streamby-core 0.36.0 → 0.38.0

package/dist/mcp/tools.js

@@ -8,19 +8,20 @@ const projectId = id('project');
 const enc = encodeURIComponent;
 const byProject = ({ projectId }) => projectId;
 const CATEGORIES = ['images', 'audios', 'videos', '3d-models'];
+const STATUSES = ['todo', 'in_progress', 'review', 'done'];
 const shotFields = {
     description: zod_1.z.string().optional(),
-    status: zod_1.z.string().optional().describe('Its status, as the project uses them'),
-    assignedTo: zod_1.z.string().optional().describe("The assignee's user id"),
+    status: zod_1.z.enum(STATUSES).optional(),
+    assignedTo: zod_1.z.array(zod_1.z.string()).optional().describe("The assignees' user ids: members of the project"),
     assetId: zod_1.z.string().optional(),
     exportId: zod_1.z.string().optional(),
     dueDate: zod_1.z.string().optional().describe('An ISO 8601 date'),
     order: zod_1.z.number().optional(),
 };
 const taskFields = {
-    status: zod_1.z.string().optional(),
-    priority: zod_1.z.string().optional(),
-    assignedTo: zod_1.z.string().optional().describe("The assignee's user id"),
+    status: zod_1.z.enum(STATUSES).optional(),
+    priority: zod_1.z.enum(['low', 'medium', 'high']).optional(),
+    assignedTo: zod_1.z.string().optional().describe("The assignee's user id: a member of the project"),
     dueDate: zod_1.z.string().optional().describe('An ISO 8601 date'),
     notes: zod_1.z.string().optional(),
 };
@@ -38,21 +39,21 @@ const defined = (fields) => Object.fromEntries(Object.entries(fields).filter(([,
 exports.TOOLS = [
     // ── Reading ──
     tool({
-        name: 'list_projects', title: 'List projects', write: false,
+        name: 'list_projects', title: 'List projects', permissions: [],
         description: 'The StreamBy projects this token reaches.',
         input: {},
         call: () => ({ method: 'GET', path: '/projects' }),
         pick: (data) => data.projects,
     }),
     tool({
-        name: 'get_project', title: 'Get a project', write: false,
+        name: 'get_project', title: 'Get a project', permissions: ['project:read'],
         description: "A project's details: its name, description, members, exports and connections.",
         input: { projectId },
         projectOf: byProject,
         call: ({ projectId }) => ({ method: 'GET', path: `/projects/${enc(projectId)}` }),
     }),
     tool({
-        name: 'list_assets', title: 'List assets', write: false,
+        name: 'list_assets', title: 'List assets', permissions: ['assets:read'],
         description: "A project's assets of a category (images, audios, videos, 3d-models), optionally in one storage connection, and optionally only those whose name contains `query`.",
         input: {
             projectId,
@@ -77,42 +78,42 @@ exports.TOOLS = [
         },
     }),
     tool({
-        name: 'get_asset_metadata', title: "Get an asset's metadata", write: false,
+        name: 'get_asset_metadata', title: "Get an asset's metadata", permissions: ['assets:read'],
         description: "An asset's metadata (technical data and custom tags).",
         input: { projectId, fileId: id('asset') },
         projectOf: byProject,
         call: ({ projectId, fileId }) => ({ method: 'GET', path: `/projects/${enc(projectId)}/assets/${enc(fileId)}/metadata` }),
     }),
     tool({
-        name: 'get_asset_rights', title: "Get an asset's rights", write: false,
+        name: 'get_asset_rights', title: "Get an asset's rights", permissions: ['rights:read'],
         description: "An asset's rights: holder, license, territory, expiry and restrictions.",
         input: { projectId, assetId: id('asset') },
         projectOf: byProject,
         call: ({ projectId, assetId }) => ({ method: 'GET', path: `/projects/${enc(projectId)}/assets/${enc(assetId)}/rights` }),
     }),
     tool({
-        name: 'get_workflow', title: "Get a project's workflow", write: false,
+        name: 'get_workflow', title: "Get a project's workflow", permissions: ['workflow:read'],
         description: "A project's workflow (its node graph).",
         input: { projectId },
         projectOf: byProject,
         call: ({ projectId }) => ({ method: 'GET', path: `/projects/${enc(projectId)}/workflow` }),
     }),
     tool({
-        name: 'list_pipelines', title: 'List pipelines', write: false,
+        name: 'list_pipelines', title: 'List pipelines', permissions: ['workflow:read'],
         description: "A project's pipelines.",
         input: { projectId },
