streamby-core 0.35.0 → 0.37.0

package/dist/mcp/tools.js

@@ -0,0 +1,286 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TOOLS = void 0;
+const zod_1 = require("zod");
+const tool = (definition) => definition;
+const id = (what) => zod_1.z.string().min(1).describe(`The ${what}'s id`);
+const projectId = id('project');
+const enc = encodeURIComponent;
+const byProject = ({ projectId }) => projectId;
+const CATEGORIES = ['images', 'audios', 'videos', '3d-models'];
+const shotFields = {
+    description: zod_1.z.string().optional(),
+    status: zod_1.z.string().optional().describe('Its status, as the project uses them'),
+    assignedTo: zod_1.z.string().optional().describe("The assignee's user id"),
+    assetId: zod_1.z.string().optional(),
+    exportId: zod_1.z.string().optional(),
+    dueDate: zod_1.z.string().optional().describe('An ISO 8601 date'),
+    order: zod_1.z.number().optional(),
+};
+const taskFields = {
+    status: zod_1.z.string().optional(),
+    priority: zod_1.z.string().optional(),
+    assignedTo: zod_1.z.string().optional().describe("The assignee's user id"),
+    dueDate: zod_1.z.string().optional().describe('An ISO 8601 date'),
+    notes: zod_1.z.string().optional(),
+};
+const rightsFields = {
+    rightsHolder: zod_1.z.string().optional(),
+    licenseType: zod_1.z.string().optional().describe('e.g. CC0, CC BY 4.0, proprietary'),
+    licenseUrl: zod_1.z.string().optional(),
+    territory: zod_1.z.string().optional(),
+    expiresAt: zod_1.z.string().optional().describe('An ISO 8601 date'),
+    usageRestrictions: zod_1.z.string().optional(),
+    notes: zod_1.z.string().optional(),
+};
+// Only the fields given (an unset optional field isn't sent as undefined).
+const defined = (fields) => Object.fromEntries(Object.entries(fields).filter(([, value]) => value !== undefined));
+exports.TOOLS = [
+    // ── Reading ──
+    tool({
+        name: 'list_projects', title: 'List projects', permissions: [],
+        description: 'The StreamBy projects this token reaches.',
+        input: {},
+        call: () => ({ method: 'GET', path: '/projects' }),
+        pick: (data) => data.projects,
+    }),
+    tool({
+        name: 'get_project', title: 'Get a project', permissions: ['project:read'],
+        description: "A project's details: its name, description, members, exports and connections.",
+        input: { projectId },
+        projectOf: byProject,
+        call: ({ projectId }) => ({ method: 'GET', path: `/projects/${enc(projectId)}` }),
+    }),
+    tool({
+        name: 'list_assets', title: 'List assets', permissions: ['assets:read'],
+        description: "A project's assets of a category (images, audios, videos, 3d-models), optionally in one storage connection, and optionally only those whose name contains `query`.",
+        input: {
+            projectId,
+            category: zod_1.z.enum(CATEGORIES),
+            connectionId: zod_1.z.string().optional().describe("A storage connection's id; the project's built-in storage if not given"),
+            query: zod_1.z.string().optional().describe('Only assets whose name contains it (case-insensitive)'),
+        },
+        projectOf: byProject,
+        call: ({ projectId, category, connectionId }) => ({
+            method: 'GET',
+            path: connectionId
+                ? `/projects/${enc(projectId)}/connections/storage/${enc(connectionId)}/files/${category}`
+                : `/projects/${enc(projectId)}/storage/${category}`,
+        }),
+        pick: (data, { query }) => {
+            const files = Array.isArray(data?.data) ? data.data : [];
+            if (!query)
+                return files;
+            const q = query.toLowerCase();
+            return files.filter(f => [f.name, f.displayName, f.originalName, f.fileName]
+                .some(n => typeof n === 'string' && n.toLowerCase().includes(q)));
+        },
+    }),
+    tool({
+        name: 'get_asset_metadata', title: "Get an asset's metadata", permissions: ['assets:read'],
+        description: "An asset's metadata (technical data and custom tags).",
+        input: { projectId, fileId: id('asset') },
+        projectOf: byProject,
+        call: ({ projectId, fileId }) => ({ method: 'GET', path: `/projects/${enc(projectId)}/assets/${enc(fileId)}/metadata` }),
