@kky42/pievo-server 2.4.14 → 3.0.0

package/.output/server/_ssr/{machineFns-BSrIgn3f.mjs → machineFns-CniGcY8s.mjs}

@@ -1,17 +1,7 @@
-import { Et as listMachinesForUser, G as forceDeleteMachine, Lt as mintDeviceToken, Nt as loopsForMachine, Pt as machineIdFromToken, Sn as sha256, Tt as listMachines$1, et as getMachine, j as createMachine$1, jn as updateMachine } from "./loopTags-CXx5UdGf.mjs";
-import { a as daemonNeedsUpdate, n as MIN_DAEMON_VERSION, o as ensureServer } from "./boot-C472kLwY.mjs";
-import { requestScope } from "./auth-0AamrwHo.mjs";
-import { n as createServerFn } from "./ssr.mjs";
+import { A as listMachines$1, C as getMachine, F as machineIdFromToken, L as mintDeviceToken, P as loopsForMachine, W as sha256, Y as updateMachine, b as forceDeleteMachine, c as ensureServer, n as MIN_DAEMON_VERSION, s as daemonNeedsUpdate, v as createMachine$1 } from "./boot-CYRi-wez.mjs";
+import { r as createServerFn } from "./ssr.mjs";
 import { t as createServerRpc } from "./createServerRpc-BD8Xn_0_.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/machineFns-BSrIgn3f.js
-/** Open mode sees every machine; auth mode sees only the signed-in owner's rows. */
-function machineInScope(machine, scope) {
-	return !scope.enforce || !!scope.userId && machine.userId === scope.userId;
-}
-/** A device token fully impersonates its machine, so auth mode keeps it owner-only. */
-function tokenVisibleTo(machine, scope) {
-	return machineInScope(machine, scope);
-}
+//#region node_modules/.nitro/vite/services/ssr/assets/machineFns-CniGcY8s.js
 /**
 * Latest published @kky42/pievo version — a cached, fail-silent lookup of the
 * npm dist-tag `latest`, so the web can tell a user their daemon is outdated and
@@ -93,21 +83,10 @@ var LatestDaemonVersion = class {
 };
 var latestDaemonVersion = new LatestDaemonVersion();
 /**
-* Machine-management server functions. In auth mode, the signed-in user is the
-* sole human authorization boundary. Open mode intentionally shares all machine
-* administration, including reconnect tokens.
+* Machine-management server functions. Pievo is single-user: anyone who can
+* reach the dashboard administers every machine, including reconnect tokens.
 */
-/** Missing and out-of-scope machines both resolve to undefined. */
-async function scopedMachine(id) {
-	const scope = await requestScope();
-	if (scope.enforce && !scope.userId) return { scope };
-	const candidate = await getMachine(id);
-	return {
-		scope,
-		machine: candidate && machineInScope(candidate, scope) ? candidate : void 0
-	};
-}
-async function toSummary(machine, scope) {
+async function toSummary(machine) {
 	return {
 		id: machine.id,
 		name: machine.name,
@@ -121,7 +100,7 @@ async function toSummary(machine, scope) {
 		latestDaemonVersion: latestDaemonVersion.get(),
 		needsUpdate: daemonNeedsUpdate(machine.daemonVersion),
 		requiredDaemonVersion: MIN_DAEMON_VERSION,
-		token: tokenVisibleTo(machine, scope) ? machine.token ?? null : null,
+		token: machine.token ?? null,
 		loopCount: (await loopsForMachine(machine.id)).length
 	};
 }
@@ -132,10 +111,8 @@ var listMachines_createServerFn_handler = createServerRpc({
 }, (opts) => listMachines.__executeServer(opts));
 var listMachines = createServerFn({ method: "GET" }).handler(listMachines_createServerFn_handler, async () => {
 	await ensureServer();
-	const scope = await requestScope();
-	if (scope.enforce && !scope.userId) return [];
-	const machines = scope.enforce ? await listMachinesForUser(scope.userId) : await listMachines$1();
-	return Promise.all(machines.filter((machine) => machine.name.trim()).map((machine) => toSummary(machine, scope)));
