streamby-core 0.37.0 → 0.38.0

package/dist/middleware/routes/storage.js

@@ -15,6 +15,9 @@ const builtinAccess_1 = require("../../utils/builtinAccess");
 const connectionResolver_1 = require("../../services/connectionResolver");
 const mongodb_1 = require("mongodb");
 const crypto_1 = __importDefault(require("crypto"));
+const signedUrls_1 = require("../../services/signedUrls");
+const assetVersions_1 = require("../../services/assetVersions");
+const deliverables_1 = require("../../services/deliverables");
 const VALID_CATEGORIES = ['images', 'audios', 'videos', '3d-models'];
 const VALID_3D_EXTENSIONS = new Set(['.glb', '.gltf', '.obj', '.fbx', '.stl', '.ply']);
 function validateContentType(contentType, filename, category) {
@@ -135,7 +138,7 @@ function storageRouter(config) {
             const storageKey = `${projectId}/${category}/${fileId}${ext}`;
             const collection = getRawFilesCollection();
             if (collection) {
-                await collection.insertOne({
+                const fileDoc = {
                     _id: new mongodb_1.ObjectId(),
                     fileId,
                     projectId,
@@ -145,10 +148,13 @@ function storageRouter(config) {
                     contentType,
                     uploadedBy: auth.userId,
                     createdAt: new Date(),
-                });
+                };
+                await collection.insertOne(fileDoc);
+                await (0, assetVersions_1.recordFirstVersion)(fileDoc);
             }
-            const url = await adapter.getPresignedUploadUrl(storageKey, contentType);
-            res.json({ url, fileId, storageKey, displayName: fileName });
+            const expiresIn = (0, signedUrls_1.signedUrlTtl)(auth, config, 'upload');
+            const url = await adapter.getPresignedUploadUrl(storageKey, contentType, expiresIn);
+            res.json({ url, fileId, storageKey, displayName: fileName, ...expiry(expiresIn) });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to generate upload URL', details: err.message });
@@ -165,7 +171,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             const collection = getRawFilesCollection();
             if (!collection)
@@ -179,9 +185,21 @@ function storageRouter(config) {
             if (!adapter.getPresignedUploadUrl) {
                 return res.status(501).json({ message: 'Storage adapter does not support presigned uploads' });
             }
-            const url = await adapter.getPresignedUploadUrl(fileDoc.storageKey, contentType);
+            // The new version goes to the asset's own key, so its URL doesn't change; the current
+            // one is archived first, and without a way to archive it nothing is replaced.
+            if (!adapter.copyFile)
+                return res.status(501).json({ message: 'Storage adapter cannot keep versions' });
+            let version;
+            try {
+                version = await (0, assetVersions_1.archiveCurrentVersion)(fileDoc, { fileName, contentType, userId: auth.userId }, adapter.copyFile.bind(adapter));
+            }
+            catch (err) {
+                return res.status(502).json({ message: 'Failed to archive the current version; nothing was replaced', details: err.message });
+            }
+            const expiresIn = (0, signedUrls_1.signedUrlTtl)(auth, config, 'upload');
+            const url = await adapter.getPresignedUploadUrl(fileDoc.storageKey, contentType, expiresIn);
             await collection.updateOne({ fileId, projectId }, { $set: { contentType, updatedAt: new Date() } });
-            res.json({ url, storageKey: fileDoc.storageKey, fileId });
+            res.json({ url, storageKey: fileDoc.storageKey, fileId, versionId: version.versionId, version: version.version, ...expiry(expiresIn) });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to generate replace URL', details: err.message });
@@ -227,8 +245,7 @@ function storageRouter(config) {
             const fileDoc = await collection.findOne({ fileId, projectId });
             if (!fileDoc)
                 return res.status(404).json({ message: 'File not found' });
-            if (adapter.deleteFile)
-                await adapter.deleteFile(fileDoc.storageKey);
+            await deleteAsset(fileDoc, adapter);
             await collection.deleteOne({ fileId, projectId });
             res.json({ message: 'File deleted successfully' });
         }
@@ -249,7 +266,7 @@ function storageRouter(config) {
             if (!collection)
                 return res.status(500).json({ message: 'Database not available' });
             const files = await collection.find({ projectId }).sort({ createdAt: -1 }).limit(12).toArray();
-            const data = await Promise.all(files.map(f => resolveFileUrl(f, adapter)));
+            const data = await Promise.all(files.map(f => resolveFileUrl(f, adapter, (0, signedUrls_1.signedUrlTtl)(auth, config, 'download'))));
             res.json({ data });
         }
         catch (err) {
@@ -272,13 +289,61 @@ function storageRouter(config) {
             if (!collection)
