decocms 4.501.0 → 4.502.1

package/dist/server/migrate.js

@@ -2379,7 +2379,7 @@ var Bz=Object.defineProperty;var Gz=(_)=>_;function Oz(_,x){this[_]=Gz.bind(null
     ON CONFLICT (thread_id, repository_id) DO NOTHING
   `.execute(_),await I`DROP FUNCTION IF EXISTS repo_ref_try_jsonb(text)`.execute(_)}async function RW(_){await I`DROP TABLE IF EXISTS thread_repositories`.execute(_),await I`
     ALTER TABLE connections DROP COLUMN IF EXISTS repository_id
-  `.execute(_)}var BW={"001-initial-schema":Uu,"002-organization-settings":Ju,"003-connection-schema-align":Qu,"004-remove-models-binding":Xu,"005-connection-configuration":Zu,"006-add-views-to-settings":Wu,"007-monitoring-logs":ju,"008-event-bus":Lu,"009-drop-audit-logs":Fu,"010-gateways":Yu,"011-gateway-icon":Du,"012-gateway-tool-selection-mode":Hu,"013-monitoring-user-agent-gateway":Mu,"014-gateway-resources-prompts":Ru,"015-monitoring-properties":Bu,"016-downstream-token-client-info":Gu,"017-downstream-token-remove-userid":Ou,"018-drop-gateway-tool-selection-strategy":Su,"019-remove-gateway-is-default":fu,"020-enabled-plugins":Au,"021-threads":Iu,"022-rename-gateway-to-virtual-mcp":yu,"023-optimize-thread-indexes":Vu,"024-consolidate-virtual-mcp":wu,"025-add-monitoring-virtual-mcp-id":ku,"026-restrict-child-connection-delete":nu,"027-update-management-mcp-url":pu,"028-update-management-mcp-to-self":qu,"029-add-updated-by-to-connections":iu,"030-member-tags":cu,"031-add-dependency-mode":hu,"032-projects":tu,"033-thread-status":ou,"034-monitoring-dashboards":au,"035-project-connections":ru,"036-update-registry-url":lu,"037-ai-provider-keys":eu,"038-oauth-pkce-states":du,"039-automations":bu,"040-replace-next-run-at-with-last-run-at":su,"041-ai-provider-keys-unique-constraint":_C,"042-rename-mesh-mcp-to-cms-mcp":xC,"043-rename-cms-mcp-to-deco-cms":uC,"044-drop-connections-tools-column":CC,"045-thread-context-start-message":KC,"046-remove-object-storage-plugin":mC,"047-add-next-run-at":TC,"048-merge-projects-agents":EC,"049-remove-org-admin-projects":$C,"050-durable-agent-runs":PC,"051-org-sso":JC,"052-thread-agent-ids":QC,"053-registry-config":XC,"054-connection-slug":WC,"055-spaces":jC,"056-automation-project-scope":LC,"057-thread-virtual-mcp-id":FC,"058-trigger-callback-tokens":YC,"059-kv":DC,"060-member-index":HC,"061-downstream-token-connection-index":MC,"062-private-registry":RC,"063-event-subscriptions-enabled-boolean":BC,"064-brand-context":GC,"065-organization-domains":OC,"066-brand-context-structured":SC,"067-threads-metadata":fC,"068-threads-branch":AC,"069-sandbox-runner-state":IC,"070-model-categories":yC,"071-default-home-agents":VC,"072-ai-provider-key-preset-id":wC,"073-backfill-basic-usage-roles":kC,"074-sandbox-runner-state-handle-nonunique":nC,"075-thread-inflight-async-jobs":vC,"076-automations-drop-agent-json":pC,"077-tier-only-model-selection":qC,"078-automation-tool-call-kind":iC,"079-strip-legacy-freestyle-vm-map-entries":cC,"080-async-research-jobs":hC,"081-async-research-jobs-result-content":tC,"082-secrets":oC,"083-thread-run-locally":aC,"084-drop-host-sandbox-rows":rC,"085-rename-runner-kind":lC,"086-thread-pins-and-vm-map-rekey":eC,"087-fix-vm-map-rekey":dC,"088-purge-cli-activate-keys":bC,"089-rename-remote-user-to-desktop":sC,"090-automation-webhook-triggers":_K,"091-organization-domains-allow-multi":xK,"092-sandbox-naming-uniformization":uK,"093-backfill-global-search-basic-usage":CK,"094-org-file-configs":NK,"095-remove-automation-tool-call-kind":mK,"096-org-file-configs-public-url-base":TK,"097-drop-local-docker-sandbox-state":EK,"098-thread-message-parts":$K,"099-run-fence":PK,"100-link-transport":UK,"101-cancel-requested-at":JK,"102-observational-agent":QK,"103-revert-observational-agent":XK,"104-agent-sandbox-provider-kind":WK,"105-org-fs":jK,"106-automation-tools":LK,"107-org-fs-public-org":FK,"108-automation-max-agent-steps":YK,"109-thread-message-parts-per-message-seq":DK,"110-backfill-ghs-token-expiry":HK,"111-org-fs-thread-id":MK,"112-org-file-configs-credential-type":RK,"113-thread-failure-reason":BK,"114-run-acked-seq":GK,"115-thread-projected-seq":OK,"116-org-sites":SK,"117-org-file-configs-site-slug":fK,"118-organization-domains-multi-verify":AK,"119-organization-join-requests":IK,"120-org-fs-read-public":yK,"121-org-fs-share-password":VK,"122-split-web-research-tier":nK,"123-connection-credential-vault":vK,"124-drop-thread-projected-seq":pK,"125-github-child-single-parent":gK,"126-task-board":iK,"127-task-board-due-date":cK,"128-reports-only":hK,"129-task-board-assigned-by":tK,"130-task-board-thread-id":oK,"131-task-board-thread-link-cascade":aK,"132-task-board-item-prs":rK,"133-dedupe-duplicate-members":lK,"134-drop-task-board-enabled":eK,"135-task-board-item-fk-cascade":dK,"136-task-board-import-idempotency":bK,"137-agent-sandbox-runner-state":sK,"138-agent-sandbox-sessions":_N,"139-organization-billing":xN,"140-seat-change-log":uN,"141-benefits-sync-pending":CN,"142-stripe-event-watermark":KN,"143-armed-report-url":NN,"144-benefits-pending-index":mN,"145-user-model-preferences":TN,"146-organization-main-agent":zN,"147-drop-agent-sandbox-tables":EN,"148-org-flags":$N,"149-task-board-item-sort-order":PN,"150-task-board-activity":UN,"151-task-board-tags":QN,"152-repair-connection-slug":ZN,"153-task-board-latest-assistant-part-index":WN,"154-task-board-qa-activity":LN,"155-task-board-review-claims":FN,"156-task-board-conflict-activity":DN,"157-drop-seat-billing":HN,"158-drop-github-child-single-parent":MN,"159-task-board-comments":RN,"160-task-quota-billing":BN,"161-task-quota-claim-state":ON,"162-claude-subscriptions":SN,"163-task-board-item-dismissed":fN,"164-per-org-task-quota":AN,"165-task-board-pending-review-index":IN,"166-task-board-last-swept-at":yN,"167-task-board-run-retry":VN,"168-org-repo-sync":kN,"169-task-board-merge-failed-activity":vN,"170-task-board-item-repo":pN,"171-jira-integration":gN,"172-task-board-item-key-seq":qN,"173-thread-github-repo-connection-index":iN,"174-thread-message-parts-persisted-at":hN,"175-task-board-sprints":tN,"176-task-board-done-sweep-index":oN,"177-notifications":aN,"178-jira-status-mapping-array":rN,"179-notification-mentioned":eN,"180-task-board-item-type":bN,"181-task-board-item-type-required":sN,"182-task-board