@sudobility/shapeshyft_service 1.0.0

package/dist/routes/users.js

@@ -0,0 +1,102 @@
+/**
+ * @fileoverview User routes
+ */
+import { Hono } from "hono";
+import { NONE_ENTITLEMENT, } from "@sudobility/types";
+import { successResponse, errorResponse, } from "@sudobility/shapeshyft_engine/types";
+export function createUsersRouter(ctx) {
+    const getUserInfo = (...args) => ctx.auth.getUserInfo(...args);
+    const { getSubscriptionHelper, getTestMode } = ctx.subscription;
+    const usersRouter = new Hono();
+    /**
+     * GET /users/:userId
+     *
+     * Get user information including siteAdmin status.
+     * Requires the Firebase token to match the requested userId.
+     * Returns 403 if token doesn't match or user not found.
+     *
+     * Note: This route is under adminRoutes which applies firebaseAuthMiddleware,
+     * so c.get("userId") is already available.
+     */
+    /**
+     * GET /users/me
+     *
+     * Identify the authenticated caller. Works with either auth method, and is the
+     * only way an API-key client can learn its own Firebase UID — which the
+     * /users/:userId/* routes require. Registered before "/:userId" so the literal
+     * "me" is not captured as a user id.
+     */
+    usersRouter.get("/me", async (c) => {
+        const userId = c.get("userId");
+        const userEmail = c.get("userEmail");
+        // The display name is a nicety fetched from Firebase. Identity is already
+        // established by the middleware, so a Firebase outage (or an API-key caller on
+        // a deployment without Firebase reachable) must not fail this route.
+        let displayName = null;
+        try {
+            const userInfo = await getUserInfo(userId);
+            displayName = userInfo?.displayName ?? null;
+        }
+        catch (error) {
+            console.error("Could not load Firebase profile for /users/me:", error);
+        }
+        return c.json(successResponse({
+            firebase_uid: userId,
+            email: userEmail,
+            siteAdmin: c.get("siteAdmin") ?? false,
+            auth_method: c.get("authMethod") ?? "firebase",
+            display_name: displayName,
+        }));
+    });
+    usersRouter.get("/:userId", async (c) => {
+        const requestedUserId = c.req.param("userId");
+        const tokenUserId = c.get("userId");
+        // Verify the token belongs to the requested user
+        if (requestedUserId !== tokenUserId) {
+            return c.json(errorResponse("Token does not match requested user"), 403);
+        }
+        const userInfo = await getUserInfo(requestedUserId);
+        if (!userInfo) {
+            return c.json(errorResponse("User not found"), 403);
+        }
+        return c.json(successResponse(userInfo));
+    });
+    /**
+     * GET /users/:userId/subscriptions
+     *
+     * Get user subscription status (requires Firebase auth).
+     */
+    usersRouter.get("/:userId/subscriptions", async (c) => {
+        const requestedUserId = c.req.param("userId");
+        const tokenUserId = c.get("userId");
+        if (requestedUserId !== tokenUserId) {
+            return c.json(errorResponse("You can only access your own subscription"), 403);
+        }
+        const subHelper = getSubscriptionHelper();
+        if (!subHelper) {
+            return c.json(errorResponse("Subscription service not configured"), 500);
+        }
+        try {
+            const testMode = getTestMode(c);
+            const subscriptionInfo = await subHelper.getSubscriptionInfo(requestedUserId, testMode);
+            const subscriptionResult = {
+                hasSubscription: subscriptionInfo.entitlements.length > 0 &&
+                    !subscriptionInfo.entitlements.includes(NONE_ENTITLEMENT),
+                entitlements: subscriptionInfo.entitlements,
+                subscriptionStartedAt: subscriptionInfo.subscriptionStartedAt?.toISOString() ?? null,
+                platform: subscriptionInfo.platform,
+                productIdentifier: subscriptionInfo.productIdentifier,
+                expiresDate: subscriptionInfo.expiresDate?.toISOString() ?? null,
+                willRenew: subscriptionInfo.willRenew,
+                managementUrl: subscriptionInfo.managementUrl,
+            };
+            return c.json(successResponse(subscriptionResult));
+        }
+        catch (error) {
