@studio-foundation/api 0.3.0-beta.1

package/dist/user-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-store.js","sourceRoot":"","sources":["../src/user-store.ts"],"names":[],"mappings":"AAAA,wBAAwB;AACxB,2DAA2D;AAC3D,4DAA4D;AAC5D,gEAAgE;AAEhE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAiB5C,MAAM,OAAO,SAAS;IACZ,EAAE,CAAoC;IAE9C,YAAY,MAAc;QACxB,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,QAAQ,CAAC,gBAAgB,CAA4D,CAAC;QACvG,IAAI,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACrC,IAAI,CAAC,UAAU,EAAE,CAAC;IACpB,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;KAgBZ,CAAC,CAAC;IACL,CAAC;IAED,eAAe,CAAC,MAAc;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,0EAA0E,CAAC;aACnF,GAAG,CAAC,MAAM,CAAqB,CAAC;QACnC,OAAO,GAAG,IAAI,IAAI,CAAC;IACrB,CAAC;IAED,WAAW,CAAC,EAAU;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,qEAAqE,CAAC;aAC9E,GAAG,CAAC,EAAE,CAAqB,CAAC;QAC/B,OAAO,GAAG,IAAI,IAAI,CAAC;IACrB,CAAC;IAED,cAAc,CAAC,KAAa;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,wEAAwE,CAAC;aACjF,GAAG,CAAC,KAAK,CAAqB,CAAC;QAClC,OAAO,GAAG,IAAI,IAAI,CAAC;IACrB,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,EAAE;aACX,OAAO,CAAC,gFAAgF,CAAC;aACzF,GAAG,EAAY,CAAC;IACrB,CAAC;IAED,QAAQ,CAAC,IAAU;QACjB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;;;;;;KAQf,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACxE,CAAC;IAED,UAAU,CAAC,EAAU;QACnB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,aAAa,CAAC,MAAc,EAAE,IAAY;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,yFAAyF,CAAC;aAClG,GAAG,CAAC,MAAM,EAAE,IAAI,CAA2B,CAAC;QAC/C,OAAO,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;IACzE,CAAC;IAED,aAAa,CAAC,MAAc,EAAE,IAAY;QACxC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;;;KAKf,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,eAAe,CAAC,MAAc,EAAE,IAAY,EAAE,MAAc;QAC1D,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;;;KAKf,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK;QACH,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC;CACF"}

package/dist/utils/repo-resolver.d.ts

@@ -0,0 +1,3 @@
+export { resolveRepoPath, cloneRepo } from '@studio-foundation/engine';
+export type { RepoResolveOptions } from '@studio-foundation/engine';
+//# sourceMappingURL=repo-resolver.d.ts.map

package/dist/utils/repo-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-resolver.d.ts","sourceRoot":"","sources":["../../src/utils/repo-resolver.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACvE,YAAY,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/utils/repo-resolver.js

@@ -0,0 +1,3 @@
+// Re-exported from @studio/engine — implementation lives there
+export { resolveRepoPath, cloneRepo } from '@studio-foundation/engine';
+//# sourceMappingURL=repo-resolver.js.map

package/dist/utils/repo-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-resolver.js","sourceRoot":"","sources":["../../src/utils/repo-resolver.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/webhook-dispatcher.d.ts

@@ -0,0 +1,13 @@
+import type { SseEventType } from './event-bus.js';
+import type { WebhookStore } from './webhook-store.js';
+export type WebhookEventType = 'pipeline_start' | 'pipeline_complete' | 'stage_complete' | 'stage_rejected' | 'stage_failed' | 'group_feedback';
+export declare class WebhookDispatcher {
+    private readonly store;
+    private readonly projectName;
+    private readonly fetcher;
+    constructor(store: WebhookStore, projectName: string, fetcher?: typeof fetch);
+    handleBusEvent(runId: string, sseType: SseEventType, data: unknown): Promise<void>;
+    private dispatch;
+    private handleFailure;
+}
+//# sourceMappingURL=webhook-dispatcher.d.ts.map

