streamby-core 0.39.0 → 0.41.0

package/dist/adapters/database/connectionManager.js

@@ -41,159 +41,217 @@ const getConnection = (id) => {
     return clientEntry;
 };
 exports.getConnection = getConnection;
+// StreamBy's tables, made (or brought up to date) at startup. Several instances starting at once
+// against the same database would deadlock on these statements, so one runs them at a time:
+// in a transaction holding a transaction-level advisory lock, which ends with it. (A session
+// lock could outlive its unlock behind a pooler in transaction mode, such as Supabase's, which
+// may run the unlock on another connection, and block every later startup.)
 const ensureTablesExist = async (pool) => {
+    const client = await pool.connect();
     try {
-        await pool.query(`
-      CREATE SCHEMA IF NOT EXISTS streamby;
-      CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
+        await client.query('BEGIN');
+        await client.query(`SELECT pg_advisory_xact_lock(hashtext('streamby:ensure-tables'))`);
+        await createTables(client);
+        await client.query('COMMIT');
+    }
+    catch (error) {
+        await client.query('ROLLBACK').catch(() => { });
+        throw error;
+    }
+    finally {
+        client.release();
+    }
+};
+const createTables = async (pool) => {
+    try {
+        await pool.query(`
+      CREATE SCHEMA IF NOT EXISTS streamby;
+      CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
     `);
         // Migrate id column from UUID to TEXT if it was created with the old schema
-        await pool.query(`
-      DO $$ BEGIN
-        ALTER TABLE streamby.projects ALTER COLUMN id TYPE TEXT USING id::text;
-        ALTER TABLE streamby.projects ALTER COLUMN id SET DEFAULT uuid_generate_v4()::text;
-      EXCEPTION WHEN OTHERS THEN NULL; END $$;
+        await pool.query(`
+      DO $$ BEGIN
+        ALTER TABLE streamby.projects ALTER COLUMN id TYPE TEXT USING id::text;
+        ALTER TABLE streamby.projects ALTER COLUMN id SET DEFAULT uuid_generate_v4()::text;
+      EXCEPTION WHEN OTHERS THEN NULL; END $$;
     `);
-        await pool.query(`
-      CREATE TABLE IF NOT EXISTS streamby.projects (
-        id               TEXT PRIMARY KEY DEFAULT uuid_generate_v4()::text,
-        name             VARCHAR(255) NOT NULL,
-        description      TEXT,
-        image            TEXT,
-        "allowedOrigin"  JSONB DEFAULT '[]',
-        exports          JSONB DEFAULT '[]',
-        connections      JSONB DEFAULT '[]',
-        "dbConnections"  JSONB DEFAULT '[]',
-        "dbType"         VARCHAR(50) NOT NULL DEFAULT 'sql',
-        "createdAt"      TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
-        "updatedAt"      TIMESTAMP WITH TIME ZONE DEFAULT NOW()
-      );
+        await pool.query(`
+      CREATE TABLE IF NOT EXISTS streamby.projects (
+        id               TEXT PRIMARY KEY DEFAULT uuid_generate_v4()::text,
+        name             VARCHAR(255) NOT NULL,
+        description      TEXT,
+        image            TEXT,
+        "allowedOrigin"  JSONB DEFAULT '[]',
+        exports          JSONB DEFAULT '[]',
+        connections      JSONB DEFAULT '[]',
+        "dbConnections"  JSONB DEFAULT '[]',
+        "dbType"         VARCHAR(50) NOT NULL DEFAULT 'sql',
+        "createdAt"      TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+        "updatedAt"      TIMESTAMP WITH TIME ZONE DEFAULT NOW()
+      );
     `);
         console.log('✅ "projects" table ensured to exist.');
         // Add JSONB columns to existing tables that predate this schema version
-        await pool.query(`
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "allowedOrigin"     JSONB DEFAULT '[]';
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS exports             JSONB DEFAULT '[]';
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS connections         JSONB DEFAULT '[]';
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "dbConnections"     JSONB DEFAULT '[]';
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "storageConnections" JSONB DEFAULT '[]';
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS workflow            JSONB;
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS pipelines           JSONB DEFAULT '[]';
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "builtinBackfilledAt" TIMESTAMP WITH TIME ZONE;
-      -- Written when a project is made (routes/project) and by its connection routes.
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS public              BOOLEAN DEFAULT TRUE;
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS category            TEXT;
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "integrationConnections"  JSONB DEFAULT '[]';
