@papi-ai/server 0.7.82 → 0.7.83

package/dist/backfill-cycle-metrics.js

@@ -8,6 +8,151 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// ../shared/dist/index.js
+function isSelfHostedDeployment(value) {
+  return value === "1" || value?.toLowerCase() === "true";
+}
+function optionalBoolean(value, fallback) {
+  if (value == null || value.trim() === "") return fallback;
+  return isSelfHostedDeployment(value);
+}
+function cleanUrl(value) {
+  const cleaned = value?.trim().replace(/\/+$/, "");
+  return cleaned || void 0;
+}
+function resolveDeploymentProfile(env) {
+  const selfHosted = isSelfHostedDeployment(env.selfHosted);
+  const hostedSupabaseUrl = cleanUrl(env.hostedSupabaseUrl);
+  return {
+    kind: selfHosted ? "self-hosted" : "hosted",
+    appUrl: cleanUrl(env.appUrl) ?? (selfHosted ? void 0 : HOSTED_APP_URL),
+    mcpUrl: cleanUrl(env.mcpUrl) ?? (selfHosted ? void 0 : HOSTED_MCP_URL),
+    dataEndpoint: cleanUrl(env.dataEndpoint) ?? (hostedSupabaseUrl ? `${hostedSupabaseUrl}/functions/v1/data-proxy` : void 0) ?? (selfHosted ? void 0 : `${HOSTED_SUPABASE_URL}/functions/v1/data-proxy`),
+    providers: {
+      vercel: optionalBoolean(env.vercelEnabled, !selfHosted),
+      railway: optionalBoolean(env.railwayEnabled, !selfHosted),
+      managedSupabase: optionalBoolean(env.managedSupabaseEnabled, !selfHosted)
+    },
+    auth: {
+      emailPassword: optionalBoolean(env.emailPasswordEnabled, true),
+      emailSignup: optionalBoolean(env.emailSignupEnabled, false),
+      google: optionalBoolean(env.googleAuthEnabled, !selfHosted),
+      github: optionalBoolean(env.githubAuthEnabled, !selfHosted)
+    }
+  };
+}
+function effortOrdinal(effort) {
+  if (typeof effort !== "string") return void 0;
+  const normalized = effort.trim().toUpperCase();
+  return EFFORT_SCALE[normalized];
+}
+function isUnparsedEffort(effort) {
+  if (typeof effort !== "string" || effort.trim().length === 0) return false;
+  return effortOrdinal(effort) === void 0;
+}
+function calculateCycleMetrics(reports, currentCycle, window = 5) {
+  const recentReports = reports.filter(
+    (r) => r.cycle > currentCycle - window && r.cycle <= currentCycle
+  );
+  const unparsedEffortCount = recentReports.filter(
+    (r) => isUnparsedEffort(r.actualEffort) || isUnparsedEffort(r.estimatedEffort)
+  ).length;
+  const perCycle = /* @__PURE__ */ new Map();
+  for (const r of recentReports) {
+    const group = perCycle.get(r.cycle) ?? [];
+    group.push(r);
+    perCycle.set(r.cycle, group);
+  }
+  const accuracy = [];
+  const velocity = [];
+  const sortedCycles = [...perCycle.keys()].sort((a, b) => a - b);
+  for (const cycle of sortedCycles) {
+    const reps = perCycle.get(cycle);
+    const deltas = [];
+    for (const r of reps) {
+      const actual = effortOrdinal(r.actualEffort);
+      const estimated = effortOrdinal(r.estimatedEffort);
+      if (actual !== void 0 && estimated !== void 0) {
+        deltas.push(actual - estimated);
+      }
+    }
+    if (deltas.length > 0) {
+      accuracy.push({
+        cycle,
+        reports: deltas.length,
+        matchRate: Math.round(deltas.filter((d) => d === 0).length / deltas.length * 100),
+        mae: Math.round(deltas.reduce((s, d) => s + Math.abs(d), 0) / deltas.length * 10) / 10,
+        bias: Math.round(deltas.reduce((s, d) => s + d, 0) / deltas.length * 10) / 10
+      });
+    }
+    velocity.push({
+      cycle,
+      completed: reps.filter((r) => r.completed === "Yes").length,
+      partial: reps.filter((r) => r.completed === "Partial").length,
+      failed: reps.filter((r) => r.completed === "No").length,
+      effortPoints: reps.reduce((s, r) => s + (effortOrdinal(r.actualEffort) ?? 0), 0)
+    });
+  }
+  return { accuracy, velocity, unparsedEffortCount };
+}