         projectOf: byProject,
         call: ({ projectId }) => ({ method: 'GET', path: `/projects/${enc(projectId)}/pipelines` }),
     }),
     tool({
-        name: 'get_pipeline', title: 'Get a pipeline', write: false,
+        name: 'get_pipeline', title: 'Get a pipeline', permissions: ['workflow:read'],
         description: 'A pipeline, with its node schema.',
         input: { projectId, pipelineId: id('pipeline') },
         projectOf: byProject,
         call: ({ projectId, pipelineId }) => ({ method: 'GET', path: `/projects/${enc(projectId)}/pipelines/${enc(pipelineId)}` }),
     }),
     tool({
-        name: 'list_exports', title: 'List exports', write: false,
+        name: 'list_exports', title: 'List exports', permissions: ['project:read', 'exports:read'],
         description: "A project's exports (its published endpoints).",
         input: { projectId },
         projectOf: byProject,
@@ -120,34 +121,34 @@ exports.TOOLS = [
         pick: (data) => data?.project?.exports ?? data?.exports ?? [],
     }),
     tool({
-        name: 'get_export', title: 'Get an export', write: false,
+        name: 'get_export', title: 'Get an export', permissions: ['exports:read'],
         description: 'An export, with its node schema.',
         input: { projectId, exportId: id('export') },
         projectOf: byProject,
         call: ({ projectId, exportId }) => ({ method: 'GET', path: `/projects/${enc(projectId)}/exports/${enc(exportId)}` }),
     }),
     tool({
-        name: 'get_job', title: 'Get a job', write: false,
+        name: 'get_job', title: 'Get a job', permissions: ['jobs:read'],
         description: "A job's status and progress (transcoding, rendering, ingesting...).",
         input: { jobId: id('job') },
         call: ({ jobId }) => ({ method: 'GET', path: `/jobs/${enc(jobId)}` }),
     }),
     tool({
-        name: 'list_sequences', title: 'List production sequences', write: false,
+        name: 'list_sequences', title: 'List production sequences', permissions: ['production:read'],
         description: "A project's production sequences.",
         input: { projectId },
         projectOf: byProject,
         call: ({ projectId }) => ({ method: 'GET', path: `/projects/${enc(projectId)}/production/sequences` }),
     }),
     tool({
-        name: 'list_shots', title: 'List shots', write: false,
+        name: 'list_shots', title: 'List shots', permissions: ['production:read'],
         description: "A production sequence's shots.",
         input: { projectId, sequenceId: id('sequence') },
         projectOf: byProject,
         call: ({ projectId, sequenceId }) => ({ method: 'GET', path: `/projects/${enc(projectId)}/production/sequences/${enc(sequenceId)}/shots` }),
     }),
     tool({
-        name: 'list_tasks', title: 'List shot tasks', write: false,
+        name: 'list_tasks', title: 'List shot tasks', permissions: ['production:read'],
         description: "A shot's tasks.",
         input: { projectId, shotId: id('shot') },
         projectOf: byProject,
@@ -155,73 +156,224 @@ exports.TOOLS = [
     }),
     // ── Writing ──
     tool({
-        name: 'update_asset_metadata', title: "Update an asset's custom tags", write: true,
-        description: "Sets an asset's custom tags (key/value pairs), replacing the ones it had.",
+        name: 'update_asset_metadata', title: "Update an asset's custom tags", permissions: ['assets:write'], write: true,
+        description: "Sets an asset's custom tags (key/value pairs), replacing the ones it had. They show in the file's Metadata tab, in Storage.",
         input: { projectId, fileId: id('asset'), customTags: zod_1.z.record(zod_1.z.string(), zod_1.z.string()) },
         projectOf: byProject,
         call: ({ projectId, fileId, customTags }) => ({ method: 'PATCH', path: `/projects/${enc(projectId)}/assets/${enc(fileId)}/metadata`, body: { customTags } }),
     }),
     tool({
-        name: 'set_asset_rights', title: "Set an asset's rights", write: true,
-        description: "Sets an asset's rights: holder, license, territory, expiry, restrictions and notes.",
+        name: 'set_asset_rights', title: "Set an asset's rights", permissions: ['rights:write'], write: true,
+        description: "Sets an asset's rights: holder, license, territory, expiry, restrictions and notes. They show in the file's Rights tab, in Storage.",
         input: { projectId, assetId: id('asset'), ...rightsFields },
         projectOf: byProject,