-sprints-entities":_m,"183-drop-jira-jql-filter":xm,"184-jira-rescan-after-scope-change":um,"185-jira-rescan-existing-cards":Cm,"186-jira-rescan-pending-flag":Nm,"187-task-board-comment-thread":mm,"188-invitation-auto-accept":Tm,"189-task-board-column-automations":Em,"190-task-board-review-cycle-started-at":$m,"191-task-board-columns":Pm,"192-task-board-verdict-nudge-activity":Jm,"193-task-board-status-column-fk":Qm,"194-jira-link-sprint":Xm,"195-task-board-sprint-activity":Wm,"196-task-board-column-tracker-statuses":jm,"197-task-board-prompts":Lm,"198-task-board-external-url":Fm,"199-drop-jira-mirror-and-org-columns":Ym,"200-jira-run-trigger":Dm,"201-organization-notices":Hm,"202-redact-base64-thread-parts":Rm,"203-task-board-preview-routes":Bm,"204-git-provider-accounts-and-repositories":Gm,"205-repository-references":Om,"206-repository-consumers":Pu,"207-task-board-prs-repo-idx":$u,"208-github-connect-flows":Eu,"209-github-installation-authorization":zu,"210-github-repository-authorization":_u,"211-user-fs-org":sx,"212-coding-agent-mcp-excluded":xu,"213-bitbucket-git-provider":uu,"214-connections-sanitized-id-idx":lx,"215-commerce-discovery-repository":ex,"216-github-cli-auth":bx,"217-experiments":Cu,"218-thread-message-parts-error-idx":Ku,"219-task-board-duplicate-reported-activity":mu,"220-jira-automation-continue-pr":Tu,"221-remove-private-registry":Px,"222-org-git-credentials":Ux,"223-drop-org-main-agent-id":rx,"224-repository-sandbox-image":Jx,"225-thread-analytics-indexes":Xx,"226-deco-score-names":Wx,"227-task-board-finding-resolved-activity":Lx,"228-org-voice-config":$x,"229-jira-automation-from":Fx,"230-project-sidebar":Yx,"231-jira-chat-agent":Dx,"232-task-board-prompt-skills":Mx,"233-remove-jira-chat-agent":Bx,"234-task-board-comment-audience":Gx,"235-prune-empty-thread-dirs":Ox,"236-task-board-sprints":fx,"237-org-sites-project-link":Ax,"238-task-board-default-lanes":Ix,"239-task-board-retire-old-lanes":yx,"240-task-board-restore-todo":Vx,"241-automation-board-column-transition":wx,"242-connection-url-slug":kx,"243-experiment-task-board-item":nx,"244-connection-url-slug-rollout-backfill":vx,"245-automation-system-key":px,"246-automation-pr-ready-trigger":gx,"247-automation-jira-transition":qx,"248-drop-retired-rule-tables":ix,"249-task-board-item-project":cx,"250-github-copilot-subscriptions":hx,"251-org-shared-plans":tx,"252-automation-linked-chat-trigger":ox,"253-automation-pr-builtin-triggers":ax,"254-codex-subscriptions":Ex},Kx=BW;import{getMigrations as N9}from"better-auth/db";import{sso as m9}from"@better-auth/sso";import{organization as T9}from"@decocms/better-auth/plugins";import{admin as z9,apiKey as E9,jwt as $9,magicLink as P9,mcp as U9,openAPI as J9}from"better-auth/plugins";import{emailOTP as Q9}from"better-auth/plugins/email-otp";import{Kysely as dW,PostgresDialect as jz}from"kysely";import{Pool as Lz}from"pg";import{homedir as GW}from"os";var OW=new Set(["all","worker","api"]);function SW(_){let x=(_??"").trim();return OW.has(x)?x:"all"}var fW=new Set(["production","development","test"]);function AW(_){let x=(_??"").trim();return fW.has(x)?x:"development"}function Z(_){return _==="true"||_==="1"}function fm(_,x,u){if(x===void 0||x==="")return;let N=Number(x);if(!Number.isSafeInteger(N)||N<=0)throw Error(`${_} must be a positive integer`);if(u!==void 0&&N>u)throw Error(`${_} must be at most ${u}`);return N}function B(_,x,u,N){return fm(_,x,N)??u}function IW(_){let x={};for(let u of(_??"").split(",")){let N=u.trim();if(!N)continue;let K=N.indexOf("="),m=K>0?N.slice(0,K).trim():"",T=K>0?N.slice(K+1).trim():"";if(!m||!T){console.warn(`STRIPE_PLAN_PRICE_IDS: ignoring unparseable entry "${N}" \u2014 expected price_xxx=planId`);continue}x[m]=T}return x}function yW(_,x,u,N){if(x===void 0||x==="")return u;let K=Number(x);if(!Number.isSafeInteger(K)||K<0)throw Error(`${_} must be a non-negative integer`);if(N!==void 0&&K>N)throw Error(`${_} must be at most ${N}`);return K}function Sm(_,x){if(_===void 0||_==="")return x;return _==="true"||_==="1"}function VW(_){return _===void 0||_===""||_==="true"||_==="1"}function D_(_,x){return _||x}function Ez(_){let x=_.DATA_DIR||_.DECOCMS_HOME||`${GW()}/deco`,u=AW(_.NODE_ENV),N=_.VOICE_CONVERSATION_PROVIDER?.trim()||"elevenlabs",K={nodeEnv:u,port:B("PORT",_.PORT,3000,65535),baseUrl:_.BASE_URL,publicUrl:D_(_.STUDIO_PUBLIC_URL,_.MESH_PUBLIC_URL),dataDir:x,voiceConversationProvider:N==="elevenlabs"||N==="openai"?N:null,openaiLiveApiKey:_.OPENAI_LIVE_API_KEY,openaiLiveModel:_.OPENAI_LIVE_MODEL?.trim()||"gpt-live-1",openaiLiveVoice:_.OPENAI_LIVE_VOICE?.trim()||"marin",elevenlabsApiKey:_.ELEVENLABS_API_KEY,elevenlabsVoiceId:_.ELEVENLABS_VOICE_ID||"JBFqnCBsd6RMkjVDRZzb",elevenlabsVoiceModel:_.ELEVENLABS_VOICE_MODEL||"eleven_v4_turbo",elevenlabsConversationModel:_.ELEVENLABS_CONVERSATION_MODEL?.trim()||"gemini-2.5-flash",databaseUrl:_.DATABASE_URL||"postgresql://postgres:postgres@localhost:5432/postgres",databasePgSsl:Z(_.DATABASE_PG_SSL),databasePoolMax:B("DATABASE_POOL_MAX",_.DATABASE_POOL_MAX,5),dbosPoolSize:B("DBOS_POOL_SIZE",_.DBOS_POOL_SIZE,5),betterAuthSecret:_.BETTER_AUTH_SECRET||"",encryptionKey:_.ENCRYPTION_KEY||"",studioJwtSecret:D_(_.STUDIO_JWT_SECRET,_.MESH_JWT_SECRET),localMode:Z(_.DECOCMS_LOCAL_MODE),disableRateLimit:Z(_.DISABLE_RATE_LIMIT),jiraAllowLocalSiteUrl:Z(_.JIRA_ALLOW_LOCAL_SITE_URL),jiraSettleSeconds:B("JIRA_SETTLE_SECONDS",_.JIRA_SETTLE_SECONDS,20,3600),studioProvisionSecretKey:_.STUDIO_PROVISION_SECRET_KEY,deploymentAdminEmails:(_.DEPLOYMENT_ADMIN_EMAILS??"").split(",").map((m)=>m.trim().toLowerCase()).filter(Boolean),taskBoardAdminOrgIds:(_.STUDIO_ADMIN_ORG_IDS??"").split(",").map((m)=>m.trim()).filter(Boolean),deploymentAdminToken:_.DEPLOYMENT_ADMIN_TOKEN||void 0,clickhouseUrl:_.CLICKHOUSE_URL,clickhouseMaxMemoryUsage:fm("CLICKHOUSE_MAX_MEMORY_USAGE",_.CLICKHOUSE_MAX_MEMORY_USAGE),monitoringOtlpEndpoint:_.MONITORING_OTLP_ENDPOINT,otelServiceName:_.OTEL_SERVICE_NAME||"studio",natsUrls:(_.NATS_URL||"nats://localhost:4222").split(",").map((m)=>m.trim()).filter(Boolean),natsCredsPath:_.NATS_CREDS,natsUser:_.NATS_USER||void 0,natsPassword:_.NATS_PASSWORD||void 0,configPath:_.CONFIG_PATH||"./config.json",aiGatewayEnabled:Z(_.DECO_AI_GATEWAY_ENABLED),aiGatewayUrl:_.DECO_AI_GATEWAY_URL||"https://ai-site.deco.site",aiGatewayAdminToken:_.DECO_AI_GATEWAY_ADMIN_TOKEN,stripeWebhookSecret:_.STRIPE_WEBHOOK_SECRET,stripeSecretKey:_.STRIPE_SECRET_KEY,stripeOrgPriceId:_.STRIPE_ORG_PRICE_ID,stripePlanPriceIds:IW(_.STRIPE_PLAN_PRICE_IDS),stripePortalConfigurationId:_.STRIPE_PORTAL_CONFIGURATION_ID,stripeTopupProductId:_.STRIPE_TOPUP_PRODUCT_ID,topupFeePercent:yW("STUDIO_TOPUP_FEE_PERCENT",_.STUDIO_TOPUP_FEE_PERCENT,15,100),taskQuotaEnforced:Z(_.STUDIO_TASK_QUOTA_ENFORCED),freeTaskExecutions:B("STUDIO_FREE_TASKS",_.STUDIO_FREE_TASKS,3),monthlyTaskExecutions:B("STUDIO_MONTHLY_TASKS",_.STUDIO_MONTHLY_TASKS,10),maxRunsPerTask:B("STUDIO_MAX_RUNS_PER_TASK",_.STUDIO_MAX_RUNS_PER_TASK,5),enableDecoImport:Z(_.ENABLE_DECO_IMPORT),hostingControlPlaneGa:Z(_.HOSTING_CONTROL_PLANE_GA),monitorGa:Z(_.MONITOR_GA),plansEnabled:Z(_.STUDIO_PLANS_ENABLED),mcpCacheEnabled:Sm(_.MCP_CACHE_ENABLED,u!