+var CAPABILITY_REGISTRY, CAPABILITY_KEYS, HOSTED_APP_URL, HOSTED_MCP_URL, HOSTED_SUPABASE_URL, WAB_WINDOW_DAYS, WAB_WEEK_MS, EFFORT_SCALE;
+var init_dist = __esm({
+  "../shared/dist/index.js"() {
+    "use strict";
+    CAPABILITY_REGISTRY = [
+      { key: "prReviewer", label: "Auto code review", description: "Runs a code review of the branch diff before accepting.", step: "review" },
+      { key: "securityScan", label: "Security scan", description: "Flags a security pass on risk-tier changes at review time.", step: "review" },
+      { key: "changelog", label: "Changelog & cycle update", description: "Curates a cycle-update post when a release ships.", step: "release" },
+      { key: "verifyHealthCheck", label: "Release health check", description: "Reminds you to verify cycle state before release.", step: "release" },
+      { key: "gestaltPreBuild", label: "Gestalt pre-build check", description: "Reads the whole cycle before building the first task.", step: "build" },
+      { key: "batchBuildRollup", label: "Batch build rollup", description: "Emits a cross-task summary after a batch build.", step: "build" },
+      { key: "modelRecommendation", label: "Model recommendation", description: "Suggests a model tier for each task.", step: "build" },
+      { key: "discoveredIssues", label: "Discovered issues surfacing", description: "Surfaces issues logged during builds at release.", step: "release" },
+      { key: "publishDirective", label: "Publish & registry updates", description: "Announces the release and updates MCP registry listings.", step: "release" },
+      // task-2482 (C319): the release quality gate. When on AND a gate command is
+      // configured (PAPI_GATE), release makes the host LLM run that command and
+      // BLOCKS the tag/merge on failure (fail-closed, AD-58 — PAPI never runs it).
+      { key: "releaseGate", label: "Release quality gate", description: "Runs your test/build command before release and blocks on failure.", step: "release" },
+      // task-2491 (C320): post-release deploy hook — the deploy half of the ship→verify
+      // loop. UNLIKE every other capability this one defaults OFF (defaultEnabled:false):
+      // running a deploy command is destructive, so it is strictly opt-in. When ON AND
+      // papi.deploy (PAPI_DEPLOY) is set, release emits a directive telling the HOST to
+      // run the deploy command AFTER the merge/tag (AD-58 — PAPI never runs it) and
+      // records a deploy_hook progress step so the reactive hub shows the deploy step.
+      { key: "deployHook", label: "Post-release deploy", description: "Runs your deploy command after a release merges.", step: "release", defaultEnabled: false },
+      // task-2833 (C341): enforce the handoff's acceptanceCriteria[] at build-complete.
+      // When ON, a completed:"yes" build whose handoff lists acceptance criteria must
+      // pass acceptance_confirmed:true or build_execute returns the checklist and does
+      // NOT mark the task Done (non-destructive — the report is not discarded). Defaults
+      // OFF: it changes the completion contract, so it is strictly opt-in until a project
+      // chooses to hold builds to their own acceptance criteria.
+      { key: "acceptanceGate", label: "Acceptance-criteria gate", description: "Requires confirming the handoff acceptance criteria before a build completes.", step: "build", defaultEnabled: false },
+      // task-2325 (C344): configurable workflow guardrails — let a user opt out of the
+      // git/branch/commit/PR ceremony and PAPI-meta framing so PAPI adapts to their
+      // workflow instead of imposing one. Every toggle DEFAULTS ON (no defaultEnabled)
+      // so current behaviour is byte-identical until the user flips it off. The no-git
+      // fallback that these ride on top of is a separate task (task-2353).
