@papi-ai/server 0.7.85 → 0.7.98

package/dist/backfill-cycle-metrics.js

@@ -30,7 +30,6 @@ function resolveDeploymentProfile(env) {
     dataEndpoint: cleanUrl(env.dataEndpoint) ?? (hostedSupabaseUrl ? `${hostedSupabaseUrl}/functions/v1/data-proxy` : void 0) ?? (selfHosted ? void 0 : `${HOSTED_SUPABASE_URL}/functions/v1/data-proxy`),
     providers: {
       vercel: optionalBoolean(env.vercelEnabled, !selfHosted),
-      railway: optionalBoolean(env.railwayEnabled, !selfHosted),
       managedSupabase: optionalBoolean(env.managedSupabaseEnabled, !selfHosted)
     },
     auth: {
@@ -100,6 +99,21 @@ var init_dist = __esm({
   "../shared/dist/index.js"() {
     "use strict";
     CAPABILITY_REGISTRY = [
+      // task-3384: the PLAN step. The landing page has advertised these three since
+      // the v5 control beat (components/marketing/landing/ControlC.tsx) with a code
+      // comment reading "shipping soon, shown now" — the registry had no plan-step
+      // entry at all, so the Planning group rendered empty and was dropped. These
+      // are NOT new behaviour: each one gates a section of the planner instructions
+      // that already runs on every full-mode plan, so ON reproduces today exactly.
+      //
+      // All three default ON. Turning one off removes its step from the planner
+      // prompt, which is the whole mechanism — the planner does what the prompt
+      // tells it to, so an omitted step is genuinely not performed (and the matching
+      // plan-prepare progress checkpoint is not recorded, so the hub does not claim
+      // a step that never ran).
+      { key: "planHealthCheck", label: "Health check", description: "Flags cycle gaps, stale tasks and AD conflicts before planning.", step: "plan" },
+      { key: "backlogTriage", label: "Backlog triage", description: "Cleans up and prioritises unreviewed backlog items during planning.", step: "plan" },
+      { key: "buildOrder", label: "Build order", description: "Detects intra-cycle dependencies and sequences the build.", step: "plan" },
       { key: "prReviewer", label: "Auto code review", description: "Runs a code review of the branch diff before accepting.", step: "review" },
       { key: "securityScan", label: "Security scan", description: "Flags a security pass on risk-tier changes at review time.", step: "review" },
       { key: "changelog", label: "Changelog & cycle update", description: "Curates a cycle-update post when a release ships.", step: "release" },
@@ -154,7 +168,7 @@ var init_dist = __esm({
     CAPABILITY_KEYS = CAPABILITY_REGISTRY.map((c) => c.key);
     HOSTED_APP_URL = "https://getpapi.ai";
     HOSTED_MCP_URL = "https://mcp.getpapi.ai";
-    HOSTED_SUPABASE_URL = "https://guewgygcpcmrcoppihzx.supabase.co";
+    HOSTED_SUPABASE_URL = "https://api.getpapi.ai";
     WAB_WINDOW_DAYS = 7;
     WAB_WEEK_MS = WAB_WINDOW_DAYS * 24 * 60 * 60 * 1e3;
     EFFORT_SCALE = {
@@ -1471,6 +1485,16 @@ __export(proxy_adapter_exports, {
   createProxyAdapter: () => createProxyAdapter,
   wrapWithForwarding: () => wrapWithForwarding
 });
+function formatRateLimitError(route, response, errorBody, displayMessage = errorBody) {
+  let reason;
+  try {
+    const parsed = JSON.parse(errorBody);
+    if (typeof parsed.reason === "string") reason = parsed.reason;
+  } catch {
+  }
+  const retryAfter = response.headers.get("Retry-After");
+  return `Proxy rate limit on ${route}${reason ? ` (${reason})` : ""}${retryAfter ? `; retry after ${retryAfter}s` : ""}: ${displayMessage}`;
+}
 function snakeToCamel(str) {
   return str.replace(/_([a-z0-9])/g, (_, c) => c.toUpperCase());
 }
@@ -1512,7 +1536,7 @@ function wrapWithForwarding(instance) {
   return new Proxy(instance, {
     get(target, prop, receiver) {
       const existing = Reflect.get(target, prop, receiver);
-      if (existing !== void 0) return existing;
+      if (Reflect.has(target, prop)) return existing;