package/dist/webhook-dispatcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-dispatcher.d.ts","sourceRoot":"","sources":["../src/webhook-dispatcher.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,MAAM,gBAAgB,GACxB,gBAAgB,GAChB,mBAAmB,GACnB,gBAAgB,GAChB,gBAAgB,GAChB,cAAc,GACd,gBAAgB,CAAC;AA8BrB,qBAAa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAFP,KAAK,EAAE,YAAY,EACnB,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,OAAO,KAAa;IAG1C,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;YAa1E,QAAQ;IAwDtB,OAAO,CAAC,aAAa;CAsBtB"}

package/dist/webhook-dispatcher.js

@@ -0,0 +1,108 @@
+// WebhookDispatcher — listens to pipeline events and delivers them to registered webhooks
+// Handles HMAC-SHA256 signing, retry logic (30s / 5min / 15min), and failure tracking
+import { createHmac, randomUUID } from 'node:crypto';
+// Retry delays in ms: attempt 1 failed → 30s, attempt 2 failed → 5min, attempt 3 failed → 15min
+const RETRY_DELAYS = [30_000, 5 * 60_000, 15 * 60_000];
+function mapToWebhookEvent(sseType, data) {
+    switch (sseType) {
+        case 'pipeline_start':
+            return 'pipeline_start';
+        case 'pipeline_complete':
+            return 'pipeline_complete';
+        case 'stage_complete': {
+            const status = data.status;
+            if (status === 'rejected')
+                return 'stage_rejected';
+            if (status === 'failed')
+                return 'stage_failed';
+            return 'stage_complete';
+        }
+        case 'group_feedback':
+            return 'group_feedback';
+        default:
+            return null;
+    }
+}
+function sign(body, secret) {
+    const hmac = createHmac('sha256', secret);
+    hmac.update(body, 'utf-8');
+    return `sha256=${hmac.digest('hex')}`;
+}
+export class WebhookDispatcher {
+    store;
+    projectName;
+    fetcher;
+    constructor(store, projectName, fetcher = fetch) {
+        this.store = store;
+        this.projectName = projectName;
+        this.fetcher = fetcher;
+    }
+    async handleBusEvent(runId, sseType, data) {
+        const webhookEvent = mapToWebhookEvent(sseType, data);
+        if (!webhookEvent)
+            return;
+        const webhooks = this.store.listWebhooks().filter(w => w.status === 'active' && w.events.includes(webhookEvent));
+        await Promise.all(webhooks.map(webhook => this.dispatch(webhook.id, webhookEvent, runId, data, 1)));
+    }
+    async dispatch(webhookId, event, runId, sourceData, attempt) {
+        const webhook = this.store.getWebhook(webhookId);
+        if (!webhook || webhook.status === 'failed')
+            return;
+        const payload = {
+            event,
+            run_id: runId,
+            project: this.projectName,
+            ts: new Date().toISOString(),
+            ...sourceData,
+        };
+        const body = JSON.stringify(payload);
+        const headers = {
+            'Content-Type': 'application/json',
+            'X-Studio-Event': event,
+        };
+        if (webhook.secret) {
+            headers['X-Studio-Signature'] = sign(body, webhook.secret);
+        }
+        const deliveryId = randomUUID();
+        this.store.saveDelivery({
+            id: deliveryId,
+            webhook_id: webhookId,
+            event,
+            run_id: runId,
+            status: 'pending',
+            attempt,
+            created_at: new Date().toISOString(),
+        });
+        try {
+            const response = await this.fetcher(webhook.url, {
+                method: 'POST',
+                headers,
+                body,
+                signal: AbortSignal.timeout(10_000),
+            });
+            if (response.ok) {
+                this.store.updateDelivery(deliveryId, 'success');
+            }
+            else {
+                this.handleFailure(webhookId, event, runId, sourceData, attempt, deliveryId);
+            }
+        }
+        catch {
+            this.handleFailure(webhookId, event, runId, sourceData, attempt, deliveryId);
+        }
+    }
+    handleFailure(webhookId, event, runId, sourceData, attempt, deliveryId) {
+        const maxAttempts = RETRY_DELAYS.length + 1; // 4 total (1 original + 3 retries)
+        if (attempt >= maxAttempts) {
+            this.store.updateDelivery(deliveryId, 'failed');
+            this.store.markWebhookFailed(webhookId);
+            return;
+        }
+        this.store.updateDelivery(deliveryId, 'retrying');
+        const delay = RETRY_DELAYS[attempt - 1];
+        setTimeout(() => {
+            void this.dispatch(webhookId, event, runId, sourceData, attempt + 1);
+        }, delay);
+    }
+}
+//# sourceMappingURL=webhook-dispatcher.js.map

