@studio-foundation/api 0.3.0-beta.1

package/dist/routes/webhooks.js

@@ -0,0 +1,102 @@
+import { randomUUID } from 'node:crypto';
+const VALID_EVENTS = [
+    'pipeline_start',
+    'pipeline_complete',
+    'stage_complete',
+    'stage_rejected',
+    'stage_failed',
+    'group_feedback',
+];
+const errorSchema = { type: 'object', properties: { error: { type: 'string' } } };
+const webhookSchema = {
+    type: 'object',
+    properties: {
+        id: { type: 'string' },
+        url: { type: 'string' },
+        events: { type: 'array', items: { type: 'string' } },
+        status: { type: 'string', enum: ['active', 'failed'] },
+        created_at: { type: 'string' },
+    },
+};
+export async function webhooksRoutes(fastify, options) {
+    const { webhookStore } = options.deps;
+    // POST /api/webhooks
+    fastify.post('/webhooks', {
+        schema: {
+            tags: ['webhooks'],
+            summary: 'Register a new webhook',
+            body: {
+                type: 'object',
+                required: ['url', 'events'],
+                properties: {
+                    url: { type: 'string' },
+                    events: { type: 'array', items: { type: 'string' }, minItems: 1 },
+                    secret: { type: 'string' },
+                },
+            },
+            response: {
+                201: webhookSchema,
+                400: errorSchema,
+            },
+        },
+    }, async (request, reply) => {
+        const { url, events, secret } = request.body;
+        if (!events || events.length === 0) {
+            return reply.status(400).send({ error: 'events must not be empty' });
+        }
+        const id = randomUUID();
+        const created_at = new Date().toISOString();
+        webhookStore.saveWebhook({
+            id,
+            url,
+            events,
+            ...(secret != null ? { secret } : {}),
+            status: 'active',
+            created_at,
+        });
+        return reply.status(201).send({ id, url, events, status: 'active', created_at });
+    });
+    // GET /api/webhooks
+    fastify.get('/webhooks', {
+        schema: {
+            tags: ['webhooks'],
+            summary: 'List all registered webhooks',
+            response: {
+                200: {
+                    type: 'object',
+                    properties: {
+                        webhooks: { type: 'array', items: webhookSchema },
+                    },
+                },
+            },
+        },
+    }, async (_request, reply) => {
+        const webhooks = webhookStore.listWebhooks().map(({ secret: _secret, ...w }) => w);
+        return reply.send({ webhooks });
+    });
+    // DELETE /api/webhooks/:id
+    fastify.delete('/webhooks/:id', {
+        schema: {
+            tags: ['webhooks'],
+            summary: 'Delete a webhook',
+            params: {
+                type: 'object',
+                properties: { id: { type: 'string' } },
+                required: ['id'],
+            },
+            response: {
+                204: { type: 'null', description: 'No content' },
+                404: errorSchema,
+            },
+        },
+    }, async (request, reply) => {
+        const deleted = webhookStore.deleteWebhook(request.params.id);
+        if (!deleted) {
+            return reply.status(404).send({ error: 'Webhook not found' });
+        }
+        return reply.status(204).send();
+    });
+}
+// Export VALID_EVENTS for documentation/validation use
+export { VALID_EVENTS };
+//# sourceMappingURL=webhooks.js.map

