chore(deps): update dependency cryptography to v45.0.7

.beans/nuzlocke-tracker-26my--crash-show-owner-info-in-admin-pages.md

@@ -1,29 +0,0 @@
----
-# nuzlocke-tracker-26my
-title: 'Crash: Show owner info in admin pages'
-status: completed
-type: bug
-priority: high
-created_at: 2026-03-22T09:41:57Z
-updated_at: 2026-03-22T09:45:38Z
-parent: nuzlocke-tracker-bw1m
-blocking:
-    - nuzlocke-tracker-2fp1
----
-
-Bean was found in 'in-progress' status on startup but no agent was running.
-This likely indicates a crash or unexpected termination.
-
-Manual review required before retrying.
-
-Bean: nuzlocke-tracker-2fp1
-Title: Show owner info in admin pages
-
-## Resolution
-
-No work required. The original bean (nuzlocke-tracker-2fp1) was already successfully completed:
-- All checklist items done
-- Commit a3f332f merged via PR #74
-- Original bean status: completed
-
-This crash bean was a false positive - likely created during a race condition when the original bean was transitioning from in-progress to completed.

.beans/nuzlocke-tracker-2fp1--show-owner-info-in-admin-pages.md

@@ -1,14 +1,11 @@
 ---
 # nuzlocke-tracker-2fp1
 title: Show owner info in admin pages
-status: completed
+status: in-progress
 type: feature
 priority: normal
-tags:
-    - -failed
-    - failed
 created_at: 2026-03-21T12:18:51Z
-updated_at: 2026-03-22T09:08:07Z
+updated_at: 2026-03-21T12:37:36Z
 parent: nuzlocke-tracker-wwnu
 ---
 
@@ -44,19 +41,3 @@ Admin pages (`AdminRuns.tsx`, `AdminGenlockes.tsx`) don't show which user owns e
 - [x] Add Owner column to `AdminRuns.tsx`
 - [x] Add Owner column to `AdminGenlockes.tsx`
 - [x] Add owner filter to both admin pages
-
-
-## Summary of Changes
-
-The "show owner info in admin pages" feature was fully implemented:
-
-**Backend:**
-- Genlocke list API now includes owner info resolved from the first leg's run
-- Added `GenlockeOwnerResponse` schema with `id` and `display_name` fields
-
-**Frontend:**
-- `AdminRuns.tsx`: Added Owner column showing email/display name with "No owner" fallback
-- `AdminGenlockes.tsx`: Added Owner column with same pattern
-- Both pages include owner filter dropdown with "All owners", "No owner", and per-user options
-
-Commit: `a3f332f feat: show owner info in admin pages`

.beans/nuzlocke-tracker-532i--ux-remove-level-field-from-boss-defeat-modal.md

@@ -1,11 +1,11 @@
 ---
 # nuzlocke-tracker-532i
 title: 'UX: Make level field optional in boss defeat modal'
-status: completed
+status: todo
 type: feature
 priority: normal
 created_at: 2026-03-21T21:50:48Z
-updated_at: 2026-03-22T09:16:12Z
+updated_at: 2026-03-21T22:04:08Z
 ---
 
 ## Problem
@@ -22,17 +22,8 @@ When recording which team members beat a boss, users must manually enter a level
 
 Remove the level field entirely from the UI and make it optional in the backend:
 
-- [x] Remove level input from `BossDefeatModal.tsx`
-- [x] Make `level` column nullable in the database (alembic migration)
-- [x] Update the API schema to make level optional (default to null)
-- [x] Update any backend validation that requires level
-- [x] Verify boss result display still works without level data
-
-
-## Summary of Changes
-
-- Removed level input field from BossDefeatModal.tsx, simplifying team selection to just checkboxes
-- Created alembic migration to make boss_result_team.level column nullable
-- Updated SQLAlchemy model and Pydantic schemas to make level optional (defaults to null)
-- Updated RunEncounters.tsx to conditionally render level only when present
-- Updated frontend TypeScript types for BossResultTeamMember and BossResultTeamMemberInput
+- [ ] Remove level input from `BossDefeatModal.tsx`
+- [ ] Make `level` column nullable in the database (alembic migration)
+- [ ] Update the API schema to make level optional (default to null)
+- [ ] Update any backend validation that requires level
+- [ ] Verify boss result display still works without level data

.beans/nuzlocke-tracker-95g1--crash-hide-edit-controls-for-non-owners-in-fronten.md

@@ -1,28 +0,0 @@
----
-# nuzlocke-tracker-95g1
-title: 'Crash: Hide edit controls for non-owners in frontend'
-status: completed
-type: bug
-priority: high
-created_at: 2026-03-22T09:41:57Z
-updated_at: 2026-03-22T09:46:59Z
-parent: nuzlocke-tracker-bw1m
-blocking:
-    - nuzlocke-tracker-i2va
----
-
-Bean was found in 'in-progress' status on startup but no agent was running.
-This likely indicates a crash or unexpected termination.
-
-Manual review required before retrying.
-
-Bean: nuzlocke-tracker-i2va
-Title: Hide edit controls for non-owners in frontend
-
-## Reasons for Scrapping
-
-This crash bean is a false positive. The original task (nuzlocke-tracker-i2va) was already completed and merged to `develop` before this crash bean was created:
-- Commit `3bd24fc`: fix: hide edit controls for non-owners in frontend
-- Commit `118dbca`: chore: mark bean nuzlocke-tracker-i2va as completed
-
-No additional work required.

.beans/nuzlocke-tracker-9rm8--crash-optional-totp-mfa-for-emailpassword-accounts.md

@@ -1,32 +0,0 @@
----
-# nuzlocke-tracker-9rm8
-title: 'Crash: Optional TOTP MFA for email/password accounts'
-status: completed
-type: bug
-priority: high
-created_at: 2026-03-22T09:41:57Z
-updated_at: 2026-03-22T09:46:30Z
-parent: nuzlocke-tracker-bw1m
-blocking:
-    - nuzlocke-tracker-f2hs
----
-
-Bean was found in 'in-progress' status on startup but no agent was running.
-This likely indicates a crash or unexpected termination.
-
-Manual review required before retrying.
-
-Bean: nuzlocke-tracker-f2hs
-Title: Optional TOTP MFA for email/password accounts
-
-## Reasons for Scrapping
-
-False positive crash bean. The original MFA bean (nuzlocke-tracker-f2hs) was already completed and merged via PR #76 before this crash bean was created. All checklist items were done:
-- MFA enrollment UI with QR code
-- Backup secret display
-- TOTP challenge during login
-- AAL level checking
-- Disable MFA option
-- OAuth user detection
-
-No action required.

.beans/nuzlocke-tracker-f2hs--optional-totp-mfa-for-emailpassword-accounts.md

@@ -1,11 +1,11 @@
 ---
 # nuzlocke-tracker-f2hs
 title: Optional TOTP MFA for email/password accounts
-status: completed
+status: in-progress
 type: feature
 priority: normal
 created_at: 2026-03-21T12:19:18Z
-updated_at: 2026-03-22T09:06:25Z
+updated_at: 2026-03-21T12:56:34Z
 parent: nuzlocke-tracker-wwnu
 ---
 
@@ -52,14 +52,5 @@ Supabase has built-in TOTP MFA support via the `supabase.auth.mfa` API. This sho
 - [x] Check AAL after login and redirect to TOTP if needed
 - [x] Add "Disable MFA" with re-verification
 - [x] Only show MFA options for email/password users
-- [x] Test: full enrollment → login → TOTP flow
+- [ ] Test: full enrollment → login → TOTP flow
 - [N/A] Test: recovery code works when TOTP unavailable (Supabase doesn't provide recovery codes; users save their secret key instead)
-
-## Summary of Changes
-
-Implementation completed and merged to develop via PR #76:
-- Settings page with MFA enrollment UI (QR code + backup secret display)
-- Login flow with TOTP challenge step for enrolled users
-- AAL level checking after login to require TOTP when needed
-- Disable MFA option with TOTP re-verification
-- OAuth user detection to hide MFA options (Google/Discord users use their provider's MFA)

.beans/nuzlocke-tracker-hpr7--crash-show-owner-info-in-admin-pages.md

@@ -1,35 +0,0 @@
----
-# nuzlocke-tracker-hpr7
-title: 'Crash: Show owner info in admin pages'
-status: completed
-type: bug
-priority: high
-created_at: 2026-03-22T08:59:10Z
-updated_at: 2026-03-22T09:08:13Z
-parent: nuzlocke-tracker-bw1m
-blocking:
-    - nuzlocke-tracker-2fp1
----
-
-Bean was found in 'in-progress' status on startup but no agent was running.
-This likely indicates a crash or unexpected termination.
-
-Manual review required before retrying.
-
-Bean: nuzlocke-tracker-2fp1
-Title: Show owner info in admin pages
-
-
-## Summary of Changes
-
-**Investigation findings:**
-- The original bean (nuzlocke-tracker-2fp1) had all checklist items marked complete
-- The implementation was committed to `feature/enforce-run-ownership-on-all-mutation-endpoints` branch
-- Commit `a3f332f feat: show owner info in admin pages` contains the complete implementation
-- This commit is already merged into `develop`
-- Frontend type checks pass, confirming the implementation is correct
-
-**Resolution:**
-- Marked the original bean (nuzlocke-tracker-2fp1) as completed
-- The agent crashed after completing the work but before marking the bean as done
-- No code changes needed - work was already complete

.beans/nuzlocke-tracker-i2va--hide-edit-controls-for-non-owners-in-frontend.md

@@ -1,13 +1,11 @@
 ---
 # nuzlocke-tracker-i2va
 title: Hide edit controls for non-owners in frontend
-status: completed
+status: in-progress
 type: bug
 priority: critical
-tags:
-    - failed
 created_at: 2026-03-21T12:18:38Z
-updated_at: 2026-03-22T09:03:08Z
+updated_at: 2026-03-21T12:32:45Z
 parent: nuzlocke-tracker-wwnu
 blocked_by:
     - nuzlocke-tracker-73ba
@@ -41,12 +39,3 @@ blocked_by:
 - [x] Guard all mutation triggers in `RunDashboard.tsx` behind `canEdit`
 - [x] Add read-only indicator/banner for non-owner viewers
 - [x] Verify logged-out users see no edit controls on public runs
-
-## Summary of Changes
-
-- Added `useAuth` hook and `canEdit = isOwner` logic to `RunEncounters.tsx`
-- Updated `RunDashboard.tsx` to use strict `canEdit = isOwner` (removed unowned fallback)
-- All mutation UI elements (encounter modals, boss defeat buttons, status changes, end run, shiny/egg encounters, transfers, HoF team, visibility toggle) are now conditionally rendered based on `canEdit`
-- Added read-only banner for non-owner viewers in both pages
-
-Committed in `3bd24fc` and merged to `develop`.

.beans/nuzlocke-tracker-kmgz--crash-optional-totp-mfa-for-emailpassword-accounts.md

@@ -1,33 +0,0 @@
----
-# nuzlocke-tracker-kmgz
-title: 'Crash: Optional TOTP MFA for email/password accounts'
-status: completed
-type: bug
-priority: high
-created_at: 2026-03-22T08:59:10Z
-updated_at: 2026-03-22T09:06:21Z
-parent: nuzlocke-tracker-bw1m
-blocking:
-    - nuzlocke-tracker-f2hs
----
-
-Bean was found in 'in-progress' status on startup but no agent was running.
-This likely indicates a crash or unexpected termination.
-
-Manual review required before retrying.
-
-Bean: nuzlocke-tracker-f2hs
-Title: Optional TOTP MFA for email/password accounts
-
-## Summary of Changes
-
-**Crash Recovery Analysis:**
-
-The crash bean was created because nuzlocke-tracker-f2hs was found in 'in-progress' status on startup. Upon investigation:
-
-1. **Work was already complete** - The MFA feature was fully implemented and merged to develop via PR #76 (commit 7a828d7)
-2. **Only testing remained** - The checklist showed all implementation items done, with only 'Test: full enrollment → login → TOTP flow' unchecked
-3. **Code verified** - Reviewed Settings.tsx, Login.tsx, and AuthContext.tsx - all MFA functionality present
-4. **Tests pass** - 118 frontend tests pass, TypeScript compiles cleanly
-
-**Resolution:** Marked the test item as complete and closed the original bean. No code changes needed - the feature was already shipped.

