
-	if (process.env.PIEVO_DB !== "pglite") throw new Error("refusing to boot the ephemeral embedded database in production — set DATABASE_URL, or PIEVO_DB=pglite to opt in");
 	const dir = path.join(dataDir(), "pgdata");
-	logger.info({
-		tier: "pglite",
-		pgdata: dir
-	}, "database tier: pglite");
+	logger.info({ pgdata: dir }, "database: pglite");
 	fs.mkdirSync(dataDir(), { recursive: true });
 	const client = new Ve(dir);
-	const db = drizzle$1(client, { schema });
+	const db = drizzle(client, { schema });
 	g$1.__pievoClient = client;
 	g$1.__pievoDb = db;
-	g$1.__pievoDriver = "pglite";
 	return {
 		db,
-		client,
-		driver: "pglite"
+		client
 	};
 }
 var opened = open();
@@ -1807,7 +466,7 @@ opened.client;
 * package root (`../../drizzle`). In the BUILT server the module is bundled under
 * `.output/server/{_ssr,_libs}` and `copy-pglite-assets.mjs` lands the folder at
 * `.output/server/drizzle` (`../drizzle`). Return the first candidate that exists
-* so the embedded pglite tier migrates in-process from either layout.
+* so the database migrates in-process from either layout.
 */
 function migrationsDir() {
 	const here = path.dirname(fileURLToPath(import.meta.url));
@@ -1817,23 +476,15 @@ function migrationsDir() {
 	if (fs.existsSync(builtDir)) return builtDir;
 	return devDir;
 }
-/**
-* Apply generated migrations IN-PROCESS (idempotent). This is the PGLITE tier's
-* only migration path (also dev boot + tests). The HOSTED postgres tier is a
-* NO-OP here: `prestart.mjs` (and `pnpm db:migrate`) own hosted migrations, run
-* once out-of-process over the DIRECT (:5432) URL before serving — re-migrating
-* over a second connection on every boot only risks a wedged connection hanging
-* boot and double-running the advisory lock.
-*/
+/** Apply generated migrations in-process (idempotent). */
 async function runMigrations() {
-	if (opened.driver === "postgres") return;
 	const dir = migrationsDir();
 	if (!fs.existsSync(dir)) return;
-	const { migrate } = await import("../_libs/drizzle-orm+postgres.mjs").then((n) => n.M);
+	const { migrate } = await import("../_libs/drizzle-orm.mjs").then((n) => n.E);
 	await migrate(opened.db, { migrationsFolder: dir });
 }
 /**
-* Best-effort clean shutdown of the runtime database client (called from the
+* Best-effort clean shutdown of the database client (called from the
 * boot AbortController on SIGINT/SIGTERM). PGlite must be closed explicitly:
 * after migrations it owns a referenced WASM timer that otherwise keeps Node
 * alive until the managed launcher's graceful-stop deadline. Never throws —
@@ -1841,32 +492,90 @@ async function runMigrations() {
 */
 async function closeClient() {
 	try {
-		if (opened.driver === "postgres") await opened.client.end({ timeout: 5 });
-		else await opened.client.close();
+		await opened.client.close();
 	} catch {}
 }
 /**
-* The GitHub login-gate condition, in one leaf module. `auth.ts` derives its
-* load-time `authEnabled` value from this, and server boot calls it before any
-* migration or scheduler work.
-*
-* The gate is ON exactly when a complete GitHub OAuth app is configured. Open
-* mode requires both values to be absent; a partial configuration fails closed.
-*/
-function loginGateEnabled() {
-	const hasClientId = !!process.env.GITHUB_CLIENT_ID?.trim();
-	if (hasClientId !== !!process.env.GITHUB_CLIENT_SECRET?.trim()) throw new Error("incomplete GitHub auth configuration: set both GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET, or unset both for open mode");
-	return hasClientId;
-}
-/**
-* Data-access layer over Drizzle — replaces c0's file-per-loop store. The API is
-* function-style; persistence is relational (loops and runs are separate tables,
-* and `owner: PeerRef` is gone → `userId` + `machineId`).
-*
-* Under Postgres (postgres-js / pglite) the drizzle session is ASYNC, so every
-* DB-touching function returns a Promise. The 5 pure, DB-free helpers stay sync.
-* Using Drizzle (not raw SQL) keeps the dialect swap a swap, not a rewrite.
+* Data-access layer over Drizzle. Loop-locked state transitions live here; every
+* DB-touching function is async, while the pure helpers stay sync.
 */
+var store_exports = /* @__PURE__ */ __exportAll({
+	TERMINAL_REPORT_GRACE_MS: () => TERMINAL_REPORT_GRACE_MS,
+	acknowledgeRetiredReport: () => acknowledgeRetiredReport,
+	acknowledgeRetiredTerminalIncident: () => acknowledgeRetiredTerminalIncident,
+	advanceDueSchedules: () => advanceDueSchedules,
+	artifactFileReferencesHash: () => artifactFileReferencesHash,
+	blobExists: () => blobExists,
+	blobHashesOlderThan: () => blobHashesOlderThan,
+	blobSizes: () => blobSizes,
+	buildLoopManifest: () => buildLoopManifest,
+	claimReadyRunForMachine: () => claimReadyRunForMachine,
+	countRunSnapshots: () => countRunSnapshots,
+	countRuns: () => countRuns,
+	createLoop: () => createLoop,
+	createMachine: () => createMachine,
+	deleteBlob: () => deleteBlob,
+	enqueueRun: () => enqueueRun,
+	expirePendingRun: () => expirePendingRun,
+	finalizeRunningRun: () => finalizeRunningRun,
+	forceDeleteLoop: () => forceDeleteLoop,
+	forceDeleteMachine: () => forceDeleteMachine,
+	getArtifactFile: () => getArtifactFile,
+	getExactTerminalReportIncident: () => getExactTerminalReportIncident,
+	getLoop: () => getLoop,
+	getMachine: () => getMachine,
+	getReportReceipt: () => getReportReceipt,
+	getRun: () => getRun,
+	getRunSnapshot: () => getRunSnapshot,
+	getTerminalReportIncidents: () => getTerminalReportIncidents,
+	hasPendingRun: () => hasPendingRun,
+	hasRunningRun: () => hasRunningRun,
+	initializeCronCadence: () => initializeCronCadence,
+	lastRun: () => lastRun,
+	listArtifacts: () => listArtifacts,
+	listLoops: () => listLoops,
+	listMachines: () => listMachines,
+	listRuns: () => listRuns,
+	listRunsBefore: () => listRunsBefore,
+	liveBlobRefs: () => liveBlobRefs,
+	loopIdsWithSnapshots: () => loopIdsWithSnapshots,
+	loopsForMachine: () => loopsForMachine,
+	machineReferencesBlob: () => machineReferencesBlob,
+	newLoopId: () => newLoopId,
+	nextCronAt: () => nextCronAt,
+	openRuns: () => openRuns,
+	pauseLoop: () => pauseLoop,
+	pauseLoopState: () => pauseLoopState,
+	prevRunSnapshot: () => prevRunSnapshot,
+	pruneRunSnapshots: () => pruneRunSnapshots,
+	putReportReceiptIfAbsent: () => putReportReceiptIfAbsent,
+	putRunSnapshot: () => putRunSnapshot,
+	putTerminalReportIncidentIfAbsent: () => putTerminalReportIncidentIfAbsent,
+	recentLoopUsage: () => recentLoopUsage,
+	reclaimRun: () => reclaimRun,
+	reconcileConfiguredArtifacts: () => reconcileConfiguredArtifacts,
+	reconcileReclaimedRun: () => reconcileReclaimedRun,
+	reconciliationStatesForRuns: () => reconciliationStatesForRuns,
+	recordBlob: () => recordBlob,
+	recordRunReportOnce: () => recordRunReportOnce,
+	refreshRunHeartbeats: () => refreshRunHeartbeats,