package/dist/routes/webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/routes/webhooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,MAAM,YAAY,GAAG;IACnB,gBAAgB;IAChB,mBAAmB;IACnB,gBAAgB;IAChB,gBAAgB;IAChB,cAAc;IACd,gBAAgB;CACR,CAAC;AAEX,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAElF,MAAM,aAAa,GAAG;IACpB,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACtB,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACvB,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;QACpD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE;QACtD,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KAC/B;CACF,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAwB,EACxB,OAA6B;IAE7B,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAEtC,qBAAqB;IACrB,OAAO,CAAC,IAAI,CAET,WAAW,EAAE;QACd,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,OAAO,EAAE,wBAAwB;YACjC,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC;gBAC3B,UAAU,EAAE;oBACV,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACvB,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE;oBACjE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBAC3B;aACF;YACD,QAAQ,EAAE;gBACR,GAAG,EAAE,aAAa;gBAClB,GAAG,EAAE,WAAW;aACjB;SACF;KACF,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1B,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;QAE7C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAE5C,YAAY,CAAC,WAAW,CAAC;YACvB,EAAE;YACF,GAAG;YACH,MAAM;YACN,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,MAAM,EAAE,QAAQ;YAChB,UAAU;SACX,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,oBAAoB;IACpB,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE;QACvB,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,OAAO,EAAE,8BAA8B;YACvC,QAAQ,EAAE;gBACR,GAAG,EAAE;oBACH,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE;qBAClD;iBACF;aACF;SACF;KACF,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;QAC3B,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACnF,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,2BAA2B;IAC3B,OAAO,CAAC,MAAM,CAA6B,eAAe,EAAE;QAC1D,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,OAAO,EAAE,kBAAkB;YAC3B,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;gBACtC,QAAQ,EAAE,CAAC,IAAI,CAAC;aACjB;YACD,QAAQ,EAAE;gBACR,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE;gBAChD,GAAG,EAAE,WAAW;aACjB;SACF;KACF,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1B,MAAM,OAAO,GAAG,YAAY,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,uDAAuD;AACvD,OAAO,EAAE,YAAY,EAAE,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,46 @@
+import type { AnyRunStore } from '@studio-foundation/engine';
+import type { RunLauncher } from './launcher.js';
+import type { WebhookStore } from './webhook-store.js';
+import type { IntegrationStore } from './integration-store.js';
+import type { IntegrationRuntime } from './integration-runtime.js';
+import type { UserStore } from './user-store.js';
+import type { PgUserStore } from './user-store-pg.js';
+import { type PlansConfig } from './plans.js';
+export interface ApiConfig {
+    key?: string;
+    port?: number;
+}
+export type MaskedConfig = {
+    defaults?: {
+        provider?: string;
+        model?: string;
+    };
+    providers: string[];
+};
+export interface ServerDeps {
+    store: AnyRunStore;
+    launcher: RunLauncher;
+    configsDir: string;
+    /** Raw projects_dir from config (may contain ~). Used by route handlers for repo cloning. */
+    projectsDir?: string;
+    projectName: string;
+    apiConfig: ApiConfig;
+    studioVersion: string;
+    maskedConfig: MaskedConfig;
+    webhookStore: WebhookStore;
+    integrationStore: IntegrationStore;
+    integrationRuntime: IntegrationRuntime;
+    userStore?: UserStore | PgUserStore;
+    plans?: PlansConfig;
+    /** true when at least one user exists in the DB — computed at bootstrap time to avoid per-request DB calls */
+    hasUsers?: boolean;
+}
+declare module 'fastify' {
+    interface FastifyRequest {
+        user?: import('./user-store.js').User;
+    }
+}
+export declare function buildServer(deps: ServerDeps): import("fastify").FastifyInstance<import("node:http").Server<typeof import("node:http").IncomingMessage, typeof import("node:http").ServerResponse>, import("node:http").IncomingMessage, import("node:http").ServerResponse<import("node:http").IncomingMessage>, import("fastify").FastifyBaseLogger, import("fastify").FastifyTypeProviderDefault> & PromiseLike<import("fastify").FastifyInstance<import("node:http").Server<typeof import("node:http").IncomingMessage, typeof import("node:http").ServerResponse>, import("node:http").IncomingMessage, import("node:http").ServerResponse<import("node:http").IncomingMessage>, import("fastify").FastifyBaseLogger, import("fastify").FastifyTypeProviderDefault>> & {
+    __linterBrands: "SafePromiseLike";
+};
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAgC,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAa5E,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjD,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB,CAAC;AAEF,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,WAAW,CAAC;IACnB,QAAQ,EAAE,WAAW,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,6FAA6F;IAC7F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,SAAS,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,YAAY,CAAC;IAC3B,YAAY,EAAE,YAAY,CAAC;IAC3B,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,SAAS,CAAC,EAAE,SAAS,GAAG,WAAW,CAAC;IACpC,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,8GAA8G;IAC9G,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAGD,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,cAAc;QACtB,IAAI,CAAC,EAAE,OAAO,iBAAiB,EAAE,IAAI,CAAC;KACvC;CACF;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU;;EA0F3C"}

