@matteai/stma-server 0.11.0 → 0.11.1

package/dist/index.js

@@ -39,6 +39,7 @@ function loadEnv(overrides = {}) {
     devMode,
     localAuth: e.AUTH_LOCAL !== "0",
     signupsOpen: e.SIGNUPS_OPEN !== "0",
+    publicMode: e.SITE_MODE === "teaser" ? "teaser" : "full",
     hosted: e.STMA_HOSTED === "1",
     demoLogins: parseDemoLogins(e.DEMO_LOGINS),
     embeddedDb: e.EMBEDDED_DB === "1",
@@ -84,7 +85,7 @@ import { serve } from "@hono/node-server";
 
 // src/app.tsx
 import { sql as sql19 } from "drizzle-orm";
-import { Hono as Hono18 } from "hono";
+import { Hono as Hono20 } from "hono";
 import { bodyLimit } from "hono/body-limit";
 
 // src/auth/session.ts
@@ -1015,9 +1016,9 @@ function detectClaimConflicts(current, existing) {
       });
     }
   }
-  const rank2 = { critical: 0, high: 1, medium: 2, low: 3 };
+  const rank3 = { critical: 0, high: 1, medium: 2, low: 3 };
   return out.sort(
-    (a, b) => rank2[a.severity] - rank2[b.severity] || a.current.resourceKey.localeCompare(b.current.resourceKey) || a.existing.runId.localeCompare(b.existing.runId)
+    (a, b) => rank3[a.severity] - rank3[b.severity] || a.current.resourceKey.localeCompare(b.current.resourceKey) || a.existing.runId.localeCompare(b.existing.runId)
   );
 }
 
@@ -1296,19 +1297,22 @@ var ONBOARD_RULES_VERSION = 2;
 
 // src/lib/rail.ts
 import { and, count, desc, eq, gt, inArray, isNotNull, isNull, ne, or, sql as sql2 } from "drizzle-orm";
+var RAIL_TEAMS = 8;
 var EMPTY_RAIL = {
   runs: 0,
   sessions: 0,
   drift: 0,
   team: null,
   role: null,
-  teams: 0
+  teams: 0,
+  projects: 0,
+  list: []
 };
 async function ensureRail(db, user) {
   if (!user.rail) user.rail = await railFor(db, user.id);
 }
 async function railFor(db, userId) {
-  const mine = await db.select({ id: teams.id, slug: teams.slug, role: memberships.role }).from(memberships).innerJoin(teams, eq(memberships.teamId, teams.id)).where(eq(memberships.userId, userId)).orderBy(desc(teams.createdAt));
+  const mine = await db.select({ id: teams.id, slug: teams.slug, name: teams.name, role: memberships.role }).from(memberships).innerJoin(teams, eq(memberships.teamId, teams.id)).where(eq(memberships.userId, userId)).orderBy(desc(teams.createdAt));
   if (mine.length === 0) return EMPTY_RAIL;
   const ids = mine.map((t) => t.id);
   const runs = await db.select({ n: count() }).from(agentRuns).where(
@@ -1333,13 +1337,17 @@ async function railFor(db, userId) {
     )
   );
   const drift = await db.select({ n: count() }).from(policyReceipts).innerJoin(agentRuns, eq(policyReceipts.runId, agentRuns.id)).where(and(inArray(agentRuns.teamId, ids), eq(policyReceipts.drift, true)));
+  const projects2 = mine[0] ? await db.select({ n: count() }).from(projects).where(eq(projects.teamId, mine[0].id)) : [];
   return {
     runs: runs[0]?.n ?? 0,
     sessions: Number(unread[0]?.n ?? 0),
     drift: drift[0]?.n ?? 0,
     team: mine[0]?.slug ?? null,
     role: mine[0]?.role ?? null,
-    teams: mine.length
+    teams: mine.length,
+    projects: projects2[0]?.n ?? 0,
+    // Bounded: somebody in thirty teams gets the newest few and the picker.
+    list: mine.slice(0, RAIL_TEAMS).map((t) => ({ slug: t.slug, name: t.name, role: t.role }))
   };
 }
 
@@ -2053,6 +2061,33 @@ var RailLink = ({
   badge && badge > 0 ? /* @__PURE__ */ jsx("span", { class: "rail-badge", children: NUM(badge) }) : null
 ] });
 var teamHref = (team, suffix) => team ? `/app/teams/${team}${suffix}` : "/app";
+var teamInitials = (name) => name.split(/[\s-]+/).filter(Boolean).slice(0, 2).map((w) => w[0].toUpperCase()).join("") || "?";
+var TeamSwitch = ({ rail }) => {
+  if (!rail.team) return null;
+  const current = rail.list.find((t) => t.slug === rail.team);
+  const name = current?.name ?? rail.team;
+  const face = /* @__PURE__ */ jsxs(Fragment, { children: [
+    /* @__PURE__ */ jsx("span", { class: "tile tile-28 tile-green", style: "width:22px;height:22px;font-size:9px", children: teamInitials(name) }),
+    /* @__PURE__ */ jsx("span", { class: "tname", children: name })
+  ] });
+  if (rail.list.length < 2) {
+    return /* @__PURE__ */ jsx("a", { class: "teamswitch", href: `/app/teams/${rail.team}`, title: "This team", children: face });
+  }
+  return /* @__PURE__ */ jsxs("details", { class: "teampick", children: [
+    /* @__PURE__ */ jsxs("summary", { class: "teamswitch", title: "Switch team", children: [
+      face,
+      /* @__PURE__ */ jsx("span", { class: "caret", children: "\u25BE" })
+    ] }),
+    /* @__PURE__ */ jsxs("div", { class: "teammenu", children: [
+      rail.list.map((t) => /* @__PURE__ */ jsxs("a", { class: t.slug === rail.team ? "on" : void 0, href: `/app/teams/${t.slug}`, children: [
+        /* @__PURE__ */ jsx("span", { style: "min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap", children: t.name }),
+        /* @__PURE__ */ jsx("span", { class: "r", children: t.role })
+      ] })),
+      /* @__PURE__ */ jsx("span", { class: "sep" }),
+      /* @__PURE__ */ jsx("a", { href: "/app", children: "All teams" })
+    ] })
+  ] });
+};
 var Rail = ({ user, active }) => {
   const rail = user.rail ?? EMPTY_RAIL;
   return /* @__PURE__ */ jsxs("nav", { class: "rail", children: [
@@ -2060,9 +2095,19 @@ var Rail = ({ user, active }) => {
       /* @__PURE__ */ jsx(Logo, { inv: true }),
       /* @__PURE__ */ jsx("span", { class: "name", children: "STMA" })
     ] }),
+    /* @__PURE__ */ jsx(TeamSwitch, { rail }),
     /* @__PURE__ */ jsxs("div", { class: "rail-nav", children: [
       /* @__PURE__ */ jsx("span", { class: "rail-group", children: "Control" }),
       /* @__PURE__ */ jsx(RailLink, { href: "/app/agents", label: "Agent map", active: active === "agents", badge: rail.runs }),
+      /* @__PURE__ */ jsx(
+        RailLink,
+        {
+          href: teamHref(rail.team, "/projects"),
+          label: "Projects",
+          active: active === "projects",
+          badge: rail.projects
+        }
+      ),
       /* @__PURE__ */ jsx(
         RailLink,
         {
@@ -2107,6 +2152,14 @@ var Rail = ({ user, active }) => {
       /* @__PURE__ */ jsx("span", { class: "rail-group later", children: "Workspace" }),
       /* @__PURE__ */ jsx(RailLink, { href: "/app", label: "Teams", active: active === "teams", badge: rail.teams > 1 ? rail.teams : void 0 }),
       /* @__PURE__ */ jsx(RailLink, { href: "/app/sessions", label: "Sessions", active: active === "sessions", badge: rail.sessions }),
+      /* @__PURE__ */ jsx(
+        RailLink,
+        {
+          href: "/app/notifications",
+          label: "Notifications",
+          active: active === "notifications"
+        }
+      ),
       /* @__PURE__ */ jsx(RailLink, { href: "/app/tokens", label: "Tokens", active: active === "tokens" }),
       /* @__PURE__ */ jsx(RailLink, { href: "/docs", label: "Docs", active: active === "docs" }),
       user.isAdmin ? /* @__PURE__ */ jsxs(Fragment, { children: [
@@ -2115,12 +2168,14 @@ var Rail = ({ user, active }) => {
       ] }) : null
     ] }),
     /* @__PURE__ */ jsxs("div", { class: "rail-foot", children: [
-      /* @__PURE__ */ jsx("span", { class: "avatar", children: initials(user.username) }),
-      /* @__PURE__ */ jsxs("div", { class: "rail-who", children: [
-        /* @__PURE__ */ jsx("div", { class: "n", children: user.username }),
-        /* @__PURE__ */ jsxs("div", { class: "r", children: [
-          rail.role ? `${rail.role} \xB7 ` : "",
-          rail.team ?? "no team yet"
+      /* @__PURE__ */ jsxs("a", { class: "railme", href: "/app/account", title: "Account", children: [
+        /* @__PURE__ */ jsx("span", { class: "avatar", children: initials(user.username) }),
+        /* @__PURE__ */ jsxs("div", { class: "rail-who", children: [
+          /* @__PURE__ */ jsx("div", { class: "n", children: user.username }),
+          /* @__PURE__ */ jsxs("div", { class: "r", children: [
+            rail.role ? `${rail.role} \xB7 ` : "",
+            rail.team ?? "no team yet"
+          ] })
         ] })
       ] }),
       /* @__PURE__ */ jsx("form", { method: "post", action: "/logout", class: "m0", children: /* @__PURE__ */ jsx("button", { class: "rail-out", type: "submit", title: "Sign out", children: "out" }) })
@@ -3349,6 +3404,79 @@ a.lrow.sel:hover { background: #eef5f1; }
   .features-grid { grid-template-columns: 1fr; }
   .appnav-user { display: none; }
 }
+
+/* ---------- v2: the team switcher, page tabs, stat strips and reading layouts ---------- */
+/* Ported from the "STMA v2" prototype. Everything above is unchanged: v2 keeps
+   the whole design system and adds the components the new screens are built
+   from. What is deliberately NOT here is the prototype's own scaffolding \u2014 the
+   floating screen switcher and the padding it needed \u2014 because that exists to
+   demo twenty screens in one file, not to ship. */
+
+.teamswitch { margin: 10px 10px 0; display: flex; align-items: center; gap: 8px; padding: 7px 9px; border: 1px solid var(--dark-line-2); border-radius: 6px; background: #1c2023; cursor: pointer; width: calc(100% - 20px); }
+.teamswitch:hover { border-color: #4a5157; }
+.teamswitch .tname { flex: 1; min-width: 0; text-align: left; font: 500 13px/1 var(--sans); color: #fff; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.teamswitch .caret { color: var(--dark-mut-2); font-size: 10px; }
+/* The open state the prototype had no need for: a real switcher has to list the
+   teams. A details/summary pair, so it works with no script at all. */
+.teamswitch::-webkit-details-marker { display: none; }
+.teamswitch::marker { content: ''; }
+.teampick[open] .teamswitch { border-color: #4a5157; }
+.teampick[open] .teamswitch .caret { transform: rotate(180deg); }
+.teammenu { margin: 4px 10px 0; padding: 4px; border: 1px solid var(--dark-line-2); border-radius: 6px; background: #1c2023; display: flex; flex-direction: column; gap: 1px; }
+.teammenu a { display: flex; align-items: baseline; gap: 6px; padding: 6px 8px; border-radius: 4px; font: 400 13px/1.2 var(--sans); color: var(--dark-txt-2); }
+.teammenu a:hover { background: #22262a; color: #fff; text-decoration: none; }
+.teammenu a.on { color: #fff; }
+.teammenu a .r { font: 400 11px/1 var(--mono); color: var(--dark-mut-2); }
+.teammenu .sep { height: 1px; margin: 3px 2px; background: var(--dark-line-2); }
+
+.railme { display: flex; align-items: center; gap: 9px; flex: 1; min-width: 0; }
+.railme:hover { text-decoration: none; }
+.railme:hover .n { color: #fff; }
+
+.pagetabs { background: #fff; border-bottom: 1px solid var(--line); padding: 0 20px; display: flex; gap: 2px; }
+
+.introw { display: flex; align-items: center; gap: 12px; padding: 14px 18px; border-bottom: 1px solid var(--line-2); }
+.introw:last-child { border-bottom: none; }
+.introw .who { flex: 1; min-width: 0; }
+.introw .who .t { font: 500 14px/1.3 var(--sans); }
+.introw .who .s { margin-top: 2px; font: 400 12px/1.4 var(--sans); color: var(--mut); }
+
+.stat3 { display: grid; grid-template-columns: repeat(auto-fit, minmax(150px, 1fr)); background: #fff; border: 1px solid var(--line); border-radius: 10px; overflow: hidden; }
+.stat3 > div { padding: 14px 16px; border-right: 1px solid var(--line-2); display: flex; flex-direction: column; gap: 7px; }
+.stat3 > div:last-child { border-right: none; }
+.stat3 .n { font: 600 20px/1 var(--mono); }
+.stat3 .n.ok { color: var(--green-strong); }
+.stat3 .n.bad { color: var(--red); }
+
+.docgrid { display: grid; grid-template-columns: 190px minmax(0, 1fr); gap: 32px; align-items: start; }
+.sidetoc { position: sticky; top: 16px; display: flex; flex-direction: column; gap: 2px; }
+.sidetoc a { padding: 6px 10px; border-left: 2px solid var(--line-2); font: 400 13px/1.3 var(--sans); color: var(--txt-3); }
+.sidetoc a:hover { color: var(--ink); text-decoration: none; }
+.sidetoc a.on { color: var(--green-strong); font-weight: 500; border-left-color: var(--green); }
+
+.toolrow { display: grid; grid-template-columns: 180px minmax(0, 1fr); gap: 14px; padding: 10px 18px; border-bottom: 1px solid var(--line-2); }
+.toolrow:last-child { border-bottom: none; }
+.toolrow .tn { font: 400 13px/1.4 var(--mono); color: var(--txt-3); }
+.toolrow .td { font: 400 13px/1.5 var(--sans); }
+
+/* Editor layout: the document on the left, what it will produce on the right. */
+.edgrid { display: grid; grid-template-columns: minmax(0, 1fr) minmax(300px, 380px); gap: 20px; align-items: start; }
+
+/* The ledger stops being squeezed before the inspector does. */
+.cbody .cmain { min-width: 520px; }
+@media (max-width: 1200px) {
+  .cbody { overflow-x: auto; }
+  .inspector { width: 320px; min-width: 320px; }
+}
+@media (max-width: 960px) {
+  .cbody .cmain { min-width: 420px; }
+  .lrow.grid-runs, .lhead.grid-runs { grid-template-columns: 26px minmax(0, 1.4fr) minmax(0, 1.6fr) 92px; }
+  .grid-runs > *:nth-child(4), .grid-runs > *:nth-child(5) { display: none; }
+  .docgrid { grid-template-columns: 1fr; gap: 18px; }
+  .sidetoc { position: static; flex-direction: row; flex-wrap: wrap; }
+  .edgrid { grid-template-columns: 1fr; }
+  .toolrow { grid-template-columns: 1fr; gap: 4px; }
+}
 `
 );
 
@@ -3590,7 +3718,7 @@ activityRoutes.get("/app/teams/:slug/activity", async (c) => {
               /* @__PURE__ */ jsxs4("tr", { children: [
                 /* @__PURE__ */ jsx4("th", { children: "When" }),
                 /* @__PURE__ */ jsx4("th", { children: "User" }),
-                /* @__PURE__ */ jsx4("th", { children: "Agent (token)" }),
+                /* @__PURE__ */ jsx4("th", { children: "Agent" }),
                 /* @__PURE__ */ jsx4("th", { children: "Action" }),
                 /* @__PURE__ */ jsx4("th", { children: "Project" }),
                 /* @__PURE__ */ jsx4("th", { children: "Detail" })
@@ -3718,7 +3846,7 @@ async function connectDb(env2) {
 }
 
 // src/lib/counters.ts
-async function hitCounter(db, bucket, subject2, windowMs, max7, by = 1) {
+async function hitCounter(db, bucket, subject2, windowMs, max8, by = 1) {
   const now = Date.now();
   const windowStart = Math.floor(now / windowMs) * windowMs;
   const resetAt = new Date(windowStart + windowMs);
@@ -3727,8 +3855,8 @@ async function hitCounter(db, bucket, subject2, windowMs, max7, by = 1) {
     target: rateCounters.key,
     set: { count: sql4`${rateCounters.count} + ${by}` }
   }).returning({ count: rateCounters.count });
-  const count13 = rows[0]?.count ?? by;
-  return { count: count13, resetAt, exceeded: count13 > max7 };
+  const count14 = rows[0]?.count ?? by;
+  return { count: count14, resetAt, exceeded: count14 > max8 };
 }
 async function readCounter(db, bucket, subject2, windowMs) {
   const windowStart = Math.floor(Date.now() / windowMs) * windowMs;
@@ -4725,8 +4853,8 @@ var CRM_STATUSES = [
 ];
 var PIPELINE_STATUSES = ["lead", "contacted", "demo", "onboarding", "active"];
 var ARCHIVED_STATUSES = ["churned", "lost"];
-var optField = (v, max7) => {
-  const s = typeof v === "string" ? v.trim().slice(0, max7) : "";
+var optField = (v, max8) => {
+  const s = typeof v === "string" ? v.trim().slice(0, max8) : "";
   return s || null;
 };
 function parseContactForm(body) {
@@ -5251,8 +5379,8 @@ async function recordRunQuota(db, found, quota) {
   const source = quota.source;
   const measured = source === "measured";
   const previous = found.run.quotaState ?? "ok";
-  const rank2 = { ok: 0, warning: 1, critical: 2 };
-  const escalated = measured && rank2[state] > rank2[previous];
+  const rank3 = { ok: 0, warning: 1, critical: 2 };
+  const escalated = measured && rank3[state] > rank3[previous];
   const resetsAt = quota.resetsAt ? new Date(quota.resetsAt) : null;
   await db.update(agentRuns).set({
     quotaPct: usedPct,
@@ -5781,7 +5909,7 @@ agentsRoutes.get("/app/agents", async (c) => {
       )
     );
   }
-  const severityByRun = /* @__PURE__ */ new Map();
+  const severityByRun2 = /* @__PURE__ */ new Map();
   const clashesByRun = /* @__PURE__ */ new Map();
   const clashing = /* @__PURE__ */ new Set();
   const clashes = [];
@@ -5795,7 +5923,7 @@ agentsRoutes.get("/app/agents", async (c) => {
     });
     const found = detectClaimConflicts(current, existing);
     const highest = found[0]?.severity;
-    if (highest) severityByRun.set(row.run.id, highest);
+    if (highest) severityByRun2.set(row.run.id, highest);
     if (found.length > 0) clashesByRun.set(row.run.id, found);
     for (const conflict of found) {
       for (const side of [conflict.current, conflict.existing]) {
@@ -5816,7 +5944,7 @@ agentsRoutes.get("/app/agents", async (c) => {
   }
   const wanted = c.req.query("run");
   const selected = (wanted ? rows.find((row) => row.run.id === wanted) : void 0) ?? // Default to the run that most needs attention, then to the newest.
-  rows.find((row) => severityByRun.get(row.run.id) === "critical") ?? rows[0];
+  rows.find((row) => severityByRun2.get(row.run.id) === "critical") ?? rows[0];
   const trail = selected ? await eventsForRun(db, selected.run.id) : [];
   const pack = selected ? await evidenceForRun(db, selected.run.id, user.id) : null;
   const receipt = selected ? (await db.select().from(policyReceipts).where(eq13(policyReceipts.runId, selected.run.id)).limit(1))[0] : void 0;
@@ -5945,7 +6073,7 @@ agentsRoutes.get("/app/agents", async (c) => {
   ) : null;
   const inspector = selected ? (() => {
     const held = claimsByRun.get(selected.run.id) ?? [];
-    const severity = severityByRun.get(selected.run.id);
+    const severity = severityByRun2.get(selected.run.id);
     const worst = (clashesByRun.get(selected.run.id) ?? [])[0];
     const others = (clashesByRun.get(selected.run.id) ?? []).length - 1;
     const fresh = Date.now() - selected.run.lastHeartbeatAt.getTime() < FRESH_MS;
@@ -5968,7 +6096,16 @@ agentsRoutes.get("/app/agents", async (c) => {
       /* @__PURE__ */ jsxs6("div", { class: "ins-acts", children: [
         /* @__PURE__ */ jsx6("a", { class: "btn btn-sm", href: `/app/teams/${selected.team.slug}/governance`, children: "Governance" }),
         /* @__PURE__ */ jsx6("a", { class: "btn btn-sm", href: `/app/teams/${selected.team.slug}/activity`, children: "Activity" }),
-        /* @__PURE__ */ jsx6("a", { class: "btn btn-sm", href: "/app/sessions", children: "Sessions" })
+        selected.projectName ? /* @__PURE__ */ jsx6(
+          "a",
+          {
+            class: "btn btn-sm",
+            href: `/app/teams/${selected.team.slug}/projects/${encodeURIComponent(
+              selected.projectName
+            )}`,
+            children: "Project"
+          }
+        ) : /* @__PURE__ */ jsx6("a", { class: "btn btn-sm", href: "/app/sessions", children: "Sessions" })
       ] }),
       /* @__PURE__ */ jsxs6("div", { class: "ins-sec", children: [
         /* @__PURE__ */ jsx6("span", { class: "ins-label", children: "Scope held" }),
@@ -6111,7 +6248,7 @@ agentsRoutes.get("/app/agents", async (c) => {
             ] }),
             rows.map((row) => {
               const held = claimsByRun.get(row.run.id) ?? [];
-              const severity = severityByRun.get(row.run.id);
+              const severity = severityByRun2.get(row.run.id);
               const fresh = Date.now() - row.run.lastHeartbeatAt.getTime() < FRESH_MS;
               return /* @__PURE__ */ jsxs6(
                 "a",
@@ -6601,7 +6738,7 @@ savingsRoutes.get("/app/teams/:slug/savings", async (c) => {
         head: /* @__PURE__ */ jsx7(
           PageHead,
           {
-            crumb: team.name,
+            crumb: `/ ${team.slug} / savings`,
             title: "Verified savings",
             sub: "What STMA prevented, separated from what somebody confirmed it prevented."