+	rejectTerminalReport: () => rejectTerminalReport,
+	releaseAbsentReconciliations: () => releaseAbsentReconciliations,
+	repairTerminalRunLeases: () => repairTerminalRunLeases,
+	requestDeleteLoop: () => requestDeleteLoop,
+	requestRunCancel: () => requestRunCancel,
+	runningRunForLoop: () => runningRunForLoop,
+	runningRunsForMachine: () => runningRunsForMachine,
+	setMachineOnline: () => setMachineOnline,
+	snapshotBlobRefs: () => snapshotBlobRefs,
+	startLoop: () => startLoop,
+	stopLoop: () => stopLoop,
+	terminalIncidentReceiptId: () => terminalIncidentReceiptId,
+	tryDeleteLoop: () => tryDeleteLoop,
+	updateLoop: () => updateLoop,
+	updateMachine: () => updateMachine,
+	upsertConfiguredArtifactFile: () => upsertConfiguredArtifactFile
+});
 function newLoopId() {
 	return `loop-${Date.now().toString(36)}-${randomUUID().slice(0, 8)}`;
 }
@@ -1897,9 +606,6 @@ function runTimes(at = nowIso$1()) {
 async function listLoops() {
 	return db.select().from(loops);
 }
-async function listLoopsForUser(userId) {
-	return db.select().from(loops).where(eq(loops.userId, userId));
-}
 async function getLoop(id) {
 	return (await db.select().from(loops).where(eq(loops.id, id)))[0];
 }
@@ -1926,12 +632,7 @@ async function createLoop(input) {
 		updatedAt: ts
 	};
 	return db.transaction(async (tx) => {
-		const machine = (await tx.select({
-			id: machines.id,
-			userId: machines.userId
-		}).from(machines).where(eq(machines.id, input.machineId)).for("key share"))[0];
-		if (!machine) throw new Error(`machine ${input.machineId} does not exist`);
-		if (machine.userId !== input.userId) throw new Error(`machine ${input.machineId} is owned by a different user`);
+		if (!(await tx.select({ id: machines.id }).from(machines).where(eq(machines.id, input.machineId)).for("key share"))[0]) throw new Error(`machine ${input.machineId} does not exist`);
 		return (await tx.insert(loops).values(row).returning())[0];
 	});
 }
@@ -2360,6 +1061,43 @@ async function recordRunReportOnce(input) {
 		} : { state: "already-reported" };
 	});
 }
+async function finalizeTerminalRunTx(tx, input) {
+	if (input.receipt) await lockReportIdTx(tx, input.receipt.reportId);
+	const current = (await tx.select().from(loops).where(eq(loops.id, input.loopId)).for("update"))[0];
+	if (!current) return void 0;
+	if (input.receipt) {
+		if ((await tx.select({ id: terminalReportIncidents.id }).from(terminalReportIncidents).where(eq(terminalReportIncidents.reportId, input.receipt.reportId)).limit(1))[0]) return void 0;
+	}
+	const leaseState = input.leaseCheck ? await input.leaseCheck(tx) : void 0;
+	if (input.leaseCheck && !leaseState) return void 0;
+	const target = (await tx.select().from(runs).where(and(eq(runs.id, input.runId), eq(runs.loopId, input.loopId), eq(runs.phase, input.runPhase))).limit(1).for("update"))[0];
+	if (!target) return void 0;
+	const runIndex = await ensureRunIndexTx(tx, target);
+	const at = typeof input.runPatch.ts === "string" ? input.runPatch.ts : nowIso$1();
+	const run = (await tx.update(runs).set({
+		...input.runPatch,
+		runIndex,
+		updatedAt: at
+	}).where(and(eq(runs.id, input.runId), eq(runs.loopId, input.loopId), eq(runs.phase, input.runPhase))).returning())[0];
+	if (!run) return void 0;
+	const lifecycle = leaseState === "reconciliation-only" ? {
+		loop: current,
+		failureStreak: 0,
+		autoPaused: false
+	} : await terminalLifecycleTx(tx, current, run, at, input.loopPatch, input.failureAutopauseStreak);
+	if (input.leaseTokenHash) await tx.delete(runLeases).where(eq(runLeases.runId, input.runId));
+	if (input.receipt) await tx.insert(runReportReceipts).values(input.receipt);
+	return {
+		run,
+		...lifecycle,
+		...input.reconciliation ? { reportOnly: leaseState === "reconciliation-only" } : {}
+	};
+}
+async function reclaimedLeaseStateTx(tx, loopId, runId, leaseTokenHash) {
+	const leaseNow = nowIso$1();
+	const lease = (await tx.select({ state: runLeases.state }).from(runLeases).where(and(eq(runLeases.tokenHash, leaseTokenHash), eq(runLeases.runId, runId), eq(runLeases.loopId, loopId), inArray(runLeases.state, ["terminal-grace", "reconciliation-only"]), gt(runLeases.expiresAt, leaseNow))).limit(1).for("update"))[0];
+	return lease?.state === "terminal-grace" || lease?.state === "reconciliation-only" ? lease.state : void 0;
+}
 /** Consume a retired tombstone when its reportId is owned by another run.
 * The run/loop may already be deleted, so only the exact incident receipt and
 * lease tombstone participate in this transaction. */
@@ -2471,32 +1209,19 @@ async function rejectTerminalReport(input) {
 * The loop patch is unreachable when cancel/reclaim/another report won. */
 async function finalizeRunningRun(loopId, runId, runPatch, loopPatch = {}, leaseTokenHash, failureAutopauseStreak = 0, receipt) {
 	return db.transaction(async (tx) => {
-		if (receipt) await lockReportIdTx(tx, receipt.reportId);
-		const current = (await tx.select().from(loops).where(eq(loops.id, loopId)).for("update"))[0];
-		if (!current) return void 0;
-		if (receipt) {
-			if ((await tx.select({ id: terminalReportIncidents.id }).from(terminalReportIncidents).where(eq(terminalReportIncidents.reportId, receipt.reportId)).limit(1))[0]) return void 0;
-		}
-		if (leaseTokenHash) {
-			if ((await activeRunForReportTx(tx, loopId, runId, leaseTokenHash)).state !== "active") return void 0;
-		}
-		const target = (await tx.select().from(runs).where(and(eq(runs.id, runId), eq(runs.loopId, loopId), eq(runs.phase, "running"))).limit(1).for("update"))[0];
-		if (!target) return void 0;
-		const runIndex = await ensureRunIndexTx(tx, target);
-		const at = typeof runPatch.ts === "string" ? runPatch.ts : nowIso$1();
-		const run = (await tx.update(runs).set({
-			...runPatch,
-			runIndex,
-			updatedAt: at
-		}).where(and(eq(runs.id, runId), eq(runs.loopId, loopId), eq(runs.phase, "running"))).returning())[0];
-		if (!run) return void 0;
-		const lifecycle = await terminalLifecycleTx(tx, current, run, at, loopPatch, failureAutopauseStreak);
-		if (leaseTokenHash) await tx.delete(runLeases).where(eq(runLeases.runId, runId));
-		if (receipt) await tx.insert(runReportReceipts).values(receipt);
-		return {
-			run,
-			...lifecycle
-		};
+		return finalizeTerminalRunTx(tx, {
+			loopId,
+			runId,
+			runPhase: "running",
+			runPatch,
+			loopPatch,
+			leaseTokenHash,
+			leaseCheck: leaseTokenHash ? async (lockedTx) => {
+				return (await activeRunForReportTx(lockedTx, loopId, runId, leaseTokenHash)).state === "active" ? "active" : void 0;
+			} : void 0,
+			failureAutopauseStreak,
+			receipt
+		});
 	});
 }
 /** Sweep reclaim under the same loop lock as claim/report/cancel. Running
@@ -2548,40 +1273,18 @@ async function releaseAbsentReconciliations(machineId, recoverableRunIds, at = n
 * first real failure from a second concurrent one. */