+    }),
+    tool({
+        name: 'get_asset_rights', title: "Get an asset's rights", permissions: ['rights:read'],
+        description: "An asset's rights: holder, license, territory, expiry and restrictions.",
+        input: { projectId, assetId: id('asset') },
+        projectOf: byProject,
+        call: ({ projectId, assetId }) => ({ method: 'GET', path: `/projects/${enc(projectId)}/assets/${enc(assetId)}/rights` }),
+    }),
+    tool({
+        name: 'get_workflow', title: "Get a project's workflow", permissions: ['workflow:read'],
+        description: "A project's workflow (its node graph).",
+        input: { projectId },
+        projectOf: byProject,
+        call: ({ projectId }) => ({ method: 'GET', path: `/projects/${enc(projectId)}/workflow` }),
+    }),
+    tool({
+        name: 'list_pipelines', title: 'List pipelines', permissions: ['workflow:read'],
+        description: "A project's pipelines.",
+        input: { projectId },
+        projectOf: byProject,
+        call: ({ projectId }) => ({ method: 'GET', path: `/projects/${enc(projectId)}/pipelines` }),
+    }),
+    tool({
+        name: 'get_pipeline', title: 'Get a pipeline', permissions: ['workflow:read'],
+        description: 'A pipeline, with its node schema.',
+        input: { projectId, pipelineId: id('pipeline') },
+        projectOf: byProject,
+        call: ({ projectId, pipelineId }) => ({ method: 'GET', path: `/projects/${enc(projectId)}/pipelines/${enc(pipelineId)}` }),
+    }),
+    tool({
+        name: 'list_exports', title: 'List exports', permissions: ['project:read', 'exports:read'],
+        description: "A project's exports (its published endpoints).",
+        input: { projectId },
+        projectOf: byProject,
+        call: ({ projectId }) => ({ method: 'GET', path: `/projects/${enc(projectId)}` }),
+        pick: (data) => data?.project?.exports ?? data?.exports ?? [],
+    }),
+    tool({
+        name: 'get_export', title: 'Get an export', permissions: ['exports:read'],
+        description: 'An export, with its node schema.',
+        input: { projectId, exportId: id('export') },
+        projectOf: byProject,
+        call: ({ projectId, exportId }) => ({ method: 'GET', path: `/projects/${enc(projectId)}/exports/${enc(exportId)}` }),
+    }),
+    tool({
+        name: 'get_job', title: 'Get a job', permissions: ['jobs:read'],
+        description: "A job's status and progress (transcoding, rendering, ingesting...).",
+        input: { jobId: id('job') },
+        call: ({ jobId }) => ({ method: 'GET', path: `/jobs/${enc(jobId)}` }),
+    }),
+    tool({
+        name: 'list_sequences', title: 'List production sequences', permissions: ['production:read'],
+        description: "A project's production sequences.",
+        input: { projectId },
+        projectOf: byProject,
+        call: ({ projectId }) => ({ method: 'GET', path: `/projects/${enc(projectId)}/production/sequences` }),
+    }),
+    tool({
+        name: 'list_shots', title: 'List shots', permissions: ['production:read'],
+        description: "A production sequence's shots.",
+        input: { projectId, sequenceId: id('sequence') },
+        projectOf: byProject,
+        call: ({ projectId, sequenceId }) => ({ method: 'GET', path: `/projects/${enc(projectId)}/production/sequences/${enc(sequenceId)}/shots` }),
+    }),
+    tool({
+        name: 'list_tasks', title: 'List shot tasks', permissions: ['production:read'],
+        description: "A shot's tasks.",
+        input: { projectId, shotId: id('shot') },
+        projectOf: byProject,
+        call: ({ projectId, shotId }) => ({ method: 'GET', path: `/projects/${enc(projectId)}/production/shots/${enc(shotId)}/tasks` }),
+    }),
+    // ── Writing ──
+    tool({
+        name: 'update_asset_metadata', title: "Update an asset's custom tags", permissions: ['assets:write'], write: true,
+        description: "Sets an asset's custom tags (key/value pairs), replacing the ones it had.",
+        input: { projectId, fileId: id('asset'), customTags: zod_1.z.record(zod_1.z.string(), zod_1.z.string()) },
+        projectOf: byProject,