           }
@@ -7151,9 +7288,9 @@ var BATCH = 100;
 var MESSAGE_WINDOW = 20;
 var EXCERPT = 280;
 var TITLE = 90;
-function oneLine(text3, max7) {
+function oneLine(text3, max8) {
   const flat = text3.replace(/\s+/g, " ").trim();
-  return flat.length > max7 ? `${flat.slice(0, max7 - 1)}\u2026` : flat;
+  return flat.length > max8 ? `${flat.slice(0, max8 - 1)}\u2026` : flat;
 }
 var article = (word) => /^[aeiou]/i.test(word) ? "an" : "a";
 function attribution(username, via) {
@@ -7936,9 +8073,9 @@ var LOGIN_FAIL_MAX = 5;
 var BUCKET = "login-fail";
 var subject = (email) => sha256hex(email.trim().toLowerCase()).slice(0, 32);
 async function loginGate(db, email) {
-  const count13 = await readCounter(db, BUCKET, subject(email), LOGIN_FAIL_WINDOW_MS);
+  const count14 = await readCounter(db, BUCKET, subject(email), LOGIN_FAIL_WINDOW_MS);
   const windowStart = Math.floor(Date.now() / LOGIN_FAIL_WINDOW_MS) * LOGIN_FAIL_WINDOW_MS;
-  return { locked: count13 >= LOGIN_FAIL_MAX, resetAt: new Date(windowStart + LOGIN_FAIL_WINDOW_MS) };
+  return { locked: count14 >= LOGIN_FAIL_MAX, resetAt: new Date(windowStart + LOGIN_FAIL_WINDOW_MS) };
 }
 async function recordLoginFailure(db, email) {
   const hit = await hitCounter(
@@ -8823,9 +8960,21 @@ compareRoutes.get("/app/teams/:slug/compare", async (c) => {
             crumb: `/ ${team.slug} / environments`,
             title: "Compare environments",
             sub: scopeProject ? `Two machines, one mechanical diff \u2014 comparing each side's newest ${scopeProject.name} snapshot.` : "Two machines, one mechanical diff \u2014 the same comparison your agents get from compare_env.",
-            actions: /* @__PURE__ */ jsxs9("a", { class: "btn btn-sm", href: `/app/teams/${team.slug}`, children: [
-              "Back to ",
-              team.slug
+            actions: /* @__PURE__ */ jsxs9(Fragment8, { children: [
+              bSide ? /* @__PURE__ */ jsx9(
+                "a",
+                {
+                  class: "btn btn-sm",
+                  href: `/app/teams/${team.slug}/compare?a=${encodeURIComponent(
+                    sideValue(bSide)
+                  )}&b=${encodeURIComponent(sideValue(aSide))}${scopeProject ? `&project=${encodeURIComponent(scopeProject.name)}` : ""}`,
+                  children: "\u21C4 Swap sides"
+                }
+              ) : null,
+              /* @__PURE__ */ jsxs9("a", { class: "btn btn-sm", href: `/app/teams/${team.slug}`, children: [
+                "Back to ",
+                team.slug
+              ] })
             ] })
           }
         ),
@@ -10216,6 +10365,7 @@ var docsRoutes = new Hono9();
 docsRoutes.get("/docs", (c) => {
   const env2 = c.get("env");
   const user = c.get("user");
+  const showConsole = Boolean(user) || env2.publicMode === "full";
   const base2 = env2.baseUrl;
   const mcpUrl = `${base2}/mcp`;
   const claudeCmd = `claude mcp add --scope user --transport http stma ${mcpUrl} --header "Authorization: Bearer stma_YOUR_TOKEN"`;
@@ -10242,24 +10392,23 @@ docsRoutes.get("/docs", (c) => {
     attempts: `Try this three different ways in parallel, one per worktree. Give every run the same stma attempt_group "TASK-fanout" and its own worktree path, so the three of you don't warn each other about touching the same files \u2014 then show me the three diffs side by side.`,
     issues: `Call stma list_issues, show me what is open, and when I pick one call start_run with that issue number. Work it on a branch, and when you finish, finish_run so the issue gets the update.`
   };
-  const body = /* @__PURE__ */ jsxs11(Fragment10, { children: [
-    /* @__PURE__ */ jsxs11("div", { class: "doc-col", children: [
+  const body = /* @__PURE__ */ jsx11(Fragment10, { children: /* @__PURE__ */ jsxs11("div", { class: "docgrid", children: [
+    /* @__PURE__ */ jsxs11("nav", { class: "sidetoc", children: [
+      /* @__PURE__ */ jsx11("a", { href: "#how", children: "How it works" }),
+      showConsole ? /* @__PURE__ */ jsx11("a", { href: "#web", children: "Quick start" }) : null,
+      /* @__PURE__ */ jsx11("a", { href: "#connect", children: "Connect an agent" }),
+      /* @__PURE__ */ jsx11("a", { href: "#control-plane", children: "Agent control plane" }),
+      /* @__PURE__ */ jsx11("a", { href: "#tools", children: "Tool reference" }),
+      /* @__PURE__ */ jsx11("a", { href: "#prompts", children: "Paste-ready prompts" }),
+      showConsole ? /* @__PURE__ */ jsx11("a", { href: "#dashboard", children: "The console" }) : null,
+      /* @__PURE__ */ jsx11("a", { href: "#security", children: "Security" }),
+      /* @__PURE__ */ jsx11("a", { href: "#troubleshooting", children: "Troubleshooting" })
+    ] }),
+    /* @__PURE__ */ jsxs11("div", { class: "doc-col", style: "max-width:none", children: [
       /* @__PURE__ */ jsxs11("div", { children: [
         /* @__PURE__ */ jsx11("h1", { class: "title", style: "font-size:30px", children: "How to use STMA" }),
         /* @__PURE__ */ jsx11("p", { class: "sub", style: "max-width:60ch", children: "STMA is the shared control plane for your team's coding agents: it maps each run to its human, project and task, detects overlapping work, distributes global policy, checks environments, and keeps async debug context. This page covers both the human dashboard and agent-facing surfaces." })
       ] }),
-      /* @__PURE__ */ jsxs11("div", { class: "toc", children: [
-        /* @__PURE__ */ jsx11("a", { href: "#how", children: "How it works" }),
-        /* @__PURE__ */ jsx11("a", { href: "#web", children: "Quick start: web" }),
-        /* @__PURE__ */ jsx11("a", { href: "#terminal", children: "Quick start: terminal" }),
-        /* @__PURE__ */ jsx11("a", { href: "#connect", children: "Connect an agent" }),
-        /* @__PURE__ */ jsx11("a", { href: "#control-plane", children: "Agent control plane" }),
-        /* @__PURE__ */ jsx11("a", { href: "#tools", children: "Tool reference" }),
-        /* @__PURE__ */ jsx11("a", { href: "#prompts", children: "Paste-ready prompts" }),
-        /* @__PURE__ */ jsx11("a", { href: "#dashboard", children: "Dashboard" }),
-        /* @__PURE__ */ jsx11("a", { href: "#security", children: "Security" }),
-        /* @__PURE__ */ jsx11("a", { href: "#troubleshooting", children: "Troubleshooting" })
-      ] }),
       /* @__PURE__ */ jsxs11("div", { class: "hero-card", children: [
         /* @__PURE__ */ jsx11("span", { class: "overline", style: "color:var(--green-strong)", children: "The point" }),
         /* @__PURE__ */ jsxs11("p", { children: [
@@ -10273,44 +10422,42 @@ docsRoutes.get("/docs", (c) => {
           /* @__PURE__ */ jsx11("p", { children: P.hero }),
           /* @__PURE__ */ jsx11("button", { class: "copybtn onlight", type: "button", "data-copy": P.hero, children: "COPY" })
         ] })
-      ] })
-    ] }),
-    /* @__PURE__ */ jsxs11("section", { class: "doc-section", id: "how", children: [
-      /* @__PURE__ */ jsx11("h2", { children: "How it works" }),
-      /* @__PURE__ */ jsxs11("p", { class: "m0 sub", style: "max-width:72ch", children: [
-        "Two halves, one account. Agents reach STMA over ",
-        /* @__PURE__ */ jsx11("b", { children: "MCP" }),
-        " \u2014 and that includes the fleet half: runs, work claims, policy receipts and environment preflight, with nothing installed. The ",
-        /* @__PURE__ */ jsx11("b", { children: "CLI and its lifecycle hooks" }),
-        " report the same things without anyone typing a command, for clients that would rather not think about it. Both land in the same control plane, and everything a human needs to see is a plain server-rendered page."
       ] }),
-      /* @__PURE__ */ jsxs11("div", { class: "card card-pad", children: [
-        /* @__PURE__ */ jsx11(SystemDiagram, {}),
-        /* @__PURE__ */ jsxs11("div", { class: "legend", style: "margin-top:16px", children: [
-          /* @__PURE__ */ jsxs11("span", { children: [
-            /* @__PURE__ */ jsx11("span", { class: "sw", style: "background:var(--green-bg);border:1px solid var(--green-line)" }),
-            " ",
-            "agent client"
-          ] }),
-          /* @__PURE__ */ jsxs11("span", { children: [
-            /* @__PURE__ */ jsx11("span", { class: "sw", style: "background:var(--dark)" }),
-            " control plane"
+      /* @__PURE__ */ jsxs11("section", { class: "doc-section", id: "how", children: [
+        /* @__PURE__ */ jsx11("h2", { children: "How it works" }),
+        /* @__PURE__ */ jsxs11("p", { class: "m0 sub", style: "max-width:72ch", children: [
+          "Two halves, one account. Agents reach STMA over ",
+          /* @__PURE__ */ jsx11("b", { children: "MCP" }),
+          " \u2014 and that includes the fleet half: runs, work claims, policy receipts and environment preflight, with nothing installed. The ",
+          /* @__PURE__ */ jsx11("b", { children: "CLI and its lifecycle hooks" }),
+          " report the same things without anyone typing a command, for clients that would rather not think about it. Both land in the same control plane, and everything a human needs to see is a plain server-rendered page."
+        ] }),
+        /* @__PURE__ */ jsxs11("div", { class: "card card-pad", children: [
+          /* @__PURE__ */ jsx11(SystemDiagram, {}),
+          /* @__PURE__ */ jsxs11("div", { class: "legend", style: "margin-top:16px", children: [
+            /* @__PURE__ */ jsxs11("span", { children: [
+              /* @__PURE__ */ jsx11("span", { class: "sw", style: "background:var(--green-bg);border:1px solid var(--green-line)" }),
+              " ",
+              "agent client"
+            ] }),
+            /* @__PURE__ */ jsxs11("span", { children: [
+              /* @__PURE__ */ jsx11("span", { class: "sw", style: "background:var(--dark)" }),
+              " control plane"
+            ] }),
+            /* @__PURE__ */ jsxs11("span", { children: [
+              /* @__PURE__ */ jsx11("span", { class: "sw", style: "background:#fff;border:1px solid var(--line-frame)" }),
+              " ",
+              "what people read"
+            ] })
           ] }),
-          /* @__PURE__ */ jsxs11("span", { children: [
-            /* @__PURE__ */ jsx11("span", { class: "sw", style: "background:#fff;border:1px solid var(--line-frame)" }),
-            " ",
-            "what people read"
+          /* @__PURE__ */ jsxs11("p", { class: "m0 small muted", style: "margin-top:12px", children: [
+            "The same picture covers one person with two machines: alice and bob become your laptop and your desktop, and ",
+            /* @__PURE__ */ jsx11("code", { children: "compare_env" }),
+            ' answers "why does it only fail on the Windows box?" with no teammate involved.'
           ] })
-        ] }),
-        /* @__PURE__ */ jsxs11("p", { class: "m0 small muted", style: "margin-top:12px", children: [
-          "The same picture covers one person with two machines: alice and bob become your laptop and your desktop, and ",
-          /* @__PURE__ */ jsx11("code", { children: "compare_env" }),
-          ' answers "why does it only fail on the Windows box?" with no teammate involved.'
         ] })
-      ] })
-    ] }),
-    /* @__PURE__ */ jsxs11("div", { class: "doc-col", children: [
-      /* @__PURE__ */ jsxs11("section", { class: "doc-section", id: "web", children: [
+      ] }),
+      showConsole ? /* @__PURE__ */ jsxs11("section", { class: "doc-section", id: "web", children: [
         /* @__PURE__ */ jsx11("h2", { children: "Quick start \u2014 from the web" }),
         /* @__PURE__ */ jsxs11("div", { class: "card card-pad", style: "display:flex;flex-direction:column;gap:14px", children: [
           /* @__PURE__ */ jsxs11("div", { class: "step-row", children: [
@@ -10371,7 +10518,7 @@ docsRoutes.get("/docs", (c) => {
             ] })
           ] })
         ] })
-      ] }),
+      ] }) : null,
       /* @__PURE__ */ jsxs11("section", { class: "doc-section", id: "terminal", children: [
         /* @__PURE__ */ jsx11("h2", { children: "Quick start \u2014 from the terminal" }),
         /* @__PURE__ */ jsxs11("p", { class: "m0 sub", style: "max-width:64ch", children: [
@@ -10861,7 +11008,7 @@ Authorization: Bearer stma_YOUR_TOKEN` }),
           ] })
         ] })
       ] }),
-      /* @__PURE__ */ jsxs11("section", { class: "doc-section", id: "dashboard", children: [
+      showConsole ? /* @__PURE__ */ jsxs11("section", { class: "doc-section", id: "dashboard", children: [
         /* @__PURE__ */ jsx11("h2", { children: "The console (for humans)" }),
         /* @__PURE__ */ jsxs11("p", { class: "m0 sub", style: "max-width:74ch", children: [
           "One grammar on every page: a ",
@@ -10883,12 +11030,28 @@ Authorization: Bearer stma_YOUR_TOKEN` }),
             /* @__PURE__ */ jsx11("th", { children: "Page" }),
             /* @__PURE__ */ jsx11("th", { children: "What you do there" })
           ] }),
+          /* @__PURE__ */ jsxs11("tr", { children: [
+            /* @__PURE__ */ jsx11("td", { class: "name", children: "Projects" }),
+            /* @__PURE__ */ jsx11("td", { children: "A project per repository, born the first time an agent names one \u2014 nothing to create. The list carries runs now, open sessions, whether a baseline exists, the policy version and the delivery flow; opening one puts that project's live runs, threads, run trail, policy and environment on a single page, each next to the control that changes it." })
+          ] }),
+          /* @__PURE__ */ jsxs11("tr", { children: [
+            /* @__PURE__ */ jsx11("td", { class: "name", children: "Account" }),
+            /* @__PURE__ */ jsx11("td", { children: "Your password and account deletion, behind your own name at the foot of the rail. Tokens have their own page \u2014 one per machine \u2014 and what STMA emails you lives on Notifications." })
+          ] }),
           /* @__PURE__ */ jsxs11("tr", { children: [
             /* @__PURE__ */ jsx11("td", { class: "name", children: "Teams" }),
             /* @__PURE__ */ jsxs11("td", { children: [
               "Create a team from ",
               /* @__PURE__ */ jsx11("b", { children: "New team" }),
-              " \u2014 a name is all that is required; the tag (the short id in URLs and agent config) and a team chat webhook are optional and marked as such. Generate/revoke invite links, see members, projects and their stats, set a Slack/Discord webhook and inbound CI/GitHub hook URLs (owners), connect the GitHub repository agents read issues from and comment back on (owners), jump to Activity or Compare environments. Danger zone: leave the team, remove a member (owner) or delete the team (owner)."
+              " \u2014 a name is all that is required; the tag (the short id in URLs and agent config) and a team chat webhook are optional and marked as such. A team's own page is four tabs: ",
+              /* @__PURE__ */ jsx11("b", { children: "Overview" }),
+              " (projects, team health, what agents share), ",
+              /* @__PURE__ */ jsx11("b", { children: "People" }),
+              " (members and invite links),",
+              /* @__PURE__ */ jsx11("b", { children: "Integrations" }),
+              " (Slack/Discord, inbound CI and GitHub hooks, GitHub, Azure DevOps and Jira connections \u2014 owners) and ",
+              /* @__PURE__ */ jsx11("b", { children: "Settings" }),
+              " (leave, remove a member, delete the team). The tab is in the URL, so a link to one is a link to what you were looking at."
             ] })
           ] }),
           /* @__PURE__ */ jsxs11("tr", { children: [
@@ -10897,7 +11060,13 @@ Authorization: Bearer stma_YOUR_TOKEN` }),
           ] }),
           /* @__PURE__ */ jsxs11("tr", { children: [
             /* @__PURE__ */ jsx11("td", { class: "name", children: "Governance" }),
-            /* @__PURE__ */ jsx11("td", { children: "Did your rules actually reach the agents: the effective policy for the team and each project, receipts showing the hash each run applied against the one the server expected (drift called out), environment baselines, the preflight results agents were given, and a timeline of run events. A project filter in the strip narrows every list to one project \u2014 global stays the default. Owners publish the rulebook and record an environment baseline from this page: one rule per line in a form that opens on whatever is live (scoped to a project, on that project's own additions), and a baseline promoted from a snapshot the team already pushed, picked by person and machine." })
+            /* @__PURE__ */ jsxs11("td", { children: [
+              "Did your rules actually reach the agents: the effective policy for the team and each project, receipts showing the hash each run applied against the one the server expected (drift called out), environment baselines, the preflight results agents were given, and a timeline of run events. A project filter in the strip narrows every list to one project \u2014 global stays the default. Owners publish the rulebook and record an environment baseline from this page: one rule per line in a form that opens on whatever is live (scoped to a project, on that project's own additions), and a baseline promoted from a snapshot the team already pushed, picked by person and machine. Owners publish from ",
+              /* @__PURE__ */ jsx11("b", { children: "Edit policy" }),
+              ", a page that shows the document on the left and what ",
+              /* @__PURE__ */ jsx11("code", { children: "get_policy" }),
+              " will serve on the right."
+            ] })
           ] }),
           /* @__PURE__ */ jsxs11("tr", { children: [
             /* @__PURE__ */ jsx11("td", { class: "name", children: "Delivery" }),
@@ -10932,7 +11101,7 @@ Authorization: Bearer stma_YOUR_TOKEN` }),
             /* @__PURE__ */ jsx11("td", { children: "The same env diff agents get, as a visual side-by-side report." })
           ] })
         ] }) })
-      ] }),
+      ] }) : null,
       /* @__PURE__ */ jsxs11("section", { class: "doc-section", id: "security", children: [
         /* @__PURE__ */ jsx11("h2", { children: "Security model" }),
         /* @__PURE__ */ jsxs11("div", { class: "card card-pad", style: "display:flex;flex-direction:column;gap:10px", children: [
@@ -11076,7 +11245,7 @@ Authorization: Bearer stma_YOUR_TOKEN` }),
         ] })
       ] })
     ] })
-  ] });
+  ] }) });
   if (user) {
     return c.html(
       /* @__PURE__ */ jsx11(AppLayout, { user, active: "docs", title: "Docs", children: body })
@@ -11556,10 +11725,58 @@ var SnapshotCell = ({ last }) => last ? /* @__PURE__ */ jsxs14("span", { class:
   /* @__PURE__ */ jsx14("span", { class: "muted", children: timeAgo(last) })
 ] }) : /* @__PURE__ */ jsx14("span", { style: "color:var(--mut-2)", children: "Agent not connected" });
 var DeviceNames = ({ devices }) => devices.length > 1 || devices[0] && devices[0].device !== DEFAULT_DEVICE ? /* @__PURE__ */ jsx14("div", { class: "mono", style: "font-size:11px;color:var(--mut-2);margin-top:2px", children: devices.map((d) => d.device).join(" \xB7 ") }) : null;
+var TeaserLanding = () => /* @__PURE__ */ jsxs14("html", { lang: "en", children: [
+  /* @__PURE__ */ jsx14(Head, {}),
+  /* @__PURE__ */ jsxs14("body", { children: [
+    /* @__PURE__ */ jsx14("header", { class: "site-head", children: /* @__PURE__ */ jsxs14("div", { class: "container site-head-inner", children: [
+      /* @__PURE__ */ jsxs14("a", { class: "brand", href: "/", children: [
+        /* @__PURE__ */ jsx14(Logo, {}),
+        "Speak to my Agent"
+      ] }),
+      /* @__PURE__ */ jsxs14("nav", { class: "site-nav", children: [
+        /* @__PURE__ */ jsx14("a", { class: "plain", href: "/docs", children: "MCP docs" }),
+        /* @__PURE__ */ jsx14("a", { class: "btn btn-sm", href: "/login", children: "Sign in" })
+      ] })
+    ] }) }),
+    /* @__PURE__ */ jsx14("section", { class: "container hero", style: "grid-template-columns:1fr;max-width:820px", children: /* @__PURE__ */ jsxs14("div", { class: "hero-copy", children: [
+      /* @__PURE__ */ jsx14("span", { class: "pill-beta", children: "Private beta \xB7 invite only" }),
+      /* @__PURE__ */ jsx14("h1", { children: "Coming very soon." }),
+      /* @__PURE__ */ jsx14("p", { class: "lede", children: "STMA \u2014 Speak to my Agent \u2014 is the control plane between a team's AI coding agents: it maps every run to its human, project and task, warns two agents before they touch the same ground, distributes the team's rules, and lets agents hand work over instead of dropping it. The hosted service is in testing with a small group; accounts are invite-only while we learn what it does to a real team's week." }),
+      /* @__PURE__ */ jsx14("p", { class: "lede", style: "margin-top:-6px", children: "The MCP server and the CLI are open source and published today. You do not need an invite to run your own \u2014 one command, an embedded database, no setup:" }),
+      /* @__PURE__ */ jsxs14("div", { class: "cmd", style: "max-width:640px", children: [
+        /* @__PURE__ */ jsx14("code", { children: "npx @matteai/stma serve" }),
+        /* @__PURE__ */ jsx14("button", { class: "copybtn", type: "button", "data-copy": "npx @matteai/stma serve", children: "COPY" })
+      ] }),
+      /* @__PURE__ */ jsxs14("div", { class: "row", style: "margin-top:18px", children: [
+        /* @__PURE__ */ jsx14("a", { class: "btn btn-primary btn-lg", href: "/docs", children: "Read the MCP docs" }),
+        /* @__PURE__ */ jsx14("a", { class: "btn btn-lg", href: "/login", children: "I have an invite" })
+      ] }),
+      /* @__PURE__ */ jsxs14("div", { class: "hero-note", children: [
+        /* @__PURE__ */ jsx14("span", { class: "dot" }),
+        "Secret values are never collected \u2014 only variable names."