 async function reconcileReclaimedRun(loopId, runId, leaseTokenHash, runPatch, loopPatch = {}, failureAutopauseStreak = 0, receipt) {
 	return db.transaction(async (tx) => {
-		if (receipt) await lockReportIdTx(tx, receipt.reportId);
-		const current = (await tx.select().from(loops).where(eq(loops.id, loopId)).for("update"))[0];
-		if (!current) return void 0;
-		if (receipt) {
-			if ((await tx.select({ id: terminalReportIncidents.id }).from(terminalReportIncidents).where(eq(terminalReportIncidents.reportId, receipt.reportId)).limit(1))[0]) return void 0;
-		}
-		const leaseNow = nowIso$1();
-		const lease = (await tx.select({
-			tokenHash: runLeases.tokenHash,
-			state: runLeases.state
-		}).from(runLeases).where(and(eq(runLeases.tokenHash, leaseTokenHash), eq(runLeases.runId, runId), eq(runLeases.loopId, loopId), inArray(runLeases.state, ["terminal-grace", "reconciliation-only"]), gt(runLeases.expiresAt, leaseNow))).limit(1).for("update"))[0];
-		if (!lease) return void 0;
-		const target = (await tx.select().from(runs).where(and(eq(runs.id, runId), eq(runs.loopId, loopId), eq(runs.phase, "error"))).limit(1).for("update"))[0];
-		if (!target) return void 0;
-		const runIndex = await ensureRunIndexTx(tx, target);
-		const at = typeof runPatch.ts === "string" ? runPatch.ts : nowIso$1();
-		const run = (await tx.update(runs).set({
-			...runPatch,
-			runIndex,
-			updatedAt: at
-		}).where(and(eq(runs.id, runId), eq(runs.loopId, loopId), eq(runs.phase, "error"))).returning())[0];
-		if (!run) return void 0;
-		const lifecycle = lease.state === "reconciliation-only" ? {
-			loop: current,
-			failureStreak: 0,
-			autoPaused: false
-		} : await terminalLifecycleTx(tx, current, run, at, loopPatch, failureAutopauseStreak);
-		await tx.delete(runLeases).where(eq(runLeases.runId, runId));
-		if (receipt) await tx.insert(runReportReceipts).values(receipt);
-		return {
-			run,
-			...lifecycle,
-			reportOnly: lease.state === "reconciliation-only"
-		};
+		return finalizeTerminalRunTx(tx, {
+			loopId,
+			runId,
+			runPhase: "error",
+			runPatch,
+			loopPatch,
+			leaseTokenHash,
+			leaseCheck: (lockedTx) => reclaimedLeaseStateTx(lockedTx, loopId, runId, leaseTokenHash),
+			failureAutopauseStreak,
+			receipt,
+			reconciliation: true
+		});
 	});
 }
 var TERMINAL_REPORT_GRACE_MS = 600 * 1e3;
@@ -2784,9 +1487,6 @@ async function expirePendingRun(runId, expected, at, maxLifetimeMs, message) {
 async function listMachines() {
 	return db.select().from(machines).orderBy(asc(machines.name), asc(machines.id));
 }
-async function listMachinesForUser(userId) {
-	return db.select().from(machines).where(eq(machines.userId, userId)).orderBy(asc(machines.name), asc(machines.id));
-}
 async function getMachine(id) {
 	return (await db.select().from(machines).where(eq(machines.id, id)))[0];
 }
@@ -2801,18 +1501,11 @@ async function updateMachine(id, patch) {
 	return getMachine(id);
 }
 /** Atomically retire all loop authority, remove server-owned machine data, revoke
-* enrollment, and delete the machine. Auth-mode callers pass `ownerUserId` so
-* ownership is rechecked under the same lock as deletion; open/server callers omit it. */
-async function forceDeleteMachine(id, ownerUserId) {
+* enrollment, and delete the machine. */
+async function forceDeleteMachine(id) {
 	return db.transaction(async (tx) => {
-		const machine = (await tx.select({
-			id: machines.id,
-			userId: machines.userId
-		}).from(machines).where(eq(machines.id, id)).for("update"))[0];
-		if (!machine) return { state: "not-found" };
-		if (ownerUserId !== void 0 && machine.userId !== ownerUserId) return { state: "forbidden" };
+		if (!(await tx.select({ id: machines.id }).from(machines).where(eq(machines.id, id)).for("update"))[0]) return { state: "not-found" };
 		const ownedLoops = await tx.select().from(loops).where(eq(loops.machineId, id)).for("update");
-		if (ownerUserId !== void 0 && ownedLoops.some((loop) => loop.userId !== ownerUserId)) return { state: "forbidden" };
 		for (const loop of ownedLoops) if (!await forceDeleteLoopTx(tx, loop.id)) throw new Error(`failed to delete loop ${loop.id}`);
 		await tx.delete(connectKeys).where(eq(connectKeys.machineId, id));
 		await tx.delete(machines).where(eq(machines.id, id));
@@ -2975,7 +1668,7 @@ async function loopIdsWithSnapshots() {
 async function liveBlobRefs() {
 	const refs = /* @__PURE__ */ new Set();
 	for (const r of await db.selectDistinct({ hash: artifactFiles.hash }).from(artifactFiles).where(isNotNull(artifactFiles.hash))) if (r.hash) refs.add(r.hash);
-	for (const r of await db.select({ manifest: runSnapshots.manifest }).from(runSnapshots)) for (const entry of Object.values(r.manifest)) if (entry?.hash) refs.add(entry.hash);
+	for (const hash of await collectSnapshotBlobRefs()) refs.add(hash);
 	return refs;
 }
 /** Blob hashes whose metadata row predates `cutoffIso` (GC candidates — the grace
@@ -3001,17 +1694,28 @@ async function artifactFileReferencesHash(hash) {
 *  raced the pass), so a snapshot that comes to reference a hash mid-pass is still
 *  caught — closing the GC-check-time gap where a snapshot references a hash no live
 *  file row does — without paying O(garbage × snapshots). */
-async function snapshotBlobRefs() {
+async function collectSnapshotBlobRefs() {
 	const refs = /* @__PURE__ */ new Set();
 	for (const r of await db.select({ manifest: runSnapshots.manifest }).from(runSnapshots)) for (const entry of Object.values(r.manifest)) if (entry?.hash) refs.add(entry.hash);
 	return refs;
 }
+async function snapshotBlobRefs() {
+	return collectSnapshotBlobRefs();
+}
 /** Count of retained run_snapshot rows — the GC's cheap change-detector for deciding
 *  whether to rebuild its precomputed snapshotBlobRefs() set mid-pass. */
 async function countRunSnapshots() {
 	const r = (await db.select({ n: sql`count(*)` }).from(runSnapshots))[0];
 	return Number(r?.n ?? 0);
 }
+var artifacts_exports = /* @__PURE__ */ __exportAll({
+	BLOB_CAP: () => BLOB_CAP,
+	SYNC_BODY_CAP: () => SYNC_BODY_CAP,
+	isValidHash: () => isValidHash,
+	parseArtifactSyncBody: () => parseArtifactSyncBody,
+	safeRelPath: () => safeRelPath,
+	sha256Buf: () => sha256Buf
+});
 /** Per-file byte cap. At or under ⇒ bytes sync; over ⇒ metadata-only (no bytes). */
 var BLOB_CAP = 10 * 1024 * 1024;
 /** Hard ceiling on the exact-manifest sync POST body. */
@@ -3099,9 +1803,26 @@ function parseArtifactSyncBody(value) {
 * Leases and connect-key bindings are DURABLE (run_leases / connect_keys
 * tables): they must survive a deploy, or every restart 401s the in-flight
 * runs' callbacks/finalize and prevents a freshly connected machine from
-* enrolling under its owner. The 15-minute `new` idempotency window stays in-process;
+* enrolling. The 15-minute `new` idempotency window stays in-process;
 * losing it only degrades retry deduplication, never persisted data.