                 return res.status(500).json({ message: 'Database not available' });
             const files = await collection.find({ projectId, category }).sort({ createdAt: -1 }).toArray();
-            const data = await Promise.all(files.map(f => resolveFileUrl(f, adapter)));
+            const data = await Promise.all(files.map(f => resolveFileUrl(f, adapter, (0, signedUrls_1.signedUrlTtl)(auth, config, 'download'))));
             res.json({ data });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to list files', details: err.message });
         }
     });
+    // A short-lived URL to download an asset, or one of its versions, wherever it's stored
+    // (the built-in storage or one of the project's storage connections). It's for that file
+    // only, and downloads it with its name.
+    router.get('/projects/:projectId/assets/:fileId/download-url', async (req, res) => {
+        try {
+            const auth = req.auth;
+            const { projectId, fileId } = req.params;
+            const { versionId } = req.query;
+            const project = await Project.findOne({ _id: projectId });
+            if (!project)
+                return res.status(404).json({ message: 'Project not found' });
+            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+                return res.status(403).json({ message: 'Unauthorized access' });
+            const collection = getRawFilesCollection();
+            if (!collection)
+                return res.status(500).json({ message: 'Database not available' });
+            const fileDoc = await collection.findOne({ fileId, projectId });
+            if (!fileDoc)
+                return res.status(404).json({ message: 'File not found' });
+            let storageKey = fileDoc.storageKey;
+            let fileName = fileDoc.displayName;
+            let contentType = fileDoc.contentType;
+            let version;
+            if (versionId) {
+                const found = await (0, assetVersions_1.findVersion)(projectId, fileId, versionId);
+                if (!found)
+                    return res.status(404).json({ message: 'Version not found' });
+                storageKey = found.storageKey;
+                fileName = found.fileName ?? fileName;
+                contentType = found.contentType ?? contentType;
+                version = found.version;
+            }
+            // Its storage connection's adapter; files stored before connections had their own row
+            // (no connection, or the built-in provider's id) are in the default storage.
+            const connId = fileDoc.storageConnectionId;
+            const fileAdapter = connId && findStorageConn(project, connId) ? await resolveConnAdapter(connId, project, auth) : adapter;
+            if ('error' in fileAdapter)
+                return res.status(fileAdapter.status).json({ message: fileAdapter.error });
+            if (!fileAdapter.getPresignedGetUrl)
+                return res.status(501).json({ message: 'Storage adapter does not support download URLs' });
+            const expiresIn = (0, signedUrls_1.signedUrlTtl)(auth, config, 'download') ?? 3600;
+            const url = await fileAdapter.getPresignedGetUrl(storageKey, expiresIn, fileName);
+            res.json({ url, fileId, fileName, contentType: contentType ?? null, ...(version ? { versionId, version } : {}), ...expiry(expiresIn) });
+        }
+        catch (err) {
+            res.status(500).json({ message: 'Failed to generate download URL', details: err.message });
+        }
+    });
     // ─── Per-connection file routes ───────────────────────────────────────────
     router.get('/projects/:projectId/connections/storage/:connId/upload-url', async (req, res) => {
         try {
@@ -309,7 +374,7 @@ function storageRouter(config) {
             const storageKey = `${projectId}/${category}/${fileId}${ext}`;
             const collection = getRawFilesCollection();
             if (collection) {
-                await collection.insertOne({
+                const fileDoc = {
                     _id: new mongodb_1.ObjectId(),
                     fileId,
                     projectId,
@@ -320,10 +385,13 @@ function storageRouter(config) {
                     contentType,
                     uploadedBy: auth.userId,
                     createdAt: new Date(),
-                });
+                };
+                await collection.insertOne(fileDoc);
+                await (0, assetVersions_1.recordFirstVersion)(fileDoc);
             }
-            const url = await connAdapter.getPresignedUploadUrl(storageKey, contentType);
-            res.json({ url, fileId, storageKey, displayName: fileName });
+            const expiresIn = (0, signedUrls_1.signedUrlTtl)(auth, config, 'upload');
+            const url = await connAdapter.getPresignedUploadUrl(storageKey, contentType, expiresIn);
+            res.json({ url, fileId, storageKey, displayName: fileName, ...expiry(expiresIn) });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to generate upload URL', details: err.message });