+      ] })
+    ] }) }),
+    /* @__PURE__ */ jsx14("footer", { class: "site-foot", children: /* @__PURE__ */ jsxs14("div", { class: "container site-foot-inner", children: [
+      /* @__PURE__ */ jsx14("span", { children: "\xA9 2026 STMA \xB7 Speak to my Agent \u2014 private beta" }),
+      /* @__PURE__ */ jsxs14("span", { children: [
+        /* @__PURE__ */ jsx14("a", { class: "plain", href: "/docs", style: "color:var(--mut)", children: "Docs" }),
+        " ",
+        "\xB7",
+        " ",
+        /* @__PURE__ */ jsx14("a", { class: "plain", href: "/terms", style: "color:var(--mut)", children: "Terms" }),
+        " ",
+        "\xB7",
+        " ",
+        /* @__PURE__ */ jsx14("a", { class: "plain", href: "/privacy", style: "color:var(--mut)", children: "Privacy" })
+      ] })
+    ] }) })
+  ] })
+] });
 dashboardRoutes.get("/", (c) => {
   const user = c.get("user");
   const env2 = c.get("env");
   if (user) return c.redirect("/app");
+  if (env2.publicMode === "teaser") return c.html(/* @__PURE__ */ jsx14(TeaserLanding, {}));
   return c.html(
     /* @__PURE__ */ jsxs14("html", { lang: "en", children: [
       /* @__PURE__ */ jsx14(Head, {}),
@@ -11699,6 +11916,8 @@ dashboardRoutes.get("/app", async (c) => {
   const teamIds = rows.map((r) => r.team.id);
   const lastSnaps = teamIds.length ? await db.select({ teamId: snapshots.teamId, last: max5(snapshots.createdAt) }).from(snapshots).where(inArray10(snapshots.teamId, teamIds)).groupBy(snapshots.teamId) : [];
   const lastByTeam = new Map(lastSnaps.map((s) => [s.teamId, s.last]));
+  const projectCounts = teamIds.length ? await db.select({ teamId: projects.teamId, n: count9() }).from(projects).where(inArray10(projects.teamId, teamIds)).groupBy(projects.teamId) : [];
+  const projectsByTeam = new Map(projectCounts.map((r) => [r.teamId, r.n]));
   const error = c.req.query("error");
   const notice = c.req.query("ok");
   const draftName = c.req.query("name");
@@ -11730,6 +11949,7 @@ dashboardRoutes.get("/app", async (c) => {
           /* @__PURE__ */ jsx14("th", { children: "Team" }),
           /* @__PURE__ */ jsx14("th", { children: "Slug" }),
           /* @__PURE__ */ jsx14("th", { children: "Role" }),
+          /* @__PURE__ */ jsx14("th", { children: "Projects" }),
           /* @__PURE__ */ jsx14("th", { children: "Last snapshot" }),
           /* @__PURE__ */ jsx14("th", {})
         ] }),
@@ -11740,6 +11960,7 @@ dashboardRoutes.get("/app", async (c) => {
           ] }) }),
           /* @__PURE__ */ jsx14("td", { class: "mono", children: r.team.slug }),
           /* @__PURE__ */ jsx14("td", { children: /* @__PURE__ */ jsx14("span", { class: `pill ${r.role === "owner" ? "pill-owner" : "pill-member"}`, children: r.role }) }),
+          /* @__PURE__ */ jsx14("td", { children: /* @__PURE__ */ jsx14("a", { href: `/app/teams/${r.team.slug}/projects`, children: projectsByTeam.get(r.team.id) ?? 0 }) }),
           /* @__PURE__ */ jsx14("td", { children: /* @__PURE__ */ jsx14(SnapshotCell, { last: lastByTeam.get(r.team.id) ?? null }) }),
           /* @__PURE__ */ jsx14("td", { style: "text-align:right", children: /* @__PURE__ */ jsx14("a", { class: "chev", href: `/app/teams/${r.team.slug}`, children: "\u203A" }) })
         ] }))
@@ -11830,7 +12051,7 @@ dashboardRoutes.post("/app/teams", async (c) => {
   const db = c.get("db");
   const env2 = c.get("env");
   const body = await c.req.parseBody();
-  const str = (key, max7) => typeof body[key] === "string" ? body[key].trim().slice(0, max7) : "";
+  const str = (key, max8) => typeof body[key] === "string" ? body[key].trim().slice(0, max8) : "";
   const name = str("name", 200);
   const tag = str("tag", 60);
   const webhookUrl = str("webhook_url", 500);
@@ -11887,6 +12108,9 @@ dashboardRoutes.get("/app/teams/:slug", async (c) => {
     );
   }
   const { team, role } = found;
+  const TABS = ["overview", "people", "integrations", "settings"];
+  const asked = c.req.query("tab");
+  const tab = TABS.includes(asked ?? "") ? asked : "overview";
   const members = await db.select({ member: users, role: memberships.role, joined: memberships.createdAt }).from(memberships).innerJoin(users, eq29(memberships.userId, users.id)).where(eq29(memberships.teamId, team.id)).orderBy(memberships.createdAt);
   const owners = members.filter((m) => m.role === "owner").length;
   const activeInvites = await db.select({ invite: invites, creator: users.username }).from(invites).leftJoin(users, eq29(invites.createdBy, users.id)).where(and22(eq29(invites.teamId, team.id), gt10(invites.expiresAt, /* @__PURE__ */ new Date()))).orderBy(desc16(invites.createdAt));
@@ -11909,6 +12133,14 @@ dashboardRoutes.get("/app/teams/:slug", async (c) => {
       if (r.pid) agentsByProject.set(r.pid, r.n);
     }
   }
+  const liveRuns = (await db.select({ n: count9() }).from(agentRuns).where(
+    and22(
+      eq29(agentRuns.teamId, team.id),
+      inArray10(agentRuns.status, [...ACTIVE_AGENT_RUN_STATUSES])
+    )
+  ))[0]?.n ?? 0;
+  const driftCount = (await db.select({ n: count9() }).from(policyReceipts).innerJoin(agentRuns, eq29(policyReceipts.runId, agentRuns.id)).where(and22(eq29(agentRuns.teamId, team.id), eq29(policyReceipts.drift, true))))[0]?.n ?? 0;
+  const openSessionCount = (await db.select({ n: count9() }).from(debugSessions).where(and22(eq29(debugSessions.teamId, team.id), eq29(debugSessions.status, "open"))))[0]?.n ?? 0;
   const activeAgentRows = await db.select({ n: countDistinct3(activity.tokenId) }).from(activity).where(and22(eq29(activity.teamId, team.id), gt10(activity.createdAt, weekAgo)));
   const activeAgents7d = activeAgentRows[0]?.n ?? 0;
   const settingsError = c.req.query("error");
@@ -11971,7 +12203,7 @@ dashboardRoutes.get("/app/teams/:slug", async (c) => {
             actions: /* @__PURE__ */ jsxs14(Fragment11, { children: [
               /* @__PURE__ */ jsx14("a", { class: "btn btn-sm", href: `/app/teams/${team.slug}/compare`, children: "Compare environments" }),
               /* @__PURE__ */ jsx14("a", { class: "btn btn-sm", href: `/app/teams/${team.slug}/governance`, children: "Governance" }),
-              /* @__PURE__ */ jsx14("a", { class: "btn btn-sm btn-primary", href: "#invites", children: "Invite member" })
+              /* @__PURE__ */ jsx14("a", { class: "btn btn-sm btn-primary", href: `/app/teams/${team.slug}?tab=people#invites`, children: "Invite member" })
             ] })
           }
         ),
@@ -11983,13 +12215,21 @@ dashboardRoutes.get("/app/teams/:slug", async (c) => {
         children: [
           settingsError ? /* @__PURE__ */ jsx14(Banner2, { kind: "error", text: settingsError }) : null,
           notice ? /* @__PURE__ */ jsx14(Banner2, { kind: "success", text: notice }) : null,
-          /* @__PURE__ */ jsxs14("div", { class: "grid2", children: [
+          /* @__PURE__ */ jsx14("div", { class: "pagetabs", style: "margin:0 0 16px;padding:0;border-bottom:1px solid var(--line)", children: TABS.map((key) => /* @__PURE__ */ jsx14(
+            "a",
+            {
+              class: `tab${tab === key ? " active" : ""}`,
+              href: `/app/teams/${team.slug}${key === "overview" ? "" : `?tab=${key}`}`,
+              children: key === "overview" ? "Overview" : key === "people" ? "People" : key === "integrations" ? "Integrations" : "Settings"
+            }
+          )) }),
+          /* @__PURE__ */ jsxs14("div", { class: tab === "overview" ? "grid2" : "col", children: [
             /* @__PURE__ */ jsxs14("div", { class: "col", children: [
-              /* @__PURE__ */ jsxs14("div", { class: "card scroll-x", children: [
+              tab === "overview" ? /* @__PURE__ */ jsxs14("div", { class: "card scroll-x", children: [
                 /* @__PURE__ */ jsxs14("div", { class: "card-head", children: [
                   /* @__PURE__ */ jsxs14("div", { children: [
                     /* @__PURE__ */ jsx14("div", { class: "card-title", children: "Projects" }),
-                    /* @__PURE__ */ jsx14("div", { class: "card-note", children: "Born automatically from the repo identifier agents send." })
+                    /* @__PURE__ */ jsx14("div", { class: "card-note", children: "Click one \u2014 policy, environment, flow and sessions live on its page." })
                   ] }),
                   /* @__PURE__ */ jsx14("span", { class: "mono muted", children: teamProjects.length })
                 ] }),
@@ -12001,14 +12241,14 @@ dashboardRoutes.get("/app/teams/:slug", async (c) => {
                     /* @__PURE__ */ jsx14("th", { children: "Last snapshot" })
                   ] }),
                   teamProjects.map((p) => /* @__PURE__ */ jsxs14("tr", { children: [
-                    /* @__PURE__ */ jsx14("td", { class: "name", children: p.name }),
+                    /* @__PURE__ */ jsx14("td", { class: "name", children: /* @__PURE__ */ jsx14("a", { href: `/app/teams/${team.slug}/projects/${encodeURIComponent(p.name)}`, children: p.name }) }),
                     /* @__PURE__ */ jsx14("td", { children: openByProject.get(p.id) ?? 0 }),
                     /* @__PURE__ */ jsx14("td", { children: agentsByProject.get(p.id) ?? 0 }),
                     /* @__PURE__ */ jsx14("td", { class: "muted", children: timeAgo(snapByProject.get(p.id) ?? null) ?? "\u2014" })
                   ] }))
                 ] })
-              ] }),
-              /* @__PURE__ */ jsxs14("div", { class: "card scroll-x", children: [
+              ] }) : null,
+              tab === "people" ? /* @__PURE__ */ jsxs14("div", { class: "card scroll-x", children: [
                 /* @__PURE__ */ jsxs14("div", { class: "card-head", children: [
                   /* @__PURE__ */ jsx14("span", { class: "card-title", children: "Members" }),
                   /* @__PURE__ */ jsx14("span", { class: "mono muted", children: members.length })
@@ -12072,8 +12312,8 @@ dashboardRoutes.get("/app/teams/:slug", async (c) => {
                     ] }) })
                   ] }))
                 ] })
-              ] }),
-              /* @__PURE__ */ jsxs14("div", { class: "card", id: "invites", children: [
+              ] }) : null,
+              tab === "people" ? /* @__PURE__ */ jsxs14("div", { class: "card", id: "invites", children: [
                 /* @__PURE__ */ jsxs14("div", { class: "card-head", children: [
                   /* @__PURE__ */ jsxs14("div", { children: [
                     /* @__PURE__ */ jsx14("div", { class: "card-title", children: "Invite links" }),
@@ -12121,17 +12361,51 @@ dashboardRoutes.get("/app/teams/:slug", async (c) => {
                     ] })
                   ] });
                 })
-              ] })
+              ] }) : null
             ] }),
             /* @__PURE__ */ jsxs14("div", { class: "col", children: [
-              /* @__PURE__ */ jsxs14("div", { class: "darkcard", children: [
+              tab === "overview" ? /* @__PURE__ */ jsxs14("div", { class: "darkcard", children: [
                 /* @__PURE__ */ jsx14("span", { class: "overline", children: "Next step" }),
                 /* @__PURE__ */ jsx14("h3", { children: "Connect your agent" }),
                 /* @__PURE__ */ jsx14("p", { children: "Create a personal token, then paste one line into your agent \u2014 it will join this team's bridge and can push its first snapshot." }),
                 /* @__PURE__ */ jsx14("div", { class: "cmd inner", children: /* @__PURE__ */ jsx14("code", { children: placeholderCmd }) }),
                 /* @__PURE__ */ jsx14("a", { class: "btn btn-white", href: "/app/tokens", style: "align-self:flex-start", children: "Create a token" })
-              ] }),
-              /* @__PURE__ */ jsxs14("div", { class: "card card-pad", style: "display:flex;flex-direction:column;gap:12px", children: [
+              ] }) : null,
+              tab === "overview" ? /* @__PURE__ */ jsxs14("div", { class: "card card-pad", style: "display:flex;flex-direction:column;gap:12px", children: [
+                /* @__PURE__ */ jsx14("span", { class: "card-title", children: "Team health" }),
+                /* @__PURE__ */ jsxs14("div", { class: "factrow", children: [
+                  /* @__PURE__ */ jsx14("span", { class: liveRuns > 0 ? "y" : "n", children: liveRuns > 0 ? "\u2713" : "\xB7" }),
+                  /* @__PURE__ */ jsxs14("span", { children: [
+                    liveRuns,
+                    " ",
+                    liveRuns === 1 ? "run" : "runs",
+                    " live now \u2014",
+                    " ",
+                    /* @__PURE__ */ jsx14("a", { href: "/app/agents", children: "agent map" })
+                  ] })
+                ] }),
+                /* @__PURE__ */ jsxs14("div", { class: "factrow", children: [
+                  /* @__PURE__ */ jsx14("span", { class: driftCount > 0 ? "n" : "y", children: driftCount > 0 ? "!" : "\u2713" }),
+                  /* @__PURE__ */ jsxs14("span", { children: [
+                    driftCount > 0 ? `${driftCount} run(s) applied rules the server did not serve` : "No policy drift reported",
+                    " ",
+                    "\u2014 ",
+                    /* @__PURE__ */ jsx14("a", { href: `/app/teams/${team.slug}/governance`, children: "governance" })
+                  ] })
+                ] }),
+                /* @__PURE__ */ jsxs14("div", { class: "factrow", children: [
+                  /* @__PURE__ */ jsx14("span", { class: "y", children: "\u2713" }),
+                  /* @__PURE__ */ jsxs14("span", { children: [
+                    openSessionCount,
+                    " open ",
+                    openSessionCount === 1 ? "thread" : "threads",
+                    " \u2014",
+                    " ",
+                    /* @__PURE__ */ jsx14("a", { href: "/app/sessions", children: "sessions" })
+                  ] })
+                ] })
+              ] }) : null,
+              tab === "overview" ? /* @__PURE__ */ jsxs14("div", { class: "card card-pad", style: "display:flex;flex-direction:column;gap:12px", children: [
                 /* @__PURE__ */ jsx14("span", { class: "card-title", children: "What agents share here" }),
                 /* @__PURE__ */ jsxs14("div", { class: "factrow", children: [
                   /* @__PURE__ */ jsx14("span", { class: "y", children: "\u2713" }),
@@ -12153,253 +12427,255 @@ dashboardRoutes.get("/app/teams/:slug", async (c) => {
                   /* @__PURE__ */ jsx14("span", { class: "n", children: "\u2715" }),
                   /* @__PURE__ */ jsx14("span", { children: "Never: secret values, file contents, source code" })
                 ] })
-              ] }),
-              role === "owner" ? /* @__PURE__ */ jsxs14("div", { class: "card card-pad", style: "display:flex;flex-direction:column;gap:12px", children: [
-                /* @__PURE__ */ jsxs14("div", { children: [
-                  /* @__PURE__ */ jsx14("div", { class: "card-title", children: "Notifications" }),
-                  /* @__PURE__ */ jsx14("div", { class: "card-note", children: "Optional Slack or Discord incoming-webhook URL. New and resolved sessions ping it \u2014 message bodies are never sent." })
-                ] }),
-                /* @__PURE__ */ jsxs14("form", { class: "inline", method: "post", action: `/app/teams/${team.slug}/settings`, children: [
-                  /* @__PURE__ */ jsx14(
-                    "input",
+              ] }) : null,
+              tab === "integrations" ? /* @__PURE__ */ jsxs14(Fragment11, { children: [
+                role === "owner" ? /* @__PURE__ */ jsxs14("div", { class: "card card-pad", style: "display:flex;flex-direction:column;gap:12px", children: [
+                  /* @__PURE__ */ jsxs14("div", { children: [
+                    /* @__PURE__ */ jsx14("div", { class: "card-title", children: "Notifications" }),
+                    /* @__PURE__ */ jsx14("div", { class: "card-note", children: "Optional Slack or Discord incoming-webhook URL. New and resolved sessions ping it \u2014 message bodies are never sent." })
+                  ] }),
+                  /* @__PURE__ */ jsxs14("form", { class: "inline", method: "post", action: `/app/teams/${team.slug}/settings`, children: [
+                    /* @__PURE__ */ jsx14(
+                      "input",
+                      {
+                        class: "in",
+                        style: "flex:1;min-width:200px",
+                        type: "text",
+                        name: "webhook_url",
+                        "aria-label": "Team Slack or Discord webhook URL",
+                        value: team.webhookUrl ?? "",
+                        placeholder: "https://hooks.slack.com/services/\u2026"
+                      }
+                    ),
+                    /* @__PURE__ */ jsx14("button", { class: "btn btn-sm", type: "submit", children: "Save" })
+                  ] }),
+                  /* @__PURE__ */ jsxs14("div", { style: "border-top:1px solid var(--line-2);padding-top:12px;display:flex;flex-direction:column;gap:8px", children: [
+                    /* @__PURE__ */ jsxs14("div", { children: [
+                      /* @__PURE__ */ jsx14("div", { class: "card-title", style: "font-size:14px", children: "Inbound hooks" }),
+                      /* @__PURE__ */ jsxs14("div", { class: "card-note", children: [
+                        "POST here from CI or a GitHub webhook (push events) to announce to the team. For GitHub, also paste the token as the webhook ",
+                        /* @__PURE__ */ jsx14("b", { children: "Secret" }),
+                        " \u2014 signed requests are verified, and a bad signature is rejected."
+                      ] })
+                    ] }),
+                    team.inboundToken ? /* @__PURE__ */ jsxs14(Fragment11, { children: [
+                      /* @__PURE__ */ jsx14("div", { class: "cmd inner", children: /* @__PURE__ */ jsx14("code", { children: `${env2.baseUrl}/api/hooks/announce/${team.inboundToken}` }) }),
+                      /* @__PURE__ */ jsx14("div", { class: "cmd inner", children: /* @__PURE__ */ jsx14("code", { children: `${env2.baseUrl}/api/hooks/github/${team.inboundToken}` }) })
+                    ] }) : /* @__PURE__ */ jsx14("p", { class: "m0 small muted", children: "No inbound token yet." }),
+                    /* @__PURE__ */ jsx14("form", { method: "post", action: `/app/teams/${team.slug}/inbound-token`, class: "m0", children: /* @__PURE__ */ jsx14("button", { class: "btn btn-sm", type: "submit", children: team.inboundToken ? "Regenerate token" : "Generate hook URLs" }) })
+                  ] })
+                ] }) : null,
+                role === "owner" ? /* @__PURE__ */ jsxs14("div", { class: "card card-pad", style: "display:flex;flex-direction:column;gap:12px", children: [
+                  /* @__PURE__ */ jsxs14("div", { children: [
+                    /* @__PURE__ */ jsx14("div", { class: "card-title", children: "GitHub issues" }),
+                    /* @__PURE__ */ jsxs14("div", { class: "card-note", children: [
+                      "Connect one repository and a run stops being a string. Agents list what is open (",
+                      /* @__PURE__ */ jsx14("code", { children: "list_issues" }),
+                      "), start a run on a number (",
+                      /* @__PURE__ */ jsxs14("code", { children: [
+                        "start_run ",
+                        "{",
+                        '"issue": 42',
+                        "}"
+                      ] }),
+                      "), and when that run finishes or is handed off, the issue gets a comment saying so. Needs a token with",
+                      " ",
+                      /* @__PURE__ */ jsx14("b", { children: "issues: read and write" }),
+                      " \u2014 a fine-grained token scoped to this one repository is the right shape."
+                    ] })
+                  ] }),
+                  github ? /* @__PURE__ */ jsxs14("div", { class: "factrow", children: [
+                    /* @__PURE__ */ jsx14("span", { class: "y", children: "\u2713" }),
+                    /* @__PURE__ */ jsxs14("span", { children: [
+                      "Connected to ",
+                      /* @__PURE__ */ jsx14("b", { children: github.repo }),
+                      github.commentOnFinish ? " \u2014 finished runs comment back on the issue." : " \u2014 commenting back is off, so this is read-only."
+                    ] })
+                  ] }) : null,
+                  /* @__PURE__ */ jsxs14(
+                    "form",
                     {
-                      class: "in",
-                      style: "flex:1;min-width:200px",
-                      type: "text",
-                      name: "webhook_url",
-                      "aria-label": "Team Slack or Discord webhook URL",
-                      value: team.webhookUrl ?? "",
-                      placeholder: "https://hooks.slack.com/services/\u2026"
+                      method: "post",
+                      action: `/app/teams/${team.slug}/integrations/github`,
+                      style: "display:flex;flex-direction:column;gap:10px",
+                      children: [
+                        /* @__PURE__ */ jsx14(
+                          "input",
+                          {
+                            class: "in",
+                            type: "text",
+                            name: "repo",
+                            "aria-label": "GitHub repository, as owner/name",
+                            value: github?.repo ?? "",
+                            placeholder: "owner/name"
+                          }
+                        ),
+                        /* @__PURE__ */ jsx14(
+                          "input",
+                          {
+                            class: "in",
+                            type: "password",
+                            name: "token",
+                            autocomplete: "off",
+                            "aria-label": "GitHub access token with issues read and write",
+                            placeholder: github ? "Stored \u2014 type a new token only to replace it" : "github_pat_\u2026 or ghp_\u2026"
+                          }
+                        ),
+                        /* @__PURE__ */ jsxs14("label", { class: "checkrow", children: [
+                          /* @__PURE__ */ jsx14(
+                            "input",
+                            {
+                              type: "checkbox",
+                              name: "comment_on_finish",
+                              value: "on",
+                              checked: github?.commentOnFinish ?? true
+                            }
+                          ),
+                          /* @__PURE__ */ jsxs14("span", { children: [
+                            /* @__PURE__ */ jsx14("span", { class: "checkrow-label", children: "Comment on the issue when a run ends" }),
+                            /* @__PURE__ */ jsx14("span", { class: "checkrow-note", children: "One comment per finished run or handoff, on issues an agent named. Off means STMA only reads." })
+                          ] })
+                        ] }),
+                        /* @__PURE__ */ jsxs14("div", { style: "display:flex;gap:8px;flex-wrap:wrap", children: [
+                          /* @__PURE__ */ jsx14("button", { class: "btn btn-sm btn-primary", type: "submit", name: "action", value: "save", children: github ? "Update connection" : "Connect repository" }),
+                          github ? /* @__PURE__ */ jsx14("button", { class: "btn btn-sm", type: "submit", name: "action", value: "test", children: "Test access" }) : null,
+                          github ? /* @__PURE__ */ jsx14("button", { class: "btn btn-sm", type: "submit", name: "action", value: "remove", children: "Disconnect" }) : null
+                        ] })
+                      ]
                     }
-                  ),
-                  /* @__PURE__ */ jsx14("button", { class: "btn btn-sm", type: "submit", children: "Save" })
-                ] }),
-                /* @__PURE__ */ jsxs14("div", { style: "border-top:1px solid var(--line-2);padding-top:12px;display:flex;flex-direction:column;gap:8px", children: [
+                  )
+                ] }) : null,
+                role === "owner" ? /* @__PURE__ */ jsxs14("div", { class: "card card-pad", style: "display:flex;flex-direction:column;gap:12px", children: [
                   /* @__PURE__ */ jsxs14("div", { children: [
-                    /* @__PURE__ */ jsx14("div", { class: "card-title", style: "font-size:14px", children: "Inbound hooks" }),
+                    /* @__PURE__ */ jsx14("div", { class: "card-title", children: "Azure DevOps" }),
                     /* @__PURE__ */ jsxs14("div", { class: "card-note", children: [
-                      "POST here from CI or a GitHub webhook (push events) to announce to the team. For GitHub, also paste the token as the webhook ",
-                      /* @__PURE__ */ jsx14("b", { children: "Secret" }),
-                      " \u2014 signed requests are verified, and a bad signature is rejected."
+                      "Where the ",
+                      /* @__PURE__ */ jsx14("a", { href: `/app/teams/${team.slug}/delivery`, children: "delivery flow" }),
+                      " gets applied: STMA commits the rendered pipeline file into this repository and registers the pipeline. Needs a PAT with ",
+                      /* @__PURE__ */ jsx14("b", { children: "Code read & write" }),
+                      " and",
+                      " ",
+                      /* @__PURE__ */ jsx14("b", { children: "Build read & execute" }),
+                      ", scoped to this one project."
                     ] })
                   ] }),
-                  team.inboundToken ? /* @__PURE__ */ jsxs14(Fragment11, { children: [
-                    /* @__PURE__ */ jsx14("div", { class: "cmd inner", children: /* @__PURE__ */ jsx14("code", { children: `${env2.baseUrl}/api/hooks/announce/${team.inboundToken}` }) }),
-                    /* @__PURE__ */ jsx14("div", { class: "cmd inner", children: /* @__PURE__ */ jsx14("code", { children: `${env2.baseUrl}/api/hooks/github/${team.inboundToken}` }) })
-                  ] }) : /* @__PURE__ */ jsx14("p", { class: "m0 small muted", children: "No inbound token yet." }),
-                  /* @__PURE__ */ jsx14("form", { method: "post", action: `/app/teams/${team.slug}/inbound-token`, class: "m0", children: /* @__PURE__ */ jsx14("button", { class: "btn btn-sm", type: "submit", children: team.inboundToken ? "Regenerate token" : "Generate hook URLs" }) })
-                ] })
-              ] }) : null,
-              role === "owner" ? /* @__PURE__ */ jsxs14("div", { class: "card card-pad", style: "display:flex;flex-direction:column;gap:12px", children: [
-                /* @__PURE__ */ jsxs14("div", { children: [
-                  /* @__PURE__ */ jsx14("div", { class: "card-title", children: "GitHub issues" }),
-                  /* @__PURE__ */ jsxs14("div", { class: "card-note", children: [
-                    "Connect one repository and a run stops being a string. Agents list what is open (",
-                    /* @__PURE__ */ jsx14("code", { children: "list_issues" }),
-                    "), start a run on a number (",
-                    /* @__PURE__ */ jsxs14("code", { children: [
-                      "start_run ",
-                      "{",
-                      '"issue": 42',
-                      "}"
-                    ] }),
-                    "), and when that run finishes or is handed off, the issue gets a comment saying so. Needs a token with",
-                    " ",
-                    /* @__PURE__ */ jsx14("b", { children: "issues: read and write" }),
-                    " \u2014 a fine-grained token scoped to this one repository is the right shape."
-                  ] })
-                ] }),
-                github ? /* @__PURE__ */ jsxs14("div", { class: "factrow", children: [
-                  /* @__PURE__ */ jsx14("span", { class: "y", children: "\u2713" }),
-                  /* @__PURE__ */ jsxs14("span", { children: [
-                    "Connected to ",
-                    /* @__PURE__ */ jsx14("b", { children: github.repo }),
-                    github.commentOnFinish ? " \u2014 finished runs comment back on the issue." : " \u2014 commenting back is off, so this is read-only."