package/dist/server.js

@@ -0,0 +1,101 @@
+// Fastify server builder — takes deps via injection for testability
+// buildServer(deps) → FastifyInstance, ready to listen
+import Fastify from 'fastify';
+import cors from '@fastify/cors';
+import rateLimit from '@fastify/rate-limit';
+import swagger from '@fastify/swagger';
+import swaggerUi from '@fastify/swagger-ui';
+import { getPlanLimits, DEFAULT_PLANS } from './plans.js';
+import { runsRoutes } from './routes/runs.js';
+import { projectsRoutes } from './routes/projects.js';
+import { contractsRoutes } from './routes/contracts.js';
+import { pipelinesRoutes } from './routes/pipelines.js';
+import { toolsRoutes } from './routes/tools.js';
+import { agentsRoutes } from './routes/agents.js';
+import { configRoutes } from './routes/config.js';
+import { skillsRoutes } from './routes/skills.js';
+import { validateRoutes } from './routes/validate.js';
+import { webhooksRoutes } from './routes/webhooks.js';
+import { usersRoutes } from './routes/users.js';
+export function buildServer(deps) {
+    const fastify = Fastify({ logger: false });
+    // Register text/plain parser so PUT routes that accept YAML bodies work correctly.
+    // Without this, Fastify v5 cannot parse text/plain and body validation fails with 400.
+    fastify.addContentTypeParser('text/plain', { parseAs: 'string' }, (_req, body, done) => {
+        done(null, body);
+    });
+    void fastify.register(cors, { origin: true });
+    void fastify.register(rateLimit, {
+        global: true,
+        max: (req) => {
+            const planName = req.user?.plan ?? 'free';
+            const plans = deps.plans ?? DEFAULT_PLANS;
+            return getPlanLimits(plans, planName).rate_limit_per_minute;
+        },
+        timeWindow: '1 minute',
+        keyGenerator: (req) => req.user?.id ?? req.ip ?? 'anonymous',
+        addHeaders: {
+            'x-ratelimit-limit': true,
+            'x-ratelimit-remaining': true,
+            'x-ratelimit-reset': true,
+        },
+        allowList: (req) => req.url.startsWith('/api/integrations/'),
+    });
+    if (process.env['NODE_ENV'] !== 'production') {
+        void fastify.register(swagger, {
+            openapi: {
+                info: {
+                    title: 'Studio API',
+                    description: 'REST API for Studio pipeline orchestration',
+                    version: '1.0.0',
+                },
+            },
+        });
+        void fastify.register(swaggerUi, {
+            routePrefix: '/api/docs',
+        });
+    }
+    // Auth hook — supports three modes:
+    //   1. Multi-user: userStore provided + hasUsers=true → lookup by api_key
+    //   2. Legacy single-key: hasUsers=false + api.key configured → Bearer check
+    //   3. Open/dev: no users, no api.key → allow all (local dev only)
+    fastify.addHook('onRequest', async (request, reply) => {
+        const path = request.url.split('?')[0];
+        if (path.startsWith('/api/integrations/'))
+            return;
+        const auth = request.headers['authorization'];
+        const token = auth?.startsWith('Bearer ') ? auth.slice(7) : undefined;
+        if (deps.userStore && deps.hasUsers) {
+            // Multi-user mode: look up user by api_key
+            const user = token ? await deps.userStore.getUserByApiKey(token) : null;
+            if (!user) {
+                await reply.status(401).send({ error: 'Unauthorized' });
+                return;
+            }
+            request.user = user;
+            return;
+        }
+        // Legacy single-key mode
+        if (deps.apiConfig.key) {
+            if (!auth || auth !== `Bearer ${deps.apiConfig.key}`) {
+                await reply.status(401).send({ error: 'Unauthorized' });
+            }
+            return;
+        }
+        // No userStore with users, no api.key → open (local dev)
+    });
