decocms 4.505.2 → 4.506.0

package/dist/server/migrate.js

@@ -2379,7 +2379,7 @@ var fz=Object.defineProperty;var Az=(_)=>_;function Iz(_,x){this[_]=Az.bind(null
     ON CONFLICT (thread_id, repository_id) DO NOTHING
   `.execute(_),await I`DROP FUNCTION IF EXISTS repo_ref_try_jsonb(text)`.execute(_)}async function AW(_){await I`DROP TABLE IF EXISTS thread_repositories`.execute(_),await I`
     ALTER TABLE connections DROP COLUMN IF EXISTS repository_id
-  `.execute(_)}var IW={"001-initial-schema":Xu,"002-organization-settings":Zu,"003-connection-schema-align":Wu,"004-remove-models-binding":ju,"005-connection-configuration":Lu,"006-add-views-to-settings":Fu,"007-monitoring-logs":Yu,"008-event-bus":Du,"009-drop-audit-logs":Hu,"010-gateways":Mu,"011-gateway-icon":Ru,"012-gateway-tool-selection-mode":Bu,"013-monitoring-user-agent-gateway":Gu,"014-gateway-resources-prompts":Ou,"015-monitoring-properties":Su,"016-downstream-token-client-info":fu,"017-downstream-token-remove-userid":Au,"018-drop-gateway-tool-selection-strategy":Iu,"019-remove-gateway-is-default":yu,"020-enabled-plugins":Vu,"021-threads":wu,"022-rename-gateway-to-virtual-mcp":ku,"023-optimize-thread-indexes":nu,"024-consolidate-virtual-mcp":vu,"025-add-monitoring-virtual-mcp-id":pu,"026-restrict-child-connection-delete":gu,"027-update-management-mcp-url":iu,"028-update-management-mcp-to-self":hu,"029-add-updated-by-to-connections":tu,"030-member-tags":ou,"031-add-dependency-mode":au,"032-projects":ru,"033-thread-status":lu,"034-monitoring-dashboards":eu,"035-project-connections":du,"036-update-registry-url":bu,"037-ai-provider-keys":su,"038-oauth-pkce-states":_C,"039-automations":xC,"040-replace-next-run-at-with-last-run-at":uC,"041-ai-provider-keys-unique-constraint":CC,"042-rename-mesh-mcp-to-cms-mcp":KC,"043-rename-cms-mcp-to-deco-cms":NC,"044-drop-connections-tools-column":mC,"045-thread-context-start-message":TC,"046-remove-object-storage-plugin":EC,"047-add-next-run-at":$C,"048-merge-projects-agents":JC,"049-remove-org-admin-projects":PC,"050-durable-agent-runs":QC,"051-org-sso":ZC,"052-thread-agent-ids":WC,"053-registry-config":jC,"054-connection-slug":FC,"055-spaces":YC,"056-automation-project-scope":DC,"057-thread-virtual-mcp-id":HC,"058-trigger-callback-tokens":MC,"059-kv":RC,"060-member-index":BC,"061-downstream-token-connection-index":GC,"062-private-registry":OC,"063-event-subscriptions-enabled-boolean":SC,"064-brand-context":fC,"065-organization-domains":AC,"066-brand-context-structured":IC,"067-threads-metadata":yC,"068-threads-branch":VC,"069-sandbox-runner-state":wC,"070-model-categories":kC,"071-default-home-agents":nC,"072-ai-provider-key-preset-id":vC,"073-backfill-basic-usage-roles":pC,"074-sandbox-runner-state-handle-nonunique":gC,"075-thread-inflight-async-jobs":qC,"076-automations-drop-agent-json":iC,"077-tier-only-model-selection":hC,"078-automation-tool-call-kind":tC,"079-strip-legacy-freestyle-vm-map-entries":oC,"080-async-research-jobs":aC,"081-async-research-jobs-result-content":rC,"082-secrets":lC,"083-thread-run-locally":eC,"084-drop-host-sandbox-rows":dC,"085-rename-runner-kind":bC,"086-thread-pins-and-vm-map-rekey":sC,"087-fix-vm-map-rekey":_K,"088-purge-cli-activate-keys":xK,"089-rename-remote-user-to-desktop":uK,"090-automation-webhook-triggers":CK,"091-organization-domains-allow-multi":KK,"092-sandbox-naming-uniformization":NK,"093-backfill-global-search-basic-usage":mK,"094-org-file-configs":zK,"095-remove-automation-tool-call-kind":EK,"096-org-file-configs-public-url-base":$K,"097-drop-local-docker-sandbox-state":JK,"098-thread-message-parts":PK,"099-run-fence":QK,"100-link-transport":XK,"101-cancel-requested-at":ZK,"102-observational-agent":WK,"103-revert-observational-agent":jK,"104-agent-sandbox-provider-kind":FK,"105-org-fs":YK,"106-automation-tools":DK,"107-org-fs-public-org":HK,"108-automation-max-agent-steps":MK,"109-thread-message-parts-per-message-seq":RK,"110-backfill-ghs-token-expiry":BK,"111-org-fs-thread-id":GK,"112-org-file-configs-credential-type":OK,"113-thread-failure-reason":SK,"114-run-acked-seq":fK,"115-thread-projected-seq":AK,"116-org-sites":IK,"117-org-file-configs-site-slug":yK,"118-organization-domains-multi-verify":VK,"119-organization-join-requests":wK,"120-org-fs-read-public":kK,"121-org-fs-share-password":nK,"122-split-web-research-tier":gK,"123-connection-credential-vault":qK,"124-drop-thread-projected-seq":iK,"125-github-child-single-parent":cK,"126-task-board":tK,"127-task-board-due-date":oK,"128-reports-only":aK,"129-task-board-assigned-by":rK,"130-task-board-thread-id":lK,"131-task-board-thread-link-cascade":eK,"132-task-board-item-prs":dK,"133-dedupe-duplicate-members":bK,"134-drop-task-board-enabled":sK,"135-task-board-item-fk-cascade":_N,"136-task-board-import-idempotency":xN,"137-agent-sandbox-runner-state":uN,"138-agent-sandbox-sessions":CN,"139-organization-billing":KN,"140-seat-change-log":NN,"141-benefits-sync-pending":mN,"142-stripe-event-watermark":TN,"143-armed-report-url":zN,"144-benefits-pending-index":EN,"145-user-model-preferences":$N,"146-organization-main-agent":UN,"147-drop-agent-sandbox-tables":JN,"148-org-flags":PN,"149-task-board-item-sort-order":QN,"150-task-board-activity":XN,"151-task-board-tags":WN,"152-repair-connection-slug":LN,"153-task-board-latest-assistant-part-index":FN,"154-task-board-qa-activity":DN,"155-task-board-review-claims":HN,"156-task-board-conflict-activity":RN,"157-drop-seat-billing":BN,"158-drop-github-child-single-parent":GN,"159-task-board-comments":ON,"160-task-quota-billing":SN,"161-task-quota-claim-state":AN,"162-claude-subscriptions":IN,"163-task-board-item-dismissed":yN,"164-per-org-task-quota":VN,"165-task-board-pending-review-index":wN,"166-task-board-last-swept-at":kN,"167-task-board-run-retry":nN,"168-org-repo-sync":pN,"169-task-board-merge-failed-activity":qN,"170-task-board-item-repo":iN,"171-jira-integration":cN,"172-task-board-item-key-seq":hN,"173-thread-github-repo-connection-index":tN,"174-thread-message-parts-persisted-at":aN,"175-task-board-sprints":rN,"176-task-board-done-sweep-index":lN,"177-notifications":eN,"178-jira-status-mapping-array":dN,"179-notification-mentioned":sN,"180-task-board-item-type":xm,"181-task-board-item-type-required":um,"182-task-board-sprints-entities":Cm,"183-drop-jira-jql-filter":Km,"184-jira-rescan-after-scope-change":Nm,"185-jira-rescan-existing-cards":mm,"186-jira-rescan-pending-flag":zm,"187-task-board-comment-thread":Em,"188-invitation-auto-accept":$m,"189-task-board-column-automations":Jm,"190-task-board-review-cycle-started-at":Pm,"191-task-board-columns":Qm,"192-task-board-verdict-nudge-activity":Zm,"193-task-board-status-column-fk":Wm,"194-jira-link-sprint":jm,"195-task-board-sprint-activity":Fm,"196-task-board-column-tracker-statuses":Ym,"197-task-board-prompts":Dm,"198-task-board-external-url":Hm,"199-drop-jira-mirror-and-org-columns":Mm,"200-jira-run-trigger":Rm,"201-organization-notices":Bm,"202-redact-base64-thread-parts":Om,"203-task-board-preview-routes":Sm,"204-git-provider-accounts-and-repositories":fm,"205-repository-references":Am,"206-repository-consumers":Qu,"207-task-board-prs-repo-idx":Pu,"208-github-connect-flows":Ju,"209-github-installation-authorization":Uu,"210-github-repository-authorization":Cu,"211-user-fs-org":uu,"212-coding-agent-mcp-excluded":Ku,"213-bitbucket-git-provider":Nu,"214-connections-sanitized-id-idx":bx,"215-commerce-discovery-repository":sx,"216-github-cli-auth":xu,"217-experiments":mu,"218-thread-message-parts-error-idx":Tu,"219-task-board-duplicate-reported-activity":Eu,"220-jira-automation-continue-pr":$u,"221-remove-private-registry":Qx,"222-org-git-credentials":Xx,"223-drop-org-main-agent-id":dx,"224-repository-sandbox-image":Zx,"225-thread-analytics-indexes":jx,"226-deco-score-names":Fx,"227-task-board-finding-resolved-activity":Dx,"228-org-voice-config":Px,"229-jira-automation-from":Hx,"230-project-sidebar":Mx,"231-jira-chat-agent":Rx,"232-task-board-prompt-skills":Gx,"233-remove-jira-chat-agent":Sx,"234-task-board-comment-audience":fx,"235-prune-empty-thread-dirs":Ax,"236-task-board-sprints":yx,"237-org-sites-project-link":Vx,"238-task-board-default-lanes":wx,"239-task-board-retire-old-lanes":kx,"240-task-board-restore-todo":nx,"241-automation-board-column-transition":vx,"242-connection-url-slug":px,"243-experiment-task-board-item":gx,"244-connection-url-slug-rollout-backfill":qx,"245-automation-system-key":ix,"246-automation-pr-ready-trigger":cx,"247-automation-jira-transition":hx,"248-drop-retired-rule-tables":tx,"249-task-board-item-project":ox,"250-github-copilot-subscriptions":ax,"251-org-shared-plans":rx,"252-automation-linked-chat-trigger":lx,"253-automation-pr-builtin-triggers":ex,"254-codex-subscriptions":$x,"255-order-monitor":Jx},Nx=IW;import{getMigrations as U9}from"better-auth/db";import{sso as J9}from"@better-auth/sso";import{organization as P9}from"@decocms/better-auth/plugins";import{admin as Q9,apiKey as X9,jwt as Z9,magicLink as W9,mcp as j9,openAPI as L9}from"better-auth/plugins";import{emailOTP as F9}from"better-auth/plugins/email-otp";import{Kysely as C9,PostgresDialect as Dz}from"kysely";import{Pool as Hz}from"pg";import{homedir as yW}from"os";var VW=new Set(["all","worker","api"]);function wW(_){let x=(_??"").trim();return VW.has(x)?x:"all"}var kW=new Set(["production","development","test"]);function nW(_){let x=(_??"").trim();return kW.has(x)?x:"development"}function Z(_){return _==="true"||_==="1"}function ym(_,x,u){if(x===void 0||x==="")return;let N=Number(x);if(!Number.isSafeInteger(N)||N<=0)throw Error(`${_} must be a positive integer`);if(u!==void 0&&N>u)throw Error(`${_} must be at most ${u}`);return N}function B(_,x,u,N){return ym(_,x,N)??u}function vW(_){let x={};for(let u of(_??"").split(",")){let N=u.trim();if(!N)continue;let K=N.indexOf("="),m=K>0?N.slice(0,K).trim():"",T=K>0?N.slice(K+1).trim():"";if(!m||!T){console.warn(`STRIPE_PLAN_PRICE_IDS: ignoring unparseable entry "${N}" \u2014 expected price_xxx=planId`);continue}x[m]=T}return x}function pW(_,x,u,N){if(x===void 0||x==="")return u;let K=Number(x);if(!Number.isSafeInteger(K)||K<0)throw Error(`${_} must be a non-negative integer`);if(N!==void 0&&K>N)throw Error(`${_} must be at most ${N}`);return K}function Im(_,x){if(_===void 0||_==="")return x;return _==="true"||_==="1"}function gW(_){return _===void 0||_===""||_==="true"||_==="1"}function H_(_,x){return _||x}function Pz(_){let x=_.DATA_DIR||_.DECOCMS_HOME||`${yW()}/deco`,u=nW(_.NODE_ENV),N=_.VOICE_CONVERSATION_PROVIDER?.trim()||"elevenlabs",K={nodeEnv:u,port:B("PORT",_.PORT,3000,65535),baseUrl:_.BASE_URL,publicUrl:H_(_.STUDIO_PUBLIC_URL,_.MESH_PUBLIC_URL),dataDir:x,voiceConversationProvider:N==="elevenlabs"||N==="openai"?N:null,openaiLiveApiKey:_.OPENAI_LIVE_API_KEY,openaiLiveModel:_.OPENAI_LIVE_MODEL?.trim()||"gpt-live-1",openaiLiveVoice:_.OPENAI_LIVE_VOICE?.trim()||"marin",elevenlabsApiKey:_.ELEVENLABS_API_KEY,elevenlabsVoiceId:_.ELEVENLABS_VOICE_ID||"JBFqnCBsd6RMkjVDRZzb",elevenlabsVoiceModel:_.ELEVENLABS_VOICE_MODEL||"eleven_v4_turbo",elevenlabsConversationModel:_.ELEVENLABS_CONVERSATION_MODEL?.trim()||"gemini-2.5-flash",databaseUrl:_.DATABASE_URL||"postgresql://postgres:postgres@localhost:5432/postgres",databasePgSsl:Z(_.DATABASE_PG_SSL),databasePoolMax:B("DATABASE_POOL_MAX",_.DATABASE_POOL_MAX,5),dbosPoolSize:B("DBOS_POOL_SIZE",_.DBOS_POOL_SIZE,5),betterAuthSecret:_.BETTER_AUTH_SECRET||"",encryptionKey:_.ENCRYPTION_KEY||"",studioJwtSecret:H_(_.STUDIO_JWT_SECRET,_.MESH_JWT_SECRET),localMode:Z(_.DECOCMS_LOCAL_MODE),disableRateLimit:Z(_.DISABLE_RATE_LIMIT),jiraAllowLocalSiteUrl:Z(_.JIRA_ALLOW_LOCAL_SITE_URL),jiraSettleSeconds:B("JIRA_SETTLE_SECONDS",_.JIRA_SETTLE_SECONDS,20,3600),studioProvisionSecretKey:_.STUDIO_PROVISION_SECRET_KEY,deploymentAdminEmails:(_.DEPLOYMENT_ADMIN_EMAILS??"").split(",").map((m)=>m.trim().toLowerCase()).filter(Boolean),taskBoardAdminOrgIds:(_.STUDIO_ADMIN_ORG_IDS??"").split(",").map((m)=>m.trim()).filter(Boolean),deploymentAdminToken:_.DEPLOYMENT_ADMIN_TOKEN||void 0,clickhouseUrl:_.CLICKHOUSE_URL,clickhouseMaxMemoryUsage:ym("CLICKHOUSE_MAX_MEMORY_USAGE",_.CLICKHOUSE_MAX_MEMORY_USAGE),monitoringOtlpEndpoint:_.MONITORING_OTLP_ENDPOINT,otelServiceName:_.OTEL_SERVICE_NAME||"studio",natsUrls:(_.NATS_URL||"nats://localhost:4222").split(",").map((m)=>m.trim()).filter(Boolean),natsCredsPath:_.NATS_CREDS,natsUser:_.NATS_USER||void 0,natsPassword:_.NATS_PASSWORD||void 0,configPath:_.CONFIG_PATH||"./config.json",aiGatewayEnabled:Z(_.DECO_AI_GATEWAY_ENABLED),aiGatewayUrl:_.DECO_AI_GATEWAY_URL||"https://ai-site.deco.site",aiGatewayAdminToken:_.DECO_AI_GATEWAY_ADMIN_TOKEN,stripeWebhookSecret:_.STRIPE_WEBHOOK_SECRET,stripeSecretKey:_.STRIPE_SECRET_KEY,stripeOrgPriceId:_.STRIPE_ORG_PRICE_ID,stripePlanPriceIds:vW(_.STRIPE_PLAN_PRICE_IDS),stripePortalConfigurationId:_.STRIPE_PORTAL_CONFIGURATION_ID,stripeTopupProductId:_.STRIPE_TOPUP_PRODUCT_ID,topupFeePercent:pW("STUDIO_TOPUP_FEE_PERCENT",_.STUDIO_TOPUP_FEE_PERCENT,15,100),taskQuotaEnforced:Z(_.STUDIO_TASK_QUOTA_ENFORCED),freeTaskExecutions:B("STUDIO_FREE_TASKS",_.STUDIO_FREE_TASKS,3),monthlyTaskExecutions:B("STUDIO_MONTHLY_TASKS",_.STUDIO_MONTHLY_TASKS,10),maxRunsPerTask:B("STUDIO_MAX_RUNS_PER_TASK",_.STUDIO_MAX_RUNS_PER_TASK,5),enableDecoImport:Z(_.ENABLE_DECO_IMPORT),hostingControlPlaneGa:Z(_.HOSTING_CONTROL_PLANE_GA),monitorGa:Z(_.MONITOR_GA),plansEnabled:Z(_.STUDIO_PLANS_ENABLED),mcpCacheEnabled:Im(_.MCP_CACHE_ENABLED,u!