=="development"),orgFsPublicSetsJson:_.ORGFS_PUBLIC_SETS,orgFsMountsDisabled:Z(_.DISABLE_ORGFS_MOUNTS),decopilotMaxConcurrentSubagents:B("DECOPILOT_MAX_CONCURRENT_SUBAGENTS",_.DECOPILOT_MAX_CONCURRENT_SUBAGENTS,4),decopilotMaxConcurrentHostedRuns:B("DECOPILOT_MAX_CONCURRENT_HOSTED_RUNS",_.DECOPILOT_MAX_CONCURRENT_HOSTED_RUNS,3),taskBoardReviewSweeperEnabled:Sm(_.TASK_BOARD_REVIEW_SWEEPER_ENABLED,!0),boardTransitionSettleSeconds:B("BOARD_TRANSITION_SETTLE_SECONDS",_.BOARD_TRANSITION_SETTLE_SECONDS,20,3600),sandboxMaxConcurrentHostedRuns:B("SANDBOX_MAX_CONCURRENT_HOSTED_RUNS",_.SANDBOX_MAX_CONCURRENT_HOSTED_RUNS,12),s3Endpoint:_.S3_ENDPOINT,s3Bucket:_.S3_BUCKET,s3Region:_.S3_REGION||"auto",s3AccessKeyId:_.S3_ACCESS_KEY_ID,s3SecretAccessKey:_.S3_SECRET_ACCESS_KEY,s3ForcePathStyle:VW(_.S3_FORCE_PATH_STYLE),monitoringS3Bucket:_.MONITORING_S3_BUCKET,monitoringS3Endpoint:_.MONITORING_S3_ENDPOINT,monitoringS3Region:_.MONITORING_S3_REGION,monitoringS3AccessKeyId:_.MONITORING_S3_ACCESS_KEY_ID,monitoringS3SecretAccessKey:_.MONITORING_S3_SECRET_ACCESS_KEY,monitoringS3Prefix:_.MONITORING_S3_PREFIX,duckdbExtensionDirectory:_.DUCKDB_EXTENSION_DIRECTORY||"/opt/duckdb/extensions",duckdbMemoryLimit:_.DUCKDB_MEMORY_LIMIT||void 0,duckdbThreads:fm("DUCKDB_THREADS",_.DUCKDB_THREADS),podName:_.POD_NAME||crypto.randomUUID(),dispatchRole:SW(D_(_.STUDIO_DISPATCH_ROLE,_.MESH_DISPATCH_ROLE)),agentSandboxEnabled:Z(_.STUDIO_AGENT_SANDBOX_ENABLED),sandboxStickyHeadRefEnabled:Z(_.SANDBOX_STICKY_HEAD_REF),taskBoardRerunReusesPrBranch:Sm(_.TASK_BOARD_RERUN_REUSES_PR_BRANCH,!0),sandboxReleaseOnRunEndEnabled:Z(_.SANDBOX_RELEASE_ON_RUN_END),sandboxPrewarmOnThreadCreateEnabled:Z(_.SANDBOX_PREWARM_ON_THREAD_CREATE),sandboxPersistentHarnessEnabled:Z(_.SANDBOX_PERSISTENT_HARNESS),sandboxReleaseGraceMs:B("SANDBOX_RELEASE_GRACE_MS",_.SANDBOX_RELEASE_GRACE_MS,120000),decoSupabaseUrl:_.DECO_SUPABASE_URL,decoSupabaseServiceKey:_.DECO_SUPABASE_SERVICE_KEY,controlplaneRestUrl:_.CONTROLPLANE_REST_URL,controlplaneServiceToken:_.CONTROLPLANE_SERVICE_TOKEN,analyticsDataUrl:_.ANALYTICS_URL,analyticsMasterToken:_.ANALYTICS_MASTER_TOKEN,clickhouseAnalyticsUrl:_.CLICKHOUSE_ANALYTICS_ADDRESS,clickhouseAnalyticsUsername:_.CLICKHOUSE_ANALYTICS_USERNAME||"admin_monitor",clickhouseAnalyticsPassword:_.CLICKHOUSE_ANALYTICS_PASSWORD,oneDollarStatsApiKey:_.ONEDOLLAR_BACKEND_API_KEY,reportsInternalApiUrl:D_(_.REPORTS_INTERNAL_API_URL,_.COMMERCE_DISCOVERY_INTERNAL_API_URL),reportsInternalApiKey:D_(_.REPORTS_INTERNAL_API_KEY,_.COMMERCE_DISCOVERY_INTERNAL_API_KEY),s3TenantBucket:_.S3_TENANT_BUCKET||"new-deco-sites-assets",s3TenantRegion:_.S3_TENANT_REGION||"us-west-2",s3TenantEndpoint:_.S3_TENANT_ENDPOINT,s3TenantPublicUrlBase:_.S3_TENANT_PUBLIC_URL_BASE||"https://assets.decocms.com",awsS3TenantRoleArn:_.AWS_S3_TENANT_ROLE_ARN,awsS3TenantProvisionerAccessKeyId:_.AWS_S3_TENANT_PROVISIONER_ACCESS_KEY_ID,awsS3TenantProvisionerSecretAccessKey:_.AWS_S3_TENANT_PROVISIONER_SECRET_ACCESS_KEY,deliveryR2AccountId:_.DELIVERY_R2_ACCOUNT_ID,deliveryR2AccessKeyId:_.DELIVERY_R2_ACCESS_KEY_ID,deliveryR2SecretAccessKey:_.DELIVERY_R2_SECRET_ACCESS_KEY,deliveryR2Bucket:_.DELIVERY_R2_BUCKET,deliveryR2Endpoint:_.DELIVERY_R2_ENDPOINT,deliveryPublicOrigin:_.DELIVERY_PUBLIC_ORIGIN,siteTokenSigningKey:_.DECO_SITE_TOKEN_SIGNING_KEY,cfDeliveryZoneId:_.CF_DELIVERY_ZONE_ID,cfPurgeApiToken:_.CF_PURGE_API_TOKEN};if(Boolean(K.natsUser)!==Boolean(K.natsPassword))throw Error("NATS_USER and NATS_PASSWORD must be set together");if(K.natsCredsPath&&K.natsUser)throw Error("Use either NATS_CREDS or NATS_USER/NATS_PASSWORD");if(K.plansEnabled&&!K.studioJwtSecret)throw Error("STUDIO_PLANS_ENABLED requires an explicit gateway JWT secret. Set STUDIO_JWT_SECRET (or its legacy alias MESH_JWT_SECRET) to the same value as the gateway's MESH_JWT_SECRET. Refusing to fall back to BETTER_AUTH_SECRET: that mismatch 401s every entitlements call, which every feature gate reads as 'no answer' and fails OPEN.");if(K.plansEnabled&&!K.studioProvisionSecretKey)throw Error("STUDIO_PLANS_ENABLED requires STUDIO_PROVISION_SECRET_KEY, set to the same value as the gateway's STUDIO_PROVISION_KEY. Without it the gateway cannot identify this server, falls back to a per-user membership callback that 401s for any user who never completed the gateway OAuth flow, and every feature gate then fails OPEN.");if(K.plansEnabled&&!K.aiGatewayEnabled)throw Error("STUDIO_PLANS_ENABLED requires DECO_AI_GATEWAY_ENABLED=true. Plans are read from the gateway; with it disabled there is no adapter to ask, so every feature gate fails OPEN on both server and client and the paid product is free fleet-wide.");if(K.plansEnabled&&Object.keys(K.stripePlanPriceIds).length>0&&!K.aiGatewayAdminToken)throw Error("STRIPE_PLAN_PRICE_IDS is set but DECO_AI_GATEWAY_ADMIN_TOKEN is not. The Stripe webhook places the paid tier through the gateway's admin API, so without the token a customer is charged and the entitlement "+"is never granted \u2014 and AI_PLAN_SET cannot repair it, it accepts only "+"'free'.");if(K.plansEnabled&&Object.keys(K.stripePlanPriceIds).length>1&&!K.stripePortalConfigurationId)console.warn("STRIPE_PLAN_PRICE_IDS maps more than one plan but STRIPE_PORTAL_CONFIGURATION_ID is unset. An org that already has a subscription cannot change tier: the account's default portal configuration lists only the legacy plans, not the tiers, so Stripe refuses the update flow. First-time checkout is unaffected.");return K}var wW=null;function K_(){return wW??