+        call: ({ projectId, fileId, customTags }) => ({ method: 'PATCH', path: `/projects/${enc(projectId)}/assets/${enc(fileId)}/metadata`, body: { customTags } }),
+    }),
+    tool({
+        name: 'set_asset_rights', title: "Set an asset's rights", permissions: ['rights:write'], write: true,
+        description: "Sets an asset's rights: holder, license, territory, expiry, restrictions and notes.",
+        input: { projectId, assetId: id('asset'), ...rightsFields },
+        projectOf: byProject,
+        call: ({ projectId, assetId, ...rights }) => ({ method: 'PUT', path: `/projects/${enc(projectId)}/assets/${enc(assetId)}/rights`, body: defined(rights) }),
+    }),
+    tool({
+        name: 'create_pipeline', title: 'Create a pipeline', permissions: ['workflow:write'], write: true,
+        description: 'Creates a pipeline in a project.',
+        input: { projectId, name: zod_1.z.string().min(1), description: zod_1.z.string().optional(), order: zod_1.z.number().optional() },
+        projectOf: byProject,
+        call: ({ projectId, ...fields }) => ({ method: 'POST', path: `/projects/${enc(projectId)}/pipelines`, body: defined(fields) }),
+    }),
+    tool({
+        name: 'update_pipeline', title: 'Update a pipeline', permissions: ['workflow:write'], write: true,
+        description: "Changes a pipeline's name, description or order.",
+        input: { projectId, pipelineId: id('pipeline'), name: zod_1.z.string().min(1).optional(), description: zod_1.z.string().optional(), order: zod_1.z.number().optional() },
+        projectOf: byProject,
+        call: ({ projectId, pipelineId, ...fields }) => ({ method: 'PATCH', path: `/projects/${enc(projectId)}/pipelines/${enc(pipelineId)}`, body: defined(fields) }),
+    }),
+    tool({
+        name: 'create_sequence', title: 'Create a production sequence', permissions: ['production:write'], write: true,
+        description: 'Creates a production sequence in a project.',
+        input: { projectId, name: zod_1.z.string().min(1), description: zod_1.z.string().optional(), order: zod_1.z.number().optional() },
+        projectOf: byProject,
+        call: ({ projectId, ...fields }) => ({ method: 'POST', path: `/projects/${enc(projectId)}/production/sequences`, body: defined(fields) }),
+    }),
+    tool({
+        name: 'update_sequence', title: 'Update a production sequence', permissions: ['production:write'], write: true,
+        description: "Changes a sequence's name, description or order.",
+        input: { projectId, sequenceId: id('sequence'), name: zod_1.z.string().min(1).optional(), description: zod_1.z.string().optional(), order: zod_1.z.number().optional() },
+        projectOf: byProject,
+        call: ({ projectId, sequenceId, ...fields }) => ({ method: 'PATCH', path: `/projects/${enc(projectId)}/production/sequences/${enc(sequenceId)}`, body: defined(fields) }),
+    }),
+    tool({
+        name: 'create_shot', title: 'Create a shot', permissions: ['production:write'], write: true,
+        description: 'Creates a shot in a production sequence.',
+        input: { projectId, sequenceId: id('sequence'), name: zod_1.z.string().min(1), ...shotFields },
+        projectOf: byProject,
+        call: ({ projectId, sequenceId, ...fields }) => ({ method: 'POST', path: `/projects/${enc(projectId)}/production/sequences/${enc(sequenceId)}/shots`, body: defined(fields) }),
+    }),
+    tool({
+        name: 'update_shot', title: 'Update a shot', permissions: ['production:write'], write: true,
+        description: 'Changes a shot (its name, status, assignee, due date...).',
+        input: { projectId, shotId: id('shot'), name: zod_1.z.string().min(1).optional(), ...shotFields },
+        projectOf: byProject,
+        call: ({ projectId, shotId, ...fields }) => ({ method: 'PATCH', path: `/projects/${enc(projectId)}/production/shots/${enc(shotId)}`, body: defined(fields) }),
+    }),
+    tool({
+        name: 'create_task', title: 'Create a shot task', permissions: ['production:write'], write: true,
+        description: 'Creates a task in a shot.',
+        input: { projectId, shotId: id('shot'), name: zod_1.z.string().min(1), ...taskFields },
+        projectOf: byProject,
+        call: ({ projectId, shotId, ...fields }) => ({ method: 'POST', path: `/projects/${enc(projectId)}/production/shots/${enc(shotId)}/tasks`, body: defined(fields) }),
