bazilion 0.12.2 → 0.13.0

package/dist/web/server/assets/{config-BmixCpz-.js → config-DGzM28F_.js}

@@ -1,27 +1,207 @@
-import { t as Route } from "./config-1w2GiJUn.js";
+import { t as Route } from "./config-wYtIhkRm.js";
 import { t as ConfigPage } from "./ConfigPage-BKlh5vOU.js";
 import { t as FieldRow } from "./FieldRow-B4eTegH9.js";
 import { useState } from "react";
 import { useRouter } from "@tanstack/react-router";
 import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+//#region src/components/ExecutionSecurityCard.tsx
+function ExecutionSecurityCard({ status }) {
+	const configured = status.configuredOperatorHttp;
+	const protectedTurns = status.protectedUnattendedTurns;
+	return /* @__PURE__ */ jsxs("section", {
+		className: "overflow-hidden rounded-lg border bg-card",
+		children: [/* @__PURE__ */ jsxs("header", {
+			className: "border-b px-4 py-3",
+			children: [/* @__PURE__ */ jsx("h2", {
+				className: "font-semibold",
+				children: "Execution security"
+			}), /* @__PURE__ */ jsx("p", {
+				className: "mt-1 text-xs text-muted-foreground",
+				children: "Operator HTTP requests keep their configured compatibility behavior. Unattended sources use a separate mandatory protected baseline."
+			})]
+		}), /* @__PURE__ */ jsxs("div", {
+			className: "grid gap-4 p-4 lg:grid-cols-2",
+			children: [/* @__PURE__ */ jsxs("section", {
+				className: "rounded-md border bg-muted/20 p-3",
+				children: [
+					/* @__PURE__ */ jsxs("div", {
+						className: "mb-3 flex flex-wrap items-center justify-between gap-2",
+						children: [/* @__PURE__ */ jsx("h3", {
+							className: "font-semibold",
+							children: "Configured operator HTTP"
+						}), /* @__PURE__ */ jsx(StatusBadge, {
+							ok: false,
+							children: "legacy · unprotected"
+						})]
+					}),
+					/* @__PURE__ */ jsxs("dl", {
+						className: "space-y-2 text-sm",
+						children: [
+							/* @__PURE__ */ jsx(StatusRow, {
+								label: "Coding surface",
+								value: codingSurfaceLabel(configured.codingSurface)
+							}),
+							/* @__PURE__ */ jsx(StatusRow, {
+								label: "Docker image",
+								value: configured.dockerImage,
+								mono: true
+							}),
+							/* @__PURE__ */ jsx(StatusRow, {
+								label: "Browser",
+								value: configured.browser
+							}),
+							/* @__PURE__ */ jsx(StatusRow, {
+								label: "MCP",
+								value: configured.mcp
+							})
+						]
+					}),
+					/* @__PURE__ */ jsx("p", {
+						className: "mt-3 text-xs text-muted-foreground",
+						children: "This compatibility branch is for operator requests; Telegram and unattended delivery never select it."
+					})
+				]
+			}), /* @__PURE__ */ jsxs("section", {
+				className: `rounded-md border p-3 ${protectedTurns.baseRuntimeReady ? "border-success/25 bg-success/5" : "border-warning/25 bg-warning/10"}`,
+				children: [
+					/* @__PURE__ */ jsxs("div", {
+						className: "mb-3 flex flex-wrap items-center justify-between gap-2",
+						children: [/* @__PURE__ */ jsx("h3", {
+							className: "font-semibold",
+							children: "Protected unattended turns"
+						}), /* @__PURE__ */ jsx(StatusBadge, {
+							ok: protectedTurns.baseRuntimeReady,
+							children: protectedTurns.baseRuntimeReady ? "base runtime ready" : "base runtime unavailable"
+						})]
+					}),
+					/* @__PURE__ */ jsx("p", {
+						className: "mb-3 text-xs text-muted-foreground",
+						children: "Telegram, schedules, inbox wake-ups, and approval delivery cannot select the legacy surface."
+					}),
+					/* @__PURE__ */ jsxs("dl", {
+						className: "space-y-2 text-sm",
+						children: [
+							/* @__PURE__ */ jsx(StatusRow, {
+								label: "Coding surface",
+								value: "Docker only"
+							}),
+							/* @__PURE__ */ jsx(StatusRow, {
+								label: "Docker",
+								value: protectedTurns.docker.ready ? "ready" : "unavailable",
+								ok: protectedTurns.docker.ready
+							}),
+							/* @__PURE__ */ jsx(StatusRow, {
+								label: "Docker image",
+								value: protectedTurns.docker.image,
+								mono: true
+							}),
+							protectedTurns.docker.reason && /* @__PURE__ */ jsx(StatusRow, {
+								label: "Docker reason",
+								value: protectedTurns.docker.reason
+							}),
+							/* @__PURE__ */ jsx(StatusRow, {
+								label: "OpenAI Codex enabled",
+								value: yesNo(protectedTurns.openaiCodex.enabled),
+								ok: protectedTurns.openaiCodex.enabled
+							}),
+							/* @__PURE__ */ jsx(StatusRow, {
+								label: "ChatGPT connected",
+								value: yesNo(protectedTurns.openaiCodex.connected),
+								ok: protectedTurns.openaiCodex.connected
+							}),
+							/* @__PURE__ */ jsx(StatusRow, {
+								label: "OpenAI access",
+								value: openAIAccessLabel(protectedTurns.openaiCodex),
+								ok: protectedTurns.openaiCodex.accessCurrent || protectedTurns.openaiCodex.refreshOnNextTurn
+							}),
+							/* @__PURE__ */ jsx(StatusRow, {
+								label: "OpenAI Codex baseline eligible",