         call: ({ projectId, assetId, ...rights }) => ({ method: 'PUT', path: `/projects/${enc(projectId)}/assets/${enc(assetId)}/rights`, body: defined(rights) }),
     }),
     tool({
-        name: 'create_pipeline', title: 'Create a pipeline', write: true,
-        description: 'Creates a pipeline in a project.',
+        name: 'create_pipeline', title: 'Create a pipeline', permissions: ['workflow:write'], write: true,
+        description: "Creates a pipeline in a project. It shows under Pipelines, and the workflow canvas draws its node.",
         input: { projectId, name: zod_1.z.string().min(1), description: zod_1.z.string().optional(), order: zod_1.z.number().optional() },
         projectOf: byProject,
         call: ({ projectId, ...fields }) => ({ method: 'POST', path: `/projects/${enc(projectId)}/pipelines`, body: defined(fields) }),
     }),
     tool({
-        name: 'update_pipeline', title: 'Update a pipeline', write: true,
+        name: 'update_pipeline', title: 'Update a pipeline', permissions: ['workflow:write'], write: true,
         description: "Changes a pipeline's name, description or order.",
         input: { projectId, pipelineId: id('pipeline'), name: zod_1.z.string().min(1).optional(), description: zod_1.z.string().optional(), order: zod_1.z.number().optional() },
         projectOf: byProject,
         call: ({ projectId, pipelineId, ...fields }) => ({ method: 'PATCH', path: `/projects/${enc(projectId)}/pipelines/${enc(pipelineId)}`, body: defined(fields) }),
     }),
     tool({
-        name: 'create_sequence', title: 'Create a production sequence', write: true,
-        description: 'Creates a production sequence in a project.',
+        name: 'create_sequence', title: 'Create a production sequence', permissions: ['production:write', 'workflow:write'], write: true, workflowNode: 'production',
+        description: "Creates a production sequence in a project, shown in its Production board. If the project's workflow has no production node yet, it first adds one (a Shot node, as dropping it on the canvas does), so the project's Production section shows it: that's why it also needs workflow:write.",
         input: { projectId, name: zod_1.z.string().min(1), description: zod_1.z.string().optional(), order: zod_1.z.number().optional() },
         projectOf: byProject,
         call: ({ projectId, ...fields }) => ({ method: 'POST', path: `/projects/${enc(projectId)}/production/sequences`, body: defined(fields) }),
     }),
     tool({
-        name: 'update_sequence', title: 'Update a production sequence', write: true,
+        name: 'update_sequence', title: 'Update a production sequence', permissions: ['production:write'], write: true,
         description: "Changes a sequence's name, description or order.",
         input: { projectId, sequenceId: id('sequence'), name: zod_1.z.string().min(1).optional(), description: zod_1.z.string().optional(), order: zod_1.z.number().optional() },
         projectOf: byProject,
         call: ({ projectId, sequenceId, ...fields }) => ({ method: 'PATCH', path: `/projects/${enc(projectId)}/production/sequences/${enc(sequenceId)}`, body: defined(fields) }),
     }),
     tool({
-        name: 'create_shot', title: 'Create a shot', write: true,
-        description: 'Creates a shot in a production sequence.',
+        name: 'create_shot', title: 'Create a shot', permissions: ['production:write', 'workflow:write'], write: true, workflowNode: 'production',
+        description: "Creates a shot in a production sequence, shown in its Production board. If the project's workflow has no production node yet, it first adds one (a Shot node, as dropping it on the canvas does), so the project's Production section shows it: that's why it also needs workflow:write.",
         input: { projectId, sequenceId: id('sequence'), name: zod_1.z.string().min(1), ...shotFields },
         projectOf: byProject,
         call: ({ projectId, sequenceId, ...fields }) => ({ method: 'POST', path: `/projects/${enc(projectId)}/production/sequences/${enc(sequenceId)}/shots`, body: defined(fields) }),
     }),
     tool({
-        name: 'update_shot', title: 'Update a shot', write: true,
+        name: 'update_shot', title: 'Update a shot', permissions: ['production:write'], write: true,
         description: 'Changes a shot (its name, status, assignee, due date...).',
         input: { projectId, shotId: id('shot'), name: zod_1.z.string().min(1).optional(), ...shotFields },
         projectOf: byProject,