=Object.freeze(Ez(process.env))}import{createContextKey as qW,metrics as iW,propagation as X8,ROOT_CONTEXT as Z8,SpanStatusCode as W8,trace as cW}from"@opentelemetry/api";import{logs as hW,SeverityNumber as Am}from"@opentelemetry/api-logs";import{OTLPLogExporter as F8}from"@opentelemetry/exporter-logs-otlp-proto";import{PrometheusExporter as tW}from"@opentelemetry/exporter-prometheus";import{OTLPTraceExporter as H8}from"@opentelemetry/exporter-trace-otlp-proto";import{RuntimeNodeInstrumentation as R8}from"@opentelemetry/instrumentation-runtime-node";import{context as E5,propagation as $5,SpanKind as P5,SpanStatusCode as U5}from"@opentelemetry/api";var Q5=globalThis.fetch;import{ExportResultCode as B5}from"@opentelemetry/core";import{ExportResultCode as Nx}from"@opentelemetry/core";import{mkdir as kW,rename as nW,writeFile as vW}from"fs/promises";import{join as mx}from"path";class Tx{bufferItems=[];bufferBytes=0;flushTimer=null;flushQueue=Promise.resolve();basePath;flushThreshold;maxBufferBytes;isShutdown=!1;knownDirs=new Set;partitionKey;constructor(_){this.basePath=_.basePath,this.flushThreshold=_.flushThreshold??1000,this.maxBufferBytes=_.maxBufferBytes??10485760,this.partitionKey=_.partitionKey;let x=_.flushIntervalMs??60000;if(x>0&&x<3600000){if(this.flushTimer=setInterval(()=>{this.flush().catch((u)=>{console.error("[NDJSONExporter] Timer flush failed:",u)})},x),this.flushTimer&&typeof this.flushTimer==="object"&&"unref"in this.flushTimer)this.flushTimer.unref()}}exportRows(_){if(this.isShutdown)return Promise.resolve({code:Nx.FAILED});for(let x of _){let u=JSON.stringify(x),N=this.partitionKey?this.partitionKey(x):"";this.bufferItems.push({partition:N,json:u}),this.bufferBytes+=Buffer.byteLength(u,"utf8")+1}if(this.bufferItems.length>=this.flushThreshold||this.bufferBytes>=this.maxBufferBytes)return this.flush().then(()=>({code:Nx.SUCCESS})).catch((x)=>{return console.error("[NDJSONExporter] Flush failed:",x),{code:Nx.FAILED}});return Promise.resolve({code:Nx.SUCCESS})}async shutdown(){if(this.isShutdown=!0,this.flushTimer)clearInterval(this.flushTimer),this.flushTimer=null;try{await this.flushQueue}catch{}if(this.bufferItems.length>0)await this.flush()}async forceFlush(){try{await this.flushQueue}catch{}if(this.bufferItems.length>0)await this.flush()}flush(){let x=this.flushQueue.catch(()=>{}).then(()=>this.doFlush());return this.flushQueue=x,x}async doFlush(){if(this.bufferItems.length===0)return;let _=this.bufferItems;this.bufferItems=[],this.bufferBytes=0;let x=new Map;for(let K of _){let m=x.get(K.partition);if(!m)m=[],x.set(K.partition,m);m.push(K.json)}let u=await Promise.allSettled(Array.from(x.entries()).map(([K,m])=>this.writeNDJSON(m,K).then(()=>K))),N=u.find((K)=>K.status==="rejected");if(N){let K=new Set;for(let T of u)if(T.status==="fulfilled")K.add(T.value);let m=_.filter((T)=>!K.has(T.partition));this.bufferItems=m.concat(this.bufferItems),this.bufferBytes=0;for(let T of this.bufferItems)this.bufferBytes+=Buffer.byteLength(T.json,"utf8")+1;throw N.reason}}async writeNDJSON(_,x){let u=new Date,N=[String(u.getUTCFullYear()),String(u.getUTCMonth()+1).padStart(2,"0"),String(u.getUTCDate()).padStart(2,"0"),String(u.getUTCHours()).padStart(2,"0")],K=x?mx(this.basePath,x,...N):mx(this.basePath,...N);if(!this.knownDirs.has(K))await kW(K,{recursive:!0,mode:448}),this.knownDirs.add(K);let m=`${crypto.randomUUID()}.ndjson`,T=mx(K,`.${m}.tmp`),z=mx(K,m),E=_.join(`
+  `.execute(_)}var BW={"001-initial-schema":Uu,"002-organization-settings":Ju,"003-connection-schema-align":Qu,"004-remove-models-binding":Xu,"005-connection-configuration":Zu,"006-add-views-to-settings":Wu,"007-monitoring-logs":ju,"008-event-bus":Lu,"009-drop-audit-logs":Fu,"010-gateways":Yu,"011-gateway-icon":Du,"012-gateway-tool-selection-mode":Hu,"013-monitoring-user-agent-gateway":Mu,"014-gateway-resources-prompts":Ru,"015-monitoring-properties":Bu,"016-downstream-token-client-info":Gu,"017-downstream-token-remove-userid":Ou,"018-drop-gateway-tool-selection-strategy":Su,"019-remove-gateway-is-default":fu,"020-enabled-plugins":Au,"021-threads":Iu,"022-rename-gateway-to-virtual-mcp":yu,"023-optimize-thread-indexes":Vu,"024-consolidate-virtual-mcp":wu,"025-add-monitoring-virtual-mcp-id":ku,"026-restrict-child-connection-delete":nu,"027-update-management-mcp-url":pu,"028-update-management-mcp-to-self":qu,"029-add-updated-by-to-connections":iu,"030-member-tags":cu,"031-add-dependency-mode":hu,"032-projects":tu,"033-thread-status":ou,"034-monitoring-dashboards":au,"035-project-connections":ru,"036-update-registry-url":lu,"037-ai-provider-keys":eu,"038-oauth-pkce-states":du,"039-automations":bu,"040-replace-next-run-at-with-last-run-at":su,"041-ai-provider-keys-unique-constraint":_C,"042-rename-mesh-mcp-to-cms-mcp":xC,"043-rename-cms-mcp-to-deco-cms":uC,"044-drop-connections-tools-column":CC,"045-thread-context-start-message":KC,"046-remove-object-storage-plugin":mC,"047-add-next-run-at":TC,"048-merge-projects-agents":EC,"049-remove-org-admin-projects":$C,"050-durable-agent-runs":PC,"051-org-sso":JC,"052-thread-agent-ids":QC,"053-registry-config":XC,"054-connection-slug":WC,"055-spaces":jC,"056-automation-project-scope":LC,"057-thread-virtual-mcp-id":FC,"058-trigger-callback-tokens":YC,"059-kv":DC,"060-member-index":HC,"061-downstream-token-connection-index":MC,"062-private-registry":RC,"063-event-subscriptions-enabled-boolean":BC,"064-brand-context":GC,"065-organization-domains":OC,"066-brand-context-structured":SC,"067-threads-metadata":fC,"068-threads-branch":AC,"069-sandbox-runner-state":IC,"070-model-categories":yC,"071-default-home-agents":VC,"072-ai-provider-key-preset-id":wC,"073-backfill-basic-usage-roles":kC,"074-sandbox-runner-state-handle-nonunique":nC,"075-thread-inflight-async-jobs":vC,"076-automations-drop-agent-json":pC,"077-tier-only-model-selection":qC,"078-automation-tool-call-kind":iC,"079-strip-legacy-freestyle-vm-map-entries":cC,"080-async-research-jobs":hC,"081-async-research-jobs-result-content":tC,"082-secrets":oC,"083-thread-run-locally":aC,"084-drop-host-sandbox-rows":rC,"085-rename-runner-kind":lC,"086-thread-pins-and-vm-map