package/dist/webhook-dispatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-dispatcher.js","sourceRoot":"","sources":["../src/webhook-dispatcher.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,sFAAsF;AAEtF,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAYrD,gGAAgG;AAChG,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC;AAEvD,SAAS,iBAAiB,CAAC,OAAqB,EAAE,IAAa;IAC7D,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,gBAAgB;YACnB,OAAO,gBAAgB,CAAC;QAC1B,KAAK,mBAAmB;YACtB,OAAO,mBAAmB,CAAC;QAC7B,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,MAAM,GAAI,IAA4B,CAAC,MAAM,CAAC;YACpD,IAAI,MAAM,KAAK,UAAU;gBAAE,OAAO,gBAAgB,CAAC;YACnD,IAAI,MAAM,KAAK,QAAQ;gBAAE,OAAO,cAAc,CAAC;YAC/C,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QACD,KAAK,gBAAgB;YACnB,OAAO,gBAAgB,CAAC;QAC1B;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,MAAc;IACxC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3B,OAAO,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,OAAO,iBAAiB;IAET;IACA;IACA;IAHnB,YACmB,KAAmB,EACnB,WAAmB,EACnB,UAAwB,KAAK;QAF7B,UAAK,GAAL,KAAK,CAAc;QACnB,gBAAW,GAAX,WAAW,CAAQ;QACnB,YAAO,GAAP,OAAO,CAAsB;IAC7C,CAAC;IAEJ,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,OAAqB,EAAE,IAAa;QACtE,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,YAAY;YAAE,OAAO;QAE1B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,MAAM,CAC/C,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAC9D,CAAC;QAEF,MAAM,OAAO,CAAC,GAAG,CACf,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CACjF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,SAAiB,EACjB,KAAuB,EACvB,KAAa,EACb,UAAmB,EACnB,OAAe;QAEf,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO;QAEpD,MAAM,OAAO,GAAG;YACd,KAAK;YACL,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,IAAI,CAAC,WAAW;YACzB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,GAAI,UAAqB;SAC1B,CAAC;QAEF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,gBAAgB,EAAE,KAAK;SACxB,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;YACtB,EAAE,EAAE,UAAU;YACd,UAAU,EAAE,SAAS;YACrB,KAAK;YACL,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,SAAS;YACjB,OAAO;YACP,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACrC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC/C,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI;gBACJ,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;YACnD,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IAEO,aAAa,CACnB,SAAiB,EACjB,KAAuB,EACvB,KAAa,EACb,UAAmB,EACnB,OAAe,EACf,UAAkB;QAElB,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,mCAAmC;QAEhF,IAAI,OAAO,IAAI,WAAW,EAAE,CAAC;YAC3B,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAChD,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QACxC,UAAU,CAAC,GAAG,EAAE;YACd,KAAK,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;QACvE,CAAC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC;CACF"}

