streamby-core 0.39.0 → 0.41.0

package/dist/middleware/routes/deliverable.js

@@ -2,15 +2,19 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.deliverableRouter = deliverableRouter;
 const express_1 = require("express");
+const workerJobs_1 = require("../../services/workerJobs");
+const worker_1 = require("./worker");
+const auth_1 = require("../../services/auth");
 const manager_1 = require("../../models/manager");
-const auth_1 = require("../../utils/auth");
+const auth_2 = require("../../utils/auth");
 const nosqlDb_1 = require("../../utils/nosqlDb");
 const assetVersions_1 = require("../../services/assetVersions");
 const deliverables_1 = require("../../services/deliverables");
 const MAX_NOTE = 1000;
 // A project's deliverables (see services/deliverables): marked, listed and removed. Removing
-// one never deletes its asset.
-function deliverableRouter(_config) {
+// one never deletes its asset. Marking one starts the workers set to process its kind of asset
+// by themselves.
+function deliverableRouter(config) {
     const router = (0, express_1.Router)();
     const Project = (0, manager_1.getModel)('projects');
     const exportsOf = (project) => project.exports ?? [];
@@ -48,7 +52,7 @@ function deliverableRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_2.isProjectMember)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const deliverables = await (0, deliverables_1.listDeliverables)(projectId, { shotId, exportId });
             res.json({ deliverables: await describe(project, deliverables) });
@@ -77,7 +81,7 @@ function deliverableRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.canEditProject)(project, auth.userId))
+            if (!(0, auth_2.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = (0, nosqlDb_1.nosqlDb)();
             if (!db)
@@ -104,7 +108,12 @@ function deliverableRouter(_config) {
                 createdBy: auth.userId,
             });
             const [described] = await describe(project, [deliverable]);
-            res.status(201).json({ deliverable: described });
+            // The project's workers set to process its kind of asset by themselves start on it: not
+            // for an API token that can't run jobs.
+            const jobs = (0, auth_1.tokenAllows)(auth.apiToken, 'jobs:run')
+                ? await (0, workerJobs_1.enqueueAutomaticJobs)(project, assetId, versionId || null, auth, config, (0, worker_1.callbackBaseOf)(req, config)).catch(() => [])
+                : [];
+            res.status(201).json({ deliverable: described, jobs: jobs.map(workerJobs_1.publicJob) });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to mark the deliverable', details: err.message });
@@ -117,7 +126,7 @@ function deliverableRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.canEditProject)(project, auth.userId))
+            if (!(0, auth_2.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             if (!(await (0, deliverables_1.deleteDeliverable)(projectId, deliverableId)))
                 return res.status(404).json({ message: 'Deliverable not found' });