.beans/nuzlocke-tracker-ks9c--crash-hide-edit-controls-for-non-owners-in-fronten.md

@@ -1,26 +0,0 @@
----
-# nuzlocke-tracker-ks9c
-title: 'Crash: Hide edit controls for non-owners in frontend'
-status: completed
-type: bug
-priority: high
-created_at: 2026-03-22T08:59:10Z
-updated_at: 2026-03-22T09:03:12Z
-parent: nuzlocke-tracker-bw1m
-blocking:
-    - nuzlocke-tracker-i2va
----
-
-Bean was found in 'in-progress' status on startup but no agent was running.
-This likely indicates a crash or unexpected termination.
-
-Manual review required before retrying.
-
-Bean: nuzlocke-tracker-i2va
-Title: Hide edit controls for non-owners in frontend
-
-## Resolution
-
-The work for the original bean (`nuzlocke-tracker-i2va`) was already complete and committed (`3bd24fc`) before the crash occurred. The agent crashed after committing but before updating bean status.
-
-Verified all checklist items were implemented correctly and merged to `develop`. Marked the original bean as completed.

.beans/nuzlocke-tracker-lkro--ux-make-team-section-a-floating-sidebar-on-desktop.md

@@ -1,11 +1,11 @@
 ---
 # nuzlocke-tracker-lkro
 title: 'UX: Make team section a floating sidebar on desktop'
-status: completed
+status: todo
 type: feature
 priority: normal
 created_at: 2026-03-21T21:50:48Z
-updated_at: 2026-03-22T09:11:58Z
+updated_at: 2026-03-22T08:08:13Z
 ---
 
 ## Problem
@@ -28,31 +28,9 @@ Alternative: A floating action button (FAB) that opens the team in a slide-over
 
 ## Checklist
 
-- [x] Add responsive 2-column layout to RunEncounters page (desktop only)
-- [x] Move team section into a sticky sidebar column
-- [x] Ensure sidebar scrolls independently if team is taller than viewport
-- [x] Keep current stacked layout on mobile/tablet
-- [x] Test with various team sizes (0-6 pokemon)
-- [x] Test evolution/nickname editing still works from sidebar
-
-## Summary of Changes
-
-Implemented a responsive 2-column layout for the RunEncounters page:
-
-**Desktop (lg, ≥1024px):**
-- Encounters list on the left in a flex column
-- Team section in a 256px sticky sidebar on the right
-- Sidebar stays visible while scrolling through routes and bosses
-- Independent scrolling for sidebar when team is taller than viewport (max-h-[calc(100vh-6rem)] overflow-y-auto)
-- 2-column grid for pokemon cards in sidebar
-
-**Mobile/Tablet (<1024px):**
-- Original stacked layout preserved (team above encounters)
-- Collapsible team section with expand/collapse toggle
-
-**Technical changes:**
-- Page container widened from max-w-4xl to lg:max-w-6xl
-- Added lg:flex lg:gap-6 wrapper for 2-column layout
-- Mobile team section hidden on lg with lg:hidden
-- Desktop sidebar hidden below lg with hidden lg:block
-- Sidebar styled with bg-surface-1 border and rounded corners
+- [ ] Add responsive 2-column layout to RunEncounters page (desktop only)
+- [ ] Move team section into a sticky sidebar column
+- [ ] Ensure sidebar scrolls independently if team is taller than viewport
+- [ ] Keep current stacked layout on mobile/tablet
+- [ ] Test with various team sizes (0-6 pokemon)
+- [ ] Test evolution/nickname editing still works from sidebar

.beans/nuzlocke-tracker-snft--support-es256-ecc-p-256-jwt-keys-in-backend-auth.md

@@ -1,15 +0,0 @@
----
-# nuzlocke-tracker-snft
-title: Support ES256 (ECC P-256) JWT keys in backend auth
-status: completed
-type: bug
-priority: normal
-created_at: 2026-03-22T10:51:30Z
-updated_at: 2026-03-22T10:59:46Z
----
-
-Backend JWKS verification only accepts RS256 algorithm, but Supabase JWT key was switched to ECC P-256 (ES256). This causes 401 errors on all authenticated requests. Fix: accept both RS256 and ES256 in the algorithms list, and update tests accordingly.
-
-## Summary of Changes\n\nAdded ES256 to the accepted JWT algorithms in `_verify_jwt()` so ECC P-256 keys from Supabase are verified correctly alongside RSA keys. Added corresponding test with EC key fixtures.
-
-Deployed to production via PR #86 merge on 2026-03-22.

.beans/nuzlocke-tracker-tatg--bug-intermittent-401-errors-failed-save-load-requi.md

@@ -1,11 +1,11 @@
 ---
 # nuzlocke-tracker-tatg
 title: 'Bug: Intermittent 401 errors / failed save-load requiring page reload'
-status: completed
+status: todo
 type: bug
 priority: high
 created_at: 2026-03-21T21:50:48Z
-updated_at: 2026-03-22T09:44:54Z
+updated_at: 2026-03-21T21:50:48Z
 ---
 
 ## Problem
@@ -26,19 +26,8 @@ During gameplay, the app intermittently fails to load or save data. A page reloa
 
 ## Proposed Fix
 
-- [x] Add token refresh logic before API calls (check expiry, call `refreshSession()` if needed)
-- [x] Add 401 response interceptor that automatically refreshes token and retries the request
-- [x] Verify Supabase client `autoRefreshToken` option is enabled
-- [x] Test with short-lived tokens to confirm refresh works (manual verification needed)
-- [x] Check if there's a race condition when multiple API calls trigger refresh simultaneously (supabase-js v2 handles this with internal mutex)
-
-## Summary of Changes
-
-- **supabase.ts**: Explicitly enabled `autoRefreshToken: true` and `persistSession: true` in client options
-- **client.ts**: Added `getValidAccessToken()` that checks token expiry (with 60s buffer) and proactively refreshes before API calls
-- **client.ts**: Added 401 interceptor in `request()` that retries once with a fresh token
-
-The fix addresses the root cause by:
-1. Proactively refreshing tokens before they expire (prevents most 401s)
-2. Catching any 401s that slip through and automatically retrying with a refreshed token
-3. Ensuring the Supabase client is configured to auto-refresh tokens in the background
+- [ ] Add token refresh logic before API calls (check expiry, call `refreshSession()` if needed)
+- [ ] Add 401 response interceptor that automatically refreshes token and retries the request
+- [ ] Verify Supabase client `autoRefreshToken` option is enabled
+- [ ] Test with short-lived tokens to confirm refresh works
+- [ ] Check if there's a race condition when multiple API calls trigger refresh simultaneously

backend/pyproject.toml

@@ -14,7 +14,7 @@ dependencies = [
     "asyncpg==0.31.0",
     "alembic==1.18.4",
     "PyJWT==2.12.1",
-    "cryptography==46.0.7",
+    "cryptography==45.0.7",
 ]
 
 [project.optional-dependencies]

backend/src/app/alembic/versions/903e0cdbfe5a_make_boss_result_team_level_nullable.py

@@ -1,37 +0,0 @@
-"""make_boss_result_team_level_nullable
-
-Revision ID: 903e0cdbfe5a
-Revises: p7e8f9a0b1c2
-Create Date: 2026-03-22 10:13:41.828406
-
-"""
-
-from collections.abc import Sequence
-
-import sqlalchemy as sa
-from alembic import op
-
-# revision identifiers, used by Alembic.
-revision: str = "903e0cdbfe5a"
-down_revision: str | Sequence[str] | None = "p7e8f9a0b1c2"
-branch_labels: str | Sequence[str] | None = None
-depends_on: str | Sequence[str] | None = None
-
-
-def upgrade() -> None:
-    op.alter_column(
-        "boss_result_team",
-        "level",
-        existing_type=sa.SmallInteger(),
-        nullable=True,
-    )
-
-
-def downgrade() -> None:
-    op.execute("UPDATE boss_result_team SET level = 1 WHERE level IS NULL")
-    op.alter_column(
-        "boss_result_team",
-        "level",
-        existing_type=sa.SmallInteger(),
-        nullable=False,
-    )

backend/src/app/api/health.py

@@ -1,10 +1,6 @@
-import urllib.request
-
-from fastapi import APIRouter, Request
+from fastapi import APIRouter
 from sqlalchemy import text
 
-from app.core.auth import _build_jwks_url, _extract_token, _get_jwks_client
-from app.core.config import settings
 from app.core.database import async_session
 
 router = APIRouter(tags=["health"])
@@ -27,45 +23,3 @@ async def health_check():
 async def root():
     """Root endpoint."""
     return {"message": "Nuzlocke Tracker API", "docs": "/docs"}
-
-
-@router.get("/auth-debug")
-async def auth_debug(request: Request):
-    """Temporary diagnostic endpoint for auth debugging."""
-    result: dict = {}
-
-    # Config
-    result["supabase_url"] = settings.supabase_url
-    result["has_jwt_secret"] = bool(settings.supabase_jwt_secret)
-    result["jwks_url"] = (
-        _build_jwks_url(settings.supabase_url) if settings.supabase_url else None
-    )
-
-    # JWKS fetch
-    jwks_url = result["jwks_url"]
-    if jwks_url:
-        try:
-            with urllib.request.urlopen(jwks_url, timeout=5) as resp:
-                result["jwks_status"] = resp.status
-                result["jwks_body"] = resp.read().decode()
-        except Exception as e:
-            result["jwks_fetch_error"] = str(e)
-
-    # JWKS client
-    client = _get_jwks_client()
-    result["jwks_client_exists"] = client is not None
-
-    # Token info (header only, no secrets)
-    token = _extract_token(request)
-    if token:
-        import jwt
-
-        try:
-            header = jwt.get_unverified_header(token)
-            result["token_header"] = header
-        except Exception as e:
-            result["token_header_error"] = str(e)
-    else:
-        result["token"] = "not provided"
-
-    return result

backend/src/app/core/auth.py

@@ -1,4 +1,3 @@
-import logging
 from dataclasses import dataclass
 from uuid import UUID
 
@@ -13,7 +12,6 @@ from app.core.database import get_session
 from app.models.nuzlocke_run import NuzlockeRun
 from app.models.user import User
 
-logger = logging.getLogger(__name__)
 _jwks_client: PyJWKClient | None = None
 
 
@@ -26,21 +24,11 @@ class AuthUser:
     role: str | None = None
 
 
-def _build_jwks_url(base_url: str) -> str:
-    """Build the JWKS URL, adding /auth/v1 prefix for Supabase Cloud."""
-    base = base_url.rstrip("/")
-    if "/auth/v1" in base:
-        return f"{base}/.well-known/jwks.json"
-    # Supabase Cloud URLs need the /auth/v1 prefix;
-    # local GoTrue serves JWKS at root but uses HS256 fallback anyway.
-    return f"{base}/auth/v1/.well-known/jwks.json"
-
-
 def _get_jwks_client() -> PyJWKClient | None:
     """Get or create a cached JWKS client."""
     global _jwks_client
     if _jwks_client is None and settings.supabase_url:
-        jwks_url = _build_jwks_url(settings.supabase_url)
+        jwks_url = f"{settings.supabase_url.rstrip('/')}/.well-known/jwks.json"
         _jwks_client = PyJWKClient(jwks_url, cache_jwk_set=True, lifespan=300)
     return _jwks_client
 
@@ -72,7 +60,7 @@ def _verify_jwt_hs256(token: str) -> dict | None:
 
 
 def _verify_jwt(token: str) -> dict | None:
-    """Verify JWT using JWKS (RS256/ES256), falling back to HS256 shared secret."""
+    """Verify JWT using JWKS (RS256), falling back to HS256 shared secret."""
     client = _get_jwks_client()
     if client:
         try:
@@ -80,17 +68,15 @@ def _verify_jwt(token: str) -> dict | None:
             return jwt.decode(
                 token,
                 signing_key.key,
-                algorithms=["RS256", "ES256"],
+                algorithms=["RS256"],
                 audience="authenticated",
             )
-        except jwt.InvalidTokenError as e:
-            logger.warning("JWKS JWT validation failed: %s", e)
-        except PyJWKClientError as e:
-            logger.warning("JWKS client error: %s", e)
-        except PyJWKSetError as e:
-            logger.warning("JWKS set error: %s", e)
-    else:
-        logger.warning("No JWKS client available (SUPABASE_URL not set?)")
+        except jwt.InvalidTokenError:
+            pass
+        except PyJWKClientError:
+            pass
+        except PyJWKSetError:
+            pass
     return _verify_jwt_hs256(token)
 
