streamby-core 0.36.0 → 0.38.0

package/dist/services/apiTokens.js

@@ -5,17 +5,27 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ApiTokenError = exports.API_TOKEN_EXPIRY_DAYS = exports.API_TOKEN_PREFIX = void 0;
 exports.createApiToken = createApiToken;
-exports.listApiTokens = listApiTokens;
-exports.revokeApiToken = revokeApiToken;
+exports.listUserApiTokens = listUserApiTokens;
+exports.listProjectApiTokens = listProjectApiTokens;
+exports.revokeUserApiToken = revokeUserApiToken;
+exports.revokeProjectApiToken = revokeProjectApiToken;
+exports.projectApiTokensMadeBy = projectApiTokensMadeBy;
+exports.deleteProjectApiTokens = deleteProjectApiTokens;
+exports.addProjectToApiToken = addProjectToApiToken;
 exports.resolveApiToken = resolveApiToken;
 const crypto_1 = __importDefault(require("crypto"));
 const manager_1 = require("../models/manager");
-// API tokens: how an agent or a service works with StreamBy as a user, without their browser
-// session. A token is "sbt_" and 32 random bytes; only its hash is stored, with a prefix to
-// tell it apart in a list. It's sent as `Authorization: Bearer sbt_...` and the host's
-// authProvider resolves it (resolveApiToken), so the request is its owner's -- limited by the
-// token's scope (read or write, which projects), and never more than its owner can do: the
-// owner's role in each project still decides.
+const auth_1 = require("../utils/auth");
+const apiTokenPermissions_1 = require("./apiTokenPermissions");
+// API tokens: how an agent or a service works with StreamBy without a browser session. A token
+// is "sbt_" and 32 random bytes; only its hash is stored, with a prefix to tell it apart in a
+// list. It's sent as `Authorization: Bearer sbt_...` and the host's authProvider resolves it
+// (resolveApiToken). It does only what its permissions allow (see apiTokenPermissions), and:
+//
+// - a user's token acts as its user, on the projects it reaches: never more than its user can,
+//   since their role in each project still decides;
+// - a project's token acts on its project alone, as the project's, not as whoever made it: it
+//   keeps working after they leave the project. Only the project's admins manage it.
 exports.API_TOKEN_PREFIX = 'sbt_';
 const PREFIX_SHOWN = exports.API_TOKEN_PREFIX.length + 8;
 exports.API_TOKEN_EXPIRY_DAYS = [7, 30, 90, 365];
@@ -28,35 +38,72 @@ class ApiTokenError extends Error {
 }
 exports.ApiTokenError = ApiTokenError;
 const hashOf = (token) => crypto_1.default.createHash('sha256').update(token).digest('hex');
-const infoOf = ({ hash: _hash, userId: _userId, ...info }) => ({
-    ...info,
-    projectIds: parseProjectIds(info.projectIds),
-});
-// As stored (a list, read back from SQL JSON as a list or its text): ['*'] is every project.
-const parseProjectIds = (value) => {
+// A list, as stored in SQL JSON: read back as a list or as its text.
+const listOf = (value) => {
     if (typeof value === 'string') {
         try {
-            return parseProjectIds(JSON.parse(value));
+            return listOf(JSON.parse(value));
         }
         catch {
             return [];
         }
     }
-    if (!Array.isArray(value))
-        return [];
-    const ids = value.map(String);
+    return Array.isArray(value) ? value.map(String) : [];
+};
+const parseProjectIds = (value) => {
+    const ids = listOf(value);
     return ids.includes(ALL_PROJECTS) ? '*' : ids;
 };
+// Only the permissions its kind may have: a stored one that isn't known anymore is dropped.
+const parsePermissions = (value, kind) => listOf(value).filter((p) => (0, apiTokenPermissions_1.isProjectPermission)(p) || (kind === 'user' && (0, apiTokenPermissions_1.isAccountPermission)(p)));
+// Tokens made before they had a kind and permissions don't work anymore, nor are listed.
+const isCurrent = (record) => !!record && (record.kind === 'user' || record.kind === 'project');
+const infoOf = (record) => {
+    const { hash: _hash, userId, createdByName, projectIds, permissions, ...info } = record;
+    return {
+        ...info,
+        permissions: parsePermissions(permissions, record.kind),