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "distributionConnections" JSONB DEFAULT '[]';
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "renderFarmConnections"   JSONB DEFAULT '[]';
+        await pool.query(`
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "allowedOrigin"     JSONB DEFAULT '[]';
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS exports             JSONB DEFAULT '[]';
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS connections         JSONB DEFAULT '[]';
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "dbConnections"     JSONB DEFAULT '[]';
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "storageConnections" JSONB DEFAULT '[]';
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS workflow            JSONB;
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS pipelines           JSONB DEFAULT '[]';
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "builtinBackfilledAt" TIMESTAMP WITH TIME ZONE;
+      -- Written when a project is made (routes/project) and by its connection routes.
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS public              BOOLEAN DEFAULT TRUE;
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS category            TEXT;
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "integrationConnections"  JSONB DEFAULT '[]';
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "distributionConnections" JSONB DEFAULT '[]';
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "renderFarmConnections"   JSONB DEFAULT '[]';
     `);
         // Ensure dbType exists with a non-null default
-        await pool.query(`
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "dbType" VARCHAR(50) NOT NULL DEFAULT 'sql';
+        await pool.query(`
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "dbType" VARCHAR(50) NOT NULL DEFAULT 'sql';
     `);
-        await pool.query(`
-      CREATE TABLE IF NOT EXISTS streamby.project_members (
-        id           TEXT PRIMARY KEY DEFAULT uuid_generate_v4()::text,
-        "projectId"  TEXT NOT NULL REFERENCES streamby.projects(id) ON DELETE CASCADE,
-        "userId"     VARCHAR(255) NOT NULL,
-        role         VARCHAR(255) NOT NULL DEFAULT 'member',
-        status       VARCHAR(50) NOT NULL DEFAULT 'active',
-        archived     BOOLEAN NOT NULL DEFAULT FALSE,
-        "archivedBy" VARCHAR(255),
-        "archivedAt" TIMESTAMP WITH TIME ZONE,
-        "createdAt"  TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
-        "updatedAt"  TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
-        UNIQUE ("projectId", "userId")
-      );
+        await pool.query(`
+      CREATE TABLE IF NOT EXISTS streamby.project_members (
+        id           TEXT PRIMARY KEY DEFAULT uuid_generate_v4()::text,
+        "projectId"  TEXT NOT NULL REFERENCES streamby.projects(id) ON DELETE CASCADE,
+        "userId"     VARCHAR(255) NOT NULL,
+        role         VARCHAR(255) NOT NULL DEFAULT 'member',
+        status       VARCHAR(50) NOT NULL DEFAULT 'active',
+        archived     BOOLEAN NOT NULL DEFAULT FALSE,
+        "archivedBy" VARCHAR(255),
+        "archivedAt" TIMESTAMP WITH TIME ZONE,
+        "createdAt"  TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+        "updatedAt"  TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+        UNIQUE ("projectId", "userId")
+      );
     `);
-        await pool.query(`
-      ALTER TABLE streamby.project_members ADD COLUMN IF NOT EXISTS status VARCHAR(50) NOT NULL DEFAULT 'active';
+        await pool.query(`
+      ALTER TABLE streamby.project_members ADD COLUMN IF NOT EXISTS status VARCHAR(50) NOT NULL DEFAULT 'active';
     `);
         console.log('✅ "project_members" table ensured to exist.');
         // Migrate projectId FK column from UUID to TEXT if table predates this schema version
-        await pool.query(`
-      DO $$ BEGIN
-        ALTER TABLE streamby.project_members DROP CONSTRAINT IF EXISTS project_members_projectId_fkey;
-        ALTER TABLE streamby.project_members ALTER COLUMN "projectId" TYPE TEXT;
-        ALTER TABLE streamby.project_members ADD CONSTRAINT project_members_projectid_fkey
-          FOREIGN KEY ("projectId") REFERENCES streamby.projects(id) ON DELETE CASCADE;
-      EXCEPTION WHEN OTHERS THEN NULL; END $$;
+        await pool.query(`
+      DO $$ BEGIN
+        ALTER TABLE streamby.project_members DROP CONSTRAINT IF EXISTS project_members_projectId_fkey;
+        ALTER TABLE streamby.project_members ALTER COLUMN "projectId" TYPE TEXT;
+        ALTER TABLE streamby.project_members ADD CONSTRAINT project_members_projectid_fkey
+          FOREIGN KEY ("projectId") REFERENCES streamby.projects(id) ON DELETE CASCADE;
+      EXCEPTION WHEN OTHERS THEN NULL; END $$;
     `);
-        await pool.query(`