=="development"),orgFsPublicSetsJson:_.ORGFS_PUBLIC_SETS,orgFsMountsDisabled:Z(_.DISABLE_ORGFS_MOUNTS),decopilotMaxConcurrentSubagents:B("DECOPILOT_MAX_CONCURRENT_SUBAGENTS",_.DECOPILOT_MAX_CONCURRENT_SUBAGENTS,4),decopilotMaxConcurrentHostedRuns:B("DECOPILOT_MAX_CONCURRENT_HOSTED_RUNS",_.DECOPILOT_MAX_CONCURRENT_HOSTED_RUNS,3),taskBoardReviewSweeperEnabled:Im(_.TASK_BOARD_REVIEW_SWEEPER_ENABLED,!0),boardTransitionSettleSeconds:B("BOARD_TRANSITION_SETTLE_SECONDS",_.BOARD_TRANSITION_SETTLE_SECONDS,20,3600),sandboxMaxConcurrentHostedRuns:B("SANDBOX_MAX_CONCURRENT_HOSTED_RUNS",_.SANDBOX_MAX_CONCURRENT_HOSTED_RUNS,12),s3Endpoint:_.S3_ENDPOINT,s3Bucket:_.S3_BUCKET,s3Region:_.S3_REGION||"auto",s3AccessKeyId:_.S3_ACCESS_KEY_ID,s3SecretAccessKey:_.S3_SECRET_ACCESS_KEY,s3ForcePathStyle:gW(_.S3_FORCE_PATH_STYLE),monitoringS3Bucket:_.MONITORING_S3_BUCKET,monitoringS3Endpoint:_.MONITORING_S3_ENDPOINT,monitoringS3Region:_.MONITORING_S3_REGION,monitoringS3AccessKeyId:_.MONITORING_S3_ACCESS_KEY_ID,monitoringS3SecretAccessKey:_.MONITORING_S3_SECRET_ACCESS_KEY,monitoringS3Prefix:_.MONITORING_S3_PREFIX,duckdbExtensionDirectory:_.DUCKDB_EXTENSION_DIRECTORY||"/opt/duckdb/extensions",duckdbMemoryLimit:_.DUCKDB_MEMORY_LIMIT||void 0,duckdbThreads:ym("DUCKDB_THREADS",_.DUCKDB_THREADS),podName:_.POD_NAME||crypto.randomUUID(),dispatchRole:wW(H_(_.STUDIO_DISPATCH_ROLE,_.MESH_DISPATCH_ROLE)),agentSandboxEnabled:Z(_.STUDIO_AGENT_SANDBOX_ENABLED),sandboxStickyHeadRefEnabled:Z(_.SANDBOX_STICKY_HEAD_REF),taskBoardRerunReusesPrBranch:Im(_.TASK_BOARD_RERUN_REUSES_PR_BRANCH,!0),sandboxReleaseOnRunEndEnabled:Z(_.SANDBOX_RELEASE_ON_RUN_END),sandboxPrewarmOnThreadCreateEnabled:Z(_.SANDBOX_PREWARM_ON_THREAD_CREATE),sandboxPersistentHarnessEnabled:Z(_.SANDBOX_PERSISTENT_HARNESS),sandboxReleaseGraceMs:B("SANDBOX_RELEASE_GRACE_MS",_.SANDBOX_RELEASE_GRACE_MS,120000),decoSupabaseUrl:_.DECO_SUPABASE_URL,decoSupabaseServiceKey:_.DECO_SUPABASE_SERVICE_KEY,controlplaneRestUrl:_.CONTROLPLANE_REST_URL,controlplaneServiceToken:_.CONTROLPLANE_SERVICE_TOKEN,analyticsDataUrl:_.ANALYTICS_URL,analyticsMasterToken:_.ANALYTICS_MASTER_TOKEN,clickhouseAnalyticsUrl:_.CLICKHOUSE_ANALYTICS_ADDRESS,clickhouseAnalyticsUsername:_.CLICKHOUSE_ANALYTICS_USERNAME||"admin_monitor",clickhouseAnalyticsPassword:_.CLICKHOUSE_ANALYTICS_PASSWORD,customerLakeUrl:_.CUSTOMER_LAKE_URL,customerLakeAdminUsername:_.CUSTOMER_LAKE_ADMIN_USERNAME||"customer_lake_user_admin",customerLakeAdminPassword:_.CUSTOMER_LAKE_ADMIN_PASSWORD,customerLakeTenantSecret:_.CUSTOMER_LAKE_TENANT_SECRET,orderMonitorIngestUrl:_.ORDER_MONITOR_INGEST_URL,oneDollarStatsApiKey:_.ONEDOLLAR_BACKEND_API_KEY,reportsInternalApiUrl:H_(_.REPORTS_INTERNAL_API_URL,_.COMMERCE_DISCOVERY_INTERNAL_API_URL),reportsInternalApiKey:H_(_.REPORTS_INTERNAL_API_KEY,_.COMMERCE_DISCOVERY_INTERNAL_API_KEY),s3TenantBucket:_.S3_TENANT_BUCKET||"new-deco-sites-assets",s3TenantRegion:_.S3_TENANT_REGION||"us-west-2",s3TenantEndpoint:_.S3_TENANT_ENDPOINT,s3TenantPublicUrlBase:_.S3_TENANT_PUBLIC_URL_BASE||"https://assets.decocms.com",awsS3TenantRoleArn:_.AWS_S3_TENANT_ROLE_ARN,awsS3TenantProvisionerAccessKeyId:_.AWS_S3_TENANT_PROVISIONER_ACCESS_KEY_ID,awsS3TenantProvisionerSecretAccessKey:_.AWS_S3_TENANT_PROVISIONER_SECRET_ACCESS_KEY,deliveryR2AccountId:_.DELIVERY_R2_ACCOUNT_ID,deliveryR2AccessKeyId:_.DELIVERY_R2_ACCESS_KEY_ID,deliveryR2SecretAccessKey:_.DELIVERY_R2_SECRET_ACCESS_KEY,deliveryR2Bucket:_.DELIVERY_R2_BUCKET,deliveryR2Endpoint:_.DELIVERY_R2_ENDPOINT,deliveryPublicOrigin:_.DELIVERY_PUBLIC_ORIGIN,siteTokenSigningKey:_.DECO_SITE_TOKEN_SIGNING_KEY,cfDeliveryZoneId:_.CF_DELIVERY_ZONE_ID,cfPurgeApiToken:_.CF_PURGE_API_TOKEN};if(Boolean(K.natsUser)!==Boolean(K.natsPassword))throw Error("NATS_USER and NATS_PASSWORD must be set together");if(K.natsCredsPath&&K.natsUser)throw Error("Use either NATS_CREDS or NATS_USER/NATS_PASSWORD");if(K.plansEnabled&&!K.studioJwtSecret)throw Error("STUDIO_PLANS_ENABLED requires an explicit gateway JWT secret. Set STUDIO_JWT_SECRET (or its legacy alias MESH_JWT_SECRET) to the same value as the gateway's MESH_JWT_SECRET. Refusing to fall back to BETTER_AUTH_SECRET: that mismatch 401s every entitlements call, which every feature gate reads as 'no answer' and fails OPEN.");if(K.plansEnabled&&!K.studioProvisionSecretKey)throw Error("STUDIO_PLANS_ENABLED requires STUDIO_PROVISION_SECRET_KEY, set to the same value as the gateway's STUDIO_PROVISION_KEY. Without it the gateway cannot identify this server, falls back to a per-user membership callback that 401s for any user who never completed the gateway OAuth flow, and every feature gate then fails OPEN.");if(K.plansEnabled&&!K.aiGatewayEnabled)throw Error("STUDIO_PLANS_ENABLED requires DECO_AI_GATEWAY_ENABLED=true. Plans are read from the gateway; with it disabled there is no adapter to ask, so every feature gate fails OPEN on both server and client and the paid product is free fleet-wide.");if(K.plansEnabled&&Object.keys(K.stripePlanPriceIds).length>0&&!K.aiGatewayAdminToken)throw Error("STRIPE_PLAN_PRICE_IDS is set but DECO_AI_GATEWAY_ADMIN_TOKEN is not. The Stripe webhook places the paid tier through the gateway's admin API, so without the token a customer is charged and the entitlement "+"is never granted \u2014 and AI_PLAN_SET cannot repair it, it accepts only "+"'free'.");if(K.plansEnabled&&Object.keys(K.stripePlanPriceIds).length>1&&!K.stripePortalConfigurationId)console.warn("STRIPE_PLAN_PRICE_IDS maps more than one plan but STRIPE_PORTAL_CONFIGURATION_ID is unset. An org that already has a subscription cannot change tier: the account's default portal configuration lists only the legacy plans, not the tiers, so Stripe refuses the update flow. First-time checkout is unaffected.");return K}var qW=null;function K_(){return qW??