@@ -345,7 +413,7 @@ function storageRouter(config) {
             if (!collection)
                 return res.status(500).json({ message: 'Database not available' });
             const files = await collection.find(connFilter(projectId, connId, project)).sort({ createdAt: -1 }).limit(12).toArray();
-            const data = await Promise.all(files.map(f => resolveFileUrl(f, connAdapter)));
+            const data = await Promise.all(files.map(f => resolveFileUrl(f, connAdapter, (0, signedUrls_1.signedUrlTtl)(auth, config, 'download'))));
             res.json({ data });
         }
         catch (err) {
@@ -371,7 +439,7 @@ function storageRouter(config) {
             if (!collection)
                 return res.status(500).json({ message: 'Database not available' });
             const files = await collection.find(connFilter(projectId, connId, project, { category })).sort({ createdAt: -1 }).toArray();
-            const data = await Promise.all(files.map(f => resolveFileUrl(f, connAdapter)));
+            const data = await Promise.all(files.map(f => resolveFileUrl(f, connAdapter, (0, signedUrls_1.signedUrlTtl)(auth, config, 'download'))));
             res.json({ data });
         }
         catch (err) {
@@ -389,7 +457,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             const collection = getRawFilesCollection();
             if (!collection)
@@ -406,9 +474,21 @@ function storageRouter(config) {
             if (!connAdapter.getPresignedUploadUrl) {
                 return res.status(501).json({ message: 'Storage adapter does not support presigned uploads' });
             }
-            const url = await connAdapter.getPresignedUploadUrl(fileDoc.storageKey, contentType);
+            // The new version goes to the asset's own key, so its URL doesn't change; the current
+            // one is archived first, and without a way to archive it nothing is replaced.
+            if (!connAdapter.copyFile)
+                return res.status(501).json({ message: 'Storage adapter cannot keep versions' });
+            let version;
+            try {
+                version = await (0, assetVersions_1.archiveCurrentVersion)(fileDoc, { fileName, contentType, userId: auth.userId }, connAdapter.copyFile.bind(connAdapter));
+            }
+            catch (err) {
+                return res.status(502).json({ message: 'Failed to archive the current version; nothing was replaced', details: err.message });
+            }
+            const expiresIn = (0, signedUrls_1.signedUrlTtl)(auth, config, 'upload');
+            const url = await connAdapter.getPresignedUploadUrl(fileDoc.storageKey, contentType, expiresIn);
             await collection.updateOne(connFilter(projectId, connId, project, { fileId }), { $set: { contentType, updatedAt: new Date() } });
-            res.json({ url, storageKey: fileDoc.storageKey, fileId });
+            res.json({ url, storageKey: fileDoc.storageKey, fileId, versionId: version.versionId, version: version.version, ...expiry(expiresIn) });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to generate replace URL', details: err.message });
@@ -457,8 +537,7 @@ function storageRouter(config) {
             const fileDoc = await collection.findOne(connFilter(projectId, connId, project, { fileId }));
             if (!fileDoc)
                 return res.status(404).json({ message: 'File not found' });
-            if (connAdapter.deleteFile)
-                await connAdapter.deleteFile(fileDoc.storageKey);
+            await deleteAsset(fileDoc, connAdapter);
             await collection.deleteOne(connFilter(projectId, connId, project, { fileId }));
             res.json({ message: 'File deleted successfully' });
         }
@@ -731,11 +810,11 @@ function storageRouter(config) {
     });
     return router;
 }
-async function resolveFileUrl(file, adapter) {
+async function resolveFileUrl(file, adapter, expiresIn) {
     let url = null;
     if (adapter.getPresignedGetUrl) {
         try {
-            url = await adapter.getPresignedGetUrl(file.storageKey);
+            url = await adapter.getPresignedGetUrl(file.storageKey, expiresIn);
         }
         catch { /* leave null */ }
     }
@@ -751,3 +830,15 @@ async function resolveFileUrl(file, adapter) {
         url,
     };
 }
+// When a signed URL stops working, for a client to know (only when it's short-lived).
+const expiry = (expiresIn) => expiresIn ? { expiresAt: new Date(Date.now() + expiresIn * 1000).toISOString() } : {};
+// An asset's files (every version), its versions and its deliverables. Its record is the
+// caller's to delete.
+async function deleteAsset(fileDoc, adapter) {
+    const keys = await (0, assetVersions_1.versionStorageKeys)(fileDoc.projectId, fileDoc.fileId, fileDoc.storageKey);
+    if (adapter.deleteFile)
+        for (const key of keys)
+            await adapter.deleteFile(key);
+    await (0, assetVersions_1.deleteVersions)(fileDoc.projectId, fileDoc.fileId);
+    await (0, deliverables_1.deleteDeliverablesOf)(fileDoc.projectId, { assetId: fileDoc.fileId });
+}