-                  ] })
-                ] }) : null,
-                /* @__PURE__ */ jsxs14(
-                  "form",
-                  {
-                    method: "post",
-                    action: `/app/teams/${team.slug}/integrations/github`,
-                    style: "display:flex;flex-direction:column;gap:10px",
-                    children: [
-                      /* @__PURE__ */ jsx14(
-                        "input",
-                        {
-                          class: "in",
-                          type: "text",
-                          name: "repo",
-                          "aria-label": "GitHub repository, as owner/name",
-                          value: github?.repo ?? "",
-                          placeholder: "owner/name"
-                        }
-                      ),
-                      /* @__PURE__ */ jsx14(
-                        "input",
-                        {
-                          class: "in",
-                          type: "password",
-                          name: "token",
-                          autocomplete: "off",
-                          "aria-label": "GitHub access token with issues read and write",
-                          placeholder: github ? "Stored \u2014 type a new token only to replace it" : "github_pat_\u2026 or ghp_\u2026"
-                        }
-                      ),
-                      /* @__PURE__ */ jsxs14("label", { class: "checkrow", children: [
+                  ado ? /* @__PURE__ */ jsxs14("div", { class: "factrow", children: [
+                    /* @__PURE__ */ jsx14("span", { class: "y", children: "\u2713" }),
+                    /* @__PURE__ */ jsxs14("span", { children: [
+                      "Connected to ",
+                      /* @__PURE__ */ jsx14("b", { class: "mono", children: `${ado.organization}/${ado.project}/${ado.repo}` })
+                    ] })
+                  ] }) : null,
+                  /* @__PURE__ */ jsx14(AdoTokenHelp, {}),
+                  /* @__PURE__ */ jsxs14(
+                    "form",
+                    {
+                      method: "post",
+                      action: `/app/teams/${team.slug}/integrations/azure-devops`,
+                      style: "display:flex;flex-direction:column;gap:10px",
+                      children: [
+                        /* @__PURE__ */ jsx14(
+                          "input",
+                          {
+                            class: "in",
+                            type: "text",
+                            name: "locator",
+                            "aria-label": "Azure DevOps repository, as organization/project/repo",
+                            value: ado ? `${ado.organization}/${ado.project}/${ado.repo}` : "",
+                            placeholder: "organization/project/repo \u2014 or paste the repo URL"
+                          }
+                        ),
                         /* @__PURE__ */ jsx14(
                           "input",
                           {
-                            type: "checkbox",
-                            name: "comment_on_finish",
-                            value: "on",
-                            checked: github?.commentOnFinish ?? true
+                            class: "in",
+                            type: "password",
+                            name: "token",
+                            autocomplete: "off",
+                            "aria-label": "Azure DevOps personal access token",
+                            placeholder: ado ? "Stored \u2014 type a new token only to replace it" : "Personal access token"
                           }
                         ),
-                        /* @__PURE__ */ jsxs14("span", { children: [
-                          /* @__PURE__ */ jsx14("span", { class: "checkrow-label", children: "Comment on the issue when a run ends" }),
-                          /* @__PURE__ */ jsx14("span", { class: "checkrow-note", children: "One comment per finished run or handoff, on issues an agent named. Off means STMA only reads." })
+                        /* @__PURE__ */ jsxs14("div", { style: "display:flex;gap:8px;flex-wrap:wrap", children: [
+                          /* @__PURE__ */ jsx14("button", { class: "btn btn-sm btn-primary", type: "submit", name: "action", value: "save", children: ado ? "Update connection" : "Connect Azure DevOps" }),
+                          ado ? /* @__PURE__ */ jsx14("button", { class: "btn btn-sm", type: "submit", name: "action", value: "test", children: "Test access" }) : null,
+                          ado ? /* @__PURE__ */ jsx14("button", { class: "btn btn-sm", type: "submit", name: "action", value: "remove", children: "Disconnect" }) : null
                         ] })
-                      ] }),
-                      /* @__PURE__ */ jsxs14("div", { style: "display:flex;gap:8px;flex-wrap:wrap", children: [
-                        /* @__PURE__ */ jsx14("button", { class: "btn btn-sm btn-primary", type: "submit", name: "action", value: "save", children: github ? "Update connection" : "Connect repository" }),
-                        github ? /* @__PURE__ */ jsx14("button", { class: "btn btn-sm", type: "submit", name: "action", value: "test", children: "Test access" }) : null,
-                        github ? /* @__PURE__ */ jsx14("button", { class: "btn btn-sm", type: "submit", name: "action", value: "remove", children: "Disconnect" }) : null
-                      ] })
-                    ]
-                  }
-                )
-              ] }) : null,
-              role === "owner" ? /* @__PURE__ */ jsxs14("div", { class: "card card-pad", style: "display:flex;flex-direction:column;gap:12px", children: [
-                /* @__PURE__ */ jsxs14("div", { children: [
-                  /* @__PURE__ */ jsx14("div", { class: "card-title", children: "Azure DevOps" }),
-                  /* @__PURE__ */ jsxs14("div", { class: "card-note", children: [
-                    "Where the ",
-                    /* @__PURE__ */ jsx14("a", { href: `/app/teams/${team.slug}/delivery`, children: "delivery flow" }),
-                    " gets applied: STMA commits the rendered pipeline file into this repository and registers the pipeline. Needs a PAT with ",
-                    /* @__PURE__ */ jsx14("b", { children: "Code read & write" }),
-                    " and",
-                    " ",
-                    /* @__PURE__ */ jsx14("b", { children: "Build read & execute" }),
-                    ", scoped to this one project."
-                  ] })
-                ] }),
-                ado ? /* @__PURE__ */ jsxs14("div", { class: "factrow", children: [
-                  /* @__PURE__ */ jsx14("span", { class: "y", children: "\u2713" }),
-                  /* @__PURE__ */ jsxs14("span", { children: [
-                    "Connected to ",
-                    /* @__PURE__ */ jsx14("b", { class: "mono", children: `${ado.organization}/${ado.project}/${ado.repo}` })
-                  ] })
+                      ]
+                    }
+                  )
                 ] }) : null,
-                /* @__PURE__ */ jsx14(AdoTokenHelp, {}),
-                /* @__PURE__ */ jsxs14(
-                  "form",
-                  {
-                    method: "post",
-                    action: `/app/teams/${team.slug}/integrations/azure-devops`,
-                    style: "display:flex;flex-direction:column;gap:10px",
-                    children: [
-                      /* @__PURE__ */ jsx14(
-                        "input",
-                        {
-                          class: "in",
-                          type: "text",
-                          name: "locator",
-                          "aria-label": "Azure DevOps repository, as organization/project/repo",
-                          value: ado ? `${ado.organization}/${ado.project}/${ado.repo}` : "",
-                          placeholder: "organization/project/repo \u2014 or paste the repo URL"
-                        }
-                      ),
-                      /* @__PURE__ */ jsx14(
-                        "input",
-                        {
-                          class: "in",
-                          type: "password",
-                          name: "token",
-                          autocomplete: "off",
-                          "aria-label": "Azure DevOps personal access token",
-                          placeholder: ado ? "Stored \u2014 type a new token only to replace it" : "Personal access token"
-                        }
-                      ),
-                      /* @__PURE__ */ jsxs14("div", { style: "display:flex;gap:8px;flex-wrap:wrap", children: [
-                        /* @__PURE__ */ jsx14("button", { class: "btn btn-sm btn-primary", type: "submit", name: "action", value: "save", children: ado ? "Update connection" : "Connect Azure DevOps" }),
-                        ado ? /* @__PURE__ */ jsx14("button", { class: "btn btn-sm", type: "submit", name: "action", value: "test", children: "Test access" }) : null,
-                        ado ? /* @__PURE__ */ jsx14("button", { class: "btn btn-sm", type: "submit", name: "action", value: "remove", children: "Disconnect" }) : null
-                      ] })
-                    ]
-                  }
-                )
-              ] }) : null,
-              role === "owner" ? /* @__PURE__ */ jsxs14("div", { class: "card card-pad", style: "display:flex;flex-direction:column;gap:12px", children: [
-                /* @__PURE__ */ jsxs14("div", { children: [
-                  /* @__PURE__ */ jsx14("div", { class: "card-title", children: "Jira" }),
-                  /* @__PURE__ */ jsxs14("div", { class: "card-note", children: [
-                    "For delivery flows whose tickets live in Jira: STMA verifies the connection and reads issue titles \u2014 it never writes to the tracker. Needs the site, the account email, and an API token from",
-                    " ",
-                    /* @__PURE__ */ jsx14("span", { class: "mono", children: "id.atlassian.com/manage-profile/security/api-tokens" }),
-                    "."
-                  ] })
-                ] }),
-                jira ? /* @__PURE__ */ jsxs14("div", { class: "factrow", children: [
-                  /* @__PURE__ */ jsx14("span", { class: "y", children: "\u2713" }),
-                  /* @__PURE__ */ jsxs14("span", { children: [
-                    "Connected to ",
-                    /* @__PURE__ */ jsx14("b", { class: "mono", children: jira.site }),
-                    " as ",
-                    jira.email
-                  ] })
-                ] }) : null,
-                /* @__PURE__ */ jsx14(JiraTokenHelp, {}),
-                /* @__PURE__ */ jsxs14(
-                  "form",
-                  {
-                    method: "post",
-                    action: `/app/teams/${team.slug}/integrations/jira`,
-                    style: "display:flex;flex-direction:column;gap:10px",
-                    children: [
-                      /* @__PURE__ */ jsx14(
-                        "input",
-                        {
-                          class: "in",
-                          type: "text",
-                          name: "site",
-                          "aria-label": "Jira site, like acme.atlassian.net",
-                          value: jira?.site ?? "",
-                          placeholder: "acme.atlassian.net"
-                        }
-                      ),
-                      /* @__PURE__ */ jsx14(
-                        "input",
-                        {
-                          class: "in",
-                          type: "email",
-                          name: "email",
-                          "aria-label": "Atlassian account email",
-                          value: jira?.email ?? "",
-                          placeholder: "you@company.com"
-                        }
-                      ),
-                      /* @__PURE__ */ jsx14(
-                        "input",
-                        {
-                          class: "in",
-                          type: "password",
-                          name: "token",
-                          autocomplete: "off",
-                          "aria-label": "Jira API token",
-                          placeholder: jira ? "Stored \u2014 type a new token only to replace it" : "API token"
-                        }
-                      ),
-                      /* @__PURE__ */ jsxs14("div", { style: "display:flex;gap:8px;flex-wrap:wrap", children: [
-                        /* @__PURE__ */ jsx14("button", { class: "btn btn-sm btn-primary", type: "submit", name: "action", value: "save", children: jira ? "Update connection" : "Connect Jira" }),
-                        jira ? /* @__PURE__ */ jsx14("button", { class: "btn btn-sm", type: "submit", name: "action", value: "test", children: "Test access" }) : null,
-                        jira ? /* @__PURE__ */ jsx14("button", { class: "btn btn-sm", type: "submit", name: "action", value: "remove", children: "Disconnect" }) : null
-                      ] })
-                    ]
-                  }
-                )
+                role === "owner" ? /* @__PURE__ */ jsxs14("div", { class: "card card-pad", style: "display:flex;flex-direction:column;gap:12px", children: [
+                  /* @__PURE__ */ jsxs14("div", { children: [
+                    /* @__PURE__ */ jsx14("div", { class: "card-title", children: "Jira" }),
+                    /* @__PURE__ */ jsxs14("div", { class: "card-note", children: [
+                      "For delivery flows whose tickets live in Jira: STMA verifies the connection and reads issue titles \u2014 it never writes to the tracker. Needs the site, the account email, and an API token from",
+                      " ",
+                      /* @__PURE__ */ jsx14("span", { class: "mono", children: "id.atlassian.com/manage-profile/security/api-tokens" }),
+                      "."
+                    ] })
+                  ] }),
+                  jira ? /* @__PURE__ */ jsxs14("div", { class: "factrow", children: [
+                    /* @__PURE__ */ jsx14("span", { class: "y", children: "\u2713" }),
+                    /* @__PURE__ */ jsxs14("span", { children: [
+                      "Connected to ",
+                      /* @__PURE__ */ jsx14("b", { class: "mono", children: jira.site }),
+                      " as ",
+                      jira.email
+                    ] })
+                  ] }) : null,
+                  /* @__PURE__ */ jsx14(JiraTokenHelp, {}),
+                  /* @__PURE__ */ jsxs14(
+                    "form",
+                    {
+                      method: "post",
+                      action: `/app/teams/${team.slug}/integrations/jira`,
+                      style: "display:flex;flex-direction:column;gap:10px",
+                      children: [
+                        /* @__PURE__ */ jsx14(
+                          "input",
+                          {
+                            class: "in",
+                            type: "text",
+                            name: "site",
+                            "aria-label": "Jira site, like acme.atlassian.net",
+                            value: jira?.site ?? "",
+                            placeholder: "acme.atlassian.net"
+                          }
+                        ),
+                        /* @__PURE__ */ jsx14(
+                          "input",
+                          {
+                            class: "in",
+                            type: "email",
+                            name: "email",
+                            "aria-label": "Atlassian account email",
+                            value: jira?.email ?? "",
+                            placeholder: "you@company.com"
+                          }
+                        ),
+                        /* @__PURE__ */ jsx14(
+                          "input",
+                          {
+                            class: "in",
+                            type: "password",
+                            name: "token",
+                            autocomplete: "off",
+                            "aria-label": "Jira API token",
+                            placeholder: jira ? "Stored \u2014 type a new token only to replace it" : "API token"
+                          }
+                        ),
+                        /* @__PURE__ */ jsxs14("div", { style: "display:flex;gap:8px;flex-wrap:wrap", children: [
+                          /* @__PURE__ */ jsx14("button", { class: "btn btn-sm btn-primary", type: "submit", name: "action", value: "save", children: jira ? "Update connection" : "Connect Jira" }),
+                          jira ? /* @__PURE__ */ jsx14("button", { class: "btn btn-sm", type: "submit", name: "action", value: "test", children: "Test access" }) : null,
+                          jira ? /* @__PURE__ */ jsx14("button", { class: "btn btn-sm", type: "submit", name: "action", value: "remove", children: "Disconnect" }) : null
+                        ] })
+                      ]
+                    }
+                  )
+                ] }) : null
               ] }) : null,
-              /* @__PURE__ */ jsxs14("div", { class: "card card-pad", style: "display:flex;flex-direction:column;gap:12px", children: [
+              tab === "settings" ? /* @__PURE__ */ jsxs14("div", { class: "card card-pad", style: "display:flex;flex-direction:column;gap:12px", children: [
                 /* @__PURE__ */ jsxs14("div", { children: [
                   /* @__PURE__ */ jsx14("div", { class: "card-title", children: "Danger zone" }),
                   /* @__PURE__ */ jsx14("div", { class: "card-note", children: "These actions take effect immediately." })
@@ -12447,7 +12723,7 @@ dashboardRoutes.get("/app/teams/:slug", async (c) => {
                     ]
                   }
                 ) : null
-              ] })
+              ] }) : null
             ] })
           ] })
         ]
@@ -12920,7 +13196,7 @@ dashboardRoutes.post("/join/:code", async (c) => {
   return c.redirect(`/app/teams/${row.team.slug}`);
 });
 var TokensPage = (props) => {
-  const { user, list, newToken, baseUrl: baseUrl2, confirmByEmail, error, notice } = props;
+  const { user, list, devices, newToken, baseUrl: baseUrl2, confirmByEmail, error, notice } = props;
   const tokenValue = newToken ?? "stma_YOUR_TOKEN";
   const claudeCmd = connectCmd(baseUrl2, tokenValue);
   const tryCmd = "Ask your agent to call the whoami tool \u2014 it should reply with your username and teams.";
@@ -12939,16 +13215,26 @@ var TokensPage = (props) => {
   return /* @__PURE__ */ jsxs14(AppLayout, { user, active: "tokens", title: "Tokens", children: [
     error ? /* @__PURE__ */ jsx14(Banner2, { kind: "error", text: error }) : null,
     notice ? /* @__PURE__ */ jsx14(Banner2, { kind: "success", text: notice }) : null,
-    /* @__PURE__ */ jsxs14("div", { class: "page-head", children: [
-      /* @__PURE__ */ jsxs14("div", { children: [
-        /* @__PURE__ */ jsx14("h1", { class: "title", children: "Personal access tokens" }),
-        /* @__PURE__ */ jsx14("p", { class: "sub", children: "One token per machine keeps snapshots attributable and easy to revoke." })
-      ] }),
-      /* @__PURE__ */ jsxs14("form", { class: "inline m0", method: "post", action: "/app/tokens", children: [
-        /* @__PURE__ */ jsx14("input", { class: "in", style: "width:200px", type: "text", name: "name", placeholder: "e.g. work-laptop" }),
-        /* @__PURE__ */ jsx14("button", { class: "btn btn-primary", type: "submit", children: "New token" })
-      ] })
-    ] }),
+    /* @__PURE__ */ jsx14(
+      PageHead,
+      {
+        title: "Personal access tokens",
+        sub: "One token per machine keeps snapshots attributable and easy to revoke. Account settings moved to their own page.",
+        actions: /* @__PURE__ */ jsxs14("form", { class: "inline m0", method: "post", action: "/app/tokens", children: [
+          /* @__PURE__ */ jsx14(
+            "input",
+            {
+              class: "in",
+              style: "width:200px",
+              type: "text",
+              name: "name",
+              placeholder: "e.g. work-laptop"
+            }
+          ),
+          /* @__PURE__ */ jsx14("button", { class: "btn btn-primary", type: "submit", children: "New token" })
+        ] })
+      }
+    ),
     newToken ? /* @__PURE__ */ jsxs14("div", { class: "reveal", children: [
       /* @__PURE__ */ jsxs14("div", { class: "reveal-head", children: [
         /* @__PURE__ */ jsx14("span", { class: "ic", children: "\u2713" }),
@@ -12969,6 +13255,7 @@ var TokensPage = (props) => {
       /* @__PURE__ */ jsxs14("tr", { children: [
         /* @__PURE__ */ jsx14("th", { children: "Name" }),
         /* @__PURE__ */ jsx14("th", { children: "Token" }),
+        /* @__PURE__ */ jsx14("th", { class: "hide-sm", children: "Machine it reports as" }),
         /* @__PURE__ */ jsx14("th", { children: "Created" }),
         /* @__PURE__ */ jsx14("th", { children: "Last used" }),
         /* @__PURE__ */ jsx14("th", { children: "Status" }),
@@ -12980,6 +13267,7 @@ var TokensPage = (props) => {
           t.prefix,
           "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022"
         ] }),
+        /* @__PURE__ */ jsx14("td", { class: "mono muted hide-sm", children: devices.get(t.id) ?? "not yet" }),
         /* @__PURE__ */ jsx14("td", { class: "muted", children: fmtDate(t.createdAt) }),
         /* @__PURE__ */ jsx14("td", { class: "muted", children: timeAgo(t.lastUsedAt) ?? "\u2014" }),
         /* @__PURE__ */ jsx14("td", { children: t.revokedAt ? /* @__PURE__ */ jsxs14("span", { class: "pill pill-muted", children: [
@@ -13056,11 +13344,29 @@ var TokensPage = (props) => {
     ] }),
     /* @__PURE__ */ jsxs14("div", { class: "card card-pad", style: "display:flex;align-items:center;justify-content:space-between;gap:14px;flex-wrap:wrap", children: [
       /* @__PURE__ */ jsxs14("div", { children: [
-        /* @__PURE__ */ jsx14("div", { class: "card-title", children: "Email notifications" }),
-        /* @__PURE__ */ jsx14("div", { class: "card-note", children: "Sessions are answered asynchronously \u2014 get an email when a teammate's agent replies to a thread of yours or resolves it." })
+        /* @__PURE__ */ jsx14("div", { class: "card-title", children: "Everything else about you" }),
+        /* @__PURE__ */ jsx14("div", { class: "card-note", children: "This page is machines. Your password and the end of the road live on Account; what STMA emails you lives on Notifications." })
       ] }),
-      /* @__PURE__ */ jsx14("a", { class: "btn", href: "/app/notifications", children: "Notification settings" })
-    ] }),
+      /* @__PURE__ */ jsxs14("div", { class: "acts", children: [
+        /* @__PURE__ */ jsx14("a", { class: "btn", href: "/app/account", children: "Account" }),
+        /* @__PURE__ */ jsx14("a", { class: "btn", href: "/app/notifications", children: "Notifications" })
+      ] })
+    ] })
+  ] });
+};
+var AccountPage = (props) => {
+  const { user, confirmByEmail, error, notice } = props;
+  return /* @__PURE__ */ jsxs14(AppLayout, { user, active: "account", title: "Account", children: [
+    error ? /* @__PURE__ */ jsx14(Banner2, { kind: "error", text: error }) : null,
+    notice ? /* @__PURE__ */ jsx14(Banner2, { kind: "success", text: notice }) : null,
+    /* @__PURE__ */ jsx14(
+      PageHead,
+      {
+        crumb: "/ account",
+        title: "Account",
+        sub: "Your sign-in and the end of the road. Tokens live on their own page, one per machine."
+      }
+    ),
     user.passwordHash ? /* @__PURE__ */ jsxs14("div", { class: "card card-pad", style: "display:flex;flex-direction:column;gap:14px", children: [
       /* @__PURE__ */ jsxs14("div", { children: [
         /* @__PURE__ */ jsx14("div", { class: "card-title", children: "Account" }),
@@ -13162,17 +13468,44 @@ var TokensPage = (props) => {
     ] })
   ] });
 };
+dashboardRoutes.get("/app/account", async (c) => {
+  const user = c.get("user");
+  if (!user) return loginRedirect(c);
+  return c.html(
+    /* @__PURE__ */ jsx14(
+      AccountPage,
+      {
+        user,
+        confirmByEmail: c.get("env").twoFactor,
+        error: c.req.query("error"),
+        notice: c.req.query("ok")
+      }
+    )
+  );
+});
 dashboardRoutes.get("/app/tokens", async (c) => {
   const user = c.get("user");
   if (!user) return loginRedirect(c);
   const db = c.get("db");
   const list = await db.select().from(tokens).where(eq29(tokens.userId, user.id)).orderBy(desc16(tokens.createdAt));
+  const devices = /* @__PURE__ */ new Map();
+  if (list.length > 0) {
+    for (const row of await db.select({ tokenId: snapshots.tokenId, label: max5(snapshots.deviceLabel) }).from(snapshots).where(
+      inArray10(
+        snapshots.tokenId,
+        list.map((t) => t.id)
+      )
+    ).groupBy(snapshots.tokenId)) {
+      if (row.tokenId && row.label) devices.set(row.tokenId, row.label);
+    }
+  }
   return c.html(
     /* @__PURE__ */ jsx14(
       TokensPage,
       {
         user,
         list,
+        devices,
         baseUrl: c.get("env").baseUrl,
         confirmByEmail: c.get("env").twoFactor,
         error: c.req.query("error"),
@@ -13197,6 +13530,7 @@ dashboardRoutes.post("/app/tokens", async (c) => {
       {
         user,
         list,
+        devices: /* @__PURE__ */ new Map(),
         newToken: pat.token,
         baseUrl: c.get("env").baseUrl,
         confirmByEmail: c.get("env").twoFactor
@@ -13698,9 +14032,9 @@ var toCount = (raw) => {
 function linesToRuntimes(raw) {
   const out = {};
   for (const line of linesToList(raw)) {
-    const eq38 = line.indexOf("=");
-    const name = (eq38 === -1 ? line : line.slice(0, eq38)).trim();
-    const version = eq38 === -1 ? "" : line.slice(eq38 + 1).trim();
+    const eq40 = line.indexOf("=");
+    const name = (eq40 === -1 ? line : line.slice(0, eq40)).trim();
+    const version = eq40 === -1 ? "" : line.slice(eq40 + 1).trim();
     if (name) out[name] = version;
   }
   return out;
@@ -13739,9 +14073,9 @@ function linesToEnvironments(raw) {
   const environments = [];
   for (const line of linesToList(raw)) {
     const [left, ...flags] = line.split(",").map((part) => part.trim());
-    const eq38 = left.indexOf("=");
-    const name = (eq38 === -1 ? left : left.slice(0, eq38)).trim();
-    const trigger = eq38 === -1 ? "manual" : left.slice(eq38 + 1).trim();
+    const eq40 = left.indexOf("=");
+    const name = (eq40 === -1 ? left : left.slice(0, eq40)).trim();
+    const trigger = eq40 === -1 ? "manual" : left.slice(eq40 + 1).trim();
     if (!DEPLOY_TRIGGERS.includes(trigger)) {
       return {
         error: `environments: "${line}" \u2014 the part after = must be one of ${DEPLOY_TRIGGERS.join(", ")}.`
@@ -13833,7 +14167,7 @@ function nodesFor(flow) {
   }
   return nodes;
 }
-var clip = (value, max7) => value.length > max7 ? `${value.slice(0, max7 - 1)}\u2026` : value;
+var clip = (value, max8) => value.length > max8 ? `${value.slice(0, max8 - 1)}\u2026` : value;
 var FlowDiagram = ({ flow }) => {
   const nodes = nodesFor(flow);
   const width = nodes.length * NODE.w + (nodes.length - 1) * NODE.gap + 8;
@@ -14865,12 +15199,11 @@ governanceRoutes.get("/app/teams/:slug/governance", async (c) => {
                   }
                 ),
                 /* @__PURE__ */ jsx17(
-                  "button",
+                  "a",
                   {
                     class: "btn btn-sm btn-primary",
-                    type: "button",
-                    "data-open-dialog": "#publish-policy",
-                    children: "Publish policy"
+                    href: `/app/teams/${team.slug}/policy${scopeProject ? `?project=${encodeURIComponent(scopeProject.name)}` : ""}`,
+                    children: "Edit policy"
                   }
                 )
               ] }) : null,
@@ -14954,7 +15287,14 @@ governanceRoutes.get("/app/teams/:slug/governance", async (c) => {
             visibleScopes.length === 0 ? /* @__PURE__ */ jsxs17("div", { class: "empty", children: [
               /* @__PURE__ */ jsx17("h2", { children: "No policy published yet" }),
               /* @__PURE__ */ jsx17("p", { children: "Until a team owner publishes one, every agent starts a run with an empty rulebook: nothing denied, nothing requiring approval, no required checks." }),
-              isOwner ? /* @__PURE__ */ jsx17("button", { class: "btn btn-primary", type: "button", "data-open-dialog": "#publish-policy", children: "Publish policy" }) : /* @__PURE__ */ jsx17("p", { class: "muted small", children: "Ask a team owner to publish one \u2014 only owners can write policy." })
+              isOwner ? /* @__PURE__ */ jsx17(
+                "a",
+                {
+                  class: "btn btn-primary",
+                  href: `/app/teams/${team.slug}/policy${scopeProject ? `?project=${encodeURIComponent(scopeProject.name)}` : ""}`,
+                  children: "Edit policy"
+                }
+              ) : /* @__PURE__ */ jsx17("p", { class: "muted small", children: "Ask a team owner to publish one \u2014 only owners can write policy." })
             ] }) : /* @__PURE__ */ jsxs17(Fragment14, { children: [
               /* @__PURE__ */ jsx17("div", { class: "scroll-x", children: /* @__PURE__ */ jsxs17("table", { class: "tbl", children: [
                 /* @__PURE__ */ jsxs17("tr", { children: [
@@ -15148,112 +15488,6 @@ governanceRoutes.get("/app/teams/:slug/governance", async (c) => {
               ] }))
             ] }) })
           ] }),
-          isOwner ? /* @__PURE__ */ jsxs17("dialog", { id: "publish-policy", class: "formdlg wide", children: [
-            /* @__PURE__ */ jsx17("h3", { children: "Publish policy" }),
-            /* @__PURE__ */ jsx17("p", { class: "dlgsub", children: "One rule per line. This is the document every agent receives on its next run \u2014 it publishes as a new version, and the old one stays in the record." }),
-            /* @__PURE__ */ jsxs17("form", { method: "post", action: `/app/teams/${team.slug}/policy`, children: [
-              /* @__PURE__ */ jsxs17("div", { class: "field", children: [
-                /* @__PURE__ */ jsx17("label", { children: "Scope" }),
-                /* @__PURE__ */ jsxs17("select", { class: "in", name: "scope", children: [
-                  /* @__PURE__ */ jsx17("option", { value: "team", selected: !scopeProject, children: "Team-wide \u2014 applies to every run" }),
-                  teamProjects.map((p) => /* @__PURE__ */ jsxs17("option", { value: p.name, selected: p.name === scopeProject?.name, children: [
-                    "Project: ",
-                    p.name,
-                    " \u2014 merged on top of team policy"
-                  ] }))
-                ] }),
-                /* @__PURE__ */ jsx17("span", { class: "help", children: scopeProject ? `Opened on ${scopeProject.name}'s own additions (the page is scoped to it) \u2014 team rules stay merged underneath.` : "Project policy adds to team policy; it does not replace it. Start team-wide." })
-              ] }),
-              /* @__PURE__ */ jsxs17("div", { class: "field", children: [
-                /* @__PURE__ */ jsx17("label", { children: "Guidance" }),
-                /* @__PURE__ */ jsx17("textarea", { class: "in", name: "guidance", rows: 3, "aria-label": "Guidance", placeholder: "Ship behind a feature flag\nNever touch another agent's branch \u2014 open a debug session instead", children: draft ? listToLines(draft.guidance) : "" }),
-                /* @__PURE__ */ jsx17("span", { class: "help", children: "Plain sentences the agent reads before it plans." })
-              ] }),
-              /* @__PURE__ */ jsxs17("div", { class: "field", children: [
-                /* @__PURE__ */ jsx17("label", { children: "Denied" }),
-                /* @__PURE__ */ jsx17("textarea", { class: "in", name: "deny", rows: 3, "aria-label": "Denied", placeholder: "read secret values\npush to main\nrun terraform apply", children: draft ? listToLines(draft.permissions.deny) : "" })
-              ] }),
-              /* @__PURE__ */ jsxs17("div", { class: "field", children: [
-                /* @__PURE__ */ jsx17("label", { children: "Requires approval" }),
-                /* @__PURE__ */ jsx17("textarea", { class: "in", name: "requireApproval", rows: 2, "aria-label": "Requires approval", placeholder: "schema migrations\nchanges under infra/", children: draft ? listToLines(draft.permissions.requireApproval) : "" }),
-                /* @__PURE__ */ jsx17("span", { class: "help", children: "The agent must ask its human before doing these." })
-              ] }),
-              /* @__PURE__ */ jsxs17("div", { class: "field", children: [
-                /* @__PURE__ */ jsx17("label", { children: "Required checks" }),
-                /* @__PURE__ */ jsx17("textarea", { class: "in", name: "requiredChecks", rows: 2, "aria-label": "Required checks", placeholder: "npm test\nnpm run typecheck", children: draft ? listToLines(draft.requiredChecks) : "" })
-              ] }),
-              /* @__PURE__ */ jsxs17("div", { class: "field", children: [
-                /* @__PURE__ */ jsx17("label", { children: "Protected paths" }),
-                /* @__PURE__ */ jsx17("textarea", { class: "in", name: "protectedPaths", rows: 2, "aria-label": "Protected paths", placeholder: "db/migrations/**\ninfra/terraform/**\n.github/workflows/**", children: draft ? listToLines(draft.protectedPaths) : "" })
-              ] }),
-              /* @__PURE__ */ jsxs17("div", { class: "field", children: [
-                /* @__PURE__ */ jsx17("label", { children: "Required environment variables" }),
-                /* @__PURE__ */ jsx17("textarea", { class: "in", name: "requiredEnvVarNames", rows: 2, "aria-label": "Required environment variable names", placeholder: "DATABASE_URL\nPAYMENTS_WEBHOOK_SECRET", children: draft ? listToLines(draft.environment.requiredEnvVarNames) : "" }),
-                /* @__PURE__ */ jsx17("span", { class: "help", children: "Names only \u2014 STMA never stores a value." })
-              ] }),
-              /* @__PURE__ */ jsxs17("div", { class: "field", children: [
-                /* @__PURE__ */ jsx17("label", { children: "Needs a person before changing" }),
-                /* @__PURE__ */ jsx17("textarea", { class: "in", name: "requireApprovalFor", rows: 2, placeholder: "migration\ncontract", children: draft ? listToLines(draft.autonomy.requireApprovalFor) : "" }),
-                /* @__PURE__ */ jsxs17("span", { class: "help", children: [
-                  "One claim type per line \u2014 ",
-                  /* @__PURE__ */ jsx17("code", { children: "path" }),
-                  ", ",
-                  /* @__PURE__ */ jsx17("code", { children: "component" }),
-                  ",",
-                  " ",
-                  /* @__PURE__ */ jsx17("code", { children: "contract" }),
-                  ", ",
-                  /* @__PURE__ */ jsx17("code", { children: "migration" }),
-                  ", ",
-                  /* @__PURE__ */ jsx17("code", { children: "config" }),
-                  ". A run that declares this ground is told to get a human to agree first. It warns; it does not lock."