+      { key: "autoBranch", label: "Auto branch", description: "Creates a feature branch per task/cycle at build start.", step: "build" },
+      { key: "autoCommit", label: "Auto commit", description: "Commits your work automatically when a build completes.", step: "build" },
+      { key: "autoPush", label: "Auto push & PR", description: "Pushes the branch and opens a pull request on build complete.", step: "build" },
+      { key: "papiMetaFraming", label: "PAPI self-referential framing", description: "Includes PAPI-meta build-discipline framing in handoff output.", step: "build" }
+    ];
+    CAPABILITY_KEYS = CAPABILITY_REGISTRY.map((c) => c.key);
+    HOSTED_APP_URL = "https://getpapi.ai";
+    HOSTED_MCP_URL = "https://mcp.getpapi.ai";
+    HOSTED_SUPABASE_URL = "https://guewgygcpcmrcoppihzx.supabase.co";
+    WAB_WINDOW_DAYS = 7;
+    WAB_WEEK_MS = WAB_WINDOW_DAYS * 24 * 60 * 60 * 1e3;
+    EFFORT_SCALE = {
+      XS: 1,
+      S: 2,
+      M: 3,
+      L: 4,
+      XL: 5
+    };
+  }
+});
+
 // src/lib/git.ts
 var git_exports = {};
 __export(git_exports, {
@@ -1230,14 +1375,12 @@ function reportTelemetryEmitFailure(reason, ctx) {
 function noteTelemetryEmitSuccess() {
   consecutiveTelemetryFailures = 0;
 }
-var HOSTED_SUPABASE_URL, DEFAULT_TELEMETRY_ENDPOINT, MD_PINGS_SUPABASE_URL, consecutiveTelemetryFailures, TELEMETRY_BLACKOUT_THRESHOLD;
+var consecutiveTelemetryFailures, TELEMETRY_BLACKOUT_THRESHOLD;
 var init_telemetry = __esm({
   "src/lib/telemetry.ts"() {
     "use strict";
     init_install_id();
-    HOSTED_SUPABASE_URL = process.env["PAPI_HOSTED_SUPABASE_URL"] ?? "https://guewgygcpcmrcoppihzx.supabase.co";
-    DEFAULT_TELEMETRY_ENDPOINT = `${HOSTED_SUPABASE_URL}/functions/v1/data-proxy`;
-    MD_PINGS_SUPABASE_URL = process.env["PAPI_MD_PINGS_URL"] ?? HOSTED_SUPABASE_URL;
+    init_dist();
     consecutiveTelemetryFailures = 0;
     TELEMETRY_BLACKOUT_THRESHOLD = 3;
   }
@@ -1493,6 +1636,13 @@ var init_proxy_adapter = __esm({
       "commitReviewSubmit",
       "commitRelease",
       // (2) not-yet-wired hosted gaps — shrink as data-proxy handlers land (task-2390).
+      // These Active Decision transaction helpers exist only on the direct-pg adapter.
+      // The strategy service probes for them structurally and deliberately falls back to
+      // the hosted-safe read/upsert paths when they are absent. Exposing them through the
+      // generic trap sends an unwired method to data-proxy and turns that fallback into a
+      // 403, blocking strategy_change and strategy_review on the canonical remote MCP.
+      "allocateActiveDecision",
+      "applyActiveDecisionUpdates",
       // getToolCallCount + updatePhaseStatus are ABSENT: they now have edge handlers and
       // are served through the forwarder (getToolCallCount = SUP-2026-026 handler #1).
       "getContributorRole",
@@ -2366,6 +2516,7 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
 import { pathToFileURL } from "url";
 
 // src/adapter-factory.ts
+init_dist();
 import path2 from "path";
 import { execSync } from "child_process";
 
@@ -2450,8 +2601,18 @@ function detectUserId() {
   }
   return void 0;
 }
-var HOSTED_SUPABASE_URL2 = process.env["PAPI_HOSTED_SUPABASE_URL"] ?? "https://guewgygcpcmrcoppihzx.supabase.co";
-var HOSTED_PROXY_ENDPOINT = `${HOSTED_SUPABASE_URL2}/functions/v1/data-proxy`;
+function serverDeploymentProfile() {
+  return resolveDeploymentProfile({
+    selfHosted: process.env["PAPI_SELF_HOST"],
+    appUrl: process.env["PAPI_DASHBOARD_URL"],
+    mcpUrl: process.env["NEXT_PUBLIC_MCP_URL"],
+    dataEndpoint: process.env["PAPI_DATA_ENDPOINT"],
+    hostedSupabaseUrl: process.env["PAPI_HOSTED_SUPABASE_URL"],
+    vercelEnabled: process.env["PAPI_ENABLE_VERCEL"],
+    railwayEnabled: process.env["PAPI_ENABLE_RAILWAY"],
+    managedSupabaseEnabled: process.env["PAPI_ENABLE_MANAGED_SUPABASE"]
+  });
+}
 var PLACEHOLDER_PATTERNS = [
   "<YOUR_DATABASE_URL>",
   "your-database-url",
@@ -2687,7 +2848,8 @@ Fix the PAPI_PROJECT_ID in your .mcp.json (or unset it and let PAPI resolve the
     }
     case "proxy": {
       const { ProxyPapiAdapter: ProxyPapiAdapter2, wrapWithForwarding: wrapWithForwarding2 } = await Promise.resolve().then(() => (init_proxy_adapter(), proxy_adapter_exports));
-      const dashboardUrl = process.env["PAPI_DASHBOARD_URL"] || "https://getpapi.ai";
+      const deployment = serverDeploymentProfile();
+      const dashboardUrl = deployment.appUrl;
       const projectId = process.env["PAPI_PROJECT_ID"];
       const dataApiKey = process.env["PAPI_DATA_API_KEY"];
       if (!dataApiKey) {
@@ -2695,14 +2857,19 @@ Fix the PAPI_PROJECT_ID in your .mcp.json (or unset it and let PAPI resolve the
           `PAPI needs an account to store your project data.