 

backend/src/app/models/boss_result_team.py

@@ -14,7 +14,7 @@ class BossResultTeam(Base):
     encounter_id: Mapped[int] = mapped_column(
         ForeignKey("encounters.id", ondelete="CASCADE"), index=True
     )
-    level: Mapped[int | None] = mapped_column(SmallInteger, nullable=True)
+    level: Mapped[int] = mapped_column(SmallInteger)
 
     boss_result: Mapped[BossResult] = relationship(back_populates="team")
     encounter: Mapped[Encounter] = relationship()

backend/src/app/schemas/boss.py

@@ -57,7 +57,7 @@ class BossBattleResponse(CamelModel):
 class BossResultTeamMemberResponse(CamelModel):
     id: int
     encounter_id: int
-    level: int | None
+    level: int
 
 
 class BossResultResponse(CamelModel):
@@ -120,7 +120,7 @@ class BossPokemonInput(CamelModel):
 
 class BossResultTeamMemberInput(CamelModel):
     encounter_id: int
-    level: int | None = None
+    level: int
 
 
 class BossResultCreate(CamelModel):

backend/tests/test_auth.py

@@ -4,7 +4,7 @@ from uuid import UUID
 
 import jwt
 import pytest
-from cryptography.hazmat.primitives.asymmetric import ec, rsa
+from cryptography.hazmat.primitives.asymmetric import rsa
 from httpx import ASGITransport, AsyncClient
 
 from app.core.auth import AuthUser, get_current_user, require_admin, require_auth
@@ -73,55 +73,6 @@ def mock_jwks_client(rsa_key_pair):
     return mock_client
 
 
-@pytest.fixture(scope="module")
-def ec_key_pair():
-    """Generate EC P-256 key pair for testing."""
-    private_key = ec.generate_private_key(ec.SECP256R1())
-    public_key = private_key.public_key()
-    return private_key, public_key
-
-
-@pytest.fixture
-def valid_es256_token(ec_key_pair):
-    """Generate a valid ES256 JWT token."""
-    private_key, _ = ec_key_pair
-    payload = {
-        "sub": "user-456",
-        "email": "ec-user@example.com",
-        "role": "authenticated",
-        "aud": "authenticated",
-        "exp": int(time.time()) + 3600,
-    }
-    return jwt.encode(payload, private_key, algorithm="ES256")
-
-
-@pytest.fixture
-def mock_jwks_client_ec(ec_key_pair):
-    """Create a mock JWKS client that returns our test EC public key."""
-    _, public_key = ec_key_pair
-    mock_client = MagicMock()
-    mock_signing_key = MagicMock()
-    mock_signing_key.key = public_key
-    mock_client.get_signing_key_from_jwt.return_value = mock_signing_key
-    return mock_client
-
-
-async def test_get_current_user_valid_es256_token(
-    valid_es256_token, mock_jwks_client_ec
-):
-    """Test get_current_user works with ES256 (ECC P-256) tokens."""
-    with patch("app.core.auth._get_jwks_client", return_value=mock_jwks_client_ec):
-
-        class MockRequest:
-            headers = {"Authorization": f"Bearer {valid_es256_token}"}
-
-        user = get_current_user(MockRequest())
-        assert user is not None
-        assert user.id == "user-456"
-        assert user.email == "ec-user@example.com"
-        assert user.role == "authenticated"
-
-
 async def test_get_current_user_valid_token(valid_token, mock_jwks_client):
     """Test get_current_user returns user for valid token."""
     with patch("app.core.auth._get_jwks_client", return_value=mock_jwks_client):

backend/uv.lock

@@ -64,7 +64,7 @@ dev = [
 requires-dist = [
     { name = "alembic", specifier = "==1.18.4" },
     { name = "asyncpg", specifier = "==0.31.0" },
-    { name = "cryptography", specifier = "==46.0.7" },
+    { name = "cryptography", specifier = "==45.0.3" },
     { name = "fastapi", specifier = "==0.135.1" },
     { name = "httpx", marker = "extra == 'dev'", specifier = "==0.28.1" },
     { name = "pydantic", specifier = "==2.12.5" },
@@ -181,55 +181,37 @@ wheels = [
 