=Object.freeze(Pz(process.env))}import{createContextKey as aW,metrics as rW,propagation as D8,ROOT_CONTEXT as H8,SpanStatusCode as M8,trace as lW}from"@opentelemetry/api";import{logs as eW,SeverityNumber as Vm}from"@opentelemetry/api-logs";import{OTLPLogExporter as G8}from"@opentelemetry/exporter-logs-otlp-proto";import{PrometheusExporter as dW}from"@opentelemetry/exporter-prometheus";import{OTLPTraceExporter as f8}from"@opentelemetry/exporter-trace-otlp-proto";import{RuntimeNodeInstrumentation as I8}from"@opentelemetry/instrumentation-runtime-node";import{context as Z5,propagation as W5,SpanKind as j5,SpanStatusCode as L5}from"@opentelemetry/api";var Y5=globalThis.fetch;import{ExportResultCode as y5}from"@opentelemetry/core";import{ExportResultCode as mx}from"@opentelemetry/core";import{mkdir as iW,rename as cW,writeFile as hW}from"fs/promises";import{join as Tx}from"path";class zx{bufferItems=[];bufferBytes=0;flushTimer=null;flushQueue=Promise.resolve();basePath;flushThreshold;maxBufferBytes;isShutdown=!1;knownDirs=new Set;partitionKey;constructor(_){this.basePath=_.basePath,this.flushThreshold=_.flushThreshold??1000,this.maxBufferBytes=_.maxBufferBytes??10485760,this.partitionKey=_.partitionKey;let x=_.flushIntervalMs??60000;if(x>0&&x<3600000){if(this.flushTimer=setInterval(()=>{this.flush().catch((u)=>{console.error("[NDJSONExporter] Timer flush failed:",u)})},x),this.flushTimer&&typeof this.flushTimer==="object"&&"unref"in this.flushTimer)this.flushTimer.unref()}}exportRows(_){if(this.isShutdown)return Promise.resolve({code:mx.FAILED});for(let x of _){let u=JSON.stringify(x),N=this.partitionKey?this.partitionKey(x):"";this.bufferItems.push({partition:N,json:u}),this.bufferBytes+=Buffer.byteLength(u,"utf8")+1}if(this.bufferItems.length>=this.flushThreshold||this.bufferBytes>=this.maxBufferBytes)return this.flush().then(()=>({code:mx.SUCCESS})).catch((x)=>{return console.error("[NDJSONExporter] Flush failed:",x),{code:mx.FAILED}});return Promise.resolve({code:mx.SUCCESS})}async shutdown(){if(this.isShutdown=!0,this.flushTimer)clearInterval(this.flushTimer),this.flushTimer=null;try{await this.flushQueue}catch{}if(this.bufferItems.length>0)await this.flush()}async forceFlush(){try{await this.flushQueue}catch{}if(this.bufferItems.length>0)await this.flush()}flush(){let x=this.flushQueue.catch(()=>{}).then(()=>this.doFlush());return this.flushQueue=x,x}async doFlush(){if(this.bufferItems.length===0)return;let _=this.bufferItems;this.bufferItems=[],this.bufferBytes=0;let x=new Map;for(let K of _){let m=x.get(K.partition);if(!m)m=[],x.set(K.partition,m);m.push(K.json)}let u=await Promise.allSettled(Array.from(x.entries()).map(([K,m])=>this.writeNDJSON(m,K).then(()=>K))),N=u.find((K)=>K.status==="rejected");if(N){let K=new Set;for(let T of u)if(T.status==="fulfilled")K.add(T.value);let m=_.filter((T)=>!K.has(T.partition));this.bufferItems=m.concat(this.bufferItems),this.bufferBytes=0;for(let T of this.bufferItems)this.bufferBytes+=Buffer.byteLength(T.json,"utf8")+1;throw N.reason}}async writeNDJSON(_,x){let u=new Date,N=[String(u.getUTCFullYear()),String(u.getUTCMonth()+1).padStart(2,"0"),String(u.getUTCDate()).padStart(2,"0"),String(u.getUTCHours()).padStart(2,"0")],K=x?Tx(this.basePath,x,...N):Tx(this.basePath,...N);if(!this.knownDirs.has(K))await iW(K,{recursive:!0,mode:448}),this.knownDirs.add(K);let m=`${crypto.randomUUID()}.ndjson`,T=Tx(K,`.${m}.tmp`),z=Tx(K,m),E=_.join(`
+  `.execute(_)}var IW={"001-initial-schema":Xu,"002-organization-settings":Zu,"003-connection-schema-align":Wu,"004-remove-models-binding":ju,"005-connection-configuration":Lu,"006-add-views-to-settings":Fu,"007-monitoring-logs":Yu,"008-event-bus":Du,"009-drop-audit-logs":Hu,"010-gateways":Mu,"011-gateway-icon":Ru,"012-gateway-tool-selection-mode":Bu,"013-monitoring-user-agent-gateway":Gu,"014-gateway-resources-prompts":Ou,"015-monitoring-properties":Su,"016-downstream-token-client-info":fu,"017-downstream-token-remove-userid":Au,"018-drop-gateway-tool-selection-strategy":Iu,"019-remove-gateway-is-default":yu,"020-enabled-plugins":Vu,"021-threads":wu,"022-rename-gateway-to-virtual-mcp":ku,"023-optimize-thread-indexes":nu,"024-consolidate-virtual-mcp":vu,"025-add-monitoring-virtual-mcp-id":pu,"026-restrict-child-connection-delete":gu,"027-update-management-mcp-url":iu,"028-update-management-mcp-to-self":hu,"029-add-updated-by-to-connections":tu,"030-member-tags":ou,"031-add-dependency-mode":au,"032-projects":ru,"033-thread-status":lu,"034-monitoring-dashboards":eu,"035-project-connections":du,"036-update-registry-url":bu,"037-ai-provider-keys":su,"038-oauth-pkce-states":_C,"039-automations":xC,"040-replace-next-run-at-with-last-run-at":uC,"041-ai-provider-keys-unique-constraint":CC,"042-rename-mesh-mcp-to-cms-mcp":KC,"043-rename-cms-mcp-to-deco-cms":NC,"044-drop-connections-tools-column":mC,"045-thread-context-start-message":TC,"046-remove-object-storage-plugin":EC,"047-add-next-run-at":$C,"048-merge-projects-agents":JC,"049-remove-org-admin-projects":PC,"050-durable-agent-runs":QC,"051-org-sso":ZC,"052-thread-agent-ids":WC,"053-registry-config":jC,"054-connection-slug":FC,"055-spaces":YC,"056-automation-project-scope":DC,"057-thread-virtual-mcp-id":HC,"058-trigger-callback-tokens":MC,"059-kv":RC,"060-member-index":BC,"061-downstream-token-connection-index":GC,"062-private-registry":OC,"063-event-subscriptions-enabled-boolean":SC,"064-brand-context":fC,"065-organization-domains":AC,"066-brand-context-structured":IC,"067-threads-metadata":yC,"068-threads-branch":VC,"069-sandbox-runner-state":wC,"070-model-categories":kC,"071-default-home-agents":nC,"072-ai-provider-key-preset-id":vC,"073-backfill-basic-usage-roles":pC,"074-sandbox-runner-state-handle-nonunique":gC,"075-thread-inflight-async-jobs":qC,"076-automations-drop-agent-json":iC,"077-tier-only-model-selection":hC,"078-automation-tool-call-kind":tC,"079-strip-legacy-freestyle-vm-map-entries":oC,"080-async-research-jobs":aC,"081-async-research-jobs-result-content":rC,"082-secrets":lC,"083-thread-run-locally":eC,"084-drop-host-sandbox-rows":dC,"085-rename-runner