package/dist/middleware/routes/mcp.js

@@ -5,11 +5,13 @@ const express_1 = require("express");
 const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/server/streamableHttp.js");
 const server_1 = require("../../mcp/server");
 const rateLimit_1 = require("../../mcp/rateLimit");
+const oauthTokens_1 = require("../../services/oauthTokens");
 // eslint-disable-next-line @typescript-eslint/no-var-requires
 const { version } = require('../../../package.json');
 const jsonRpcError = (res, status, message) => res.status(status).json({ jsonrpc: '2.0', error: { code: -32000, message }, id: null });
 // StreamBy's MCP server (Streamable HTTP, stateless: one server per request), for agents
-// working with StreamBy through an API token. Each tool calls the REST API right here -- this
+// working with StreamBy through an API token, or an OAuth access token of an app the user
+// signed in to (e.g. claude.ai's connector). Each tool calls the REST API right here -- this
 // same process, under the same mount -- with the request's own Authorization header, so it
 // reaches what the token and its owner can and nothing more.
 function mcpRouter(config) {
@@ -17,12 +19,17 @@ function mcpRouter(config) {
     const limiter = (0, rateLimit_1.createRateLimiter)(config.mcp?.rateLimit ?? rateLimit_1.DEFAULT_MCP_RATE_LIMIT);
     router.post('/mcp', async (req, res) => {
         const auth = req.auth;
-        if (!auth.apiToken)
-            return jsonRpcError(res, 401, 'The MCP server takes an API token (Authorization: Bearer sbt_...)');
+        // A browser session isn't for agents: they come with a token.
+        if (!auth.apiToken) {
+            if (config.oauth)
+                res.setHeader('WWW-Authenticate', (0, oauthTokens_1.wwwAuthenticate)(config.oauth, false));
+            return jsonRpcError(res, 401, 'The MCP server takes an API token (Authorization: Bearer sbt_...) or an OAuth access token');
+        }
+        // Per token; an app is counted per user it acts for.
         const taken = limiter.take(auth.apiToken.tokenId);
         if (!taken.allowed) {
             res.setHeader('Retry-After', String(Math.ceil(taken.retryAfterMs / 1000)));
-            return jsonRpcError(res, 429, 'Too many requests for this API token; try again later');
+            return jsonRpcError(res, 429, 'Too many requests for this token; try again later');
         }
         const base = config.mcp?.apiBaseUrl ?? `http://127.0.0.1:${req.socket.localPort}${req.baseUrl}`;
         const api = async ({ method, path, body }) => {

package/dist/middleware/routes/media.js

@@ -8,6 +8,7 @@ const jobQueue_1 = require("../../services/jobQueue");
 const mediaProcessor_1 = require("../../services/mediaProcessor");
 const storage_1 = require("../../providers/storage");
 const connectionManager_1 = require("../../adapters/database/connectionManager");
+const workerJobs_1 = require("../../services/workerJobs");
 const auth_2 = require("../../services/auth");
 function getMetadataCollection() {
     const ids = (0, connectionManager_1.getConnectedIds)().filter(id => (0, connectionManager_1.getConnection)(id).type === 'nosql');
@@ -31,7 +32,7 @@ function mediaRouter(config) {
     router.get('/jobs/:jobId', async (req, res) => {
         try {
             const auth = req.auth;
-            const job = (0, jobQueue_1.getJob)(req.params.jobId);
+            const job = await (0, jobQueue_1.getJob)(req.params.jobId);
             if (!job)
                 return res.status(404).json({ message: 'Job not found' });
             // With an API token, only a job of a project it reaches.
@@ -42,7 +43,7 @@ function mediaRouter(config) {
                 if (!(0, auth_1.isProjectMember)(project, auth.userId))
                     return res.status(404).json({ message: 'Job not found' });
             }
-            res.json({ job });
+            res.json({ job: (0, workerJobs_1.publicJob)(job) });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to fetch job', details: err.message });
@@ -61,7 +62,7 @@ function mediaRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
-            const job = (0, jobQueue_1.createJob)('ingest', auth.userId, projectId, { fileId });
+            const job = await (0, jobQueue_1.createJob)('ingest', auth.userId, projectId, { fileId });
             // Run async — response returns immediately with jobId
             setImmediate(() => (0, mediaProcessor_1.runIngestJob)(job.jobId, fileId, projectId));
             res.status(202).json({ jobId: job.jobId, status: job.status });
@@ -83,7 +84,7 @@ function mediaRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
-            const job = (0, jobQueue_1.createJob)('transcode', auth.userId, projectId, {
+            const job = await (0, jobQueue_1.createJob)('transcode', auth.userId, projectId, {
                 fileId, codec, resolution, outputFormat, bitrate, audioCodec,
             });
             setImmediate(() => (0, mediaProcessor_1.runTranscodeJob)(job.jobId, fileId, projectId, { codec, resolution, outputFormat, bitrate, audioCodec }, adapter));
@@ -106,7 +107,7 @@ function mediaRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
-            const job = (0, jobQueue_1.createJob)('thumbnail', auth.userId, projectId, { fileId, timecode, resolution, strategy });
+            const job = await (0, jobQueue_1.createJob)('thumbnail', auth.userId, projectId, { fileId, timecode, resolution, strategy });
             setImmediate(() => (0, mediaProcessor_1.runThumbnailJob)(job.jobId, fileId, projectId, { timecode, resolution, strategy }));
             res.status(202).json({ jobId: job.jobId, status: job.status });
         }
@@ -127,7 +128,7 @@ function mediaRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
-            const job = (0, jobQueue_1.createJob)('caption', auth.userId, projectId, { fileId, sourceLanguage, outputFormat, provider });
+            const job = await (0, jobQueue_1.createJob)('caption', auth.userId, projectId, { fileId, sourceLanguage, outputFormat, provider });
             setImmediate(() => (0, mediaProcessor_1.runCaptionJob)(job.jobId, fileId, projectId, { sourceLanguage, outputFormat, provider }));
             res.status(202).json({ jobId: job.jobId, status: job.status });
         }