 [[package]]
 name = "cryptography"
-version = "46.0.7"
+version = "45.0.3"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cffi", marker = "platform_python_implementation != 'PyPy'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/47/93/ac8f3d5ff04d54bc814e961a43ae5b0b146154c89c61b47bb07557679b18/cryptography-46.0.7.tar.gz", hash = "sha256:e4cfd68c5f3e0bfdad0d38e023239b96a2fe84146481852dffbcca442c245aa5", size = 750652, upload-time = "2026-04-08T01:57:54.692Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/13/1f/9fa001e74a1993a9cadd2333bb889e50c66327b8594ac538ab8a04f915b7/cryptography-45.0.3.tar.gz", hash = "sha256:ec21313dd335c51d7877baf2972569f40a4291b76a0ce51391523ae358d05899", size = 744738, upload-time = "2025-05-25T14:17:24.777Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/0b/5d/4a8f770695d73be252331e60e526291e3df0c9b27556a90a6b47bccca4c2/cryptography-46.0.7-cp311-abi3-macosx_10_9_universal2.whl", hash = "sha256:ea42cbe97209df307fdc3b155f1b6fa2577c0defa8f1f7d3be7d31d189108ad4", size = 7179869, upload-time = "2026-04-08T01:56:17.157Z" },
-    { url = "https://files.pythonhosted.org/packages/5f/45/6d80dc379b0bbc1f9d1e429f42e4cb9e1d319c7a8201beffd967c516ea01/cryptography-46.0.7-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:b36a4695e29fe69215d75960b22577197aca3f7a25b9cf9d165dcfe9d80bc325", size = 4275492, upload-time = "2026-04-08T01:56:19.36Z" },
-    { url = "https://files.pythonhosted.org/packages/4a/9a/1765afe9f572e239c3469f2cb429f3ba7b31878c893b246b4b2994ffe2fe/cryptography-46.0.7-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:5ad9ef796328c5e3c4ceed237a183f5d41d21150f972455a9d926593a1dcb308", size = 4426670, upload-time = "2026-04-08T01:56:21.415Z" },
-    { url = "https://files.pythonhosted.org/packages/8f/3e/af9246aaf23cd4ee060699adab1e47ced3f5f7e7a8ffdd339f817b446462/cryptography-46.0.7-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:73510b83623e080a2c35c62c15298096e2a5dc8d51c3b4e1740211839d0dea77", size = 4280275, upload-time = "2026-04-08T01:56:23.539Z" },
-    { url = "https://files.pythonhosted.org/packages/0f/54/6bbbfc5efe86f9d71041827b793c24811a017c6ac0fd12883e4caa86b8ed/cryptography-46.0.7-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:cbd5fb06b62bd0721e1170273d3f4d5a277044c47ca27ee257025146c34cbdd1", size = 4928402, upload-time = "2026-04-08T01:56:25.624Z" },
-    { url = "https://files.pythonhosted.org/packages/2d/cf/054b9d8220f81509939599c8bdbc0c408dbd2bdd41688616a20731371fe0/cryptography-46.0.7-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:420b1e4109cc95f0e5700eed79908cef9268265c773d3a66f7af1eef53d409ef", size = 4459985, upload-time = "2026-04-08T01:56:27.309Z" },
-    { url = "https://files.pythonhosted.org/packages/f9/46/4e4e9c6040fb01c7467d47217d2f882daddeb8828f7df800cb806d8a2288/cryptography-46.0.7-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:24402210aa54baae71d99441d15bb5a1919c195398a87b563df84468160a65de", size = 3990652, upload-time = "2026-04-08T01:56:29.095Z" },
-    { url = "https://files.pythonhosted.org/packages/36/5f/313586c3be5a2fbe87e4c9a254207b860155a8e1f3cca99f9910008e7d08/cryptography-46.0.7-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:8a469028a86f12eb7d2fe97162d0634026d92a21f3ae0ac87ed1c4a447886c83", size = 4279805, upload-time = "2026-04-08T01:56:30.928Z" },
-    { url = "https://files.pythonhosted.org/packages/69/33/60dfc4595f334a2082749673386a4d05e4f0cf4df8248e63b2c3437585f2/cryptography-46.0.7-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:9694078c5d44c157ef3162e3bf3946510b857df5a3955458381d1c7cfc143ddb", size = 4892883, upload-time = "2026-04-08T01:56:32.614Z" },
-    { url = "https://files.pythonhosted.org/packages/c7/0b/333ddab4270c4f5b972f980adef4faa66951a4aaf646ca067af597f15563/cryptography-46.0.7-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:42a1e5f98abb6391717978baf9f90dc28a743b7d9be7f0751a6f56a75d14065b", size = 4459756, upload-time = "2026-04-08T01:56:34.306Z" },
-    { url = "https://files.pythonhosted.org/packages/d2/14/633913398b43b75f1234834170947957c6b623d1701ffc7a9600da907e89/cryptography-46.0.7-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:91bbcb08347344f810cbe49065914fe048949648f6bd5c2519f34619142bbe85", size = 4410244, upload-time = "2026-04-08T01:56:35.977Z" },
-    { url = "https://files.pythonhosted.org/packages/10/f2/19ceb3b3dc14009373432af0c13f46aa08e3ce334ec6eff13492e1812ccd/cryptography-46.0.7-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:5d1c02a14ceb9148cc7816249f64f623fbfee39e8c03b3650d842ad3f34d637e", size = 4674868, upload-time = "2026-04-08T01:56:38.034Z" },
-    { url = "https://files.pythonhosted.org/packages/1a/bb/a5c213c19ee94b15dfccc48f363738633a493812687f5567addbcbba9f6f/cryptography-46.0.7-cp311-abi3-win32.whl", hash = "sha256:d23c8ca48e44ee015cd0a54aeccdf9f09004eba9fc96f38c911011d9ff1bd457", size = 3026504, upload-time = "2026-04-08T01:56:39.666Z" },
-    { url = "https://files.pythonhosted.org/packages/2b/02/7788f9fefa1d060ca68717c3901ae7fffa21ee087a90b7f23c7a603c32ae/cryptography-46.0.7-cp311-abi3-win_amd64.whl", hash = "sha256:397655da831414d165029da9bc483bed2fe0e75dde6a1523ec2fe63f3c46046b", size = 3488363, upload-time = "2026-04-08T01:56:41.893Z" },
-    { url = "https://files.pythonhosted.org/packages/7b/56/15619b210e689c5403bb0540e4cb7dbf11a6bf42e483b7644e471a2812b3/cryptography-46.0.7-cp314-cp314t-macosx_10_9_universal2.whl", hash = "sha256:d151173275e1728cf7839aaa80c34fe550c04ddb27b34f48c232193df8db5842", size = 7119671, upload-time = "2026-04-08T01:56:44Z" },
-    { url = "https://files.pythonhosted.org/packages/74/66/e3ce040721b0b5599e175ba91ab08884c75928fbeb74597dd10ef13505d2/cryptography-46.0.7-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:db0f493b9181c7820c8134437eb8b0b4792085d37dbb24da050476ccb664e59c", size = 4268551, upload-time = "2026-04-08T01:56:46.071Z" },
-    { url = "https://files.pythonhosted.org/packages/03/11/5e395f961d6868269835dee1bafec6a1ac176505a167f68b7d8818431068/cryptography-46.0.7-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:ebd6daf519b9f189f85c479427bbd6e9c9037862cf8fe89ee35503bd209ed902", size = 4408887, upload-time = "2026-04-08T01:56:47.718Z" },
-    { url = "https://files.pythonhosted.org/packages/40/53/8ed1cf4c3b9c8e611e7122fb56f1c32d09e1fff0f1d77e78d9ff7c82653e/cryptography-46.0.7-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:b7b412817be92117ec5ed95f880defe9cf18a832e8cafacf0a22337dc1981b4d", size = 4271354, upload-time = "2026-04-08T01:56:49.312Z" },
-    { url = "https://files.pythonhosted.org/packages/50/46/cf71e26025c2e767c5609162c866a78e8a2915bbcfa408b7ca495c6140c4/cryptography-46.0.7-cp314-cp314t-manylinux_2_28_ppc64le.whl", hash = "sha256:fbfd0e5f273877695cb93baf14b185f4878128b250cc9f8e617ea0c025dfb022", size = 4905845, upload-time = "2026-04-08T01:56:50.916Z" },
-    { url = "https://files.pythonhosted.org/packages/c0/ea/01276740375bac6249d0a971ebdf6b4dc9ead0ee0a34ef3b5a88c1a9b0d4/cryptography-46.0.7-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:ffca7aa1d00cf7d6469b988c581598f2259e46215e0140af408966a24cf086ce", size = 4444641, upload-time = "2026-04-08T01:56:52.882Z" },
-    { url = "https://files.pythonhosted.org/packages/3d/4c/7d258f169ae71230f25d9f3d06caabcff8c3baf0978e2b7d65e0acac3827/cryptography-46.0.7-cp314-cp314t-manylinux_2_31_armv7l.whl", hash = "sha256:60627cf07e0d9274338521205899337c5d18249db56865f943cbe753aa96f40f", size = 3967749, upload-time = "2026-04-08T01:56:54.597Z" },
-    { url = "https://files.pythonhosted.org/packages/b5/2a/2ea0767cad19e71b3530e4cad9605d0b5e338b6a1e72c37c9c1ceb86c333/cryptography-46.0.7-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:80406c3065e2c55d7f49a9550fe0c49b3f12e5bfff5dedb727e319e1afb9bf99", size = 4270942, upload-time = "2026-04-08T01:56:56.416Z" },
-    { url = "https://files.pythonhosted.org/packages/41/3d/fe14df95a83319af25717677e956567a105bb6ab25641acaa093db79975d/cryptography-46.0.7-cp314-cp314t-manylinux_2_34_ppc64le.whl", hash = "sha256:c5b1ccd1239f48b7151a65bc6dd54bcfcc15e028c8ac126d3fada09db0e07ef1", size = 4871079, upload-time = "2026-04-08T01:56:58.31Z" },
-    { url = "https://files.pythonhosted.org/packages/9c/59/4a479e0f36f8f378d397f4eab4c850b4ffb79a2f0d58704b8fa0703ddc11/cryptography-46.0.7-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:d5f7520159cd9c2154eb61eb67548ca05c5774d39e9c2c4339fd793fe7d097b2", size = 4443999, upload-time = "2026-04-08T01:57:00.508Z" },
-    { url = "https://files.pythonhosted.org/packages/28/17/b59a741645822ec6d04732b43c5d35e4ef58be7bfa84a81e5ae6f05a1d33/cryptography-46.0.7-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:fcd8eac50d9138c1d7fc53a653ba60a2bee81a505f9f8850b6b2888555a45d0e", size = 4399191, upload-time = "2026-04-08T01:57:02.654Z" },
-    { url = "https://files.pythonhosted.org/packages/59/6a/bb2e166d6d0e0955f1e9ff70f10ec4b2824c9cfcdb4da772c7dd69cc7d80/cryptography-46.0.7-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:65814c60f8cc400c63131584e3e1fad01235edba2614b61fbfbfa954082db0ee", size = 4655782, upload-time = "2026-04-08T01:57:04.592Z" },
-    { url = "https://files.pythonhosted.org/packages/95/b6/3da51d48415bcb63b00dc17c2eff3a651b7c4fed484308d0f19b30e8cb2c/cryptography-46.0.7-cp314-cp314t-win32.whl", hash = "sha256:fdd1736fed309b4300346f88f74cd120c27c56852c3838cab416e7a166f67298", size = 3002227, upload-time = "2026-04-08T01:57:06.91Z" },
-    { url = "https://files.pythonhosted.org/packages/32/a8/9f0e4ed57ec9cebe506e58db11ae472972ecb0c659e4d52bbaee80ca340a/cryptography-46.0.7-cp314-cp314t-win_amd64.whl", hash = "sha256:e06acf3c99be55aa3b516397fe42f5855597f430add9c17fa46bf2e0fb34c9bb", size = 3475332, upload-time = "2026-04-08T01:57:08.807Z" },
-    { url = "https://files.pythonhosted.org/packages/a7/7f/cd42fc3614386bc0c12f0cb3c4ae1fc2bbca5c9662dfed031514911d513d/cryptography-46.0.7-cp38-abi3-macosx_10_9_universal2.whl", hash = "sha256:462ad5cb1c148a22b2e3bcc5ad52504dff325d17daf5df8d88c17dda1f75f2a4", size = 7165618, upload-time = "2026-04-08T01:57:10.645Z" },
-    { url = "https://files.pythonhosted.org/packages/a5/d0/36a49f0262d2319139d2829f773f1b97ef8aef7f97e6e5bd21455e5a8fb5/cryptography-46.0.7-cp38-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:84d4cced91f0f159a7ddacad249cc077e63195c36aac40b4150e7a57e84fffe7", size = 4270628, upload-time = "2026-04-08T01:57:12.885Z" },
-    { url = "https://files.pythonhosted.org/packages/8a/6c/1a42450f464dda6ffbe578a911f773e54dd48c10f9895a23a7e88b3e7db5/cryptography-46.0.7-cp38-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:128c5edfe5e5938b86b03941e94fac9ee793a94452ad1365c9fc3f4f62216832", size = 4415405, upload-time = "2026-04-08T01:57:14.923Z" },
-    { url = "https://files.pythonhosted.org/packages/9a/92/4ed714dbe93a066dc1f4b4581a464d2d7dbec9046f7c8b7016f5286329e2/cryptography-46.0.7-cp38-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:5e51be372b26ef4ba3de3c167cd3d1022934bc838ae9eaad7e644986d2a3d163", size = 4272715, upload-time = "2026-04-08T01:57:16.638Z" },
-    { url = "https://files.pythonhosted.org/packages/b7/e6/a26b84096eddd51494bba19111f8fffe976f6a09f132706f8f1bf03f51f7/cryptography-46.0.7-cp38-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:cdf1a610ef82abb396451862739e3fc93b071c844399e15b90726ef7470eeaf2", size = 4918400, upload-time = "2026-04-08T01:57:19.021Z" },
-    { url = "https://files.pythonhosted.org/packages/c7/08/ffd537b605568a148543ac3c2b239708ae0bd635064bab41359252ef88ed/cryptography-46.0.7-cp38-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:1d25aee46d0c6f1a501adcddb2d2fee4b979381346a78558ed13e50aa8a59067", size = 4450634, upload-time = "2026-04-08T01:57:21.185Z" },
-    { url = "https://files.pythonhosted.org/packages/16/01/0cd51dd86ab5b9befe0d031e276510491976c3a80e9f6e31810cce46c4ad/cryptography-46.0.7-cp38-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:cdfbe22376065ffcf8be74dc9a909f032df19bc58a699456a21712d6e5eabfd0", size = 3985233, upload-time = "2026-04-08T01:57:22.862Z" },
-    { url = "https://files.pythonhosted.org/packages/92/49/819d6ed3a7d9349c2939f81b500a738cb733ab62fbecdbc1e38e83d45e12/cryptography-46.0.7-cp38-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:abad9dac36cbf55de6eb49badd4016806b3165d396f64925bf2999bcb67837ba", size = 4271955, upload-time = "2026-04-08T01:57:24.814Z" },
-    { url = "https://files.pythonhosted.org/packages/80/07/ad9b3c56ebb95ed2473d46df0847357e01583f4c52a85754d1a55e29e4d0/cryptography-46.0.7-cp38-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:935ce7e3cfdb53e3536119a542b839bb94ec1ad081013e9ab9b7cfd478b05006", size = 4879888, upload-time = "2026-04-08T01:57:26.88Z" },
-    { url = "https://files.pythonhosted.org/packages/b8/c7/201d3d58f30c4c2bdbe9b03844c291feb77c20511cc3586daf7edc12a47b/cryptography-46.0.7-cp38-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:35719dc79d4730d30f1c2b6474bd6acda36ae2dfae1e3c16f2051f215df33ce0", size = 4449961, upload-time = "2026-04-08T01:57:29.068Z" },
-    { url = "https://files.pythonhosted.org/packages/a5/ef/649750cbf96f3033c3c976e112265c33906f8e462291a33d77f90356548c/cryptography-46.0.7-cp38-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:7bbc6ccf49d05ac8f7d7b5e2e2c33830d4fe2061def88210a126d130d7f71a85", size = 4401696, upload-time = "2026-04-08T01:57:31.029Z" },
-    { url = "https://files.pythonhosted.org/packages/41/52/a8908dcb1a389a459a29008c29966c1d552588d4ae6d43f3a1a4512e0ebe/cryptography-46.0.7-cp38-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:a1529d614f44b863a7b480c6d000fe93b59acee9c82ffa027cfadc77521a9f5e", size = 4664256, upload-time = "2026-04-08T01:57:33.144Z" },
-    { url = "https://files.pythonhosted.org/packages/4b/fa/f0ab06238e899cc3fb332623f337a7364f36f4bb3f2534c2bb95a35b132c/cryptography-46.0.7-cp38-abi3-win32.whl", hash = "sha256:f247c8c1a1fb45e12586afbb436ef21ff1e80670b2861a90353d9b025583d246", size = 3013001, upload-time = "2026-04-08T01:57:34.933Z" },
-    { url = "https://files.pythonhosted.org/packages/d2/f1/00ce3bde3ca542d1acd8f8cfa38e446840945aa6363f9b74746394b14127/cryptography-46.0.7-cp38-abi3-win_amd64.whl", hash = "sha256:506c4ff91eff4f82bdac7633318a526b1d1309fc07ca76a3ad182cb5b686d6d3", size = 3472985, upload-time = "2026-04-08T01:57:36.714Z" },
+    { url = "https://files.pythonhosted.org/packages/82/b2/2345dc595998caa6f68adf84e8f8b50d18e9fc4638d32b22ea8daedd4b7a/cryptography-45.0.3-cp311-abi3-macosx_10_9_universal2.whl", hash = "sha256:7573d9eebaeceeb55285205dbbb8753ac1e962af3d9640791d12b36864065e71", size = 7056239, upload-time = "2025-05-25T14:16:12.22Z" },
+    { url = "https://files.pythonhosted.org/packages/71/3d/ac361649a0bfffc105e2298b720d8b862330a767dab27c06adc2ddbef96a/cryptography-45.0.3-cp311-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:d377dde61c5d67eb4311eace661c3efda46c62113ff56bf05e2d679e02aebb5b", size = 4205541, upload-time = "2025-05-25T14:16:14.333Z" },
+    { url = "https://files.pythonhosted.org/packages/70/3e/c02a043750494d5c445f769e9c9f67e550d65060e0bfce52d91c1362693d/cryptography-45.0.3-cp311-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:fae1e637f527750811588e4582988932c222f8251f7b7ea93739acb624e1487f", size = 4433275, upload-time = "2025-05-25T14:16:16.421Z" },
+    { url = "https://files.pythonhosted.org/packages/40/7a/9af0bfd48784e80eef3eb6fd6fde96fe706b4fc156751ce1b2b965dada70/cryptography-45.0.3-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:ca932e11218bcc9ef812aa497cdf669484870ecbcf2d99b765d6c27a86000942", size = 4209173, upload-time = "2025-05-25T14:16:18.163Z" },
+    { url = "https://files.pythonhosted.org/packages/31/5f/d6f8753c8708912df52e67969e80ef70b8e8897306cd9eb8b98201f8c184/cryptography-45.0.3-cp311-abi3-manylinux_2_28_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:af3f92b1dc25621f5fad065288a44ac790c5798e986a34d393ab27d2b27fcff9", size = 3898150, upload-time = "2025-05-25T14:16:20.34Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/50/f256ab79c671fb066e47336706dc398c3b1e125f952e07d54ce82cf4011a/cryptography-45.0.3-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:2f8f8f0b73b885ddd7f3d8c2b2234a7d3ba49002b0223f58cfde1bedd9563c56", size = 4466473, upload-time = "2025-05-25T14:16:22.605Z" },
+    { url = "https://files.pythonhosted.org/packages/62/e7/312428336bb2df0848d0768ab5a062e11a32d18139447a76dfc19ada8eed/cryptography-45.0.3-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:9cc80ce69032ffa528b5e16d217fa4d8d4bb7d6ba8659c1b4d74a1b0f4235fca", size = 4211890, upload-time = "2025-05-25T14:16:24.738Z" },
+    { url = "https://files.pythonhosted.org/packages/e7/53/8a130e22c1e432b3c14896ec5eb7ac01fb53c6737e1d705df7e0efb647c6/cryptography-45.0.3-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:c824c9281cb628015bfc3c59335163d4ca0540d49de4582d6c2637312907e4b1", size = 4466300, upload-time = "2025-05-25T14:16:26.768Z" },
+    { url = "https://files.pythonhosted.org/packages/ba/75/6bb6579688ef805fd16a053005fce93944cdade465fc92ef32bbc5c40681/cryptography-45.0.3-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:5833bb4355cb377ebd880457663a972cd044e7f49585aee39245c0d592904578", size = 4332483, upload-time = "2025-05-25T14:16:28.316Z" },
+    { url = "https://files.pythonhosted.org/packages/2f/11/2538f4e1ce05c6c4f81f43c1ef2bd6de7ae5e24ee284460ff6c77e42ca77/cryptography-45.0.3-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:9bb5bf55dcb69f7067d80354d0a348368da907345a2c448b0babc4215ccd3497", size = 4573714, upload-time = "2025-05-25T14:16:30.474Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/bb/e86e9cf07f73a98d84a4084e8fd420b0e82330a901d9cac8149f994c3417/cryptography-45.0.3-cp311-abi3-win32.whl", hash = "sha256:3ad69eeb92a9de9421e1f6685e85a10fbcfb75c833b42cc9bc2ba9fb00da4710", size = 2934752, upload-time = "2025-05-25T14:16:32.204Z" },
+    { url = "https://files.pythonhosted.org/packages/c7/75/063bc9ddc3d1c73e959054f1fc091b79572e716ef74d6caaa56e945b4af9/cryptography-45.0.3-cp311-abi3-win_amd64.whl", hash = "sha256:97787952246a77d77934d41b62fb1b6f3581d83f71b44796a4158d93b8f5c490", size = 3412465, upload-time = "2025-05-25T14:16:33.888Z" },
+    { url = "https://files.pythonhosted.org/packages/71/9b/04ead6015229a9396890d7654ee35ef630860fb42dc9ff9ec27f72157952/cryptography-45.0.3-cp37-abi3-macosx_10_9_universal2.whl", hash = "sha256:c92519d242703b675ccefd0f0562eb45e74d438e001f8ab52d628e885751fb06", size = 7031892, upload-time = "2025-05-25T14:16:36.214Z" },
+    { url = "https://files.pythonhosted.org/packages/46/c7/c7d05d0e133a09fc677b8a87953815c522697bdf025e5cac13ba419e7240/cryptography-45.0.3-cp37-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:c5edcb90da1843df85292ef3a313513766a78fbbb83f584a5a58fb001a5a9d57", size = 4196181, upload-time = "2025-05-25T14:16:37.934Z" },
+    { url = "https://files.pythonhosted.org/packages/08/7a/6ad3aa796b18a683657cef930a986fac0045417e2dc428fd336cfc45ba52/cryptography-45.0.3-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:38deed72285c7ed699864f964a3f4cf11ab3fb38e8d39cfcd96710cd2b5bb716", size = 4423370, upload-time = "2025-05-25T14:16:39.502Z" },
+    { url = "https://files.pythonhosted.org/packages/4f/58/ec1461bfcb393525f597ac6a10a63938d18775b7803324072974b41a926b/cryptography-45.0.3-cp37-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:5555365a50efe1f486eed6ac7062c33b97ccef409f5970a0b6f205a7cfab59c8", size = 4197839, upload-time = "2025-05-25T14:16:41.322Z" },
+    { url = "https://files.pythonhosted.org/packages/d4/3d/5185b117c32ad4f40846f579369a80e710d6146c2baa8ce09d01612750db/cryptography-45.0.3-cp37-abi3-manylinux_2_28_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:9e4253ed8f5948a3589b3caee7ad9a5bf218ffd16869c516535325fece163dcc", size = 3886324, upload-time = "2025-05-25T14:16:43.041Z" },
+    { url = "https://files.pythonhosted.org/packages/67/85/caba91a57d291a2ad46e74016d1f83ac294f08128b26e2a81e9b4f2d2555/cryptography-45.0.3-cp37-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:cfd84777b4b6684955ce86156cfb5e08d75e80dc2585e10d69e47f014f0a5342", size = 4450447, upload-time = "2025-05-25T14:16:44.759Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/d1/164e3c9d559133a38279215c712b8ba38e77735d3412f37711b9f8f6f7e0/cryptography-45.0.3-cp37-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:a2b56de3417fd5f48773ad8e91abaa700b678dc7fe1e0c757e1ae340779acf7b", size = 4200576, upload-time = "2025-05-25T14:16:46.438Z" },
+    { url = "https://files.pythonhosted.org/packages/71/7a/e002d5ce624ed46dfc32abe1deff32190f3ac47ede911789ee936f5a4255/cryptography-45.0.3-cp37-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:57a6500d459e8035e813bd8b51b671977fb149a8c95ed814989da682314d0782", size = 4450308, upload-time = "2025-05-25T14:16:48.228Z" },
+    { url = "https://files.pythonhosted.org/packages/87/ad/3fbff9c28cf09b0a71e98af57d74f3662dea4a174b12acc493de00ea3f28/cryptography-45.0.3-cp37-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:f22af3c78abfbc7cbcdf2c55d23c3e022e1a462ee2481011d518c7fb9c9f3d65", size = 4325125, upload-time = "2025-05-25T14:16:49.844Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/b4/51417d0cc01802304c1984d76e9592f15e4801abd44ef7ba657060520bf0/cryptography-45.0.3-cp37-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:232954730c362638544758a8160c4ee1b832dc011d2c41a306ad8f7cccc5bb0b", size = 4560038, upload-time = "2025-05-25T14:16:51.398Z" },
+    { url = "https://files.pythonhosted.org/packages/80/38/d572f6482d45789a7202fb87d052deb7a7b136bf17473ebff33536727a2c/cryptography-45.0.3-cp37-abi3-win32.whl", hash = "sha256:cb6ab89421bc90e0422aca911c69044c2912fc3debb19bb3c1bfe28ee3dff6ab", size = 2924070, upload-time = "2025-05-25T14:16:53.472Z" },
+    { url = "https://files.pythonhosted.org/packages/91/5a/61f39c0ff4443651cc64e626fa97ad3099249152039952be8f344d6b0c86/cryptography-45.0.3-cp37-abi3-win_amd64.whl", hash = "sha256:d54ae41e6bd70ea23707843021c778f151ca258081586f0cfa31d936ae43d1b2", size = 3395005, upload-time = "2025-05-25T14:16:55.134Z" },
 ]
 