+            console.error("Error fetching subscription:", error);
+            return c.json(errorResponse("Failed to fetch subscription status"), 500);
+        }
+    });
+    return usersRouter;
+}
+//# sourceMappingURL=users.js.map

package/dist/routes/users.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.js","sourceRoot":"","sources":["../../src/routes/users.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAEL,gBAAgB,GAEjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,eAAe,EACf,aAAa,GACd,MAAM,qCAAqC,CAAC;AAI7C,MAAM,UAAU,iBAAiB,CAAC,GAAmB;IACnD,MAAM,WAAW,GAA+B,CAAC,GAAG,IAAI,EAAE,EAAE,CAC1D,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,CAAC;IAChC,MAAM,EAAE,qBAAqB,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,YAAY,CAAC;IAEhE,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;IAE/B;;;;;;;;;OASG;IACH;;;;;;;OAOG;IACH,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;QAC/B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAErC,0EAA0E;QAC1E,+EAA+E;QAC/E,qEAAqE;QACrE,IAAI,WAAW,GAAkB,IAAI,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;YAC3C,WAAW,GAAG,QAAQ,EAAE,WAAW,IAAI,IAAI,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,gDAAgD,EAAE,KAAK,CAAC,CAAC;QACzE,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CACX,eAAe,CAAC;YACd,YAAY,EAAE,MAAM;YACpB,KAAK,EAAE,SAAS;YAChB,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,KAAK;YACtC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,UAAU;YAC9C,YAAY,EAAE,WAAW;SAC1B,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;QACpC,MAAM,eAAe,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEpC,iDAAiD;QACjD,IAAI,eAAe,KAAK,WAAW,EAAE,CAAC;YACpC,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,qCAAqC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,eAAe,CAAC,CAAC;QAEpD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAmB,QAAQ,CAAC,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH;;;;OAIG;IACH,WAAW,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;QAClD,MAAM,eAAe,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEpC,IAAI,eAAe,KAAK,WAAW,EAAE,CAAC;YACpC,OAAO,CAAC,CAAC,IAAI,CACX,aAAa,CAAC,2CAA2C,CAAC,EAC1D,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,qBAAqB,EAAE,CAAC;QAC1C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,qCAAqC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YAChC,MAAM,gBAAgB,GAAG,MAAM,SAAS,CAAC,mBAAmB,CAC1D,eAAe,EACf,QAAQ,CACT,CAAC;YACF,MAAM,kBAAkB,GAA8B;gBACpD,eAAe,EACb,gBAAgB,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;oBACxC,CAAC,gBAAgB,CAAC,YAAY,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBAC3D,YAAY,EAAE,gBAAgB,CAAC,YAAY;gBAC3C,qBAAqB,EACnB,gBAAgB,CAAC,qBAAqB,EAAE,WAAW,EAAE,IAAI,IAAI;gBAC/D,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;gBACnC,iBAAiB,EAAE,gBAAgB,CAAC,iBAAiB;gBACrD,WAAW,EAAE,gBAAgB,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,IAAI;gBAChE,SAAS,EAAE,gBAAgB,CAAC,SAAS;gBACrC,aAAa,EAAE,gBAAgB,CAAC,aAAa;aAC9C,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CACX,eAAe,CAA4B,kBAAkB,CAAC,CAC/D,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;YACrD,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,qCAAqC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/dist/schema/init.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @fileoverview Idempotent DDL for the shared tables
+ * @description Runs on every server boot. Every statement is IF NOT EXISTS or
+ * guarded, so re-running is safe. Identifiers cannot be bound as parameters,
+ * so schema and prefix are validated and interpolated into `client.unsafe`.
+ */
+import type { Sql } from "postgres";
+export declare function initServiceTables(client: Sql, opts: {
+    schemaName: string;
+    indexPrefix: string;
+}): Promise<void>;
+//# sourceMappingURL=init.d.ts.map

package/dist/schema/init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/schema/init.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAapC,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,GAAG,EACX,IAAI,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAChD,OAAO,CAAC,IAAI,CAAC,CAgbf"}

package/dist/schema/init.js

@@ -0,0 +1,404 @@
+/**
+ * @fileoverview Idempotent DDL for the shared tables
+ * @description Runs on every server boot. Every statement is IF NOT EXISTS or
+ * guarded, so re-running is safe. Identifiers cannot be bound as parameters,
+ * so schema and prefix are validated and interpolated into `client.unsafe`.