-rekey":eC,"087-fix-vm-map-rekey":dC,"088-purge-cli-activate-keys":bC,"089-rename-remote-user-to-desktop":sC,"090-automation-webhook-triggers":_K,"091-organization-domains-allow-multi":xK,"092-sandbox-naming-uniformization":uK,"093-backfill-global-search-basic-usage":CK,"094-org-file-configs":NK,"095-remove-automation-tool-call-kind":mK,"096-org-file-configs-public-url-base":TK,"097-drop-local-docker-sandbox-state":EK,"098-thread-message-parts":$K,"099-run-fence":PK,"100-link-transport":UK,"101-cancel-requested-at":JK,"102-observational-agent":QK,"103-revert-observational-agent":XK,"104-agent-sandbox-provider-kind":WK,"105-org-fs":jK,"106-automation-tools":LK,"107-org-fs-public-org":FK,"108-automation-max-agent-steps":YK,"109-thread-message-parts-per-message-seq":DK,"110-backfill-ghs-token-expiry":HK,"111-org-fs-thread-id":MK,"112-org-file-configs-credential-type":RK,"113-thread-failure-reason":BK,"114-run-acked-seq":GK,"115-thread-projected-seq":OK,"116-org-sites":SK,"117-org-file-configs-site-slug":fK,"118-organization-domains-multi-verify":AK,"119-organization-join-requests":IK,"120-org-fs-read-public":yK,"121-org-fs-share-password":VK,"122-split-web-research-tier":nK,"123-connection-credential-vault":vK,"124-drop-thread-projected-seq":pK,"125-github-child-single-parent":gK,"126-task-board":iK,"127-task-board-due-date":cK,"128-reports-only":hK,"129-task-board-assigned-by":tK,"130-task-board-thread-id":oK,"131-task-board-thread-link-cascade":aK,"132-task-board-item-prs":rK,"133-dedupe-duplicate-members":lK,"134-drop-task-board-enabled":eK,"135-task-board-item-fk-cascade":dK,"136-task-board-import-idempotency":bK,"137-agent-sandbox-runner-state":sK,"138-agent-sandbox-sessions":_N,"139-organization-billing":xN,"140-seat-change-log":uN,"141-benefits-sync-pending":CN,"142-stripe-event-watermark":KN,"143-armed-report-url":NN,"144-benefits-pending-index":mN,"145-user-model-preferences":TN,"146-organization-main-agent":zN,"147-drop-agent-sandbox-tables":EN,"148-org-flags":$N,"149-task-board-item-sort-order":PN,"150-task-board-activity":UN,"151-task-board-tags":QN,"152-repair-connection-slug":ZN,"153-task-board-latest-assistant-part-index":WN,"154-task-board-qa-activity":LN,"155-task-board-review-claims":FN,"156-task-board-conflict-activity":DN,"157-drop-seat-billing":HN,"158-drop-github-child-single-parent":MN,"159-task-board-comments":RN,"160-task-quota-billing":BN,"161-task-quota-claim-state":ON,"162-claude-subscriptions":SN,"163-task-board-item-dismissed":fN,"164-per-org-task-quota":AN,"165-task-board-pending-review-index":IN,"166-task-board-last-swept-at":yN,"167-task-board-run-retry":VN,"168-org-repo-sync":kN,"169-task-board-merge-failed-activity":vN,"170-task-board-item-repo":pN,"171-jira-integration":gN,"172-task-board-item-key-seq":qN,"173-thread-github-repo-connection-index":iN,"174-thread-message-parts-persisted-at":hN,"175-task-board-sprints":tN,"176-task-board-done-sweep-index":oN,"177-notifications":aN,"178-jira-status-mapping-array":rN,"179-notification-mentioned":eN,"180-task-board-item-type":bN,"181-task-board-item-type-required":sN,"182-task-board-sprints-entities":_m,"183-drop-jira-jql-filter":xm,"184-jira-rescan-after-scope-change":um,"185-jira-rescan-existing-cards":Cm,"186-jira-rescan-pending-flag":Nm,"187-task-board-comment-thread":mm,"188-invitation-auto-accept":Tm,"189-task-board-column-automations":Em,"190-task-board-review-cycle-started-at":$m,"191-task-board-columns":Pm,"192-task-board-verdict-nudge-activity":Jm,"193-task-board-status-column-fk":Qm,"194-jira-link-sprint":Xm,"195-task-board-sprint-activity":Wm,"196-task-board-column-tracker-statuses":jm,"197-task-board-prompts":Lm,"198-task-board-external-url":Fm,"199-drop-jira-mirror-and-org-columns":Ym,"200-jira-run-trigger":Dm,"201-organization-notices":Hm,"202-redact-base64-thread-parts":Rm,"203-task-board-preview-routes":Bm,"204-git-provider-accounts-and-repositories":Gm,"205-repository-references":Om,"206-repository-consumers":Pu,"207-task-board-prs-repo-idx":$u,"208-github-connect-flows":Eu,"209-github-installation-authorization":zu,"210-github-repository-authorization":_u,"211-user-fs-org":sx,"212-coding-agent-mcp-excluded":xu,"213-bitbucket-git-provider":uu,"214-connections-sanitized-id-idx":lx,"215-commerce-discovery-repository":ex,"216-github-cli-auth":bx,"217-experiments":Cu,"218-thread-message-parts-error-idx":Ku,"219-task-board-duplicate-reported-activity":mu,"220-jira-automation-continue-pr":Tu,"221-remove-private-registry":Px,"222-org-git-credentials":Ux,"223-drop-org-main-agent-id":rx,"224-repository-sandbox-image":Jx,"225-thread-analytics-indexes":Xx,"226-deco-score-names":Wx,"227-task-board-finding-resolved-activity":Lx,"228-org-voice-config":$x,"229-jira-automation-from":Fx,"230-project-sidebar":Yx,"231-jira-chat-agent":Dx,"232-task-board-prompt-skills":Mx,"233-remove-jira-chat-agent":Bx,"234-task-board-comment-audience":Gx,"235-prune-empty-thread-dirs":Ox,"236-task-board-sprints":fx,"237-org-sites-project-link":Ax,"238-task-board-default-lanes":Ix,"239-task-board-retire-old-lanes":yx,"240-task-board-restore-todo":Vx,"241-automation-board-column-transition":wx,"242-connection-url-slug":kx,"243-experiment-task-board-item":nx,"244-connection-url-slug-rollout-backfill":vx,"245-automation-system-key":px,"246-automation-pr-ready-trigger":gx,"247-automation-jira-transition":qx,"248-drop-retired-rule-tables":ix,"249-task-board-item-project":cx,"250-github-copilot-subscriptions":hx,"251-org-shared-plans":tx,"252-automation-linked-chat-trigger":ox,"253-automation-pr-builtin-triggers":ax,"254-codex-subscriptions":Ex},Kx=BW;import{getMigrations as N9}from"better-auth/db";import{sso as m9}from"@better-auth/sso";import{organization as T9}from"@decocms/better-auth/plugins";import{admin as z9,apiKey as E9,jwt as $9,magicLink as P9,mcp as U9,openAPI as J9}from"better-auth/plugins";import{emailOTP as Q9}from"better-auth/plugins/email-otp";import{Kysely as dW,PostgresDialect as jz}from"kysely";import{Pool as Lz}from"pg";import{homedir as GW}from"os";var OW=new Set(["all","worker","api"]);function SW(_){let x=(_??"").trim();return OW.has(x)?x:"all"}var fW=new Set(["production","development","test"]);function AW(_){let x=(_??"").trim();return fW.has(x)?x:"development"}function Z(_){return _==="true"||_==="1"}function fm(_,x,u){if(x===void 0||x==="")return;let N=Number(x);if(!Number.isSafeInteger(N)||N<=0)throw Error(`${_} must be a positive integer`);if(u!