-kind":bC,"086-thread-pins-and-vm-map-rekey":sC,"087-fix-vm-map-rekey":_K,"088-purge-cli-activate-keys":xK,"089-rename-remote-user-to-desktop":uK,"090-automation-webhook-triggers":CK,"091-organization-domains-allow-multi":KK,"092-sandbox-naming-uniformization":NK,"093-backfill-global-search-basic-usage":mK,"094-org-file-configs":zK,"095-remove-automation-tool-call-kind":EK,"096-org-file-configs-public-url-base":$K,"097-drop-local-docker-sandbox-state":JK,"098-thread-message-parts":PK,"099-run-fence":QK,"100-link-transport":XK,"101-cancel-requested-at":ZK,"102-observational-agent":WK,"103-revert-observational-agent":jK,"104-agent-sandbox-provider-kind":FK,"105-org-fs":YK,"106-automation-tools":DK,"107-org-fs-public-org":HK,"108-automation-max-agent-steps":MK,"109-thread-message-parts-per-message-seq":RK,"110-backfill-ghs-token-expiry":BK,"111-org-fs-thread-id":GK,"112-org-file-configs-credential-type":OK,"113-thread-failure-reason":SK,"114-run-acked-seq":fK,"115-thread-projected-seq":AK,"116-org-sites":IK,"117-org-file-configs-site-slug":yK,"118-organization-domains-multi-verify":VK,"119-organization-join-requests":wK,"120-org-fs-read-public":kK,"121-org-fs-share-password":nK,"122-split-web-research-tier":gK,"123-connection-credential-vault":qK,"124-drop-thread-projected-seq":iK,"125-github-child-single-parent":cK,"126-task-board":tK,"127-task-board-due-date":oK,"128-reports-only":aK,"129-task-board-assigned-by":rK,"130-task-board-thread-id":lK,"131-task-board-thread-link-cascade":eK,"132-task-board-item-prs":dK,"133-dedupe-duplicate-members":bK,"134-drop-task-board-enabled":sK,"135-task-board-item-fk-cascade":_N,"136-task-board-import-idempotency":xN,"137-agent-sandbox-runner-state":uN,"138-agent-sandbox-sessions":CN,"139-organization-billing":KN,"140-seat-change-log":NN,"141-benefits-sync-pending":mN,"142-stripe-event-watermark":TN,"143-armed-report-url":zN,"144-benefits-pending-index":EN,"145-user-model-preferences":$N,"146-organization-main-agent":UN,"147-drop-agent-sandbox-tables":JN,"148-org-flags":PN,"149-task-board-item-sort-order":QN,"150-task-board-activity":XN,"151-task-board-tags":WN,"152-repair-connection-slug":LN,"153-task-board-latest-assistant-part-index":FN,"154-task-board-qa-activity":DN,"155-task-board-review-claims":HN,"156-task-board-conflict-activity":RN,"157-drop-seat-billing":BN,"158-drop-github-child-single-parent":GN,"159-task-board-comments":ON,"160-task-quota-billing":SN,"161-task-quota-claim-state":AN,"162-claude-subscriptions":IN,"163-task-board-item-dismissed":yN,"164-per-org-task-quota":VN,"165-task-board-pending-review-index":wN,"166-task-board-last-swept-at":kN,"167-task-board-run-retry":nN,"168-org-repo-sync":pN,"169-task-board-merge-failed-activity":qN,"170-task-board-item-repo":iN,"171-jira-integration":cN,"172-task-board-item-key-seq":hN,"173-thread-github-repo-connection-index":tN,"174-thread-message-parts-persisted-at":aN,"175-task-board-sprints":rN,"176-task-board-done-sweep-index":lN,"177-notifications":eN,"178-jira-status-mapping-array":dN,"179-notification-mentioned":sN,"180-task-board-item-type":xm,"181-task-board-item-type-required":um,"182-task-board-sprints-entities":Cm,"183-drop-jira-jql-filter":Km,"184-jira-rescan-after-scope-change":Nm,"185-jira-rescan-existing-cards":mm,"186-jira-rescan-pending-flag":zm,"187-task-board-comment-thread":Em,"188-invitation-auto-accept":$m,"189-task-board-column-automations":Jm,"190-task-board-review-cycle-started-at":Pm,"191-task-board-columns":Qm,"192-task-board-verdict-nudge-activity":Zm,"193-task-board-status-column-fk":Wm,"194-jira-link-sprint":jm,"195-task-board-sprint-activity":Fm,"196-task-board-column-tracker-statuses":Ym,"197-task-board-prompts":Dm,"198-task-board-external-url":Hm,"199-drop-jira-mirror-and-org-columns":Mm,"200-jira-run-trigger":Rm,"201-organization-notices":Bm,"202-redact-base64-thread-parts":Om,"203-task-board-preview-routes":Sm,"204-git-provider-accounts-and-repositories":fm,"205-repository-references":Am,"206-repository-consumers":Qu,"207-task-board-prs-repo-idx":Pu,"208-github-connect-flows":Ju,"209-github-installation-authorization":Uu,"210-github-repository-authorization":Cu,"211-user-fs-org":uu,"212-coding-agent-mcp-excluded":Ku,"213-bitbucket-git-provider":Nu,"214-connections-sanitized-id-idx":bx,"215-commerce-discovery-repository":sx,"216-github-cli-auth":xu,"217-experiments":mu,"218-thread-message-parts-error-idx":Tu,"219-task-board-duplicate-reported-activity":Eu,"220-jira-automation-continue-pr":$u,"221-remove-private-registry":Qx,"222-org-git-credentials":Xx,"223-drop-org-main-agent-id":dx,"224-repository-sandbox-image":Zx,"225-thread-analytics-indexes":jx,"226-deco-score-names":Fx,"227-task-board-finding-resolved-activity":Dx,"228-org-voice-config":Px,"229-jira-automation-from":Hx,"230-project-sidebar":Mx,"231-jira-chat-agent":Rx,"232-task-board-prompt-skills":Gx,"233-remove-jira-chat-agent":Sx,"234-task-board-comment-audience":fx,"235-prune-empty-thread-dirs":Ax,"236-task-board-sprints":yx,"237-org-sites-project-link":Vx,"238-task-board-default-lanes":wx,"239-task-board-retire-old-lanes":kx,"240-task-board-restore-todo":nx,"241-automation-board-column-transition":vx,"242-connection-url-slug":px,"243-experiment-task-board-item":gx,"244-connection-url-slug-rollout-backfill":qx,"245-automation-system-key":ix,"246-automation-pr-ready-trigger":cx,"247-automation-jira-transition":hx,"248-drop-retired-rule-tables":tx,"249-task-board-item-project":ox,"250-github-copilot-subscriptions":ax,"251-org-shared-plans":rx,"252-automation-linked-chat-trigger":lx,"253-automation-pr-builtin-triggers":ex,"254-codex-subscriptions":$x,"255-order-monitor":Jx},Nx=IW;import{getMigrations as U9}from"better-auth/db";import{sso as J9}from"@better-auth/sso";import{organization as P9}from"@decocms/better-auth/plugins";import{admin as Q9,apiKey as X9,jwt as Z9,magicLink as W9,mcp as j9,openAPI as L9}from"better-auth/plugins";import{emailOTP as F9}from"better-auth/plugins/email-otp";import{Kysely as C9,PostgresDialect as Dz}from"kysely";import{Pool as Hz}from"pg";import{homedir as yW}from"os";var VW=new Set(["all","worker","api"]);function wW(_){let x=(_??"").trim();return VW.has(x)?x:"all"}var kW=new Set(["production","development","test"]);function nW(_){let x=(_??"").trim();return kW.has(x)?x:"development"}function Z(_){return _==="true"||_==="1"}function ym(_,x,u){if(x===void 0||x==="")return;let N=Number(x);if(!Number.isSafeInteger(N)||N<=0)throw Error(`${_} must be a positive integer`);if(u!