         call: ({ projectId, shotId, ...fields }) => ({ method: 'PATCH', path: `/projects/${enc(projectId)}/production/shots/${enc(shotId)}`, body: defined(fields) }),
     }),
     tool({
-        name: 'create_task', title: 'Create a shot task', write: true,
-        description: 'Creates a task in a shot.',
+        name: 'create_task', title: 'Create a shot task', permissions: ['production:write', 'workflow:write'], write: true, workflowNode: 'production',
+        description: "Creates a task in a shot, shown in the shot's panel in the Production board. If the project's workflow has no production node yet, it first adds one (a Shot node, as dropping it on the canvas does), so the project's Production section shows it: that's why it also needs workflow:write.",
         input: { projectId, shotId: id('shot'), name: zod_1.z.string().min(1), ...taskFields },
         projectOf: byProject,
         call: ({ projectId, shotId, ...fields }) => ({ method: 'POST', path: `/projects/${enc(projectId)}/production/shots/${enc(shotId)}/tasks`, body: defined(fields) }),
     }),
     tool({
-        name: 'update_task', title: 'Update a shot task', write: true,
+        name: 'update_task', title: 'Update a shot task', permissions: ['production:write'], write: true,
         description: 'Changes a task (its name, status, priority, assignee, due date, notes).',
         input: { projectId, shotId: id('shot'), taskId: id('task'), name: zod_1.z.string().min(1).optional(), ...taskFields },
         projectOf: byProject,
         call: ({ projectId, shotId, taskId, ...fields }) => ({ method: 'PATCH', path: `/projects/${enc(projectId)}/production/shots/${enc(shotId)}/tasks/${enc(taskId)}`, body: defined(fields) }),
     }),
+    // ── Files: uploading, downloading, deliverables ──
+    // The file itself never goes through the conversation: these tools give a signed URL, and
+    // the user's own tool (Blender's or Godot's MCP, a script) uploads or downloads it directly.
+    tool({
+        name: 'list_asset_versions', title: "List an asset's versions", permissions: ['assets:read'],
+        description: "An asset's versions, newest first: each one's id, number, file name and when it was made. Any of them can be downloaded (get_asset_download_url).",
+        input: { projectId, assetId: id('asset') },
+        projectOf: byProject,
+        call: ({ projectId, assetId }) => ({ method: 'GET', path: `/projects/${enc(projectId)}/assets/${enc(assetId)}/versions` }),
+        pick: (data) => (data?.versions ?? []).map((v) => ({
+            versionId: v.versionId, version: v.version, fileName: v.fileName ?? null, contentType: v.contentType ?? null, createdAt: v.createdAt,
+        })),
+    }),
+    tool({
+        name: 'request_asset_upload', title: 'Request an upload URL', permissions: ['assets:write'], write: true,
+        description: [
+            "Makes a new asset (or, with assetId, a new version of one) and gives a signed URL to upload its file to, as the UI does.",
+            "It doesn't upload anything: the file is sent by the tool that has it (for example Blender's MCP, running Python), with an HTTP PUT of its bytes to `upload.url` and the `upload.headers` given, before `expiresAt`.",
+            "The URL works for that file only. A new version keeps the asset's URL (it replaces what it serves); the earlier ones are archived and can still be downloaded.",
+            "Categories: images, audios, videos, 3d-models (.glb, .gltf, .obj, .fbx, .stl, .ply); contentType must match it.",
+        ].join(' '),
+        input: {
+            projectId,
+            category: zod_1.z.enum(CATEGORIES),
+            fileName: zod_1.z.string().min(1).describe('The file name, with its extension (e.g. shot010_layout.glb)'),
+            contentType: zod_1.z.string().min(1).describe('Its MIME type (e.g. model/gltf-binary, image/png, video/mp4)'),
+            assetId: zod_1.z.string().optional().describe('An existing asset to upload a new version of; a new asset if not given'),
+            connectionId: zod_1.z.string().optional().describe("A storage connection to store it in; the project's built-in storage if not given"),
+        },
+        projectOf: byProject,
+        call: ({ projectId, category, fileName, contentType, assetId, connectionId }) => {
+            const query = new URLSearchParams({ fileName, contentType, ...(connectionId && !assetId ? { category } : {}) });