-                ] })
-              ] }),
-              /* @__PURE__ */ jsxs17("div", { class: "field", children: [
-                /* @__PURE__ */ jsx17("label", { children: "Change budget" }),
-                /* @__PURE__ */ jsxs17("div", { class: "row", children: [
-                  /* @__PURE__ */ jsx17(
-                    "input",
-                    {
-                      class: "in",
-                      type: "number",
-                      min: "0",
-                      name: "maxScopeItems",
-                      style: "width:120px",
-                      placeholder: "scope",
-                      value: draft?.changeBudget.maxScopeItems || ""
-                    }
-                  ),
-                  /* @__PURE__ */ jsx17(
-                    "input",
-                    {
-                      class: "in",
-                      type: "number",
-                      min: "0",
-                      name: "maxPaths",
-                      style: "width:120px",
-                      placeholder: "paths",
-                      value: draft?.changeBudget.maxPaths || ""
-                    }
-                  )
-                ] }),
-                /* @__PURE__ */ jsx17("span", { class: "help", children: "Total claims and path claims one run may declare. Blank means no budget. A reviewer reads a small change and skims a big one, so this is the cheapest quality control there is." })
-              ] }),
-              /* @__PURE__ */ jsxs17("div", { class: "field", children: [
-                /* @__PURE__ */ jsx17("label", { children: "Expected runtimes" }),
-                /* @__PURE__ */ jsx17("textarea", { class: "in", name: "runtimes", rows: 2, "aria-label": "Expected runtimes", placeholder: "node=22.14.0\npython=3.12.4", children: draft ? runtimesToLines(draft.environment.runtimes) : "" }),
-                /* @__PURE__ */ jsxs17("span", { class: "help", children: [
-                  "One ",
-                  /* @__PURE__ */ jsx17("code", { children: "name=version" }),
-                  " per line. Preflight calls a mismatch critical."
-                ] })
-              ] }),
-              /* @__PURE__ */ jsxs17("div", { class: "dialog-actions", children: [
-                /* @__PURE__ */ jsx17("button", { class: "btn", type: "button", "data-close-dialog": "t", children: "Cancel" }),
-                /* @__PURE__ */ jsx17("button", { class: "btn btn-primary", type: "submit", children: "Publish" })
-              ] })
-            ] })
-          ] }) : null,
           isOwner ? /* @__PURE__ */ jsxs17("dialog", { id: "record-baseline", class: "formdlg wide", children: [
             /* @__PURE__ */ jsx17("h3", { children: "Record an environment baseline" }),
             /* @__PURE__ */ jsx17("p", { class: "dlgsub", children: "Promote a machine that already works. Preflight compares every other machine against it and tells the agent, before it starts, what is different." }),
@@ -17552,15 +17786,827 @@ notificationsRoutes.post("/app/notifications/webhook", async (c) => {
   return back4(`ok=${encodeURIComponent("Personal webhook saved.")}`);
 });
 
-// src/routes/sessions.tsx
-import { and as and27, count as count12, desc as desc21, eq as eq35, ilike as ilike2, inArray as inArray13, or as or7, sql as sql18 } from "drizzle-orm";
+// src/routes/policyEditor.tsx
+import { and as and27, desc as desc21, eq as eq35, inArray as inArray13 } from "drizzle-orm";
 import { Hono as Hono16 } from "hono";
 import { Fragment as Fragment16, jsx as jsx19, jsxs as jsxs19 } from "hono/jsx/jsx-runtime";
-var sessionsRoutes = new Hono16();
+var policyEditorRoutes = new Hono16();
+var PROJECT_LIMIT3 = 50;
+function servedText(doc, team, version) {
+  const out = [];
+  out.push(`Team rules for ${team}${version ? ` (v${version}, pending)` : ""}`);
+  for (const line of doc.guidance) out.push(`- ${line}`);
+  if (doc.permissions.deny.length > 0) out.push(`Denied: ${doc.permissions.deny.join(" \xB7 ")}`);
+  if (doc.permissions.requireApproval.length > 0) {
+    out.push(`Requires approval: ${doc.permissions.requireApproval.join(" \xB7 ")}`);
+  }
+  if (doc.requiredChecks.length > 0) out.push(`Checks: ${doc.requiredChecks.join(" \xB7 ")}`);
+  if (doc.protectedPaths.length > 0) out.push(`Protected: ${doc.protectedPaths.join(" \xB7 ")}`);
+  if (doc.environment.requiredEnvVarNames.length > 0) {
+    out.push(`Required env: ${doc.environment.requiredEnvVarNames.join(", ")}`);
+  }
+  const runtimes = Object.entries(doc.environment.runtimes);
+  if (runtimes.length > 0) {
+    out.push(`Runtimes: ${runtimes.map(([n, v]) => v ? `${n} ${v}` : n).join(", ")}`);
+  }
+  if (doc.autonomy.requireApprovalFor.length > 0) {
+    out.push(`A person must approve: ${doc.autonomy.requireApprovalFor.join(" \xB7 ")}`);
+  }
+  const budget = [];
+  if (doc.changeBudget.maxScopeItems > 0) budget.push(`${doc.changeBudget.maxScopeItems} claims`);
+  if (doc.changeBudget.maxPaths > 0) budget.push(`${doc.changeBudget.maxPaths} paths`);
+  if (budget.length > 0) out.push(`Budget: ${budget.join(", ")}`);
+  if (out.length === 1) out.push("- (nothing published yet)");
+  return out.join("\n");
+}
+policyEditorRoutes.get("/app/teams/:slug/policy", async (c) => {
+  const user = c.get("user");
+  if (!user) return loginRedirect(c);
+  const db = c.get("db");
+  const found = await teamForUser(db, user.id, c.req.param("slug"));
+  if (!found) return c.notFound();
+  const { team, role } = found;
+  if (!planLimits(team.plan, c.get("env").hosted).governance) return c.notFound();
+  if (role !== "owner") {
+    return c.html(
+      /* @__PURE__ */ jsx19(AppLayout, { user, active: "governance", title: "Policy", children: /* @__PURE__ */ jsxs19("div", { class: "card card-pad joincard", children: [
+        /* @__PURE__ */ jsx19("span", { class: "tile tile-44 tile-gray", children: "\xB7" }),
+        /* @__PURE__ */ jsx19("h2", { class: "title m0", children: "Owners publish policy" }),
+        /* @__PURE__ */ jsx19("p", { class: "m0 sub", children: "You can read every rule in force on the governance page \u2014 publishing a new version is an owner action, because it changes what every agent on the team is told." }),
+        /* @__PURE__ */ jsx19("a", { class: "btn", href: `/app/teams/${team.slug}/governance`, style: "align-self:flex-start", children: "Back to governance" })
+      ] }) }),
+      403
+    );
+  }
+  const projectQuery = (c.req.query("project") ?? "").trim();
+  const scopeProject = projectQuery ? await projectForTeam(db, team.id, projectQuery) : void 0;
+  const teamProjects = await db.select({ name: projects.name }).from(projects).where(eq35(projects.teamId, team.id)).orderBy(projects.name).limit(PROJECT_LIMIT3);
+  const scopeKey = scopeProject ? `project:${scopeProject.id}` : "team";
+  const bundles = await db.select().from(policyBundles).where(and27(eq35(policyBundles.teamId, team.id), eq35(policyBundles.scopeKey, scopeKey))).orderBy(desc21(policyBundles.version)).limit(1);
+  const live = bundles[0];
+  const draft = live ? policyDocumentSchema.parse(live.document) : null;
+  const nextVersion = (live?.version ?? 0) + 1;
+  const served = await effectivePolicy(db, user.id, {
+    team: team.slug,
+    project: scopeProject?.name
+  });
+  const servedDoc = "error" in served ? null : served.document;
+  const liveRuns = await db.select({ n: agentRuns.id }).from(agentRuns).where(and27(eq35(agentRuns.teamId, team.id), inArray13(agentRuns.status, ["active", "waiting", "blocked"])));
+  const error = c.req.query("error");
+  const scopeLabel = scopeProject ? `project: ${scopeProject.name}` : "team-wide";
+  return c.html(
+    /* @__PURE__ */ jsxs19(
+      AppLayout,
+      {
+        user,
+        active: "governance",
+        title: `Edit policy \u2014 ${team.name}`,
+        head: /* @__PURE__ */ jsx19(
+          PageHead,
+          {
+            crumb: `/ ${team.slug} / governance / policy`,
+            title: `Edit policy \u2014 ${scopeLabel}`,
+            sub: "A document, not a dialog: write on the left, read what every agent will receive on the right.",
+            actions: /* @__PURE__ */ jsxs19(Fragment16, { children: [
+              /* @__PURE__ */ jsx19("a", { class: "btn btn-sm", href: `/app/teams/${team.slug}/governance`, children: "Discard" }),
+              /* @__PURE__ */ jsxs19("button", { class: "btn btn-sm btn-primary", type: "submit", form: "policy-form", children: [
+                "Publish v",
+                nextVersion
+              ] })
+            ] })
+          }
+        ),
+        keys: [{ k: "Esc", label: "back to governance" }],
+        keysNote: "publishing writes a new version \u2014 the old one is archived, never deleted",
+        children: [
+          error ? /* @__PURE__ */ jsx19("div", { class: "banner banner-error", children: error }) : null,
+          /* @__PURE__ */ jsxs19("div", { class: "edgrid", children: [
+            /* @__PURE__ */ jsxs19(
+              "form",
+              {
+                id: "policy-form",
+                class: "card card-pad",
+                method: "post",
+                action: `/app/teams/${team.slug}/policy`,
+                style: "display:flex;flex-direction:column;gap:14px",
+                children: [
+                  /* @__PURE__ */ jsxs19("div", { class: "field", children: [
+                    /* @__PURE__ */ jsx19("label", { for: "pf-scope", children: "Scope" }),
+                    /* @__PURE__ */ jsxs19("select", { class: "in", id: "pf-scope", name: "scope", children: [
+                      /* @__PURE__ */ jsx19("option", { value: "team", selected: !scopeProject, children: "Team-wide \u2014 applies to every run" }),
+                      teamProjects.map((p) => /* @__PURE__ */ jsxs19("option", { value: p.name, selected: p.name === scopeProject?.name, children: [
+                        "Project: ",
+                        p.name,
+                        " \u2014 merged on top of team policy"
+                      ] }))
+                    ] }),
+                    /* @__PURE__ */ jsx19("span", { class: "help", children: "Project policy adds to team policy; it never replaces it. Switching scope here changes what you are editing \u2014 reopen the page to load that scope's document." })
+                  ] }),
+                  /* @__PURE__ */ jsxs19("div", { class: "field", children: [
+                    /* @__PURE__ */ jsx19("label", { for: "pf-guidance", children: "Guidance" }),
+                    /* @__PURE__ */ jsx19(
+                      "textarea",
+                      {
+                        class: "in",
+                        id: "pf-guidance",
+                        name: "guidance",
+                        rows: 3,
+                        placeholder: "Keep migrations backwards compatible.\nNever touch another agent's branch \u2014 open a debug session instead.",
+                        children: draft ? listToLines(draft.guidance) : ""
+                      }
+                    ),
+                    /* @__PURE__ */ jsx19("span", { class: "help", children: "Plain sentences the agent reads before it plans." })
+                  ] }),
+                  /* @__PURE__ */ jsxs19("div", { class: "field", children: [
+                    /* @__PURE__ */ jsx19("label", { for: "pf-deny", children: "Denied" }),
+                    /* @__PURE__ */ jsx19(
+                      "textarea",
+                      {
+                        class: "in",
+                        id: "pf-deny",
+                        name: "deny",
+                        rows: 3,
+                        placeholder: "read secret values\npush to main",
+                        children: draft ? listToLines(draft.permissions.deny) : ""
+                      }
+                    )
+                  ] }),
+                  /* @__PURE__ */ jsxs19("div", { class: "field", children: [
+                    /* @__PURE__ */ jsx19("label", { for: "pf-approval", children: "Requires approval" }),
+                    /* @__PURE__ */ jsx19(
+                      "textarea",
+                      {
+                        class: "in",
+                        id: "pf-approval",
+                        name: "requireApproval",
+                        rows: 2,
+                        placeholder: "production changes\nschema migrations",
+                        children: draft ? listToLines(draft.permissions.requireApproval) : ""
+                      }
+                    ),
+                    /* @__PURE__ */ jsx19("span", { class: "help", children: "The agent must ask its human before doing these." })
+                  ] }),
+                  /* @__PURE__ */ jsxs19("div", { class: "field", children: [
+                    /* @__PURE__ */ jsx19("label", { for: "pf-checks", children: "Required checks" }),
+                    /* @__PURE__ */ jsx19(
+                      "textarea",
+                      {
+                        class: "in",
+                        id: "pf-checks",
+                        name: "requiredChecks",
+                        rows: 2,
+                        placeholder: "npm test\nnpm run typecheck",
+                        children: draft ? listToLines(draft.requiredChecks) : ""
+                      }
+                    )
+                  ] }),
+                  /* @__PURE__ */ jsxs19("div", { class: "field", children: [
+                    /* @__PURE__ */ jsx19("label", { for: "pf-paths", children: "Protected paths" }),
+                    /* @__PURE__ */ jsx19(
+                      "textarea",
+                      {
+                        class: "in",
+                        id: "pf-paths",
+                        name: "protectedPaths",
+                        rows: 2,
+                        placeholder: "db/migrations/**\n.github/workflows/**",
+                        children: draft ? listToLines(draft.protectedPaths) : ""
+                      }
+                    )
+                  ] }),
+                  /* @__PURE__ */ jsxs19("div", { class: "field", children: [
+                    /* @__PURE__ */ jsx19("label", { for: "pf-env", children: "Required environment variables" }),
+                    /* @__PURE__ */ jsx19(
+                      "textarea",
+                      {
+                        class: "in",
+                        id: "pf-env",
+                        name: "requiredEnvVarNames",
+                        rows: 2,
+                        placeholder: "DATABASE_URL\nPAYMENTS_WEBHOOK_SECRET",
+                        children: draft ? listToLines(draft.environment.requiredEnvVarNames) : ""
+                      }
+                    ),
+                    /* @__PURE__ */ jsx19("span", { class: "help", children: "Names only \u2014 STMA never carries a value." })
+                  ] }),
+                  /* @__PURE__ */ jsxs19("div", { class: "field", children: [
+                    /* @__PURE__ */ jsx19("label", { for: "pf-runtimes", children: "Expected runtimes" }),
+                    /* @__PURE__ */ jsx19(
+                      "textarea",
+                      {
+                        class: "in",
+                        id: "pf-runtimes",
+                        name: "runtimes",
+                        rows: 2,
+                        placeholder: "node=22.14.0\npython=3.12.4",
+                        children: draft ? runtimesToLines(draft.environment.runtimes) : ""
+                      }
+                    ),
+                    /* @__PURE__ */ jsxs19("span", { class: "help", children: [
+                      "One ",
+                      /* @__PURE__ */ jsx19("code", { children: "name=version" }),
+                      " per line. Preflight calls a mismatch critical."
+                    ] })
+                  ] }),
+                  /* @__PURE__ */ jsxs19("div", { class: "field", children: [
+                    /* @__PURE__ */ jsx19("label", { for: "pf-autonomy", children: "A person must approve" }),
+                    /* @__PURE__ */ jsx19(
+                      "textarea",
+                      {
+                        class: "in",
+                        id: "pf-autonomy",
+                        name: "requireApprovalFor",
+                        rows: 2,
+                        placeholder: "migration\ncontract",
+                        children: draft ? listToLines(draft.autonomy.requireApprovalFor) : ""
+                      }
+                    ),
+                    /* @__PURE__ */ jsx19("span", { class: "help", children: "Claim types that need a human before a run takes write access to them." })
+                  ] }),
+                  /* @__PURE__ */ jsxs19("div", { class: "row", style: "gap:12px;flex-wrap:wrap", children: [
+                    /* @__PURE__ */ jsxs19("div", { class: "field", style: "flex:1;min-width:150px", children: [
+                      /* @__PURE__ */ jsx19("label", { for: "pf-claims", children: "Max claims per run" }),
+                      /* @__PURE__ */ jsx19(
+                        "input",
+                        {
+                          class: "in",
+                          id: "pf-claims",
+                          type: "number",
+                          name: "maxScopeItems",
+                          min: 0,
+                          value: draft?.changeBudget.maxScopeItems || "",
+                          placeholder: "0 = unset"
+                        }
+                      )
+                    ] }),
+                    /* @__PURE__ */ jsxs19("div", { class: "field", style: "flex:1;min-width:150px", children: [
+                      /* @__PURE__ */ jsx19("label", { for: "pf-paths-budget", children: "Max paths per run" }),
+                      /* @__PURE__ */ jsx19(
+                        "input",
+                        {
+                          class: "in",
+                          id: "pf-paths-budget",
+                          type: "number",
+                          name: "maxPaths",
+                          min: 0,
+                          value: draft?.changeBudget.maxPaths || "",
+                          placeholder: "0 = unset"
+                        }
+                      )
+                    ] })
+                  ] })
+                ]
+              }
+            ),
+            /* @__PURE__ */ jsxs19("div", { class: "col", children: [
+              /* @__PURE__ */ jsxs19("div", { class: "darkcard", children: [
+                /* @__PURE__ */ jsx19("span", { class: "overline", children: "What get_policy will serve" }),
+                /* @__PURE__ */ jsx19("div", { class: "cmd inner", children: /* @__PURE__ */ jsx19("code", { style: "white-space:pre-wrap", children: servedDoc ? servedText(servedDoc, team.slug, null) : "(nothing published yet)" }) }),
+                /* @__PURE__ */ jsx19("p", { class: "m0 small", style: "color:var(--dark-mut)", children: "The merged document, exactly as an agent receives it \u2014 team rules with this scope's additions on top. It updates when you publish, not while you type." })
+              ] }),
+              /* @__PURE__ */ jsxs19("div", { class: "card card-pad", style: "display:flex;flex-direction:column;gap:12px", children: [
+                /* @__PURE__ */ jsx19("span", { class: "card-title", children: "On publish" }),
+                /* @__PURE__ */ jsxs19("div", { class: "factrow", children: [
+                  /* @__PURE__ */ jsx19("span", { class: "y", children: "\u2713" }),
+                  /* @__PURE__ */ jsxs19("span", { children: [
+                    "v",
+                    live?.version ?? 0,
+                    " is archived, not deleted \u2014 the record of what was in force stays."
+                  ] })
+                ] }),
+                /* @__PURE__ */ jsxs19("div", { class: "factrow", children: [
+                  /* @__PURE__ */ jsx19("span", { class: "y", children: "\u2713" }),
+                  /* @__PURE__ */ jsxs19("span", { children: [
+                    "The new hash reaches every agent on its next ",
+                    /* @__PURE__ */ jsx19("code", { children: "get_policy" }),
+                    "."