+ */
+import { initRateLimitTable } from "@sudobility/ratelimit_service";
+import { runEntityMigration } from "@sudobility/entity_service";
+const IDENTIFIER = /^[a-z_][a-z0-9_]*$/;
+function identifier(value, what) {
+    if (!IDENTIFIER.test(value)) {
+        throw new Error(`Invalid ${what} "${value}": must match ${IDENTIFIER}`);
+    }
+    return value;
+}
+export async function initServiceTables(client, opts) {
+    const s = identifier(opts.schemaName, "schemaName");
+    const p = identifier(opts.indexPrefix, "indexPrefix");
+    // Create schema if it doesn't exist
+    await client.unsafe(`CREATE SCHEMA IF NOT EXISTS ${s}`);
+    // Create enums (if they don't exist)
+    await client.unsafe(`
+    DO $$ BEGIN
+      CREATE TYPE ${s}.llm_provider AS ENUM ('openai', 'anthropic', 'gemini', 'mistral', 'cohere', 'groq', 'xai', 'deepseek', 'perplexity', 'lm_studio');
+    EXCEPTION
+      WHEN duplicate_object THEN null;
+    END $$;
+  `);
+    // Add new enum values if they don't exist (migration for existing databases)
+    await client.unsafe(`
+    DO $$
+    BEGIN
+      -- Add mistral if not exists
+      IF NOT EXISTS (SELECT 1 FROM pg_enum WHERE enumlabel = 'mistral' AND enumtypid = '${s}.llm_provider'::regtype) THEN
+        ALTER TYPE ${s}.llm_provider ADD VALUE 'mistral';
+      END IF;
+      -- Add cohere if not exists
+      IF NOT EXISTS (SELECT 1 FROM pg_enum WHERE enumlabel = 'cohere' AND enumtypid = '${s}.llm_provider'::regtype) THEN
+        ALTER TYPE ${s}.llm_provider ADD VALUE 'cohere';
+      END IF;
+      -- Add groq if not exists
+      IF NOT EXISTS (SELECT 1 FROM pg_enum WHERE enumlabel = 'groq' AND enumtypid = '${s}.llm_provider'::regtype) THEN
+        ALTER TYPE ${s}.llm_provider ADD VALUE 'groq';
+      END IF;
+      -- Add xai if not exists
+      IF NOT EXISTS (SELECT 1 FROM pg_enum WHERE enumlabel = 'xai' AND enumtypid = '${s}.llm_provider'::regtype) THEN
+        ALTER TYPE ${s}.llm_provider ADD VALUE 'xai';
+      END IF;
+      -- Add deepseek if not exists
+      IF NOT EXISTS (SELECT 1 FROM pg_enum WHERE enumlabel = 'deepseek' AND enumtypid = '${s}.llm_provider'::regtype) THEN
+        ALTER TYPE ${s}.llm_provider ADD VALUE 'deepseek';
+      END IF;
+      -- Add perplexity if not exists
+      IF NOT EXISTS (SELECT 1 FROM pg_enum WHERE enumlabel = 'perplexity' AND enumtypid = '${s}.llm_provider'::regtype) THEN
+        ALTER TYPE ${s}.llm_provider ADD VALUE 'perplexity';
+      END IF;
+      -- Add lm_studio if not exists
+      IF NOT EXISTS (SELECT 1 FROM pg_enum WHERE enumlabel = 'lm_studio' AND enumtypid = '${s}.llm_provider'::regtype) THEN
+        ALTER TYPE ${s}.llm_provider ADD VALUE 'lm_studio';
+      END IF;
+    END $$;
+  `);
+    await client.unsafe(`
+    DO $$ BEGIN
+      CREATE TYPE ${s}.http_method AS ENUM ('GET', 'POST');
+    EXCEPTION
+      WHEN duplicate_object THEN null;
+    END $$;
+  `);
+    // =============================================================================
+    // Step 1: Create users and user_settings tables
+    // firebase_uid is now the primary key
+    // =============================================================================
+    await client.unsafe(`
+    CREATE TABLE IF NOT EXISTS ${s}.users (
+      firebase_uid VARCHAR(128) PRIMARY KEY,
+      email VARCHAR(255),
+      display_name VARCHAR(255),
+      created_at TIMESTAMP DEFAULT NOW(),
+      updated_at TIMESTAMP DEFAULT NOW()
+    )
+  `);
+    await client.unsafe(`
+    CREATE TABLE IF NOT EXISTS ${s}.user_settings (
+      id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      firebase_uid VARCHAR(128) NOT NULL UNIQUE REFERENCES ${s}.users(firebase_uid) ON DELETE CASCADE,
+      organization_name VARCHAR(255),
+      organization_path VARCHAR(255) NOT NULL UNIQUE,
+      created_at TIMESTAMP DEFAULT NOW(),
+      updated_at TIMESTAMP DEFAULT NOW()
+    )
+  `);
+    // =============================================================================
+    // Step 2: Run entity migration (creates entities, entity_members tables)
+    // This must happen BEFORE tables that reference entities.id
+    // =============================================================================
+    await runEntityMigration({
+        client: client, // postgres type versions can differ under bun link
+        schemaName: s,
+        indexPrefix: p,
+        migrateProjects: false, // Tables are created fresh with entity_id
+        migrateUsers: false, // Personal entities created on-demand via EntityHelper
+    });
+    // =============================================================================
+    // Step 2b: Create user_api_keys table (references users.firebase_uid)
+    // Personal API keys used as an alternative to a Firebase ID token.