+    }),
+    tool({
+        name: 'update_task', title: 'Update a shot task', permissions: ['production:write'], write: true,
+        description: 'Changes a task (its name, status, priority, assignee, due date, notes).',
+        input: { projectId, shotId: id('shot'), taskId: id('task'), name: zod_1.z.string().min(1).optional(), ...taskFields },
+        projectOf: byProject,
+        call: ({ projectId, shotId, taskId, ...fields }) => ({ method: 'PATCH', path: `/projects/${enc(projectId)}/production/shots/${enc(shotId)}/tasks/${enc(taskId)}`, body: defined(fields) }),
+    }),
+    // ── Projects ──
+    tool({
+        name: 'create_project', title: 'Create a project', permissions: ['projects:create'], write: true,
+        description: 'Creates a StreamBy project, its maker being its admin, as from "New project" in the UI. The token reaches it from then on.',
+        input: {
+            name: zod_1.z.string().min(1),
+            description: zod_1.z.string().optional(),
+            public: zod_1.z.boolean().optional().describe('Whether it shows in Explore (true if not given; a private one needs a subscriber plan)'),
+            category: zod_1.z.string().optional(),
+        },
+        call: (fields) => ({ method: 'POST', path: '/projects/create', body: defined(fields) }),
+        pick: (data) => ({ projectId: data?.projectId, message: data?.message }),
+    }),
+    tool({
+        name: 'delete_project', title: 'Delete a project', permissions: ['project:delete'], write: true, destructive: true,
+        description: 'Deletes a project, with everything in it, for every member. It cannot be undone.',
+        input: { projectId },
+        projectOf: byProject,
+        call: ({ projectId }) => ({ method: 'DELETE', path: `/projects/${enc(projectId)}` }),
+        pick: (data) => ({ message: data?.message }),
+    }),
+    // ── Deleting ──
+    tool({
+        name: 'delete_asset', title: 'Delete an asset', permissions: ['assets:delete'], write: true, destructive: true,
+        description: "Deletes an asset's file, from the project's built-in storage or from one of its storage connections. It cannot be undone.",
+        input: {
+            projectId,
+            fileId: id('asset'),
+            connectionId: zod_1.z.string().optional().describe("The storage connection it's in; the project's built-in storage if not given"),
+        },
+        projectOf: byProject,
+        call: ({ projectId, fileId, connectionId }) => ({
+            method: 'DELETE',
+            path: connectionId
+                ? `/projects/${enc(projectId)}/connections/storage/${enc(connectionId)}/files/${enc(fileId)}`
+                : `/projects/${enc(projectId)}/storage/files/${enc(fileId)}`,
+        }),
+    }),
+    tool({
+        name: 'delete_sequence', title: 'Delete a production sequence', permissions: ['production:delete'], write: true, destructive: true,
+        description: 'Deletes a production sequence, with its shots. It cannot be undone.',
+        input: { projectId, sequenceId: id('sequence') },
+        projectOf: byProject,
+        call: ({ projectId, sequenceId }) => ({ method: 'DELETE', path: `/projects/${enc(projectId)}/production/sequences/${enc(sequenceId)}` }),
+    }),
+    tool({
+        name: 'delete_shot', title: 'Delete a shot', permissions: ['production:delete'], write: true, destructive: true,
+        description: 'Deletes a shot, with its tasks. It cannot be undone.',
+        input: { projectId, shotId: id('shot') },
+        projectOf: byProject,
+        call: ({ projectId, shotId }) => ({ method: 'DELETE', path: `/projects/${enc(projectId)}/production/shots/${enc(shotId)}` }),
+    }),
+    tool({
+        name: 'delete_task', title: 'Delete a shot task', permissions: ['production:delete'], write: true, destructive: true,
+        description: "Deletes a shot's task. It cannot be undone.",
+        input: { projectId, shotId: id('shot'), taskId: id('task') },
+        projectOf: byProject,
+        call: ({ projectId, shotId, taskId }) => ({ method: 'DELETE', path: `/projects/${enc(projectId)}/production/shots/${enc(shotId)}/tasks/${enc(taskId)}` }),
+    }),
+];