+    void fastify.register(runsRoutes, { prefix: '/api', deps });
+    void fastify.register(projectsRoutes, { prefix: '/api', deps });
+    void fastify.register(contractsRoutes, { prefix: '/api', deps });
+    void fastify.register(pipelinesRoutes, { prefix: '/api', deps });
+    void fastify.register(toolsRoutes, { prefix: '/api', deps });
+    void fastify.register(agentsRoutes, { prefix: '/api', deps });
+    void fastify.register(configRoutes, { prefix: '/api', deps });
+    void fastify.register(skillsRoutes, { prefix: '/api', deps });
+    void fastify.register(validateRoutes, { prefix: '/api', deps });
+    void fastify.register(webhooksRoutes, { prefix: '/api', deps });
+    void fastify.register(usersRoutes, { prefix: '/api', deps });
+    deps.integrationRuntime.registerRoutes(fastify, '/api');
+    return fastify;
+}
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,uDAAuD;AAEvD,OAAO,OAAgC,MAAM,SAAS,CAAC;AACvD,OAAO,IAAI,MAAM,eAAe,CAAC;AACjC,OAAO,SAAS,MAAM,qBAAqB,CAAC;AAC5C,OAAO,OAAO,MAAM,kBAAkB,CAAC;AACvC,OAAO,SAAS,MAAM,qBAAqB,CAAC;AAQ5C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAoB,MAAM,YAAY,CAAC;AAC5E,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAsChD,MAAM,UAAU,WAAW,CAAC,IAAgB;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAE3C,mFAAmF;IACnF,uFAAuF;IACvF,OAAO,CAAC,oBAAoB,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QACrF,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,KAAK,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAE9C,KAAK,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE;QAC/B,MAAM,EAAE,IAAI;QACZ,GAAG,EAAE,CAAC,GAAmB,EAAE,EAAE;YAC3B,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC;YAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC;YAC1C,OAAO,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,qBAAqB,CAAC;QAC9D,CAAC;QACD,UAAU,EAAE,UAAU;QACtB,YAAY,EAAE,CAAC,GAAmB,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,WAAW;QAC5E,UAAU,EAAE;YACV,mBAAmB,EAAE,IAAI;YACzB,uBAAuB,EAAE,IAAI;YAC7B,mBAAmB,EAAE,IAAI;SAC1B;QACD,SAAS,EAAE,CAAC,GAAmB,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,oBAAoB,CAAC;KAC7E,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY,EAAE,CAAC;QAC7C,KAAK,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE;YAC7B,OAAO,EAAE;gBACP,IAAI,EAAE;oBACJ,KAAK,EAAE,YAAY;oBACnB,WAAW,EAAE,4CAA4C;oBACzD,OAAO,EAAE,OAAO;iBACjB;aACF;SACF,CAAC,CAAC;QACH,KAAK,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE;YAC/B,WAAW,EAAE,WAAW;SACzB,CAAC,CAAC;IACL,CAAC;IAED,oCAAoC;IACpC,0EAA0E;IAC1E,6EAA6E;IAC7E,mEAAmE;IACnE,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACpD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC;YAAE,OAAO;QAElD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEtE,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,2CAA2C;YAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACxE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YACD,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YACpB,OAAO;QACT,CAAC;QAED,yBAAyB;QACzB,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC;gBACrD,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO;QACT,CAAC;QAED,yDAAyD;IAC3D,CAAC,CAAC,CAAC;IAEH,KAAK,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,KAAK,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,KAAK,OAAO,CAAC,QAAQ,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,KAAK,OAAO,CAAC,QAAQ,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,KAAK,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,KAAK,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,KAAK,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,KAAK,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,KAAK,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,KAAK,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,KAAK,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAExD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/spawners/http-api-spawner.d.ts