+        projectIds: parseProjectIds(projectIds),
+        createdBy: { userId, username: createdByName ?? null },
+    };
+};
 const mainDbType = (config) => config.databases?.find(db => db.main)?.type ?? 'nosql';
-/** A new token for `userId`: the token itself, shown only now, and what's kept of it. */
-async function createApiToken(userId, input, config) {
+const validPermissions = (value, kind) => {
+    if (!Array.isArray(value) || !value.length)
+        throw new ApiTokenError('A token needs at least one permission.');
+    for (const p of value) {
+        if ((0, apiTokenPermissions_1.isAccountPermission)(p) && kind === 'project')
+            throw new ApiTokenError(`A project's token can't have '${p}'.`);
+        if (!(0, apiTokenPermissions_1.isProjectPermission)(p) && !(0, apiTokenPermissions_1.isAccountPermission)(p))
+            throw new ApiTokenError(`Unknown permission '${String(p)}'.`);
+    }
+    return [...new Set(value)];
+};
+/** A new token: the token itself, shown only now, and what's kept of it. */
+async function createApiToken(owner, input, config) {
     const name = typeof input.name === 'string' ? input.name.trim() : '';
     if (!name)
         throw new ApiTokenError('A token needs a name.');
-    if (input.access !== 'read' && input.access !== 'write')
-        throw new ApiTokenError("access must be 'read' or 'write'.");
-    if (input.projectIds !== '*' && (!Array.isArray(input.projectIds) || !input.projectIds.length || !input.projectIds.every(id => typeof id === 'string' && id && id !== ALL_PROJECTS))) {
-        throw new ApiTokenError("projectIds must be '*' or a list of project ids.");
+    const permissions = validPermissions(input.permissions, owner.kind);
+    let projectIds;
+    if (owner.kind === 'project') {
+        if (!owner.projectId)
+            throw new ApiTokenError("A project's token needs its project.");
+        projectIds = [owner.projectId];
+    }
+    else if (input.projectIds === '*') {
+        projectIds = [ALL_PROJECTS];
+    }
+    else {
+        const ids = input.projectIds;
+        if (!Array.isArray(ids) || !ids.every(id => typeof id === 'string' && id && id !== ALL_PROJECTS)) {
+            throw new ApiTokenError("projectIds must be '*' or a list of project ids.");
+        }
+        // No project yet only for a token that makes them: it reaches the ones it makes.
+        if (!ids.length && !permissions.includes('projects:create')) {
+            throw new ApiTokenError('A token needs at least one project, or to be able to create them.');
+        }
+        projectIds = [...new Set(ids)];
     }
     if (input.expiresInDays !== null && !exports.API_TOKEN_EXPIRY_DAYS.includes(input.expiresInDays)) {
         throw new ApiTokenError(`expiresInDays must be one of ${exports.API_TOKEN_EXPIRY_DAYS.join(', ')}, or null.`);
@@ -65,12 +112,14 @@ async function createApiToken(userId, input, config) {
     const now = new Date();
     const record = {
         id: crypto_1.default.randomUUID(),
-        userId,
+        kind: owner.kind,
+        userId: owner.userId,
+        createdByName: owner.username ?? null,
         name,
         prefix: token.slice(0, PREFIX_SHOWN),
         hash: hashOf(token),
-        access: input.access,
-        projectIds: input.projectIds === '*' ? [ALL_PROJECTS] : [...new Set(input.projectIds)],
+        permissions,
+        projectIds,
         createdAt: now,
         expiresAt: input.expiresInDays === null ? null : new Date(now.getTime() + input.expiresInDays * 86400000),
         lastUsedAt: null,
@@ -78,33 +127,78 @@ async function createApiToken(userId, input, config) {
     await (0, manager_1.getModel)('api_tokens').create({ ...record, dbType: mainDbType(config) });
     return { token, info: infoOf(record) };
 }
-/** The tokens `userId` has. */
-async function listApiTokens(userId) {
-    const records = (await (0, manager_1.getModel)('api_tokens').find({ userId }));
+const newestFirst = (a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime();
+/** A user's own tokens. */
+async function listUserApiTokens(userId) {