package/dist/middleware/createRouter.js

@@ -13,6 +13,7 @@ const reencryptCredentials_1 = require("../services/reencryptCredentials");
 const wsHub_1 = require("../services/wsHub");
 const auth_1 = require("../services/auth");
 const apiToken_1 = require("./routes/apiToken");
+const mcp_1 = require("./routes/mcp");
 const encryption_1 = require("../utils/encryption");
 const auth_2 = require("./routes/auth");
 const user_1 = require("./routes/user");
@@ -97,6 +98,7 @@ function createStreamByRouter(config) {
             (0, manager_1.registerModel)('user_subscriptions', [mainDb.id], 'user_subscriptions', 'streamby');
             (0, manager_1.registerModel)('user_integrations', [mainDb.id], 'user_integrations', streambySchema);
             (0, manager_1.registerModel)('api_tokens', [mainDb.id], 'api_tokens', streambySchema);
+            (0, manager_1.registerModel)('mcp_audit', [mainDb.id], 'mcp_audit', streambySchema);
         }
     }
     if (config.websocket?.server) {
@@ -110,6 +112,7 @@ function createStreamByRouter(config) {
     router.use(subscription_1.ensureSubscription);
     router.use((0, user_1.userRouter)(config));
     router.use((0, apiToken_1.apiTokenRouter)(config));
+    router.use((0, mcp_1.mcpRouter)(config));
     router.use((0, export_1.exportRouter)(config));
     router.use((0, member_1.memberRouter)(config));
     router.use((0, storage_2.storageRouter)(config));