@@ -0,0 +1,10 @@
+import type { RunSpawner, SpawnConfig, SpawnResult } from '@studio-foundation/contracts';
+export declare class HttpApiSpawner implements RunSpawner {
+    private apiUrl;
+    private apiKey?;
+    constructor(apiUrl: string, apiKey?: string | undefined);
+    private authHeaders;
+    spawnAndWait(config: SpawnConfig): Promise<SpawnResult>;
+    private waitForCompletion;
+}
+//# sourceMappingURL=http-api-spawner.d.ts.map

package/dist/spawners/http-api-spawner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-api-spawner.d.ts","sourceRoot":"","sources":["../../src/spawners/http-api-spawner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAe,MAAM,8BAA8B,CAAC;AAEtG,qBAAa,cAAe,YAAW,UAAU;IACnC,OAAO,CAAC,MAAM;IAAU,OAAO,CAAC,MAAM,CAAC;gBAA/B,MAAM,EAAE,MAAM,EAAU,MAAM,CAAC,EAAE,MAAM,YAAA;IAE3D,OAAO,CAAC,WAAW;IAIb,YAAY,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IA0C7D,OAAO,CAAC,iBAAiB;CA4C1B"}

package/dist/spawners/http-api-spawner.js

@@ -0,0 +1,88 @@
+export class HttpApiSpawner {
+    apiUrl;
+    apiKey;
+    constructor(apiUrl, apiKey) {
+        this.apiUrl = apiUrl;
+        this.apiKey = apiKey;
+    }
+    authHeaders() {
+        return this.apiKey ? { Authorization: `Bearer ${this.apiKey}` } : {};
+    }
+    async spawnAndWait(config) {
+        // 1. Launch the run
+        const postRes = await fetch(`${this.apiUrl}/api/runs`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'X-Studio-Depth': String(config.depth),
+                'X-Studio-Parent-Run-Id': config.parentRunId,
+                ...this.authHeaders(),
+            },
+            body: JSON.stringify({ pipeline: config.pipeline, input: config.input }),
+        });
+        if (!postRes.ok) {
+            const text = await postRes.text();
+            throw new Error(`Failed to launch child run: ${postRes.status} ${text}`);
+        }
+        const { run_id } = (await postRes.json());
+        // 2. Wait for pipeline_complete via SSE
+        await this.waitForCompletion(run_id);
+        // 3. Fetch full run result to get output
+        const getRes = await fetch(`${this.apiUrl}/api/runs/${run_id}`, {
+            headers: { ...this.authHeaders() },
+        });
+        if (!getRes.ok) {
+            throw new Error(`Failed to fetch child run result ${run_id}: ${getRes.status}`);
+        }
+        const run = (await getRes.json());
+        if (run.status === 'failed' || run.status === 'rejected' || run.status === 'cancelled') {
+            throw new Error(`Child run ${run_id} ${run.status}`);
+        }
+        const lastStage = [...run.stages].reverse().find(s => s.status === 'success');
+        const output = lastStage?.output ?? null;
+        return { run_id, status: run.status, output };
+    }
+    waitForCompletion(runId) {
+        return new Promise((resolve, reject) => {
+            fetch(`${this.apiUrl}/api/runs/${runId}/stream`, {
+                headers: { Accept: 'text/event-stream', ...this.authHeaders() },
+            })
+                .then(response => {
+                if (!response.ok || !response.body) {
+                    reject(new Error(`SSE connection failed for run ${runId}: ${response.status}`));
+                    return;
+                }
+                const reader = response.body.getReader();
+                const decoder = new TextDecoder();
+                let buffer = '';
+                let currentEventType = '';
+                const pump = () => reader.read().then(({ done, value }) => {
+                    if (done) {
+                        reject(new Error(`SSE stream ended without pipeline_complete for run ${runId}`));
+                        return;
+                    }
+                    buffer += decoder.decode(value, { stream: true });
+                    const lines = buffer.split('\n');
+                    buffer = lines.pop() ?? '';
+                    for (const line of lines) {
+                        if (line.startsWith('event: ')) {
+                            currentEventType = line.slice(7).trim();
+                        }
+                        else if (line.startsWith('data: ') && currentEventType === 'pipeline_complete') {
+                            reader.cancel();
+                            resolve();
+                            return;
+                        }
+                        else if (line === '') {
+                            currentEventType = '';
+                        }
+                    }
+                    return pump();
+                });
+                pump().catch(reject);
+            })
+                .catch(reject);
+        });
+    }
+}
+//# sourceMappingURL=http-api-spawner.js.map

package/dist/spawners/http-api-spawner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-api-spawner.js","sourceRoot":"","sources":["../../src/spawners/http-api-spawner.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,cAAc;IACL;IAAwB;IAA5C,YAAoB,MAAc,EAAU,MAAe;QAAvC,WAAM,GAAN,MAAM,CAAQ;QAAU,WAAM,GAAN,MAAM,CAAS;IAAG,CAAC;IAEvD,WAAW;QACjB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAmB;QACpC,oBAAoB;QACpB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,WAAW,EAAE;YACrD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;gBACtC,wBAAwB,EAAE,MAAM,CAAC,WAAW;gBAC5C,GAAG,IAAI,CAAC,WAAW,EAAE;aACtB;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;SACzE,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,+BAA+B,OAAO,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAuB,CAAC;QAEhE,wCAAwC;QACxC,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAErC,yCAAyC;QACzC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,aAAa,MAAM,EAAE,EAAE;YAC9D,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,EAAE;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAgB,CAAC;QAEjD,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACvF,MAAM,IAAI,KAAK,CAAC,aAAa,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,SAAS,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAI,SAA8C,EAAE,MAAM,IAAI,IAAI,CAAC;QAE/E,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAChD,CAAC;IAEO,iBAAiB,CAAC,KAAa;QACrC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,aAAa,KAAK,SAAS,EAAE;gBAC/C,OAAO,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,EAAE;aAChE,CAAC;iBACC,IAAI,CAAC,QAAQ,CAAC,EAAE;gBACf,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;oBACnC,MAAM,CAAC,IAAI,KAAK,CAAC,iCAAiC,KAAK,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;oBAChF,OAAO;gBACT,CAAC;gBACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACzC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;gBAClC,IAAI,MAAM,GAAG,EAAE,CAAC;gBAChB,IAAI,gBAAgB,GAAG,EAAE,CAAC;gBAE1B,MAAM,IAAI,GAAG,GAAkB,EAAE,CAC/B,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;oBACrC,IAAI,IAAI,EAAE,CAAC;wBACT,MAAM,CAAC,IAAI,KAAK,CAAC,sDAAsD,KAAK,EAAE,CAAC,CAAC,CAAC;wBACjF,OAAO;oBACT,CAAC;oBACD,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;oBAClD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBACjC,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;oBAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;wBACzB,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;4BAC/B,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;wBAC1C,CAAC;6BAAM,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,gBAAgB,KAAK,mBAAmB,EAAE,CAAC;4BACjF,MAAM,CAAC,MAAM,EAAE,CAAC;4BAChB,OAAO,EAAE,CAAC;4BACV,OAAO;wBACT,CAAC;6BAAM,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;4BACvB,gBAAgB,GAAG,EAAE,CAAC;wBACxB,CAAC;oBACH,CAAC;oBACD,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC,CAAC,CAAC;gBAEL,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC,CAAC;iBACD,KAAK,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/user-store-pg.d.ts