 
 Get started in 3 steps:
-  1. Sign up at ${dashboardUrl}/login
+  1. Sign up at ${dashboardUrl ? `${dashboardUrl}/login` : "your configured PAPI dashboard"}
   2. Complete the onboarding wizard \u2014 it generates your .mcp.json config
   3. Download the config, place it in your project root, and restart Claude Code
 
 Already have an account? Make sure PAPI_DATA_API_KEY is set in your .mcp.json env config.`
         );
       }
-      const dataEndpoint = process.env["PAPI_DATA_ENDPOINT"] || HOSTED_PROXY_ENDPOINT;
+      const dataEndpoint = deployment.dataEndpoint;
+      if (!dataEndpoint) {
+        throw new Error(
+          "PAPI_DATA_ENDPOINT is required for the proxy adapter in a self-hosted deployment. Set it to the deployment-owned data-proxy URL; hosted production defaults are intentionally disabled."
+        );
+      }
       const adapter = new ProxyPapiAdapter2({
         endpoint: dataEndpoint,
         apiKey: dataApiKey,
@@ -2800,111 +2967,8 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
   }
 }
 
-// ../shared/dist/index.js
-var CAPABILITY_REGISTRY = [
-  { key: "prReviewer", label: "Auto code review", description: "Runs a code review of the branch diff before accepting.", step: "review" },
-  { key: "securityScan", label: "Security scan", description: "Flags a security pass on risk-tier changes at review time.", step: "review" },
-  { key: "changelog", label: "Changelog & cycle update", description: "Curates a cycle-update post when a release ships.", step: "release" },
-  { key: "verifyHealthCheck", label: "Release health check", description: "Reminds you to verify cycle state before release.", step: "release" },
-  { key: "gestaltPreBuild", label: "Gestalt pre-build check", description: "Reads the whole cycle before building the first task.", step: "build" },
-  { key: "batchBuildRollup", label: "Batch build rollup", description: "Emits a cross-task summary after a batch build.", step: "build" },
-  { key: "modelRecommendation", label: "Model recommendation", description: "Suggests a model tier for each task.", step: "build" },
-  { key: "discoveredIssues", label: "Discovered issues surfacing", description: "Surfaces issues logged during builds at release.", step: "release" },
-  { key: "publishDirective", label: "Publish & registry updates", description: "Announces the release and updates MCP registry listings.", step: "release" },
-  // task-2482 (C319): the release quality gate. When on AND a gate command is
-  // configured (PAPI_GATE), release makes the host LLM run that command and
-  // BLOCKS the tag/merge on failure (fail-closed, AD-58 — PAPI never runs it).
-  { key: "releaseGate", label: "Release quality gate", description: "Runs your test/build command before release and blocks on failure.", step: "release" },
-  // task-2491 (C320): post-release deploy hook — the deploy half of the ship→verify
-  // loop. UNLIKE every other capability this one defaults OFF (defaultEnabled:false):
-  // running a deploy command is destructive, so it is strictly opt-in. When ON AND
-  // papi.deploy (PAPI_DEPLOY) is set, release emits a directive telling the HOST to
-  // run the deploy command AFTER the merge/tag (AD-58 — PAPI never runs it) and
-  // records a deploy_hook progress step so the reactive hub shows the deploy step.
-  { key: "deployHook", label: "Post-release deploy", description: "Runs your deploy command after a release merges.", step: "release", defaultEnabled: false },
-  // task-2833 (C341): enforce the handoff's acceptanceCriteria[] at build-complete.