package/dist/middleware/routes/apiToken.js

@@ -5,25 +5,34 @@ const express_1 = require("express");
 const manager_1 = require("../../models/manager");
 const auth_1 = require("../../utils/auth");
 const apiTokens_1 = require("../../services/apiTokens");
-// The signed-in user's own API tokens (see services/apiTokens): listed, made, revoked. Only
-// with a session: a token can't manage tokens (see enforceApiTokenScope).
+// API tokens (see services/apiTokens), managed only with a session: no route here is
+// reachable with a token (see apiTokenPermissions).
+//
+// - A user's own: listed, made and revoked by them.
+// - A project's: listed, made and revoked by its admins only.
 function apiTokenRouter(config) {
     const router = (0, express_1.Router)();
     const Project = (0, manager_1.getModel)('projects');
+    const failed = (res, what, err) => {
+        if (err instanceof apiTokens_1.ApiTokenError)
+            return res.status(err.status).json({ message: err.message });
+        res.status(500).json({ message: `Failed to ${what}`, details: err.message });
+    };
+    // The token itself is in the response that makes it only: it's never stored, nor shown again.
+    const created = (res, token, info) => res.status(201).json({ token, apiToken: info, message: 'Copy the token now: it will not be shown again' });
     router.get('/user/api-tokens', async (req, res) => {
         try {
             const auth = req.auth;
-            res.json({ apiTokens: await (0, apiTokens_1.listApiTokens)(auth.userId) });
+            res.json({ apiTokens: await (0, apiTokens_1.listUserApiTokens)(auth.userId) });
         }
         catch (err) {
-            res.status(500).json({ message: 'Failed to list API tokens', details: err.message });
+            failed(res, 'list API tokens', err);
         }
     });
-    // The token itself is in this response only: it's never stored, nor shown again.
     router.post('/user/api-tokens', async (req, res) => {
         try {
             const auth = req.auth;
-            const { name, access, projectIds, expiresInDays } = req.body ?? {};
+            const { name, permissions, projectIds, expiresInDays } = req.body ?? {};
             // A token reaches only projects its owner is in.
             if (Array.isArray(projectIds)) {
                 for (const id of projectIds) {
@@ -33,25 +42,79 @@ function apiTokenRouter(config) {
                     }
                 }
             }
-            const { token, info } = await (0, apiTokens_1.createApiToken)(auth.userId, { name, access, projectIds, expiresInDays: expiresInDays ?? null }, config);
-            res.status(201).json({ token, apiToken: info, message: 'Copy the token now: it will not be shown again' });
+            const { token, info } = await (0, apiTokens_1.createApiToken)({ kind: 'user', userId: auth.userId, username: auth.username }, { name, permissions, projectIds, expiresInDays: expiresInDays ?? null }, config);
+            created(res, token, info);
         }
         catch (err) {
-            if (err instanceof apiTokens_1.ApiTokenError)
-                return res.status(err.status).json({ message: err.message });
-            res.status(500).json({ message: 'Failed to create API token', details: err.message });
+            failed(res, 'create API token', err);
         }
     });
     router.delete('/user/api-tokens/:tokenId', async (req, res) => {
         try {
             const auth = req.auth;
-            const revoked = await (0, apiTokens_1.revokeApiToken)(auth.userId, req.params.tokenId);
-            if (!revoked)
+            if (!(await (0, apiTokens_1.revokeUserApiToken)(auth.userId, req.params.tokenId))) {
                 return res.status(404).json({ message: 'API token not found' });
+            }
+            res.status(204).end();
+        }
+        catch (err) {
+            failed(res, 'revoke API token', err);
+        }
+    });
+    // ── A project's tokens: its admins only ──
+    const adminsProject = async (req, res) => {
+        const auth = req.auth;
+        const project = await Project.findOne({ _id: req.params.id });
+        if (!project) {
+            res.status(404).json({ message: 'Project not found' });
+            return null;
+        }
+        if (!(0, auth_1.isProjectAdmin)(project, auth.userId)) {
+            res.status(403).json({ message: "Only a project admin manages the project's API tokens" });
+            return null;
+        }
+        return project;
+    };
+    router.get('/projects/:id/api-tokens', async (req, res) => {
+        try {
+            const project = await adminsProject(req, res);
+            if (!project)
+                return;
+            // Whether whoever made each one is still in the project: it keeps working if they aren't.
+            const apiTokens = (await (0, apiTokens_1.listProjectApiTokens)(req.params.id)).map(token => ({
+                ...token,
+                createdBy: { ...token.createdBy, isMember: !!(0, auth_1.activeMemberOf)(project, token.createdBy.userId) },
+            }));
+            res.json({ apiTokens });
+        }
+        catch (err) {
+            failed(res, "list the project's API tokens", err);
+        }
+    });
+    router.post('/projects/:id/api-tokens', async (req, res) => {
+        try {
+            const auth = req.auth;
+            if (!(await adminsProject(req, res)))
+                return;
+            const { name, permissions, expiresInDays } = req.body ?? {};
+            const { token, info } = await (0, apiTokens_1.createApiToken)({ kind: 'project', userId: auth.userId, username: auth.username, projectId: req.params.id }, { name, permissions, expiresInDays: expiresInDays ?? null }, config);
+            created(res, token, info);
+        }
+        catch (err) {
+            failed(res, "create the project's API token", err);
+        }
+    });
+    router.delete('/projects/:id/api-tokens/:tokenId', async (req, res) => {
+        try {
+            if (!(await adminsProject(req, res)))
+                return;
+            if (!(await (0, apiTokens_1.revokeProjectApiToken)(req.params.id, req.params.tokenId))) {
+                return res.status(404).json({ message: 'API token not found' });
+            }
             res.status(204).end();
         }
         catch (err) {
-            res.status(500).json({ message: 'Failed to revoke API token', details: err.message });
+            failed(res, "revoke the project's API token", err);
         }
     });
     return router;

package/dist/middleware/routes/mcp.d.ts

@@ -0,0 +1,3 @@
+import { Router } from 'express';
+import { StreamByConfig } from '../../types';
+export declare function mcpRouter(config: StreamByConfig): Router;