package/dist/services/apiTokenPermissions.js

@@ -62,11 +62,15 @@ const RULES = [
     rule('read', `${P}/connections/storage/[^/]+/(files|folders)(/.+)?`, 'assets:read'),
     rule(['POST', 'PATCH'], `${P}/connections/storage/[^/]+/(files|folders)(/.+)?`, 'assets:write'),
     rule('delete', `${P}/connections/storage/[^/]+/(files|folders)/[^/]+`, 'assets:delete'),
-    rule('read', `${P}/assets/[^/]+/(metadata|versions|qc-report|dependency-graph)`, 'assets:read'),
+    rule('read', `${P}/assets/[^/]+/(metadata|versions|qc-report|dependency-graph|download-url)`, 'assets:read'),
     rule(['PATCH'], `${P}/assets/[^/]+/metadata`, 'assets:write'),
     rule(['POST'], `${P}/assets/[^/]+/qc-report`, 'assets:write'),
     rule('read', `${P}/(reviews(/[^/]+)?|assets/[^/]+/versions/[^/]+/annotations)`, 'assets:read'),
     rule(['POST', 'PATCH'], `${P}/(reviews(/[^/]+/decision)?|assets/[^/]+/versions/[^/]+/annotations(/[^/]+/resolve)?)`, 'assets:write'),
+    // Deliverables: an asset (or a version) delivered for a shot or an export.
+    rule('read', `${P}/deliverables`, 'assets:read'),
+    rule(['POST'], `${P}/deliverables`, 'assets:write'),
+    rule('delete', `${P}/deliverables/[^/]+`, 'assets:write'),
     // Rights.
     rule('read', `${P}/assets/[^/]+/rights`, 'rights:read'),
     rule(['PUT'], `${P}/assets/[^/]+/rights`, 'rights:write'),