 */
+var tokens_exports = /* @__PURE__ */ __exportAll({
+	CONNECT_KEY_TTL_MS: () => CONNECT_KEY_TTL_MS,
+	NEW_IDEMPOTENCY_TTL_MS: () => NEW_IDEMPOTENCY_TTL_MS,
+	TERMINAL_GRACE_MS: () => TERMINAL_GRACE_MS,
+	connectKeyValid: () => connectKeyValid,
+	isDeviceTokenShape: () => isDeviceTokenShape,
+	isRunTokenShape: () => isRunTokenShape,
+	machineIdFromToken: () => machineIdFromToken,
+	mintDeviceToken: () => mintDeviceToken,
+	pruneExpiredLeases: () => pruneExpiredLeases,
+	readNewIdempotency: () => readNewIdempotency,
+	recordNewIdempotency: () => recordNewIdempotency,
+	rememberConnectKey: () => rememberConnectKey,
+	resolveLease: () => resolveLease,
+	retireLease: () => retireLease,
+	sha256: () => sha256
+});
 function sha256(s) {
 	return createHash("sha256").update(s).digest("hex");
 }
@@ -3124,13 +1845,12 @@ var CONNECT_KEY_TTL_MS = 1440 * 60 * 1e3;
 function connectKeyFresh(mintedAt, now) {
 	return now - Date.parse(mintedAt) <= CONNECT_KEY_TTL_MS;
 }
-/** Bind a freshly minted connect key to its owner and prune expired rows. */
-async function rememberConnectKey(connectKey, binding) {
+/** Record a freshly minted connect key and prune expired rows. */
+async function rememberConnectKey(connectKey) {
 	const now = /* @__PURE__ */ new Date();
 	await db.delete(connectKeys).where(lt(connectKeys.mintedAt, (/* @__PURE__ */ new Date(now.getTime() - CONNECT_KEY_TTL_MS)).toISOString()));
 	const row = {
 		machineId: machineIdFromToken(connectKey),
-		userId: binding.userId,
 		mintedAt: now.toISOString()
 	};
 	await db.insert(connectKeys).values(row).onConflictDoUpdate({
@@ -3138,11 +1858,10 @@ async function rememberConnectKey(connectKey, binding) {
 		set: row
 	});
 }
-async function readConnectKeyBinding(connectKey, now = Date.now()) {
-	if (!connectKey) return void 0;
+async function connectKeyValid(connectKey, now = Date.now()) {
+	if (!connectKey) return false;
 	const row = (await db.select().from(connectKeys).where(eq(connectKeys.machineId, machineIdFromToken(connectKey))))[0];
-	if (!row || !connectKeyFresh(row.mintedAt, now)) return void 0;
-	return { userId: row.userId };
+	return !!row && connectKeyFresh(row.mintedAt, now);
 }
 /** How long a terminal-grace lease stays alive to accept one late wake-report.
 *  A laptop can sleep overnight or across a weekend before the daemon resumes. */
@@ -3198,6 +1917,8 @@ async function pruneExpiredLeases(now = Date.now()) {
 	}).where(and(inArray(runLeases.state, ["terminal-grace", "reconciliation-only"]), isNotNull(runLeases.expiresAt), lt(runLeases.expiresAt, new Date(now).toISOString())));
 }
 var newIdempotency = /* @__PURE__ */ new Map();
+/** Long enough to swallow a timed-out retry without collapsing later creates. */
+var NEW_IDEMPOTENCY_TTL_MS = 900 * 1e3;
 function pruneNewIdempotency(now) {
 	for (const [key, rec] of newIdempotency) if (now - rec.at > 9e5) newIdempotency.delete(key);
 }
@@ -3292,6 +2013,80 @@ function isOutdated(current, latest) {
 	}
 	return isPre(current) && !isPre(latest);
 }
+var reserved = new Set(RESERVED_LOOP_TAGS);
+function normalizeLoopTag(value) {
+	return value.normalize("NFKC").trim().replace(/\s+/gu, " ").toLocaleLowerCase("en-US");
+}
+function validateLoopTags(value) {
+	if (value === void 0) return {
+		ok: true,
+		value: []
+	};
+	if (!Array.isArray(value)) return {
+		ok: false,
+		detail: "tags must be an array of strings"
+	};
+	if (value.length > 4) return {
+		ok: false,
+		detail: `tags must contain at most 4 values`
+	};
+	const tags = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const entry of value) {
+		if (typeof entry !== "string") return {
+			ok: false,
+			detail: "tags must contain only strings"
+		};
+		if (/\p{Cc}|\p{Cf}|\p{Default_Ignorable_Code_Point}/u.test(entry)) return {
+			ok: false,
+			detail: "tags must not contain control or invisible characters"
+		};
+		const tag = normalizeLoopTag(entry);
+		if (!tag) return {
+			ok: false,
+			detail: "tags must not contain empty values"
+		};
+		if ([...tag].length > 64) return {
+			ok: false,
+			detail: `each tag must contain at most 64 characters`
+		};
+		if (reserved.has(tag)) return {
+			ok: false,
+			detail: `reserved tag: ${tag}`
+		};
+		if (seen.has(tag)) return {
+			ok: false,
+			detail: `duplicate tag: ${tag}`
+		};
+		seen.add(tag);
+		tags.push(tag);
+	}
+	return {
+		ok: true,
+		value: [...tags].sort()
+	};
+}
+//#endregion
+//#region node_modules/.nitro/vite/services/ssr/assets/boot-CYRi-wez.js
+var boot_CYRi_wez_exports = /* @__PURE__ */ __exportAll$1({
+	_: () => validOptionalPollString,
+	a: () => POLL_HTTP_BODY_FIELDS,
+	c: () => MIN_DAEMON_VERSION,
+	d: () => canonicalLoopSummary,
+	f: () => validateLoopEdit,
+	g: () => readJsonBody,
+	h: () => readByteBody,
+	i: () => runDiff_exports,
+	l: () => daemonNeedsUpdate,
+	m: () => WIRE_TEXT_CAP,
+	n: () => ensureServer,
+	o: () => validPollCurrentRun,
+	p: () => MACHINE_BODY_CAP,
+	r: () => getArtifactSync,
+	s: () => validPollWireId,
+	t: () => boot_exports,
+	u: () => canonicalLoopEnvelope
+});
 /**
 * Machine-route ingress: read + parse a JSON request body under a hard size cap.
 * The gateway's per-field wire caps (WIRE_TEXT_CAP etc.) clip individual strings
@@ -3381,7 +2176,7 @@ function nowIso() {
 /** Strip NUL (U+0000) from a wire string: Postgres text/jsonb columns REJECT the
 *  NUL byte (SQLite tolerated it), so a daemon-supplied string carrying one would
 *  throw mid-finalize on the DB write. The single sanitizing primitive behind
-*  `clipText` and index.ts's `str` - and used directly by `cli.ts`
+*  `clipText` - and used directly by `cli.ts`
 *  (parseFlags/validateState, the same one-chokepoint discipline). */
 function stripNul(s) {
 	return s.replace(/\u0000/g, "");
@@ -3422,13 +2217,8 @@ async function buildDelivery(loop, queuedRun, runToken, roots) {
 * loop/run). The store ONLY writes/reads bytes — it never executes or interprets
 * them — preserving the server's zero-exec invariant.
 *
-* Three implementations behind one small interface:
-*   • LocalBlobStore — durable filesystem default under PIEVO_DATA_DIR/blobs.
-*   • R2BlobStore — Cloudflare R2 (S3-compatible) when credentials are configured.
-*   • MemoryBlobStore — explicit ephemeral selection or injected test fake.
-*
-* The S3 client is dynamic-imported inside R2BlobStore so tests (and any deploy
-* without R2 creds) never load the AWS SDK, and it stays out of the client bundle.
+* `LocalBlobStore` is the durable store under `<dataDir>/blobs`;
+* `MemoryBlobStore` is the injected test fake.