==void 0&&N>u)throw Error(`${_} must be at most ${u}`);return N}function B(_,x,u,N){return fm(_,x,N)??u}function IW(_){let x={};for(let u of(_??"").split(",")){let N=u.trim();if(!N)continue;let K=N.indexOf("="),m=K>0?N.slice(0,K).trim():"",T=K>0?N.slice(K+1).trim():"";if(!m||!T){console.warn(`STRIPE_PLAN_PRICE_IDS: ignoring unparseable entry "${N}" \u2014 expected price_xxx=planId`);continue}x[m]=T}return x}function yW(_,x,u,N){if(x===void 0||x==="")return u;let K=Number(x);if(!Number.isSafeInteger(K)||K<0)throw Error(`${_} must be a non-negative integer`);if(N!==void 0&&K>N)throw Error(`${_} must be at most ${N}`);return K}function Sm(_,x){if(_===void 0||_==="")return x;return _==="true"||_==="1"}function VW(_){return _===void 0||_===""||_==="true"||_==="1"}function D_(_,x){return _||x}function Ez(_){let x=_.DATA_DIR||_.DECOCMS_HOME||`${GW()}/deco`,u=AW(_.NODE_ENV),N=_.VOICE_CONVERSATION_PROVIDER?.trim()||"elevenlabs",K={nodeEnv:u,port:B("PORT",_.PORT,3000,65535),baseUrl:_.BASE_URL,publicUrl:D_(_.STUDIO_PUBLIC_URL,_.MESH_PUBLIC_URL),dataDir:x,voiceConversationProvider:N==="elevenlabs"||N==="openai"?N:null,openaiLiveApiKey:_.OPENAI_LIVE_API_KEY,openaiLiveModel:_.OPENAI_LIVE_MODEL?.trim()||"gpt-live-1",openaiLiveVoice:_.OPENAI_LIVE_VOICE?.trim()||"marin",elevenlabsApiKey:_.ELEVENLABS_API_KEY,elevenlabsVoiceId:_.ELEVENLABS_VOICE_ID||"JBFqnCBsd6RMkjVDRZzb",elevenlabsVoiceModel:_.ELEVENLABS_VOICE_MODEL||"eleven_v4_turbo",elevenlabsConversationModel:_.ELEVENLABS_CONVERSATION_MODEL?.trim()||"gemini-2.5-flash",databaseUrl:_.DATABASE_URL||"postgresql://postgres:postgres@localhost:5432/postgres",databasePgSsl:Z(_.DATABASE_PG_SSL),databasePoolMax:B("DATABASE_POOL_MAX",_.DATABASE_POOL_MAX,5),dbosPoolSize:B("DBOS_POOL_SIZE",_.DBOS_POOL_SIZE,5),betterAuthSecret:_.BETTER_AUTH_SECRET||"",encryptionKey:_.ENCRYPTION_KEY||"",studioJwtSecret:D_(_.STUDIO_JWT_SECRET,_.MESH_JWT_SECRET),localMode:Z(_.DECOCMS_LOCAL_MODE),disableRateLimit:Z(_.DISABLE_RATE_LIMIT),jiraAllowLocalSiteUrl:Z(_.JIRA_ALLOW_LOCAL_SITE_URL),jiraSettleSeconds:B("JIRA_SETTLE_SECONDS",_.JIRA_SETTLE_SECONDS,20,3600),studioProvisionSecretKey:_.STUDIO_PROVISION_SECRET_KEY,deploymentAdminEmails:(_.DEPLOYMENT_ADMIN_EMAILS??"").split(",").map((m)=>m.trim().toLowerCase()).filter(Boolean),taskBoardAdminOrgIds:(_.STUDIO_ADMIN_ORG_IDS??"").split(",").map((m)=>m.trim()).filter(Boolean),deploymentAdminToken:_.DEPLOYMENT_ADMIN_TOKEN||void 0,clickhouseUrl:_.CLICKHOUSE_URL,clickhouseMaxMemoryUsage:fm("CLICKHOUSE_MAX_MEMORY_USAGE",_.CLICKHOUSE_MAX_MEMORY_USAGE),monitoringOtlpEndpoint:_.MONITORING_OTLP_ENDPOINT,otelServiceName:_.OTEL_SERVICE_NAME||"studio",natsUrls:(_.NATS_URL||"nats://localhost:4222").split(",").map((m)=>m.trim()).filter(Boolean),natsCredsPath:_.NATS_CREDS,natsUser:_.NATS_USER||void 0,natsPassword:_.NATS_PASSWORD||void 0,configPath:_.CONFIG_PATH||"./config.json",aiGatewayEnabled:Z(_.DECO_AI_GATEWAY_ENABLED),aiGatewayUrl:_.DECO_AI_GATEWAY_URL||"https://ai-site.deco.site",aiGatewayAdminToken:_.DECO_AI_GATEWAY_ADMIN_TOKEN,stripeWebhookSecret:_.STRIPE_WEBHOOK_SECRET,stripeSecretKey:_.STRIPE_SECRET_KEY,stripeOrgPriceId:_.STRIPE_ORG_PRICE_ID,stripePlanPriceIds:IW(_.STRIPE_PLAN_PRICE_IDS),stripePortalConfigurationId:_.STRIPE_PORTAL_CONFIGURATION_ID,stripeTopupProductId:_.STRIPE_TOPUP_PRODUCT_ID,topupFeePercent:yW("STUDIO_TOPUP_FEE_PERCENT",_.STUDIO_TOPUP_FEE_PERCENT,15,100),taskQuotaEnforced:Z(_.STUDIO_TASK_QUOTA_ENFORCED),freeTaskExecutions:B("STUDIO_FREE_TASKS",_.STUDIO_FREE_TASKS,3),monthlyTaskExecutions:B("STUDIO_MONTHLY_TASKS",_.STUDIO_MONTHLY_TASKS,10),maxRunsPerTask:B("STUDIO_MAX_RUNS_PER_TASK",_.STUDIO_MAX_RUNS_PER_TASK,5),enableDecoImport:Z(_.ENABLE_DECO_IMPORT),hostingControlPlaneGa:Z(_.HOSTING_CONTROL_PLANE_GA),monitorGa:Z(_.MONITOR_GA),plansEnabled:Z(_.STUDIO_PLANS_ENABLED),mcpCacheEnabled:Sm(_.MCP_CACHE_ENABLED,u!=="development"),orgFsPublicSetsJson:_.ORGFS_PUBLIC_SETS,orgFsMountsDisabled:Z(_.DISABLE_ORGFS_MOUNTS),decopilotMaxConcurrentSubagents:B("DECOPILOT_MAX_CONCURRENT_SUBAGENTS",_.DECOPILOT_MAX_CONCURRENT_SUBAGENTS,4),decopilotMaxConcurrentHostedRuns:B("DECOPILOT_MAX_CONCURRENT_HOSTED_RUNS",_.DECOPILOT_MAX_CONCURRENT_HOSTED_RUNS,3),taskBoardReviewSweeperEnabled:Sm(_.TASK_BOARD_REVIEW_SWEEPER_ENABLED,!0),boardTransitionSettleSeconds:B("BOARD_TRANSITION_SETTLE_SECONDS",_.BOARD_TRANSITION_SETTLE_SECONDS,20,3600),sandboxMaxConcurrentHostedRuns:B("SANDBOX_MAX_CONCURRENT_HOSTED_RUNS",_.SANDBOX_MAX_CONCURRENT_HOSTED_RUNS,12),s3Endpoint:_.S3_ENDPOINT,s3Bucket:_.S3_BUCKET,s3Region:_.S3_REGION||"auto",s3AccessKeyId:_.S3_ACCESS_KEY_ID,s3SecretAccessKey:_.S3_SECRET_ACCESS_KEY,s3ForcePathStyle:VW(_.S3_FORCE_PATH_STYLE),monitoringS3Bucket:_.MONITORING_S3_BUCKET,monitoringS3Endpoint:_.MONITORING_S3_ENDPOINT,monitoringS3Region:_.MONITORING_S3_REGION,monitoringS3AccessKeyId:_.MONITORING_S3_ACCESS_KEY_ID,monitoringS3SecretAccessKey:_.MONITORING_S3_SECRET_ACCESS_KEY,monitoringS3Prefix:_.MONITORING_S3_PREFIX,duckdbExtensionDirectory:_.DUCKDB_EXTENSION_DIRECTORY||"/opt/duckdb/extensions",duckdbMemoryLimit:_.DUCKDB_MEMORY_LIMIT||void 0,duckdbThreads:fm("DUCKDB_THREADS",_.DUCKDB_THREADS),podName:_.POD_NAME||crypto.randomUUID(),dispatchRole:SW(D_(_.STUDIO_DISPATCH_ROLE,_.MESH_DISPATCH_ROLE)),agentSandboxEnabled:Z(_.STUDIO_AGENT_SANDBOX_ENABLED),sandboxStickyHeadRefEnabled:Z(_.SANDBOX_STICKY_HEAD_REF),taskBoardRerunReusesPrBranch:Sm(_.TASK_BOARD_RERUN_REUSES_PR_BRANCH,!0),sandboxReleaseOnRunEndEnabled:Z(_.SANDBOX_RELEASE_ON_RUN_END),sandboxPrewarmOnThreadCreateEnabled:Z(_.SANDBOX_PREWARM_ON_THREAD_CREATE),sandboxPersistentHarnessEnabled:Z(_.SANDBOX_PERSISTENT_HARNESS),sandboxReleaseGraceMs:B("SANDBOX_RELEASE_GRACE_MS",_.SANDBOX_RELEASE_GRACE_MS,120000),decoSupabaseUrl:_.DECO_SUPABASE_URL,decoSupabaseServiceKey:_.DECO_SUPABASE_SERVICE_KEY,controlplaneRestUrl:_.CONTROLPLANE_REST_URL,controlplaneServiceToken:_.CONTROLPLANE_SERVICE_TOKEN,analyticsDataUrl:_.ANALYTICS_URL,analyticsMasterToken:_.ANALYTICS_MASTER_TOKEN,clickhouseAnalyticsUrl:_.CLICKHOUSE_ANALYTICS_ADDRESS,clickhouseAnalyticsUsername:_.CLICKHOUSE_ANALYTICS_USERNAME||"admin_monitor",clickhouseAnalyticsPassword:_.CLICKHOUSE_ANALYTICS_PASSWORD,customerLakeUrl:_.CUSTOMER_LAKE_URL,customerLakeAdminUsername:_.CUSTOMER_LAKE_ADMIN_USERNAME||"customer_lake_user_admin",customerLakeAdminPassword:_.CUSTOMER_LAKE_ADMIN_PASSWORD,customerLakeTenantSecret:_.CUSTOMER_LAKE_TENANT_SECRET,oneDollarStatsApiKey:_.ONEDOLLAR_BACKEND_API_KEY,reportsInternalApiUrl:D_(_.REPORTS_INTERNAL_API_URL,_.COMMERCE_DISCOVERY_INTERNAL_API_URL),reportsInternalApiKey:D_(_.REPORTS_INTERNAL_API_KEY,_.COMMERCE_DISCOVERY_INTERNAL_API_KEY),s3TenantBucket:_.S3_TENANT_BUCKET||"new-deco-sites-assets",s3TenantRegion:_.S3_TENANT_REGION||"us-west-2",s3TenantEndpoint:_.S3_TENANT_ENDPOINT,s3TenantPublicUrlBase:_.S3_TENANT_PUBLIC_URL_BASE||"https://assets.decocms.com",awsS3TenantRoleArn:_.AWS_S3_TENANT_ROLE_ARN,awsS3TenantProvisionerAccessKeyId:_.AWS_S3_TENANT_PROVISIONER_ACCESS_KEY_ID,awsS3TenantProvisionerSecretAccessKey:_.AWS_S3_TENANT_PROVISIONER_SECRET_ACCESS_KEY,deliveryR2AccountId:_.DELIVERY_R2_ACCOUNT_ID,deliveryR2AccessKeyId:_.DELIVERY_R2_ACCESS_KEY_ID,deliveryR2SecretAccessKey:_.DELIVERY_R2_SECRET_ACCESS_KEY,deliveryR2Bucket:_.DELIVERY_R2_BUCKET,deliveryR2Endpoint:_.DELIVERY_R2_ENDPOINT,deliveryPublicOrigin:_.DELIVERY_PUBLIC_ORIGIN,siteTokenSigningKey:_.DECO_SITE_TOKEN_SIGNING_KEY,cfDeliveryZoneId:_.CF_DELIVERY_ZONE_ID,cfPurgeApiToken:_.CF_PURGE_API_TOKEN};if(Boolean(K.natsUser)!==Boolean(K.natsPassword))throw Error("NATS_USER and NATS_PASSWORD must be set together");if(K.natsCredsPath&&K.natsUser)throw Error("Use either NATS_CREDS or NATS_USER/NATS_PASSWORD");if(K.plansEnabled&&!K.studioJwtSecret)throw Error("STUDIO_PLANS_ENABLED requires an explicit gateway JWT secret. Set STUDIO_JWT_SECRET (or its legacy alias MESH_JWT_SECRET) to the same value as the gateway's MESH_JWT_SECRET. Refusing to fall back to BETTER_AUTH_SECRET: that mismatch 401s every entitlements call, which every feature gate reads as 'no answer' and fails OPEN.");if(K.plansEnabled&&!K.studioProvisionSecretKey)throw Error("STUDIO_PLANS_ENABLED requires STUDIO_PROVISION_SECRET_KEY, set to the same value as the gateway's STUDIO_PROVISION_KEY. Without it the gateway cannot identify this server, falls back to a per-user membership callback that 401s for any user who never completed the gateway OAuth flow, and every feature gate then fails OPEN.");if(K.plansEnabled&&!K.aiGatewayEnabled)throw Error("STUDIO_PLANS_ENABLED requires DECO_AI_GATEWAY_ENABLED=true. Plans are read from the gateway; with it disabled there is no adapter to ask, so every feature gate fails OPEN on both server and client and the paid product is free fleet-wide.");if(K.plansEnabled&&Object.keys(K.stripePlanPriceIds).length>0&&!K.aiGatewayAdminToken)throw Error("STRIPE_PLAN_PRICE_IDS is set but DECO_AI_GATEWAY_ADMIN_TOKEN is not. The Stripe webhook places the paid tier through the gateway's admin API, so without the token a customer is charged and the entitlement "+"is never granted \u2014 and AI_PLAN_SET cannot repair it, it accepts only "+"'free'.");if(K.plansEnabled&&Object.keys(K.stripePlanPriceIds).length>1&&!K.stripePortalConfigurationId)console.warn("STRIPE_PLAN_PRICE_IDS maps more than one plan but STRIPE_PORTAL_CONFIGURATION_ID is unset. An org that already has a subscription cannot change tier: the account's default portal configuration lists only the legacy plans, not the tiers, so Stripe refuses the update flow. First-time checkout is unaffected.");return K}var wW=null;function K_(){return wW??=Object.freeze(Ez(process.env))}import{createContextKey as qW,metrics as iW,propagation as X8,ROOT_CONTEXT as Z8,SpanStatusCode as W8,trace as cW}from"@opentelemetry/api";import{logs as hW,SeverityNumber as Am}from"@opentelemetry/api-logs";import{OTLPLogExporter as F8}from"@opentelemetry/exporter-logs-otlp-proto";import{PrometheusExporter as tW}from"@opentelemetry/exporter-prometheus";import{OTLPTraceExporter as H8}from"@opentelemetry/exporter-trace-otlp-proto";import{RuntimeNodeInstrumentation as R8}from"@opentelemetry/instrumentation-runtime-node";import{context as E5,propagation as $5,SpanKind as P5,SpanStatusCode as U5}from"@opentelemetry/api";var Q5=globalThis.fetch;import{ExportResultCode as B5}from"@opentelemetry/core";import{ExportResultCode as Nx}from"@opentelemetry/core";import{mkdir as kW,rename as nW,writeFile as vW}from"fs/promises";import{join as mx}from"path";class Tx{bufferItems=[];bufferBytes=0;flushTimer=null;flushQueue=Promise.resolve();basePath;flushThreshold;maxBufferBytes;isShutdown=!1;knownDirs=new Set;partitionKey;constructor(_){this.basePath=_.basePath,this.flushThreshold=_.flushThreshold??1000,this.maxBufferBytes=_.maxBufferBytes??10485760,this.partitionKey=_.partitionKey;let x=_.flushIntervalMs??60000;if(x>0&&x<3600000){if(this.flushTimer=setInterval(()=>{this.flush().catch((u)=>{console.error("[NDJSONExporter] Timer flush failed:",u)})},x),this.flushTimer&&typeof this.flushTimer==="object"&&"unref"in this.flushTimer)this.flushTimer.unref()}}exportRows(_){if(this.isShutdown)return Promise.resolve({code:Nx.FAILED});for(let x of _){let u=JSON.stringify(x),N=this.partitionKey?this.partitionKey(x):"";this.bufferItems.push({partition:N,json:u}),this.bufferBytes+=Buffer.byteLength(u,"utf8")+1}if(this.bufferItems.length>=this.flushThreshold||this.bufferBytes>=this.maxBufferBytes)return this.flush().then(()=>({code:Nx.SUCCESS})).catch((x)=>{return console.error("[NDJSONExporter] Flush failed:",x),{code:Nx.FAILED}});return Promise.resolve({code:Nx.SUCCESS})}async shutdown(){if(this.isShutdown=!0,this.flushTimer)clearInterval(this.flushTimer),this.flushTimer=null;try{await this.flushQueue}catch{}if(this.bufferItems.length>0)await this.flush()}async forceFlush(){try{await this.flushQueue}catch{}if(this.bufferItems.length>0)await this.flush()}flush(){let x=this.flushQueue.catch(()=>{}).then(()=>this.doFlush());return this.flushQueue=x,x}async doFlush(){if(this.bufferItems.length===0)return;let _=this.bufferItems;this.bufferItems=[],this.bufferBytes=0;let x=new Map;for(let K of _){let m=x.get(K.partition);if(!m)m=[],x.set(K.partition,m);m.push(K.json)}let u=await Promise.allSettled(Array.from(x.entries()).map(([K,m])=>this.writeNDJSON(m,K).then(()=>K))),N=u.find((K)=>K.status==="rejected");if(N){let K=new Set;for(let T of u)if(T.status==="fulfilled")K.add(T.value);let m=_.filter((T)=>!K.has(T.partition));this.bufferItems=m.concat(this.bufferItems),this.bufferBytes=0;for(let T of this.bufferItems)this.bufferBytes+=Buffer.byteLength(T.json,"utf8")+1;throw N.reason}}async writeNDJSON(_,x){let u=new Date,N=[String(u.getUTCFullYear()),String(u.getUTCMonth()+1).padStart(2,"0"),String(u.getUTCDate()).padStart(2,"0"),String(u.getUTCHours()).padStart(2,"0")],K=x?mx(this.basePath,x,...N):mx(this.basePath,...N);if(!this.knownDirs.has(K))await kW(K,{recursive:!0,mode:448}),this.knownDirs.add(K);let m=`${crypto.randomUUID()}.ndjson`,T=mx(K,`.${m}.tmp`),z=mx(K,m),E=_.join(`