+    const records = (await (0, manager_1.getModel)('api_tokens').find({ userId, kind: 'user' }));
+    return records.filter(isCurrent).map(infoOf).sort(newestFirst);
+}
+/** A project's tokens. */
+async function listProjectApiTokens(projectId) {
+    const records = (await (0, manager_1.getModel)('api_tokens').find({ kind: 'project' }));
     return records
+        .filter(r => isCurrent(r) && listOf(r.projectIds)[0] === projectId)
         .map(infoOf)
-        .sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime());
+        .sort(newestFirst);
+}
+/** Revokes a user's own token: it stops working at once. Whether there was one. */
+async function revokeUserApiToken(userId, tokenId) {
+    return (await (0, manager_1.getModel)('api_tokens').delete({ id: tokenId, userId, kind: 'user' })) > 0;
+}
+/** Revokes a project's token. Whether there was one. */
+async function revokeProjectApiToken(projectId, tokenId) {
+    const ApiTokens = (0, manager_1.getModel)('api_tokens');
+    const record = (await ApiTokens.findOne({ id: tokenId, kind: 'project' }));
+    if (!record || listOf(record.projectIds)[0] !== projectId)
+        return false;
+    return (await ApiTokens.delete({ id: tokenId })) > 0;
+}
+/** A project's tokens that `userId` made (to tell its admins they keep working once they leave). */
+async function projectApiTokensMadeBy(projectId, userId) {
+    return (await listProjectApiTokens(projectId)).filter(t => t.createdBy.userId === userId);
+}
+/** Ends a deleted project's tokens. */
+async function deleteProjectApiTokens(projectId) {
+    const ApiTokens = (0, manager_1.getModel)('api_tokens');
+    for (const token of await listProjectApiTokens(projectId))
+        await ApiTokens.delete({ id: token.id });
 }
-/** Revokes one of `userId`'s tokens: it stops working at once. Whether there was one. */
-async function revokeApiToken(userId, tokenId) {
-    return (await (0, manager_1.getModel)('api_tokens').delete({ id: tokenId, userId })) > 0;
+/** A project a user's token made: it reaches it from now on (one reaching every project already does). */
+async function addProjectToApiToken(tokenId, projectId) {
+    const ApiTokens = (0, manager_1.getModel)('api_tokens');
+    const record = (await ApiTokens.findOne({ id: tokenId, kind: 'user' }));
+    if (!record)
+        return;
+    const ids = listOf(record.projectIds);
+    if (ids.includes(ALL_PROJECTS) || ids.includes(projectId))
+        return;
+    await ApiTokens.update({ id: tokenId }, { projectIds: [...ids, projectId] });
 }
 /**
- * The token's owner and scope, for the host's authProvider; null when it isn't a token, isn't
- * known (revoked), or has expired. Marks when it was last used.
+ * The token's request: who it is and what it may do, for the host's authProvider; null when
+ * it isn't a token, isn't known (revoked), or has expired. Marks when it was last used.
  */
 async function resolveApiToken(token) {
     if (typeof token !== 'string' || !token.startsWith(exports.API_TOKEN_PREFIX))
         return null;
     const ApiTokens = (0, manager_1.getModel)('api_tokens');
     const record = (await ApiTokens.findOne({ hash: hashOf(token) }));
-    if (!record)
+    if (!isCurrent(record))
         return null;
     if (record.expiresAt && new Date(record.expiresAt).getTime() <= Date.now())
         return null;
     ApiTokens.update({ id: record.id }, { lastUsedAt: new Date() }).catch(() => { });
-    return {
-        userId: record.userId,
-        scope: { tokenId: record.id, access: record.access, projectIds: parseProjectIds(record.projectIds) },
+    const scope = {
+        tokenId: record.id,
+        kind: record.kind,
+        permissions: parsePermissions(record.permissions, record.kind),
+        projectIds: parseProjectIds(record.projectIds),
     };
+    if (record.kind === 'project') {
+        const projectId = listOf(record.projectIds)[0];
+        if (!projectId)
+            return null;
+        return { userId: (0, auth_1.projectTokenPrincipal)(record.id, projectId), name: record.name, scope: { ...scope, projectIds: [projectId] } };
+    }
+    return { userId: record.userId, name: record.name, scope };
 }