+                  ] })
+                ] }),
+                /* @__PURE__ */ jsxs19("div", { class: "factrow", children: [
+                  /* @__PURE__ */ jsx19("span", { class: liveRuns.length > 0 ? "n" : "y", children: liveRuns.length > 0 ? "!" : "\u2713" }),
+                  /* @__PURE__ */ jsx19("span", { children: liveRuns.length > 0 ? `${liveRuns.length} live ${liveRuns.length === 1 ? "run is" : "runs are"} on the old version \u2014 they read as unconfirmed until they answer with the new hash.` : "No run is in flight, so nothing is holding the old version." })
+                ] })
+              ] })
+            ] })
+          ] })
+        ]
+      }
+    )
+  );
+});
+
+// src/routes/projects.tsx
+import { and as and28, count as count12, countDistinct as countDistinct5, desc as desc22, eq as eq36, gt as gt13, inArray as inArray14, max as max7 } from "drizzle-orm";
+import { Hono as Hono17 } from "hono";
+import { Fragment as Fragment17, jsx as jsx20, jsxs as jsxs20 } from "hono/jsx/jsx-runtime";
+var projectsRoutes = new Hono17();
+var RUNS_SHOWN = 6;
+var SESSIONS_SHOWN = 5;
+var TRAIL_SHOWN = 8;
+var WEEK = 7 * 24 * 60 * 60 * 1e3;
+var rank2 = { critical: 0, high: 1, medium: 2, low: 3 };
+var attemptId2 = (row) => ({
+  ownerId: row.owner.id,
+  attemptGroup: row.run.attemptGroup,
+  taskKey: row.run.taskKey,
+  worktree: row.run.worktree ?? null
+});
+async function severityByRun(db, rows) {
+  const out = /* @__PURE__ */ new Map();
+  if (rows.length === 0) return out;
+  const claims = await claimsForRuns(
+    db,
+    rows.map((row) => row.run.id)
+  );
+  const byRun = new Map(rows.map((row) => [row.run.id, row]));
+  const asConflictClaims = claims.map((claim) => {
+    const row = byRun.get(claim.runId);
+    return {
+      runId: claim.runId,
+      owner: row.owner.username,
+      agentName: row.installation.name,
+      taskKey: row.run.taskKey,
+      resourceType: claim.resourceType,
+      resourceKey: claim.resourceKey,
+      access: claim.access
+    };
+  });
+  for (const row of rows) {
+    const mine = asConflictClaims.filter((claim) => claim.runId === row.run.id);
+    const others = asConflictClaims.filter((claim) => {
+      if (claim.runId === row.run.id) return false;
+      const other = byRun.get(claim.runId);
+      if (!other) return false;
+      if (other.run.projectId !== row.run.projectId) return false;
+      return !areAttemptSiblings(attemptId2(row), attemptId2(other));
+    });
+    for (const conflict of detectClaimConflicts(mine, others)) {
+      const seen = out.get(row.run.id);
+      if (!seen || rank2[conflict.severity] < rank2[seen]) out.set(row.run.id, conflict.severity);
+    }
+  }
+  return out;
+}
+var claimLabel = (type, key, access) => `${access === "write" ? "w" : "r"}:${type}:${key}`;
+projectsRoutes.get("/app/teams/:slug/projects", async (c) => {
+  const user = c.get("user");
+  if (!user) return loginRedirect(c);
+  const db = c.get("db");
+  const access = await teamForUser(db, user.id, c.req.param("slug"));
+  if (!access) return c.notFound();
+  const team = access.team;
+  const rows = await db.select().from(projects).where(eq36(projects.teamId, team.id)).orderBy(projects.name);
+  const ids = rows.map((p) => p.id);
+  const openSessions = /* @__PURE__ */ new Map();
+  const lastSnapshot = /* @__PURE__ */ new Map();
+  const baseline = /* @__PURE__ */ new Set();
+  const policyVersion = /* @__PURE__ */ new Map();
+  const flowName = /* @__PURE__ */ new Map();
+  if (ids.length > 0) {
+    for (const r of await db.select({ pid: debugSessions.projectId, n: count12() }).from(debugSessions).where(and28(inArray14(debugSessions.projectId, ids), eq36(debugSessions.status, "open"))).groupBy(debugSessions.projectId)) {
+      if (r.pid) openSessions.set(r.pid, r.n);
+    }
+    for (const r of await db.select({ pid: snapshots.projectId, last: max7(snapshots.createdAt) }).from(snapshots).where(inArray14(snapshots.projectId, ids)).groupBy(snapshots.projectId)) {
+      if (r.pid) lastSnapshot.set(r.pid, r.last);
+    }
+    for (const r of await db.select({ pid: environmentBaselines.projectId }).from(environmentBaselines).where(
+      and28(
+        inArray14(environmentBaselines.projectId, ids),
+        eq36(environmentBaselines.active, true)
+      )
+    )) {
+      if (r.pid) baseline.add(r.pid);
+    }
+    for (const r of await db.select({ scope: policyBundles.scopeKey, version: max7(policyBundles.version) }).from(policyBundles).where(eq36(policyBundles.teamId, team.id)).groupBy(policyBundles.scopeKey)) {
+      const id = r.scope.startsWith("project:") ? r.scope.slice("project:".length) : null;
+      if (id && r.version) policyVersion.set(id, r.version);
+    }
+    for (const r of await db.select({ pid: deliveryFlows.projectId, name: deliveryFlows.name }).from(deliveryFlows).where(and28(eq36(deliveryFlows.teamId, team.id), eq36(deliveryFlows.status, "active")))) {
+      if (r.pid) flowName.set(r.pid, r.name);
+    }
+  }
+  const teamFlow = (await db.select({ name: deliveryFlows.name }).from(deliveryFlows).where(and28(eq36(deliveryFlows.teamId, team.id), eq36(deliveryFlows.status, "active"))).limit(5)).length;
+  const live = (await activeRunsForMember(db, user.id, team.slug)).filter((r) => r.run.projectId);
+  const severity = await severityByRun(db, live);
+  const runsByProject = /* @__PURE__ */ new Map();
+  for (const row of live) {
+    const key = row.run.projectId;
+    runsByProject.set(key, [...runsByProject.get(key) ?? [], row]);
+  }
+  const totalOpen = [...openSessions.values()].reduce((a, b) => a + b, 0);
+  return c.html(
+    /* @__PURE__ */ jsx20(
+      AppLayout,
+      {
+        user,
+        active: "projects",
+        title: `Projects \u2014 ${team.name}`,
+        strip: /* @__PURE__ */ jsxs20(Fragment17, { children: [
+          /* @__PURE__ */ jsx20(Lead, { text: `${rows.length} ${rows.length === 1 ? "project" : "projects"}`, live: rows.length > 0 }),
+          /* @__PURE__ */ jsx20(Vr, {}),
+          /* @__PURE__ */ jsxs20("span", { children: [
+            live.length,
+            " running now"
+          ] }),
+          /* @__PURE__ */ jsx20(Vr, {}),
+          /* @__PURE__ */ jsxs20("span", { children: [
+            totalOpen,
+            " open sessions"
+          ] })
+        ] }),
+        scope: /* @__PURE__ */ jsxs20("span", { class: "mono muted", children: [
+          "team ",
+          team.slug
+        ] }),
+        head: /* @__PURE__ */ jsx20(
+          PageHead,
+          {
+            crumb: `/ ${team.slug} / projects`,
+            title: "Projects",
+            sub: "Born automatically from the repo identifier agents send. Each one owns its policy, baseline, flow and sessions."
+          }
+        ),
+        keys: [{ k: "G", label: "agent map" }],
+        keysNote: "a project appears the first time an agent names its repo \u2014 there is nothing to create",
+        children: rows.length === 0 ? /* @__PURE__ */ jsxs20("div", { class: "card card-pad muted small", children: [
+          "No projects yet. One appears the first time an agent names its repository \u2014 through",
+          " ",
+          /* @__PURE__ */ jsx20("code", { children: "start_run" }),
+          ", a snapshot, or a session opened with a repo name. Nothing to create here."
+        ] }) : /* @__PURE__ */ jsx20("div", { class: "card scroll-x", children: /* @__PURE__ */ jsxs20("table", { class: "tbl", children: [
+          /* @__PURE__ */ jsxs20("tr", { children: [
+            /* @__PURE__ */ jsx20("th", { children: "Project" }),
+            /* @__PURE__ */ jsx20("th", { children: "Runs now" }),
+            /* @__PURE__ */ jsx20("th", { children: "Open sessions" }),
+            /* @__PURE__ */ jsx20("th", { children: "Baseline" }),
+            /* @__PURE__ */ jsx20("th", { children: "Policy" }),
+            /* @__PURE__ */ jsx20("th", { children: "Flow" }),
+            /* @__PURE__ */ jsx20("th", { children: "Last snapshot" }),
+            /* @__PURE__ */ jsx20("th", {})
+          ] }),
+          rows.map((p) => {
+            const mine = runsByProject.get(p.id) ?? [];
+            const worst = mine.map((r) => severity.get(r.run.id)).filter(Boolean).sort((a, b) => rank2[a] - rank2[b])[0];
+            return /* @__PURE__ */ jsxs20("tr", { children: [
+              /* @__PURE__ */ jsx20("td", { class: "name", children: /* @__PURE__ */ jsx20("a", { href: `/app/teams/${team.slug}/projects/${encodeURIComponent(p.name)}`, children: p.name }) }),
+              /* @__PURE__ */ jsxs20("td", { children: [
+                mine.length,
+                worst ? /* @__PURE__ */ jsxs20(Fragment17, { children: [
+                  " ",
+                  /* @__PURE__ */ jsx20("span", { class: `pill ${worst === "critical" ? "pill-danger" : "pill-warn"}`, children: "overlap" })
+                ] }) : null
+              ] }),
+              /* @__PURE__ */ jsx20("td", { children: openSessions.get(p.id) ?? 0 }),
+              /* @__PURE__ */ jsx20("td", { children: baseline.has(p.id) ? /* @__PURE__ */ jsxs20("span", { class: "mono", children: [
+                /* @__PURE__ */ jsx20("span", { class: "dot" }),
+                " set"
+              ] }) : /* @__PURE__ */ jsx20("span", { class: "muted", children: "none" }) }),
+              /* @__PURE__ */ jsx20("td", { class: "mono", children: policyVersion.has(p.id) ? `v${policyVersion.get(p.id)}` : /* @__PURE__ */ jsx20("span", { class: "muted", children: "team only" }) }),
+              /* @__PURE__ */ jsx20("td", { class: "mono", children: flowName.get(p.id) ?? (teamFlow > 0 ? /* @__PURE__ */ jsx20("span", { class: "muted", children: "team-wide" }) : /* @__PURE__ */ jsx20("span", { class: "muted", children: "\u2014" })) }),
+              /* @__PURE__ */ jsx20("td", { class: "muted", children: timeAgo(lastSnapshot.get(p.id) ?? null) ?? "\u2014" }),
+              /* @__PURE__ */ jsx20("td", { class: "chev", children: "\u203A" })
+            ] });
+          })
+        ] }) })
+      }
+    )
+  );
+});
+projectsRoutes.get("/app/teams/:slug/projects/:project", async (c) => {
+  const user = c.get("user");
+  if (!user) return loginRedirect(c);
+  const db = c.get("db");
+  const access = await teamForUser(db, user.id, c.req.param("slug"));
+  if (!access) return c.notFound();
+  const team = access.team;
+  const name = c.req.param("project");
+  const found = await db.select().from(projects).where(and28(eq36(projects.teamId, team.id), eq36(projects.name, name))).limit(1);
+  const project = found[0];
+  if (!project) return c.notFound();
+  const live = (await activeRunsForMember(db, user.id, team.slug)).filter(
+    (r) => r.run.projectId === project.id
+  );
+  const severity = await severityByRun(db, live);
+  const worst = live.map((r) => severity.get(r.run.id)).filter(Boolean).sort((a, b) => rank2[a] - rank2[b])[0];
+  const claims = await claimsForRuns(
+    db,
+    live.map((r) => r.run.id)
+  );
+  const sessions = await db.select({ session: debugSessions }).from(debugSessions).where(and28(eq36(debugSessions.projectId, project.id), eq36(debugSessions.status, "open"))).orderBy(desc22(debugSessions.createdAt)).limit(SESSIONS_SHOWN);
+  const openCount = (await db.select({ n: count12() }).from(debugSessions).where(and28(eq36(debugSessions.projectId, project.id), eq36(debugSessions.status, "open"))))[0]?.n ?? 0;
+  const agents7d = (await db.select({ n: countDistinct5(activity.tokenId) }).from(activity).where(
+    and28(
+      eq36(activity.projectId, project.id),
+      gt13(activity.createdAt, new Date(Date.now() - WEEK))
+    )
+  ))[0]?.n ?? 0;
+  const snap = (await db.select({ last: max7(snapshots.createdAt) }).from(snapshots).where(eq36(snapshots.projectId, project.id)))[0]?.last;
+  const policy = await effectivePolicy(db, user.id, { team: team.slug, project: project.name });
+  const baselines = await activeBaselines(db, team.id, 1, project.id);
+  const checks = await recentEnvironmentChecks(db, team.id, 5, project.id);
+  const criticalChecks = checks.filter((row) => row.check.status === "critical").length;
+  const trail = await recentAgentEvents(db, team.id, TRAIL_SHOWN, project.id);
+  const receipts = await recentPolicyReceipts(db, team.id, 10, project.id);
+  const confirmed = receipts.length > 0 ? {
+    total: receipts.length,
+    answered: receipts.filter((row) => row.receipt.reportedHash && !row.receipt.drift).length
+  } : null;
+  const policyDoc = "error" in policy ? null : policy;
+  const rules = [];
+  const projectScope = policyDoc?.sources.find((source) => source.scope.startsWith("project:"));
+  if (policyDoc) {
+    const doc = policyDoc.document;
+    for (const rule of doc.autonomy?.requireApprovalFor ?? []) rules.push(`Needs a person: ${rule}`);
+    for (const rule of doc.permissions?.requireApproval ?? []) rules.push(`Requires approval: ${rule}`);
+    for (const key of doc.environment?.requiredEnvVarNames ?? []) rules.push(`Required env var: ${key}`);
+    for (const check2 of doc.requiredChecks ?? []) rules.push(`Check: ${check2}`);
+    for (const path2 of doc.protectedPaths ?? []) rules.push(`Protected: ${path2}`);
+    for (const line of doc.permissions?.deny ?? []) rules.push(`Denied: ${line}`);
+  }
+  return c.html(
+    /* @__PURE__ */ jsxs20(
+      AppLayout,
+      {
+        user,
+        active: "projects",
+        title: `${project.name} \u2014 ${team.name}`,
+        strip: /* @__PURE__ */ jsxs20(Fragment17, { children: [
+          /* @__PURE__ */ jsx20(
+            Lead,
+            {
+              text: `${live.length} ${live.length === 1 ? "run" : "runs"} on this project`,
+              live: live.length > 0
+            }
+          ),
+          worst ? /* @__PURE__ */ jsxs20(Fragment17, { children: [
+            /* @__PURE__ */ jsx20(Vr, {}),
+            /* @__PURE__ */ jsxs20("span", { style: "color:var(--red)", children: [
+              worst,
+              " overlap"
+            ] })
+          ] }) : null,
+          /* @__PURE__ */ jsx20(Vr, {}),
+          /* @__PURE__ */ jsxs20("span", { children: [
+            openCount,
+            " open sessions"
+          ] })
+        ] }),
+        scope: /* @__PURE__ */ jsxs20(Fragment17, { children: [
+          /* @__PURE__ */ jsx20("a", { class: "linklike", href: `/app/teams/${team.slug}/projects`, children: "\u2190 all projects" }),
+          /* @__PURE__ */ jsx20(Vr, {}),
+          /* @__PURE__ */ jsxs20("span", { class: "mono muted", children: [
+            "project ",
+            project.name
+          ] })
+        ] }),
+        head: /* @__PURE__ */ jsx20(
+          PageHead,
+          {
+            crumb: `/ ${team.slug} / projects / ${project.name}`,
+            title: project.name,
+            sub: "Everything about this project on one page: live runs, sessions, policy, environment and delivery \u2014 with the way to change each.",
+            actions: /* @__PURE__ */ jsxs20(Fragment17, { children: [
+              /* @__PURE__ */ jsx20(
+                "a",
+                {
+                  class: "btn btn-sm",
+                  href: `/app/teams/${team.slug}/compare?project=${encodeURIComponent(project.name)}`,
+                  children: "Compare machines"
+                }
+              ),
+              /* @__PURE__ */ jsx20("a", { class: "btn btn-sm", href: "/app/sessions", children: "Open a session" }),
+              /* @__PURE__ */ jsx20("a", { class: "btn btn-sm btn-primary", href: "/app/agents", children: "View on agent map" })
+            ] })
+          }
+        ),
+        band: worst === "critical" ? /* @__PURE__ */ jsx20(
+          Band,
+          {
+            kind: "danger",
+            tag: "critical",
+            actions: /* @__PURE__ */ jsx20("a", { class: "btn btn-sm", href: "/app/agents", children: "Open in inspector" }),
+            children: "Two live runs hold the same ground on this project. Claims are advisory \u2014 STMA warns the agents, it does not lock the file."
+          }
+        ) : void 0,
+        keys: [{ k: "G", label: "agent map" }],
+        keysNote: "every number here is read from the page that owns it \u2014 the links go there",
+        children: [
+          /* @__PURE__ */ jsxs20("div", { class: "stat3", children: [
+            /* @__PURE__ */ jsxs20("div", { children: [
+              /* @__PURE__ */ jsx20("span", { class: "overline", children: "Active runs" }),
+              /* @__PURE__ */ jsx20("span", { class: `n${worst === "critical" ? " bad" : ""}`, children: live.length })
+            ] }),
+            /* @__PURE__ */ jsxs20("div", { children: [
+              /* @__PURE__ */ jsx20("span", { class: "overline", children: "Open sessions" }),
+              /* @__PURE__ */ jsx20("span", { class: "n", children: openCount })
+            ] }),
+            /* @__PURE__ */ jsxs20("div", { children: [
+              /* @__PURE__ */ jsx20("span", { class: "overline", children: "Agents (7d)" }),
+              /* @__PURE__ */ jsx20("span", { class: "n", children: agents7d })
+            ] }),
+            /* @__PURE__ */ jsxs20("div", { children: [
+              /* @__PURE__ */ jsx20("span", { class: "overline", children: "Preflight" }),
+              /* @__PURE__ */ jsx20("span", { class: `n${criticalChecks > 0 ? " bad" : " ok"}`, children: criticalChecks > 0 ? `${criticalChecks} critical` : checks.length > 0 ? "ok" : "\u2014" })
+            ] }),
+            /* @__PURE__ */ jsxs20("div", { children: [
+              /* @__PURE__ */ jsx20("span", { class: "overline", children: "Last snapshot" }),
+              /* @__PURE__ */ jsx20("span", { class: "n", children: timeAgo(snap ?? null) ?? "\u2014" })
+            ] })
+          ] }),
+          /* @__PURE__ */ jsxs20("div", { class: "edgrid", style: "margin-top:16px", children: [
+            /* @__PURE__ */ jsxs20("div", { class: "col", children: [
+              /* @__PURE__ */ jsxs20("div", { class: "card", children: [
+                /* @__PURE__ */ jsxs20("div", { class: "card-head", children: [
+                  /* @__PURE__ */ jsxs20("div", { children: [
+                    /* @__PURE__ */ jsx20("div", { class: "card-title", children: "Active runs" }),
+                    /* @__PURE__ */ jsx20("div", { class: "card-note", children: "This project only \u2014 the same rows as the agent map." })
+                  ] }),
+                  /* @__PURE__ */ jsx20("a", { class: "btn btn-sm", href: "/app/agents", children: "Agent map" })
+                ] }),
+                live.length === 0 ? /* @__PURE__ */ jsx20("div", { class: "card-pad muted small", children: "Nothing running here right now. The map is presence, not history \u2014 what these runs did is on Activity and the governance timeline." }) : live.slice(0, RUNS_SHOWN).map((row) => {
+                  const held = claims.filter((claim) => claim.runId === row.run.id).map((claim) => claimLabel(claim.resourceType, claim.resourceKey, claim.access));
+                  const sev = severity.get(row.run.id);
+                  return /* @__PURE__ */ jsxs20("div", { class: "introw", children: [
+                    /* @__PURE__ */ jsx20("span", { class: `dot${sev === "critical" ? " red" : ""}` }),
+                    /* @__PURE__ */ jsxs20("div", { class: "who", children: [
+                      /* @__PURE__ */ jsx20("div", { class: "t", children: row.run.taskKey ?? "no task key" }),
+                      /* @__PURE__ */ jsxs20("div", { class: "s", children: [
+                        row.owner.username,
+                        " \xB7 ",
+                        row.installation.name,
+                        row.run.branch ? ` \xB7 ${row.run.branch}` : ""
+                      ] })
+                    ] }),
+                    /* @__PURE__ */ jsx20("span", { class: "mono small muted hide-sm", children: held.join(", ") || "no claims" }),
+                    sev ? /* @__PURE__ */ jsx20("span", { class: `pill ${sev === "critical" ? "pill-danger" : "pill-warn"}`, children: sev }) : null
+                  ] });
+                })
+              ] }),
+              /* @__PURE__ */ jsxs20("div", { class: "card", children: [
+                /* @__PURE__ */ jsxs20("div", { class: "card-head", children: [
+                  /* @__PURE__ */ jsxs20("div", { children: [
+                    /* @__PURE__ */ jsx20("div", { class: "card-title", children: "Open sessions" }),
+                    /* @__PURE__ */ jsxs20("div", { class: "card-note", children: [
+                      "Debug threads tagged ",
+                      project.name,
+                      "."
+                    ] })
+                  ] }),
+                  /* @__PURE__ */ jsx20("a", { class: "btn btn-sm", href: "/app/sessions", children: "All sessions" })
+                ] }),
+                sessions.length === 0 ? /* @__PURE__ */ jsxs20("div", { class: "card-pad muted small", children: [
+                  "No open thread on this project. Resolved ones stay searchable \u2014 agents read them through ",
+                  /* @__PURE__ */ jsx20("code", { children: "search_past_issues" }),
+                  "."
+                ] }) : sessions.map(({ session }) => /* @__PURE__ */ jsxs20("div", { class: "introw", children: [
+                  /* @__PURE__ */ jsxs20("div", { class: "who", children: [
+                    /* @__PURE__ */ jsx20("div", { class: "t", children: /* @__PURE__ */ jsx20("a", { href: `/app/sessions/${session.id}`, children: session.title }) }),
+                    /* @__PURE__ */ jsxs20("div", { class: "s", children: [
+                      "opened ",
+                      timeAgo(session.createdAt) ?? "just now"
+                    ] })
+                  ] }),
+                  /* @__PURE__ */ jsx20("span", { class: "pill pill-ok", children: "open" })
+                ] }))
+              ] }),
+              /* @__PURE__ */ jsxs20("div", { class: "card", children: [
+                /* @__PURE__ */ jsxs20("div", { class: "card-head", children: [
+                  /* @__PURE__ */ jsxs20("div", { children: [
+                    /* @__PURE__ */ jsx20("div", { class: "card-title", children: "Recent activity" }),
+                    /* @__PURE__ */ jsx20("div", { class: "card-note", children: "The run trail for this project, newest first." })
+                  ] }),
+                  /* @__PURE__ */ jsx20("a", { class: "btn btn-sm", href: `/app/teams/${team.slug}/activity?project=${encodeURIComponent(project.name)}`, children: "Activity" })
+                ] }),
+                trail.length === 0 ? /* @__PURE__ */ jsx20("div", { class: "card-pad muted small", children: "Nothing recorded for this project yet." }) : /* @__PURE__ */ jsxs20("table", { class: "tbl", children: [
+                  /* @__PURE__ */ jsxs20("tr", { children: [
+                    /* @__PURE__ */ jsx20("th", { children: "When" }),
+                    /* @__PURE__ */ jsx20("th", { children: "Event" }),
+                    /* @__PURE__ */ jsx20("th", { children: "Run" }),
+                    /* @__PURE__ */ jsx20("th", { children: "Owner" })
+                  ] }),
+                  trail.map((row) => /* @__PURE__ */ jsxs20("tr", { children: [
+                    /* @__PURE__ */ jsx20("td", { class: "muted", children: timeAgo(row.event.createdAt) ?? "just now" }),
+                    /* @__PURE__ */ jsx20("td", { class: "mono", children: row.event.type }),
+                    /* @__PURE__ */ jsx20("td", { class: "mono", children: row.run.taskKey ?? "\u2014" }),
+                    /* @__PURE__ */ jsx20("td", { children: row.owner })
+                  ] }))
+                ] })
+              ] })
+            ] }),
+            /* @__PURE__ */ jsxs20("div", { class: "col", children: [
+              /* @__PURE__ */ jsxs20("div", { class: "card card-pad", style: "display:flex;flex-direction:column;gap:12px", children: [
+                /* @__PURE__ */ jsxs20("div", { class: "row", style: "justify-content:space-between", children: [
+                  /* @__PURE__ */ jsxs20("div", { children: [
+                    /* @__PURE__ */ jsx20("div", { class: "card-title", children: "Policy" }),
+                    /* @__PURE__ */ jsx20("div", { class: "card-note", children: "This project's additions, merged onto team rules." })
+                  ] }),
+                  projectScope ? /* @__PURE__ */ jsxs20("span", { class: "pill pill-active", children: [
+                    "v",
+                    projectScope.version,
+                    confirmed !== null ? " \xB7 confirmed" : ""
+                  ] }) : /* @__PURE__ */ jsx20("span", { class: "pill", children: "team only" })
+                ] }),
+                rules.length === 0 ? /* @__PURE__ */ jsxs20("p", { class: "m0 small muted", children: [
+                  "No rules in force for ",
+                  project.name,
+                  " beyond the team's. A project policy adds to the team document; it never replaces it."