package/dist/webhook-store.d.ts

@@ -0,0 +1,31 @@
+export interface WebhookRegistration {
+    id: string;
+    url: string;
+    events: string[];
+    secret?: string;
+    status: 'active' | 'failed';
+    created_at: string;
+}
+export interface WebhookDelivery {
+    id: string;
+    webhook_id: string;
+    event: string;
+    run_id: string;
+    status: 'pending' | 'retrying' | 'success' | 'failed';
+    attempt: number;
+    created_at: string;
+}
+export declare class WebhookStore {
+    private db;
+    constructor(dbPath: string);
+    private initSchema;
+    saveWebhook(webhook: WebhookRegistration): void;
+    getWebhook(id: string): WebhookRegistration | null;
+    listWebhooks(): WebhookRegistration[];
+    deleteWebhook(id: string): boolean;
+    markWebhookFailed(id: string): void;
+    saveDelivery(delivery: WebhookDelivery): void;
+    updateDelivery(id: string, status: WebhookDelivery['status']): void;
+    close(): void;
+}
+//# sourceMappingURL=webhook-store.d.ts.map

package/dist/webhook-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-store.d.ts","sourceRoot":"","sources":["../src/webhook-store.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,EAAE,CAAoC;gBAElC,MAAM,EAAE,MAAM;IAQ1B,OAAO,CAAC,UAAU;IAwBlB,WAAW,CAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI;IAmB/C,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI;IAgBlD,YAAY,IAAI,mBAAmB,EAAE;IAerC,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAKlC,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAInC,YAAY,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI;IAe7C,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC,GAAG,IAAI;IAInE,KAAK,IAAI,IAAI;CAGd"}

package/dist/webhook-store.js

@@ -0,0 +1,91 @@
+// WebhookStore — SQLite persistence for webhook registrations and deliveries
+// Uses the same DB file as the run store (.studio/runs/runs.db)
+import { createRequire } from 'node:module';
+export class WebhookStore {
+    db;
+    constructor(dbPath) {
+        const _require = createRequire(import.meta.url);
+        const Database = _require('better-sqlite3');
+        this.db = new Database(dbPath);
+        this.db.pragma('journal_mode = WAL');
+        this.initSchema();
+    }
+    initSchema() {
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS webhooks (
+        id TEXT PRIMARY KEY,
+        url TEXT NOT NULL,
+        events TEXT NOT NULL,
+        secret TEXT,
+        status TEXT NOT NULL DEFAULT 'active',
+        created_at TEXT NOT NULL
+      );
+
+      CREATE TABLE IF NOT EXISTS webhook_deliveries (
+        id TEXT PRIMARY KEY,
+        webhook_id TEXT NOT NULL,
+        event TEXT NOT NULL,
+        run_id TEXT NOT NULL,
+        status TEXT NOT NULL,
+        attempt INTEGER NOT NULL,
+        created_at TEXT NOT NULL,
+        FOREIGN KEY (webhook_id) REFERENCES webhooks(id)
+      );
+    `);
+    }
+    saveWebhook(webhook) {
+        this.db.prepare(`
+      INSERT INTO webhooks (id, url, events, secret, status, created_at)
+      VALUES (?, ?, ?, ?, ?, ?)
+      ON CONFLICT(id) DO UPDATE SET
+        url = excluded.url,
+        events = excluded.events,
+        secret = excluded.secret,
+        status = excluded.status
+    `).run(webhook.id, webhook.url, JSON.stringify(webhook.events), webhook.secret ?? null, webhook.status, webhook.created_at);
+    }
+    getWebhook(id) {
+        const row = this.db.prepare('SELECT id, url, events, secret, status, created_at FROM webhooks WHERE id = ?').get(id);
+        if (!row)
+            return null;
+        return {
+            id: row.id,
+            url: row.url,
+            events: JSON.parse(row.events),
+            ...(row.secret != null ? { secret: row.secret } : {}),
+            status: row.status,
+            created_at: row.created_at,
+        };
+    }
+    listWebhooks() {
+        const rows = this.db.prepare('SELECT id, url, events, secret, status, created_at FROM webhooks ORDER BY created_at DESC').all();
+        return rows.map(row => ({
+            id: row.id,
+            url: row.url,
+            events: JSON.parse(row.events),
+            ...(row.secret != null ? { secret: row.secret } : {}),
+            status: row.status,
+            created_at: row.created_at,
+        }));
+    }
+    deleteWebhook(id) {
+        const result = this.db.prepare('DELETE FROM webhooks WHERE id = ?').run(id);
+        return result.changes > 0;
+    }
+    markWebhookFailed(id) {
+        this.db.prepare("UPDATE webhooks SET status = 'failed' WHERE id = ?").run(id);
+    }
+    saveDelivery(delivery) {
+        this.db.prepare(`
+      INSERT INTO webhook_deliveries (id, webhook_id, event, run_id, status, attempt, created_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?)
+    `).run(delivery.id, delivery.webhook_id, delivery.event, delivery.run_id, delivery.status, delivery.attempt, delivery.created_at);
+    }
+    updateDelivery(id, status) {
+        this.db.prepare('UPDATE webhook_deliveries SET status = ? WHERE id = ?').run(status, id);
+    }
+    close() {
+        this.db.close();
+    }
+}
+//# sourceMappingURL=webhook-store.js.map