package/dist/middleware/routes/{apiConnection.d.ts → oauthResource.d.ts}

@@ -1,3 +1,3 @@
 import { Router } from 'express';
 import { StreamByConfig } from '../../types';
-export declare function apiConnectionRouter(config: StreamByConfig): Router;
+export declare function oauthResourceRouter(config: StreamByConfig): Router;

package/dist/middleware/routes/oauthResource.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oauthResourceRouter = oauthResourceRouter;
+const express_1 = require("express");
+const oauthTokens_1 = require("../../services/oauthTokens");
+// StreamBy's metadata as an OAuth protected resource (RFC 9728), open to anyone: an MCP client
+// that got a 401 reads it to know which authorization server to sign the user in with. The
+// host serves the same document at its root too, where RFC 9728 puts it.
+function oauthResourceRouter(config) {
+    const router = (0, express_1.Router)();
+    router.get('/.well-known/oauth-protected-resource', (_req, res) => {
+        if (!config.oauth)
+            return res.status(404).json({ error: 'Not an OAuth protected resource' });
+        res.set({ 'Access-Control-Allow-Origin': '*', 'Cache-Control': 'public, max-age=300' });
+        return res.json((0, oauthTokens_1.protectedResourceMetadata)(config.oauth));
+    });
+    return router;
+}

package/dist/middleware/routes/project.js

@@ -12,6 +12,7 @@ const auth_2 = require("../../services/auth");
 const apiTokens_1 = require("../../services/apiTokens");
 const nosqlDb_1 = require("../../utils/nosqlDb");
 const production_1 = require("../../services/production");
+const jobStore_1 = require("../../services/jobStore");
 function projectRouter(config) {
     const router = (0, express_1.Router)();
     const Project = (0, manager_1.getModel)('projects');
@@ -254,9 +255,12 @@ function projectRouter(config) {
                 return res.status(403).json({ message: 'Only a project admin can delete it' });
             }
             await Project.useDbType(project.dbType).delete({ _id: projectId });
-            // Its tokens have nothing left to reach, and its production data nothing to belong to.
+            // Its tokens have nothing left to reach, and its production data and jobs nothing to
+            // belong to.
             await (0, apiTokens_1.deleteProjectApiTokens)(String(projectId));
             await (0, production_1.deleteProductionData)(String(projectId));
+            if (projectId)
+                await (0, jobStore_1.jobStore)().deleteProject(String(projectId));
             const allProjects = await Project.find({});
             const projects = allProjects
                 .filter(project => {