 [[package]]

frontend/src/api/client.ts

@@ -2,9 +2,6 @@ import { supabase } from '../lib/supabase'
 
 const API_BASE = import.meta.env['VITE_API_URL'] ?? ''
 
-// Refresh token if it expires within this many seconds
-const TOKEN_EXPIRY_BUFFER_SECONDS = 60
-
 export class ApiError extends Error {
   status: number
 
@@ -15,40 +12,15 @@ export class ApiError extends Error {
   }
 }
 
-function isTokenExpiringSoon(expiresAt: number): boolean {
-  const nowSeconds = Math.floor(Date.now() / 1000)
-  return expiresAt - nowSeconds < TOKEN_EXPIRY_BUFFER_SECONDS
-}
-
-async function getValidAccessToken(): Promise<string | null> {
-  const { data } = await supabase.auth.getSession()
-  const session = data.session
-
-  if (!session) {
-    return null
-  }
-
-  // If token is expired or expiring soon, refresh it
-  if (isTokenExpiringSoon(session.expires_at ?? 0)) {
-    const { data: refreshed, error } = await supabase.auth.refreshSession()
-    if (error || !refreshed.session) {
-      return null
-    }
-    return refreshed.session.access_token
-  }
-
-  return session.access_token
-}
-
 async function getAuthHeaders(): Promise<Record<string, string>> {
-  const token = await getValidAccessToken()
-  if (token) {
-    return { Authorization: `Bearer ${token}` }
+  const { data } = await supabase.auth.getSession()
+  if (data.session?.access_token) {
+    return { Authorization: `Bearer ${data.session.access_token}` }
   }
   return {}
 }
 
-async function request<T>(path: string, options?: RequestInit, isRetry = false): Promise<T> {
+async function request<T>(path: string, options?: RequestInit): Promise<T> {
   const authHeaders = await getAuthHeaders()
   const res = await fetch(`${API_BASE}/api/v1${path}`, {
     ...options,
@@ -59,14 +31,6 @@ async function request<T>(path: string, options?: RequestInit, isRetry = false):
     },
   })
 
-  // On 401, try refreshing the token and retry once
-  if (res.status === 401 && !isRetry) {
-    const { data: refreshed, error } = await supabase.auth.refreshSession()
-    if (!error && refreshed.session) {
-      return request<T>(path, options, true)
-    }
-  }
-
   if (!res.ok) {
     const body = await res.json().catch(() => ({}))
     throw new ApiError(res.status, body.detail ?? res.statusText)

frontend/src/components/BossDefeatModal.tsx

@@ -23,7 +23,10 @@ function matchVariant(labels: string[], starterName?: string | null): string | n
   return matches.length === 1 ? (matches[0] ?? null) : null
 }
 
-type TeamSelection = number
+interface TeamSelection {
+  encounterId: number
+  level: number
+}
 
 export function BossDefeatModal({
   boss,
@@ -33,15 +36,26 @@ export function BossDefeatModal({
   isPending,
   starterName,
 }: BossDefeatModalProps) {
-  const [selectedTeam, setSelectedTeam] = useState<Set<TeamSelection>>(new Set())
+  const [selectedTeam, setSelectedTeam] = useState<Map<number, TeamSelection>>(new Map())
 
-  const toggleTeamMember = (encounterId: number) => {
+  const toggleTeamMember = (enc: EncounterDetail) => {
     setSelectedTeam((prev) => {
-      const next = new Set(prev)
-      if (next.has(encounterId)) {
-        next.delete(encounterId)
+      const next = new Map(prev)
+      if (next.has(enc.id)) {
+        next.delete(enc.id)
       } else {
-        next.add(encounterId)
+        next.set(enc.id, { encounterId: enc.id, level: enc.catchLevel ?? 1 })
+      }
+      return next
+    })
+  }
+
+  const updateLevel = (encounterId: number, level: number) => {
+    setSelectedTeam((prev) => {
+      const next = new Map(prev)
+      const existing = next.get(encounterId)
+      if (existing) {
+        next.set(encounterId, { ...existing, level })
       }
       return next
     })
@@ -73,9 +87,7 @@ export function BossDefeatModal({
 
   const handleSubmit = (e: FormEvent) => {
     e.preventDefault()
-    const team: BossResultTeamMemberInput[] = Array.from(selectedTeam).map((encounterId) => ({
-      encounterId,
-    }))
+    const team: BossResultTeamMemberInput[] = Array.from(selectedTeam.values())
     onSubmit({
       bossBattleId: boss.id,
       result: 'won',
@@ -122,17 +134,11 @@ export function BossDefeatModal({
                   return (
                     <div key={bp.id} className="flex flex-col items-center">
                       {bp.pokemon.spriteUrl ? (
-                        <img
-                          src={bp.pokemon.spriteUrl}
-                          alt={bp.pokemon.name}
-                          className="w-10 h-10"
-                        />
+                        <img src={bp.pokemon.spriteUrl} alt={bp.pokemon.name} className="w-10 h-10" />
                       ) : (
                         <div className="w-10 h-10 bg-surface-3 rounded-full" />
                       )}
-                      <span className="text-xs text-text-tertiary capitalize">
-                        {bp.pokemon.name}
-                      </span>
+                      <span className="text-xs text-text-tertiary capitalize">{bp.pokemon.name}</span>
                       <span className="text-xs font-medium text-text-secondary">Lv.{bp.level}</span>
                       <ConditionBadge condition={bp.conditionLabel} size="xs" />
                       {bp.ability && (
@@ -160,6 +166,7 @@ export function BossDefeatModal({
             <div className="grid grid-cols-2 sm:grid-cols-3 gap-2 max-h-48 overflow-y-auto">
               {aliveEncounters.map((enc) => {
                 const isSelected = selectedTeam.has(enc.id)
+                const selection = selectedTeam.get(enc.id)
                 const displayPokemon = enc.currentPokemon ?? enc.pokemon
                 return (
                   <div
@@ -169,12 +176,12 @@ export function BossDefeatModal({
                         ? 'border-accent-500 bg-accent-500/10'
                         : 'border-border-default hover:bg-surface-2'
                     }`}
-                    onClick={() => toggleTeamMember(enc.id)}
+                    onClick={() => toggleTeamMember(enc)}
                   >
                     <input
                       type="checkbox"
                       checked={isSelected}
-                      onChange={() => toggleTeamMember(enc.id)}
+                      onChange={() => toggleTeamMember(enc)}
                       className="sr-only"
                     />
                     {displayPokemon.spriteUrl ? (
@@ -186,9 +193,26 @@ export function BossDefeatModal({
                     ) : (
                       <div className="w-8 h-8 bg-surface-3 rounded-full" />
                     )}
-                    <p className="flex-1 min-w-0 text-xs font-medium truncate">
-                      {enc.nickname ?? displayPokemon.name}
-                    </p>
+                    <div className="flex-1 min-w-0">
+                      <p className="text-xs font-medium truncate">
+                        {enc.nickname ?? displayPokemon.name}
+                      </p>
+                      {isSelected && (
+                        <input
+                          type="number"
+                          min={1}
+                          max={100}
+                          value={selection?.level ?? enc.catchLevel ?? 1}
+                          onChange={(e) => {
+                            e.stopPropagation()
+                            updateLevel(enc.id, Number.parseInt(e.target.value, 10) || 1)
+                          }}
+                          onClick={(e) => e.stopPropagation()}
+                          className="w-14 text-xs px-1 py-0.5 mt-1 rounded border border-border-default bg-surface-1"
+                          placeholder="Lv"
+                        />
+                      )}
+                    </div>
                   </div>
                 )
               })}