==void 0&&N>u)throw Error(`${_} must be at most ${u}`);return N}function B(_,x,u,N){return ym(_,x,N)??u}function vW(_){let x={};for(let u of(_??"").split(",")){let N=u.trim();if(!N)continue;let K=N.indexOf("="),m=K>0?N.slice(0,K).trim():"",T=K>0?N.slice(K+1).trim():"";if(!m||!T){console.warn(`STRIPE_PLAN_PRICE_IDS: ignoring unparseable entry "${N}" \u2014 expected price_xxx=planId`);continue}x[m]=T}return x}function pW(_,x,u,N){if(x===void 0||x==="")return u;let K=Number(x);if(!Number.isSafeInteger(K)||K<0)throw Error(`${_} must be a non-negative integer`);if(N!==void 0&&K>N)throw Error(`${_} must be at most ${N}`);return K}function Im(_,x){if(_===void 0||_==="")return x;return _==="true"||_==="1"}function gW(_){return _===void 0||_===""||_==="true"||_==="1"}function H_(_,x){return _||x}function Pz(_){let x=_.DATA_DIR||_.DECOCMS_HOME||`${yW()}/deco`,u=nW(_.NODE_ENV),N=_.VOICE_CONVERSATION_PROVIDER?.trim()||"elevenlabs",K={nodeEnv:u,port:B("PORT",_.PORT,3000,65535),baseUrl:_.BASE_URL,publicUrl:H_(_.STUDIO_PUBLIC_URL,_.MESH_PUBLIC_URL),dataDir:x,voiceConversationProvider:N==="elevenlabs"||N==="openai"?N:null,openaiLiveApiKey:_.OPENAI_LIVE_API_KEY,openaiLiveModel:_.OPENAI_LIVE_MODEL?.trim()||"gpt-live-1",openaiLiveVoice:_.OPENAI_LIVE_VOICE?.trim()||"marin",elevenlabsApiKey:_.ELEVENLABS_API_KEY,elevenlabsVoiceId:_.ELEVENLABS_VOICE_ID||"JBFqnCBsd6RMkjVDRZzb",elevenlabsVoiceModel:_.ELEVENLABS_VOICE_MODEL||"eleven_v4_turbo",elevenlabsConversationModel:_.ELEVENLABS_CONVERSATION_MODEL?.trim()||"gemini-2.5-flash",databaseUrl:_.DATABASE_URL||"postgresql://postgres:postgres@localhost:5432/postgres",databasePgSsl:Z(_.DATABASE_PG_SSL),databasePoolMax:B("DATABASE_POOL_MAX",_.DATABASE_POOL_MAX,5),dbosPoolSize:B("DBOS_POOL_SIZE",_.DBOS_POOL_SIZE,5),betterAuthSecret:_.BETTER_AUTH_SECRET||"",encryptionKey:_.ENCRYPTION_KEY||"",studioJwtSecret:H_(_.STUDIO_JWT_SECRET,_.MESH_JWT_SECRET),localMode:Z(_.DECOCMS_LOCAL_MODE),disableRateLimit:Z(_.DISABLE_RATE_LIMIT),jiraAllowLocalSiteUrl:Z(_.JIRA_ALLOW_LOCAL_SITE_URL),codexUsageUrl:_.CODEX_USAGE_URL||"https://chatgpt.com/backend-api/wham/usage",claudeUsageUrl:_.CLAUDE_USAGE_URL||"https://api.anthropic.com/api/oauth/usage",jiraSettleSeconds:B("JIRA_SETTLE_SECONDS",_.JIRA_SETTLE_SECONDS,20,3600),studioProvisionSecretKey:_.STUDIO_PROVISION_SECRET_KEY,deploymentAdminEmails:(_.DEPLOYMENT_ADMIN_EMAILS??"").split(",").map((m)=>m.trim().toLowerCase()).filter(Boolean),taskBoardAdminOrgIds:(_.STUDIO_ADMIN_ORG_IDS??"").split(",").map((m)=>m.trim()).filter(Boolean),deploymentAdminToken:_.DEPLOYMENT_ADMIN_TOKEN||void 0,clickhouseUrl:_.CLICKHOUSE_URL,clickhouseMaxMemoryUsage:ym("CLICKHOUSE_MAX_MEMORY_USAGE",_.CLICKHOUSE_MAX_MEMORY_USAGE),monitoringOtlpEndpoint:_.MONITORING_OTLP_ENDPOINT,otelServiceName:_.OTEL_SERVICE_NAME||"studio",natsUrls:(_.NATS_URL||"nats://localhost:4222").split(",").map((m)=>m.trim()).filter(Boolean),natsCredsPath:_.NATS_CREDS,natsUser:_.NATS_USER||void 0,natsPassword:_.NATS_PASSWORD||void 0,configPath:_.CONFIG_PATH||"./config.json",aiGatewayEnabled:Z(_.DECO_AI_GATEWAY_ENABLED),aiGatewayUrl:_.DECO_AI_GATEWAY_URL||"https://ai-site.deco.site",aiGatewayAdminToken:_.DECO_AI_GATEWAY_ADMIN_TOKEN,stripeWebhookSecret:_.STRIPE_WEBHOOK_SECRET,stripeSecretKey:_.STRIPE_SECRET_KEY,stripeOrgPriceId:_.STRIPE_ORG_PRICE_ID,stripePlanPriceIds:vW(_.STRIPE_PLAN_PRICE_IDS),stripePortalConfigurationId:_.STRIPE_PORTAL_CONFIGURATION_ID,stripeTopupProductId:_.STRIPE_TOPUP_PRODUCT_ID,topupFeePercent:pW("STUDIO_TOPUP_FEE_PERCENT",_.STUDIO_TOPUP_FEE_PERCENT,15,100),taskQuotaEnforced:Z(_.STUDIO_TASK_QUOTA_ENFORCED),freeTaskExecutions:B("STUDIO_FREE_TASKS",_.STUDIO_FREE_TASKS,3),monthlyTaskExecutions:B("STUDIO_MONTHLY_TASKS",_.STUDIO_MONTHLY_TASKS,10),maxRunsPerTask:B("STUDIO_MAX_RUNS_PER_TASK",_.STUDIO_MAX_RUNS_PER_TASK,5),enableDecoImport:Z(_.ENABLE_DECO_IMPORT),hostingControlPlaneGa:Z(_.HOSTING_CONTROL_PLANE_GA),monitorGa:Z(_.MONITOR_GA),plansEnabled:Z(_.STUDIO_PLANS_ENABLED),mcpCacheEnabled:Im(_.MCP_CACHE_ENABLED,u!=="development"),orgFsPublicSetsJson:_.ORGFS_PUBLIC_SETS,orgFsMountsDisabled:Z(_.DISABLE_ORGFS_MOUNTS),decopilotMaxConcurrentSubagents:B("DECOPILOT_MAX_CONCURRENT_SUBAGENTS",_.DECOPILOT_MAX_CONCURRENT_SUBAGENTS,4),decopilotMaxConcurrentHostedRuns:B("DECOPILOT_MAX_CONCURRENT_HOSTED_RUNS",_.DECOPILOT_MAX_CONCURRENT_HOSTED_RUNS,3),taskBoardReviewSweeperEnabled:Im(_.TASK_BOARD_REVIEW_SWEEPER_ENABLED,!0),boardTransitionSettleSeconds:B("BOARD_TRANSITION_SETTLE_SECONDS",_.BOARD_TRANSITION_SETTLE_SECONDS,20,3600),sandboxMaxConcurrentHostedRuns:B("SANDBOX_MAX_CONCURRENT_HOSTED_RUNS",_.SANDBOX_MAX_CONCURRENT_HOSTED_RUNS,12),s3Endpoint:_.S3_ENDPOINT,s3Bucket:_.S3_BUCKET,s3Region:_.S3_REGION||"auto",s3AccessKeyId:_.S3_ACCESS_KEY_ID,s3SecretAccessKey:_.S3_SECRET_ACCESS_KEY,s3ForcePathStyle:gW(_.S3_FORCE_PATH_STYLE),monitoringS3Bucket:_.MONITORING_S3_BUCKET,monitoringS3Endpoint:_.MONITORING_S3_ENDPOINT,monitoringS3Region:_.MONITORING_S3_REGION,monitoringS3AccessKeyId:_.MONITORING_S3_ACCESS_KEY_ID,monitoringS3SecretAccessKey:_.MONITORING_S3_SECRET_ACCESS_KEY,monitoringS3Prefix:_.MONITORING_S3_PREFIX,duckdbExtensionDirectory:_.DUCKDB_EXTENSION_DIRECTORY||"/opt/duckdb/extensions",duckdbMemoryLimit:_.DUCKDB_MEMORY_LIMIT||void 