+								value: yesNo(protectedTurns.openaiCodex.baselineEligible),
+								ok: protectedTurns.openaiCodex.baselineEligible
+							}),
+							/* @__PURE__ */ jsx(StatusRow, {
+								label: "Browser",
+								value: protectedTurns.browser,
+								ok: true
+							}),
+							/* @__PURE__ */ jsx(StatusRow, {
+								label: "MCP",
+								value: protectedTurns.mcp,
+								ok: true
+							})
+						]
+					}),
+					protectedTurns.remediation && /* @__PURE__ */ jsxs("p", {
+						className: "mt-3 rounded-md border border-warning/25 bg-background/60 px-3 py-2 text-xs text-warning",
+						children: [
+							/* @__PURE__ */ jsx("strong", { children: "Remediation:" }),
+							" ",
+							protectedTurns.remediation
+						]
+					}),
+					/* @__PURE__ */ jsx("p", {
+						className: "mt-3 text-xs text-muted-foreground",
+						children: "Every turn separately validates its selected normal/review model, bound OAuth refresh, and Team/input/memory/skill mounts and paths before execution."
+					})
+				]
+			})]
+		})]
+	});
+}
+function StatusBadge({ ok, children }) {
+	return /* @__PURE__ */ jsx("span", {
+		className: `rounded-full px-2 py-0.5 text-xs font-semibold uppercase ${ok ? "bg-success/10 text-success" : "bg-warning/10 text-warning"}`,
+		children
+	});
+}
+function StatusRow({ label, value, ok, mono = false }) {
+	return /* @__PURE__ */ jsxs("div", {
+		className: "flex items-start justify-between gap-3",
+		children: [/* @__PURE__ */ jsx("dt", {
+			className: "text-muted-foreground",
+			children: label
+		}), /* @__PURE__ */ jsx("dd", {
+			className: `${mono ? "font-mono" : "font-medium"} text-right ${ok === void 0 ? "" : ok ? "text-success" : "text-warning"}`,
+			children: value
+		})]
+	});
+}
+function codingSurfaceLabel(surface) {
+	if (surface === "host") return "Host tools";
+	if (surface === "docker") return "Docker only";
+	return "Unavailable";
+}
+function yesNo(value) {
+	return value ? "yes" : "no";
+}
+function openAIAccessLabel(status) {
+	if (status.accessCurrent) return "current";
+	if (status.refreshOnNextTurn) return "refresh on next turn";
+	return "unavailable";
+}
+//#endregion
 //#region src/routes/config/index.tsx?tsr-split=component
 function ProvidersPage() {
-	const { providers, openaiCodex } = Route.useLoaderData();
+	const { providers, openaiCodex, executionSecurity } = Route.useLoaderData();
 	const setupComplete = providers.some((p) => p.enabled && p.curated.length > 0);
 	return /* @__PURE__ */ jsxs(ConfigPage, {
 		active: "providers",
 		title: "Providers",
 		description: /* @__PURE__ */ jsx(Fragment, { children: "Configure credentials, endpoints, and the curated model lists used by agent templates and running agents. Secrets are encrypted; URLs and IDs remain inspectable configuration." }),
-		children: [!setupComplete && /* @__PURE__ */ jsx(SetupBlockerBanner, {
-			providers,
-			openaiCodex
-		}), /* @__PURE__ */ jsx("div", {
-			className: "space-y-3",
-			children: providers.map((p) => /* @__PURE__ */ jsx(ProviderCard, {
-				p,
-				openaiCodexStatus: p.id === "openai-codex" ? openaiCodex : void 0
-			}, p.id))
-		})]
+		children: [
+			/* @__PURE__ */ jsx(ExecutionSecurityCard, { status: executionSecurity }),
+			!setupComplete && /* @__PURE__ */ jsx(SetupBlockerBanner, {
+				providers,
+				openaiCodex
+			}),
+			/* @__PURE__ */ jsx("div", {
+				className: "space-y-3",
+				children: providers.map((p) => /* @__PURE__ */ jsx(ProviderCard, {
+					p,
+					openaiCodexStatus: p.id === "openai-codex" ? openaiCodex : void 0
+				}, p.id))
+			})
+		]
 	});
 }
 function SetupBlockerBanner({ providers, openaiCodex }) {
@@ -231,7 +411,7 @@ function exampleModelFor(providerId) {
 		case "google-vertex": return "gemini-3.6-flash";
 		case "xai": return "grok-4.5";
 		case "groq": return "llama-3.3-70b-versatile";
-		case "cerebras": return "zai-glm-4.7";
+		case "cerebras": return "gpt-oss-120b";
 		case "mistral": return "mistral-large-latest";
 		case "zai": return "glm-5.2";
 		case "huggingface": return "Qwen/Qwen3.5-397B-A17B";
@@ -240,13 +420,15 @@ function exampleModelFor(providerId) {
 		case "deepseek": return "deepseek-v4-pro";
 		case "fireworks": return "accounts/fireworks/models/kimi-k3";
 		case "together": return "moonshotai/Kimi-K3";
+		case "baseten": return "moonshotai/Kimi-K3";
 		case "moonshotai": return "kimi-k3";
 		case "moonshotai-cn": return "kimi-k3";
 		case "kimi-coding": return "kimi-for-coding";
 		case "minimax": return "MiniMax-M2.7";
 		case "minimax-cn": return "MiniMax-M3";
-		case "qwen-token-plan":
-		case "qwen-token-plan-cn": return "qwen3.8-max-preview";
+		case "qwen-token-plan": return "qwen3.8-max";
+		case "qwen-token-plan-cn":
+		case "qwen-token-plan-individual": return "qwen3.8-max";
 		case "ant-ling": return "Ling-2.6-1T";
 		case "nvidia": return "nvidia/nemotron-3-super-120b-a12b";
 		case "cloudflare-workers-ai": return "@cf/moonshotai/kimi-k2.6";