+	const machines = await listMachines$1();
+	return Promise.all(machines.filter((machine) => machine.name.trim()).map(toSummary));
 });
 var createMachine_createServerFn_handler = createServerRpc({
 	id: "ed679b4e1e05e903a5d4ba4a70d9b9d883991ab22ed59b4d2d69078941818415",
@@ -144,13 +121,10 @@ var createMachine_createServerFn_handler = createServerRpc({
 }, (opts) => createMachine.__executeServer(opts));
 var createMachine = createServerFn({ method: "POST" }).handler(createMachine_createServerFn_handler, async () => {
 	await ensureServer();
-	const scope = await requestScope();
-	if (scope.enforce && !scope.userId) return { error: "not signed in" };
 	const token = mintDeviceToken();
 	const id = machineIdFromToken(token);
 	await createMachine$1({
 		id,
-		userId: scope.userId ?? "shared",
 		name: "",
 		tokenHash: sha256(token),
 		token,
@@ -168,8 +142,8 @@ var machineStatus_createServerFn_handler = createServerRpc({
 }, (opts) => machineStatus.__executeServer(opts));
 var machineStatus = createServerFn({ method: "GET" }).validator((id) => id).handler(machineStatus_createServerFn_handler, async ({ data: id }) => {
 	await ensureServer();
-	const { scope, machine } = await scopedMachine(id);
-	return machine ? toSummary(machine, scope) : null;
+	const machine = await getMachine(id);
+	return machine ? toSummary(machine) : null;
 });
 var finalizeMachine_createServerFn_handler = createServerRpc({
 	id: "27d7eba0b6a2257949392fdd56057275a5c5366484ae01faf3b5897a225ecd83",
@@ -180,8 +154,6 @@ var finalizeMachine = createServerFn({ method: "POST" }).validator((data) => dat
 	await ensureServer();
 	const name = data.name?.trim();
 	if (!name) return { ok: false };
-	const { machine } = await scopedMachine(data.id);
-	if (!machine) return { ok: false };
 	return { ok: !!await updateMachine(data.id, { name }) };
 });
 var deleteMachine_createServerFn_handler = createServerRpc({
@@ -191,17 +163,8 @@ var deleteMachine_createServerFn_handler = createServerRpc({
 }, (opts) => deleteMachine.__executeServer(opts));
 var deleteMachine = createServerFn({ method: "POST" }).validator((id) => id).handler(deleteMachine_createServerFn_handler, async ({ data: id }) => {
 	const { scheduler } = await ensureServer();
-	const { scope, machine } = await scopedMachine(id);
-	if (scope.enforce && !scope.userId) return {
-		ok: false,
-		error: "unauthorized"
-	};
-	if (!machine) return {
-		ok: false,
-		error: "machine not found"
-	};
-	const deleted = scope.enforce ? await forceDeleteMachine(id, scope.userId) : await forceDeleteMachine(id);
-	if (deleted.state === "forbidden" || deleted.state === "not-found") return {
+	const deleted = await forceDeleteMachine(id);
+	if (deleted.state === "not-found") return {
 		ok: false,
 		error: "machine not found"
 	};

package/.output/server/_ssr/networkAccess-CIlK3ION.mjs

@@ -0,0 +1,30 @@
+import { isIP } from "node:net";
+//#region node_modules/.nitro/vite/services/ssr/assets/networkAccess-CIlK3ION.js
+/**
+* Pievo has no login, so the network is the access boundary: only this
+* machine, private LAN ranges, and Tailscale peers may reach any route.
+* Anyone who passes this check can run prompts on every connected machine.
+* Requests proxied by `tailscale serve` arrive from loopback.
+*
+* IPv4: loopback 127/8, RFC 1918 (10/8, 172.16/12, 192.168/16), link-local
+* 169.254/16, and CGNAT 100.64/10 (Tailscale addresses). IPv6: loopback,
+* link-local fe80::/10, and unique-local fc00::/7 (includes Tailscale's
+* fd7a:115c:a1e0::/48). IPv4-mapped IPv6 is checked as IPv4.