package/dist/webhook-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-store.js","sourceRoot":"","sources":["../src/webhook-store.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,gEAAgE;AAEhE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAqB5C,MAAM,OAAO,YAAY;IACf,EAAE,CAAoC;IAE9C,YAAY,MAAc;QACxB,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,QAAQ,CAAC,gBAAgB,CAA4D,CAAC;QACvG,IAAI,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACrC,IAAI,CAAC,UAAU,EAAE,CAAC;IACpB,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;KAoBZ,CAAC,CAAC;IACL,CAAC;IAED,WAAW,CAAC,OAA4B;QACtC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;;;;;;KAQf,CAAC,CAAC,GAAG,CACJ,OAAO,CAAC,EAAE,EACV,OAAO,CAAC,GAAG,EACX,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAC9B,OAAO,CAAC,MAAM,IAAI,IAAI,EACtB,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,UAAU,CACnB,CAAC;IACJ,CAAC;IAED,UAAU,CAAC,EAAU;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CACzB,+EAA+E,CAChF,CAAC,GAAG,CAAC,EAAE,CAAuH,CAAC;QAEhI,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAa;YAC1C,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,MAAM,EAAE,GAAG,CAAC,MAA6B;YACzC,UAAU,EAAE,GAAG,CAAC,UAAU;SAC3B,CAAC;IACJ,CAAC;IAED,YAAY;QACV,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAC1B,2FAA2F,CAC5F,CAAC,GAAG,EAAmH,CAAC;QAEzH,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACtB,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAa;YAC1C,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,MAAM,EAAE,GAAG,CAAC,MAA6B;YACzC,UAAU,EAAE,GAAG,CAAC,UAAU;SAC3B,CAAC,CAAC,CAAC;IACN,CAAC;IAED,aAAa,CAAC,EAAU;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5E,OAAO,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,iBAAiB,CAAC,EAAU;QAC1B,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,oDAAoD,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,YAAY,CAAC,QAAyB;QACpC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;KAGf,CAAC,CAAC,GAAG,CACJ,QAAQ,CAAC,EAAE,EACX,QAAQ,CAAC,UAAU,EACnB,QAAQ,CAAC,KAAK,EACd,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,UAAU,CACpB,CAAC;IACJ,CAAC;IAED,cAAc,CAAC,EAAU,EAAE,MAAiC;QAC1D,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,uDAAuD,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,KAAK;QACH,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC;CACF"}