package/dist/middleware/routes/mcp.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mcpRouter = mcpRouter;
+const express_1 = require("express");
+const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/server/streamableHttp.js");
+const server_1 = require("../../mcp/server");
+const rateLimit_1 = require("../../mcp/rateLimit");
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+const { version } = require('../../../package.json');
+const jsonRpcError = (res, status, message) => res.status(status).json({ jsonrpc: '2.0', error: { code: -32000, message }, id: null });
+// StreamBy's MCP server (Streamable HTTP, stateless: one server per request), for agents
+// working with StreamBy through an API token. Each tool calls the REST API right here -- this
+// same process, under the same mount -- with the request's own Authorization header, so it
+// reaches what the token and its owner can and nothing more.
+function mcpRouter(config) {
+    const router = (0, express_1.Router)();
+    const limiter = (0, rateLimit_1.createRateLimiter)(config.mcp?.rateLimit ?? rateLimit_1.DEFAULT_MCP_RATE_LIMIT);
+    router.post('/mcp', async (req, res) => {
+        const auth = req.auth;
+        if (!auth.apiToken)
+            return jsonRpcError(res, 401, 'The MCP server takes an API token (Authorization: Bearer sbt_...)');
+        const taken = limiter.take(auth.apiToken.tokenId);
+        if (!taken.allowed) {
+            res.setHeader('Retry-After', String(Math.ceil(taken.retryAfterMs / 1000)));
+            return jsonRpcError(res, 429, 'Too many requests for this API token; try again later');
+        }
+        const base = config.mcp?.apiBaseUrl ?? `http://127.0.0.1:${req.socket.localPort}${req.baseUrl}`;
+        const api = async ({ method, path, body }) => {
+            const answer = await fetch(`${base}${path}`, {
+                method,
+                headers: { Authorization: req.headers.authorization ?? '', ...(body !== undefined ? { 'Content-Type': 'application/json' } : {}) },
+                body: body !== undefined ? JSON.stringify(body) : undefined,
+                redirect: 'error',
+            });
+            const text = await answer.text();
+            let parsed = null;
+            try {
+                parsed = text ? JSON.parse(text) : null;
+            }
+            catch {
+                parsed = text;
+            }
+            return { status: answer.status, body: parsed };
+        };
+        const server = (0, server_1.createMcpServer)(auth, api, config, version);
+        const transport = new streamableHttp_js_1.StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
+        res.on('close', () => { transport.close(); server.close(); });
+        try {
+            await server.connect(transport);
+            await transport.handleRequest(req, res, req.body);
+        }
+        catch (err) {
+            console.error('❌ StreamBy MCP: request failed:', err instanceof Error ? err.message : err);
+            if (!res.headersSent)
+                jsonRpcError(res, 500, 'Internal error');
+        }
+    });
+    // Stateless: no session to stream to, nor to end.
+    router.get('/mcp', (_req, res) => jsonRpcError(res, 405, 'Method not allowed'));
+    router.delete('/mcp', (_req, res) => jsonRpcError(res, 405, 'Method not allowed'));
+    return router;
+}

package/dist/middleware/routes/member.js

@@ -7,6 +7,7 @@ const auth_1 = require("../../utils/auth");
 const connectionManager_1 = require("../../adapters/database/connectionManager");
 const sql_1 = require("../../adapters/database/sql");
 const notification_1 = require("../../services/notification");
+const apiTokens_1 = require("../../services/apiTokens");
 const VALID_ROLES = ['viewer', 'editor', 'admin'];
 function memberRouter(config) {
     const router = (0, express_1.Router)();
@@ -302,6 +303,13 @@ function memberRouter(config) {
             else {
                 await Project.update({ _id: projectId }, { $pull: { members: { userId: targetUserId } } });
             }
+            // A project's tokens they made keep working: its admins should know.
+            const tokens = await (0, apiTokens_1.projectApiTokensMadeBy)(projectId, targetUserId);
+            if (tokens.length) {
+                const names = tokens.map(t => `"${t.name}"`).join(', ');
+                const admins = (project.members ?? []).filter((m) => m.role === 'admin' && m.status === 'active' && m.userId?.toString() !== targetUserId?.toString());
+                await Promise.all(admins.map((admin) => (0, notification_1.createNotification)(admin.userId.toString(), 'api_token_creator_left', `${tokens.length === 1 ? 'An API token' : `${tokens.length} API tokens`} of "${project.name}" (${names}) made by a member who left keep working until revoked`, { projectId, tokenIds: tokens.map(t => t.id) }).catch(() => { })));
+            }
             res.status(200).json({ message: 'Member removed successfully' });
         }
         catch (err) {