+*/
+function isTrustedPeer(address) {
+	if (!address) return false;
+	const ip = address.toLowerCase().replace(/^::ffff:(?=\d+\.\d+\.\d+\.\d+$)/, "").split("%")[0];
+	const family = isIP(ip);
+	if (family === 4) {
+		const [a, b] = ip.split(".").map(Number);
+		return a === 127 || a === 10 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 169 && b === 254 || a === 100 && b >= 64 && b <= 127;
+	}
+	if (family === 6) {
+		if (ip === "::1") return true;
+		const first = parseInt(ip.split(":")[0] || "0", 16);
+		return (first & 65472) === 65152 || (first & 65024) === 64512;
+	}
+	return false;
+}
+//#endregion
+export { isTrustedPeer };

package/.output/server/_ssr/router-BFIH2UAE.mjs

@@ -0,0 +1,362 @@
+import { c as ensureServer, d as readJsonBody, f as validOptionalPollString, m as validPollWireId, p as validPollCurrentRun, r as POLL_HTTP_BODY_FIELDS, t as MACHINE_BODY_CAP, u as readByteBody } from "./boot-CYRi-wez.mjs";
+import { h as require_jsx_runtime } from "../_libs/@base-ui/react+[...].mjs";
+import { c as createFileRoute, i as HeadContent, l as createRootRoute, o as createRouter, r as Scripts } from "../_libs/@tanstack/react-router+[...].mjs";
+import { r as imageMime, t as Route$10 } from "./artifactKind-DqpmtxDU.mjs";
+import { t as Route$11 } from "./loops._loopId_.runs._runId-BFP9oMrp.mjs";
+import { n as Route$12 } from "./routes-DnE7XDe_.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/router-BFIH2UAE.js
+var import_jsx_runtime = require_jsx_runtime();
+var app_default = "/assets/app-DXLuQNb9.css";
+var Route$9 = createRootRoute({
+	head: () => ({
+		meta: [
+			{ charSet: "utf-8" },
+			{
+				name: "viewport",
+				content: "width=device-width, initial-scale=1"
+			},
+			{ title: "Pievo" }
+		],
+		links: [{
+			rel: "stylesheet",
+			href: app_default
+		}, {
+			rel: "icon",
+			type: "image/svg+xml",
+			href: "/favicon.svg"
+		}]
+	}),
+	shellComponent: RootDocument
+});
+function RootDocument({ children }) {
+	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("html", {
+		lang: "en",
+		suppressHydrationWarning: true,
+		children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)("head", { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(HeadContent, {}) }), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("body", {
+			className: "dot-grid-subtle bg-paper font-sans text-primary antialiased",
+			suppressHydrationWarning: true,
+			children: [children, /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Scripts, {})]
+		})]
+	});
+}
+async function machineJsonRoute(request, options) {
+	const auth = request.headers.get("authorization") ?? "";
+	const token = auth.startsWith("Bearer ") ? auth.slice(7) : "";
+	if (!token) return Response.json({ error: options.missingCredential }, { status: 401 });
+	const parsed = await readJsonBody(request, MACHINE_BODY_CAP);
+	if (parsed.kind === "too-large") return Response.json({ error: "body too large" }, { status: 413 });
+	if (parsed.kind !== "ok") {
+		if (options.invalidBody === void 0) return Response.json({ error: options.invalidJsonError ?? "invalid JSON body" }, { status: 400 });
+		return options.handle(token, options.invalidBody);
+	}
+	const body = options.parseBody(parsed.body);
+	if (body === null) return Response.json({ error: options.invalidBodyError ?? "invalid request body" }, { status: 400 });
+	return options.handle(token, body);
+}
+var Route$8 = createFileRoute("/machine/report")({ server: { handlers: { POST: async ({ request }) => {
+	return machineJsonRoute(request, {
+		missingCredential: "missing token",
+		invalidBody: {},
+		parseBody: (value) => value && typeof value === "object" ? value : {},
+		handle: async (token, body) => {
+			const { getGateway } = await import("./boot-CYRi-wez.mjs").then((n) => n.i).then((n) => n.t);
+			const r = await (await getGateway()).report(token, body);
+			return Response.json(r.body, { status: r.status });
+		}
+	});
+} } } });
+/**
+* Deep readiness for process launchers. Unlike /api/health, this waits for the
+* one-time backend boot (migrations, blob-store selection, and scheduler start).