package/dist/middleware/routes/renderFarm.js

@@ -1,7 +1,4 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderFarmRouter = renderFarmRouter;
 const express_1 = require("express");
@@ -9,80 +6,10 @@ const manager_1 = require("../../models/manager");
 const auth_1 = require("../../utils/auth");
 const jobQueue_1 = require("../../services/jobQueue");
 const vfxProcessor_1 = require("../../services/vfxProcessor");
-const sanitize_1 = require("../../utils/sanitize");
-const crypto_1 = __importDefault(require("crypto"));
-const encryption_1 = require("../../utils/encryption");
 function renderFarmRouter(_config) {
     const router = (0, express_1.Router)();
     const Project = (0, manager_1.getModel)('projects');
-    // ─── Render Farm Connections ─────────────────────────────────────────────────
-    router.get('/projects/:projectId/render-farm-connections', async (req, res) => {
-        try {
-            const auth = req.auth;
-            const { projectId } = req.params;
-            const project = await Project.findOne({ _id: projectId });
-            if (!project)
-                return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
-                return res.status(403).json({ message: 'Unauthorized' });
-            res.json({ connections: (0, sanitize_1.sanitizeConnections)(project.renderFarmConnections) });
-        }
-        catch (err) {
-            res.status(500).json({ message: err.message });
-        }
-    });
-    router.post('/projects/:projectId/render-farm-connections', async (req, res) => {
-        try {
-            const auth = req.auth;
-            const { projectId } = req.params;
-            const { name, provider, apiUrl, credential: credentialValue, encryptedCredential: legacyCredential, description } = req.body;
-            // The credential, as given (`encryptedCredential` was its old name: it was always the
-            // value itself), stored encrypted.
-            const credential = credentialValue ?? legacyCredential;
-            if (credential && !(0, encryption_1.isEncryptionKeySet)())
-                return res.status(500).json({ message: 'Encryption key is not set' });
-            const encryptedCredential = credential ? (0, encryption_1.encrypt)(String(credential)) : undefined;
-            if (!name || !provider || !apiUrl) {
-                return res.status(400).json({ message: 'name, provider and apiUrl are required' });
-            }
-            const project = await Project.findOne({ _id: projectId });
-            if (!project)
-                return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.canEditProject)(project, auth.userId))
-                return res.status(403).json({ message: 'Unauthorized' });
-            const connection = {
-                id: crypto_1.default.randomUUID(),
-                name,
-                provider,
-                apiUrl,
-                encryptedCredential,
-                description,
-                projectId,
-                createdAt: new Date(),
-            };
-            await Project.update({ _id: projectId }, { $push: { renderFarmConnections: connection } });
-            res.status(201).json({ connection: (0, sanitize_1.sanitizeConnection)(connection) });
-        }
-        catch (err) {
-            res.status(500).json({ message: err.message });
-        }
-    });
-    router.delete('/projects/:projectId/render-farm-connections/:connectionId', async (req, res) => {
-        try {
-            const auth = req.auth;
-            const { projectId, connectionId } = req.params;
-            const project = await Project.findOne({ _id: projectId });
-            if (!project)
-                return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.canEditProject)(project, auth.userId))
-                return res.status(403).json({ message: 'Unauthorized' });
-            await Project.update({ _id: projectId }, { $pull: { renderFarmConnections: { id: connectionId } } });
-            res.json({ message: 'Connection deleted' });
-        }
-        catch (err) {
-            res.status(500).json({ message: err.message });
-        }
-    });
+    // A project's render farms are its workers: see routes/worker.
     // ─── VFX Jobs ────────────────────────────────────────────────────────────────
     router.post('/projects/:projectId/jobs/render', async (req, res) => {
         try {
@@ -96,7 +23,7 @@ function renderFarmRouter(_config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
-            const job = (0, jobQueue_1.createJob)('render', auth.userId, projectId, { fileId, renderer, renderFarmConnectionId, frameRange, resolution, samples, outputFormat });
+            const job = await (0, jobQueue_1.createJob)('render', auth.userId, projectId, { fileId, renderer, renderFarmConnectionId, frameRange, resolution, samples, outputFormat });
             setImmediate(() => (0, vfxProcessor_1.runRenderJob)(job.jobId, fileId, projectId, { renderer, renderFarmConnectionId, frameRange, resolution, samples, outputFormat }));
             res.status(202).json({ jobId: job.jobId, status: job.status });
         }
@@ -116,7 +43,7 @@ function renderFarmRouter(_config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
-            const job = (0, jobQueue_1.createJob)('format-convert', auth.userId, projectId, { fileId, inputFormat, outputFormat, applyTransforms, embedTextures });
+            const job = await (0, jobQueue_1.createJob)('format-convert', auth.userId, projectId, { fileId, inputFormat, outputFormat, applyTransforms, embedTextures });
             setImmediate(() => (0, vfxProcessor_1.runFormatConvertJob)(job.jobId, fileId, projectId, { inputFormat, outputFormat, applyTransforms, embedTextures }));
             res.status(202).json({ jobId: job.jobId, status: job.status });
         }
@@ -136,7 +63,7 @@ function renderFarmRouter(_config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
-            const job = (0, jobQueue_1.createJob)('lod', auth.userId, projectId, { fileId, levels, reductionRatios, algorithm, outputFormat });
+            const job = await (0, jobQueue_1.createJob)('lod', auth.userId, projectId, { fileId, levels, reductionRatios, algorithm, outputFormat });
             setImmediate(() => (0, vfxProcessor_1.runLodJob)(job.jobId, fileId, projectId, { levels, reductionRatios, algorithm, outputFormat }));
             res.status(202).json({ jobId: job.jobId, status: job.status });
         }