package/dist/web/server/assets/{config-1w2GiJUn.js → config-wYtIhkRm.js}

@@ -1,8 +1,8 @@
-import { t as createServerFn } from "../server.js";
-import { t as createSsrRpc } from "./createSsrRpc-DFsIAfFd.js";
+import { n as createServerFn } from "../server.js";
+import { t as createSsrRpc } from "./createSsrRpc-6LHNEsSK.js";
 import { createFileRoute, lazyRouteComponent } from "@tanstack/react-router";
 //#region src/routes/config/index.tsx
-var $$splitComponentImporter = () => import("./config-BmixCpz-.js");
+var $$splitComponentImporter = () => import("./config-DGzM28F_.js");
 var fetchProvidersData = createServerFn({ method: "GET" }).handler(createSsrRpc("b18a227687dba45b99ea5a2ac7a5bf8efcd9bc54387bc279cd87510fd2f83f7e"));
 var Route = createFileRoute("/config/")({
 	loader: () => fetchProvidersData(),

package/dist/web/server/assets/context-BkDDwbby.js

@@ -0,0 +1,12 @@
+import { n as createServerFn } from "../server.js";
+import { t as createSsrRpc } from "./createSsrRpc-6LHNEsSK.js";
+import { createFileRoute, lazyRouteComponent } from "@tanstack/react-router";
+//#region src/routes/teams/$id/context.tsx
+var $$splitComponentImporter = () => import("./context-poimKI7w.js");
+var fetchContext = createServerFn({ method: "POST" }).validator((data) => data).handler(createSsrRpc("b859e1340a80871c50b0d3e60bd3f3b48fe3c66b083f8ff9d5b2981720d36a81"));
+var Route = createFileRoute("/teams/$id/context")({
+	loader: ({ params }) => fetchContext({ data: params }),
+	component: lazyRouteComponent($$splitComponentImporter, "component")
+});
+//#endregion
+export { Route as t };

package/dist/web/server/assets/context-DMc0KyHh.js

@@ -0,0 +1,12 @@
+import { n as createServerFn } from "../server.js";
+import { t as createServerRpc } from "./createServerRpc-B7Yr1K8i.js";
+import { n as daemonClient } from "./daemon-client-CI5NHwNC.js";
+//#region src/routes/teams/$id/context.tsx?tss-serverfn-split
+var fetchContext_createServerFn_handler = createServerRpc({
+	id: "b859e1340a80871c50b0d3e60bd3f3b48fe3c66b083f8ff9d5b2981720d36a81",
+	name: "fetchContext",
+	filename: "src/routes/teams/$id/context.tsx"
+}, (opts) => fetchContext.__executeServer(opts));
+var fetchContext = createServerFn({ method: "POST" }).validator((data) => data).handler(fetchContext_createServerFn_handler, ({ data }) => daemonClient().get(`/api/teams/${encodeURIComponent(data.id)}`));
+//#endregion
+export { fetchContext_createServerFn_handler };