package/dist/services/assetVersions.d.ts

@@ -0,0 +1,48 @@
+export interface AssetVersion {
+    versionId: string;
+    assetId: string;
+    projectId: string;
+    version: number;
+    storageKey: string;
+    contentType: string | null;
+    fileName: string | null;
+    createdBy: string | null;
+    createdAt: Date;
+}
+export declare const versionsCollection: () => import("mongodb").Collection<import("bson").Document> | null;
+/** The key an asset's version `n` is archived in, next to the asset's own key. */
+export declare const archivedVersionKey: (assetKey: string, version: number) => string;
+/** Records the first version of an asset just made (or one made before versions were kept). */
+export declare function recordFirstVersion(file: {
+    fileId: string;
+    projectId: string;
+    storageKey: string;
+    contentType?: string;
+    displayName?: string;
+    uploadedBy?: string;
+    createdAt?: Date;
+}): Promise<void>;
+/**
+ * Makes room for a new version of an asset, to be uploaded to its own key: its current version
+ * is copied to an archive key first (`copyFile`) and recorded there. If the copy fails nothing
+ * changes, and it throws: the current version is never lost.
+ */
+export declare function archiveCurrentVersion(file: {
+    fileId: string;
+    projectId: string;
+    storageKey: string;
+    contentType?: string;
+    displayName?: string;
+    uploadedBy?: string;
+    createdAt?: Date;
+}, upload: {
+    fileName: string;
+    contentType: string;
+    userId: string;
+}, copyFile: (from: string, to: string) => Promise<void>): Promise<AssetVersion>;
+/** One of an asset's versions, or null. */
+export declare function findVersion(projectId: string, assetId: string, versionId: string): Promise<AssetVersion | null>;
+/** Every key an asset's versions are stored in (its current one included). */
+export declare function versionStorageKeys(projectId: string, assetId: string, currentKey?: string): Promise<string[]>;
+/** Forgets an asset's versions (once their files are deleted). */
+export declare function deleteVersions(projectId: string, assetId: string): Promise<void>;

package/dist/services/assetVersions.js

@@ -0,0 +1,84 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.archivedVersionKey = exports.versionsCollection = void 0;
+exports.recordFirstVersion = recordFirstVersion;
+exports.archiveCurrentVersion = archiveCurrentVersion;
+exports.findVersion = findVersion;
+exports.versionStorageKeys = versionStorageKeys;
+exports.deleteVersions = deleteVersions;
+const crypto_1 = __importDefault(require("crypto"));
+const mongodb_1 = require("mongodb");
+const nosqlDb_1 = require("../utils/nosqlDb");
+const versionsCollection = () => (0, nosqlDb_1.nosqlDb)()?.collection('asset_versions') ?? null;
+exports.versionsCollection = versionsCollection;
+/** The key an asset's version `n` is archived in, next to the asset's own key. */
+const archivedVersionKey = (assetKey, version) => {
+    const extension = /(\.[^./]*)$/.exec(assetKey)?.[1] ?? '';
+    return `${assetKey.slice(0, assetKey.length - extension.length)}.v${version}${extension}`;
+};
+exports.archivedVersionKey = archivedVersionKey;
+/** Records the first version of an asset just made (or one made before versions were kept). */
+async function recordFirstVersion(file) {
+    const col = (0, exports.versionsCollection)();
+    if (!col)
+        return;
+    if (await col.findOne({ assetId: file.fileId, projectId: file.projectId }))
+        return;
+    await col.insertOne({
+        _id: new mongodb_1.ObjectId(),
+        versionId: crypto_1.default.randomUUID(),
+        assetId: file.fileId,
+        projectId: file.projectId,
+        version: 1,
+        storageKey: file.storageKey,
+        contentType: file.contentType ?? null,
+        fileName: file.displayName ?? null,
+        createdBy: file.uploadedBy ?? null,
+        createdAt: file.createdAt ?? new Date(),
+    });
+}
+/**
+ * Makes room for a new version of an asset, to be uploaded to its own key: its current version
+ * is copied to an archive key first (`copyFile`) and recorded there. If the copy fails nothing
+ * changes, and it throws: the current version is never lost.
+ */
+async function archiveCurrentVersion(file, upload, copyFile) {
+    const col = (0, exports.versionsCollection)();
+    if (!col)
+        throw new Error('Database not available');
+    await recordFirstVersion(file);
+    const [current] = await col.find({ assetId: file.fileId, projectId: file.projectId }).sort({ version: -1 }).limit(1).toArray();
+    const currentVersion = current?.version ?? 1;
+    const archiveKey = (0, exports.archivedVersionKey)(file.storageKey, currentVersion);
+    await copyFile(file.storageKey, archiveKey);
+    await col.updateOne({ assetId: file.fileId, projectId: file.projectId, version: currentVersion }, { $set: { storageKey: archiveKey } });
+    const record = {
+        versionId: crypto_1.default.randomUUID(),
+        assetId: file.fileId,
+        projectId: file.projectId,
+        version: currentVersion + 1,
+        storageKey: file.storageKey,
+        contentType: upload.contentType,
+        fileName: upload.fileName,
+        createdBy: upload.userId,
+        createdAt: new Date(),
+    };
+    await col.insertOne({ _id: new mongodb_1.ObjectId(), ...record });
+    return record;
+}
+/** One of an asset's versions, or null. */
+async function findVersion(projectId, assetId, versionId) {
+    return (await (0, exports.versionsCollection)()?.findOne({ projectId, assetId, versionId })) ?? null;
+}
+/** Every key an asset's versions are stored in (its current one included). */
+async function versionStorageKeys(projectId, assetId, currentKey) {
+    const versions = ((await (0, exports.versionsCollection)()?.find({ projectId, assetId }).toArray()) ?? []);
+    return [...new Set([...(currentKey ? [currentKey] : []), ...versions.map(v => v.storageKey)])];
+}
+/** Forgets an asset's versions (once their files are deleted). */
+async function deleteVersions(projectId, assetId) {
+    await (0, exports.versionsCollection)()?.deleteMany({ projectId, assetId });
+}