 */
 var log$4 = logger.child({ mod: "blobstore" });
 var SHA256_HEX = /^[a-f0-9]{64}$/;
@@ -3542,132 +2332,15 @@ var LocalBlobStore = class {
 		await this.syncDir(path.dirname(target));
 	}
 };
-var MemoryBlobStore = class {
-	map = /* @__PURE__ */ new Map();
-	async has(hash) {
-		return this.map.has(hash);
-	}
-	async put(hash, bytes) {
-		this.map.set(hash, Buffer.from(bytes));
-	}
-	async get(hash) {
-		return this.map.get(hash) ?? null;
-	}
-	async delete(hash) {
-		this.map.delete(hash);
-	}
-};
-function blobKey(hash) {
-	return `blobs/${hash}`;
-}
-var R2BlobStore = class {
-	cfg;
-	client;
-	constructor(cfg) {
-		this.cfg = cfg;
-	}
-	async s3() {
-		if (this.client) return this.client;
-		const { S3Client } = await import("../_libs/@aws-sdk/client-s3+[...].mjs").then((n) => n.t);
-		this.client = new S3Client({
-			region: this.cfg.region,
-			endpoint: this.cfg.endpoint,
-			credentials: {
-				accessKeyId: this.cfg.accessKeyId,
-				secretAccessKey: this.cfg.secretAccessKey
-			},
-			forcePathStyle: true
-		});
-		return this.client;
-	}
-	async has(hash) {
-		const { HeadObjectCommand } = await import("../_libs/@aws-sdk/client-s3+[...].mjs").then((n) => n.t);
-		const client = await this.s3();
-		try {
-			await client.send(new HeadObjectCommand({
-				Bucket: this.cfg.bucket,
-				Key: blobKey(hash)
-			}));
-			return true;
-		} catch (err) {
-			if (isNotFound(err)) return false;
-			throw err;
-		}
-	}
-	async put(hash, bytes) {
-		const { PutObjectCommand } = await import("../_libs/@aws-sdk/client-s3+[...].mjs").then((n) => n.t);
-		await (await this.s3()).send(new PutObjectCommand({
-			Bucket: this.cfg.bucket,
-			Key: blobKey(hash),
-			Body: bytes,
-			ContentLength: bytes.length
-		}));
-	}
-	async get(hash) {
-		const { GetObjectCommand } = await import("../_libs/@aws-sdk/client-s3+[...].mjs").then((n) => n.t);
-		const client = await this.s3();
-		try {
-			const body = (await client.send(new GetObjectCommand({
-				Bucket: this.cfg.bucket,
-				Key: blobKey(hash)
-			}))).Body;
-			if (!body?.transformToByteArray) return null;
-			return Buffer.from(await body.transformToByteArray());
-		} catch (err) {
-			if (isNotFound(err)) return null;
-			throw err;
-		}
-	}
-	async delete(hash) {
-		const { DeleteObjectCommand } = await import("../_libs/@aws-sdk/client-s3+[...].mjs").then((n) => n.t);
-		await (await this.s3()).send(new DeleteObjectCommand({
-			Bucket: this.cfg.bucket,
-			Key: blobKey(hash)
-		}));
-	}
-};
-function isNotFound(err) {
-	const e = err;
-	return e?.name === "NotFound" || e?.name === "NoSuchKey" || e?.$metadata?.httpStatusCode === 404;
-}
-/**
-* The configured blob store: durable local filesystem under PIEVO_DATA_DIR by
-* default; complete R2 credentials preserve the existing R2 selection behavior,
-* while memory requires an explicit selector. Constructed once and shared by every
-* gateway so writes, reads, and GC use the same adapter.
-*/
+/** The one local blob store shared by sync writes, artifact reads, and GC. */
 function createBlobStore() {
-	const selection = process.env.PIEVO_BLOB_STORE?.trim().toLowerCase();
-	if (selection && ![
-		"local",
-		"r2",
-		"memory"
-	].includes(selection)) throw new Error("PIEVO_BLOB_STORE must be local, r2, or memory");
-	if (selection === "memory") {
-		log$4.warn("blob store: EPHEMERAL MEMORY explicitly selected; all artifact bytes are lost on restart");
-		return new MemoryBlobStore();
-	}
-	if (selection === "local") {
-		const local = new LocalBlobStore();
-		log$4.info({ root: local.root }, "blob store: local filesystem (explicit)");
-		return local;
-	}
-	const cfg = r2Config();
-	if (selection === "r2" && !cfg) throw new Error("PIEVO_BLOB_STORE=r2 requires complete PIEVO_R2_* configuration");
-	if (cfg) {
-		log$4.info({
-			bucket: cfg.bucket,
-			endpoint: cfg.endpoint
-		}, "blob store: Cloudflare R2");
-		return new R2BlobStore(cfg);
-	}
 	const local = new LocalBlobStore();
 	log$4.info({ root: local.root }, "blob store: local filesystem");
 	return local;
 }
 /**
 * Artifact-storage retention + garbage collection — the policy that keeps the
-* local/R2 byte store from growing monotonically.
+* local byte store from growing monotonically.
 *
 * The artifact pipeline is content-addressed: blob BYTES are keyed by sha256 and
 * deduped across every loop/run. When a path is deleted or its content changes,
@@ -3698,7 +2371,7 @@ var log$3 = logger.child({ mod: "retention" });
 * (most-recent-N). Returns the total number pruned. This is what makes an old
 * snapshot's now-unreferenced blobs collectable by gcBlobs().
 */
-async function pruneSnapshots(keep = snapshotRetention()) {
+async function pruneSnapshots(keep = 20) {
 	let pruned = 0;
 	for (const loopId of await loopIdsWithSnapshots()) pruned += await pruneRunSnapshots(loopId, keep);
 	return pruned;
@@ -3727,7 +2400,7 @@ async function pruneSnapshots(keep = snapshotRetention()) {
 *         so that file re-uploads its bytes on the next sync. We never leave a
 *         live blobs row pointing at deleted bytes.
 */
-async function gcBlobs(blobStore, graceMs = blobGcGraceMs()) {
+async function gcBlobs(blobStore, graceMs = BLOB_GC_GRACE_MS) {
 	const refs = await liveBlobRefs();
 	const garbage = (await blobHashesOlderThan(new Date(Date.now() - graceMs).toISOString())).filter((h) => !refs.has(h));
 	let snapCount = await countRunSnapshots();
@@ -3753,15 +2426,9 @@ async function gcBlobs(blobStore, graceMs = blobGcGraceMs()) {
 	}
 	return reclaimed;
 }
-/**
-* One full storage-maintenance pass: prune snapshots, then GC the blobs they
-* freed (plus any already-unreferenced). Order matters — pruning first lets the
-* same pass reclaim the blobs it just unpinned. Idempotent and safe with no
-* garbage (returns zeros).