package/dist/middleware/routes/storage.js

@@ -18,21 +18,7 @@ const crypto_1 = __importDefault(require("crypto"));
 const signedUrls_1 = require("../../services/signedUrls");
 const assetVersions_1 = require("../../services/assetVersions");
 const deliverables_1 = require("../../services/deliverables");
-const VALID_CATEGORIES = ['images', 'audios', 'videos', '3d-models'];
-const VALID_3D_EXTENSIONS = new Set(['.glb', '.gltf', '.obj', '.fbx', '.stl', '.ply']);
-function validateContentType(contentType, filename, category) {
-    if (category === 'images')
-        return contentType.startsWith('image/');
-    if (category === 'audios')
-        return contentType.startsWith('audio/');
-    if (category === 'videos')
-        return contentType.startsWith('video/');
-    if (category === '3d-models') {
-        const ext = filename.split('.').pop()?.toLowerCase();
-        return ext ? VALID_3D_EXTENSIONS.has(`.${ext}`) : false;
-    }
-    return false;
-}
+const assetCategories_1 = require("../../utils/assetCategories");
 function getRawFilesCollection() {
     const model = (0, manager_1.getModel)('storage_files', 'nosql');
     const connectionIds = model.getConnectionIds();
@@ -113,13 +99,13 @@ function storageRouter(config) {
             const auth = req.auth;
             const { projectId, category } = req.params;
             const { fileName, contentType } = req.query;
-            if (!VALID_CATEGORIES.includes(category)) {
-                return res.status(400).json({ message: `Invalid category. Must be one of: ${VALID_CATEGORIES.join(', ')}` });
+            if (!assetCategories_1.VALID_CATEGORIES.includes(category)) {
+                return res.status(400).json({ message: `Invalid category. Must be one of: ${assetCategories_1.VALID_CATEGORIES.join(', ')}` });
             }
             if (!fileName || !contentType) {
                 return res.status(400).json({ message: 'Query params fileName and contentType are required' });
             }
-            if (!validateContentType(contentType, fileName, category)) {
+            if (!(0, assetCategories_1.validateContentType)(contentType, fileName, category)) {
                 const hint = category === '3d-models'
                     ? '.glb, .gltf, .obj, .fbx, .stl, or .ply'
                     : `${category.slice(0, -1)}/* content type`;
@@ -179,7 +165,7 @@ function storageRouter(config) {
             const fileDoc = await collection.findOne({ fileId, projectId });
             if (!fileDoc)
                 return res.status(404).json({ message: 'File not found' });
-            if (!validateContentType(contentType, fileName, fileDoc.category)) {
+            if (!(0, assetCategories_1.validateContentType)(contentType, fileName, fileDoc.category)) {
                 return res.status(400).json({ message: `File does not match category ${fileDoc.category}` });
             }
             if (!adapter.getPresignedUploadUrl) {
@@ -277,8 +263,8 @@ function storageRouter(config) {
         try {
             const auth = req.auth;
             const { projectId, category } = req.params;
-            if (!VALID_CATEGORIES.includes(category)) {
-                return res.status(400).json({ message: `Invalid category. Must be one of: ${VALID_CATEGORIES.join(', ')}` });
+            if (!assetCategories_1.VALID_CATEGORIES.includes(category)) {