-      CREATE TABLE IF NOT EXISTS streamby.exports (
-        id          TEXT PRIMARY KEY DEFAULT uuid_generate_v4()::text,
-        "projectId" TEXT NOT NULL REFERENCES streamby.projects(id) ON DELETE CASCADE,
-        status      VARCHAR(50) NOT NULL DEFAULT 'pending',
-        "filePath"  TEXT,
-        "createdAt" TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
-        "updatedAt" TIMESTAMP WITH TIME ZONE DEFAULT NOW()
-      );
+        await pool.query(`
+      CREATE TABLE IF NOT EXISTS streamby.exports (
+        id          TEXT PRIMARY KEY DEFAULT uuid_generate_v4()::text,
+        "projectId" TEXT NOT NULL REFERENCES streamby.projects(id) ON DELETE CASCADE,
+        status      VARCHAR(50) NOT NULL DEFAULT 'pending',
+        "filePath"  TEXT,
+        "createdAt" TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+        "updatedAt" TIMESTAMP WITH TIME ZONE DEFAULT NOW()
+      );
     `);
         console.log('✅ "exports" table ensured to exist.');
         // user_integrations is registered against the main db only (see createRouter.ts), but
         // this function runs per-SQL-connection like projects/exports above — harmless on
         // non-main connections since the model never queries them there.
-        await pool.query(`
-      CREATE TABLE IF NOT EXISTS streamby.user_integrations (
-        id                     TEXT PRIMARY KEY DEFAULT uuid_generate_v4()::text,
-        "userId"               VARCHAR(255) NOT NULL,
-        kind                   VARCHAR(20) NOT NULL,
-        provider               VARCHAR(20) NOT NULL,
-        name                   VARCHAR(255) NOT NULL,
-        description            TEXT,
-        "encryptedCredential"  TEXT NOT NULL,
-        "createdAt"            TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
-        "updatedAt"            TIMESTAMP WITH TIME ZONE DEFAULT NOW()
-      );
-      CREATE INDEX IF NOT EXISTS user_integrations_userid_idx ON streamby.user_integrations ("userId");
+        await pool.query(`
+      CREATE TABLE IF NOT EXISTS streamby.user_integrations (
+        id                     TEXT PRIMARY KEY DEFAULT uuid_generate_v4()::text,
+        "userId"               VARCHAR(255) NOT NULL,
+        kind                   VARCHAR(20) NOT NULL,
+        provider               VARCHAR(20) NOT NULL,
+        name                   VARCHAR(255) NOT NULL,
+        description            TEXT,
+        "encryptedCredential"  TEXT NOT NULL,
+        "createdAt"            TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+        "updatedAt"            TIMESTAMP WITH TIME ZONE DEFAULT NOW()
+      );
+      CREATE INDEX IF NOT EXISTS user_integrations_userid_idx ON streamby.user_integrations ("userId");
     `);
         console.log('✅ "user_integrations" table ensured to exist.');
         // API tokens: only their hash is kept (see services/apiTokens). Main db only, like
         // user_integrations above. A table from before tokens had a kind and permissions gets the
         // new columns; its old tokens no longer work (they have no kind) and aren't listed.
-        await pool.query(`
-      CREATE TABLE IF NOT EXISTS streamby.api_tokens (
-        id                TEXT PRIMARY KEY DEFAULT uuid_generate_v4()::text,
-        kind              VARCHAR(10),
-        "userId"          VARCHAR(255) NOT NULL,
-        "createdByName"   VARCHAR(255),
-        name              VARCHAR(255) NOT NULL,
-        prefix            VARCHAR(32) NOT NULL,
-        hash              CHAR(64) NOT NULL UNIQUE,
-        permissions       JSONB NOT NULL DEFAULT '[]',
-        "projectIds"      JSONB NOT NULL,
-        "createdAt"       TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
-        "expiresAt"       TIMESTAMP WITH TIME ZONE,
-        "lastUsedAt"      TIMESTAMP WITH TIME ZONE
-      );
-      ALTER TABLE streamby.api_tokens ADD COLUMN IF NOT EXISTS kind VARCHAR(10);
-      ALTER TABLE streamby.api_tokens ADD COLUMN IF NOT EXISTS "createdByName" VARCHAR(255);
-      ALTER TABLE streamby.api_tokens ADD COLUMN IF NOT EXISTS permissions JSONB NOT NULL DEFAULT '[]';
-      DO $$ BEGIN
-        IF EXISTS (SELECT 1 FROM information_schema.columns
-                   WHERE table_schema = 'streamby' AND table_name = 'api_tokens' AND column_name = 'access') THEN
-          ALTER TABLE streamby.api_tokens ALTER COLUMN access DROP NOT NULL;
-        END IF;
-      END $$;
-      CREATE INDEX IF NOT EXISTS api_tokens_userid_idx ON streamby.api_tokens ("userId");
-      CREATE INDEX IF NOT EXISTS api_tokens_kind_idx ON streamby.api_tokens (kind);
+        await pool.query(`
+      CREATE TABLE IF NOT EXISTS streamby.api_tokens (
+        id                TEXT PRIMARY KEY DEFAULT uuid_generate_v4()::text,
+        kind              VARCHAR(10),