       if (typeof prop !== "string" || prop === "then" || prop.startsWith("_") || NO_FORWARD.has(prop)) {
         return existing;
       }
@@ -1644,8 +1668,14 @@ var init_proxy_adapter = __esm({
       "linkPhasesToStage",
       "listContributors",
       "listConventions",
+      "listDecisionPositions",
+      "upsertDecisionPosition",
+      "proposeDecision",
+      "resolveDecisionState",
+      "getUserEmailsByIds",
       "listMyBugReports",
       "listOwnerActionsForBlockerScan",
+      "listOwnerActionsForOwner",
       "logEntityReferences",
       "markAgendaTopicsAddressed",
       "markCycleLearningResolved",
@@ -1709,6 +1739,12 @@ var init_proxy_adapter = __esm({
       // (1) local-only
       "close",
       "initRls",
+      // task-3667: the exit-criteria evaluators probe adapter.sql to pick their
+      // transport branch (direct SQL vs adapter reads). Forwarding `sql` to the
+      // edge 403'd INSIDE sqlOf — every SQL-backed evaluator then threw
+      // 'evaluator failed' instead of engaging its hosted branch or degrading to
+      // an honest unevaluated reason. `sql` is local-only by definition.
+      "sql",
       // task-3207 (C357): commitBuildComplete, commitReviewSubmit, commitRelease have no
       // edge case handler and no ALLOWED_METHODS entry — forwarding them 403s at the edge
       // with no try/catch at the call site, crashing build_execute/review_submit/release
@@ -1795,6 +1831,15 @@ var init_proxy_adapter = __esm({
         this.projectId = config.projectId ?? "";
         this.onAuthRejected = config.onAuthRejected;
       }
+      /**
+       * Headers shared by every authenticated proxy route.
+       */
+      authenticatedHeaders() {
+        return {
+          "Content-Type": "application/json",
+          "Authorization": `Bearer ${this.apiKey}`
+        };
+      }
       /**
        * Does the hosted path genuinely serve `name`? (task-3022, C362)
        *
@@ -1833,10 +1878,7 @@ var init_proxy_adapter = __esm({
         try {
           const response = await fetch(`${this.endpoint}/project-list`, {
             method: "POST",
-            headers: {
-              "Content-Type": "application/json",
-              "Authorization": `Bearer ${this.apiKey}`
-            },
+            headers: this.authenticatedHeaders(),
             body: "{}",
             signal: AbortSignal.timeout(5e3)
           });
@@ -1875,10 +1917,7 @@ var init_proxy_adapter = __esm({
         const url = `${this.endpoint}/ensure-project`;
         const response = await fetch(url, {
           method: "POST",
-          headers: {
-            "Content-Type": "application/json",
-            "Authorization": `Bearer ${this.apiKey}`
-          },
+          headers: this.authenticatedHeaders(),
           body: JSON.stringify({
             ...projectName ? { projectName } : {},
             ...repoUrl ? { repoUrl } : {},
@@ -1898,6 +1937,9 @@ var init_proxy_adapter = __esm({
           } catch {
             message = errorBody;
           }
+          if (response.status === 429) {
+            throw new Error(formatRateLimitError("ensureProject", response, errorBody, message));
+          }
           throw new Error(`Auto-provision failed (${response.status}): ${message}`);
         }
         const body = await response.json();
@@ -1918,10 +1960,7 @@ var init_proxy_adapter = __esm({
         try {
           response = await fetch(url, {
             method: "POST",
-            headers: {
-              "Content-Type": "application/json",
-              "Authorization": `Bearer ${this.apiKey}`
-            },
+            headers: this.authenticatedHeaders(),
             body: JSON.stringify({
               projectId: this.projectId,
               method,
@@ -1964,6 +2003,9 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
 (${response.status} on ${method}: ${message})`
             );