package/dist/web/server/assets/{context-DrkrIWun.js → context-poimKI7w.js}

@@ -1,4 +1,4 @@
-import { t as Route } from "./context-BXGo5Vfi.js";
+import { t as Route } from "./context-BkDDwbby.js";
 import { r as PageShell } from "./Page-LENulSXY.js";
 import { t as TeamTabs } from "./TeamTabs-zZzbP1t_.js";
 import { jsx, jsxs } from "react/jsx-runtime";

package/dist/web/server/assets/{createServerRpc-pU-IQV2Y.js → createServerRpc-B7Yr1K8i.js}

@@ -1,4 +1,4 @@
-import { n as TSS_SERVER_FUNCTION } from "../server.js";
+import { r as TSS_SERVER_FUNCTION } from "../server.js";
 //#region ../../node_modules/.pnpm/@tanstack+start-server-core@1.169.17/node_modules/@tanstack/start-server-core/dist/esm/createServerRpc.js
 var createServerRpc = (serverFnMeta, splitImportFn) => {
 	const url = "/_serverFn/" + serverFnMeta.id;

package/dist/web/server/assets/{createSsrRpc-DFsIAfFd.js → createSsrRpc-6LHNEsSK.js}

@@ -1,4 +1,4 @@
-import { n as TSS_SERVER_FUNCTION, r as getServerFnById } from "../server.js";
+import { i as getServerFnById, r as TSS_SERVER_FUNCTION } from "../server.js";
 //#region ../../node_modules/.pnpm/@tanstack+start-server-core@1.169.17/node_modules/@tanstack/start-server-core/dist/esm/createSsrRpc.js
 var createSsrRpc = (functionId) => {
 	const url = "/_serverFn/" + functionId;

package/dist/web/server/assets/{daemon-client-2NRMzlTr.js → daemon-client-CI5NHwNC.js}

@@ -1,4 +1,5 @@
-import { i as getCookie } from "../server.js";
+import { a as getCookie } from "../server.js";
+import { t as webOriginConfig } from "./public-origin-xV0lm0Ty.js";
 //#region ../../packages/client/src/index.ts
 var ApiClientError = class extends Error {
 	status;
@@ -14,9 +15,12 @@ async function resolveToken(src) {
 }
 function createClient(cfg) {
 	async function authHeaders() {
+		const token = cfg.token === null ? null : await resolveToken(cfg.token);
+		const extra = typeof cfg.headers === "function" ? await cfg.headers() : cfg.headers ?? {};
 		return {
-			authorization: `Bearer ${await resolveToken(cfg.token)}`,
-			origin: cfg.serverUrl
+			...token ? { authorization: `Bearer ${token}` } : {},
+			origin: cfg.serverUrl,
+			...extra
 		};
 	}
 	async function request(method, path, body) {
@@ -86,9 +90,17 @@ function createClient(cfg) {
 //#region src/lib/daemon-client.ts
 var DAEMON_URL = process.env.BAZILION_DAEMON ?? "http://127.0.0.1:4321";
 function daemonClient() {
+	const origin = webOriginConfig();
+	const session = getCookie(origin.sessionCookie);
+	const csrf = getCookie(origin.csrfCookie);
+	const cookies = [session ? `${origin.sessionCookie}=${session}` : null, csrf ? `${origin.csrfCookie}=${csrf}` : null].filter((value) => value !== null).join("; ");
 	return createClient({
 		serverUrl: DAEMON_URL,
-		token: getCookie("bz_token") ?? ""
+		token: null,
+		headers: {
+			...cookies ? { cookie: cookies } : {},
+			...csrf ? { "x-bazilion-csrf": csrf } : {}
+		}
 	});
 }
 var DAEMON_BASE_URL = DAEMON_URL;