package/dist/services/assetVersions.d.ts

@@ -0,0 +1,48 @@
+export interface AssetVersion {
+    versionId: string;
+    assetId: string;
+    projectId: string;
+    version: number;
+    storageKey: string;
+    contentType: string | null;
+    fileName: string | null;
+    createdBy: string | null;
+    createdAt: Date;
+}
+export declare const versionsCollection: () => import("mongodb").Collection<import("bson").Document> | null;
+/** The key an asset's version `n` is archived in, next to the asset's own key. */
+export declare const archivedVersionKey: (assetKey: string, version: number) => string;
+/** Records the first version of an asset just made (or one made before versions were kept). */
+export declare function recordFirstVersion(file: {
+    fileId: string;
+    projectId: string;
+    storageKey: string;
+    contentType?: string;
+    displayName?: string;
+    uploadedBy?: string;
+    createdAt?: Date;
+}): Promise<void>;
+/**
+ * Makes room for a new version of an asset, to be uploaded to its own key: its current version
+ * is copied to an archive key first (`copyFile`) and recorded there. If the copy fails nothing
+ * changes, and it throws: the current version is never lost.
+ */
+export declare function archiveCurrentVersion(file: {
+    fileId: string;
+    projectId: string;
+    storageKey: string;
+    contentType?: string;
+    displayName?: string;
+    uploadedBy?: string;
+    createdAt?: Date;
+}, upload: {
+    fileName: string;
+    contentType: string;
+    userId: string;
+}, copyFile: (from: string, to: string) => Promise<void>): Promise<AssetVersion>;
+/** One of an asset's versions, or null. */
+export declare function findVersion(projectId: string, assetId: string, versionId: string): Promise<AssetVersion | null>;
+/** Every key an asset's versions are stored in (its current one included). */
+export declare function versionStorageKeys(projectId: string, assetId: string, currentKey?: string): Promise<string[]>;
+/** Forgets an asset's versions (once their files are deleted). */
+export declare function deleteVersions(projectId: string, assetId: string): Promise<void>;

package/dist/services/assetVersions.js

@@ -0,0 +1,84 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.archivedVersionKey = exports.versionsCollection = void 0;
+exports.recordFirstVersion = recordFirstVersion;
+exports.archiveCurrentVersion = archiveCurrentVersion;
+exports.findVersion = findVersion;
+exports.versionStorageKeys = versionStorageKeys;
+exports.deleteVersions = deleteVersions;
+const crypto_1 = __importDefault(require("crypto"));
+const mongodb_1 = require("mongodb");
+const nosqlDb_1 = require("../utils/nosqlDb");
+const versionsCollection = () => (0, nosqlDb_1.nosqlDb)()?.collection('asset_versions') ?? null;
+exports.versionsCollection = versionsCollection;
+/** The key an asset's version `n` is archived in, next to the asset's own key. */
+const archivedVersionKey = (assetKey, version) => {
+    const extension = /(\.[^./]*)$/.exec(assetKey)?.[1] ?? '';
+    return `${assetKey.slice(0, assetKey.length - extension.length)}.v${version}${extension}`;
+};
+exports.archivedVersionKey = archivedVersionKey;
+/** Records the first version of an asset just made (or one made before versions were kept). */
+async function recordFirstVersion(file) {
+    const col = (0, exports.versionsCollection)();
+    if (!col)
+        return;
+    if (await col.findOne({ assetId: file.fileId, projectId: file.projectId }))
+        return;
+    await col.insertOne({
+        _id: new mongodb_1.ObjectId(),
+        versionId: crypto_1.default.randomUUID(),
+        assetId: file.fileId,
+        projectId: file.projectId,
+        version: 1,
+        storageKey: file.storageKey,
+        contentType: file.contentType ?? null,
+        fileName: file.displayName ?? null,
+        createdBy: file.uploadedBy ?? null,
+        createdAt: file.createdAt ?? new Date(),
+    });
+}
+/**
+ * Makes room for a new version of an asset, to be uploaded to its own key: its current version
+ * is copied to an archive key first (`copyFile`) and recorded there. If the copy fails nothing
+ * changes, and it throws: the current version is never lost.
+ */
+async function archiveCurrentVersion(file, upload, copyFile) {
+    const col = (0, exports.versionsCollection)();
+    if (!col)
+        throw new Error('Database not available');
+    await recordFirstVersion(file);
+    const [current] = await col.find({ assetId: file.fileId, projectId: file.projectId }).sort({ version: -1 }).limit(1).toArray();
+    const currentVersion = current?.version ?? 1;
+    const archiveKey = (0, exports.archivedVersionKey)(file.storageKey, currentVersion);
+    await copyFile(file.storageKey, archiveKey);
+    await col.updateOne({ assetId: file.fileId, projectId: file.projectId, version: currentVersion }, { $set: { storageKey: archiveKey } });
+    const record = {
+        versionId: crypto_1.default.randomUUID(),
+        assetId: file.fileId,
+        projectId: file.projectId,
+        version: currentVersion + 1,
+        storageKey: file.storageKey,
+        contentType: upload.contentType,
+        fileName: upload.fileName,
+        createdBy: upload.userId,
+        createdAt: new Date(),
+    };
+    await col.insertOne({ _id: new mongodb_1.ObjectId(), ...record });
+    return record;
+}
+/** One of an asset's versions, or null. */
+async function findVersion(projectId, assetId, versionId) {
+    return (await (0, exports.versionsCollection)()?.findOne({ projectId, assetId, versionId })) ?? null;
+}
+/** Every key an asset's versions are stored in (its current one included). */
+async function versionStorageKeys(projectId, assetId, currentKey) {
+    const versions = ((await (0, exports.versionsCollection)()?.find({ projectId, assetId }).toArray()) ?? []);
+    return [...new Set([...(currentKey ? [currentKey] : []), ...versions.map(v => v.storageKey)])];
+}
+/** Forgets an asset's versions (once their files are deleted). */
+async function deleteVersions(projectId, assetId) {
+    await (0, exports.versionsCollection)()?.deleteMany({ projectId, assetId });
+}