package/dist/services/auth.d.ts

@@ -1,7 +1,10 @@
 import { Request, Response, NextFunction } from 'express';
 import { Auth, StreamByConfig } from '../types';
+import { ApiTokenPermission } from './apiTokenPermissions';
 export declare const isPublicRoute: (method: string, path: string) => boolean;
-/** Whether a token's scope reaches a project. */
+/** Whether a token reaches a project. */
 export declare const scopeReachesProject: (scope: Auth["apiToken"], projectId: string) => boolean;
+/** Whether a token has a permission (a request without a token: always). */
+export declare const tokenAllows: (scope: Auth["apiToken"], permission: ApiTokenPermission) => boolean;
 export declare const enforceApiTokenScope: (req: Request, res: Response, next: NextFunction) => void | Response<any, Record<string, any>>;
 export declare const authenticate: (config: StreamByConfig) => (req: Request, res: Response, next: NextFunction) => Promise<void | Response<any, Record<string, any>>>;

package/dist/services/auth.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.authenticate = exports.enforceApiTokenScope = exports.scopeReachesProject = exports.isPublicRoute = void 0;
+exports.authenticate = exports.enforceApiTokenScope = exports.tokenAllows = exports.scopeReachesProject = exports.isPublicRoute = void 0;
+const auth_1 = require("../utils/auth");
+const apiTokenPermissions_1 = require("./apiTokenPermissions");
 // The one route open without a session: a project's public export, read
 // (GET /:projectId/export/:exportName, see routes/export). Exactly that path -- not any path
 // that has an "export" segment somewhere.
@@ -9,10 +11,11 @@ const READ_METHODS = ['GET', 'HEAD', 'OPTIONS'];
 const isPublicRoute = (method, path) => READ_METHODS.includes(method.toUpperCase()) && PUBLIC_EXPORT.test(path);
 exports.isPublicRoute = isPublicRoute;
 // ── API tokens ──
-// A request made with an API token reaches only what the token's scope does: no writes with a
-// read token, no project outside its projects (as if it didn't exist), no managing tokens, and
-// of the routes outside a project only the few below. Its owner's role in each project still
-// decides on top (the routes' own checks).
+// A request made with an API token reaches only what the token does: its route's permission
+// must be among the token's (see apiTokenPermissions), and a project outside its projects is as
+// if it didn't exist. A user's token is also limited by its user's role in each project (the
+// routes' own checks); a project's token acts in its project as an admin, so its permissions
+// are all it has.
 // The project a route acts on, by its path.
 const PROJECT_PATHS = [/^\/projects\/([^/]+)/, /^\/(?:upload|delete)-project-image-url\/([^/]+)/];
 const NOT_A_PROJECT = new Set(['create', 'explore']);
@@ -24,11 +27,12 @@ const projectIdOf = (path) => {
     }
     return undefined;
 };
-// Outside a project, a token reaches only these reads (each limited to its scope there).
-const OUTSIDE_A_PROJECT = [/^\/auth\/?$/, /^\/projects\/?$/, /^\/jobs\/[^/]+\/?$/, /^\/user\/subscription\/?$/, /^\/users\/search\/?$/];
-/** Whether a token's scope reaches a project. */
+/** Whether a token reaches a project. */
 const scopeReachesProject = (scope, projectId) => !scope || scope.projectIds === '*' || scope.projectIds.includes(projectId);
 exports.scopeReachesProject = scopeReachesProject;
+/** Whether a token has a permission (a request without a token: always). */
+const tokenAllows = (scope, permission) => !scope || scope.permissions.includes(permission);