package/dist/web/server/assets/{inbox-ZvDNAjaM.js → inbox-0iiSg-Y1.js}

@@ -1,9 +1,9 @@
-import { t as createServerFn } from "../server.js";
-import { t as createSsrRpc } from "./createSsrRpc-DFsIAfFd.js";
+import { n as createServerFn } from "../server.js";
+import { t as createSsrRpc } from "./createSsrRpc-6LHNEsSK.js";
 import { createFileRoute, lazyRouteComponent, redirect } from "@tanstack/react-router";
 //#region src/routes/agents/$id/inbox.tsx
-var $$splitComponentImporter = () => import("./inbox-BLUzA5sQ.js");
-var fetchInbox = createServerFn({ method: "POST" }).inputValidator((d) => d).handler(createSsrRpc("2cd8c6ec40e2e2d9518b5f127a518ecd83a2222d85665cc61d5144bcf59ed4fb"));
+var $$splitComponentImporter = () => import("./inbox-DTTfSuGU.js");
+var fetchInbox = createServerFn({ method: "POST" }).validator((d) => d).handler(createSsrRpc("2cd8c6ec40e2e2d9518b5f127a518ecd83a2222d85665cc61d5144bcf59ed4fb"));
 var Route = createFileRoute("/agents/$id/inbox")({
 	validateSearch: (s) => ({
 		unread: s.unread === "1" ? "1" : void 0,

package/dist/web/server/assets/{inbox-BLUzA5sQ.js → inbox-DTTfSuGU.js}

@@ -1,4 +1,4 @@
-import { t as Route } from "./inbox-ZvDNAjaM.js";
+import { t as Route } from "./inbox-0iiSg-Y1.js";
 import { r as PageShell } from "./Page-LENulSXY.js";
 import { t as AgentTabs } from "./AgentTabs-aXdsiiMp.js";
 import { jsx, jsxs } from "react/jsx-runtime";

package/dist/web/server/assets/{inbox-CzlKT9Wg.js → inbox-Dv55rGYq.js}

@@ -1,13 +1,13 @@
-import { t as createServerFn } from "../server.js";
-import { t as createServerRpc } from "./createServerRpc-pU-IQV2Y.js";
-import { n as daemonClient, r as ApiClientError } from "./daemon-client-2NRMzlTr.js";
+import { n as createServerFn } from "../server.js";
+import { t as createServerRpc } from "./createServerRpc-B7Yr1K8i.js";
+import { n as daemonClient, r as ApiClientError } from "./daemon-client-CI5NHwNC.js";
 //#region src/routes/agents/$id/inbox.tsx?tss-serverfn-split
 var fetchInbox_createServerFn_handler = createServerRpc({
 	id: "2cd8c6ec40e2e2d9518b5f127a518ecd83a2222d85665cc61d5144bcf59ed4fb",
 	name: "fetchInbox",
 	filename: "src/routes/agents/$id/inbox.tsx"
 }, (opts) => fetchInbox.__executeServer(opts));
-var fetchInbox = createServerFn({ method: "POST" }).inputValidator((d) => d).handler(fetchInbox_createServerFn_handler, async ({ data }) => {
+var fetchInbox = createServerFn({ method: "POST" }).validator((d) => d).handler(fetchInbox_createServerFn_handler, async ({ data }) => {
 	const c = daemonClient();
 	let resolved;
 	try {

package/dist/web/server/assets/{learning-8zav4pIT.js → learning-C2upa1CE.js}

@@ -1,13 +1,13 @@
-import { t as createServerFn } from "../server.js";
-import { t as createServerRpc } from "./createServerRpc-pU-IQV2Y.js";
-import { n as daemonClient, r as ApiClientError } from "./daemon-client-2NRMzlTr.js";
+import { n as createServerFn } from "../server.js";
+import { t as createServerRpc } from "./createServerRpc-B7Yr1K8i.js";
+import { n as daemonClient, r as ApiClientError } from "./daemon-client-CI5NHwNC.js";
 //#region src/routes/agents/$id/learning.tsx?tss-serverfn-split
 var fetchLearning_createServerFn_handler = createServerRpc({
 	id: "fcdd0f08b635c7c501caa840d01d1376ace6683e26cc5ac7dead28d7870f98b9",
 	name: "fetchLearning",
 	filename: "src/routes/agents/$id/learning.tsx"
 }, (opts) => fetchLearning.__executeServer(opts));
-var fetchLearning = createServerFn({ method: "POST" }).inputValidator((data) => data).handler(fetchLearning_createServerFn_handler, async ({ data }) => {
+var fetchLearning = createServerFn({ method: "POST" }).validator((data) => data).handler(fetchLearning_createServerFn_handler, async ({ data }) => {
 	const client = daemonClient();
 	let resolved;
 	try {