package/package.json

@@ -0,0 +1,59 @@
+{
+  "name": "@studio-foundation/api",
+  "version": "0.3.0-beta.1",
+  "description": "HTTP API for Studio v7",
+  "type": "module",
+  "main": "./dist/api.js",
+  "types": "./dist/api.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/api.js",
+      "types": "./dist/api.d.ts"
+    },
+    "./standalone": {
+      "import": "./dist/index.js"
+    },
+    "./user-store": {
+      "import": "./dist/user-store.js",
+      "types": "./dist/user-store.d.ts"
+    }
+  },
+  "bin": {
+    "studio-api": "./dist/index.js"
+  },
+  "keywords": [
+    "studio",
+    "api"
+  ],
+  "author": "Ariane Guay",
+  "license": "AGPL-3.0-only",
+  "dependencies": {
+    "@fastify/cors": "^10.0.2",
+    "@fastify/rate-limit": "^10.3.0",
+    "@fastify/swagger": "^9.7.0",
+    "@fastify/swagger-ui": "^5.2.5",
+    "better-sqlite3": "^9.0.0",
+    "fastify": "^5.3.2",
+    "js-yaml": "^4.1.1",
+    "pg": "^8.19.0",
+    "@studio-foundation/contracts": "0.3.0-beta.1",
+    "@studio-foundation/engine": "0.3.0-beta.1",
+    "@studio-foundation/runner": "0.3.0-beta.1"
+  },
+  "devDependencies": {
+    "@types/better-sqlite3": "^7.6.8",
+    "@types/js-yaml": "^4.0.9",
+    "@types/node": "^25.2.3",
+    "@types/pg": "^8.18.0",
+    "typescript": "^5.3.0",
+    "vitest": "^4.0.18"
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "clean": "rm -rf dist",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  }
+}

package/src/api.ts

@@ -0,0 +1,8 @@
+// Named exports for programmatic use (CLI, tests)
+export { bootstrap } from './bootstrap.js';
+export { buildServer } from './server.js';
+export type { ServerDeps, ApiConfig } from './server.js';
+export type { RunLauncher, LaunchConfig } from './launcher.js';
+export { InProcessLauncher, generateRunId } from './launcher.js';
+export { cloneRepo, resolveRepoPath } from './utils/repo-resolver.js';
+export type { RepoResolveOptions } from './utils/repo-resolver.js';