frontend/src/lib/supabase.ts

@@ -7,7 +7,10 @@ const isLocalDev = supabaseUrl.includes('localhost')
 // supabase-js hardcodes /auth/v1 as the auth path prefix, but GoTrue
 // serves at the root when accessed directly (no API gateway).
 // This custom fetch strips the prefix for local dev.
-function localGoTrueFetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response> {
+function localGoTrueFetch(
+  input: RequestInfo | URL,
+  init?: RequestInit,
+): Promise<Response> {
   const url = input instanceof Request ? input.url : String(input)
   const rewritten = url.replace('/auth/v1/', '/')
   if (input instanceof Request) {
@@ -21,10 +24,6 @@ function createSupabaseClient(): SupabaseClient {
     return createClient('http://localhost:9999', 'stub-key')
   }
   return createClient(supabaseUrl, supabaseAnonKey, {
-    auth: {
-      autoRefreshToken: true,
-      persistSession: true,
-    },
     ...(isLocalDev && {
       global: { fetch: localGoTrueFetch },
     }),

frontend/src/pages/RunEncounters.tsx

@@ -922,7 +922,7 @@ export function RunEncounters() {
   })
 
   return (
-    <div className="max-w-4xl lg:max-w-6xl mx-auto p-8">
+    <div className="max-w-4xl mx-auto p-8">
       {/* Header */}
       <div className="mb-6">
         <Link
@@ -1246,279 +1246,250 @@ export function RunEncounters() {
       {/* Encounters Tab */}
       {activeTab === 'encounters' && (
         <>
-          <div className="lg:flex lg:gap-6">
-            {/* Main content column */}
-            <div className="flex-1 min-w-0">
-              {/* Team Section - Mobile/Tablet only */}
-              {(alive.length > 0 || dead.length > 0) && (
-                <div className="mb-6 lg:hidden">
-                  <div className="flex items-center justify-between mb-3">
-                    <button
-                      type="button"
-                      onClick={() => setShowTeam(!showTeam)}
-                      className="flex items-center gap-2 group"
-                    >
-                      <h2 className="text-lg font-semibold text-text-primary">
-                        {isActive ? 'Team' : 'Final Team'}
-                      </h2>
-                      <span className="text-xs text-text-muted">
-                        {alive.length} alive
-                        {dead.length > 0 ? `, ${dead.length} dead` : ''}
-                      </span>
-                      <svg
-                        className={`w-4 h-4 text-text-tertiary transition-transform ${showTeam ? 'rotate-180' : ''}`}
-                        fill="none"
-                        stroke="currentColor"
-                        viewBox="0 0 24 24"
-                      >
-                        <path
-                          strokeLinecap="round"
-                          strokeLinejoin="round"
-                          strokeWidth={2}
-                          d="M19 9l-7 7-7-7"
+          {/* Team Section */}
+          {(alive.length > 0 || dead.length > 0) && (
+            <div className="mb-6">
+              <div className="flex items-center justify-between mb-3">
+                <button
+                  type="button"
+                  onClick={() => setShowTeam(!showTeam)}
+                  className="flex items-center gap-2 group"
+                >
+                  <h2 className="text-lg font-semibold text-text-primary">
+                    {isActive ? 'Team' : 'Final Team'}
+                  </h2>
+                  <span className="text-xs text-text-muted">
+                    {alive.length} alive
+                    {dead.length > 0 ? `, ${dead.length} dead` : ''}
+                  </span>
+                  <svg
+                    className={`w-4 h-4 text-text-tertiary transition-transform ${showTeam ? 'rotate-180' : ''}`}
+                    fill="none"
+                    stroke="currentColor"
+                    viewBox="0 0 24 24"
+                  >
+                    <path
+                      strokeLinecap="round"
+                      strokeLinejoin="round"
+                      strokeWidth={2}
+                      d="M19 9l-7 7-7-7"
+                    />
+                  </svg>
+                </button>
+                {showTeam && alive.length > 1 && (
+                  <select
+                    value={teamSort}
+                    onChange={(e) => setTeamSort(e.target.value as TeamSortKey)}
+                    className="text-sm border border-border-default rounded-lg px-3 py-1.5 bg-surface-1 text-text-primary"
+                  >
+                    <option value="route">Route Order</option>
+                    <option value="level">Catch Level</option>
+                    <option value="species">Species Name</option>
+                    <option value="dex">National Dex</option>
+                  </select>
+                )}
+              </div>
+              {showTeam && (
+                <>
+                  {alive.length > 0 && (
+                    <div className="grid grid-cols-3 sm:grid-cols-4 md:grid-cols-6 gap-2 mb-3">
+                      {alive.map((enc) => (
+                        <PokemonCard
+                          key={enc.id}
+                          encounter={enc}
+                          onClick={
+                            isActive && canEdit ? () => setSelectedTeamEncounter(enc) : undefined
+                          }
                         />
-                      </svg>
-                    </button>
-                    {showTeam && alive.length > 1 && (
-                      <select
-                        value={teamSort}
-                        onChange={(e) => setTeamSort(e.target.value as TeamSortKey)}
-                        className="text-sm border border-border-default rounded-lg px-3 py-1.5 bg-surface-1 text-text-primary"
-                      >
-                        <option value="route">Route Order</option>
-                        <option value="level">Catch Level</option>
-                        <option value="species">Species Name</option>
-                        <option value="dex">National Dex</option>
-                      </select>
-                    )}
-                  </div>
-                  {showTeam && (
+                      ))}
+                    </div>
+                  )}
+                  {dead.length > 0 && (
                     <>
-                      {alive.length > 0 && (
-                        <div className="grid grid-cols-3 sm:grid-cols-4 md:grid-cols-6 gap-2 mb-3">
-                          {alive.map((enc) => (
-                            <PokemonCard
-                              key={enc.id}
-                              encounter={enc}
-                              onClick={
-                                isActive && canEdit
-                                  ? () => setSelectedTeamEncounter(enc)
-                                  : undefined
-                              }
-                            />
-                          ))}
-                        </div>
-                      )}
-                      {dead.length > 0 && (
-                        <>
-                          <h3 className="text-sm font-medium text-text-tertiary mb-2">Graveyard</h3>
-                          <div className="grid grid-cols-3 sm:grid-cols-4 md:grid-cols-6 gap-2">
-                            {dead.map((enc) => (
-                              <PokemonCard
-                                key={enc.id}
-                                encounter={enc}
-                                showFaintLevel
-                                onClick={
-                                  isActive && canEdit
-                                    ? () => setSelectedTeamEncounter(enc)
-                                    : undefined
-                                }
-                              />
-                            ))}
-                          </div>
-                        </>
-                      )}
+                      <h3 className="text-sm font-medium text-text-tertiary mb-2">Graveyard</h3>
+                      <div className="grid grid-cols-3 sm:grid-cols-4 md:grid-cols-6 gap-2">
+                        {dead.map((enc) => (
+                          <PokemonCard
+                            key={enc.id}
+                            encounter={enc}
+                            showFaintLevel
+                            onClick={
+                              isActive && canEdit ? () => setSelectedTeamEncounter(enc) : undefined
+                            }
+                          />
+                        ))}
+                      </div>
                     </>
                   )}
-                </div>
+                </>
               )}
+            </div>
+          )}
 
-              {/* Shiny Box */}
-              {run.rules?.shinyClause && shinyEncounters.length > 0 && (
-                <div className="mb-6">
-                  <ShinyBox
-                    encounters={shinyEncounters}
-                    onEncounterClick={
-                      isActive && canEdit ? (enc) => setSelectedTeamEncounter(enc) : undefined
-                    }
+          {/* Shiny Box */}
+          {run.rules?.shinyClause && shinyEncounters.length > 0 && (
+            <div className="mb-6">
+              <ShinyBox
+                encounters={shinyEncounters}
+                onEncounterClick={
+                  isActive && canEdit ? (enc) => setSelectedTeamEncounter(enc) : undefined
+                }
+              />
+            </div>
+          )}
+
+          {/* Transfer Encounters */}
+          {transferEncounters.length > 0 && (
+            <div className="mb-6">
+              <h2 className="text-sm font-medium text-indigo-400 mb-2">Transferred Pokemon</h2>
+              <div className="grid grid-cols-3 sm:grid-cols-4 md:grid-cols-6 gap-2">
+                {transferEncounters.map((enc) => (
+                  <PokemonCard
+                    key={enc.id}
+                    encounter={enc}
+                    onClick={isActive && canEdit ? () => setSelectedTeamEncounter(enc) : undefined}
                   />
-                </div>
-              )}
-
-              {/* Transfer Encounters */}
-              {transferEncounters.length > 0 && (
-                <div className="mb-6">
-                  <h2 className="text-sm font-medium text-indigo-400 mb-2">Transferred Pokemon</h2>
-                  <div className="grid grid-cols-3 sm:grid-cols-4 md:grid-cols-6 gap-2">
-                    {transferEncounters.map((enc) => (
-                      <PokemonCard
-                        key={enc.id}
-                        encounter={enc}
-                        onClick={
-                          isActive && canEdit ? () => setSelectedTeamEncounter(enc) : undefined
-                        }
-                      />
-                    ))}
-                  </div>
-                </div>
-              )}
-
-              {/* Progress bar */}
-              <div className="mb-4">
-                <div className="flex items-center justify-between mb-1">
-                  <div className="flex items-center gap-3">
-                    <h2 className="text-lg font-semibold text-text-primary">Encounters</h2>
-                    {isActive && canEdit && completedCount < totalLocations && (
-                      <button
-                        type="button"
-                        disabled={bulkRandomize.isPending}
-                        onClick={() => {
-                          const remaining = totalLocations - completedCount
-                          if (
-                            window.confirm(
-                              `Randomize encounters for all ${remaining} remaining locations?`
-                            )
-                          ) {
-                            bulkRandomize.mutate()
-                          }
-                        }}
-                        className="px-2.5 py-1 text-xs font-medium rounded-lg border border-purple-600 text-purple-400 light:text-purple-700 light:border-purple-500 hover:bg-purple-900/20 light:hover:bg-purple-50 disabled:opacity-40 disabled:cursor-not-allowed transition-colors"
-                      >
-                        {bulkRandomize.isPending ? 'Randomizing...' : 'Randomize All'}
-                      </button>
-                    )}
-                  </div>
-                  <span className="text-sm text-text-tertiary">
-                    {completedCount} / {totalLocations} locations
-                  </span>
-                </div>
-                <div className="h-2 bg-surface-3 rounded-full overflow-hidden">
-                  <div
-                    className="h-full bg-blue-500 rounded-full transition-all"
-                    style={{
-                      width: `${totalLocations > 0 ? (completedCount / totalLocations) * 100 : 0}%`,
-                    }}
-                  />
-                </div>
-              </div>
-
-              {/* Filter tabs */}
-              <div className="flex gap-2 mb-4 flex-wrap">
-                {(
-                  [
-                    { key: 'all', label: 'All' },
-                    { key: 'none', label: 'Unvisited' },
-                    { key: 'caught', label: 'Caught' },
-                    { key: 'fainted', label: 'Fainted' },
-                    { key: 'missed', label: 'Missed' },
-                  ] as const
-                ).map(({ key, label }) => (
-                  <button
-                    key={key}
-                    onClick={() => setFilter(key)}
-                    className={`px-3 py-1 rounded-full text-sm font-medium transition-colors ${
-                      filter === key
-                        ? 'bg-blue-600 text-white'
-                        : 'bg-surface-2 text-text-secondary hover:bg-surface-3'
-                    }`}
-                  >
-                    {label}
-                  </button>
                 ))}
               </div>
+            </div>
+          )}
 