@@ -0,0 +1,21 @@
+import type { User, DailyUsage } from './user-store.js';
+export type { User, DailyUsage } from './user-store.js';
+export declare class PgUserStore {
+    private pool;
+    private schemaReady;
+    constructor(connectionString: string);
+    private ensureSchema;
+    private initSchema;
+    getUserByApiKey(apiKey: string): Promise<User | null>;
+    getUserById(id: string): Promise<User | null>;
+    getUserByEmail(email: string): Promise<User | null>;
+    listUsers(): Promise<User[]>;
+    saveUser(user: User): Promise<void>;
+    deleteUser(id: string): Promise<void>;
+    getDailyUsage(userId: string, date: string): Promise<DailyUsage>;
+    incrementRuns(userId: string, date: string): Promise<void>;
+    incrementTokens(userId: string, date: string, tokens: number): Promise<void>;
+    close(): Promise<void>;
+}
+export type AnyUserStore = import('./user-store.js').UserStore | PgUserStore;
+//# sourceMappingURL=user-store-pg.d.ts.map

package/dist/user-store-pg.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-store-pg.d.ts","sourceRoot":"","sources":["../src/user-store-pg.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxD,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAExD,qBAAa,WAAW;IACtB,OAAO,CAAC,IAAI,CAAoB;IAChC,OAAO,CAAC,WAAW,CAA8B;gBAErC,gBAAgB,EAAE,MAAM;IAMpC,OAAO,CAAC,YAAY;YAON,UAAU;IAqBlB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IASrD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAS7C,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IASnD,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAQ5B,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAcnC,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrC,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAShE,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAW1D,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAW5E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B;AAED,MAAM,MAAM,YAAY,GAAG,OAAO,iBAAiB,EAAE,SAAS,GAAG,WAAW,CAAC"}