+* The per-launch nonce lets a launcher reject a different process already bound
+* to the requested port.
+*/
+async function readyResponse(ensure = ensureServer, env = process.env) {
+	await ensure();
+	return Response.json({
+		ok: true,
+		nonce: env.PIEVO_SERVER_LAUNCH_NONCE ?? null
+	});
+}
+var Route$7 = createFileRoute("/api/ready")({ server: { handlers: { GET: () => readyResponse() } } });
+var Route$6 = createFileRoute("/api/health")({ server: { handlers: { GET: async () => Response.json({ ok: true }) } } });
+/**
+* POST /api/machine/sync — exact artifact sync (Bearer DEVICE token). The daemon
+* posts the complete configured-path manifest after a run; the server reconciles
+* artifact_files and replies with needHashes for raw blob PUTs.
+* The manifest route retains its dedicated 32 MB JSON-body limit.
+*
+* This byte-ingress route is deliberately NOT rate limited (same rationale as the
+* blob PUT): it requires a valid registered device token (unknown ⇒ 401) and is
+* already bounded by the exact-path/hash handshake and 32MB sync-body cap, so a
+* limiter would only throttle a legitimate large sync.
+*/
+var Route$5 = createFileRoute("/api/machine/sync")({ server: { handlers: { POST: async ({ request }) => {
+	const auth = request.headers.get("authorization") ?? "";
+	const token = auth.startsWith("Bearer ") ? auth.slice(7) : "";
+	if (!token) return Response.json({ error: "missing device token" }, { status: 401 });
+	const { SYNC_BODY_CAP, parseArtifactSyncBody } = await import("./boot-CYRi-wez.mjs").then((n) => n.N).then((n) => n.v);
+	const parsed = await readJsonBody(request, SYNC_BODY_CAP);
+	if (parsed.kind === "too-large") return Response.json({ error: "sync body too large" }, { status: 413 });
+	if (parsed.kind === "invalid") return Response.json({ error: "invalid JSON" }, { status: 400 });
+	const body = parseArtifactSyncBody(parsed.body);
+	if (!body) return Response.json({ error: "invalid sync body" }, { status: 400 });
+	const { getArtifactSync } = await import("./boot-CYRi-wez.mjs").then((n) => n.i).then((n) => n.t);
+	const r = await (await getArtifactSync()).sync(token, body);
+	return Response.json(r.body, { status: r.status });
+} } } });
+var Route$4 = createFileRoute("/api/machine/status")({ server: { handlers: { GET: async ({ request }) => {
+	const auth = request.headers.get("authorization") ?? "";
+	const token = auth.startsWith("Bearer ") ? auth.slice(7) : "";
+	if (!token) return Response.json({ error: "missing device token" }, { status: 401 });
+	const { getGateway } = await import("./boot-CYRi-wez.mjs").then((n) => n.i).then((n) => n.t);
+	const r = await (await getGateway()).status(token);
+	return Response.json(r.body, { status: r.status });
+} } } });
+/** Reject non-object bodies, additions, coercible types, over-cap strings, and
+* NUL-bearing text before the gateway is loaded or any state can mutate. */
+function parsePollBody(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	if (Object.keys(value).some((key) => !POLL_HTTP_BODY_FIELDS.has(key))) return null;
+	const body = value;
+	if (!validOptionalPollString(body.host, 524288) || !validOptionalPollString(body.platform, 524288) || !validOptionalPollString(body.arch, 524288) || !validOptionalPollString(body.version, 64)) return null;
+	if (body.protocolVersion !== void 0 && (typeof body.protocolVersion !== "number" || !Number.isInteger(body.protocolVersion))) return null;
+	if (body.currentRuns !== void 0 && (!Array.isArray(body.currentRuns) || body.currentRuns.some((run) => !validPollCurrentRun(run)))) return null;