-*/
-async function maintainStorage(blobStore) {
-	const snapshotsPruned = await pruneSnapshots();
-	const blobsReclaimed = await gcBlobs(blobStore);
+async function maintainStorage(blobStore, options = {}) {
+	const snapshotsPruned = await pruneSnapshots(options.keep);
+	const blobsReclaimed = await gcBlobs(blobStore, options.graceMs);
 	if (snapshotsPruned || blobsReclaimed) log$3.info({
 		snapshotsPruned,
 		blobsReclaimed
@@ -3884,6 +2551,7 @@ function doc(...sections) {
 }
 var LOOP_CONFIG_FIELDS = [
 	"name",
+	"tags",
 	"schedule",
 	"workdir",
 	"agent",
@@ -4175,18 +2843,24 @@ function statusDefinitionsFromLoop(loop) {
 	};
 }
 function canonicalLoopEnvelope(loop) {
+	return {
+		...canonicalLoopSummary(loop),
+		prompt: loop.prompt,
+		statusDefinitions: statusDefinitionsFromLoop(loop),
+		artifacts: loop.artifacts,
+		enabled: loop.enabled
+	};
+}
+function canonicalLoopSummary(loop) {
 	return {
 		id: loop.id,
 		name: loop.name,
+		tags: loop.tags,
 		schedule: scheduleFromLoop(loop),
 		workdir: loop.workdir,
 		agent: loop.agent,
 		model: loop.model ?? null,
-		reasoningEffort: loop.reasoningEffort ?? null,
-		prompt: loop.prompt,
-		statusDefinitions: statusDefinitionsFromLoop(loop),
-		artifacts: loop.artifacts,
-		enabled: loop.enabled
+		reasoningEffort: loop.reasoningEffort ?? null
 	};
 }
 function validateLoopCreate(value) {
@@ -4202,6 +2876,8 @@ function validateLoopCreate(value) {
 	};
 	const name = requiredText(raw.name, "name");
 	if (!name.ok) return name;
+	const tags = validateLoopTags(raw.tags);
+	if (!tags.ok) return tags;
 	const workdir = validateWorkdir(raw.workdir);
 	if (!workdir.ok) return workdir;
 	const prompt = requiredText(raw.prompt, "prompt", true);
@@ -4227,6 +2903,7 @@ function validateLoopCreate(value) {
 	};
 	const config = {
 		name: name.value,
+		tags: tags.value,
 		schedule: schedule.value,
 		workdir: workdir.value,
 		agent,
@@ -4243,6 +2920,7 @@ function validateLoopCreate(value) {
 			config,
 			row: {
 				name: config.name,
+				tags: config.tags,
 				...rowSchedule(config.schedule),
 				workdir: config.workdir,
 				agent: config.agent,
@@ -4275,6 +2953,11 @@ function validateLoopEdit(loop, value) {
 		if (!result.ok) return result;
 		update.name = result.value;
 	}
+	if (raw.tags !== void 0) {
+		const result = validateLoopTags(raw.tags);
+		if (!result.ok) return result;
+		update.tags = result.value;
+	}
 	if (raw.workdir !== void 0) {
 		const result = validateWorkdir(raw.workdir);
 		if (!result.ok) return result;
@@ -4394,7 +3077,7 @@ var configuredRunTimeoutMs = Number(process.env.PIEVO_RUN_TIMEOUT_MS || 20 * 6e4
 var RUN_TIMEOUT_MS = Number.isFinite(configuredRunTimeoutMs) && configuredRunTimeoutMs > 0 ? configuredRunTimeoutMs : 20 * 6e4;
 /** The ONLY keys an owner `editLoop` patch may touch. A key outside this set is
 *  rejected (400) rather than silently ignored, so a `--json` typo fails loudly
-*  and identity/ownership columns (id/userId/machineId/timestamps) can never be
+*  and identity columns (id/machineId/timestamps) can never be
 *  patched over the device-token edit surface. Exported for `cli.ts`
 *  (the `new`/`edit` verb help lists these keys). */
 var EDITABLE_LOOP_FIELDS = LOOP_EDIT_FIELDS;
@@ -4692,7 +3375,7 @@ var MachineGateway = class {
 	* grace window + final re-check protect freshly-written/referenced blobs) and
 	* idempotent with no garbage. Best-effort — never throws into the caller.
 	*/
-	async maintainStorage() {
+	async maintainStorage(options) {
 		if (this.maintenanceRunning) {
 			log$2.info("storage maintenance already in progress — skipping this tick");
 			return {
@@ -4702,7 +3385,7 @@ var MachineGateway = class {
 		}
 		this.maintenanceRunning = true;
 		try {
-			return await maintainStorage(this.blobStore);
+			return await maintainStorage(this.blobStore, options);
 		} catch (err) {
 			log$2.warn({ err: err instanceof Error ? err.message : String(err) }, "storage maintenance failed");
 			return {
@@ -4719,14 +3402,12 @@ var MachineGateway = class {
 		const { machineId } = auth;
 		let machine = auth.machine;
 		if (!machine) {
-			const binding = await readConnectKeyBinding(deviceToken);
-			if (!binding) return {
+			if (!await connectKeyValid(deviceToken)) return {
 				status: 401,
 				body: { error: "unknown device token — connect this machine first" }
 			};
 			machine = await createMachine({
 				id: machineId,
-				userId: binding.userId,
 				name: info?.host || `machine-${machineId.slice(2, 8)}`,
 				tokenHash: sha256(deviceToken),
 				token: deviceToken,
@@ -4874,7 +3555,7 @@ var MachineGateway = class {
 			status: 200,
 			body: {
 				registered: false,
-				claimValid: await readConnectKeyBinding(deviceToken) !== void 0,
+				claimValid: await connectKeyValid(deviceToken),
 				online: false,
 				name: null,
 				lastSeen: null,
@@ -4904,7 +3585,6 @@ var MachineGateway = class {
 		const auth = await authenticateDeviceToken(deviceToken);
 		if (!auth.ok) return auth.response;
 		const { machineId } = auth;
-		const machine = auth.machine;
 		{
 			if (body === null || typeof body !== "object" || Array.isArray(body)) return {
 				status: 400,
@@ -4947,7 +3627,6 @@ var MachineGateway = class {
 				}
 			};
 			const loop = await createLoop({
-				userId: machine.userId,
 				machineId,
 				...row
 			});
@@ -5170,6 +3849,51 @@ var MachineGateway = class {
 		log$2.info({ runId: lease.runId }, "report: ignored (run was canceled)");
 		return response;
 	}
+	async reportRaceResponse(runToken, lease, body, payloadDigest) {
+		const raced = await committedReportEvidence(body.reportId, payloadDigest, lease.runId);
+		if (raced.response) return raced.response;
+		if (raced.foreignRun) return this.rejectTerminalAttempt(runToken, lease, body, payloadDigest, "REPORT_CONFLICT", ["reportId was already committed for another run"]);
+	}
+	async resolveLostTerminalRace(runToken, lease, body, payloadDigest, retryReconcile, logMessage) {
+		const raced = await this.reportRaceResponse(runToken, lease, body, payloadDigest);
+		if (raced) return raced;
+		const fresh = await getRun(lease.runId);
+		if (fresh?.phase === "canceled") return this.ignoreCanceledReport(runToken, lease, body);
+		if (fresh?.phase === "done") return {
+			status: 409,
+			body: {
+				error: "run already finalized",
+				code: "REPORT_NOT_FINALIZED",
+				reportId: body.reportId
+			}
+		};
+		const refreshedLease = await resolveLease(runToken);
+		if (refreshedLease?.state === "retired") return this.retiredReport(runToken, body, lease.runId);
+		if (retryReconcile && fresh?.phase === "error" && refreshedLease?.state === "terminal-grace") return this.reconcileReclaimedReport(runToken, refreshedLease, fresh, body);
+		log$2.info({
+			runId: lease.runId,
+			phase: fresh?.phase
+		}, logMessage);
+		return {
+			status: 409,
+			body: {
+				error: "terminal report was not finalized",
+				code: "REPORT_NOT_FINALIZED",
+				reportId: body.reportId
+			}
+		};
+	}
+	async captureRunSnapshot(runId, loopId) {
+		try {
+			await putRunSnapshot(runId, loopId, await buildLoopManifest(loopId));
+			await pruneRunSnapshots(loopId, 20);
+		} catch (err) {
+			log$2.warn({
+				runId,
+				err: err instanceof Error ? err.message : String(err)
+			}, "snapshot capture failed");
+		}
+	}
 	/** Reconcile one swept run. The store consumes the terminal-grace lease in the
 	* same loop-lock transaction as the error→done/error patch and loop state, so
 	* concurrent late reports cannot both win (including error→error). */
@@ -5192,51 +3916,14 @@ var MachineGateway = class {
 				ts: nowIso()