+        "userId"          VARCHAR(255) NOT NULL,
+        "createdByName"   VARCHAR(255),
+        name              VARCHAR(255) NOT NULL,
+        prefix            VARCHAR(32) NOT NULL,
+        hash              CHAR(64) NOT NULL UNIQUE,
+        permissions       JSONB NOT NULL DEFAULT '[]',
+        "projectIds"      JSONB NOT NULL,
+        "createdAt"       TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+        "expiresAt"       TIMESTAMP WITH TIME ZONE,
+        "lastUsedAt"      TIMESTAMP WITH TIME ZONE
+      );
+      ALTER TABLE streamby.api_tokens ADD COLUMN IF NOT EXISTS kind VARCHAR(10);
+      ALTER TABLE streamby.api_tokens ADD COLUMN IF NOT EXISTS "createdByName" VARCHAR(255);
+      ALTER TABLE streamby.api_tokens ADD COLUMN IF NOT EXISTS permissions JSONB NOT NULL DEFAULT '[]';
+      DO $$ BEGIN
+        IF EXISTS (SELECT 1 FROM information_schema.columns
+                   WHERE table_schema = 'streamby' AND table_name = 'api_tokens' AND column_name = 'access') THEN
+          ALTER TABLE streamby.api_tokens ALTER COLUMN access DROP NOT NULL;
+        END IF;
+      END $$;
+      CREATE INDEX IF NOT EXISTS api_tokens_userid_idx ON streamby.api_tokens ("userId");
+      CREATE INDEX IF NOT EXISTS api_tokens_kind_idx ON streamby.api_tokens (kind);
     `);
         console.log('✅ "api_tokens" table ensured to exist.');
+        // Jobs (see services/jobStore): kept here so they survive restarts and every instance sees
+        // them. Main db only, like the tables above.
+        await pool.query(`
+      CREATE TABLE IF NOT EXISTS streamby.jobs (
+        id               TEXT PRIMARY KEY,
+        "jobType"        VARCHAR(40) NOT NULL,
+        "userId"         VARCHAR(255) NOT NULL,
+        "projectId"      VARCHAR(255) NOT NULL,
+        "assetId"        VARCHAR(255),
+        status           VARCHAR(20) NOT NULL,
+        stage            VARCHAR(60) NOT NULL,
+        progress         INTEGER NOT NULL DEFAULT 0,
+        payload          JSONB NOT NULL DEFAULT '{}',
+        error            TEXT,
+        worker           JSONB,
+        kind             VARCHAR(100),
+        profile          JSONB,
+        "versionId"      VARCHAR(255),
+        "resultMode"     VARCHAR(20),
+        attempts         INTEGER NOT NULL DEFAULT 0,
+        "maxAttempts"    INTEGER NOT NULL DEFAULT 1,
+        "nextAttemptAt"  TIMESTAMP WITH TIME ZONE,
+        "leaseUntil"     TIMESTAMP WITH TIME ZONE,
+        "callbackHash"   CHAR(64),
+        upload           JSONB,
+        report           JSONB,
+        result           JSONB,
+        "createdAt"      TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
+        "updatedAt"      TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
+      );
+      CREATE INDEX IF NOT EXISTS jobs_project_idx ON streamby.jobs ("projectId", "createdAt");
+      CREATE INDEX IF NOT EXISTS jobs_due_idx ON streamby.jobs (status, "nextAttemptAt") WHERE worker IS NOT NULL;
+    `);
+        console.log('✅ "jobs" table ensured to exist.');
         // The MCP server's audit log: every tool call (see mcp/audit). Main db only.
-        await pool.query(`
-      CREATE TABLE IF NOT EXISTS streamby.mcp_audit (
-        id            TEXT PRIMARY KEY DEFAULT uuid_generate_v4()::text,
-        "userId"      VARCHAR(255) NOT NULL,
-        "tokenId"     VARCHAR(255) NOT NULL,
-        "projectId"   VARCHAR(255),
-        tool          VARCHAR(100) NOT NULL,
-        ok            BOOLEAN NOT NULL,
-        status        INTEGER,
-        error         TEXT,
-        "durationMs"  INTEGER NOT NULL,
-        "createdAt"   TIMESTAMP WITH TIME ZONE DEFAULT NOW()
-      );
-      CREATE INDEX IF NOT EXISTS mcp_audit_token_idx ON streamby.mcp_audit ("tokenId", "createdAt");
+        await pool.query(`
+      CREATE TABLE IF NOT EXISTS streamby.mcp_audit (
+        id            TEXT PRIMARY KEY DEFAULT uuid_generate_v4()::text,
+        "userId"      VARCHAR(255) NOT NULL,
+        "tokenId"     VARCHAR(255) NOT NULL,
+        "projectId"   VARCHAR(255),
+        tool          VARCHAR(100) NOT NULL,
+        ok            BOOLEAN NOT NULL,
+        status        INTEGER,
+        error         TEXT,
+        "durationMs"  INTEGER NOT NULL,
+        "createdAt"   TIMESTAMP WITH TIME ZONE DEFAULT NOW()
+      );
+      CREATE INDEX IF NOT EXISTS mcp_audit_token_idx ON streamby.mcp_audit ("tokenId", "createdAt");
+      -- An app's calls (an OAuth access token) are recorded by its client, with no token.
+      ALTER TABLE streamby.mcp_audit ADD COLUMN IF NOT EXISTS "oauthClientId" VARCHAR(255);
+      ALTER TABLE streamby.mcp_audit ALTER COLUMN "tokenId" DROP NOT NULL;
     `);
         console.log('✅ "mcp_audit" table ensured to exist.');
     }