+    // =============================================================================
+    await client.unsafe(`
+    CREATE TABLE IF NOT EXISTS ${s}.user_api_keys (
+      uuid UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      firebase_uid VARCHAR(128) NOT NULL REFERENCES ${s}.users(firebase_uid) ON DELETE CASCADE,
+      key_name VARCHAR(255) NOT NULL,
+      key_hash VARCHAR(64) NOT NULL UNIQUE,
+      key_prefix VARCHAR(20) NOT NULL,
+      encrypted_key TEXT NOT NULL,
+      encryption_iv VARCHAR(32) NOT NULL,
+      is_active BOOLEAN NOT NULL DEFAULT true,
+      last_used_at TIMESTAMP,
+      created_at TIMESTAMP DEFAULT NOW(),
+      updated_at TIMESTAMP DEFAULT NOW()
+    )
+  `);
+    await client.unsafe(`
+    CREATE INDEX IF NOT EXISTS ${p}_user_api_keys_user_idx
+      ON ${s}.user_api_keys(firebase_uid)
+  `);
+    await client.unsafe(`
+    CREATE UNIQUE INDEX IF NOT EXISTS ${p}_user_api_keys_hash_idx
+      ON ${s}.user_api_keys(key_hash)
+  `);
+    // =============================================================================
+    // Step 2c: Create entity_api_keys table (references entities.id)
+    // Entity-scoped keys used by CI, scripts, and MCP clients.
+    // =============================================================================
+    await client.unsafe(`
+    CREATE TABLE IF NOT EXISTS ${s}.entity_api_keys (
+      id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      entity_id UUID NOT NULL REFERENCES ${s}.entities(id) ON DELETE CASCADE,
+      key_name VARCHAR(255) NOT NULL,
+      key_hash VARCHAR(64) NOT NULL UNIQUE,
+      key_prefix VARCHAR(20) NOT NULL,
+      created_by_user_id VARCHAR(128) NOT NULL,
+      is_active BOOLEAN NOT NULL DEFAULT true,
+      last_used_at TIMESTAMPTZ,
+      created_at TIMESTAMPTZ DEFAULT NOW(),
+      updated_at TIMESTAMPTZ DEFAULT NOW()
+    )
+  `);
+    await client.unsafe(`
+    CREATE UNIQUE INDEX IF NOT EXISTS ${p}_entity_api_keys_hash_idx
+      ON ${s}.entity_api_keys(key_hash)
+  `);
+    await client.unsafe(`
+    CREATE INDEX IF NOT EXISTS ${p}_entity_api_keys_entity_idx
+      ON ${s}.entity_api_keys(entity_id)
+  `);
+    await client.unsafe(`
+    CREATE INDEX IF NOT EXISTS ${p}_entity_api_keys_active_idx
+      ON ${s}.entity_api_keys(is_active)
+  `);
+    // =============================================================================
+    // Step 4: Create projects table (references entities.id)
+    // =============================================================================
+    await client.unsafe(`
+    CREATE TABLE IF NOT EXISTS ${s}.projects (
+      uuid UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      entity_id UUID NOT NULL REFERENCES ${s}.entities(id) ON DELETE CASCADE,
+      project_name VARCHAR(255) NOT NULL,
+      display_name VARCHAR(255) NOT NULL,
+      description TEXT,
+      is_active BOOLEAN DEFAULT true,
+      encrypted_api_key TEXT,
+      api_key_iv VARCHAR(32),
+      api_key_prefix VARCHAR(20),
+      api_key_created_at TIMESTAMP,
+      created_at TIMESTAMP DEFAULT NOW(),
+      updated_at TIMESTAMP DEFAULT NOW()
+    )
+  `);
+    // Create unique index for project_name per entity
+    await client.unsafe(`
+    CREATE UNIQUE INDEX IF NOT EXISTS unique_project_per_entity
+    ON ${s}.projects(entity_id, project_name)
+  `);
+    // Create index for entity_id lookups
+    await client.unsafe(`
+    CREATE INDEX IF NOT EXISTS ${p}_projects_entity_idx
+    ON ${s}.projects(entity_id)
+  `);
+    // =============================================================================
+    // Step 5: Create endpoints table (references projects.uuid)
+    // =============================================================================
+    await client.unsafe(`
+    CREATE TABLE IF NOT EXISTS ${s}.endpoints (