           }
+          if (response.status === 429) {
+            throw new Error(formatRateLimitError(method, response, errorBody, message));
+          }
           throw new Error(`Proxy error (${response.status}) on ${method}: ${message}`);
         }
         const body = await response.json();
@@ -2025,10 +2067,7 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
         try {
           const response = await fetch(`${this.endpoint}/invoke`, {
             method: "POST",
-            headers: {
-              "Content-Type": "application/json",
-              "Authorization": `Bearer ${this.apiKey}`
-            },
+            headers: this.authenticatedHeaders(),
             body: JSON.stringify({ projectId, method: "projectExists", args: [] }),
             signal: AbortSignal.timeout(5e3)
           });
@@ -2059,8 +2098,8 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
       writeCycleLogEntry(entry) {
         return this.invoke("writeCycleLogEntry", [entry]);
       }
-      updateActiveDecision(id, body, cycleNumber) {
-        return this.invoke("updateActiveDecision", [id, body, cycleNumber]);
+      updateActiveDecision(id, body, cycleNumber, action) {
+        return this.invoke("updateActiveDecision", [id, body, cycleNumber, action]);
       }
       upsertActiveDecision(id, body, title, confidence, cycleNumber) {
         return this.invoke("upsertActiveDecision", [id, body, title, confidence, cycleNumber]);
@@ -2187,7 +2226,7 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
        * task-2288 (C308): emit a telemetry event via the proxy's /telemetry endpoint
        * using THIS adapter's per-request bearer (this.apiKey) — the same credential
        * invoke() uses. This is the fix for the hosted-transport blackout: on the
-       * multi-tenant Railway pod there is no PAPI_DATA_API_KEY env var, so the
+       * multi-tenant server has no PAPI_DATA_API_KEY env var, so the
        * env-var emitTelemetryEvent path (lib/telemetry.ts) dropped every event since
        * 2026-06-16. Fire-and-forget — never throws, never blocks the tool response.
        * Not routed through invoke() because /telemetry is a distinct endpoint and a
@@ -2203,10 +2242,7 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
         if (event.projectId) payload["projectId"] = event.projectId;
         fetch(`${this.endpoint}/telemetry`, {
           method: "POST",
-          headers: {
-            "Content-Type": "application/json",
-            "Authorization": `Bearer ${this.apiKey}`
-          },
+          headers: this.authenticatedHeaders(),
           body: JSON.stringify(payload),
           signal: AbortSignal.timeout(5e3)
         }).then((res) => {
@@ -2293,6 +2329,19 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
       getLatestDecisionScores() {
         return this.invoke("getLatestDecisionScores");
       }
+      // --- Decision lifecycle — propose / resolve / positions (task-3408, C366) ---
+      proposeDecision(id, decisionType, proposedByUserId, cycleNumber) {
+        return this.invoke("proposeDecision", [id, decisionType, proposedByUserId, cycleNumber]);
+      }
+      resolveDecisionState(id, state, actorUserId, cycleNumber) {
+        return this.invoke("resolveDecisionState", [id, state, actorUserId, cycleNumber]);
+      }
+      listDecisionPositions(decisionId) {
+        return this.invoke("listDecisionPositions", [decisionId]);
+      }
+      upsertDecisionPosition(decisionId, userId, status, comments) {
+        return this.invoke("upsertDecisionPosition", [decisionId, userId, status, comments ?? null]);
+      }
       logEntityReferences(refs) {
         return this.invoke("logEntityReferences", [refs]);
       }
@@ -2488,7 +2537,18 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
       }
       // --- Project metadata (path-identity guardrail) ---