+	if (body.daemonInstanceId !== void 0 && !validPollWireId(body.daemonInstanceId)) return null;
+	if (body.recoveryComplete !== void 0 && typeof body.recoveryComplete !== "boolean") return null;
+	return body;
+}
+function gatewayPollRequest(body) {
+	return {
+		protocolVersion: body.protocolVersion,
+		currentRuns: body.currentRuns,
+		daemonInstanceId: body.daemonInstanceId,
+		recoveryComplete: body.recoveryComplete,
+		info: {
+			host: body.host,
+			platform: body.platform,
+			arch: body.arch,
+			version: body.version
+		}
+	};
+}
+var Route$3 = createFileRoute("/api/machine/poll")({ server: { handlers: { POST: async ({ request }) => {
+	return machineJsonRoute(request, {
+		missingCredential: "missing device token",
+		invalidBodyError: "unknown or invalid poll body fields",
+		invalidJsonError: "invalid JSON body",
+		parseBody: parsePollBody,
+		handle: async (token, body) => {
+			const { getGateway } = await import("./boot-CYRi-wez.mjs").then((n) => n.i).then((n) => n.t);
+			const r = await (await getGateway()).pollV4Wait(token, gatewayPollRequest(body));
+			return Response.json(r.body, { status: r.status });
+		}
+	});
+} } } });
+function parseCliBody(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	const body = value;
+	if (Object.keys(body).length !== 1 || !Object.prototype.hasOwnProperty.call(body, "argv")) return null;
+	if (!Array.isArray(body.argv) || body.argv.some((entry) => typeof entry !== "string")) return null;
+	return { argv: body.argv };
+}
+/**
+* POST /api/machine/cli — the ONE unified CLI dispatch (Bearer credential + `{argv}`).
+* `CliGateway.cli()` branches by credential type: a `dk_` device token takes owner
+* commands, while an `rk_` run credential can only report its run. Uses the standard
+* 2MB machine JSON body cap.
+*/
+var Route$2 = createFileRoute("/api/machine/cli")({ server: { handlers: { POST: async ({ request }) => {
+	return machineJsonRoute(request, {
+		missingCredential: "missing credential",
+		invalidJsonError: "body must be exactly {argv:string[]}",
+		invalidBodyError: "body must be exactly {argv:string[]}",
+		parseBody: parseCliBody,
+		handle: async (token, body) => {
+			const { getCliGateway } = await import("./boot-CYRi-wez.mjs").then((n) => n.i).then((n) => n.t);
+			const r = await (await getCliGateway()).cli(token, body.argv);
+			return Response.json(r.body, { status: r.status });
+		}
+	});
+} } } });
+/**
+* `decodeURIComponent` that returns null on malformed percent-encoding instead
+* of throwing a URIError (which would escape a route handler as a 500). Shared
+* by the routes that decode path segments; the policy is uniform — ANY
+* malformed segment is the caller's clean 400, never silently kept raw.
+*/
+function safeDecode(s) {
+	try {
+		return decodeURIComponent(s);
+	} catch {
+		return null;
+	}
+}
+/**
+* PUT /api/machine/blob/:hash — upload one content-addressed blob's raw bytes
+* (Bearer DEVICE token). The server recomputes sha256(body) and rejects a
+* mismatch before storing in the byte store. The hash is read from the URL (the daemon PUTs
+* exactly the hashes the sync handshake returned in needHashes).
+*
+* This byte-ingress route is deliberately NOT rate limited: it requires a valid
+* registered device token (unknown ⇒ 401, not an unauthenticated surface) and is
+* already bounded by the sync hash-handshake (the server only accepts hashes it
+* asked THIS machine for) plus the per-file 10MB byte cap. A
+* large first sync bursts many concurrent PUTs on one token, so any limiter would
+* only throttle legitimate uploads without adding real protection.