 			}, loopPatch, AUTOPAUSE_STREAK, receipt);
 		} catch (error) {
-			const raced = await committedReportEvidence(receipt.reportId, payloadDigest, lease.runId);
-			if (raced.response) return raced.response;
-			if (raced.foreignRun) return this.rejectTerminalAttempt(runToken, lease, body, payloadDigest, "REPORT_CONFLICT", ["reportId was already committed for another run"]);
+			const raced = await this.reportRaceResponse(runToken, lease, body, payloadDigest);
+			if (raced) return raced;
 			throw error;
 		}
-		if (!reconciled) {
-			const raced = await committedReportEvidence(receipt.reportId, payloadDigest, lease.runId);
-			if (raced.response) return raced.response;
-			if (raced.foreignRun) return this.rejectTerminalAttempt(runToken, lease, body, payloadDigest, "REPORT_CONFLICT", ["reportId was already committed for another run"]);
-			const fresh = await getRun(lease.runId);
-			if (fresh?.phase === "canceled") return this.ignoreCanceledReport(runToken, lease, body);
-			if (fresh?.phase === "done") return {
-				status: 409,
-				body: {
-					error: "run already finalized",
-					code: "REPORT_NOT_FINALIZED",
-					reportId: body.reportId
-				}
-			};
-			if ((await resolveLease(runToken))?.state === "retired") return this.retiredReport(runToken, body, lease.runId);
-			log$2.info({
-				runId: lease.runId,
-				phase: fresh?.phase
-			}, "report: late reconcile lost terminal race");
-			return {
-				status: 409,
-				body: {
-					error: "terminal report was not finalized",
-					code: "REPORT_NOT_FINALIZED",
-					reportId: body.reportId
-				}
-			};
-		}
+		if (!reconciled) return this.resolveLostTerminalRace(runToken, lease, body, payloadDigest, false, "report: late reconcile lost terminal race");
 		const deleting = reconciled.loop.deleteRequestedAt != null;
 		const reportOnly = reconciled.reportOnly === true;
-		if (!deleting && !reportOnly) try {
-			await putRunSnapshot(lease.runId, lease.loopId, await buildLoopManifest(lease.loopId));
-			await pruneRunSnapshots(lease.loopId, snapshotRetention());
-		} catch (err) {
-			log$2.warn({
-				runId: lease.runId,
-				err: err instanceof Error ? err.message : String(err)
-			}, "snapshot capture failed");
-		}
-		reconciled.run;
+		if (!deleting && !reportOnly) await this.captureRunSnapshot(lease.runId, lease.loopId);
 		if (!reportOnly) this.scheduler.addLoop(reconciled.loop);
 		if (!reportOnly) this.applyAutopauseTimer(lease.loopId, reconciled);
 		if (deleting) await tryDeleteLoop(lease.loopId);
@@ -5372,52 +4059,13 @@ var MachineGateway = class {
 				ts: nowIso()
 			}, loopPatch, sha256(runToken), AUTOPAUSE_STREAK, expected);
 		} catch (error) {
-			const raced = await committedReportEvidence(reportId, payloadDigest, lease.runId);
-			if (raced.response) return raced.response;
-			if (raced.foreignRun) return this.rejectTerminalAttempt(runToken, lease, body, payloadDigest, "REPORT_CONFLICT", ["reportId was already committed for another run"]);
+			const raced = await this.reportRaceResponse(runToken, lease, body, payloadDigest);
+			if (raced) return raced;
 			throw error;
 		}
-		if (!terminal) {
-			const raced = await committedReportEvidence(reportId, payloadDigest, lease.runId);
-			if (raced.response) return raced.response;
-			if (raced.foreignRun) return this.rejectTerminalAttempt(runToken, lease, body, payloadDigest, "REPORT_CONFLICT", ["reportId was already committed for another run"]);
-			const fresh = await getRun(lease.runId);
-			if (fresh?.phase === "canceled") return this.ignoreCanceledReport(runToken, lease, body);
-			if (fresh?.phase === "done") return {
-				status: 409,
-				body: {
-					error: "run already finalized",
-					code: "REPORT_NOT_FINALIZED",
-					reportId
-				}
-			};
-			const refreshedLease = await resolveLease(runToken);
-			if (refreshedLease?.state === "retired") return this.retiredReport(runToken, body, lease.runId);
-			if (fresh?.phase === "error" && refreshedLease?.state === "terminal-grace") return this.reconcileReclaimedReport(runToken, refreshedLease, fresh, body);
-			log$2.info({
-				runId: lease.runId,
-				phase: fresh?.phase
-			}, "report: lost terminal race");
-			return {
-				status: 409,
-				body: {
-					error: "terminal report was not finalized",
-					code: "REPORT_NOT_FINALIZED",
-					reportId
-				}
-			};
-		}
-		terminal.run;
+		if (!terminal) return this.resolveLostTerminalRace(runToken, lease, body, payloadDigest, true, "report: lost terminal race");
 		const deleting = terminal.loop.deleteRequestedAt != null;
-		if (!deleting) try {
-			await putRunSnapshot(lease.runId, lease.loopId, await buildLoopManifest(lease.loopId));
-			await pruneRunSnapshots(lease.loopId, snapshotRetention());
-		} catch (err) {
-			log$2.warn({
-				runId: lease.runId,
-				err: err instanceof Error ? err.message : String(err)
-			}, "snapshot capture failed");
-		}
+		if (!deleting) await this.captureRunSnapshot(lease.runId, lease.loopId);
 		this.scheduler.addLoop(terminal.loop);
 		this.applyAutopauseTimer(lease.loopId, terminal);
 		log$2.info({
@@ -5689,6 +4337,7 @@ var ArtifactSync = class {
 * process execution, so the server's zero-exec invariant holds. Binary/oversize
 * files emit a size-delta marker only (no inline diff).
 */
+var runDiff_exports = /* @__PURE__ */ __exportAll({ computeRunDiff: () => computeRunDiff });
 /**
 * Upper bound for computing an inline unified diff. jsdiff is synchronous and
 * roughly O(N*D); on a multi-MB or minified text file it would block the
@@ -6405,7 +5054,6 @@ var CliGateway = class {
 				action: "force-delete",
 				loopId: loop.id,
 				machineId,
-				actorUserId: loop.userId,
 				machineReachability: reachability
 			});
 			return {
@@ -6793,6 +5441,7 @@ function renderShowText(loop, env, totalRuns, lastRun, opts = {}) {
 	const block = detailBlock("loop", [
 		["id", env.id],
 		["name", env.name],
+		["tags", { raw: JSON.stringify(env.tags) }],
 		["schedule", { raw: JSON.stringify(env.schedule) }],
 		["workdir", env.workdir],
 		["agent", env.agent],
@@ -7029,87 +5678,6 @@ function msg(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 /**
-* DB watchdog — the real auto-recovery backstop for a wedged postgres-js pool.
-*
-* BACKGROUND (2026-07-12 outage, twice in one day): the runtime pool against the
-* Supabase transaction pooler wedged — every connection stuck on a query that
-* never returned, so `/api/health/db`'s `select 1` queued behind them forever and
-* the server stopped sending response headers. Fly's health check went `critical`,
-* which only PULLS the machine from load balancing (a well-known Fly footgun:
-* failing `[http_service.checks]` do NOT restart the VM — only a process EXIT
-* triggers `restart.policy = "on-failure"`). Result: ~9h fully down with no
-* auto-recovery until a manual `fly machine restart`. The pool's own self-healing
-* (`max_lifetime`/`statement_timeout`, `db/index.ts`) can't cover a busy-wedged
-* connection or a dead socket that never errors.
-*
-* This watchdog closes that gap: it pings `select 1` on a fixed cadence under a
-* HARD client-side deadline (a hung ping counts as a failure, since the underlying
-* query can't be canceled). After N consecutive failures it exits the process, so
-* Fly restarts the machine with a fresh pool — turning a multi-hour hang into a
-* ~1-2min self-heal. A single healthy ping resets the streak, so a transient blip
-* never restarts the box.
-*
-* Pure + injectable: `makeDbWatchdog` takes the probe / exit / clock as deps so the
-* decision logic is unit-tested with no real DB, timers, or `process.exit`.