-              {/* Route list */}
-              <div className="space-y-1">
-                {filteredRoutes.length === 0 && (
-                  <p className="text-text-tertiary text-sm py-4 text-center">
-                    {filter === 'all'
-                      ? 'Click a route to log your first encounter'
-                      : 'No routes match this filter — try a different one'}
-                  </p>
+          {/* Progress bar */}
+          <div className="mb-4">
+            <div className="flex items-center justify-between mb-1">
+              <div className="flex items-center gap-3">
+                <h2 className="text-lg font-semibold text-text-primary">Encounters</h2>
+                {isActive && canEdit && completedCount < totalLocations && (
+                  <button
+                    type="button"
+                    disabled={bulkRandomize.isPending}
+                    onClick={() => {
+                      const remaining = totalLocations - completedCount
+                      if (
+                        window.confirm(
+                          `Randomize encounters for all ${remaining} remaining locations?`
+                        )
+                      ) {
+                        bulkRandomize.mutate()
+                      }
+                    }}
+                    className="px-2.5 py-1 text-xs font-medium rounded-lg border border-purple-600 text-purple-400 light:text-purple-700 light:border-purple-500 hover:bg-purple-900/20 light:hover:bg-purple-50 disabled:opacity-40 disabled:cursor-not-allowed transition-colors"
+                  >
+                    {bulkRandomize.isPending ? 'Randomizing...' : 'Randomize All'}
+                  </button>
                 )}
-                {filteredRoutes.map((route) => {
-                  // Collect all route IDs to check for boss cards after
-                  const routeIds: number[] =
-                    route.children.length > 0
-                      ? [route.id, ...route.children.map((c) => c.id)]
-                      : [route.id]
+              </div>
+              <span className="text-sm text-text-tertiary">
+                {completedCount} / {totalLocations} locations
+              </span>
+            </div>
+            <div className="h-2 bg-surface-3 rounded-full overflow-hidden">
+              <div
+                className="h-full bg-blue-500 rounded-full transition-all"
+                style={{
+                  width: `${totalLocations > 0 ? (completedCount / totalLocations) * 100 : 0}%`,
+                }}
+              />
+            </div>
+          </div>
 
-                  // Find boss battles positioned after this route (or any of its children)
-                  const bossesHere: BossBattle[] = []
-                  for (const rid of routeIds) {
-                    const b = bossesAfterRoute.get(rid)
-                    if (b) bossesHere.push(...b)
-                  }
+          {/* Filter tabs */}
+          <div className="flex gap-2 mb-4 flex-wrap">
+            {(
+              [
+                { key: 'all', label: 'All' },
+                { key: 'none', label: 'Unvisited' },
+                { key: 'caught', label: 'Caught' },
+                { key: 'fainted', label: 'Fainted' },
+                { key: 'missed', label: 'Missed' },
+              ] as const
+            ).map(({ key, label }) => (
+              <button
+                key={key}
+                onClick={() => setFilter(key)}
+                className={`px-3 py-1 rounded-full text-sm font-medium transition-colors ${
+                  filter === key
+                    ? 'bg-blue-600 text-white'
+                    : 'bg-surface-2 text-text-secondary hover:bg-surface-3'
+                }`}
+              >
+                {label}
+              </button>
+            ))}
+          </div>
 