package/dist/user-store-pg.js

@@ -0,0 +1,97 @@
+// api/src/user-store-pg.ts
+// PgUserStore — PostgreSQL async variant of UserStore
+// Follows same pattern as PgRunStore in @studio/engine
+// Table prefix studio_ to avoid conflicts with user app tables
+import { createRequire } from 'node:module';
+export class PgUserStore {
+    pool;
+    schemaReady = null;
+    constructor(connectionString) {
+        const _require = createRequire(import.meta.url);
+        const { Pool } = _require('pg');
+        this.pool = new Pool({ connectionString });
+    }
+    ensureSchema() {
+        if (!this.schemaReady) {
+            this.schemaReady = this.initSchema();
+        }
+        return this.schemaReady;
+    }
+    async initSchema() {
+        await this.pool.query(`
+      CREATE TABLE IF NOT EXISTS studio_users (
+        id         TEXT PRIMARY KEY,
+        email      TEXT UNIQUE NOT NULL,
+        plan       TEXT NOT NULL DEFAULT 'free',
+        api_key    TEXT UNIQUE NOT NULL,
+        created_at TEXT NOT NULL
+      )
+    `);
+        await this.pool.query(`
+      CREATE TABLE IF NOT EXISTS studio_usage (
+        user_id     TEXT NOT NULL,
+        date        TEXT NOT NULL,
+        runs_count  INTEGER NOT NULL DEFAULT 0,
+        tokens_used INTEGER NOT NULL DEFAULT 0,
+        PRIMARY KEY (user_id, date)
+      )
+    `);
+    }
+    async getUserByApiKey(apiKey) {
+        await this.ensureSchema();
+        const res = await this.pool.query('SELECT id, email, plan, api_key, created_at FROM studio_users WHERE api_key = $1', [apiKey]);
+        return res.rows[0] ?? null;
+    }
+    async getUserById(id) {
+        await this.ensureSchema();
+        const res = await this.pool.query('SELECT id, email, plan, api_key, created_at FROM studio_users WHERE id = $1', [id]);
+        return res.rows[0] ?? null;
+    }
+    async getUserByEmail(email) {
+        await this.ensureSchema();
+        const res = await this.pool.query('SELECT id, email, plan, api_key, created_at FROM studio_users WHERE email = $1', [email]);
+        return res.rows[0] ?? null;
+    }
+    async listUsers() {
+        await this.ensureSchema();
+        const res = await this.pool.query('SELECT id, email, plan, api_key, created_at FROM studio_users ORDER BY created_at ASC');
+        return res.rows;
+    }
+    async saveUser(user) {
+        await this.ensureSchema();
+        await this.pool.query(`INSERT INTO studio_users (id, email, plan, api_key, created_at)
+       VALUES ($1, $2, $3, $4, $5)
+       ON CONFLICT (id) DO UPDATE SET
+         email      = EXCLUDED.email,
+         plan       = EXCLUDED.plan,
+         api_key    = EXCLUDED.api_key,
+         created_at = EXCLUDED.created_at`, [user.id, user.email, user.plan, user.api_key, user.created_at]);
+    }
+    async deleteUser(id) {
+        await this.ensureSchema();
+        await this.pool.query('DELETE FROM studio_users WHERE id = $1', [id]);
+    }
+    async getDailyUsage(userId, date) {
+        await this.ensureSchema();
+        const res = await this.pool.query('SELECT user_id, date, runs_count, tokens_used FROM studio_usage WHERE user_id = $1 AND date = $2', [userId, date]);
+        return res.rows[0] ?? { user_id: userId, date, runs_count: 0, tokens_used: 0 };
+    }
+    async incrementRuns(userId, date) {
+        await this.ensureSchema();
+        await this.pool.query(`INSERT INTO studio_usage (user_id, date, runs_count, tokens_used)
+       VALUES ($1, $2, 1, 0)
+       ON CONFLICT (user_id, date) DO UPDATE SET
+         runs_count = studio_usage.runs_count + 1`, [userId, date]);
+    }
+    async incrementTokens(userId, date, tokens) {
+        await this.ensureSchema();
+        await this.pool.query(`INSERT INTO studio_usage (user_id, date, runs_count, tokens_used)
+       VALUES ($1, $2, 0, $3)
+       ON CONFLICT (user_id, date) DO UPDATE SET
+         tokens_used = studio_usage.tokens_used + EXCLUDED.tokens_used`, [userId, date, tokens]);
+    }
+    async close() {
+        await this.pool.end();
+    }
+}
+//# sourceMappingURL=user-store-pg.js.map

package/dist/user-store-pg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-store-pg.js","sourceRoot":"","sources":["../src/user-store-pg.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,sDAAsD;AACtD,uDAAuD;AACvD,+DAA+D;AAE/D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAI5C,MAAM,OAAO,WAAW;IACd,IAAI,CAAoB;IACxB,WAAW,GAAyB,IAAI,CAAC;IAEjD,YAAY,gBAAwB;QAClC,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAwB,CAAC;QACvD,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC7C,CAAC;IAEO,YAAY;QAClB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;;;;;;;;KAQrB,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;;;;;;;;KAQrB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAC/B,kFAAkF,EAClF,CAAC,MAAM,CAAC,CACT,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAU;QAC1B,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAC/B,6EAA6E,EAC7E,CAAC,EAAE,CAAC,CACL,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAa;QAChC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAC/B,gFAAgF,EAChF,CAAC,KAAK,CAAC,CACR,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAC/B,uFAAuF,CACxF,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAU;QACvB,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB;;;;;;0CAMoC,EACpC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAChE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,wCAAwC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,IAAY;QAC9C,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAC/B,kGAAkG,EAClG,CAAC,MAAM,EAAE,IAAI,CAAC,CACf,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;IACjF,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,IAAY;QAC9C,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB;;;kDAG4C,EAC5C,CAAC,MAAM,EAAE,IAAI,CAAC,CACf,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAc,EAAE,IAAY,EAAE,MAAc;QAChE,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB;;;uEAGiE,EACjE,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CACvB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IACxB,CAAC;CACF"}

package/dist/user-store.d.ts

@@ -0,0 +1,29 @@
+export interface User {
+    id: string;
+    email: string;
+    plan: string;
+    api_key: string;
+    created_at: string;
+}
+export interface DailyUsage {
+    user_id: string;
+    date: string;
+    runs_count: number;
+    tokens_used: number;
+}
+export declare class UserStore {
+    private db;
+    constructor(dbPath: string);
+    private initSchema;
+    getUserByApiKey(apiKey: string): User | null;
+    getUserById(id: string): User | null;
+    getUserByEmail(email: string): User | null;
+    listUsers(): User[];
+    saveUser(user: User): void;
+    deleteUser(id: string): void;
+    getDailyUsage(userId: string, date: string): DailyUsage;
+    incrementRuns(userId: string, date: string): void;
+    incrementTokens(userId: string, date: string, tokens: number): void;
+    close(): void;
+}
+//# sourceMappingURL=user-store.d.ts.map