package/dist/adapters/database/sql.js

@@ -10,7 +10,7 @@ function serializeForPg(v) {
 }
 const createSQLExportTable = async (connection, projectId, exportName, nodeSchema) => {
     const exportId = (0, crypto_1.randomUUID)();
-    await connection.query(`INSERT INTO "exports" (id, "projectId", node_schema, name, method, created_at, updated_at)
+    await connection.query(`INSERT INTO "exports" (id, "projectId", node_schema, name, method, created_at, updated_at)
      VALUES ($1, $2, $3, $4, 'GET', NOW(), NOW())`, [exportId, projectId, nodeSchema ? JSON.stringify(nodeSchema) : null, exportName]);
     return { exportId };
 };

package/dist/index.d.ts

@@ -1,7 +1,9 @@
 export { createStreamByRouter } from './middleware/createRouter';
 export { emitToUser } from './services/wsHub';
 export { createNotification } from './services/notification';
-export type { UserPlan, UserSubscription, Auth, ApiTokenScope, ApiTokenKind, ApiTokenPermission, ProjectPermission, AccountPermission } from './types';
+export type { UserPlan, UserSubscription, Auth, ApiTokenScope, ApiTokenKind, ApiTokenPermission, ProjectPermission, AccountPermission, OAuthClientInfo, OAuthResourceConfig } from './types';
 export { resolveApiToken, API_TOKEN_PREFIX } from './services/apiTokens';
 export { PROJECT_PERMISSIONS, ACCOUNT_PERMISSIONS } from './services/apiTokenPermissions';
 export type { ResolvedApiToken } from './services/apiTokens';
+export { createOAuthTokenVerifier, looksLikeOAuthAccessToken, protectedResourceMetadata, defaultResourceMetadataUrl, permissionsForOAuthScopes, OAUTH_SCOPES, OAUTH_SCOPE_PERMISSIONS, } from './services/oauthTokens';
+export type { VerifiedOAuthToken, OAuthTokenVerifierOptions, Jwks, Jwk, OAuthScope } from './services/oauthTokens';

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ACCOUNT_PERMISSIONS = exports.PROJECT_PERMISSIONS = exports.API_TOKEN_PREFIX = exports.resolveApiToken = exports.createNotification = exports.emitToUser = exports.createStreamByRouter = void 0;
+exports.OAUTH_SCOPE_PERMISSIONS = exports.OAUTH_SCOPES = exports.permissionsForOAuthScopes = exports.defaultResourceMetadataUrl = exports.protectedResourceMetadata = exports.looksLikeOAuthAccessToken = exports.createOAuthTokenVerifier = exports.ACCOUNT_PERMISSIONS = exports.PROJECT_PERMISSIONS = exports.API_TOKEN_PREFIX = exports.resolveApiToken = exports.createNotification = exports.emitToUser = exports.createStreamByRouter = void 0;
 var createRouter_1 = require("./middleware/createRouter");
 Object.defineProperty(exports, "createStreamByRouter", { enumerable: true, get: function () { return createRouter_1.createStreamByRouter; } });
 var wsHub_1 = require("./services/wsHub");
@@ -13,3 +13,11 @@ Object.defineProperty(exports, "API_TOKEN_PREFIX", { enumerable: true, get: func
 var apiTokenPermissions_1 = require("./services/apiTokenPermissions");
 Object.defineProperty(exports, "PROJECT_PERMISSIONS", { enumerable: true, get: function () { return apiTokenPermissions_1.PROJECT_PERMISSIONS; } });
 Object.defineProperty(exports, "ACCOUNT_PERMISSIONS", { enumerable: true, get: function () { return apiTokenPermissions_1.ACCOUNT_PERMISSIONS; } });
+var oauthTokens_1 = require("./services/oauthTokens");
+Object.defineProperty(exports, "createOAuthTokenVerifier", { enumerable: true, get: function () { return oauthTokens_1.createOAuthTokenVerifier; } });
+Object.defineProperty(exports, "looksLikeOAuthAccessToken", { enumerable: true, get: function () { return oauthTokens_1.looksLikeOAuthAccessToken; } });
+Object.defineProperty(exports, "protectedResourceMetadata", { enumerable: true, get: function () { return oauthTokens_1.protectedResourceMetadata; } });
+Object.defineProperty(exports, "defaultResourceMetadataUrl", { enumerable: true, get: function () { return oauthTokens_1.defaultResourceMetadataUrl; } });
+Object.defineProperty(exports, "permissionsForOAuthScopes", { enumerable: true, get: function () { return oauthTokens_1.permissionsForOAuthScopes; } });
+Object.defineProperty(exports, "OAUTH_SCOPES", { enumerable: true, get: function () { return oauthTokens_1.OAUTH_SCOPES; } });
+Object.defineProperty(exports, "OAUTH_SCOPE_PERMISSIONS", { enumerable: true, get: function () { return oauthTokens_1.OAUTH_SCOPE_PERMISSIONS; } });