package/src/bootstrap.ts

@@ -0,0 +1,259 @@
+// Bootstrap — finds .studio/, loads config, creates engine + store + launcher
+// Same pattern as CLI but without terminal output
+
+import { resolve, join, dirname } from 'node:path';
+import { access, readFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import yaml from 'js-yaml';
+import {
+  type EngineConfig,
+  SQLiteRunStore,
+  InMemoryRunStore,
+  PgRunStore,
+  type AnyRunStore,
+} from '@studio-foundation/engine';
+import {
+  createDefaultRegistry,
+  ToolRegistry,
+  loadProjectTools,
+  loadPlugins,
+  loadProjectIntegrations,
+  MCPClient,
+  type SkillContent,
+} from '@studio-foundation/runner';
+import { InProcessLauncher, type RunLauncher } from './launcher.js';
+import { RunEventBus } from './event-bus.js';
+import type { MaskedConfig } from './server.js';
+import { WebhookStore } from './webhook-store.js';
+import { WebhookDispatcher } from './webhook-dispatcher.js';
+import { IntegrationStore } from './integration-store.js';
+import { IntegrationRuntime } from './integration-runtime.js';
+import { HttpApiSpawner } from './spawners/http-api-spawner.js';
+import { resolvePlans, type PlansConfig } from './plans.js';
+import { UserStore } from './user-store.js';
+import { PgUserStore } from './user-store-pg.js';
+
+export interface StudioApiConfig {
+  providers?: {
+    openai?: { apiKey: string };
+    anthropic?: { apiKey: string };
+    ollama?: { baseUrl?: string };   // ADD THIS
+  };
+  paths?: { projects_dir?: string };
+  defaults?: { provider?: string; model?: string };
+  api?: { key?: string; port?: number };
+  integrations?: Record<string, Record<string, unknown>>;
+  db?: {
+    type?: 'sqlite' | 'postgres' | 'inmemory';
+    url?: string;
+  };
+  plans?: Record<string, {
+    runs_per_day?: number;
+    max_concurrent?: number;
+    max_tokens_per_run?: number;
+    rate_limit_per_minute?: number;
+  }>;
+}
+
+export interface BootstrapResult {
+  store: AnyRunStore;
+  launcher: RunLauncher;
+  configsDir: string;
+  /** Raw projects_dir from config (may contain ~). Used by route handlers for repo cloning. */
+  projectsDir?: string;
+  projectName: string;
+  apiConfig: { key?: string; port?: number };
+  cleanup: () => Promise<void>;
+  studioVersion: string;
+  maskedConfig: MaskedConfig;
+  webhookStore: WebhookStore;
+  integrationStore: IntegrationStore;
+  integrationRuntime: IntegrationRuntime;
+  userStore: UserStore | PgUserStore;
+  plans: PlansConfig;
+}
+
+async function findStudioDir(startDir: string): Promise<string | null> {
+  let current = resolve(startDir);
+  while (true) {
+    const candidate = join(current, '.studio');
+    try {
+      await access(candidate);
+      return candidate;
+    } catch {
+      // not here, go up
+    }
+    const parent = dirname(current);
+    if (parent === current) return null;
+    current = parent;
+  }
+}
+
+export async function bootstrap(cwd: string = process.cwd()): Promise<BootstrapResult> {
+  const studioDir = await findStudioDir(cwd);
+  if (!studioDir) {
+    throw new Error(`No .studio/ directory found from ${cwd}. Run 'studio init' first.`);
+  }
+
+  // Load config
+  let config: StudioApiConfig = {};
+  try {
+    const raw = await readFile(join(studioDir, 'config.yaml'), 'utf-8');
+    // Resolve env vars
+    const resolved = raw.replace(/\$\{([^}]+)\}/g, (_m: string, v: string) => process.env[v.trim()] ?? '');
+    config = (yaml.load(resolved) as StudioApiConfig) ?? {};
+  } catch {
+    // No config.yaml — use defaults
+  }
+
+  // Read studio version from api/package.json
+  const pkgPath = fileURLToPath(new URL('../package.json', import.meta.url));
+  const pkgRaw = await readFile(pkgPath, 'utf-8');
+  const studioVersion = (JSON.parse(pkgRaw) as { version: string }).version;
+
+  // Build masked config — provider names only, no API keys
+  const maskedConfig = {
+    defaults: config.defaults,
+    providers: Object.keys(config.providers ?? {}),
+  };
+
+  const runsDir = join(studioDir, 'runs');
+
+  const dbType = config.db?.type ?? 'sqlite';
+
+  // WebhookStore and IntegrationStore are always SQLite — they are separate from RunStore
+  const dbPath = join(studioDir, 'runs', 'runs.db');
+
+  let store: AnyRunStore;
+  if (dbType === 'postgres') {
+    const url = config.db?.url;
+    if (!url) throw new Error('db.url is required when db.type is postgres');
+    store = new PgRunStore(url);
+  } else if (dbType === 'inmemory') {
+    store = new InMemoryRunStore();
+  } else {
+    store = new SQLiteRunStore(dbPath);
+  }
+