0,duckdbThreads:ym("DUCKDB_THREADS",_.DUCKDB_THREADS),podName:_.POD_NAME||crypto.randomUUID(),dispatchRole:wW(H_(_.STUDIO_DISPATCH_ROLE,_.MESH_DISPATCH_ROLE)),agentSandboxEnabled:Z(_.STUDIO_AGENT_SANDBOX_ENABLED),sandboxStickyHeadRefEnabled:Z(_.SANDBOX_STICKY_HEAD_REF),taskBoardRerunReusesPrBranch:Im(_.TASK_BOARD_RERUN_REUSES_PR_BRANCH,!0),sandboxReleaseOnRunEndEnabled:Z(_.SANDBOX_RELEASE_ON_RUN_END),sandboxPrewarmOnThreadCreateEnabled:Z(_.SANDBOX_PREWARM_ON_THREAD_CREATE),sandboxPersistentHarnessEnabled:Z(_.SANDBOX_PERSISTENT_HARNESS),sandboxReleaseGraceMs:B("SANDBOX_RELEASE_GRACE_MS",_.SANDBOX_RELEASE_GRACE_MS,120000),decoSupabaseUrl:_.DECO_SUPABASE_URL,decoSupabaseServiceKey:_.DECO_SUPABASE_SERVICE_KEY,controlplaneRestUrl:_.CONTROLPLANE_REST_URL,controlplaneServiceToken:_.CONTROLPLANE_SERVICE_TOKEN,analyticsDataUrl:_.ANALYTICS_URL,analyticsMasterToken:_.ANALYTICS_MASTER_TOKEN,clickhouseAnalyticsUrl:_.CLICKHOUSE_ANALYTICS_ADDRESS,clickhouseAnalyticsUsername:_.CLICKHOUSE_ANALYTICS_USERNAME||"admin_monitor",clickhouseAnalyticsPassword:_.CLICKHOUSE_ANALYTICS_PASSWORD,customerLakeUrl:_.CUSTOMER_LAKE_URL,customerLakeAdminUsername:_.CUSTOMER_LAKE_ADMIN_USERNAME||"customer_lake_user_admin",customerLakeAdminPassword:_.CUSTOMER_LAKE_ADMIN_PASSWORD,customerLakeTenantSecret:_.CUSTOMER_LAKE_TENANT_SECRET,orderMonitorIngestUrl:_.ORDER_MONITOR_INGEST_URL,oneDollarStatsApiKey:_.ONEDOLLAR_BACKEND_API_KEY,reportsInternalApiUrl:H_(_.REPORTS_INTERNAL_API_URL,_.COMMERCE_DISCOVERY_INTERNAL_API_URL),reportsInternalApiKey:H_(_.REPORTS_INTERNAL_API_KEY,_.COMMERCE_DISCOVERY_INTERNAL_API_KEY),s3TenantBucket:_.S3_TENANT_BUCKET||"new-deco-sites-assets",s3TenantRegion:_.S3_TENANT_REGION||"us-west-2",s3TenantEndpoint:_.S3_TENANT_ENDPOINT,s3TenantPublicUrlBase:_.S3_TENANT_PUBLIC_URL_BASE||"https://assets.decocms.com",awsS3TenantRoleArn:_.AWS_S3_TENANT_ROLE_ARN,awsS3TenantProvisionerAccessKeyId:_.AWS_S3_TENANT_PROVISIONER_ACCESS_KEY_ID,awsS3TenantProvisionerSecretAccessKey:_.AWS_S3_TENANT_PROVISIONER_SECRET_ACCESS_KEY,deliveryR2AccountId:_.DELIVERY_R2_ACCOUNT_ID,deliveryR2AccessKeyId:_.DELIVERY_R2_ACCESS_KEY_ID,deliveryR2SecretAccessKey:_.DELIVERY_R2_SECRET_ACCESS_KEY,deliveryR2Bucket:_.DELIVERY_R2_BUCKET,deliveryR2Endpoint:_.DELIVERY_R2_ENDPOINT,deliveryPublicOrigin:_.DELIVERY_PUBLIC_ORIGIN,siteTokenSigningKey:_.DECO_SITE_TOKEN_SIGNING_KEY,cfDeliveryZoneId:_.CF_DELIVERY_ZONE_ID,cfPurgeApiToken:_.CF_PURGE_API_TOKEN};if(Boolean(K.natsUser)!==Boolean(K.natsPassword))throw Error("NATS_USER and NATS_PASSWORD must be set together");if(K.natsCredsPath&&K.natsUser)throw Error("Use either NATS_CREDS or NATS_USER/NATS_PASSWORD");if(K.plansEnabled&&!K.studioJwtSecret)throw Error("STUDIO_PLANS_ENABLED requires an explicit gateway JWT secret. Set STUDIO_JWT_SECRET (or its legacy alias MESH_JWT_SECRET) to the same value as the gateway's MESH_JWT_SECRET. Refusing to fall back to BETTER_AUTH_SECRET: that mismatch 401s every entitlements call, which every feature gate reads as 'no answer' and fails OPEN.");if(K.plansEnabled&&!K.studioProvisionSecretKey)throw Error("STUDIO_PLANS_ENABLED requires STUDIO_PROVISION_SECRET_KEY, set to the same value as the gateway's STUDIO_PROVISION_KEY. Without it the gateway cannot identify this server, falls back to a per-user membership callback that 401s for any user who never completed the gateway OAuth flow, and every feature gate then fails OPEN.");if(K.plansEnabled&&!K.aiGatewayEnabled)throw Error("STUDIO_PLANS_ENABLED requires DECO_AI_GATEWAY_ENABLED=true. Plans are read from the gateway; with it disabled there is no adapter to ask, so every feature gate fails OPEN on both server and client and the paid product is free fleet-wide.");if(K.plansEnabled&&Object.keys(K.stripePlanPriceIds).length>0&&!K.aiGatewayAdminToken)throw Error("STRIPE_PLAN_PRICE_IDS is set but DECO_AI_GATEWAY_ADMIN_TOKEN is not. The Stripe webhook places the paid tier through the gateway's admin API, so without the token a customer is charged and the entitlement "+"is never granted \u2014 and AI_PLAN_SET cannot repair it, it accepts only "+"'free'.");if(K.plansEnabled&&Object.keys(K.stripePlanPriceIds).length>1&&!K.stripePortalConfigurationId)console.warn("STRIPE_PLAN_PRICE_IDS maps more than one plan but STRIPE_PORTAL_CONFIGURATION_ID is unset. An org that already has a subscription cannot change tier: the account's default portal configuration lists only the legacy plans, not the tiers, so Stripe refuses the update flow. First-time checkout is unaffected.");return K}var qW=null;function K_(){return qW??=Object.freeze(Pz(process.env))}import{createContextKey as aW,metrics as rW,propagation as D8,ROOT_CONTEXT as H8,SpanStatusCode as M8,trace as lW}from"@opentelemetry/api";import{logs as eW,SeverityNumber as Vm}from"@opentelemetry/api-logs";import{OTLPLogExporter as G8}from"@opentelemetry/exporter-logs-otlp-proto";import{PrometheusExporter as dW}from"@opentelemetry/exporter-prometheus";import{OTLPTraceExporter as f8}from"@opentelemetry/exporter-trace-otlp-proto";import{RuntimeNodeInstrumentation as I8}from"@opentelemetry/instrumentation-runtime-node";import{context as Z5,propagation as W5,SpanKind as j5,SpanStatusCode as L5}from"@opentelemetry/api";var Y5=globalThis.fetch;import{ExportResultCode as y5}from"@opentelemetry/core";import{ExportResultCode as mx}from"@opentelemetry/core";import{mkdir as iW,rename as cW,writeFile as hW}from"fs/promises";import{join as Tx}from"path";class zx{bufferItems=[];bufferBytes=0;flushTimer=null;flushQueue=Promise.resolve();basePath;flushThreshold;maxBufferBytes;isShutdown=!1;knownDirs=new Set;partitionKey;constructor(_){this.basePath=_.basePath,this.flushThreshold=_.flushThreshold??1000,this.maxBufferBytes=_.maxBufferBytes??10485760,this.partitionKey=_.partitionKey;let x=_.flushIntervalMs??60000;if(x>0&&x<3600000){if(this.flushTimer=setInterval(()=>{this.flush().catch((u)=>{console.error("[NDJSONExporter] Timer flush failed:",u)})},x),this.flushTimer&&typeof this.flushTimer==="object"&&"unref"in this.flushTimer)this.flushTimer.unref()}}exportRows(_){if(this.isShutdown)return Promise.resolve({code:mx.FAILED});for(let x of _){let u=JSON.stringify(x),N=this.partitionKey?this.partitionKey(x):"";this.bufferItems.push({partition:N,json:u}),this.bufferBytes+=Buffer.byteLength(u,"utf8")+1}if(this.bufferItems.length>=this.flushThreshold||this.bufferBytes>=this.maxBufferBytes)return this.flush().then(()=>({code:mx.SUCCESS})).catch((x)=>{return console.error("[NDJSONExporter] Flush failed:",x),{code:mx.FAILED}});return Promise.resolve({code:mx.SUCCESS})}async shutdown(){if(this.isShutdown=!0,this.flushTimer)clearInterval(this.flushTimer),this.flushTimer=null;try{await this.flushQueue}catch{}if(this.bufferItems.length>0)await this.flush()}async forceFlush(){try{await this.flushQueue}catch{}if(this.bufferItems.length>0)await this.flush()}flush(){let x=this.flushQueue.catch(()=>{}).then(()=>this.doFlush());return this.flushQueue=x,x}async doFlush(){if(this.bufferItems.length===0)return;let _=this.bufferItems;this.bufferItems=[],this.bufferBytes=0;let x=new Map;for(let K of _){let m=x.get(K.partition);if(!m)m=[],x.set(K.partition,m);m.push(K.json)}let u=await Promise.allSettled(Array.from(x.entries()).map(([K,m])=>this.writeNDJSON(m,K).then(()=>K))),N=u.find((K)=>K.status==="rejected");if(N){let K=new Set;for(let T of u)if(T.status==="fulfilled")K.add(T.value);let m=_.filter((T)=>!K.has(T.partition));this.bufferItems=m.concat(this.bufferItems),this.bufferBytes=0;for(let T of this.bufferItems)this.bufferBytes+=Buffer.byteLength(T.json,"utf8")+1;throw N.reason}}async writeNDJSON(_,x){let u=new Date,N=[String(u.getUTCFullYear()),String(u.getUTCMonth()+1).padStart(2,"0"),String(u.getUTCDate()).padStart(2,"0"),String(u.getUTCHours()).padStart(2,"0")],K=x?Tx(this.basePath,x,...N):Tx(this.basePath,...N);if(!this.knownDirs.has(K))await iW(K,{recursive:!0,mode:448}),this.knownDirs.add(K);let m=`${crypto.randomUUID()}.ndjson`,T=Tx(K,`.${m}.tmp`),z=Tx(K,m),E=_.join(`