+            const files = connectionId ? `/projects/${enc(projectId)}/connections/storage/${enc(connectionId)}` : `/projects/${enc(projectId)}/storage`;
+            const path = assetId
+                ? `${files}/files/${enc(assetId)}/replace-url`
+                : connectionId ? `${files}/upload-url` : `${files}/${category}/upload-url`;
+            return { method: 'GET', path: `${path}?${query}` };
+        },
+        pick: (data, { contentType }) => ({
+            assetId: data?.fileId,
+            ...(data?.versionId ? { versionId: data.versionId, version: data.version } : { version: 1 }),
+            upload: { method: 'PUT', url: data?.url, headers: { 'Content-Type': contentType } },
+            expiresAt: data?.expiresAt ?? null,
+        }),
+    }),
+    tool({
+        name: 'get_asset_download_url', title: 'Get a download URL', permissions: ['assets:read'],
+        description: "A short-lived signed URL to download an asset's file (its latest version, or the one given), for the tool that will use it (for example Blender's or Godot's MCP) to fetch with an HTTP GET before `expiresAt`. It works for that file only.",
+        input: { projectId, assetId: id('asset'), versionId: zod_1.z.string().optional().describe('A version (list_asset_versions); the latest if not given') },
+        projectOf: byProject,
+        call: ({ projectId, assetId, versionId }) => ({
+            method: 'GET',
+            path: `/projects/${enc(projectId)}/assets/${enc(assetId)}/download-url${versionId ? `?${new URLSearchParams({ versionId })}` : ''}`,
+        }),
+    }),
+    tool({
+        name: 'list_deliverables', title: 'List deliverables', permissions: ['assets:read'],
+        description: "A project's deliverables (assets delivered for a shot or an export), of one shot or export if given: each one's asset, version, note and what it's for.",
+        input: {
+            projectId,
+            shotId: zod_1.z.string().optional().describe("A shot's id: only its deliverables"),
+            exportId: zod_1.z.string().optional().describe("An export's id: only its deliverables"),
+        },
+        projectOf: byProject,
+        call: ({ projectId, shotId, exportId }) => {
+            const query = new URLSearchParams(defined({ shotId, exportId })).toString();
+            return { method: 'GET', path: `/projects/${enc(projectId)}/deliverables${query ? `?${query}` : ''}` };
+        },
+        pick: (data) => data?.deliverables ?? [],
+    }),
+    tool({
+        name: 'mark_deliverable', title: 'Mark a deliverable', permissions: ['assets:write'], write: true,
+        description: "Marks an asset (or one of its versions) as a deliverable of a production shot or of an export. It shows in the shot's panel in the Production board, or in the export's Deliverables tab. Give shotId or exportId, one of them. Upload the file first (request_asset_upload).",
+        input: {
+            projectId,
+            assetId: id('asset'),
+            versionId: zod_1.z.string().optional().describe('A version of it; without one, the asset as it is (its latest version)'),
+            shotId: zod_1.z.string().optional().describe("The shot it's delivered for"),
+            exportId: zod_1.z.string().optional().describe("The export it's delivered for"),
+            note: zod_1.z.string().max(1000).optional(),
+        },
+        projectOf: byProject,
+        call: ({ projectId, ...fields }) => ({ method: 'POST', path: `/projects/${enc(projectId)}/deliverables`, body: defined(fields) }),
+        pick: (data) => data?.deliverable,
+    }),
+    tool({
+        name: 'remove_deliverable', title: 'Remove a deliverable', permissions: ['assets:write'], write: true,
+        description: 'Unmarks a deliverable. Its asset stays where it is.',
+        input: { projectId, deliverableId: id('deliverable') },
+        projectOf: byProject,
+        call: ({ projectId, deliverableId }) => ({ method: 'DELETE', path: `/projects/${enc(projectId)}/deliverables/${enc(deliverableId)}` }),
+    }),
+    // ── Projects ──
+    tool({
+        name: 'create_project', title: 'Create a project', permissions: ['projects:create'], write: true,
+        description: 'Creates a StreamBy project, its maker being its admin, as from "New project" in the UI. The token reaches it from then on.',
+        input: {
+            name: zod_1.z.string().min(1),
+            description: zod_1.z.string().optional(),
+            public: zod_1.z.boolean().optional().describe('Whether it shows in Explore (true if not given; a private one needs a subscriber plan)'),