package/dist/mcp/audit.d.ts

@@ -1,7 +1,8 @@
-import { StreamByConfig } from '../types';
+import { Auth, StreamByConfig } from '../types';
 export interface McpAuditEntry {
     userId: string;
-    tokenId: string;
+    tokenId: string | null;
+    oauthClientId: string | null;
     projectId: string | null;
     tool: string;
     ok: boolean;
@@ -9,4 +10,6 @@ export interface McpAuditEntry {
     error: string | null;
     durationMs: number;
 }
+/** Who made an MCP request, as the audit log keeps it. */
+export declare const auditCallerOf: (auth: Auth) => Pick<McpAuditEntry, "userId" | "tokenId" | "oauthClientId">;
 export declare function recordMcpCall(entry: McpAuditEntry, config: StreamByConfig): Promise<void>;

package/dist/mcp/audit.js

@@ -3,9 +3,17 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.auditCallerOf = void 0;
 exports.recordMcpCall = recordMcpCall;
 const crypto_1 = __importDefault(require("crypto"));
 const manager_1 = require("../models/manager");
+/** Who made an MCP request, as the audit log keeps it. */
+const auditCallerOf = (auth) => ({
+    userId: auth.userId,
+    tokenId: auth.oauth ? null : auth.apiToken?.tokenId ?? null,
+    oauthClientId: auth.oauth?.clientId ?? null,
+});
+exports.auditCallerOf = auditCallerOf;
 async function recordMcpCall(entry, config) {
     try {
         const dbType = config.databases?.find(db => db.main)?.type ?? 'nosql';

package/dist/mcp/server.js

@@ -40,7 +40,7 @@ function createMcpServer(auth, api, config, version) {
                     const refused = await (0, workflowNodes_1.ensureWorkflowNode)(tool.workflowNode, tool.projectOf?.(args), auth, api);
                     if (refused) {
                         await (0, audit_1.recordMcpCall)({
-                            userId: auth.userId, tokenId: auth.apiToken.tokenId, projectId, tool: tool.name,
+                            ...(0, audit_1.auditCallerOf)(auth), projectId, tool: tool.name,
                             ok: false, status: null, error: refused, durationMs: Date.now() - started,
                         }, config);
                         return { isError: true, content: [{ type: 'text', text: refused }] };
@@ -50,7 +50,7 @@ function createMcpServer(auth, api, config, version) {
                 status = answer.status;
                 const ok = status >= 200 && status < 300;
                 await (0, audit_1.recordMcpCall)({
-                    userId: auth.userId, tokenId: auth.apiToken.tokenId, projectId, tool: tool.name,
+                    ...(0, audit_1.auditCallerOf)(auth), projectId, tool: tool.name,
                     ok, status, error: ok ? null : errorText(answer.body, status), durationMs: Date.now() - started,
                 }, config);
                 if (!ok)
@@ -61,7 +61,7 @@ function createMcpServer(auth, api, config, version) {
             catch (err) {
                 const message = err instanceof Error ? err.message : String(err);
                 await (0, audit_1.recordMcpCall)({
-                    userId: auth.userId, tokenId: auth.apiToken.tokenId, projectId, tool: tool.name,
+                    ...(0, audit_1.auditCallerOf)(auth), projectId, tool: tool.name,
                     ok: false, status, error: message, durationMs: Date.now() - started,
                 }, config);
                 return { isError: true, content: [{ type: 'text', text: `The call failed: ${message}` }] };