+*/
+var Route$1 = createFileRoute("/api/machine/blob/$hash")({ server: { handlers: { PUT: async ({ request }) => {
+	const auth = request.headers.get("authorization") ?? "";
+	const token = auth.startsWith("Bearer ") ? auth.slice(7) : "";
+	if (!token) return Response.json({ error: "missing device token" }, { status: 401 });
+	const hash = safeDecode(new URL(request.url).pathname.split("/").pop() ?? "");
+	if (hash === null) return Response.json({ error: "bad hash" }, { status: 400 });
+	const { BLOB_CAP } = await import("./boot-CYRi-wez.mjs").then((n) => n.N).then((n) => n.v);
+	const body = await readByteBody(request, BLOB_CAP);
+	if (body.kind === "too-large") return Response.json({ error: "blob exceeds size cap" }, { status: 413 });
+	if (body.kind === "invalid") return Response.json({ error: "could not read blob body" }, { status: 400 });
+	const buf = Buffer.from(body.bytes.buffer, body.bytes.byteOffset, body.bytes.byteLength);
+	const { getArtifactSync } = await import("./boot-CYRi-wez.mjs").then((n) => n.i).then((n) => n.t);
+	const r = await (await getArtifactSync()).putBlob(token, hash, buf);
+	return Response.json(r.body, { status: r.status });
+} } } });
+/**
+* GET /api/artifact/:loopId/:path - stream one of a loop's live-synced artifact
+* blobs. Two dispositions:
+*  - default: `attachment` (the download affordance for binary/oversize files;
+*    text is shown inline via getArtifact).
+*  - `?view=inline`: for a KNOWN image type only (the `imageMime` allowlist),
+*    served `inline` with the real image content-type so an <img> can render it.
+*    Hardened against a direct navigation turning the byte stream into a scripted
+*    document on the app origin: `X-Content-Type-Options: nosniff` pins the type
+*    and `Content-Security-Policy: sandbox` loads it in an opaque origin with no
+*    scripts - so an inline SVG can't run script against the session even if the
+*    URL is opened directly. Non-image inline requests fall back to attachment.
+*
+* Served to dashboard callers like the server functions. Path-safe: the relative path is
+* normalized + traversal-rejected before it ever reaches a blob, and blob keys
+* are content hashes, never the user path. Reads stream from the local
+* BlobStore; the route never writes.
+*/
+var PREFIX = "/api/artifact/";
+var Route = createFileRoute("/api/artifact/$loopId/$")({ server: { handlers: { GET: async ({ request }) => {
+	const pathname = new URL(request.url).pathname;
+	if (!pathname.startsWith(PREFIX)) return Response.json({ error: "not found" }, { status: 404 });
+	const after = pathname.slice(14);
+	const slash = after.indexOf("/");
+	if (slash < 0) return Response.json({ error: "missing path" }, { status: 400 });
+	const loopId = safeDecode(after.slice(0, slash));
+	if (loopId === null) return Response.json({ error: "bad loop id" }, { status: 400 });
+	const segments = after.slice(slash + 1).split("/").map((s) => safeDecode(s));
+	if (segments.some((s) => s === null)) return Response.json({ error: "bad path" }, { status: 400 });
+	const relPath = segments.join("/");
+	if (!await (await import("./boot-CYRi-wez.mjs").then((n) => n.N).then((n) => n.It)).getLoop(loopId)) return Response.json({ error: "not found" }, { status: 404 });
+	const { readLoopArtifactBytes } = await import("./artifactFiles-Di1xDKvX.mjs");
+	const r = await readLoopArtifactBytes(loopId, relPath);
+	if (r.status !== 200 || !r.bytes) return Response.json({ error: "not found" }, { status: r.status });
+	const filename = (r.filename || "file").replace(/["\\\r\n]/g, "_");