+            category: zod_1.z.string().optional(),
+        },
+        call: (fields) => ({ method: 'POST', path: '/projects/create', body: defined(fields) }),
+        pick: (data) => ({ projectId: data?.projectId, message: data?.message }),
+    }),
+    tool({
+        name: 'delete_project', title: 'Delete a project', permissions: ['project:delete'], write: true, destructive: true,
+        description: 'Deletes a project, with everything in it, for every member. It cannot be undone.',
+        input: { projectId },
+        projectOf: byProject,
+        call: ({ projectId }) => ({ method: 'DELETE', path: `/projects/${enc(projectId)}` }),
+        pick: (data) => ({ message: data?.message }),
+    }),
+    // ── Deleting ──
+    tool({
+        name: 'delete_asset', title: 'Delete an asset', permissions: ['assets:delete'], write: true, destructive: true,
+        description: "Deletes an asset's file, from the project's built-in storage or from one of its storage connections. It cannot be undone.",
+        input: {
+            projectId,
+            fileId: id('asset'),
+            connectionId: zod_1.z.string().optional().describe("The storage connection it's in; the project's built-in storage if not given"),
+        },
+        projectOf: byProject,
+        call: ({ projectId, fileId, connectionId }) => ({
+            method: 'DELETE',
+            path: connectionId
+                ? `/projects/${enc(projectId)}/connections/storage/${enc(connectionId)}/files/${enc(fileId)}`
+                : `/projects/${enc(projectId)}/storage/files/${enc(fileId)}`,
+        }),
+    }),
+    tool({
+        name: 'delete_sequence', title: 'Delete a production sequence', permissions: ['production:delete'], write: true, destructive: true,
+        description: 'Deletes a production sequence, with its shots. It cannot be undone.',
+        input: { projectId, sequenceId: id('sequence') },
+        projectOf: byProject,
+        call: ({ projectId, sequenceId }) => ({ method: 'DELETE', path: `/projects/${enc(projectId)}/production/sequences/${enc(sequenceId)}` }),
+    }),
+    tool({
+        name: 'delete_shot', title: 'Delete a shot', permissions: ['production:delete'], write: true, destructive: true,
+        description: 'Deletes a shot, with its tasks. It cannot be undone.',
+        input: { projectId, shotId: id('shot') },
+        projectOf: byProject,
+        call: ({ projectId, shotId }) => ({ method: 'DELETE', path: `/projects/${enc(projectId)}/production/shots/${enc(shotId)}` }),
+    }),
+    tool({
+        name: 'delete_task', title: 'Delete a shot task', permissions: ['production:delete'], write: true, destructive: true,
+        description: "Deletes a shot's task. It cannot be undone.",
+        input: { projectId, shotId: id('shot'), taskId: id('task') },
+        projectOf: byProject,
+        call: ({ projectId, shotId, taskId }) => ({ method: 'DELETE', path: `/projects/${enc(projectId)}/production/shots/${enc(shotId)}/tasks/${enc(taskId)}` }),
+    }),
 ];

package/dist/mcp/workflowNodes.d.ts

@@ -0,0 +1,24 @@
+import { Auth } from '../types';
+import type { ApiCaller } from './server';
+export type WorkflowNodeRequirement = 'production';
+/** A Shot node, as the UI makes one dropped on the canvas without a position. */
+export declare const newShotNode: () => {
+    id: string;
+    type: string;
+    position: {
+        x: number;
+        y: number;
+    };
+    data: {
+        label: string;
+        subtitle: string;
+        bgColor: string;
+        iconColor: string;
+    };
+};
+/**
+ * Makes sure a project's workflow has what `requirement` needs, adding it (through the REST
+ * API, as the caller) if it's missing. An error to answer with, or null to go on. A project
+ * the caller doesn't reach is left alone: the call that follows answers for it.
+ */
+export declare function ensureWorkflowNode(requirement: WorkflowNodeRequirement, projectId: string | undefined, auth: Auth, api: ApiCaller): Promise<string | null>;

package/dist/mcp/workflowNodes.js

@@ -0,0 +1,48 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.newShotNode = void 0;
+exports.ensureWorkflowNode = ensureWorkflowNode;
+const crypto_1 = __importDefault(require("crypto"));
+const manager_1 = require("../models/manager");
+const auth_1 = require("../utils/auth");
+const auth_2 = require("../services/auth");
+// The node types that make a workflow's production section (as the UI groups them).
+const PRODUCTION_NODE_TYPES = new Set(['shotNode', 'assemblyNode', 'masterNode']);
+/** A Shot node, as the UI makes one dropped on the canvas without a position. */
+const newShotNode = () => ({
+    id: `shotNode-${crypto_1.default.randomUUID()}`,
+    type: 'shotNode',
+    position: { x: 240 + Math.random() * 60, y: 300 + Math.random() * 40 },
+    data: { label: 'Shot', subtitle: 'Raw video clip', bgColor: '#0e2537', iconColor: '#38B6FF' },
+});
+exports.newShotNode = newShotNode;
+/**
+ * Makes sure a project's workflow has what `requirement` needs, adding it (through the REST
+ * API, as the caller) if it's missing. An error to answer with, or null to go on. A project
+ * the caller doesn't reach is left alone: the call that follows answers for it.
+ */
+async function ensureWorkflowNode(requirement, projectId, auth, api) {
+    if (requirement !== 'production' || !projectId)
+        return null;
+    if (!(0, auth_2.scopeReachesProject)(auth.apiToken, projectId))
+        return null;
+    const project = await (0, manager_1.getModel)('projects').findOne({ _id: projectId });
+    if (!project || !(0, auth_1.activeMemberOf)(project, auth.userId))
+        return null;
+    const schema = project.workflow?.nodeSchema ?? null;
+    const nodes = Array.isArray(schema?.nodes) ? schema.nodes : [];
+    if (nodes.some(node => PRODUCTION_NODE_TYPES.has(node?.type)))
+        return null;
+    const answer = await api({
+        method: 'PATCH',
+        path: `/projects/${encodeURIComponent(projectId)}/workflow`,
+        body: { nodeSchema: { ...(schema ?? {}), nodes: [...nodes, (0, exports.newShotNode)()], edges: Array.isArray(schema?.edges) ? schema.edges : [] } },
+    });
+    if (answer.status >= 200 && answer.status < 300)
+        return null;
+    const message = answer.body?.message ?? answer.body?.error;
+    return `Couldn't add a production node to the project's workflow: ${typeof message === 'string' ? message : `StreamBy answered ${answer.status}`}`;
+}

package/dist/middleware/createRouter.js

@@ -38,6 +38,7 @@ const production_1 = require("./routes/production");
 const rights_1 = require("./routes/rights");
 const workflow_1 = require("./routes/workflow");
 const pipeline_1 = require("./routes/pipeline");
+const deliverable_1 = require("./routes/deliverable");
 function createStreamByRouter(config) {
     const router = express_1.default.Router();
     if (config.encrypt)
@@ -134,5 +135,6 @@ function createStreamByRouter(config) {
     router.use((0, rights_1.rightsRouter)(config));
     router.use((0, workflow_1.workflowRouter)(config));
     router.use((0, pipeline_1.pipelineRouter)(config));
+    router.use((0, deliverable_1.deliverableRouter)(config));
     return router;
 }

package/dist/middleware/routes/apiToken.js

@@ -5,25 +5,34 @@ const express_1 = require("express");
 const manager_1 = require("../../models/manager");
 const auth_1 = require("../../utils/auth");
 const apiTokens_1 = require("../../services/apiTokens");
-// The signed-in user's own API tokens (see services/apiTokens): listed, made, revoked. Only
-// with a session: a token can't manage tokens (see enforceApiTokenScope).
+// API tokens (see services/apiTokens), managed only with a session: no route here is
+// reachable with a token (see apiTokenPermissions).
+//
+// - A user's own: listed, made and revoked by them.
+// - A project's: listed, made and revoked by its admins only.
 function apiTokenRouter(config) {
     const router = (0, express_1.Router)();
     const Project = (0, manager_1.getModel)('projects');
+    const failed = (res, what, err) => {
+        if (err instanceof apiTokens_1.ApiTokenError)
+            return res.status(err.status).json({ message: err.message });
+        res.status(500).json({ message: `Failed to ${what}`, details: err.message });
+    };
+    // The token itself is in the response that makes it only: it's never stored, nor shown again.