package/dist/mcp/tools.js

@@ -317,6 +317,47 @@ exports.TOOLS = [
         projectOf: byProject,
         call: ({ projectId, deliverableId }) => ({ method: 'DELETE', path: `/projects/${enc(projectId)}/deliverables/${enc(deliverableId)}` }),
     }),
+    // ── Processing (workers) ──
+    tool({
+        name: 'list_workers', title: 'List workers', permissions: ['project:read'],
+        description: "The processing workers a project can use: the host's and the project's own (each one's id, source, what it does — its kinds — and the asset categories it takes). They show in the project's Workers settings.",
+        input: { projectId },
+        projectOf: byProject,
+        call: ({ projectId }) => ({ method: 'GET', path: `/projects/${enc(projectId)}/workers` }),
+        pick: (data) => data?.data ?? [],
+    }),
+    tool({
+        name: 'process_asset', title: 'Process an asset', permissions: ['jobs:run'], write: true,
+        description: "Asks a worker to process an asset (or one of its versions), e.g. optimize a glTF. The result is kept as a new asset derived from it (resultMode 'derived', the default: the original is untouched) or as the asset's new version ('version': its URL then serves the result). It runs in the background: follow it with get_job or list_jobs; it shows in the file's Jobs tab, in Storage.",
+        input: {
+            projectId,
+            assetId: id('asset'),
+            versionId: zod_1.z.string().optional().describe('A version (list_asset_versions); the latest if not given'),
+            worker: zod_1.z.object({ source: zod_1.z.enum(['builtin', 'project']), id: zod_1.z.string().min(1) }).describe('A worker, from list_workers'),
+            kind: zod_1.z.string().min(1).describe("What it should do: one of the worker's kinds"),
+            profile: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()).optional().describe("Options for the worker (e.g. { \"textureFormat\": \"ktx2\" })"),
+            resultMode: zod_1.z.enum(['derived', 'version']).optional(),
+        },
+        projectOf: byProject,
+        call: ({ projectId, ...fields }) => ({ method: 'POST', path: `/projects/${enc(projectId)}/jobs/process`, body: defined(fields) }),
+        pick: (data) => data?.job,
+    }),
+    tool({
+        name: 'list_jobs', title: 'List jobs', permissions: ['jobs:read'],
+        description: "A project's jobs, newest first (of one asset if given): their status, stage, progress, error and, when done, their worker's report and result.",
+        input: { projectId, assetId: zod_1.z.string().optional() },
+        projectOf: byProject,
+        call: ({ projectId, assetId }) => ({ method: 'GET', path: `/projects/${enc(projectId)}/jobs${assetId ? `?${new URLSearchParams({ assetId })}` : ''}` }),
+        pick: (data) => data?.data ?? [],
+    }),
+    tool({
+        name: 'retry_job', title: 'Retry a job', permissions: ['jobs:run'], write: true,
+        description: "Sends a failed worker job to its worker again.",
+        input: { projectId, jobId: id('job') },
+        projectOf: byProject,
+        call: ({ projectId, jobId }) => ({ method: 'POST', path: `/projects/${enc(projectId)}/jobs/${enc(jobId)}/retry` }),
+        pick: (data) => data?.job,
+    }),
     // ── Projects ──
     tool({
         name: 'create_project', title: 'Create a project', permissions: ['projects:create'], write: true,