-*/
-/** Reject if `p` hasn't settled within `ms`. The underlying promise keeps running
-*  (we can't cancel a wedged query) — bounded by the exit after `failureThreshold`. */
-function withDeadline(p, ms, setTimer, clearTimer) {
-	return new Promise((resolve, reject) => {
-		const h = setTimer(() => reject(/* @__PURE__ */ new Error(`db ping timed out after ${ms}ms`)), ms);
-		p.then((v) => {
-			clearTimer(h);
-			resolve(v);
-		}, (e) => {
-			clearTimer(h);
-			reject(e instanceof Error ? e : new Error(String(e)));
-		});
-	});
-}
-function makeDbWatchdog(deps) {
-	const { probe, exit, timeoutMs, failureThreshold, setTimer = (fn, ms) => setTimeout(fn, ms), clearTimer = (h) => clearTimeout(h), log = logger } = deps;
-	let consecutive = 0;
-	let running = false;
-	let done = false;
-	async function tick() {
-		if (running || done) return;
-		running = true;
-		try {
-			await withDeadline(Promise.resolve().then(probe), timeoutMs, setTimer, clearTimer);
-			consecutive = 0;
-		} catch (err) {
-			consecutive += 1;
-			log.warn({
-				consecutive,
-				failureThreshold,
-				err: String(err)
-			}, "db watchdog: liveness ping failed");
-			if (consecutive >= failureThreshold) {
-				done = true;
-				log.error({ consecutive }, "db watchdog: database unreachable for too long — exiting so the platform restarts with a fresh pool");
-				exit(1);
-			}
-		} finally {
-			running = false;
-		}
-	}
-	return {
-		tick,
-		failures: () => consecutive
-	};
-}
-/**
-* Start the watchdog on a repeating interval. Returns a stop function (cleared on
-* the boot AbortController). The interval is `unref`'d so it never keeps the
-* process alive on its own.
-*/
-function startDbWatchdog(deps) {
-	const wd = makeDbWatchdog(deps);
-	const handle = setInterval(() => void wd.tick(), deps.intervalMs);
-	handle.unref?.();
-	return () => clearInterval(handle);
-}
-/**
 * Server boot — idempotent one-time init of the in-process backend: apply
 * migrations, wire the machine gateway's dispatcher into the Scheduler, start
 * the Scheduler + an offline-sweep interval. Guarded on `globalThis` so it
@@ -7117,6 +5685,12 @@ function startDbWatchdog(deps) {
 * from any server-side entry (the standalone machine server / TanStack server
 * fns); the first call boots, the rest share the same instance.
 */
+var boot_exports = /* @__PURE__ */ __exportAll({
+	ensureServer: () => ensureServer,
+	getArtifactSync: () => getArtifactSync,
+	getCliGateway: () => getCliGateway,
+	getGateway: () => getGateway
+});
 var g = globalThis;
 function ensureServer() {
 	if (g.__pievoBooted) return g.__pievoBooted;
@@ -7128,7 +5702,6 @@ function ensureServer() {
 	return p;
 }
 async function boot() {
-	loginGateEnabled();
 	await runMigrations();
 	await repairTerminalRunLeases();
 	const abort = new AbortController();
@@ -7149,27 +5722,9 @@ async function boot() {
 	const sweep = setInterval(() => void gateway.sweep().catch((err) => logger.error({ err: String(err) }, "sweep tick failed")), ONLINE_TTL_MS);
 	sweep.unref?.();
 	abort.signal.addEventListener("abort", () => clearInterval(sweep), { once: true });
-	const gc = setInterval(() => void gateway.maintainStorage().catch((err) => logger.error({ err: String(err) }, "gc tick failed")), gcIntervalMs());
+	const gc = setInterval(() => void gateway.maintainStorage().catch((err) => logger.error({ err: String(err) }, "gc tick failed")), GC_INTERVAL_MS);
 	gc.unref?.();
 	abort.signal.addEventListener("abort", () => clearInterval(gc), { once: true });
-	if (dbWatchdogEnabled()) {
-		const intervalMs = dbWatchdogIntervalMs();
-		const timeoutMs = dbWatchdogTimeoutMs();
-		const failureThreshold = dbWatchdogFailureThreshold();
-		logger.info({
-			intervalMs,
-			timeoutMs,
-			failureThreshold
-		}, "db watchdog: armed");
-		const stopWatchdog = startDbWatchdog({
-			probe: () => db.execute(sql`select 1`),
-			exit: (code) => process.exit(code),
-			intervalMs,
-			timeoutMs,
-			failureThreshold
-		});
-		abort.signal.addEventListener("abort", () => stopWatchdog(), { once: true });
-	}
 	logger.info("pievo server booted");
 	return {
 		scheduler,
@@ -7190,4 +5745,4 @@ async function getCliGateway() {
 	return (await ensureServer()).cliGateway;
 }
 //#endregion
-export { listLoopsForUser as $, getBaseURL as A, updateMachine as At, getRun as B, defu as C, sha256 as Ct, forceDeleteMachine as D, toKebabCase as Dt, forceDeleteLoop as E, stopLoop as Et, getHost as F, wildcardMatch as Ft, isOutdated as G, hasRunningRun as H, getLoop as I, isSafeUrlScheme as J, isProduction as K, getMachine as L, getCliGateway as M, validPollCurrentRun as Mt, getEnvVar as N, validPollWireId as Nt, getArtifactFile as O, tryDeleteLoop as Ot, getGateway as P, validateLoopEdit as Pt, listLoops as Q, getOrigin as R, db as S, scheduleFromLoop as St, env as T, statusDefinitionsFromLoop as Tt, isDevelopment as U, hasPendingRun as V, isDynamicBaseURLConfig as W, kAPIErrorHeaderSymbol as X, isTest as Y, listArtifacts as Z, countRuns as _, rememberConnectKey as _t, BetterAuthError as a, loginGateEnabled as at, createMachine as b, resolveBaseURL as bt, ENV as c, machinePresence as ct, POLL_HTTP_BODY_FIELDS as d, parseArtifactSyncBody as dt, listMachines as et, SYNC_BODY_CAP as f, pauseLoop as ft, computeRunDiff as g, reconciliationStatesForRuns as gt, capitalizeFirstLetter as h, recentLoopUsage as ht, BLOB_CAP as i, logger as it, getBooleanEnvVar as j, validOptionalPollString as jt, getArtifactSync as k, updateLoop as kt, MACHINE_BODY_CAP as l, mintDeviceToken as lt, betterFetch as m, readJsonBody as mt, APIError$1 as n, listRuns as nt, BetterCallError as o, loopsForMachine as ot, ValidationError$1 as p, readByteBody as pt, isRequestLike as q, BASE_ERROR_CODES as r, listRunsBefore as rt, CODING_AGENTS as s, machineIdFromToken as st, APIError as t, listMachinesForUser as tt, MIN_DAEMON_VERSION as u, normalizePathname as ut, createDefu as v, requestDeleteLoop as vt, ensureServer as w, startLoop as wt, daemonNeedsUpdate as x, safeRelPath as xt, createFetch as y, requestRunCancel as yt, getProtocol as z };
+export { listMachines as A, reconciliationStatesForRuns as B, getMachine as C, isOutdated as D, hasRunningRun as E, machineIdFromToken as F, startLoop as G, requestRunCancel as H, machinePresence as I, updateLoop as J, stopLoop as K, mintDeviceToken as L, listRunsBefore as M, loopTags_C6vATFCp_exports as N, listArtifacts as O, loopsForMachine as P, pauseLoop as R, getLoop as S, hasPendingRun as T, safeRelPath as U, requestDeleteLoop as V, sha256 as W, validateLoopTags as X, updateMachine as Y, countRuns as _, canonicalLoopEnvelope as a, forceDeleteMachine as b, ensureServer as c, readJsonBody as d, validOptionalPollString as f, CODING_AGENTS as g, validateLoopEdit as h, boot_CYRi_wez_exports as i, listRuns as j, listLoops as k, getArtifactSync as l, validPollWireId as m, MIN_DAEMON_VERSION as n, canonicalLoopSummary as o, validPollCurrentRun as p, tryDeleteLoop as q, POLL_HTTP_BODY_FIELDS as r, daemonNeedsUpdate as s, MACHINE_BODY_CAP as t, readByteBody as u, createMachine as v, getRun as w, getArtifactFile as x, forceDeleteLoop as y, recentLoopUsage as z };