+exports.tokenAllows = tokenAllows;
 const enforceApiTokenScope = (req, res, next) => {
     const scope = req.auth?.apiToken;
     if (!scope)
@@ -36,19 +40,17 @@ const enforceApiTokenScope = (req, res, next) => {
     // The MCP server handles a token itself: its tools call the routes here, each one checked.
     if (req.path === '/mcp')
         return next();
-    if (/^\/user\/api-tokens(\/|$)/.test(req.path)) {
-        return res.status(403).json({ error: 'API tokens are managed with a session, not with a token' });
-    }
-    if (!READ_METHODS.includes(req.method.toUpperCase()) && scope.access !== 'write') {
-        return res.status(403).json({ error: 'This API token can only read' });
+    const rule = (0, apiTokenPermissions_1.routeRuleFor)(req.method, req.path);
+    if (!rule || (rule.userTokenOnly && scope.kind !== 'user')) {
+        return res.status(403).json({ error: 'Not available with an API token' });
     }
     const projectId = projectIdOf(req.path);
-    if (projectId) {
-        return (0, exports.scopeReachesProject)(scope, projectId) ? next() : res.status(404).json({ message: 'Project not found' });
+    if (projectId && !(0, exports.scopeReachesProject)(scope, projectId))
+        return res.status(404).json({ message: 'Project not found' });
+    if (rule.permission && !(0, exports.tokenAllows)(scope, rule.permission)) {
+        return res.status(403).json({ error: `This API token doesn't have the '${rule.permission}' permission` });
     }
-    if (READ_METHODS.includes(req.method.toUpperCase()) && OUTSIDE_A_PROJECT.some(route => route.test(req.path)))
-        return next();
-    return res.status(403).json({ error: 'Not available with an API token' });
+    next();
 };
 exports.enforceApiTokenScope = enforceApiTokenScope;
 const authenticate = (config) => async (req, res, next) => {
@@ -60,6 +62,10 @@ const authenticate = (config) => async (req, res, next) => {
         if (!auth || !auth.userId || !auth.role) {
             return res.status(401).json({ error: 'Unauthorized' });
         }
+        // A project token's principal is only ever a project's token (see utils/auth).
+        if ((0, auth_1.isProjectTokenPrincipal)(auth.userId) && auth.apiToken?.kind !== 'project') {
+            return res.status(401).json({ error: 'Unauthorized' });
+        }
         req.auth = auth;
         next();
     }

package/dist/services/deliverables.d.ts

@@ -0,0 +1,26 @@
+export interface Deliverable {
+    id: string;
+    projectId: string;
+    assetId: string;
+    versionId: string | null;
+    shotId: string | null;
+    exportId: string | null;
+    note: string | null;
+    createdBy: string;
+    createdAt: Date;
+}
+export declare const deliverablesCollection: () => import("mongodb").Collection<import("bson").Document> | null;
+export declare function createDeliverable(fields: Omit<Deliverable, 'id' | 'createdAt'>): Promise<Deliverable>;
+/** A project's deliverables, of one shot or export if given, newest first. */
+export declare function listDeliverables(projectId: string, of?: {
+    shotId?: string;
+    exportId?: string;
+}): Promise<Deliverable[]>;
+/** Removes a deliverable (never its asset). Whether there was one. */
+export declare function deleteDeliverable(projectId: string, id: string): Promise<boolean>;
+/** Forgets the deliverables of what's gone: an asset, shots, or an export. */
+export declare function deleteDeliverablesOf(projectId: string, of: {
+    assetId?: string;
+    shotIds?: string[];
+    exportId?: string;
+}): Promise<void>;