 `)+`
 `;await vW(T,E,{mode:384}),await nW(T,z)}}import{ExportResultCode as A5}from"@opentelemetry/core";import{AggregationTemporality as y5,DataPointType as V5}from"@opentelemetry/sdk-metrics";import{ExportResultCode as g5}from"@opentelemetry/core";var h5=Buffer.byteLength("... [TRUNCATED]","utf8");import{BatchLogRecordProcessor as V8,LoggerProvider as w8}from"@opentelemetry/sdk-logs";import{detectResources as n8,envDetector as v8,hostDetector as p8,osDetector as g8,processDetector as q8,resourceFromAttributes as i8}from"@opentelemetry/resources";import{PeriodicExportingMetricReader as h8}from"@opentelemetry/sdk-metrics";import{NOOP_LOGGER as a5}from"@opentelemetry/api-logs";import{NodeSDK as a8}from"@opentelemetry/sdk-node";import{BatchSpanProcessor as l8,SamplingDecision as N_}from"@opentelemetry/sdk-trace-base";import{SpanStatusCode as b5}from"@opentelemetry/api";var oW="__d",aW=qW("Current request"),rW=1;var Pz=(_)=>{let u=new URL(_.url).searchParams.get(oW);if(u==="")return crypto.randomUUID();if(!u)u=_.headers.get("x-trace-debug-id");return u};class Uz{inner;constructor(_){this.inner=_}shouldSample(_,x,u,N,K,m){let T=_.getValue(aW);if(!T){if(this.inner)return this.inner.shouldSample(_,x,u,N,K,m);return{decision:N_.RECORD_AND_SAMPLED}}let z=Pz(T);if(z)return{decision:N_.RECORD_AND_SAMPLED,attributes:{"trace.debug.id":z}};if(this.inner){let E=this.inner.shouldSample(_,x,u,N,K,m);if(E.decision===N_.RECORD_AND_SAMPLED){let $=crypto.randomUUID();E.attributes={...E.attributes??{},"trace.debug.id":$}}return E}return{decision:N_.NOT_RECORD}}toString(){return"DebugSampler"}}class Jz{ratio;constructor(_){this.ratio=_}shouldSample(){if(Math.random()<this.ratio)return{decision:N_.RECORD_AND_SAMPLED};return{decision:N_.NOT_RECORD}}toString(){return`RatioSampler(${this.ratio})`}}var d8=new tW({preventServerStart:!0}),b8=new Uz(new Jz(rW));var $z=cW.getTracer("studio","1.0.0"),H_=iW.getMeter("studio","1.0.0"),lW=hW.getLogger("studio","1.0.0"),Im=(_,x,u)=>{let N={},K=u,m=u[u.length-1];if(m!==null&&typeof m==="object"&&!Array.isArray(m)&&!(m instanceof Error)&&Object.getPrototypeOf(m)===Object.prototype)N=m,K=u.slice(0,-1);let T=K.map((z)=>{if(z instanceof Error)return`${z.name}: ${z.message}`;if(typeof z==="object")try{return JSON.stringify(z)}catch{return"[Object]"}return String(z)}).join(" ");lW.emit({severityNumber:_,severityText:x,body:T,attributes:{"log.source":"console",...N}})},ym={error:console.error.bind(console),warn:console.warn.bind(console),debug:console.debug.bind(console)};console.error=(..._)=>{Im(Am.ERROR,"ERROR",_),ym.error(..._)};console.warn=(..._)=>{Im(Am.WARN,"WARN",_),ym.warn(..._)};console.debug=(..._)=>{Im(Am.DEBUG,"DEBUG",_),ym.debug(..._)};var Vm,Qz=0,wm=500;function eW(){if(Vm)return;let _=performance.now()+wm;Vm=setInterval(()=>{let x=performance.now();Qz=Math.max(0,x-_),_=x+wm},wm),Vm.unref?.()}function Xz(){return eW(),Qz}var bW=()=>H_.createHistogram("db.query.duration",{description:"Database query execution duration in milliseconds",unit:"ms"}),Zz=()=>H_.createHistogram("db.pool.acquire.duration",{description:"Time spent waiting to acquire a connection from the pool",unit:"ms"}),Wz=400,sW=100,_9=(_)=>({"db.status":_.level==="error"?"error":"success"}),x9=(_)=>(x)=>{let u=_9(x);if(x.queryDurationMillis>Wz){let N=Xz(),K=N>Wz/2;console.error(K?"Slow query measurement \u2014 likely event-loop lag, not slow SQL:":"Slow query detected:",{durationMs:x.queryDurationMillis,eventLoopLagMs:Math.round(N),sql:x.query.sql,pool:{total:_.totalCount,idle:_.idleCount,waiting:_.waitingCount,max:zx()}})}if(bW().record(x.queryDurationMillis,u),x.level==="error")console.error("Query failed:",{durationMs:x.queryDurationMillis,error:x.error,sql:x.query.sql})};function u9(_){let x=_.connect.bind(_);return _.connect=(u)=>{if(typeof u==="function")return x(u);let N=performance.now(),K=zx(),m=_.idleCount===0&&_.totalCount>=K,T=_.idleCount;return x().then((z)=>{let E=performance.now()-N;if(Zz().record(E,{"db.pool.outcome":m?"contended":"available"}),E>sW)if(m)console.error("Slow db pool acquire \u2014 pool saturated:",{waitMs:E,total:_.totalCount,idle:_.idleCount,waiting:_.waitingCount,max:K});else console.warn("Slow db pool acquire \u2014 event-loop lag (not pool):",{waitMs:E,idleAtStart:T,total:_.totalCount,max:K});return z},(z)=>{throw Zz().record(performance.now()-N,{"db.pool.outcome":"error"}),z})},_}var Fz={keepAlive:!0,keepAliveInitialDelayMillis:1e4,idleTimeoutMillis:300000,connectionTimeoutMillis:30000,allowExitOnIdle:!0};function Yz(){try{return K_().databasePgSsl}catch{return!1}}function zx(){try{return K_().databasePoolMax}catch{return 10}}function C9(_){let x=u9(new Lz({connectionString:_,max:zx(),ssl:Yz(),...Fz})),u=new jz({pool:x});return{type:"postgres",db:new dW({dialect:u,log:x9(x)}),pool:x}}function R_(){return K_().databaseUrl}function Dz(_){let x=_||R_();return new jz({pool:new Lz({connectionString:x,max:zx(),ssl:Yz(),...Fz})})}function K9(_){let x=_||R_();return C9(x)}async function Hz(_){if(await _.db.destroy(),!_.pool.ended)await _.pool.end();if(_===M_)M_=null}var M_=null;function km(){if(!M_)M_=K9(R_());return M_}async function Mz(_){let u={database:Dz(_||R_()),plugins:[T9({dynamicAccessControl:{enabled:!0,enableCustomResources:!0}}),z9(),E9(),$9(),J9(),U9({loginPage:"/login"}),m9(),P9({sendMagicLink:async()=>{}}),Q9({sendVerificationOTP:async()=>{}})]},{toBeAdded:N,toBeCreated:K,runMigrations:m}=await N9(u);if(!N.length&&!K.length)return"up to date";return await m(),`${K.length+N.length} table(s) migrated`}async function nm(_,x){return(await o`
     SELECT table_name FROM information_schema.tables