package/dist/services/deliverables.d.ts

@@ -0,0 +1,26 @@
+export interface Deliverable {
+    id: string;
+    projectId: string;
+    assetId: string;
+    versionId: string | null;
+    shotId: string | null;
+    exportId: string | null;
+    note: string | null;
+    createdBy: string;
+    createdAt: Date;
+}
+export declare const deliverablesCollection: () => import("mongodb").Collection<import("bson").Document> | null;
+export declare function createDeliverable(fields: Omit<Deliverable, 'id' | 'createdAt'>): Promise<Deliverable>;
+/** A project's deliverables, of one shot or export if given, newest first. */
+export declare function listDeliverables(projectId: string, of?: {
+    shotId?: string;
+    exportId?: string;
+}): Promise<Deliverable[]>;
+/** Removes a deliverable (never its asset). Whether there was one. */
+export declare function deleteDeliverable(projectId: string, id: string): Promise<boolean>;
+/** Forgets the deliverables of what's gone: an asset, shots, or an export. */
+export declare function deleteDeliverablesOf(projectId: string, of: {
+    assetId?: string;
+    shotIds?: string[];
+    exportId?: string;
+}): Promise<void>;

package/dist/services/deliverables.js

@@ -0,0 +1,55 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deliverablesCollection = void 0;
+exports.createDeliverable = createDeliverable;
+exports.listDeliverables = listDeliverables;
+exports.deleteDeliverable = deleteDeliverable;
+exports.deleteDeliverablesOf = deleteDeliverablesOf;
+const crypto_1 = __importDefault(require("crypto"));
+const mongodb_1 = require("mongodb");
+const nosqlDb_1 = require("../utils/nosqlDb");
+const deliverablesCollection = () => (0, nosqlDb_1.nosqlDb)()?.collection('deliverables') ?? null;
+exports.deliverablesCollection = deliverablesCollection;
+const strip = ({ _id, ...deliverable }) => deliverable;
+async function createDeliverable(fields) {
+    const col = (0, exports.deliverablesCollection)();
+    if (!col)
+        throw new Error('Database not available');
+    const deliverable = { id: crypto_1.default.randomUUID(), ...fields, createdAt: new Date() };
+    await col.insertOne({ _id: new mongodb_1.ObjectId(), ...deliverable });
+    return deliverable;
+}
+/** A project's deliverables, of one shot or export if given, newest first. */
+async function listDeliverables(projectId, of = {}) {
+    const col = (0, exports.deliverablesCollection)();
+    if (!col)
+        throw new Error('Database not available');
+    const filter = { projectId };
+    if (of.shotId)
+        filter.shotId = of.shotId;
+    if (of.exportId)
+        filter.exportId = of.exportId;
+    return (await col.find(filter).sort({ createdAt: -1 }).toArray()).map(strip);
+}
+/** Removes a deliverable (never its asset). Whether there was one. */
+async function deleteDeliverable(projectId, id) {
+    const col = (0, exports.deliverablesCollection)();
+    if (!col)
+        throw new Error('Database not available');
+    return (await col.deleteOne({ projectId, id })).deletedCount > 0;
+}
+/** Forgets the deliverables of what's gone: an asset, shots, or an export. */
+async function deleteDeliverablesOf(projectId, of) {
+    const col = (0, exports.deliverablesCollection)();
+    if (!col)
+        return;
+    if (of.assetId)
+        await col.deleteMany({ projectId, assetId: of.assetId });
+    if (of.shotIds?.length)
+        await col.deleteMany({ projectId, shotId: { $in: of.shotIds } });
+    if (of.exportId)
+        await col.deleteMany({ projectId, exportId: of.exportId });
+}