+	const mime = new URL(request.url).searchParams.get("view") === "inline" ? imageMime(relPath) : null;
+	if (mime) return new Response(new Uint8Array(r.bytes), {
+		status: 200,
+		headers: {
+			"content-type": mime,
+			"content-length": String(r.bytes.length),
+			"content-disposition": `inline; filename="${filename}"`,
+			"x-content-type-options": "nosniff",
+			"content-security-policy": "sandbox",
+			"cache-control": "private, no-store"
+		}
+	});
+	return new Response(new Uint8Array(r.bytes), {
+		status: 200,
+		headers: {
+			"content-type": r.binary ? "application/octet-stream" : "text/plain; charset=utf-8",
+			"content-length": String(r.bytes.length),
+			"content-disposition": `attachment; filename="${filename}"`,
+			"cache-control": "private, no-store"
+		}
+	});
+} } } });
+var IndexRoute = Route$12.update({
+	id: "/",
+	path: "/",
+	getParentRoute: () => Route$9
+});
+var MachineReportRoute = Route$8.update({
+	id: "/machine/report",
+	path: "/machine/report",
+	getParentRoute: () => Route$9
+});
+var LoopsLoopIdRoute = Route$10.update({
+	id: "/loops/$loopId",
+	path: "/loops/$loopId",
+	getParentRoute: () => Route$9
+});
+var ApiReadyRoute = Route$7.update({
+	id: "/api/ready",
+	path: "/api/ready",
+	getParentRoute: () => Route$9
+});
+var ApiHealthRoute = Route$6.update({
+	id: "/api/health",
+	path: "/api/health",
+	getParentRoute: () => Route$9
+});
+var ApiMachineSyncRoute = Route$5.update({
+	id: "/api/machine/sync",
+	path: "/api/machine/sync",
+	getParentRoute: () => Route$9
+});
+var ApiMachineStatusRoute = Route$4.update({
+	id: "/api/machine/status",
+	path: "/api/machine/status",
+	getParentRoute: () => Route$9
+});
+var ApiMachinePollRoute = Route$3.update({
+	id: "/api/machine/poll",
+	path: "/api/machine/poll",
+	getParentRoute: () => Route$9
+});
+var ApiMachineCliRoute = Route$2.update({
+	id: "/api/machine/cli",
+	path: "/api/machine/cli",
+	getParentRoute: () => Route$9
+});
+var LoopsLoopIdRunsRunIdRoute = Route$11.update({
+	id: "/loops/$loopId_/runs/$runId",
+	path: "/loops/$loopId/runs/$runId",
+	getParentRoute: () => Route$9
+});
+var ApiMachineBlobHashRoute = Route$1.update({
+	id: "/api/machine/blob/$hash",
+	path: "/api/machine/blob/$hash",
+	getParentRoute: () => Route$9
+});
+var rootRouteChildren = {
+	IndexRoute,
+	ApiHealthRoute,
+	ApiReadyRoute,
+	LoopsLoopIdRoute,
+	MachineReportRoute,
+	ApiMachineCliRoute,
+	ApiMachinePollRoute,
+	ApiMachineStatusRoute,
+	ApiMachineSyncRoute,
+	ApiArtifactLoopIdSplatRoute: Route.update({
+		id: "/api/artifact/$loopId/$",
+		path: "/api/artifact/$loopId/$",
+		getParentRoute: () => Route$9
+	}),
+	ApiMachineBlobHashRoute,
+	LoopsLoopIdRunsRunIdRoute
+};
+var routeTree = Route$9._addFileChildren(rootRouteChildren)._addFileTypes();
+function getRouter() {
+	return createRouter({
+		routeTree,
+		scrollRestoration: true,
+		defaultPreload: "intent"
+	});
+}
+//#endregion
+export { getRouter };

package/.output/server/_ssr/routes-BSVBANI3.mjs

@@ -0,0 +1,12 @@
+import { h as require_jsx_runtime } from "../_libs/@base-ui/react+[...].mjs";
+import { n as Route, t as DashboardView } from "./routes-DnE7XDe_.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/routes-BSVBANI3.js
+var import_jsx_runtime = require_jsx_runtime();
+/** First-load failure screen — a calm retry instead of the router's default
+*  error dump. Only the initial loader can land here; the in-page poll is
+*  fetch-then-set and keeps stale data on a transient blip. */
+function Home() {
+	return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(DashboardView, { initial: Route.useLoaderData() });
+}
+//#endregion
+export { Home as component };