+                ] }) : rules.slice(0, 5).map((rule) => /* @__PURE__ */ jsxs20("div", { class: "factrow", children: [
+                  /* @__PURE__ */ jsx20("span", { class: "y", children: "\u2713" }),
+                  /* @__PURE__ */ jsx20("span", { children: rule })
+                ] })),
+                policyDoc ? /* @__PURE__ */ jsxs20("div", { class: "factrow", children: [
+                  /* @__PURE__ */ jsx20("span", { class: confirmed && confirmed.answered > 0 ? "y" : "n", children: confirmed && confirmed.answered > 0 ? "\u2713" : "!" }),
+                  /* @__PURE__ */ jsxs20("span", { children: [
+                    "Effective hash ",
+                    /* @__PURE__ */ jsx20("span", { class: "mono", children: policyDoc.hash.slice(0, 12) }),
+                    confirmed ? ` \u2014 ${confirmed.answered} of ${confirmed.total} recent runs confirmed it.` : " \u2014 no run has reported which rules it applied."
+                  ] })
+                ] }) : null,
+                /* @__PURE__ */ jsxs20("div", { class: "row", style: "gap:8px", children: [
+                  /* @__PURE__ */ jsx20(
+                    "a",
+                    {
+                      class: "btn btn-sm",
+                      href: `/app/teams/${team.slug}/governance?project=${encodeURIComponent(project.name)}`,
+                      children: "Edit policy"
+                    }
+                  ),
+                  /* @__PURE__ */ jsx20(
+                    "a",
+                    {
+                      class: "btn btn-sm",
+                      href: `/app/teams/${team.slug}/governance?project=${encodeURIComponent(project.name)}`,
+                      children: "Receipts"
+                    }
+                  )
+                ] })
+              ] }),
+              /* @__PURE__ */ jsxs20("div", { class: "card card-pad", style: "display:flex;flex-direction:column;gap:12px", children: [
+                /* @__PURE__ */ jsxs20("div", { class: "row", style: "justify-content:space-between", children: [
+                  /* @__PURE__ */ jsxs20("div", { children: [
+                    /* @__PURE__ */ jsx20("div", { class: "card-title", children: "Environment" }),
+                    /* @__PURE__ */ jsx20("div", { class: "card-note", children: "Baseline and what preflight told the machines." })
+                  ] }),
+                  criticalChecks > 0 ? /* @__PURE__ */ jsxs20("span", { class: "pill pill-danger", children: [
+                    criticalChecks,
+                    " critical"
+                  ] }) : null
+                ] }),
+                baselines[0] ? /* @__PURE__ */ jsxs20("div", { class: "factrow", children: [
+                  /* @__PURE__ */ jsx20("span", { class: "y", children: "\u2713" }),
+                  /* @__PURE__ */ jsxs20("span", { children: [
+                    "Baseline",
+                    " ",
+                    /* @__PURE__ */ jsx20("span", { class: "mono", children: baselines[0].baseline.fingerprint.slice(0, 12) }),
+                    " from",
+                    " ",
+                    /* @__PURE__ */ jsx20("b", { children: baselines[0].author ?? "unknown" }),
+                    ",",
+                    " ",
+                    timeAgo(baselines[0].baseline.createdAt) ?? "just now",
+                    "."
+                  ] })
+                ] }) : /* @__PURE__ */ jsxs20("div", { class: "factrow", children: [
+                  /* @__PURE__ */ jsx20("span", { class: "n", children: "!" }),
+                  /* @__PURE__ */ jsx20("span", { children: "No baseline recorded. Preflight can only report what a baseline claims, so without one an agent is told nothing about its machine." })
+                ] }),
+                checks.slice(0, 2).map((row) => /* @__PURE__ */ jsxs20("div", { class: "factrow", children: [
+                  /* @__PURE__ */ jsx20("span", { class: row.check.status === "ok" ? "y" : "n", children: row.check.status === "ok" ? "\u2713" : "!" }),
+                  /* @__PURE__ */ jsxs20("span", { children: [
+                    /* @__PURE__ */ jsx20("b", { children: row.username ?? "a machine" }),
+                    ": ",
+                    row.check.summary
+                  ] })
+                ] })),
+                /* @__PURE__ */ jsxs20("div", { class: "row", style: "gap:8px", children: [
+                  /* @__PURE__ */ jsx20(
+                    "a",
+                    {
+                      class: "btn btn-sm",
+                      href: `/app/teams/${team.slug}/compare?project=${encodeURIComponent(project.name)}`,
+                      children: "Compare machines"
+                    }
+                  ),
+                  /* @__PURE__ */ jsx20("a", { class: "btn btn-sm", href: `/app/teams/${team.slug}/governance`, children: "Update baseline" })
+                ] })
+              ] })
+            ] })
+          ] })
+        ]
+      }
+    )
+  );
+});
+
+// src/routes/sessions.tsx
+import { and as and29, count as count13, desc as desc23, eq as eq37, ilike as ilike2, inArray as inArray15, or as or7, sql as sql18 } from "drizzle-orm";
+import { Hono as Hono18 } from "hono";
+import { Fragment as Fragment18, jsx as jsx21, jsxs as jsxs21 } from "hono/jsx/jsx-runtime";
+var sessionsRoutes = new Hono18();
 var LIST_PAGE_SIZE = 25;
 var THREAD_PAGE_SIZE = 100;
 async function myTeams(db, userId) {
-  return db.select({ team: teams }).from(memberships).innerJoin(teams, eq35(memberships.teamId, teams.id)).where(eq35(memberships.userId, userId)).orderBy(teams.name);
+  return db.select({ team: teams }).from(memberships).innerJoin(teams, eq37(memberships.teamId, teams.id)).where(eq37(memberships.userId, userId)).orderBy(teams.name);
 }
 var isKind2 = (k) => typeof k === "string" && MESSAGE_KINDS.includes(k);
 sessionsRoutes.get("/app/sessions", async (c) => {
@@ -17580,23 +18626,23 @@ sessionsRoutes.get("/app/sessions", async (c) => {
   let openCount = 0;
   let resolvedCount = 0;
   if (teamIds.length > 0) {
-    const conds = [inArray13(debugSessions.teamId, teamIds), eq35(debugSessions.status, status)];
+    const conds = [inArray15(debugSessions.teamId, teamIds), eq37(debugSessions.status, status)];
     if (status === "resolved" && q) {
       const like2 = `%${q}%`;
       conds.push(
         or7(ilike2(debugSessions.title, like2), sql18`${debugSessions.resolution}::text ilike ${like2}`)
       );
     }
-    const fetched = await db.select({ s: debugSessions, projectName: projects.name }).from(debugSessions).leftJoin(projects, eq35(debugSessions.projectId, projects.id)).where(and27(...conds)).orderBy(desc21(debugSessions.createdAt)).limit(win.limit).offset(win.offset);
+    const fetched = await db.select({ s: debugSessions, projectName: projects.name }).from(debugSessions).leftJoin(projects, eq37(debugSessions.projectId, projects.id)).where(and29(...conds)).orderBy(desc23(debugSessions.createdAt)).limit(win.limit).offset(win.offset);
     paged = slicePage(fetched, win);
     sessions = paged.items;
-    const countRows = await db.select({ status: debugSessions.status, n: count12() }).from(debugSessions).where(inArray13(debugSessions.teamId, teamIds)).groupBy(debugSessions.status);
+    const countRows = await db.select({ status: debugSessions.status, n: count13() }).from(debugSessions).where(inArray15(debugSessions.teamId, teamIds)).groupBy(debugSessions.status);
     openCount = countRows.find((r) => r.status === "open")?.n ?? 0;
     resolvedCount = countRows.find((r) => r.status === "resolved")?.n ?? 0;
   }
   const ids = sessions.map((r) => r.s.id);
   const { stats, unread } = await sessionStats(db, { userId: user.id }, ids);
-  const participantRows = ids.length ? await db.selectDistinct({ sessionId: messages.sessionId, username: users.username }).from(messages).innerJoin(users, eq35(messages.authorId, users.id)).where(inArray13(messages.sessionId, ids)) : [];
+  const participantRows = ids.length ? await db.selectDistinct({ sessionId: messages.sessionId, username: users.username }).from(messages).innerJoin(users, eq37(messages.authorId, users.id)).where(inArray15(messages.sessionId, ids)) : [];
   const participants = /* @__PURE__ */ new Map();
   for (const p of participantRows) {
     const list = participants.get(p.sessionId) ?? [];
@@ -17604,35 +18650,35 @@ sessionsRoutes.get("/app/sessions", async (c) => {
     participants.set(p.sessionId, list);
   }
   return c.html(
-    /* @__PURE__ */ jsxs19(AppLayout, { user, active: "sessions", title: "Sessions", children: [
-      error ? /* @__PURE__ */ jsxs19("div", { class: "banner banner-error", children: [
-        /* @__PURE__ */ jsx19("span", { class: "ic", children: "!" }),
-        /* @__PURE__ */ jsx19("span", { children: error }),
-        /* @__PURE__ */ jsx19("button", { class: "x", type: "button", "data-dismiss": "t", children: "\xD7" })
+    /* @__PURE__ */ jsxs21(AppLayout, { user, active: "sessions", title: "Sessions", children: [
+      error ? /* @__PURE__ */ jsxs21("div", { class: "banner banner-error", children: [
+        /* @__PURE__ */ jsx21("span", { class: "ic", children: "!" }),
+        /* @__PURE__ */ jsx21("span", { children: error }),
+        /* @__PURE__ */ jsx21("button", { class: "x", type: "button", "data-dismiss": "t", children: "\xD7" })
       ] }) : null,
-      /* @__PURE__ */ jsxs19("div", { class: "page-head", children: [
-        /* @__PURE__ */ jsxs19("div", { children: [
-          /* @__PURE__ */ jsx19("h1", { class: "title", children: "Debug sessions" }),
-          /* @__PURE__ */ jsx19("p", { class: "sub", children: "Topic-based threads where agents (and humans) debug together, asynchronously." })
+      /* @__PURE__ */ jsxs21("div", { class: "page-head", children: [
+        /* @__PURE__ */ jsxs21("div", { children: [
+          /* @__PURE__ */ jsx21("h1", { class: "title", children: "Debug sessions" }),
+          /* @__PURE__ */ jsx21("p", { class: "sub", children: "Topic-based threads where agents (and humans) debug together, asynchronously." })
         ] }),
-        mine.length > 0 ? /* @__PURE__ */ jsx19("button", { class: "btn btn-primary", type: "button", "data-open-dialog": "#new-session", children: "New session" }) : null
+        mine.length > 0 ? /* @__PURE__ */ jsx21("button", { class: "btn btn-primary", type: "button", "data-open-dialog": "#new-session", children: "New session" }) : null
       ] }),
-      win.page === 1 ? /* @__PURE__ */ jsx19("div", { "data-autorefresh": "30", style: "display:none" }) : null,
-      mine.length === 0 ? /* @__PURE__ */ jsx19("div", { class: "card", children: /* @__PURE__ */ jsxs19("div", { class: "empty", children: [
-        /* @__PURE__ */ jsx19("h2", { children: "Join a team first" }),
-        /* @__PURE__ */ jsxs19("p", { children: [
+      win.page === 1 ? /* @__PURE__ */ jsx21("div", { "data-autorefresh": "30", style: "display:none" }) : null,
+      mine.length === 0 ? /* @__PURE__ */ jsx21("div", { class: "card", children: /* @__PURE__ */ jsxs21("div", { class: "empty", children: [
+        /* @__PURE__ */ jsx21("h2", { children: "Join a team first" }),
+        /* @__PURE__ */ jsxs21("p", { children: [
           "Debug sessions live inside a team. ",
-          /* @__PURE__ */ jsx19("a", { href: "/app", children: "Create or join a team" }),
+          /* @__PURE__ */ jsx21("a", { href: "/app", children: "Create or join a team" }),
           ", then come back here."
         ] })
-      ] }) }) : /* @__PURE__ */ jsxs19(Fragment16, { children: [
-        /* @__PURE__ */ jsxs19("div", { class: "tabs", children: [
-          /* @__PURE__ */ jsxs19("a", { class: `tab${status === "open" ? " active" : ""}`, href: "/app/sessions", children: [
+      ] }) }) : /* @__PURE__ */ jsxs21(Fragment18, { children: [
+        /* @__PURE__ */ jsxs21("div", { class: "tabs", children: [
+          /* @__PURE__ */ jsxs21("a", { class: `tab${status === "open" ? " active" : ""}`, href: "/app/sessions", children: [
             "Open (",
             openCount,
             ")"
           ] }),
-          /* @__PURE__ */ jsxs19(
+          /* @__PURE__ */ jsxs21(
             "a",
             {
               class: `tab${status === "resolved" ? " active" : ""}`,
@@ -17645,9 +18691,9 @@ sessionsRoutes.get("/app/sessions", async (c) => {
             }
           )
         ] }),
-        status === "resolved" ? /* @__PURE__ */ jsxs19("form", { class: "inline m0", method: "get", action: "/app/sessions", children: [
-          /* @__PURE__ */ jsx19("input", { type: "hidden", name: "status", value: "resolved" }),
-          /* @__PURE__ */ jsx19(
+        status === "resolved" ? /* @__PURE__ */ jsxs21("form", { class: "inline m0", method: "get", action: "/app/sessions", children: [
+          /* @__PURE__ */ jsx21("input", { type: "hidden", name: "status", value: "resolved" }),
+          /* @__PURE__ */ jsx21(
             "input",
             {
               class: "in",
@@ -17658,53 +18704,53 @@ sessionsRoutes.get("/app/sessions", async (c) => {
               value: q
             }
           ),
-          /* @__PURE__ */ jsx19("button", { class: "btn", type: "submit", children: "Search" })
+          /* @__PURE__ */ jsx21("button", { class: "btn", type: "submit", children: "Search" })
         ] }) : null,
-        sessions.length === 0 && win.page === 1 ? /* @__PURE__ */ jsx19("div", { class: "card", children: /* @__PURE__ */ jsxs19("div", { class: "empty", children: [
-          /* @__PURE__ */ jsx19("h2", { children: status === "open" ? "No open sessions" : q ? "No archived match" : "Nothing resolved yet" }),
-          /* @__PURE__ */ jsx19("p", { children: status === "open" ? 'When something "works on my machine", open a session here \u2014 or let your agent do it with the open_session tool.' : "Resolved sessions keep their root cause and fix, searchable for the next time." })
-        ] }) }) : /* @__PURE__ */ jsxs19("div", { class: "sesslist", children: [
+        sessions.length === 0 && win.page === 1 ? /* @__PURE__ */ jsx21("div", { class: "card", children: /* @__PURE__ */ jsxs21("div", { class: "empty", children: [
+          /* @__PURE__ */ jsx21("h2", { children: status === "open" ? "No open sessions" : q ? "No archived match" : "Nothing resolved yet" }),
+          /* @__PURE__ */ jsx21("p", { children: status === "open" ? 'When something "works on my machine", open a session here \u2014 or let your agent do it with the open_session tool.' : "Resolved sessions keep their root cause and fix, searchable for the next time." })
+        ] }) }) : /* @__PURE__ */ jsxs21("div", { class: "sesslist", children: [
           sessions.map(({ s, projectName }) => {
             const st = stats.get(s.id);
             const un = unread.get(s.id) ?? 0;
             const res = s.resolution ?? null;
             const names = participants.get(s.id) ?? [];
-            return /* @__PURE__ */ jsxs19(
+            return /* @__PURE__ */ jsxs21(
               "a",
               {
                 class: `sesscard${un > 0 ? " unread" : ""}${s.status === "resolved" ? " resolved" : ""}`,
                 href: `/app/sessions/${s.id}`,
                 children: [
-                  /* @__PURE__ */ jsxs19("div", { class: "sesscard-head", children: [
-                    /* @__PURE__ */ jsx19("span", { class: "sesscard-title", children: s.title }),
-                    s.status === "open" ? /* @__PURE__ */ jsxs19("span", { class: "pill pill-open", children: [
-                      /* @__PURE__ */ jsx19("span", { class: "dot" }),
+                  /* @__PURE__ */ jsxs21("div", { class: "sesscard-head", children: [
+                    /* @__PURE__ */ jsx21("span", { class: "sesscard-title", children: s.title }),
+                    s.status === "open" ? /* @__PURE__ */ jsxs21("span", { class: "pill pill-open", children: [
+                      /* @__PURE__ */ jsx21("span", { class: "dot" }),
                       "open"
-                    ] }) : /* @__PURE__ */ jsx19("span", { class: "pill pill-muted", children: "resolved" })
+                    ] }) : /* @__PURE__ */ jsx21("span", { class: "pill pill-muted", children: "resolved" })
                   ] }),
-                  s.status === "resolved" && res?.rootCause ? /* @__PURE__ */ jsxs19("p", { class: "sesscard-root", children: [
-                    /* @__PURE__ */ jsx19("b", { children: "Root cause:" }),
+                  s.status === "resolved" && res?.rootCause ? /* @__PURE__ */ jsxs21("p", { class: "sesscard-root", children: [
+                    /* @__PURE__ */ jsx21("b", { children: "Root cause:" }),
                     " ",
                     res.rootCause.slice(0, 180),
                     res.rootCause.length > 180 ? "\u2026" : ""
                   ] }) : null,
-                  /* @__PURE__ */ jsxs19("div", { class: "sesscard-meta", children: [
-                    /* @__PURE__ */ jsxs19("div", { class: "sesscard-info", children: [
-                      names.length > 0 ? /* @__PURE__ */ jsx19("span", { class: "avstack", children: names.map((n) => /* @__PURE__ */ jsx19("span", { class: "avatar light", children: initials(n) })) }) : null,
-                      /* @__PURE__ */ jsx19("span", { children: slugById.get(s.teamId) }),
-                      projectName ? /* @__PURE__ */ jsxs19("span", { children: [
+                  /* @__PURE__ */ jsxs21("div", { class: "sesscard-meta", children: [
+                    /* @__PURE__ */ jsxs21("div", { class: "sesscard-info", children: [
+                      names.length > 0 ? /* @__PURE__ */ jsx21("span", { class: "avstack", children: names.map((n) => /* @__PURE__ */ jsx21("span", { class: "avatar light", children: initials(n) })) }) : null,
+                      /* @__PURE__ */ jsx21("span", { children: slugById.get(s.teamId) }),
+                      projectName ? /* @__PURE__ */ jsxs21("span", { children: [
                         "\xB7 ",
                         projectName
                       ] }) : null,
-                      /* @__PURE__ */ jsxs19("span", { children: [
+                      /* @__PURE__ */ jsxs21("span", { children: [
                         st?.n ?? 0,
                         " ",
                         (st?.n ?? 0) === 1 ? "message" : "messages",
                         st?.last ? ` \xB7 ${timeAgo(st.last)}` : ""
                       ] })
                     ] }),
-                    un > 0 ? /* @__PURE__ */ jsxs19("span", { class: "unreadmark", children: [
-                      /* @__PURE__ */ jsx19("span", { class: "dot" }),
+                    un > 0 ? /* @__PURE__ */ jsxs21("span", { class: "unreadmark", children: [
+                      /* @__PURE__ */ jsx21("span", { class: "dot" }),
                       un,
                       " unread"
                     ] }) : null
@@ -17713,8 +18759,8 @@ sessionsRoutes.get("/app/sessions", async (c) => {
               }
             );
           }),
-          sessions.length === 0 ? /* @__PURE__ */ jsx19("div", { class: "card card-pad muted small", children: "Nothing this far back \u2014 the list ends before this page." }) : null,
-          /* @__PURE__ */ jsx19("div", { class: "card", children: /* @__PURE__ */ jsx19(
+          sessions.length === 0 ? /* @__PURE__ */ jsx21("div", { class: "card card-pad muted small", children: "Nothing this far back \u2014 the list ends before this page." }) : null,
+          /* @__PURE__ */ jsx21("div", { class: "card", children: /* @__PURE__ */ jsx21(
             Pager,
             {
               path: "/app/sessions",
@@ -17725,17 +18771,17 @@ sessionsRoutes.get("/app/sessions", async (c) => {
             }
           ) })
         ] }),
-        /* @__PURE__ */ jsxs19("dialog", { id: "new-session", class: "formdlg", children: [
-          /* @__PURE__ */ jsx19("h3", { children: "New debug session" }),
-          /* @__PURE__ */ jsx19("p", { class: "dlgsub", children: "Describe the problem \u2014 teammates' agents will see it in their inbox." }),
-          /* @__PURE__ */ jsxs19("form", { method: "post", action: "/app/sessions", children: [
-            mine.length > 1 ? /* @__PURE__ */ jsxs19("div", { class: "field", children: [
-              /* @__PURE__ */ jsx19("label", { children: "Team" }),
-              /* @__PURE__ */ jsx19("select", { class: "in", name: "team", children: mine.map((m) => /* @__PURE__ */ jsx19("option", { value: m.team.slug, children: m.team.name })) })
-            ] }) : /* @__PURE__ */ jsx19("input", { type: "hidden", name: "team", value: mine[0].team.slug }),
-            /* @__PURE__ */ jsxs19("div", { class: "field", children: [
-              /* @__PURE__ */ jsx19("label", { children: "Title" }),
-              /* @__PURE__ */ jsx19(
+        /* @__PURE__ */ jsxs21("dialog", { id: "new-session", class: "formdlg", children: [
+          /* @__PURE__ */ jsx21("h3", { children: "New debug session" }),
+          /* @__PURE__ */ jsx21("p", { class: "dlgsub", children: "Describe the problem \u2014 teammates' agents will see it in their inbox." }),
+          /* @__PURE__ */ jsxs21("form", { method: "post", action: "/app/sessions", children: [
+            mine.length > 1 ? /* @__PURE__ */ jsxs21("div", { class: "field", children: [
+              /* @__PURE__ */ jsx21("label", { children: "Team" }),
+              /* @__PURE__ */ jsx21("select", { class: "in", name: "team", children: mine.map((m) => /* @__PURE__ */ jsx21("option", { value: m.team.slug, children: m.team.name })) })
+            ] }) : /* @__PURE__ */ jsx21("input", { type: "hidden", name: "team", value: mine[0].team.slug }),
+            /* @__PURE__ */ jsxs21("div", { class: "field", children: [
+              /* @__PURE__ */ jsx21("label", { children: "Title" }),
+              /* @__PURE__ */ jsx21(
                 "input",
                 {
                   class: "in",
@@ -17747,13 +18793,13 @@ sessionsRoutes.get("/app/sessions", async (c) => {
                 }
               )
             ] }),
-            /* @__PURE__ */ jsxs19("div", { class: "field", children: [
-              /* @__PURE__ */ jsx19("label", { children: "Project / repo (optional)" }),
-              /* @__PURE__ */ jsx19("input", { class: "in", type: "text", name: "repo", placeholder: "e.g. billing-api", maxlength: 120 })
+            /* @__PURE__ */ jsxs21("div", { class: "field", children: [
+              /* @__PURE__ */ jsx21("label", { children: "Project / repo (optional)" }),
+              /* @__PURE__ */ jsx21("input", { class: "in", type: "text", name: "repo", placeholder: "e.g. billing-api", maxlength: 120 })
             ] }),
-            /* @__PURE__ */ jsxs19("div", { class: "field", children: [
-              /* @__PURE__ */ jsx19("label", { children: "First message" }),
-              /* @__PURE__ */ jsx19(
+            /* @__PURE__ */ jsxs21("div", { class: "field", children: [
+              /* @__PURE__ */ jsx21("label", { children: "First message" }),
+              /* @__PURE__ */ jsx21(
                 "textarea",
                 {
                   class: "in",
@@ -17763,9 +18809,9 @@ sessionsRoutes.get("/app/sessions", async (c) => {
                 }
               )
             ] }),
-            /* @__PURE__ */ jsxs19("div", { class: "dialog-actions", children: [
-              /* @__PURE__ */ jsx19("button", { class: "btn", type: "button", "data-close-dialog": "t", children: "Cancel" }),
-              /* @__PURE__ */ jsx19("button", { class: "btn btn-primary", type: "submit", children: "Open session" })
+            /* @__PURE__ */ jsxs21("div", { class: "dialog-actions", children: [
+              /* @__PURE__ */ jsx21("button", { class: "btn", type: "button", "data-close-dialog": "t", children: "Cancel" }),
+              /* @__PURE__ */ jsx21("button", { class: "btn btn-primary", type: "submit", children: "Open session" })
             ] })
           ] })
         ] })
@@ -17830,35 +18876,35 @@ sessionsRoutes.get("/app/sessions/:id", async (c) => {
   const found = await sessionForMember(db, c.req.param("id"), user.id);
   if (!found) {
     return c.html(
-      /* @__PURE__ */ jsx19(AppLayout, { user, active: "sessions", title: "Not found", children: /* @__PURE__ */ jsxs19("div", { class: "card card-pad joincard", children: [
-        /* @__PURE__ */ jsx19("span", { class: "tile tile-44 tile-gray", children: "\xD7" }),
-        /* @__PURE__ */ jsx19("h2", { class: "title m0", children: "Session not found" }),
-        /* @__PURE__ */ jsx19("p", { class: "m0 sub", children: "Either it does not exist or you are not in its team." }),
-        /* @__PURE__ */ jsx19("a", { class: "btn", href: "/app/sessions", style: "align-self:flex-start", children: "Back to sessions" })
+      /* @__PURE__ */ jsx21(AppLayout, { user, active: "sessions", title: "Not found", children: /* @__PURE__ */ jsxs21("div", { class: "card card-pad joincard", children: [
+        /* @__PURE__ */ jsx21("span", { class: "tile tile-44 tile-gray", children: "\xD7" }),
+        /* @__PURE__ */ jsx21("h2", { class: "title m0", children: "Session not found" }),
+        /* @__PURE__ */ jsx21("p", { class: "m0 sub", children: "Either it does not exist or you are not in its team." }),
+        /* @__PURE__ */ jsx21("a", { class: "btn", href: "/app/sessions", style: "align-self:flex-start", children: "Back to sessions" })
       ] }) }),
       404
     );
   }
   const { session, team } = found;
   const win = pageWindow(c.req.query("page"), THREAD_PAGE_SIZE);
-  const fetched = await db.select({ m: messages, author: users.username }).from(messages).leftJoin(users, eq35(messages.authorId, users.id)).where(eq35(messages.sessionId, session.id)).orderBy(desc21(messages.createdAt)).limit(win.limit).offset(win.offset);
+  const fetched = await db.select({ m: messages, author: users.username }).from(messages).leftJoin(users, eq37(messages.authorId, users.id)).where(eq37(messages.sessionId, session.id)).orderBy(desc23(messages.createdAt)).limit(win.limit).offset(win.offset);
   const page = slicePage(fetched, win);
   const msgs = [...page.items].reverse();
-  const opener = session.openedBy ? (await db.select({ username: users.username }).from(users).where(eq35(users.id, session.openedBy)).limit(1))[0]?.username : void 0;
+  const opener = session.openedBy ? (await db.select({ username: users.username }).from(users).where(eq37(users.id, session.openedBy)).limit(1))[0]?.username : void 0;
   await markRead(db, user.id, session.id);
   const resolution = session.resolution ?? null;
   return c.html(
-    /* @__PURE__ */ jsxs19(AppLayout, { user, active: "sessions", title: session.title, children: [
-      /* @__PURE__ */ jsxs19("div", { class: "crumb", children: [
-        /* @__PURE__ */ jsx19("a", { href: "/app/sessions", children: "Sessions" }),
+    /* @__PURE__ */ jsxs21(AppLayout, { user, active: "sessions", title: session.title, children: [
+      /* @__PURE__ */ jsxs21("div", { class: "crumb", children: [
+        /* @__PURE__ */ jsx21("a", { href: "/app/sessions", children: "Sessions" }),
         " / ",
         team.slug
       ] }),
-      /* @__PURE__ */ jsxs19("div", { class: "card", children: [
-        /* @__PURE__ */ jsxs19("div", { class: "card-head", style: "align-items:flex-start", children: [
-          /* @__PURE__ */ jsxs19("div", { children: [
-            /* @__PURE__ */ jsx19("div", { class: "card-title", style: "font-size:17px", children: session.title }),
-            /* @__PURE__ */ jsxs19("div", { class: "card-note mono", children: [
+      /* @__PURE__ */ jsxs21("div", { class: "card", children: [
+        /* @__PURE__ */ jsxs21("div", { class: "card-head", style: "align-items:flex-start", children: [
+          /* @__PURE__ */ jsxs21("div", { children: [
+            /* @__PURE__ */ jsx21("div", { class: "card-title", style: "font-size:17px", children: session.title }),
+            /* @__PURE__ */ jsxs21("div", { class: "card-note mono", children: [
               team.slug,
               " \xB7 opened by ",
               opener ?? "unknown",
@@ -17866,12 +18912,12 @@ sessionsRoutes.get("/app/sessions/:id", async (c) => {
               fmtDate(session.createdAt)
             ] })
           ] }),
-          session.kind === "announcements" ? /* @__PURE__ */ jsxs19("span", { class: "pill pill-open", children: [
-            /* @__PURE__ */ jsx19("span", { class: "dot" }),
+          session.kind === "announcements" ? /* @__PURE__ */ jsxs21("span", { class: "pill pill-open", children: [
+            /* @__PURE__ */ jsx21("span", { class: "dot" }),
             "channel"
-          ] }) : session.status === "open" ? /* @__PURE__ */ jsx19("button", { class: "btn btn-sm", type: "button", "data-open-dialog": "#resolve-dialog", children: "Mark resolved" }) : /* @__PURE__ */ jsx19("span", { class: "pill pill-muted", children: "resolved" })
+          ] }) : session.status === "open" ? /* @__PURE__ */ jsx21("button", { class: "btn btn-sm", type: "button", "data-open-dialog": "#resolve-dialog", children: "Mark resolved" }) : /* @__PURE__ */ jsx21("span", { class: "pill pill-muted", children: "resolved" })
         ] }),
-        page.hasMore || win.page > 1 ? /* @__PURE__ */ jsx19(
+        page.hasMore || win.page > 1 ? /* @__PURE__ */ jsx21(
           Pager,
           {
             path: `/app/sessions/${session.id}`,
@@ -17881,47 +18927,47 @@ sessionsRoutes.get("/app/sessions/:id", async (c) => {
             note: "Newest first by page; oldest first inside a page."