       async getProjectInfo() {
-        return this.invoke("getProjectInfo", []);
+        const raw = await this.invoke("getProjectInfo", []);
+        if (!raw) return null;
+        return {
+          name: raw.name,
+          slug: raw.slug,
+          papi_dir: raw.papi_dir ?? raw.papiDir ?? null,
+          repo_url: raw.repo_url ?? raw.repoUrl ?? null,
+          capabilities: raw.capabilities ?? {},
+          discord_channel_id: raw.discord_channel_id ?? raw.discordChannelId ?? null,
+          decision_resolution_mode: raw.decision_resolution_mode ?? raw.decisionResolutionMode ?? "owner",
+          decision_type_resolvers: raw.decision_type_resolvers ?? raw.decisionTypeResolvers ?? {}
+        };
       }
       /**
        * task-2052 (C288): owner-gate identity for the proxy transport. Both sides
@@ -2528,10 +2588,7 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
       async postRoute(route, payload) {
         const response = await fetch(`${this.endpoint}/${route}`, {
           method: "POST",
-          headers: {
-            "Content-Type": "application/json",
-            "Authorization": `Bearer ${this.apiKey}`
-          },
+          headers: this.authenticatedHeaders(),
           body: JSON.stringify(payload),
           signal: AbortSignal.timeout(15e3)
         });
@@ -2543,6 +2600,9 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
           } catch {
             message = errorBody;
           }
+          if (response.status === 429) {
+            throw new Error(formatRateLimitError(route, response, errorBody, message));
+          }
           if (response.status === 401) this.onAuthRejected?.();
           throw new Error(`Proxy error (${response.status}) on ${route}: ${message}`);
         }
@@ -2692,7 +2752,6 @@ function serverDeploymentProfile() {
     dataEndpoint: process.env["PAPI_DATA_ENDPOINT"],
     hostedSupabaseUrl: process.env["PAPI_HOSTED_SUPABASE_URL"],
     vercelEnabled: process.env["PAPI_ENABLE_VERCEL"],
-    railwayEnabled: process.env["PAPI_ENABLE_RAILWAY"],
     managedSupabaseEnabled: process.env["PAPI_ENABLE_MANAGED_SUPABASE"]
   });
 }
@@ -2863,16 +2922,21 @@ Fix the PAPI_PROJECT_ID in your .mcp.json (or unset it and let PAPI resolve the
             });
           }
         } else {
-          if (!existing.root_commit_hash && rootHash) {
+          if (!existing.root_commit_hash && rootHash || !existing.repo_url && originUrl) {
             try {
-              await pgAdapter.updateProject(projectId, {
-                root_commit_hash: rootHash,
-                repo_url: originUrl ?? void 0,
-                resolution_method: "root_hash"
-              });
+              const update = {};
+              if (!existing.root_commit_hash && rootHash) {
+                update.root_commit_hash = rootHash;
+                update.resolution_method = "root_hash";
+              }
+              if (!existing.repo_url && originUrl) {
+                update.repo_url = originUrl;
+                if (!update.resolution_method && !existing.resolution_method) update.resolution_method = "repo_url";
+              }
+              await pgAdapter.updateProject(projectId, update);
             } catch (err) {
               console.error(
-                `[papi] \u26A0 Failed to backfill root_commit_hash: ${err instanceof Error ? err.message : String(err)}`
+                `[papi] \u26A0 Failed to backfill project resolution signals: ${err instanceof Error ? err.message : String(err)}`
               );
             }
           }
@@ -2913,7 +2977,7 @@ Fix the PAPI_PROJECT_ID in your .mcp.json (or unset it and let PAPI resolve the
         } catch {
         }
       }
-      const adapter = new PgPapiAdapter(config, projectId);
+      const adapter = new PgPapiAdapter({ ...config, userId: resolveUserId }, projectId);
       try {
         await adapter.initRls();
       } catch {