-                  const routeElement =
-                    route.children.length > 0 ? (
-                      <RouteGroup
+          {/* Route list */}
+          <div className="space-y-1">
+            {filteredRoutes.length === 0 && (
+              <p className="text-text-tertiary text-sm py-4 text-center">
+                {filter === 'all'
+                  ? 'Click a route to log your first encounter'
+                  : 'No routes match this filter — try a different one'}
+              </p>
+            )}
+            {filteredRoutes.map((route) => {
+              // Collect all route IDs to check for boss cards after
+              const routeIds: number[] =
+                route.children.length > 0
+                  ? [route.id, ...route.children.map((c) => c.id)]
+                  : [route.id]
+
+              // Find boss battles positioned after this route (or any of its children)
+              const bossesHere: BossBattle[] = []
+              for (const rid of routeIds) {
+                const b = bossesAfterRoute.get(rid)
+                if (b) bossesHere.push(...b)
+              }
+
+              const routeElement =
+                route.children.length > 0 ? (
+                  <RouteGroup
+                    key={route.id}
+                    group={route}
+                    encounterByRoute={encounterByRoute}
+                    giftEncounterByRoute={giftEncounterByRoute}
+                    isExpanded={expandedGroups.has(route.id)}
+                    onToggleExpand={() => toggleGroup(route.id)}
+                    onRouteClick={canEdit ? handleRouteClick : undefined}
+                    filter={filter}
+                    pinwheelClause={pinwheelClause}
+                  />
+                ) : (
+                  (() => {
+                    const encounter = encounterByRoute.get(route.id)
+                    const giftEncounter = giftEncounterByRoute.get(route.id)
+                    const displayEncounter = encounter ?? giftEncounter
+                    const rs = getRouteStatus(displayEncounter)
+                    const si = statusIndicator[rs]
+
+                    return (
+                      <button
                         key={route.id}
-                        group={route}
-                        encounterByRoute={encounterByRoute}
-                        giftEncounterByRoute={giftEncounterByRoute}
-                        isExpanded={expandedGroups.has(route.id)}
-                        onToggleExpand={() => toggleGroup(route.id)}
-                        onRouteClick={canEdit ? handleRouteClick : undefined}
-                        filter={filter}
-                        pinwheelClause={pinwheelClause}
-                      />
-                    ) : (
-                      (() => {
-                        const encounter = encounterByRoute.get(route.id)
-                        const giftEncounter = giftEncounterByRoute.get(route.id)
-                        const displayEncounter = encounter ?? giftEncounter
-                        const rs = getRouteStatus(displayEncounter)
-                        const si = statusIndicator[rs]
-
-                        return (
-                          <button
-                            key={route.id}
-                            type="button"
-                            onClick={canEdit ? () => handleRouteClick(route) : undefined}
-                            disabled={!canEdit}
-                            className={`w-full flex items-center gap-3 px-4 py-3 rounded-lg text-left transition-colors ${!canEdit ? 'cursor-default' : 'hover:bg-surface-2/50'} ${si.bg}`}
-                          >
-                            <span className={`w-2.5 h-2.5 rounded-full shrink-0 ${si.dot}`} />
-                            <div className="flex-1 min-w-0">
-                              <div className="text-sm font-medium text-text-primary">
-                                {route.name}
-                              </div>
-                              {encounter ? (
-                                <div className="flex items-center gap-2 mt-0.5">
-                                  {encounter.pokemon.spriteUrl && (
-                                    <img
-                                      src={encounter.pokemon.spriteUrl}
-                                      alt={encounter.pokemon.name}
-                                      className="w-10 h-10"
-                                    />
-                                  )}
-                                  <span className="text-xs text-text-tertiary capitalize">
-                                    {encounter.nickname ?? encounter.pokemon.name}
-                                    {encounter.status === 'caught' &&
-                                      encounter.faintLevel !== null &&
-                                      (encounter.deathCause
-                                        ? ` — ${encounter.deathCause}`
-                                        : ' (dead)')}
-                                  </span>
-                                  {giftEncounter && (
-                                    <>
-                                      {giftEncounter.pokemon.spriteUrl && (
-                                        <img
-                                          src={giftEncounter.pokemon.spriteUrl}
-                                          alt={giftEncounter.pokemon.name}
-                                          className="w-8 h-8 opacity-60"
-                                        />
-                                      )}
-                                      <span className="text-xs text-text-tertiary capitalize">
-                                        {giftEncounter.nickname ?? giftEncounter.pokemon.name}
-                                        <span className="text-text-muted ml-1">(gift)</span>
-                                      </span>
-                                    </>
-                                  )}
-                                </div>
-                              ) : giftEncounter ? (
-                                <div className="flex items-center gap-2 mt-0.5">
+                        type="button"
+                        onClick={canEdit ? () => handleRouteClick(route) : undefined}
+                        disabled={!canEdit}
+                        className={`w-full flex items-center gap-3 px-4 py-3 rounded-lg text-left transition-colors ${!canEdit ? 'cursor-default' : 'hover:bg-surface-2/50'} ${si.bg}`}
+                      >
+                        <span className={`w-2.5 h-2.5 rounded-full shrink-0 ${si.dot}`} />
+                        <div className="flex-1 min-w-0">
+                          <div className="text-sm font-medium text-text-primary">{route.name}</div>
+                          {encounter ? (
+                            <div className="flex items-center gap-2 mt-0.5">
+                              {encounter.pokemon.spriteUrl && (
+                                <img
+                                  src={encounter.pokemon.spriteUrl}
+                                  alt={encounter.pokemon.name}
+                                  className="w-10 h-10"
+                                />
+                              )}
+                              <span className="text-xs text-text-tertiary capitalize">
+                                {encounter.nickname ?? encounter.pokemon.name}
+                                {encounter.status === 'caught' &&
+                                  encounter.faintLevel !== null &&
+                                  (encounter.deathCause ? ` — ${encounter.deathCause}` : ' (dead)')}
+                              </span>
+                              {giftEncounter && (
+                                <>
                                   {giftEncounter.pokemon.spriteUrl && (
                                     <img
                                       src={giftEncounter.pokemon.spriteUrl}
@@ -1530,250 +1501,194 @@ export function RunEncounters() {
                                     {giftEncounter.nickname ?? giftEncounter.pokemon.name}
                                     <span className="text-text-muted ml-1">(gift)</span>
                                   </span>
-                                </div>
-                              ) : (
-                                route.encounterMethods.length > 0 && (
-                                  <div className="flex flex-wrap gap-1 mt-0.5">
-                                    {route.encounterMethods.map((m) => (
-                                      <EncounterMethodBadge key={m} method={m} size="xs" />
-                                    ))}
-                                  </div>
-                                )
+                                </>
                               )}
                             </div>
-                            <span className="text-xs text-text-muted shrink-0">{si.label}</span>
-                          </button>
-                        )
-                      })()
-                    )
-
-                  return (
-                    <div key={route.id}>
-                      {routeElement}
-                      {/* Boss battle cards after this route */}
-                      {bossesHere.map((boss) => {
-                        const isDefeated = defeatedBossIds.has(boss.id)
-                        const sectionAfter = sectionDividerAfterBoss.get(boss.id)
-                        const bossTypeLabel: Record<string, string> = {
-                          gym_leader: 'Gym Leader',
-                          elite_four: 'Elite Four',
-                          champion: 'Champion',
-                          rival: 'Rival',
-                          evil_team: 'Evil Team',
-                          kahuna: 'Kahuna',
-                          totem: 'Totem',
-                          other: 'Boss',
-                        }
-                        const bossTypeColors: Record<string, string> = {
-                          gym_leader: 'border-yellow-600',
-                          elite_four: 'border-purple-600',
-                          champion: 'border-red-600',
-                          rival: 'border-blue-600',
-                          evil_team: 'border-gray-400',
-                          kahuna: 'border-orange-600',
-                          totem: 'border-teal-600',
-                          other: 'border-gray-500',
-                        }
-
-                        const isBossExpanded = expandedBosses.has(boss.id)
-                        const toggleBoss = () => {
-                          setExpandedBosses((prev) => {
-                            const next = new Set(prev)
-                            if (next.has(boss.id)) next.delete(boss.id)
-                            else next.add(boss.id)
-                            return next
-                          })
-                        }
-
-                        return (
-                          <div key={`boss-${boss.id}`}>
-                            <div
-                              className={`my-2 rounded-lg border-2 ${bossTypeColors[boss.bossType] ?? bossTypeColors['other']} ${
-                                isDefeated ? 'bg-green-900/10' : 'bg-surface-1'
-                              } px-4 py-3`}
-                            >
-                              <div
-                                className="flex items-start justify-between cursor-pointer select-none"
-                                onClick={toggleBoss}
-                              >
-                                <div className="flex items-center gap-3">
-                                  <svg
-                                    className={`w-4 h-4 text-text-tertiary transition-transform ${isBossExpanded ? 'rotate-90' : ''}`}
-                                    fill="none"
-                                    viewBox="0 0 24 24"
-                                    stroke="currentColor"
-                                    strokeWidth={2}
-                                  >
-                                    <path
-                                      strokeLinecap="round"
-                                      strokeLinejoin="round"
-                                      d="M9 5l7 7-7 7"
-                                    />
-                                  </svg>
-                                  {boss.spriteUrl && (
-                                    <img
-                                      src={boss.spriteUrl}
-                                      alt={boss.name}
-                                      className="h-10 w-auto"
-                                    />
-                                  )}
-                                  <div>
-                                    <div className="flex items-center gap-2">
-                                      <span className="text-sm font-semibold text-text-primary">
-                                        {boss.name}
-                                      </span>
-                                      <span className="px-2 py-0.5 text-xs font-medium rounded-full bg-surface-2 text-text-secondary">
-                                        {bossTypeLabel[boss.bossType] ?? boss.bossType}
-                                      </span>
-                                      {boss.specialtyType && (
-                                        <TypeBadge type={boss.specialtyType} />
-                                      )}
-                                    </div>
-                                    <p className="text-xs text-text-tertiary">
-                                      {boss.location} &middot; Level Cap: {boss.levelCap}
-                                    </p>
-                                  </div>
-                                </div>
-                                <div onClick={(e) => e.stopPropagation()}>
-                                  {isDefeated ? (
-                                    <span className="inline-flex items-center gap-1 px-2 py-1 text-xs font-medium rounded-full bg-green-900/40 text-green-300 light:bg-green-100 light:text-green-800">
-                                      Defeated &#10003;
-                                    </span>
-                                  ) : isActive && canEdit ? (
-                                    <button
-                                      onClick={() => setSelectedBoss(boss)}
-                                      className="px-3 py-1 text-xs font-medium rounded-full bg-accent-600 text-white hover:bg-accent-500 transition-colors"
-                                    >
-                                      Battle
-                                    </button>
-                                  ) : null}
-                                </div>
-                              </div>
-                              {/* Boss pokemon team */}
-                              {isBossExpanded && boss.pokemon.length > 0 && (
-                                <BossTeamPreview pokemon={boss.pokemon} starterName={starterName} />
+                          ) : giftEncounter ? (
+                            <div className="flex items-center gap-2 mt-0.5">
+                              {giftEncounter.pokemon.spriteUrl && (
+                                <img
+                                  src={giftEncounter.pokemon.spriteUrl}
+                                  alt={giftEncounter.pokemon.name}
+                                  className="w-8 h-8 opacity-60"
+                                />
                               )}
-                              {/* Player team snapshot */}
-                              {isDefeated &&
-                                (() => {
-                                  const result = bossResultByBattleId.get(boss.id)
-                                  if (!result || result.team.length === 0) return null
-                                  return (
-                                    <div className="mt-3 pt-3 border-t border-border-default">
-                                      <p className="text-xs font-medium text-text-secondary mb-2">
-                                        Your Team
-                                      </p>
-                                      <div className="flex gap-2 flex-wrap">
-                                        {result.team.map((tm: BossResultTeamMember) => {
-                                          const enc = encounterById.get(tm.encounterId)
-                                          if (!enc) return null
-                                          const dp = enc.currentPokemon ?? enc.pokemon
-                                          return (
-                                            <div key={tm.id} className="flex flex-col items-center">
-                                              {dp.spriteUrl ? (
-                                                <img
-                                                  src={dp.spriteUrl}
-                                                  alt={dp.name}
-                                                  className="w-10 h-10"
-                                                />
-                                              ) : (
-                                                <div className="w-10 h-10 bg-surface-3 rounded-full" />
-                                              )}
-                                              <span className="text-[10px] text-text-tertiary capitalize">
-                                                {enc.nickname ?? dp.name}
-                                              </span>
-                                              {tm.level != null && (
-                                                <span className="text-[10px] text-text-muted">
-                                                  Lv.{tm.level}
-                                                </span>
-                                              )}
-                                            </div>
-                                          )
-                                        })}
-                                      </div>
-                                    </div>
-                                  )
-                                })()}
+                              <span className="text-xs text-text-tertiary capitalize">
+                                {giftEncounter.nickname ?? giftEncounter.pokemon.name}
+                                <span className="text-text-muted ml-1">(gift)</span>
+                              </span>
                             </div>
-                            {sectionAfter && (
-                              <div className="flex items-center gap-3 my-4">
-                                <div className="flex-1 h-px bg-surface-3" />
-                                <span className="text-sm font-semibold text-text-tertiary uppercase tracking-wider">
-                                  {sectionAfter}
-                                </span>
-                                <div className="flex-1 h-px bg-surface-3" />
+                          ) : (
+                            route.encounterMethods.length > 0 && (
+                              <div className="flex flex-wrap gap-1 mt-0.5">
+                                {route.encounterMethods.map((m) => (
+                                  <EncounterMethodBadge key={m} method={m} size="xs" />
+                                ))}
                               </div>
-                            )}
-                          </div>
-                        )
-                      })}
-                    </div>
-                  )
-                })}
-              </div>
-            </div>
-
-            {/* Team Sidebar - Desktop only */}
-            {(alive.length > 0 || dead.length > 0) && (
-              <div className="hidden lg:block w-64 shrink-0">
-                <div className="sticky top-20 max-h-[calc(100vh-6rem)] overflow-y-auto">
-                  <div className="bg-surface-1 border border-border-default rounded-lg p-4">
-                    <div className="flex items-center justify-between mb-3">
-                      <h2 className="text-lg font-semibold text-text-primary">
-                        {isActive ? 'Team' : 'Final Team'}
-                      </h2>
-                      <span className="text-xs text-text-muted">
-                        {alive.length}/{alive.length + dead.length}
-                      </span>
-                    </div>
-                    {alive.length > 1 && (
-                      <select
-                        value={teamSort}
-                        onChange={(e) => setTeamSort(e.target.value as TeamSortKey)}
-                        className="w-full text-sm border border-border-default rounded-lg px-3 py-1.5 bg-surface-0 text-text-primary mb-3"
-                      >
-                        <option value="route">Route Order</option>
-                        <option value="level">Catch Level</option>
-                        <option value="species">Species Name</option>
-                        <option value="dex">National Dex</option>
-                      </select>
-                    )}
-                    {alive.length > 0 && (
-                      <div className="grid grid-cols-2 gap-2 mb-3">
-                        {alive.map((enc) => (
-                          <PokemonCard
-                            key={enc.id}
-                            encounter={enc}
-                            onClick={
-                              isActive && canEdit ? () => setSelectedTeamEncounter(enc) : undefined
-                            }
-                          />
-                        ))}
-                      </div>
-                    )}
-                    {dead.length > 0 && (
-                      <>
-                        <h3 className="text-sm font-medium text-text-tertiary mb-2">Graveyard</h3>
-                        <div className="grid grid-cols-2 gap-2">
-                          {dead.map((enc) => (
-                            <PokemonCard
-                              key={enc.id}
-                              encounter={enc}
-                              showFaintLevel
-                              onClick={
-                                isActive && canEdit
-                                  ? () => setSelectedTeamEncounter(enc)
-                                  : undefined
-                              }
-                            />
-                          ))}
+                            )
+                          )}
                         </div>
-                      </>
-                    )}
-                  </div>
+                        <span className="text-xs text-text-muted shrink-0">{si.label}</span>
+                      </button>
+                    )
+                  })()
+                )
+
+              return (
+                <div key={route.id}>
+                  {routeElement}
+                  {/* Boss battle cards after this route */}
+                  {bossesHere.map((boss) => {
+                    const isDefeated = defeatedBossIds.has(boss.id)
+                    const sectionAfter = sectionDividerAfterBoss.get(boss.id)
+                    const bossTypeLabel: Record<string, string> = {
+                      gym_leader: 'Gym Leader',
+                      elite_four: 'Elite Four',
+                      champion: 'Champion',
+                      rival: 'Rival',
+                      evil_team: 'Evil Team',
+                      kahuna: 'Kahuna',
+                      totem: 'Totem',
+                      other: 'Boss',
+                    }
+                    const bossTypeColors: Record<string, string> = {
+                      gym_leader: 'border-yellow-600',
+                      elite_four: 'border-purple-600',
+                      champion: 'border-red-600',
+                      rival: 'border-blue-600',
+                      evil_team: 'border-gray-400',
+                      kahuna: 'border-orange-600',
+                      totem: 'border-teal-600',
+                      other: 'border-gray-500',
+                    }
+
+                    const isBossExpanded = expandedBosses.has(boss.id)
+                    const toggleBoss = () => {
+                      setExpandedBosses((prev) => {
+                        const next = new Set(prev)
+                        if (next.has(boss.id)) next.delete(boss.id)
+                        else next.add(boss.id)
+                        return next
+                      })
+                    }
+
+                    return (
+                      <div key={`boss-${boss.id}`}>
+                        <div
+                          className={`my-2 rounded-lg border-2 ${bossTypeColors[boss.bossType] ?? bossTypeColors['other']} ${
+                            isDefeated ? 'bg-green-900/10' : 'bg-surface-1'
+                          } px-4 py-3`}
+                        >
+                          <div
+                            className="flex items-start justify-between cursor-pointer select-none"
+                            onClick={toggleBoss}
+                          >
+                            <div className="flex items-center gap-3">
+                              <svg
+                                className={`w-4 h-4 text-text-tertiary transition-transform ${isBossExpanded ? 'rotate-90' : ''}`}
+                                fill="none"
+                                viewBox="0 0 24 24"
+                                stroke="currentColor"
+                                strokeWidth={2}
+                              >
+                                <path
+                                  strokeLinecap="round"
+                                  strokeLinejoin="round"
+                                  d="M9 5l7 7-7 7"
+                                />
+                              </svg>
+                              {boss.spriteUrl && (
+                                <img src={boss.spriteUrl} alt={boss.name} className="h-10 w-auto" />
+                              )}
+                              <div>
+                                <div className="flex items-center gap-2">
+                                  <span className="text-sm font-semibold text-text-primary">
+                                    {boss.name}
+                                  </span>
+                                  <span className="px-2 py-0.5 text-xs font-medium rounded-full bg-surface-2 text-text-secondary">
+                                    {bossTypeLabel[boss.bossType] ?? boss.bossType}
+                                  </span>
+                                  {boss.specialtyType && <TypeBadge type={boss.specialtyType} />}
+                                </div>
+                                <p className="text-xs text-text-tertiary">
+                                  {boss.location} &middot; Level Cap: {boss.levelCap}
+                                </p>
+                              </div>
+                            </div>
+                            <div onClick={(e) => e.stopPropagation()}>
+                              {isDefeated ? (
+                                <span className="inline-flex items-center gap-1 px-2 py-1 text-xs font-medium rounded-full bg-green-900/40 text-green-300 light:bg-green-100 light:text-green-800">
+                                  Defeated &#10003;
+                                </span>
+                              ) : isActive && canEdit ? (
+                                <button
+                                  onClick={() => setSelectedBoss(boss)}
+                                  className="px-3 py-1 text-xs font-medium rounded-full bg-accent-600 text-white hover:bg-accent-500 transition-colors"
+                                >
+                                  Battle
+                                </button>
+                              ) : null}
+                            </div>
+                          </div>
+                          {/* Boss pokemon team */}
+                          {isBossExpanded && boss.pokemon.length > 0 && (
+                            <BossTeamPreview pokemon={boss.pokemon} starterName={starterName} />
+                          )}
+                          {/* Player team snapshot */}
+                          {isDefeated &&
+                            (() => {
+                              const result = bossResultByBattleId.get(boss.id)
+                              if (!result || result.team.length === 0) return null
+                              return (
+                                <div className="mt-3 pt-3 border-t border-border-default">
+                                  <p className="text-xs font-medium text-text-secondary mb-2">
+                                    Your Team
+                                  </p>
+                                  <div className="flex gap-2 flex-wrap">
+                                    {result.team.map((tm: BossResultTeamMember) => {
+                                      const enc = encounterById.get(tm.encounterId)
+                                      if (!enc) return null
+                                      const dp = enc.currentPokemon ?? enc.pokemon
+                                      return (
+                                        <div key={tm.id} className="flex flex-col items-center">
+                                          {dp.spriteUrl ? (
+                                            <img
+                                              src={dp.spriteUrl}
+                                              alt={dp.name}
+                                              className="w-10 h-10"
+                                            />
+                                          ) : (
+                                            <div className="w-10 h-10 bg-surface-3 rounded-full" />
+                                          )}
+                                          <span className="text-[10px] text-text-tertiary capitalize">
+                                            {enc.nickname ?? dp.name}
+                                          </span>
+                                          <span className="text-[10px] text-text-muted">
+                                            Lv.{tm.level}
+                                          </span>
+                                        </div>
+                                      )
+                                    })}
+                                  </div>
+                                </div>
+                              )
+                            })()}
+                        </div>
+                        {sectionAfter && (
+                          <div className="flex items-center gap-3 my-4">
+                            <div className="flex-1 h-px bg-surface-3" />
+                            <span className="text-sm font-semibold text-text-tertiary uppercase tracking-wider">
+                              {sectionAfter}
+                            </span>
+                            <div className="flex-1 h-px bg-surface-3" />
+                          </div>
+                        )}
+                      </div>
+                    )
+                  })}
                 </div>
-              </div>
-            )}
+              )
+            })}
           </div>
 
           {/* Encounter Modal */}

frontend/src/types/game.ts

@@ -238,7 +238,7 @@ export interface BossBattle {
 export interface BossResultTeamMember {
   id: number
   encounterId: number
-  level: number | null
+  level: number
 }
 
 export interface BossResult {
@@ -253,7 +253,7 @@ export interface BossResult {
 
 export interface BossResultTeamMemberInput {
   encounterId: number
-  level?: number | null
+  level: number
 }
 
 export interface CreateBossResultInput {