+      uuid UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      project_id UUID NOT NULL REFERENCES ${s}.projects(uuid) ON DELETE CASCADE,
+      endpoint_name VARCHAR(255) NOT NULL,
+      display_name VARCHAR(255) NOT NULL,
+      http_method ${s}.http_method NOT NULL DEFAULT 'POST',
+      llm_key_id UUID,
+      provider ${s}.llm_provider,
+      model VARCHAR(255),
+      input_schema JSONB,
+      output_schema JSONB,
+      instructions TEXT,
+      context TEXT,
+      is_active BOOLEAN DEFAULT true,
+      ip_allowlist JSONB,
+      call_count INTEGER NOT NULL DEFAULT 0,
+      created_at TIMESTAMP DEFAULT NOW(),
+      updated_at TIMESTAMP DEFAULT NOW(),
+      UNIQUE(project_id, endpoint_name)
+    )
+  `);
+    // Add model column if it doesn't exist (migration for existing tables)
+    await client.unsafe(`
+    DO $$
+    BEGIN
+      IF NOT EXISTS (
+        SELECT 1 FROM information_schema.columns
+        WHERE table_schema = '${s}'
+        AND table_name = 'endpoints'
+        AND column_name = 'model'
+      ) THEN
+        ALTER TABLE ${s}.endpoints ADD COLUMN model VARCHAR(255);
+      END IF;
+    END $$;
+  `);
+    // Add call_count column if it doesn't exist (migration for existing tables).
+    // Existing endpoints start at 0 rather than backfilling from usage_analytics:
+    // the counter is a forward-looking tally, and a backfill would silently
+    // disagree with any analytics rows that have since been pruned.
+    await client.unsafe(`
+    DO $$
+    BEGIN
+      IF NOT EXISTS (
+        SELECT 1 FROM information_schema.columns
+        WHERE table_schema = '${s}'
+        AND table_name = 'endpoints'
+        AND column_name = 'call_count'
+      ) THEN
+        ALTER TABLE ${s}.endpoints
+          ADD COLUMN call_count INTEGER NOT NULL DEFAULT 0;
+      END IF;
+    END $$;
+  `);
+    // Create index for project_id lookups
+    await client.unsafe(`
+    CREATE INDEX IF NOT EXISTS ${p}_endpoints_project_idx
+    ON ${s}.endpoints(project_id)
+  `);
+    // =============================================================================
+    // Step 6: Create usage_analytics table (references endpoints.uuid)
+    // =============================================================================
+    await client.unsafe(`
+    CREATE TABLE IF NOT EXISTS ${s}.usage_analytics (
+      uuid UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      endpoint_id UUID NOT NULL REFERENCES ${s}.endpoints(uuid) ON DELETE CASCADE,
+      timestamp TIMESTAMP NOT NULL DEFAULT NOW(),
+      success BOOLEAN NOT NULL,
+      error_message TEXT,
+      tokens_input INTEGER,
+      tokens_output INTEGER,
+      latency_ms INTEGER,
+      estimated_cost_cents INTEGER,
+      request_metadata JSONB
+    )
+  `);
+    // Create indexes for analytics queries
+    await client.unsafe(`
+    CREATE INDEX IF NOT EXISTS idx_usage_endpoint_timestamp
+    ON ${s}.usage_analytics(endpoint_id, timestamp DESC)
+  `);
+    // =============================================================================
+    // Step 7: Rate limit counters table
+    // =============================================================================
+    await initRateLimitTable(client, s, p);
+    // =============================================================================
+    // Step 8: Entity Storage Configs table (for generated media uploads)
+    // =============================================================================
+    await client.unsafe(`
+    CREATE TABLE IF NOT EXISTS ${s}.entity_storage_configs (
+      uuid UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      entity_id UUID NOT NULL UNIQUE REFERENCES ${s}.entities(id) ON DELETE CASCADE,
+      provider VARCHAR(20) NOT NULL,
+      bucket VARCHAR(255) NOT NULL,