package/dist/user-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-store.d.ts","sourceRoot":"","sources":["../src/user-store.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,EAAE,CAAoC;gBAElC,MAAM,EAAE,MAAM;IAQ1B,OAAO,CAAC,UAAU;IAoBlB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAO5C,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAOpC,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAO1C,SAAS,IAAI,IAAI,EAAE;IAMnB,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI;IAY1B,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAI5B,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU;IAOvD,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IASjD,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IASnE,KAAK,IAAI,IAAI;CAGd"}

package/dist/user-store.js

@@ -0,0 +1,97 @@
+// api/src/user-store.ts
+// UserStore — SQLite persistence for users and daily usage
+// Follows same pattern as WebhookStore and IntegrationStore
+// Uses the same DB file as the run store (.studio/runs/runs.db)
+import { createRequire } from 'node:module';
+export class UserStore {
+    db;
+    constructor(dbPath) {
+        const _require = createRequire(import.meta.url);
+        const Database = _require('better-sqlite3');
+        this.db = new Database(dbPath);
+        this.db.pragma('journal_mode = WAL');
+        this.initSchema();
+    }
+    initSchema() {
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS users (
+        id         TEXT PRIMARY KEY,
+        email      TEXT UNIQUE NOT NULL,
+        plan       TEXT NOT NULL DEFAULT 'free',
+        api_key    TEXT UNIQUE NOT NULL,
+        created_at TEXT NOT NULL
+      );
+
+      CREATE TABLE IF NOT EXISTS usage (
+        user_id    TEXT NOT NULL,
+        date       TEXT NOT NULL,
+        runs_count INTEGER NOT NULL DEFAULT 0,
+        tokens_used INTEGER NOT NULL DEFAULT 0,
+        PRIMARY KEY (user_id, date)
+      );
+    `);
+    }
+    getUserByApiKey(apiKey) {
+        const row = this.db
+            .prepare('SELECT id, email, plan, api_key, created_at FROM users WHERE api_key = ?')
+            .get(apiKey);
+        return row ?? null;
+    }
+    getUserById(id) {
+        const row = this.db
+            .prepare('SELECT id, email, plan, api_key, created_at FROM users WHERE id = ?')
+            .get(id);
+        return row ?? null;
+    }
+    getUserByEmail(email) {
+        const row = this.db
+            .prepare('SELECT id, email, plan, api_key, created_at FROM users WHERE email = ?')
+            .get(email);
+        return row ?? null;
+    }
+    listUsers() {
+        return this.db
+            .prepare('SELECT id, email, plan, api_key, created_at FROM users ORDER BY created_at ASC')
+            .all();
+    }
+    saveUser(user) {
+        this.db.prepare(`
+      INSERT INTO users (id, email, plan, api_key, created_at)
+      VALUES (?, ?, ?, ?, ?)
+      ON CONFLICT(id) DO UPDATE SET
+        email      = excluded.email,
+        plan       = excluded.plan,
+        api_key    = excluded.api_key,
+        created_at = excluded.created_at
+    `).run(user.id, user.email, user.plan, user.api_key, user.created_at);
+    }
+    deleteUser(id) {
+        this.db.prepare('DELETE FROM users WHERE id = ?').run(id);
+    }
+    getDailyUsage(userId, date) {
+        const row = this.db
+            .prepare('SELECT user_id, date, runs_count, tokens_used FROM usage WHERE user_id = ? AND date = ?')
+            .get(userId, date);
+        return row ?? { user_id: userId, date, runs_count: 0, tokens_used: 0 };
+    }
+    incrementRuns(userId, date) {
+        this.db.prepare(`
+      INSERT INTO usage (user_id, date, runs_count, tokens_used)
+      VALUES (?, ?, 1, 0)
+      ON CONFLICT (user_id, date) DO UPDATE SET
+        runs_count = runs_count + 1
+    `).run(userId, date);
+    }
+    incrementTokens(userId, date, tokens) {
+        this.db.prepare(`
+      INSERT INTO usage (user_id, date, runs_count, tokens_used)
+      VALUES (?, ?, 0, ?)
+      ON CONFLICT (user_id, date) DO UPDATE SET
+        tokens_used = tokens_used + excluded.tokens_used
+    `).run(userId, date, tokens);
+    }
+    close() {
+        this.db.close();
+    }
+}
+//# sourceMappingURL=user-store.js.map