package/dist/services/deliverables.js

@@ -0,0 +1,55 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deliverablesCollection = void 0;
+exports.createDeliverable = createDeliverable;
+exports.listDeliverables = listDeliverables;
+exports.deleteDeliverable = deleteDeliverable;
+exports.deleteDeliverablesOf = deleteDeliverablesOf;
+const crypto_1 = __importDefault(require("crypto"));
+const mongodb_1 = require("mongodb");
+const nosqlDb_1 = require("../utils/nosqlDb");
+const deliverablesCollection = () => (0, nosqlDb_1.nosqlDb)()?.collection('deliverables') ?? null;
+exports.deliverablesCollection = deliverablesCollection;
+const strip = ({ _id, ...deliverable }) => deliverable;
+async function createDeliverable(fields) {
+    const col = (0, exports.deliverablesCollection)();
+    if (!col)
+        throw new Error('Database not available');
+    const deliverable = { id: crypto_1.default.randomUUID(), ...fields, createdAt: new Date() };
+    await col.insertOne({ _id: new mongodb_1.ObjectId(), ...deliverable });
+    return deliverable;
+}
+/** A project's deliverables, of one shot or export if given, newest first. */
+async function listDeliverables(projectId, of = {}) {
+    const col = (0, exports.deliverablesCollection)();
+    if (!col)
+        throw new Error('Database not available');
+    const filter = { projectId };
+    if (of.shotId)
+        filter.shotId = of.shotId;
+    if (of.exportId)
+        filter.exportId = of.exportId;
+    return (await col.find(filter).sort({ createdAt: -1 }).toArray()).map(strip);
+}
+/** Removes a deliverable (never its asset). Whether there was one. */
+async function deleteDeliverable(projectId, id) {
+    const col = (0, exports.deliverablesCollection)();
+    if (!col)
+        throw new Error('Database not available');
+    return (await col.deleteOne({ projectId, id })).deletedCount > 0;
+}
+/** Forgets the deliverables of what's gone: an asset, shots, or an export. */
+async function deleteDeliverablesOf(projectId, of) {
+    const col = (0, exports.deliverablesCollection)();
+    if (!col)
+        return;
+    if (of.assetId)
+        await col.deleteMany({ projectId, assetId: of.assetId });
+    if (of.shotIds?.length)
+        await col.deleteMany({ projectId, shotId: { $in: of.shotIds } });
+    if (of.exportId)
+        await col.deleteMany({ projectId, exportId: of.exportId });
+}

package/dist/services/mediaProcessor.js

@@ -69,7 +69,9 @@ async function runIngestJob(jobId, fileId, projectId) {
         }
         (0, jobQueue_1.updateJob)(jobId, { stage: 'creating-version', progress: 70 });
         const versionsCol = getVersionsCollection();
-        if (versionsCol) {
+        // Its upload already recorded the version it's in; only an asset from before versions
+        // were kept gets one here.
+        if (versionsCol && !(await versionsCol.findOne({ assetId: fileId, projectId, storageKey: fileDoc.storageKey }))) {
             const existing = await versionsCol.countDocuments({ assetId: fileId, projectId });
             await versionsCol.insertOne({
                 _id: new mongodb_1.ObjectId(),

package/dist/services/production.d.ts

@@ -0,0 +1,2 @@
+/** A deleted project's sequences, shots, tasks and deliverables: only that project's. */
+export declare function deleteProductionData(projectId: string): Promise<void>;

package/dist/services/production.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deleteProductionData = deleteProductionData;
+const nosqlDb_1 = require("../utils/nosqlDb");
+/** A deleted project's sequences, shots, tasks and deliverables: only that project's. */
+async function deleteProductionData(projectId) {
+    const db = (0, nosqlDb_1.nosqlDb)();
+    if (!db || !projectId)
+        return;
+    for (const name of ['production_tasks', 'production_shots', 'production_sequences', 'deliverables']) {
+        await db.collection(name).deleteMany({ projectId });
+    }
+}

package/dist/services/productionFields.d.ts

@@ -0,0 +1,16 @@
+export declare const PRODUCTION_STATUSES: readonly ["todo", "in_progress", "review", "done"];
+export declare const TASK_PRIORITIES: readonly ["low", "medium", "high"];
+type Field = 'name' | 'description' | 'notes' | 'status' | 'priority' | 'assignees' | 'assignee' | 'dueDate' | 'order' | 'assetId' | 'exportId';
+export type FieldsResult = {
+    values: Record<string, any>;
+} | {
+    error: string;
+};
+/**
+ * The fields of `body` that `allowed` lists, checked and ready to save (`assignees` and
+ * `assignee` are saved as `assignedTo`). With `creating`, a name is required.
+ */
+export declare function checkProductionFields(body: any, allowed: readonly Field[], project: any, { creating }?: {
+    creating?: boolean | undefined;
+}): FieldsResult;
+export {};