package/dist/web/server/assets/{learning-B7PBkvER.js → learning-DpyLNVe8.js}

@@ -1,9 +1,9 @@
-import { t as createServerFn } from "../server.js";
-import { t as createSsrRpc } from "./createSsrRpc-DFsIAfFd.js";
+import { n as createServerFn } from "../server.js";
+import { t as createSsrRpc } from "./createSsrRpc-6LHNEsSK.js";
 import { createFileRoute, lazyRouteComponent, redirect } from "@tanstack/react-router";
 //#region src/routes/agents/$id/learning.tsx
-var $$splitComponentImporter = () => import("./learning-Cq7K2heb.js");
-var fetchLearning = createServerFn({ method: "POST" }).inputValidator((data) => data).handler(createSsrRpc("fcdd0f08b635c7c501caa840d01d1376ace6683e26cc5ac7dead28d7870f98b9"));
+var $$splitComponentImporter = () => import("./learning-fG8316uc.js");
+var fetchLearning = createServerFn({ method: "POST" }).validator((data) => data).handler(createSsrRpc("fcdd0f08b635c7c501caa840d01d1376ace6683e26cc5ac7dead28d7870f98b9"));
 var Route = createFileRoute("/agents/$id/learning")({
 	loader: async ({ params }) => {
 		const data = await fetchLearning({ data: { id: params.id } });

package/dist/web/server/assets/{learning-Cq7K2heb.js → learning-fG8316uc.js}

@@ -1,4 +1,4 @@
-import { t as Route } from "./learning-B7PBkvER.js";
+import { t as Route } from "./learning-DpyLNVe8.js";
 import { r as PageShell } from "./Page-LENulSXY.js";
 import { t as AgentTabs } from "./AgentTabs-aXdsiiMp.js";
 import { t as Button } from "./Button-Dsnw22OF.js";

package/dist/web/server/assets/{login-Bx5LEyGP.js → login-CrFVVUaE.js}

@@ -109,7 +109,7 @@ function ThemeToggle() {
 }
 //#endregion
 //#region src/routes/login.tsx
-var $$splitComponentImporter = () => import("./login-CmWvxfTK.js");
+var $$splitComponentImporter = () => import("./login-D_GDeTrB.js");
 var Route = createFileRoute("/login")({
 	validateSearch: (search) => ({ error: search.error === "1" ? "1" : void 0 }),
 	component: lazyRouteComponent($$splitComponentImporter, "component")

package/dist/web/server/assets/{login-CmWvxfTK.js → login-D_GDeTrB.js}

@@ -1,4 +1,4 @@
-import { i as BaziuLogo, n as ThemeToggle, r as PawIcon, t as Route } from "./login-Bx5LEyGP.js";
+import { i as BaziuLogo, n as ThemeToggle, r as PawIcon, t as Route } from "./login-CrFVVUaE.js";
 import { jsx, jsxs } from "react/jsx-runtime";
 import { KeyRound, MessageSquareText, UsersRound } from "lucide-react";
 //#region src/routes/login.tsx?tsr-split=component
@@ -70,7 +70,7 @@ function LoginPage() {
 						}),
 						/* @__PURE__ */ jsx("p", {
 							className: "mt-2 text-sm leading-6 text-mocha-light",
-							children: "Use the local access token created by your Bazilion daemon."
+							children: "Use a named device token minted locally by your Bazilion CLI."
 						}),
 						error && /* @__PURE__ */ jsx("div", {
 							className: "err mt-5",
@@ -105,12 +105,12 @@ function LoginPage() {
 						/* @__PURE__ */ jsxs("p", {
 							className: "mt-5 rounded-xl bg-ivory px-3 py-2.5 text-[0.78em] leading-relaxed text-mocha-light",
 							children: [
-								"Find it in ",
-								/* @__PURE__ */ jsx("code", { children: "~/.bazilion/auth.json" }),
-								", created the first time you run",
+								"On the server, run ",
+								/* @__PURE__ */ jsx("code", { children: "bazilion token create browser" }),
+								". The bootstrap token in",
 								" ",
-								/* @__PURE__ */ jsx("code", { children: "bazilion serve" }),
-								"."
+								/* @__PURE__ */ jsx("code", { children: "auth.json" }),
+								" is intentionally rejected here."
 							]
 						})
 					]

package/dist/web/server/assets/{mcp-DIWTogHM.js → mcp-BQtp2T87.js}

@@ -1,8 +1,8 @@
-import { t as createServerFn } from "../server.js";
-import { t as createSsrRpc } from "./createSsrRpc-DFsIAfFd.js";
+import { n as createServerFn } from "../server.js";
+import { t as createSsrRpc } from "./createSsrRpc-6LHNEsSK.js";
 import { createFileRoute, lazyRouteComponent } from "@tanstack/react-router";
 //#region src/routes/config/mcp.tsx
-var $$splitComponentImporter = () => import("./mcp-BJjLIdP0.js");
+var $$splitComponentImporter = () => import("./mcp-DlgXUcAS.js");
 var fetchServers = createServerFn({ method: "GET" }).handler(createSsrRpc("278849457893891c3d22806d15e11a0a42cc3630b30e9e62b74cf2d3b982ded7"));
 var Route = createFileRoute("/config/mcp")({
 	loader: () => fetchServers(),