+      path_prefix VARCHAR(500),
+      encrypted_credentials TEXT NOT NULL,
+      encryption_iv VARCHAR(32) NOT NULL,
+      created_at TIMESTAMP DEFAULT NOW(),
+      updated_at TIMESTAMP DEFAULT NOW(),
+      created_by VARCHAR(128) NOT NULL
+    )
+  `);
+    // Create index for entity_id lookups
+    await client.unsafe(`
+    CREATE INDEX IF NOT EXISTS ${p}_entity_storage_configs_entity_idx
+    ON ${s}.entity_storage_configs(entity_id)
+  `);
+    // =============================================================================
+    // Step 9: Add multimodal columns to endpoints table (migration for existing DBs)
+    // =============================================================================
+    // Add expects_media_output column
+    await client.unsafe(`
+    DO $$
+    BEGIN
+      IF NOT EXISTS (
+        SELECT 1 FROM information_schema.columns
+        WHERE table_schema = '${s}'
+        AND table_name = 'endpoints'
+        AND column_name = 'expects_media_output'
+      ) THEN
+        ALTER TABLE ${s}.endpoints ADD COLUMN expects_media_output JSONB;
+      END IF;
+    END $$;
+  `);
+    // Add output_media_format column
+    await client.unsafe(`
+    DO $$
+    BEGIN
+      IF NOT EXISTS (
+        SELECT 1 FROM information_schema.columns
+        WHERE table_schema = '${s}'
+        AND table_name = 'endpoints'
+        AND column_name = 'output_media_format'
+      ) THEN
+        ALTER TABLE ${s}.endpoints ADD COLUMN output_media_format VARCHAR(20);
+      END IF;
+    END $$;
+  `);
+    // Add web_search column
+    await client.unsafe(`
+    DO $$
+    BEGIN
+      IF NOT EXISTS (
+        SELECT 1 FROM information_schema.columns
+        WHERE table_schema = '${s}'
+        AND table_name = 'endpoints'
+        AND column_name = 'web_search'
+      ) THEN
+        ALTER TABLE ${s}.endpoints ADD COLUMN web_search BOOLEAN DEFAULT false;
+      END IF;
+    END $$;
+  `);
+    // Add temperature column
+    await client.unsafe(`
+    DO $$
+    BEGIN
+      IF NOT EXISTS (
+        SELECT 1 FROM information_schema.columns
+        WHERE table_schema = '${s}'
+        AND table_name = 'endpoints'
+        AND column_name = 'temperature'
+      ) THEN
+        ALTER TABLE ${s}.endpoints ADD COLUMN temperature REAL;
+      END IF;
+    END $$;
+  `);
+    // Add transcription_extraction_model column
+    await client.unsafe(`
+    DO $$
+    BEGIN
+      IF NOT EXISTS (
+        SELECT 1 FROM information_schema.columns
+        WHERE table_schema = '${s}'
+        AND table_name = 'endpoints'
+        AND column_name = 'transcription_extraction_model'
+      ) THEN
+        ALTER TABLE ${s}.endpoints ADD COLUMN transcription_extraction_model VARCHAR(255);
+      END IF;
+    END $$;
+  `);
+    // Add max_output_tokens column.
+    // Intentionally nullable with NO default and NO backfill: NULL means "no
+    // runaway protection", and existing endpoints must keep behaving exactly as
+    // they did. Adding a default here would silently cap live endpoints whose
+    // callers depend on longer answers.
+    await client.unsafe(`
+    DO $$
+    BEGIN
+      IF NOT EXISTS (
+        SELECT 1 FROM information_schema.columns
+        WHERE table_schema = '${s}'
+        AND table_name = 'endpoints'
+        AND column_name = 'max_output_tokens'
+      ) THEN
+        ALTER TABLE ${s}.endpoints ADD COLUMN max_output_tokens INTEGER;
+      END IF;
+    END $$;
+  `);
+    // =============================================================================
+    // Step 10: Provider binding (service extraction)
+    // provider: which LLM the endpoint calls, written by bindEndpoint.
+    // llm_key_id: relaxed to nullable; products without per-entity keys leave it
+    // null. Apps that keep a key table add their own FK and backfill provider.