 `)+`
 `;await hW(T,E,{mode:384}),await cW(T,z)}}import{ExportResultCode as v5}from"@opentelemetry/core";import{AggregationTemporality as g5,DataPointType as q5}from"@opentelemetry/sdk-metrics";import{ExportResultCode as a5}from"@opentelemetry/core";var d5=Buffer.byteLength("... [TRUNCATED]","utf8");import{BatchLogRecordProcessor as q8,LoggerProvider as i8}from"@opentelemetry/sdk-logs";import{detectResources as h8,envDetector as t8,hostDetector as o8,osDetector as a8,processDetector as r8,resourceFromAttributes as l8}from"@opentelemetry/resources";import{PeriodicExportingMetricReader as d8}from"@opentelemetry/sdk-metrics";import{NOOP_LOGGER as _8}from"@opentelemetry/api-logs";import{NodeSDK as _3}from"@opentelemetry/sdk-node";import{BatchSpanProcessor as u3,SamplingDecision as N_}from"@opentelemetry/sdk-trace-base";import{SpanStatusCode as N8}from"@opentelemetry/api";var bW="__d",sW=aW("Current request"),_9=1;var Xz=(_)=>{let u=new URL(_.url).searchParams.get(bW);if(u==="")return crypto.randomUUID();if(!u)u=_.headers.get("x-trace-debug-id");return u};class Zz{inner;constructor(_){this.inner=_}shouldSample(_,x,u,N,K,m){let T=_.getValue(sW);if(!T){if(this.inner)return this.inner.shouldSample(_,x,u,N,K,m);return{decision:N_.RECORD_AND_SAMPLED}}let z=Xz(T);if(z)return{decision:N_.RECORD_AND_SAMPLED,attributes:{"trace.debug.id":z}};if(this.inner){let E=this.inner.shouldSample(_,x,u,N,K,m);if(E.decision===N_.RECORD_AND_SAMPLED){let $=crypto.randomUUID();E.attributes={...E.attributes??{},"trace.debug.id":$}}return E}return{decision:N_.NOT_RECORD}}toString(){return"DebugSampler"}}class Wz{ratio;constructor(_){this.ratio=_}shouldSample(){if(Math.random()<this.ratio)return{decision:N_.RECORD_AND_SAMPLED};return{decision:N_.NOT_RECORD}}toString(){return`RatioSampler(${this.ratio})`}}var K3=new dW({preventServerStart:!0}),N3=new Zz(new Wz(_9));var Qz=lW.getTracer("studio","1.0.0"),M_=rW.getMeter("studio","1.0.0"),x9=eW.getLogger("studio","1.0.0"),wm=(_,x,u)=>{let N={},K=u,m=u[u.length-1];if(m!==null&&typeof m==="object"&&!Array.isArray(m)&&!(m instanceof Error)&&Object.getPrototypeOf(m)===Object.prototype)N=m,K=u.slice(0,-1);let T=K.map((z)=>{if(z instanceof Error)return`${z.name}: ${z.message}`;if(typeof z==="object")try{return JSON.stringify(z)}catch{return"[Object]"}return String(z)}).join(" ");x9.emit({severityNumber:_,severityText:x,body:T,attributes:{"log.source":"console",...N}})},km={error:console.error.bind(console),warn:console.warn.bind(console),debug:console.debug.bind(console)};console.error=(..._)=>{wm(Vm.ERROR,"ERROR",_),km.error(..._)};console.warn=(..._)=>{wm(Vm.WARN,"WARN",_),km.warn(..._)};console.debug=(..._)=>{wm(Vm.DEBUG,"DEBUG",_),km.debug(..._)};var nm,jz=0,vm=500;function u9(){if(nm)return;let _=performance.now()+vm;nm=setInterval(()=>{let x=performance.now();jz=Math.max(0,x-_),_=x+vm},vm),nm.unref?.()}function Lz(){return u9(),jz}var K9=()=>M_.createHistogram("db.query.duration",{description:"Database query execution duration in milliseconds",unit:"ms"}),Fz=()=>M_.createHistogram("db.pool.acquire.duration",{description:"Time spent waiting to acquire a connection from the pool",unit:"ms"}),Yz=400,N9=100,m9=(_)=>({"db.status":_.level==="error"?"error":"success"}),T9=(_)=>(x)=>{let u=m9(x);if(x.queryDurationMillis>Yz){let N=Lz(),K=N>Yz/2;console.error(K?"Slow query measurement \u2014 likely event-loop lag, not slow SQL:":"Slow query detected:",{durationMs:x.queryDurationMillis,eventLoopLagMs:Math.round(N),sql:x.query.sql,pool:{total:_.totalCount,idle:_.idleCount,waiting:_.waitingCount,max:Ex()}})}if(K9().record(x.queryDurationMillis,u),x.level==="error")console.error("Query failed:",{durationMs:x.queryDurationMillis,error:x.error,sql:x.query.sql})};function z9(_){let x=_.connect.bind(_);return _.connect=(u)=>{if(typeof u==="function")return x(u);let N=performance.now(),K=Ex(),m=_.idleCount===0&&_.totalCount>=K,T=_.idleCount;return x().then((z)=>{let E=performance.now()-N;if(Fz().record(E,{"db.pool.outcome":m?"contended":"available"}),E>N9)if(m)console.error("Slow db pool acquire \u2014 pool saturated:",{waitMs:E,total:_.totalCount,idle:_.idleCount,waiting:_.waitingCount,max:K});else console.warn("Slow db pool acquire \u2014 event-loop lag (not pool):",{waitMs:E,idleAtStart:T,total:_.totalCount,max:K});return z},(z)=>{throw Fz().record(performance.now()-N,{"db.pool.outcome":"error"}),z})},_}var Mz={keepAlive:!0,keepAliveInitialDelayMillis:1e4,idleTimeoutMillis:300000,connectionTimeoutMillis:30000,allowExitOnIdle:!0};function Rz(){try{return K_().databasePgSsl}catch{return!1}}function Ex(){try{return K_().databasePoolMax}catch{return 10}}function E9(_){let x=z9(new Hz({connectionString:_,max:Ex(),ssl:Rz(),...Mz})),u=new Dz({pool:x});return{type:"postgres",db:new C9({dialect:u,log:T9(x)}),pool:x}}function B_(){return K_().databaseUrl}function Bz(_){let x=_||B_();return new Dz({pool:new Hz({connectionString:x,max:Ex(),ssl:Rz(),...Mz})})}function $9(_){let x=_||B_();return E9(x)}async function Gz(_){if(await _.db.destroy(),!_.pool.ended)await _.pool.end();if(_===R_)R_=null}var R_=null;function pm(){if(!R_)R_=$9(B_());return R_}async function Oz(_){let u={database:Bz(_||B_()),plugins:[P9({dynamicAccessControl:{enabled:!0,enableCustomResources:!0}}),Q9(),X9(),Z9(),L9(),j9({loginPage:"/login"}),J9(),W9({sendMagicLink:async()=>{}}),F9({sendVerificationOTP:async()=>{}})]},{toBeAdded:N,toBeCreated:K,runMigrations:m}=await U9(u);if(!N.length&&!K.length)return"up to date";return await m(),`${K.length+N.length} table(s) migrated`}async function gm(_,x){return(await o`
     SELECT table_name FROM information_schema.tables