package/dist/services/mediaProcessor.js

@@ -69,7 +69,9 @@ async function runIngestJob(jobId, fileId, projectId) {
         }
         (0, jobQueue_1.updateJob)(jobId, { stage: 'creating-version', progress: 70 });
         const versionsCol = getVersionsCollection();
-        if (versionsCol) {
+        // Its upload already recorded the version it's in; only an asset from before versions
+        // were kept gets one here.
+        if (versionsCol && !(await versionsCol.findOne({ assetId: fileId, projectId, storageKey: fileDoc.storageKey }))) {
             const existing = await versionsCol.countDocuments({ assetId: fileId, projectId });
             await versionsCol.insertOne({
                 _id: new mongodb_1.ObjectId(),

package/dist/services/production.d.ts

@@ -0,0 +1,2 @@
+/** A deleted project's sequences, shots, tasks and deliverables: only that project's. */
+export declare function deleteProductionData(projectId: string): Promise<void>;

package/dist/services/production.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deleteProductionData = deleteProductionData;
+const nosqlDb_1 = require("../utils/nosqlDb");
+/** A deleted project's sequences, shots, tasks and deliverables: only that project's. */
+async function deleteProductionData(projectId) {
+    const db = (0, nosqlDb_1.nosqlDb)();
+    if (!db || !projectId)
+        return;
+    for (const name of ['production_tasks', 'production_shots', 'production_sequences', 'deliverables']) {
+        await db.collection(name).deleteMany({ projectId });
+    }
+}

package/dist/services/productionFields.d.ts

@@ -0,0 +1,16 @@
+export declare const PRODUCTION_STATUSES: readonly ["todo", "in_progress", "review", "done"];
+export declare const TASK_PRIORITIES: readonly ["low", "medium", "high"];
+type Field = 'name' | 'description' | 'notes' | 'status' | 'priority' | 'assignees' | 'assignee' | 'dueDate' | 'order' | 'assetId' | 'exportId';
+export type FieldsResult = {
+    values: Record<string, any>;
+} | {
+    error: string;
+};
+/**
+ * The fields of `body` that `allowed` lists, checked and ready to save (`assignees` and
+ * `assignee` are saved as `assignedTo`). With `creating`, a name is required.
+ */
+export declare function checkProductionFields(body: any, allowed: readonly Field[], project: any, { creating }?: {
+    creating?: boolean | undefined;
+}): FieldsResult;
+export {};