+  // UserStore — same DB as run store
+  let userStore: UserStore | PgUserStore;
+  if (dbType === 'postgres') {
+    const url = config.db?.url;
+    if (!url) throw new Error('db.url is required when db.type is postgres');
+    userStore = new PgUserStore(url);
+  } else {
+    userStore = new UserStore(dbPath);
+  }
+
+  const plans = resolvePlans(config.plans as Record<string, import('./plans.js').PlanLimits> | undefined);
+
+  const providerRegistry = createDefaultRegistry({
+    openai: config.providers?.openai ? { apiKey: config.providers.openai.apiKey } : undefined,
+    anthropic: config.providers?.anthropic ? { apiKey: config.providers.anthropic.apiKey } : undefined,
+    ollama: config.providers?.ollama ? { baseUrl: config.providers.ollama.baseUrl } : undefined,
+  });
+
+  const toolsDir = join(studioDir, 'tools');
+  const loadedPlugins = await loadProjectTools(toolsDir, cwd);
+  const toolRegistry = new ToolRegistry();
+  for (const plugin of loadedPlugins) {
+    toolRegistry.registerPlugin(plugin.name, plugin.tools, plugin.promptSnippet);
+  }
+
+  // Load MCP plugins
+  const pluginsDir = join(studioDir, 'plugins');
+  const pluginManifests = await loadPlugins(pluginsDir);
+  const mcpClients: InstanceType<typeof MCPClient>[] = [];
+  const pluginSkills: Record<string, string[]> = {};
+
+  for (const manifest of pluginManifests) {
+    for (const [serverName, serverDef] of Object.entries(manifest.mcpServers)) {
+      const client = new MCPClient(manifest.name, serverName, serverDef);
+      try {
+        await client.start();
+        const mcpTools = await client.getTools();
+        toolRegistry.registerPlugin(`${manifest.name}-${serverName}`, mcpTools);
+        mcpClients.push(client);
+      } catch {
+        // Plugin failed to start — skip silently for API
+      }
+    }
+    if (manifest.skills.length > 0) {
+      pluginSkills[manifest.name] = manifest.skills.map(
+        (s: SkillContent) => `## Skill: ${s.name}\n\n${s.content}`
+      );
+    }
+  }
+
+  // Self-referential spawner: allows pipelines to spawn child runs via the API
+  // Must match DEFAULT_PORT in index.ts (3700) — was 3000 which collides with common dev servers
+  const apiPort = config.api?.port ?? 3700;
+  const spawner = new HttpApiSpawner(`http://localhost:${apiPort}`, config.api?.key);
+
+  const engineConfig: EngineConfig = {
+    configsDir: studioDir,
+    providerRegistry,
+    toolRegistry,
+    db: store,
+    pluginSkills,
+    spawner,
+    maxDepth: 3,
+    defaultProvider: config.defaults?.provider,
+    defaultModel: config.defaults?.model,
+  };
+
+  const bus = new RunEventBus();
+  const launcher = new InProcessLauncher(engineConfig, store, runsDir, bus);
+
+  // Derive project name from the directory containing .studio/
+  const projectName = studioDir.split('/').slice(-2, -1)[0] ?? 'studio-project';
+
+  const webhookStore = new WebhookStore(dbPath);
+  const integrationStore = new IntegrationStore(dbPath);
+  const integrationsDir = join(studioDir, 'integrations');
+  const loadedIntegrations = await loadProjectIntegrations(integrationsDir);
+  const integrationConfigs = (config.integrations ?? {}) as Record<string, Record<string, unknown>>;
+  const integrationRuntime = new IntegrationRuntime({
+    integrations: loadedIntegrations,
+    store: integrationStore,
+    launcher,
+    configsDir: studioDir,
+    projectsDir: config.paths?.projects_dir,
+    apiConfig: config.api ?? {},
+    integrationConfigs,
+  });
+  integrationRuntime.setupEventBus(bus);
+  const webhookDispatcher = new WebhookDispatcher(webhookStore, projectName);
+  bus.subscribeAll((runId, event) => {
+    void webhookDispatcher.handleBusEvent(runId, event.type, event.data);
+  });
+
+  return {
+    store,
+    launcher,
+    configsDir: studioDir,
+    projectsDir: config.paths?.projects_dir,
+    projectName,
+    apiConfig: config.api ?? {},
+    studioVersion,
+    maskedConfig,
+    webhookStore,
+    integrationStore,
+    integrationRuntime,
+    userStore,
+    plans,
+    cleanup: async () => {
+      for (const client of mcpClients) {
+        try { await client.close(); } catch { /* ignore */ }
+      }
+      if ('close' in store && typeof (store as AnyRunStore & { close?: () => unknown }).close === 'function') {
+        await (store as AnyRunStore & { close(): Promise<void> | void }).close();
+      }
+      if (userStore && 'close' in userStore && typeof userStore.close === 'function') {
+        await userStore.close();
+      }
+      webhookStore.close();
+      integrationStore.close();
+    },
+  };
+}