package/dist/web/server/assets/{mcp-2pwT9HU8.js → mcp-BvnvlVFd.js}

@@ -1,6 +1,6 @@
-import { t as createServerFn } from "../server.js";
-import { t as createServerRpc } from "./createServerRpc-pU-IQV2Y.js";
-import { n as daemonClient } from "./daemon-client-2NRMzlTr.js";
+import { n as createServerFn } from "../server.js";
+import { t as createServerRpc } from "./createServerRpc-B7Yr1K8i.js";
+import { n as daemonClient } from "./daemon-client-CI5NHwNC.js";
 //#region src/routes/config/mcp.tsx?tss-serverfn-split
 var fetchServers_createServerFn_handler = createServerRpc({
 	id: "278849457893891c3d22806d15e11a0a42cc3630b30e9e62b74cf2d3b982ded7",

package/dist/web/server/assets/{mcp-BJjLIdP0.js → mcp-DlgXUcAS.js}

@@ -1,4 +1,4 @@
-import { t as Route } from "./mcp-DIWTogHM.js";
+import { t as Route } from "./mcp-BQtp2T87.js";
 import { t as ConfigPage } from "./ConfigPage-BKlh5vOU.js";
 import { useState } from "react";
 import { useRouter } from "@tanstack/react-router";

package/dist/web/server/assets/members-BP3UTqu1.js

@@ -0,0 +1,12 @@
+import { n as createServerFn } from "../server.js";
+import { t as createServerRpc } from "./createServerRpc-B7Yr1K8i.js";
+import { n as daemonClient } from "./daemon-client-CI5NHwNC.js";
+//#region src/routes/teams/$id/members.tsx?tss-serverfn-split
+var fetchMembers_createServerFn_handler = createServerRpc({
+	id: "0a6e766d2b4ea526da34cefed5342a6ecc5ff35ad1ce38fba4129b8c24d8e6e5",
+	name: "fetchMembers",
+	filename: "src/routes/teams/$id/members.tsx"
+}, (opts) => fetchMembers.__executeServer(opts));
+var fetchMembers = createServerFn({ method: "POST" }).validator((data) => data).handler(fetchMembers_createServerFn_handler, ({ data }) => daemonClient().get(`/api/teams/${encodeURIComponent(data.id)}/policy`));
+//#endregion
+export { fetchMembers_createServerFn_handler };

package/dist/web/server/assets/{members-CCv17cjQ.js → members-CteHKPSF.js}

@@ -1,4 +1,4 @@
-import { t as Route } from "./members-VdPwD6CE.js";
+import { t as Route } from "./members-DXu2oAS_.js";
 import { r as PageShell } from "./Page-LENulSXY.js";
 import { t as TeamTabs } from "./TeamTabs-zZzbP1t_.js";
 import { jsx, jsxs } from "react/jsx-runtime";

package/dist/web/server/assets/members-DXu2oAS_.js

@@ -0,0 +1,12 @@
+import { n as createServerFn } from "../server.js";
+import { t as createSsrRpc } from "./createSsrRpc-6LHNEsSK.js";
+import { createFileRoute, lazyRouteComponent } from "@tanstack/react-router";
+//#region src/routes/teams/$id/members.tsx
+var $$splitComponentImporter = () => import("./members-CteHKPSF.js");
+var fetchMembers = createServerFn({ method: "POST" }).validator((data) => data).handler(createSsrRpc("0a6e766d2b4ea526da34cefed5342a6ecc5ff35ad1ce38fba4129b8c24d8e6e5"));
+var Route = createFileRoute("/teams/$id/members")({
+	loader: ({ params }) => fetchMembers({ data: params }),
+	component: lazyRouteComponent($$splitComponentImporter, "component")
+});
+//#endregion
+export { Route as t };

package/dist/web/server/assets/{memory-Dngc13Nw.js → memory-BqV-Afy1.js}

@@ -1,13 +1,13 @@
-import { t as createServerFn } from "../server.js";
-import { t as createServerRpc } from "./createServerRpc-pU-IQV2Y.js";
-import { n as daemonClient, r as ApiClientError } from "./daemon-client-2NRMzlTr.js";
+import { n as createServerFn } from "../server.js";
+import { t as createServerRpc } from "./createServerRpc-B7Yr1K8i.js";
+import { n as daemonClient, r as ApiClientError } from "./daemon-client-CI5NHwNC.js";
 //#region src/routes/teams/$id/memory.tsx?tss-serverfn-split
 var fetchMemory_createServerFn_handler = createServerRpc({
 	id: "b96a98e3ed6c8a3ab5f6a4ed8458e93da753ffd74e2912ef1724bb6e58030cb5",
 	name: "fetchMemory",
 	filename: "src/routes/teams/$id/memory.tsx"
 }, (opts) => fetchMemory.__executeServer(opts));
-var fetchMemory = createServerFn({ method: "POST" }).inputValidator((d) => d).handler(fetchMemory_createServerFn_handler, async ({ data }) => {
+var fetchMemory = createServerFn({ method: "POST" }).validator((d) => d).handler(fetchMemory_createServerFn_handler, async ({ data }) => {
 	const c = daemonClient();
 	let team;
 	try {