-  // When ON, a completed:"yes" build whose handoff lists acceptance criteria must
-  // pass acceptance_confirmed:true or build_execute returns the checklist and does
-  // NOT mark the task Done (non-destructive — the report is not discarded). Defaults
-  // OFF: it changes the completion contract, so it is strictly opt-in until a project
-  // chooses to hold builds to their own acceptance criteria.
-  { key: "acceptanceGate", label: "Acceptance-criteria gate", description: "Requires confirming the handoff acceptance criteria before a build completes.", step: "build", defaultEnabled: false },
-  // task-2325 (C344): configurable workflow guardrails — let a user opt out of the
-  // git/branch/commit/PR ceremony and PAPI-meta framing so PAPI adapts to their
-  // workflow instead of imposing one. Every toggle DEFAULTS ON (no defaultEnabled)
-  // so current behaviour is byte-identical until the user flips it off. The no-git
-  // fallback that these ride on top of is a separate task (task-2353).
-  { key: "autoBranch", label: "Auto branch", description: "Creates a feature branch per task/cycle at build start.", step: "build" },
-  { key: "autoCommit", label: "Auto commit", description: "Commits your work automatically when a build completes.", step: "build" },
-  { key: "autoPush", label: "Auto push & PR", description: "Pushes the branch and opens a pull request on build complete.", step: "build" },
-  { key: "papiMetaFraming", label: "PAPI self-referential framing", description: "Includes PAPI-meta build-discipline framing in handoff output.", step: "build" }
-];
-var CAPABILITY_KEYS = CAPABILITY_REGISTRY.map((c) => c.key);
-var WAB_WINDOW_DAYS = 7;
-var WAB_WEEK_MS = WAB_WINDOW_DAYS * 24 * 60 * 60 * 1e3;
-var EFFORT_SCALE = {
-  XS: 1,
-  S: 2,
-  M: 3,
-  L: 4,
-  XL: 5
-};
-function effortOrdinal(effort) {
-  if (typeof effort !== "string") return void 0;
-  const normalized = effort.trim().toUpperCase();
-  return EFFORT_SCALE[normalized];
-}
-function isUnparsedEffort(effort) {
-  if (typeof effort !== "string" || effort.trim().length === 0) return false;
-  return effortOrdinal(effort) === void 0;
-}
-function calculateCycleMetrics(reports, currentCycle, window = 5) {
-  const recentReports = reports.filter(
-    (r) => r.cycle > currentCycle - window && r.cycle <= currentCycle
-  );
-  const unparsedEffortCount = recentReports.filter(
-    (r) => isUnparsedEffort(r.actualEffort) || isUnparsedEffort(r.estimatedEffort)
-  ).length;
-  const perCycle = /* @__PURE__ */ new Map();
-  for (const r of recentReports) {
-    const group = perCycle.get(r.cycle) ?? [];
-    group.push(r);
-    perCycle.set(r.cycle, group);
-  }
-  const accuracy = [];
-  const velocity = [];
-  const sortedCycles = [...perCycle.keys()].sort((a, b) => a - b);
-  for (const cycle of sortedCycles) {
-    const reps = perCycle.get(cycle);
-    const deltas = [];
-    for (const r of reps) {
-      const actual = effortOrdinal(r.actualEffort);
-      const estimated = effortOrdinal(r.estimatedEffort);
-      if (actual !== void 0 && estimated !== void 0) {
-        deltas.push(actual - estimated);
-      }
-    }
-    if (deltas.length > 0) {
-      accuracy.push({
-        cycle,
-        reports: deltas.length,
-        matchRate: Math.round(deltas.filter((d) => d === 0).length / deltas.length * 100),
-        mae: Math.round(deltas.reduce((s, d) => s + Math.abs(d), 0) / deltas.length * 10) / 10,
-        bias: Math.round(deltas.reduce((s, d) => s + d, 0) / deltas.length * 10) / 10
-      });
-    }
-    velocity.push({
-      cycle,
-      completed: reps.filter((r) => r.completed === "Yes").length,
-      partial: reps.filter((r) => r.completed === "Partial").length,
-      failed: reps.filter((r) => r.completed === "No").length,
-      effortPoints: reps.reduce((s, r) => s + (effortOrdinal(r.actualEffort) ?? 0), 0)
-    });
-  }
-  return { accuracy, velocity, unparsedEffortCount };
-}
-
 // src/lib/formatters.ts
+init_dist();
 var PLAN_FULL_NOTES_BUDGET_BYTES = Number(process.env.PAPI_PLAN_NOTES_BUDGET) || 6e4;
 function effortWeight(size) {
   switch ((size || "").toUpperCase()) {