+    const created = (res, token, info) => res.status(201).json({ token, apiToken: info, message: 'Copy the token now: it will not be shown again' });
     router.get('/user/api-tokens', async (req, res) => {
         try {
             const auth = req.auth;
-            res.json({ apiTokens: await (0, apiTokens_1.listApiTokens)(auth.userId) });
+            res.json({ apiTokens: await (0, apiTokens_1.listUserApiTokens)(auth.userId) });
         }
         catch (err) {
-            res.status(500).json({ message: 'Failed to list API tokens', details: err.message });
+            failed(res, 'list API tokens', err);
         }
     });
-    // The token itself is in this response only: it's never stored, nor shown again.
     router.post('/user/api-tokens', async (req, res) => {
         try {
             const auth = req.auth;
-            const { name, access, projectIds, expiresInDays } = req.body ?? {};
+            const { name, permissions, projectIds, expiresInDays } = req.body ?? {};
             // A token reaches only projects its owner is in.
             if (Array.isArray(projectIds)) {
                 for (const id of projectIds) {
@@ -33,25 +42,79 @@ function apiTokenRouter(config) {
                     }
                 }
             }
-            const { token, info } = await (0, apiTokens_1.createApiToken)(auth.userId, { name, access, projectIds, expiresInDays: expiresInDays ?? null }, config);
-            res.status(201).json({ token, apiToken: info, message: 'Copy the token now: it will not be shown again' });
+            const { token, info } = await (0, apiTokens_1.createApiToken)({ kind: 'user', userId: auth.userId, username: auth.username }, { name, permissions, projectIds, expiresInDays: expiresInDays ?? null }, config);
+            created(res, token, info);
         }
         catch (err) {
-            if (err instanceof apiTokens_1.ApiTokenError)
-                return res.status(err.status).json({ message: err.message });
-            res.status(500).json({ message: 'Failed to create API token', details: err.message });
+            failed(res, 'create API token', err);
         }
     });
     router.delete('/user/api-tokens/:tokenId', async (req, res) => {
         try {
             const auth = req.auth;
-            const revoked = await (0, apiTokens_1.revokeApiToken)(auth.userId, req.params.tokenId);
-            if (!revoked)
+            if (!(await (0, apiTokens_1.revokeUserApiToken)(auth.userId, req.params.tokenId))) {
                 return res.status(404).json({ message: 'API token not found' });
+            }
+            res.status(204).end();
+        }
+        catch (err) {
+            failed(res, 'revoke API token', err);
+        }
+    });
+    // ── A project's tokens: its admins only ──
+    const adminsProject = async (req, res) => {
+        const auth = req.auth;
+        const project = await Project.findOne({ _id: req.params.id });
+        if (!project) {
+            res.status(404).json({ message: 'Project not found' });
+            return null;
+        }
+        if (!(0, auth_1.isProjectAdmin)(project, auth.userId)) {
+            res.status(403).json({ message: "Only a project admin manages the project's API tokens" });
+            return null;
+        }
+        return project;
+    };
+    router.get('/projects/:id/api-tokens', async (req, res) => {
+        try {
+            const project = await adminsProject(req, res);
+            if (!project)
+                return;
+            // Whether whoever made each one is still in the project: it keeps working if they aren't.
+            const apiTokens = (await (0, apiTokens_1.listProjectApiTokens)(req.params.id)).map(token => ({
+                ...token,
+                createdBy: { ...token.createdBy, isMember: !!(0, auth_1.activeMemberOf)(project, token.createdBy.userId) },
+            }));
+            res.json({ apiTokens });
+        }
+        catch (err) {
+            failed(res, "list the project's API tokens", err);
+        }
+    });
+    router.post('/projects/:id/api-tokens', async (req, res) => {
+        try {
+            const auth = req.auth;
+            if (!(await adminsProject(req, res)))
+                return;
+            const { name, permissions, expiresInDays } = req.body ?? {};
+            const { token, info } = await (0, apiTokens_1.createApiToken)({ kind: 'project', userId: auth.userId, username: auth.username, projectId: req.params.id }, { name, permissions, expiresInDays: expiresInDays ?? null }, config);
+            created(res, token, info);
+        }
+        catch (err) {
+            failed(res, "create the project's API token", err);
+        }
+    });
+    router.delete('/projects/:id/api-tokens/:tokenId', async (req, res) => {
+        try {
+            if (!(await adminsProject(req, res)))
+                return;
+            if (!(await (0, apiTokens_1.revokeProjectApiToken)(req.params.id, req.params.tokenId))) {
+                return res.status(404).json({ message: 'API token not found' });
+            }
             res.status(204).end();
         }
         catch (err) {
-            res.status(500).json({ message: 'Failed to revoke API token', details: err.message });
+            failed(res, "revoke the project's API token", err);
         }
     });
     return router;

package/dist/middleware/routes/deliverable.d.ts

@@ -0,0 +1,3 @@
+import { Router } from 'express';
+import { StreamByConfig } from '../../types';
+export declare function deliverableRouter(_config: StreamByConfig): Router;