package/dist/middleware/createRouter.js

@@ -15,6 +15,7 @@ const auth_1 = require("../services/auth");
 const apiToken_1 = require("./routes/apiToken");
 const mcp_1 = require("./routes/mcp");
 const encryption_1 = require("../utils/encryption");
+const jobStore_1 = require("../services/jobStore");
 const auth_2 = require("./routes/auth");
 const user_1 = require("./routes/user");
 const export_1 = require("./routes/export");
@@ -27,6 +28,7 @@ const dbConnection_1 = require("./routes/dbConnection");
 const storageConnection_1 = require("./routes/storageConnection");
 const userIntegration_1 = require("./routes/userIntegration");
 const oauth_1 = require("./routes/oauth");
+const oauthResource_1 = require("./routes/oauthResource");
 const notification_1 = require("./routes/notification");
 const subscription_1 = require("./routes/subscription");
 const media_1 = require("./routes/media");
@@ -38,11 +40,15 @@ const production_1 = require("./routes/production");
 const rights_1 = require("./routes/rights");
 const workflow_1 = require("./routes/workflow");
 const pipeline_1 = require("./routes/pipeline");
+const worker_1 = require("./routes/worker");
+const workerCallback_1 = require("./routes/workerCallback");
+const workerJobs_1 = require("../services/workerJobs");
 const deliverable_1 = require("./routes/deliverable");
 function createStreamByRouter(config) {
     const router = express_1.default.Router();
     if (config.encrypt)
         (0, encryption_1.setEncryptionKey)(config.encrypt, config.encryptPreviousKeys);
+    (0, jobStore_1.setJobStoreDatabase)(config);
     // Establish DB connections asynchronously (Postgres/Mongo + schema migrations).
     // Until they're ready, HOLD incoming requests instead of letting them through —
     // route handlers resolve projects/exports (e.g. the /menu-list export) against a
@@ -69,6 +75,8 @@ function createStreamByRouter(config) {
     })
         .finally(() => {
         ready = true;
+        // Jobs left pending (or with their worker's time up) by a restart are sent again.
+        (0, workerJobs_1.startWorkerSweeper)({ ...config, adapter });
     });
     router.use((_req, _res, next) => {
         if (ready)
@@ -105,9 +113,13 @@ function createStreamByRouter(config) {
     if (config.websocket?.server) {
         (0, wsHub_1.initWsHub)(config.websocket.server, config);
     }
+    // Where to sign in for a token (RFC 9728): open, before anything asks for one.
+    router.use((0, oauthResource_1.oauthResourceRouter)(config));
     // /auth answers whether there's a session (it reads it itself); everything after needs one,
     // but for the public export route (see authenticate).
     router.use((0, auth_2.authRouter)(config));
+    // Workers call back with their job's token, not a session (see routes/workerCallback).
+    router.use((0, workerCallback_1.workerCallbackRouter)({ ...config, adapter }));
     router.use((0, auth_1.authenticate)(config));
     router.use(auth_1.enforceApiTokenScope);
     router.use(subscription_1.ensureSubscription);
@@ -135,6 +147,7 @@ function createStreamByRouter(config) {
     router.use((0, rights_1.rightsRouter)(config));
     router.use((0, workflow_1.workflowRouter)(config));
     router.use((0, pipeline_1.pipelineRouter)(config));
-    router.use((0, deliverable_1.deliverableRouter)(config));
+    router.use((0, worker_1.workerRouter)({ ...config, adapter }));
+    router.use((0, deliverable_1.deliverableRouter)({ ...config, adapter }));
     return router;
 }

package/dist/middleware/routes/ai.js

@@ -31,7 +31,7 @@ function aiRouter(_config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
-            const job = (0, jobQueue_1.createJob)('transcription', auth.userId, projectId, { fileId, model, sourceLanguage, outputFormats, provider, credentialId });
+            const job = await (0, jobQueue_1.createJob)('transcription', auth.userId, projectId, { fileId, model, sourceLanguage, outputFormats, provider, credentialId });
             setImmediate(() => (0, aiProcessor_1.runTranscriptionJob)(job.jobId, fileId, projectId, { model, sourceLanguage, outputFormats, provider, credentialId }));
             res.status(202).json({ jobId: job.jobId, status: job.status });
         }
@@ -52,7 +52,7 @@ function aiRouter(_config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
-            const job = (0, jobQueue_1.createJob)('upscale', auth.userId, projectId, { fileId, scale, model, mode, credentialId });
+            const job = await (0, jobQueue_1.createJob)('upscale', auth.userId, projectId, { fileId, scale, model, mode, credentialId });
             setImmediate(() => (0, aiProcessor_1.runUpscaleJob)(job.jobId, fileId, projectId, { scale, model, mode, credentialId }));
             res.status(202).json({ jobId: job.jobId, status: job.status });
         }
@@ -73,7 +73,7 @@ function aiRouter(_config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
-            const job = (0, jobQueue_1.createJob)('generate-asset', auth.userId, projectId, { assetType, provider, prompt, seed, credentialId });
+            const job = await (0, jobQueue_1.createJob)('generate-asset', auth.userId, projectId, { assetType, provider, prompt, seed, credentialId });
             setImmediate(() => (0, aiProcessor_1.runGenerateAssetJob)(job.jobId, projectId, { assetType, provider, prompt, seed, credentialId }));
             res.status(202).json({ jobId: job.jobId, status: job.status });
         }

package/dist/middleware/routes/deliverable.d.ts

@@ -1,3 +1,5 @@
 import { Router } from 'express';
-import { StreamByConfig } from '../../types';
-export declare function deliverableRouter(_config: StreamByConfig): Router;
+import { StorageAdapter, StreamByConfig } from '../../types';
+export declare function deliverableRouter(config: StreamByConfig & {
+    adapter?: StorageAdapter;
+}): Router;