package/dist/web/server/assets/{memory-a8Kz57Kh.js → memory-C6fX_FKI.js}

@@ -1,4 +1,4 @@
-import { t as Route } from "./memory-pZ4pZT7p.js";
+import { t as Route } from "./memory-Iq2M0-Yc.js";
 import { r as PageShell } from "./Page-LENulSXY.js";
 import { t as TeamTabs } from "./TeamTabs-zZzbP1t_.js";
 import { useEffect, useRef, useState } from "react";

package/dist/web/server/assets/{memory-pZ4pZT7p.js → memory-Iq2M0-Yc.js}

@@ -1,9 +1,9 @@
-import { t as createServerFn } from "../server.js";
-import { t as createSsrRpc } from "./createSsrRpc-DFsIAfFd.js";
+import { n as createServerFn } from "../server.js";
+import { t as createSsrRpc } from "./createSsrRpc-6LHNEsSK.js";
 import { createFileRoute, lazyRouteComponent, redirect } from "@tanstack/react-router";
 //#region src/routes/teams/$id/memory.tsx
-var $$splitComponentImporter = () => import("./memory-a8Kz57Kh.js");
-var fetchMemory = createServerFn({ method: "POST" }).inputValidator((d) => d).handler(createSsrRpc("b96a98e3ed6c8a3ab5f6a4ed8458e93da753ffd74e2912ef1724bb6e58030cb5"));
+var $$splitComponentImporter = () => import("./memory-C6fX_FKI.js");
+var fetchMemory = createServerFn({ method: "POST" }).validator((d) => d).handler(createSsrRpc("b96a98e3ed6c8a3ab5f6a4ed8458e93da753ffd74e2912ef1724bb6e58030cb5"));
 var Route = createFileRoute("/teams/$id/memory")({
 	loader: async ({ params }) => {
 		const data = await fetchMemory({ data: { id: params.id } });

package/dist/web/server/assets/{policy-Bb-vEgqg.js → policy-18fdTFO4.js}

@@ -1,6 +1,6 @@
-import { t as createServerFn } from "../server.js";
-import { t as createServerRpc } from "./createServerRpc-pU-IQV2Y.js";
-import { n as daemonClient } from "./daemon-client-2NRMzlTr.js";
+import { n as createServerFn } from "../server.js";
+import { t as createServerRpc } from "./createServerRpc-B7Yr1K8i.js";
+import { n as daemonClient } from "./daemon-client-CI5NHwNC.js";
 //#region src/routes/teams/$id/policy.tsx?tss-serverfn-split
 var fetchPolicy_createServerFn_handler = createServerRpc({
 	id: "fc940d6dec5305aa64bdb9b9f5f7d4f925b2ba0608cb6d39af854a94872fc867",

package/dist/web/server/assets/{policy-BcGELcc9.js → policy-Bg6u-rTq.js}

@@ -1,4 +1,4 @@
-import { t as Route } from "./policy-C30AeFIb.js";
+import { t as Route } from "./policy-D7kj3Cy7.js";
 import { r as PageShell } from "./Page-LENulSXY.js";
 import { t as Button } from "./Button-Dsnw22OF.js";
 import { t as RecoveryState } from "./RecoveryState-B2SG-mrY.js";

package/dist/web/server/assets/{policy-C30AeFIb.js → policy-D7kj3Cy7.js}

@@ -1,9 +1,9 @@
-import { t as createServerFn } from "../server.js";
-import { t as createSsrRpc } from "./createSsrRpc-DFsIAfFd.js";
+import { n as createServerFn } from "../server.js";
+import { t as createSsrRpc } from "./createSsrRpc-6LHNEsSK.js";
 import { createFileRoute, lazyRouteComponent } from "@tanstack/react-router";
 //#region src/routes/teams/$id/policy.tsx
 var $$splitErrorComponentImporter = () => import("./policy-BYVXqsan.js");
-var $$splitComponentImporter = () => import("./policy-BcGELcc9.js");
+var $$splitComponentImporter = () => import("./policy-Bg6u-rTq.js");
 var fetchPolicy = createServerFn({ method: "POST" }).validator((data) => data).handler(createSsrRpc("fc940d6dec5305aa64bdb9b9f5f7d4f925b2ba0608cb6d39af854a94872fc867"));
 var Route = createFileRoute("/teams/$id/policy")({
 	validateSearch: (search) => ({