+    // =============================================================================
+    await client.unsafe(`
+    ALTER TABLE ${s}.endpoints ADD COLUMN IF NOT EXISTS provider ${s}.llm_provider
+  `);
+    await client.unsafe(`
+    ALTER TABLE ${s}.endpoints ALTER COLUMN llm_key_id DROP NOT NULL
+  `);
+}
+//# sourceMappingURL=init.js.map

package/dist/schema/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/schema/init.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,MAAM,UAAU,GAAG,oBAAoB,CAAC;AAExC,SAAS,UAAU,CAAC,KAAa,EAAE,IAAY;IAC7C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,KAAK,iBAAiB,UAAU,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAW,EACX,IAAiD;IAEjD,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACpD,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAEtD,oCAAoC;IACpC,MAAM,MAAM,CAAC,MAAM,CAAC,+BAA+B,CAAC,EAAE,CAAC,CAAC;IAExD,qCAAqC;IACrC,MAAM,MAAM,CAAC,MAAM,CAAC;;oBAEF,CAAC;;;;GAIlB,CAAC,CAAC;IAEH,6EAA6E;IAC7E,MAAM,MAAM,CAAC,MAAM,CAAC;;;;0FAIoE,CAAC;qBACtE,CAAC;;;yFAGmE,CAAC;qBACrE,CAAC;;;uFAGiE,CAAC;qBACnE,CAAC;;;sFAGgE,CAAC;qBAClE,CAAC;;;2FAGqE,CAAC;qBACvE,CAAC;;;6FAGuE,CAAC;qBACzE,CAAC;;;4FAGsE,CAAC;qBACxE,CAAC;;;GAGnB,CAAC,CAAC;IAEH,MAAM,MAAM,CAAC,MAAM,CAAC;;oBAEF,CAAC;;;;GAIlB,CAAC,CAAC;IAEH,gFAAgF;IAChF,gDAAgD;IAChD,sCAAsC;IACtC,gFAAgF;IAEhF,MAAM,MAAM,CAAC,MAAM,CAAC;iCACW,CAAC;;;;;;;GAO/B,CAAC,CAAC;IAEH,MAAM,MAAM,CAAC,MAAM,CAAC;iCACW,CAAC;;6DAE2B,CAAC;;;;;;GAM3D,CAAC,CAAC;IAEH,gFAAgF;IAChF,yEAAyE;IACzE,4DAA4D;IAC5D,gFAAgF;IAEhF,MAAM,kBAAkB,CAAC;QACvB,MAAM,EAAE,MAAa,EAAE,mDAAmD;QAC1E,UAAU,EAAE,CAAC;QACb,WAAW,EAAE,CAAC;QACd,eAAe,EAAE,KAAK,EAAE,0CAA0C;QAClE,YAAY,EAAE,KAAK,EAAE,uDAAuD;KAC7E,CAAC,CAAC;IAEH,gFAAgF;IAChF,sEAAsE;IACtE,mEAAmE;IACnE,gFAAgF;IAEhF,MAAM,MAAM,CAAC,MAAM,CAAC;iCACW,CAAC;;sDAEoB,CAAC;;;;;;;;;;;GAWpD,CAAC,CAAC;IAEH,MAAM,MAAM,CAAC,MAAM,CAAC;iCACW,CAAC;WACvB,CAAC;GACT,CAAC,CAAC;IAEH,MAAM,MAAM,CAAC,MAAM,CAAC;wCACkB,CAAC;WAC9B,CAAC;GACT,CAAC,CAAC;IAEH,gFAAgF;IAChF,iEAAiE;IACjE,2DAA2D;IAC3D,gFAAgF;IAEhF,MAAM,MAAM,CAAC,MAAM,CAAC;iCACW,CAAC;;2CAES,CAAC;;;;;;;;;;GAUzC,CAAC,CAAC;IAEH,MAAM,MAAM,CAAC,MAAM,CAAC;wCACkB,CAAC;WAC9B,CAAC;GACT,CAAC,CAAC;IAEH,MAAM,MAAM,CAAC,MAAM,CAAC;iCACW,CAAC;WACvB,CAAC;GACT,CAAC,CAAC;IAEH,MAAM,MAAM,CAAC,MAAM,CAAC;iCACW,CAAC;WACvB,CAAC;GACT,CAAC,CAAC;IAEH,gFAAgF;IAChF,yDAAyD;IACzD,gFAAgF;IAEhF,MAAM,MAAM,CAAC,MAAM,CAAC;iCACW,CAAC;;2CAES,CAAC;;;;;;;;;;;;GAYzC,CAAC,CAAC;IAEH,kDAAkD;IAClD,MAAM,MAAM,CAAC,MAAM,CAAC;;SAEb,CAAC;GACP,CAAC,CAAC;IAEH,qCAAqC;IACrC,MAAM,MAAM,CAAC,MAAM,CAAC;iCACW,CAAC;SACzB,CAAC;GACP,CAAC,CAAC;IAEH,gFAAgF;IAChF,4DAA4D;IAC5D,gFAAgF;IAEhF,MAAM,MAAM,CAAC,MAAM,CAAC;iCACW,CAAC;;4CAEU,CAAC;;;oBAGzB,CAAC;;iBAEJ,CAAC;;;;;;;;;;;;;GAaf,CAAC,CAAC;IAEH,uEAAuE;IACvE,MAAM,MAAM,CAAC,MAAM,CAAC;;;;;gCAKU,CAAC;;;;sBAIX,CAAC;;;GAGpB,CAAC,CAAC;IAEH,6EAA6E;IAC7E,8EAA8E;IAC9E,wEAAwE;IACxE,gEAAgE;IAChE,MAAM,MAAM,CAAC,MAAM,CAAC;;;;;gCAKU,CAAC;;;;sBAIX,CAAC;;;;GAIpB,CAAC,CAAC;IAEH,sCAAsC;IACtC,MAAM,MAAM,CAAC,MAAM,CAAC;iCACW,CAAC;SACzB,CAAC;GACP,CAAC,CAAC;IAEH,gFAAgF;IAChF,mEAAmE;IACnE,gFAAgF;IAEhF,MAAM,MAAM,CAAC,MAAM,CAAC;iCACW,CAAC;;6CAEW,CAAC;;;;;;;;;;GAU3C,CAAC,CAAC;IAEH,uCAAuC;IACvC,MAAM,MAAM,CAAC,MAAM,CAAC;;SAEb,CAAC;GACP,CAAC,CAAC;IAEH,gFAAgF;IAChF,oCAAoC;IACpC,gFAAgF;IAEhF,MAAM,kBAAkB,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAEvC,gFAAgF;IAChF,qEAAqE;IACrE,gFAAgF;IAEhF,MAAM,MAAM,CAAC,MAAM,CAAC;iCACW,CAAC;;kDAEgB,CAAC;;;;;;;;;;GAUhD,CAAC,CAAC;IAEH,qCAAqC;IACrC,MAAM,MAAM,CAAC,MAAM,CAAC;iCACW,CAAC;SACzB,CAAC;GACP,CAAC,CAAC;IAEH,gFAAgF;IAChF,iFAAiF;IACjF,gFAAgF;IAEhF,kCAAkC;IAClC,MAAM,MAAM,CAAC,MAAM,CAAC;;;;;gCAKU,CAAC;;;;sBAIX,CAAC;;;GAGpB,CAAC,CAAC;IAEH,iCAAiC;IACjC,MAAM,MAAM,CAAC,MAAM,CAAC;;;;;gCAKU,CAAC;;;;sBAIX,CAAC;;;GAGpB,CAAC,CAAC;IAEH,wBAAwB;IACxB,MAAM,MAAM,CAAC,MAAM,CAAC;;;;;gCAKU,CAAC;;;;sBAIX,CAAC;;;GAGpB,CAAC,CAAC;IAEH,yBAAyB;IACzB,MAAM,MAAM,CAAC,MAAM,CAAC;;;;;gCAKU,CAAC;;;;sBAIX,CAAC;;;GAGpB,CAAC,CAAC;IAEH,4CAA4C;IAC5C,MAAM,MAAM,CAAC,MAAM,CAAC;;;;;gCAKU,CAAC;;;;sBAIX,CAAC;;;GAGpB,CAAC,CAAC;IAEH,gCAAgC;IAChC,yEAAyE;IACzE,4EAA4E;IAC5E,0EAA0E;IAC1E,oCAAoC;IACpC,MAAM,MAAM,CAAC,MAAM,CAAC;;;;;gCAKU,CAAC;;;;sBAIX,CAAC;;;GAGpB,CAAC,CAAC;IAEH,gFAAgF;IAChF,iDAAiD;IACjD,mEAAmE;IACnE,6EAA6E;IAC7E,2EAA2E;IAC3E,gFAAgF;IAEhF,MAAM,MAAM,CAAC,MAAM,CAAC;kBACJ,CAAC,gDAAgD,CAAC;GACjE,CAAC,CAAC;IAEH,MAAM,MAAM,CAAC,MAAM,CAAC;kBACJ,CAAC;GAChB,CAAC,CAAC;AACL,CAAC"}