package/dist/services/productionFields.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TASK_PRIORITIES = exports.PRODUCTION_STATUSES = void 0;
+exports.checkProductionFields = checkProductionFields;
+const auth_1 = require("../utils/auth");
+// What a production sequence, shot or task may be given, checked before it's saved: a name
+// that isn't blank, a known status and priority, assignees who are members of the project, a
+// due date that is a date.
+exports.PRODUCTION_STATUSES = ['todo', 'in_progress', 'review', 'done'];
+exports.TASK_PRIORITIES = ['low', 'medium', 'high'];
+const MAX_NAME = 200;
+const MAX_TEXT = 5000;
+/**
+ * The fields of `body` that `allowed` lists, checked and ready to save (`assignees` and
+ * `assignee` are saved as `assignedTo`). With `creating`, a name is required.
+ */
+function checkProductionFields(body, allowed, project, { creating = false } = {}) {
+    const values = {};
+    const given = (field) => body?.[field] !== undefined;
+    const has = (field) => allowed.includes(field);
+    if (creating && !given('name'))
+        return { error: 'name is required' };
+    if (has('name') && given('name')) {
+        if (typeof body.name !== 'string' || !body.name.trim())
+            return { error: 'name must not be blank' };
+        if (body.name.trim().length > MAX_NAME)
+            return { error: `name must be at most ${MAX_NAME} characters` };
+        values.name = body.name.trim();
+    }
+    for (const field of ['description', 'notes']) {
+        if (!has(field) || !given(field))
+            continue;
+        const value = body[field];
+        if (value !== null && (typeof value !== 'string' || value.length > MAX_TEXT)) {
+            return { error: `${field} must be text of at most ${MAX_TEXT} characters, or null` };
+        }
+        values[field] = value === null || !value.trim() ? null : value;
+    }
+    if (has('status') && given('status')) {
+        if (!exports.PRODUCTION_STATUSES.includes(body.status))
+            return { error: `status must be one of ${exports.PRODUCTION_STATUSES.join(', ')}` };
+        values.status = body.status;
+    }
+    if (has('priority') && given('priority')) {
+        if (!exports.TASK_PRIORITIES.includes(body.priority))
+            return { error: `priority must be one of ${exports.TASK_PRIORITIES.join(', ')}` };
+        values.priority = body.priority;
+    }
+    const isMember = (id) => typeof id === 'string' && !!(0, auth_1.activeMemberOf)(project, id);
+    if (has('assignees') && given('assignedTo')) {
+        const ids = body.assignedTo;
+        if (!Array.isArray(ids) || !ids.every(isMember))
+            return { error: 'assignedTo must be a list of members of the project' };
+        values.assignedTo = [...new Set(ids)];
+    }
+    if (has('assignee') && given('assignedTo')) {
+        if (body.assignedTo !== null && !isMember(body.assignedTo))
+            return { error: 'assignedTo must be a member of the project, or null' };
+        values.assignedTo = body.assignedTo;
+    }
+    if (has('dueDate') && given('dueDate')) {
+        const date = body.dueDate === null || body.dueDate === '' ? null : new Date(body.dueDate);
+        if (date && Number.isNaN(date.getTime()))
+            return { error: 'dueDate must be a date, or null' };
+        values.dueDate = date;
+    }
+    if (has('order') && given('order')) {
+        if (typeof body.order !== 'number' || !Number.isFinite(body.order))
+            return { error: 'order must be a number' };
+        values.order = body.order;
+    }
+    for (const field of ['assetId', 'exportId']) {
+        if (!has(field) || !given(field))
+            continue;
+        if (body[field] !== null && typeof body[field] !== 'string')
+            return { error: `${field} must be an id, or null` };
+        values[field] = body[field] || null;
+    }
+    return { values };
+}

package/dist/services/signedUrls.d.ts

@@ -0,0 +1,6 @@
+import { Auth, StreamByConfig } from '../types';
+export declare const DEFAULT_TOKEN_SIGNED_URL_TTL: {
+    upload: number;
+    download: number;
+};
+export declare const signedUrlTtl: (auth: Auth | undefined, config: StreamByConfig, kind: "upload" | "download") => number | undefined;

package/dist/services/signedUrls.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signedUrlTtl = exports.DEFAULT_TOKEN_SIGNED_URL_TTL = void 0;
+// How long a signed storage URL works. A request made with an API token (an agent, the MCP
+// server) gets short-lived ones; a browser session, the adapter's own (an hour to upload, a
+// day to read).
+exports.DEFAULT_TOKEN_SIGNED_URL_TTL = { upload: 15 * 60, download: 5 * 60 };
+const signedUrlTtl = (auth, config, kind) => auth?.apiToken ? config.mcp?.signedUrlTtl?.[kind] ?? exports.DEFAULT_TOKEN_SIGNED_URL_TTL[kind] : undefined;
+exports.signedUrlTtl = signedUrlTtl;