           }
         ) : null,
-        /* @__PURE__ */ jsxs19("div", { class: "thread", children: [
-          msgs.length === 0 ? /* @__PURE__ */ jsx19("p", { class: "muted small m0", children: "No messages yet." }) : null,
-          msgs.map((r) => /* @__PURE__ */ jsxs19("div", { class: "msg", children: [
-            /* @__PURE__ */ jsx19("span", { class: `avatar ${r.m.authorId === user.id ? "ink" : "light"}`, children: initials(r.author ?? "ci") }),
-            /* @__PURE__ */ jsxs19("div", { class: "msg-main", children: [
-              /* @__PURE__ */ jsxs19("div", { class: "msg-head", children: [
-                /* @__PURE__ */ jsxs19("span", { class: "msg-author", children: [
+        /* @__PURE__ */ jsxs21("div", { class: "thread", children: [
+          msgs.length === 0 ? /* @__PURE__ */ jsx21("p", { class: "muted small m0", children: "No messages yet." }) : null,
+          msgs.map((r) => /* @__PURE__ */ jsxs21("div", { class: "msg", children: [
+            /* @__PURE__ */ jsx21("span", { class: `avatar ${r.m.authorId === user.id ? "ink" : "light"}`, children: initials(r.author ?? "ci") }),
+            /* @__PURE__ */ jsxs21("div", { class: "msg-main", children: [
+              /* @__PURE__ */ jsxs21("div", { class: "msg-head", children: [
+                /* @__PURE__ */ jsxs21("span", { class: "msg-author", children: [
                   r.m.via ? `${r.m.via} \xB7 ` : "",
                   r.author ?? "automation"
                 ] }),
-                /* @__PURE__ */ jsx19("span", { class: `kindtag kind-${r.m.kind}`, children: r.m.kind }),
-                /* @__PURE__ */ jsx19("span", { class: "msg-time", children: timeAgo(r.m.createdAt) })
+                /* @__PURE__ */ jsx21("span", { class: `kindtag kind-${r.m.kind}`, children: r.m.kind }),
+                /* @__PURE__ */ jsx21("span", { class: "msg-time", children: timeAgo(r.m.createdAt) })
               ] }),
-              /* @__PURE__ */ jsx19("p", { class: "msg-text", children: r.m.body }),
+              /* @__PURE__ */ jsx21("p", { class: "msg-text", children: r.m.body }),
               (r.m.attachments ?? []).map(
-                (a) => /* @__PURE__ */ jsxs19("div", { class: "attach", children: [
-                  /* @__PURE__ */ jsx19("div", { class: "attach-head", children: /* @__PURE__ */ jsx19("span", { children: a.name }) }),
-                  /* @__PURE__ */ jsx19("pre", { children: a.content })
+                (a) => /* @__PURE__ */ jsxs21("div", { class: "attach", children: [
+                  /* @__PURE__ */ jsx21("div", { class: "attach-head", children: /* @__PURE__ */ jsx21("span", { children: a.name }) }),
+                  /* @__PURE__ */ jsx21("pre", { children: a.content })
                 ] })
               )
             ] })
           ] }))
         ] }),
-        session.status === "resolved" && resolution ? /* @__PURE__ */ jsxs19("div", { class: "resolution-note", children: [
-          /* @__PURE__ */ jsxs19("span", { class: "t", children: [
+        session.status === "resolved" && resolution ? /* @__PURE__ */ jsxs21("div", { class: "resolution-note", children: [
+          /* @__PURE__ */ jsxs21("span", { class: "t", children: [
             "Resolved",
             resolution.resolvedBy ? ` by ${resolution.resolvedBy}` : ""
           ] }),
-          /* @__PURE__ */ jsxs19("p", { children: [
-            /* @__PURE__ */ jsx19("b", { children: "Root cause:" }),
+          /* @__PURE__ */ jsxs21("p", { children: [
+            /* @__PURE__ */ jsx21("b", { children: "Root cause:" }),
             " ",
             resolution.rootCause
           ] }),
-          /* @__PURE__ */ jsxs19("p", { children: [
-            /* @__PURE__ */ jsx19("b", { children: "Fix:" }),
+          /* @__PURE__ */ jsxs21("p", { children: [
+            /* @__PURE__ */ jsx21("b", { children: "Fix:" }),
             " ",
             resolution.fix
           ] })
         ] }) : null,
-        /* @__PURE__ */ jsx19("div", { class: "composer", children: /* @__PURE__ */ jsxs19("form", { method: "post", action: `/app/sessions/${session.id}/messages`, style: "display:flex;flex-direction:column;gap:12px", children: [
-          /* @__PURE__ */ jsx19(
+        /* @__PURE__ */ jsx21("div", { class: "composer", children: /* @__PURE__ */ jsxs21("form", { method: "post", action: `/app/sessions/${session.id}/messages`, style: "display:flex;flex-direction:column;gap:12px", children: [
+          /* @__PURE__ */ jsx21(
             "textarea",
             {
               class: "in",
@@ -17931,27 +18977,27 @@ sessionsRoutes.get("/app/sessions/:id", async (c) => {
               maxlength: 2e4
             }
           ),
-          /* @__PURE__ */ jsxs19("div", { class: "page-head", style: "align-items:center", children: [
-            /* @__PURE__ */ jsx19("select", { class: "in", name: "kind", children: MESSAGE_KINDS.filter((k) => k !== "announcement").map((k) => /* @__PURE__ */ jsx19("option", { value: k, selected: k === "question", children: k })) }),
-            /* @__PURE__ */ jsx19("button", { class: "btn btn-primary", type: "submit", children: "Send" })
+          /* @__PURE__ */ jsxs21("div", { class: "page-head", style: "align-items:center", children: [
+            /* @__PURE__ */ jsx21("select", { class: "in", name: "kind", children: MESSAGE_KINDS.filter((k) => k !== "announcement").map((k) => /* @__PURE__ */ jsx21("option", { value: k, selected: k === "question", children: k })) }),
+            /* @__PURE__ */ jsx21("button", { class: "btn btn-primary", type: "submit", children: "Send" })
           ] })
         ] }) })
       ] }),
-      /* @__PURE__ */ jsxs19("dialog", { id: "resolve-dialog", class: "formdlg", children: [
-        /* @__PURE__ */ jsx19("h3", { children: "Mark session resolved" }),
-        /* @__PURE__ */ jsx19("p", { class: "dlgsub", children: "Both fields go into the searchable archive, so the next agent hitting this can find it." }),
-        /* @__PURE__ */ jsxs19("form", { method: "post", action: `/app/sessions/${session.id}/resolve`, children: [
-          /* @__PURE__ */ jsxs19("div", { class: "field", children: [
-            /* @__PURE__ */ jsx19("label", { children: "Root cause" }),
-            /* @__PURE__ */ jsx19("textarea", { class: "in", name: "root_cause", required: true, maxlength: 4e3, placeholder: "What was actually wrong?" })
+      /* @__PURE__ */ jsxs21("dialog", { id: "resolve-dialog", class: "formdlg", children: [
+        /* @__PURE__ */ jsx21("h3", { children: "Mark session resolved" }),
+        /* @__PURE__ */ jsx21("p", { class: "dlgsub", children: "Both fields go into the searchable archive, so the next agent hitting this can find it." }),
+        /* @__PURE__ */ jsxs21("form", { method: "post", action: `/app/sessions/${session.id}/resolve`, children: [
+          /* @__PURE__ */ jsxs21("div", { class: "field", children: [
+            /* @__PURE__ */ jsx21("label", { children: "Root cause" }),
+            /* @__PURE__ */ jsx21("textarea", { class: "in", name: "root_cause", required: true, maxlength: 4e3, placeholder: "What was actually wrong?" })
           ] }),
-          /* @__PURE__ */ jsxs19("div", { class: "field", children: [
-            /* @__PURE__ */ jsx19("label", { children: "Fix" }),
-            /* @__PURE__ */ jsx19("textarea", { class: "in", name: "fix", required: true, maxlength: 4e3, placeholder: "What did you change? (PR link welcome)" })
+          /* @__PURE__ */ jsxs21("div", { class: "field", children: [
+            /* @__PURE__ */ jsx21("label", { children: "Fix" }),
+            /* @__PURE__ */ jsx21("textarea", { class: "in", name: "fix", required: true, maxlength: 4e3, placeholder: "What did you change? (PR link welcome)" })
           ] }),
-          /* @__PURE__ */ jsxs19("div", { class: "dialog-actions", children: [
-            /* @__PURE__ */ jsx19("button", { class: "btn", type: "button", "data-close-dialog": "t", children: "Cancel" }),
-            /* @__PURE__ */ jsx19("button", { class: "btn btn-primary", type: "submit", children: "Resolve session" })
+          /* @__PURE__ */ jsxs21("div", { class: "dialog-actions", children: [
+            /* @__PURE__ */ jsx21("button", { class: "btn", type: "button", "data-close-dialog": "t", children: "Cancel" }),
+            /* @__PURE__ */ jsx21("button", { class: "btn btn-primary", type: "submit", children: "Resolve session" })
           ] })
         ] })
       ] })
@@ -18016,7 +19062,7 @@ sessionsRoutes.post("/app/sessions/:id/resolve", async (c) => {
     resolvedBy: user.username,
     resolvedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
-  await db.update(debugSessions).set({ status: "resolved", resolution, resolvedAt: /* @__PURE__ */ new Date() }).where(eq35(debugSessions.id, found.session.id));
+  await db.update(debugSessions).set({ status: "resolved", resolution, resolvedAt: /* @__PURE__ */ new Date() }).where(eq37(debugSessions.id, found.session.id));
   const posted = await db.insert(messages).values({
     sessionId: found.session.id,
     authorId: user.id,
@@ -18050,16 +19096,16 @@ Fix: ${resolution.fix}`
 });
 
 // src/routes/stream.ts
-import { eq as eq36 } from "drizzle-orm";
-import { Hono as Hono17 } from "hono";
+import { eq as eq38 } from "drizzle-orm";
+import { Hono as Hono19 } from "hono";
 import { streamSSE } from "hono/streaming";
-var streamRoutes = new Hono17();
+var streamRoutes = new Hono19();
 var PING_MS = 2e4;
 var MAX_LIFETIME_MS = 5 * 6e4;
 streamRoutes.get("/app/stream", async (c) => {
   const user = c.get("user");
   if (!user) return c.text("sign in first", 401);
-  const rows = await c.get("db").select({ teamId: memberships.teamId }).from(memberships).where(eq36(memberships.userId, user.id));
+  const rows = await c.get("db").select({ teamId: memberships.teamId }).from(memberships).where(eq38(memberships.userId, user.id));
   const teams4 = new Set(rows.map((r) => r.teamId));
   return streamSSE(c, async (stream) => {
     const queue = [];
@@ -18116,45 +19162,45 @@ streamRoutes.get("/app/stream", async (c) => {
 });
 
 // src/ui/NotFound.tsx
-import { jsx as jsx20, jsxs as jsxs20 } from "hono/jsx/jsx-runtime";
-var NotFoundPage = ({ user, path: path2 }) => /* @__PURE__ */ jsx20(AppLayout, { user, title: "Not found", children: /* @__PURE__ */ jsxs20("div", { class: "card card-pad joincard", children: [
-  /* @__PURE__ */ jsx20("span", { class: "tile tile-44 tile-gray", children: "\xD7" }),
-  /* @__PURE__ */ jsx20("h2", { class: "title m0", children: "Page not found" }),
-  /* @__PURE__ */ jsxs20("p", { class: "m0 sub", children: [
+import { jsx as jsx22, jsxs as jsxs22 } from "hono/jsx/jsx-runtime";
+var NotFoundPage = ({ user, path: path2 }) => /* @__PURE__ */ jsx22(AppLayout, { user, title: "Not found", children: /* @__PURE__ */ jsxs22("div", { class: "card card-pad joincard", children: [
+  /* @__PURE__ */ jsx22("span", { class: "tile tile-44 tile-gray", children: "\xD7" }),
+  /* @__PURE__ */ jsx22("h2", { class: "title m0", children: "Page not found" }),
+  /* @__PURE__ */ jsxs22("p", { class: "m0 sub", children: [
     "Nothing answers ",
-    /* @__PURE__ */ jsx20("code", { children: path2 }),
+    /* @__PURE__ */ jsx22("code", { children: path2 }),
     ". It may have been renamed or deleted, or it may not be yours to see."
   ] }),
-  /* @__PURE__ */ jsxs20("div", { class: "row", style: "gap:8px", children: [
-    /* @__PURE__ */ jsx20("a", { class: "btn btn-primary", href: "/app/agents", children: "Agent map" }),
-    /* @__PURE__ */ jsx20("a", { class: "btn", href: "/app", children: "Teams" }),
-    /* @__PURE__ */ jsx20("a", { class: "btn", href: "/docs", children: "Docs" })
+  /* @__PURE__ */ jsxs22("div", { class: "row", style: "gap:8px", children: [
+    /* @__PURE__ */ jsx22("a", { class: "btn btn-primary", href: "/app/agents", children: "Agent map" }),
+    /* @__PURE__ */ jsx22("a", { class: "btn", href: "/app", children: "Teams" }),
+    /* @__PURE__ */ jsx22("a", { class: "btn", href: "/docs", children: "Docs" })
   ] })
 ] }) });
-var NotFoundPublic = ({ path: path2 }) => /* @__PURE__ */ jsxs20("html", { lang: "en", children: [
-  /* @__PURE__ */ jsx20(Head, { title: "Not found" }),
-  /* @__PURE__ */ jsx20("body", { children: /* @__PURE__ */ jsx20("div", { class: "auth-wrap", children: /* @__PURE__ */ jsxs20("div", { class: "auth-card", children: [
-    /* @__PURE__ */ jsx20(Logo, { lg: true }),
-    /* @__PURE__ */ jsxs20("div", { children: [
-      /* @__PURE__ */ jsx20("h1", { children: "Page not found" }),
-      /* @__PURE__ */ jsxs20("p", { class: "lede", children: [
+var NotFoundPublic = ({ path: path2 }) => /* @__PURE__ */ jsxs22("html", { lang: "en", children: [
+  /* @__PURE__ */ jsx22(Head, { title: "Not found" }),
+  /* @__PURE__ */ jsx22("body", { children: /* @__PURE__ */ jsx22("div", { class: "auth-wrap", children: /* @__PURE__ */ jsxs22("div", { class: "auth-card", children: [
+    /* @__PURE__ */ jsx22(Logo, { lg: true }),
+    /* @__PURE__ */ jsxs22("div", { children: [
+      /* @__PURE__ */ jsx22("h1", { children: "Page not found" }),
+      /* @__PURE__ */ jsxs22("p", { class: "lede", children: [
         "Nothing answers ",
-        /* @__PURE__ */ jsx20("code", { children: path2 }),
+        /* @__PURE__ */ jsx22("code", { children: path2 }),
         ". If you were sent here by a link, it may have expired."
       ] })
     ] }),
-    /* @__PURE__ */ jsx20("a", { class: "btn btn-primary", style: "width:100%;height:44px", href: "/", children: "Go to the home page" }),
-    /* @__PURE__ */ jsxs20("p", { class: "finenote", children: [
+    /* @__PURE__ */ jsx22("a", { class: "btn btn-primary", style: "width:100%;height:44px", href: "/", children: "Go to the home page" }),
+    /* @__PURE__ */ jsxs22("p", { class: "finenote", children: [
       "Already have an account? ",
-      /* @__PURE__ */ jsx20("a", { href: "/login", children: "Sign in" }),
+      /* @__PURE__ */ jsx22("a", { href: "/login", children: "Sign in" }),
       " \xB7 ",
-      /* @__PURE__ */ jsx20("a", { href: "/docs", children: "Docs" })
+      /* @__PURE__ */ jsx22("a", { href: "/docs", children: "Docs" })
     ] })
   ] }) }) })
 ] });
 
 // src/app.tsx
-import { jsx as jsx21 } from "hono/jsx/jsx-runtime";
+import { jsx as jsx23 } from "hono/jsx/jsx-runtime";
 var originGuard = async (c, next) => {
   if (c.req.method === "POST" && !c.req.path.startsWith("/mcp")) {
     const origin = c.req.header("origin");
@@ -18173,7 +19219,7 @@ var originGuard = async (c, next) => {
   await next();
 };
 function createApp(deps) {
-  const app = new Hono18();
+  const app = new Hono20();
   setHosted(deps.env.hosted);
   app.use("*", async (c, next) => {
     c.set("db", deps.db);
@@ -18254,6 +19300,8 @@ function createApp(deps) {
   app.route("/", sessionsRoutes);
   app.route("/", streamRoutes);
   app.route("/", notificationsRoutes);
+  app.route("/", policyEditorRoutes);
+  app.route("/", projectsRoutes);
   app.route("/", compareRoutes);
   app.route("/", activityRoutes);
   app.route("/", governanceRoutes);
@@ -18270,7 +19318,7 @@ function createApp(deps) {
     const user = c.get("user");
     if (user) await ensureRail(deps.db, user);
     return c.html(
-      user ? /* @__PURE__ */ jsx21(NotFoundPage, { user, path: path2 }) : /* @__PURE__ */ jsx21(NotFoundPublic, { path: path2 }),
+      user ? /* @__PURE__ */ jsx23(NotFoundPage, { user, path: path2 }) : /* @__PURE__ */ jsx23(NotFoundPublic, { path: path2 }),
       404
     );
   });
@@ -18304,12 +19352,12 @@ function createApp(deps) {
 }
 
 // src/lib/cleanup.ts
-import { and as and28, eq as eq37, inArray as inArray14, lt as lt4, notInArray as notInArray2, or as or8 } from "drizzle-orm";
+import { and as and30, eq as eq39, inArray as inArray16, lt as lt4, notInArray as notInArray2, or as or8 } from "drizzle-orm";
 var teamsIn = (db, plans) => db.select({ id: teams.id }).from(teams).where(
   // A plan id nobody recognises resolves to `free` everywhere else, so it has
   // to be swept like `free` here too — otherwise a typo in the column buys a
   // team unlimited history.
-  plans.includes("free") ? or8(inArray14(teams.plan, [...plans]), notInArray2(teams.plan, [...PLAN_IDS])) : inArray14(teams.plan, [...plans])
+  plans.includes("free") ? or8(inArray16(teams.plan, [...plans]), notInArray2(teams.plan, [...PLAN_IDS])) : inArray16(teams.plan, [...plans])
 );
 function retentionGroups(env2) {
   if (!env2.hosted) {
@@ -18339,8 +19387,8 @@ async function runCleanupOnce(db, env2) {
   }
   if (env2.sessionRetentionDays > 0) {
     const purged = await db.delete(debugSessions).where(
-      and28(
-        eq37(debugSessions.status, "resolved"),
+      and30(
+        eq39(debugSessions.status, "resolved"),
         lt4(debugSessions.resolvedAt, new Date(now.getTime() - env2.sessionRetentionDays * DAY5))
       )
     );
@@ -18361,15 +19409,15 @@ async function runCleanupOnce(db, env2) {
   for (const [days, scope] of retentionGroups(env2)) {
     const cutoff = new Date(now.getTime() - days * DAY5);
     counts.activity += rowsAffected(
-      await db.delete(activity).where(scope ? and28(lt4(activity.createdAt, cutoff), inArray14(activity.teamId, teamsIn(db, scope))) : lt4(activity.createdAt, cutoff))
+      await db.delete(activity).where(scope ? and30(lt4(activity.createdAt, cutoff), inArray16(activity.teamId, teamsIn(db, scope))) : lt4(activity.createdAt, cutoff))
     );
     counts.agentEvents += rowsAffected(
       await db.delete(agentEvents).where(
-        scope ? and28(
+        scope ? and30(
           lt4(agentEvents.createdAt, cutoff),
-          inArray14(
+          inArray16(
             agentEvents.runId,
-            db.select({ id: agentRuns.id }).from(agentRuns).where(inArray14(agentRuns.teamId, teamsIn(db, scope)))
+            db.select({ id: agentRuns.id }).from(agentRuns).where(inArray16(agentRuns.teamId, teamsIn(db, scope)))
           )
         ) : lt4(agentEvents.createdAt, cutoff)
       )