package/dist/middleware/routes/project.js

@@ -9,6 +9,7 @@ const sql_1 = require("../../adapters/database/sql");
 const sanitize_1 = require("../../utils/sanitize");
 const projectIntegration_1 = require("../../services/projectIntegration");
 const auth_2 = require("../../services/auth");
+const apiTokens_1 = require("../../services/apiTokens");
 function projectRouter(config) {
     const router = (0, express_1.Router)();
     const Project = (0, manager_1.getModel)('projects');
@@ -30,8 +31,8 @@ function projectRouter(config) {
             const allProjects = await Project.find({}); // Fetch all projects
             const projects = allProjects
                 .filter(project => {
-                const currentUserMember = project.members?.find((m) => m.userId?.toString() === auth.userId?.toString());
-                if (!currentUserMember || currentUserMember.status !== 'active')
+                const currentUserMember = (0, auth_1.activeMemberOf)(project, auth.userId?.toString());
+                if (!currentUserMember)
                     return false;
                 // With an API token, only the projects it reaches.
                 if (!(0, auth_2.scopeReachesProject)(auth.apiToken, (project._id ?? project.id)?.toString()))
@@ -122,6 +123,9 @@ function projectRouter(config) {
                 integrationConnections: [],
             });
             const newProjectId = newProject._id || newProject.id;
+            // A token that made it reaches it.
+            if (auth.apiToken?.kind === 'user')
+                await (0, apiTokens_1.addProjectToApiToken)(auth.apiToken.tokenId, String(newProjectId));
             if (dbConnections.length || storageConnections.length || integrationConnections.length) {
                 const stamped = await Project.update({ _id: newProjectId }, {
                     dbConnections: dbConnections.map(c => ({ ...c, projectId: newProjectId })),
@@ -253,6 +257,8 @@ function projectRouter(config) {
                 return res.status(403).json({ message: 'Only a project admin can delete it' });
             }
             await Project.useDbType(project.dbType).delete({ _id: projectId });
+            // Its tokens have nothing left to reach.
+            await (0, apiTokens_1.deleteProjectApiTokens)(String(projectId));
             const allProjects = await Project.find({});
             const projects = allProjects
                 .filter(project => {

package/dist/middleware/routes/subscription.js

@@ -18,6 +18,9 @@ const ensureSubscription = async (req, res, next) => {
         const auth = req.auth;
         if (!auth)
             return next();
+        // A project's token is no user: it has no plan of its own.
+        if (auth.apiToken?.kind === 'project')
+            return next();
         const plan = await resolveSubscription(auth);
         req.subscription = plan;
         next();

package/dist/services/apiTokenPermissions.d.ts

@@ -0,0 +1,16 @@
+/** Permissions on a project, for the projects a token reaches. */
+export declare const PROJECT_PERMISSIONS: readonly ["project:read", "project:update", "project:delete", "members:read", "members:manage", "assets:read", "assets:write", "assets:delete", "production:read", "production:write", "production:delete", "workflow:read", "workflow:write", "exports:read", "exports:write", "rights:read", "rights:write", "jobs:read", "jobs:run"];
+/** Permissions on the account: only a user's token has them. */
+export declare const ACCOUNT_PERMISSIONS: readonly ["projects:create"];
+export type ProjectPermission = typeof PROJECT_PERMISSIONS[number];
+export type AccountPermission = typeof ACCOUNT_PERMISSIONS[number];
+export type ApiTokenPermission = ProjectPermission | AccountPermission;
+export declare const isProjectPermission: (value: unknown) => value is ProjectPermission;
+export declare const isAccountPermission: (value: unknown) => value is AccountPermission;
+/** What a route needs of a token: a permission, or only being a token (`null`). */
+export interface RouteRule {
+    permission: ApiTokenPermission | null;
+    userTokenOnly?: boolean;
+}
+/** The rule for a request made with an API token, or undefined: not reachable with one. */
+export declare function routeRuleFor(method: string, path: string): RouteRule | undefined;