+                return res.status(400).json({ message: `Invalid category. Must be one of: ${assetCategories_1.VALID_CATEGORIES.join(', ')}` });
             }
             const project = await Project.findOne({ _id: projectId });
             if (!project)
@@ -350,13 +336,13 @@ function storageRouter(config) {
             const auth = req.auth;
             const { projectId, connId } = req.params;
             const { fileName, contentType, category } = req.query;
-            if (!category || !VALID_CATEGORIES.includes(category)) {
-                return res.status(400).json({ message: `Invalid category. Must be one of: ${VALID_CATEGORIES.join(', ')}` });
+            if (!category || !assetCategories_1.VALID_CATEGORIES.includes(category)) {
+                return res.status(400).json({ message: `Invalid category. Must be one of: ${assetCategories_1.VALID_CATEGORIES.join(', ')}` });
             }
             if (!fileName || !contentType) {
                 return res.status(400).json({ message: 'Query params fileName and contentType are required' });
             }
-            if (!validateContentType(contentType, fileName, category)) {
+            if (!(0, assetCategories_1.validateContentType)(contentType, fileName, category)) {
                 return res.status(400).json({ message: `File does not match category ${category}` });
             }
             const project = await Project.findOne({ _id: projectId });
@@ -424,8 +410,8 @@ function storageRouter(config) {
         try {
             const auth = req.auth;
             const { projectId, connId, category } = req.params;
-            if (!VALID_CATEGORIES.includes(category)) {
-                return res.status(400).json({ message: `Invalid category. Must be one of: ${VALID_CATEGORIES.join(', ')}` });
+            if (!assetCategories_1.VALID_CATEGORIES.includes(category)) {
+                return res.status(400).json({ message: `Invalid category. Must be one of: ${assetCategories_1.VALID_CATEGORIES.join(', ')}` });
             }
             const project = await Project.findOne({ _id: projectId });
             if (!project)
@@ -465,7 +451,7 @@ function storageRouter(config) {
             const fileDoc = await collection.findOne(connFilter(projectId, connId, project, { fileId }));
             if (!fileDoc)
                 return res.status(404).json({ message: 'File not found' });
-            if (!validateContentType(contentType, fileName, fileDoc.category)) {
+            if (!(0, assetCategories_1.validateContentType)(contentType, fileName, fileDoc.category)) {
                 return res.status(400).json({ message: `File does not match category ${fileDoc.category}` });
             }
             const connAdapter = await resolveConnAdapter(connId, project, auth);

package/dist/middleware/routes/worker.d.ts

@@ -0,0 +1,7 @@
+import { Router, Request } from 'express';
+import { StorageAdapter, StreamByConfig } from '../../types';
+/** Where workers call back to: this router, as the request reached it (unless the host says). */
+export declare const callbackBaseOf: (req: Request, config: StreamByConfig) => string;
+export declare function workerRouter(config: StreamByConfig & {
+    adapter?: StorageAdapter;
+}): Router;

package/dist/middleware/routes/worker.js

@@ -0,0 +1,125 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.callbackBaseOf = void 0;
+exports.workerRouter = workerRouter;
+const express_1 = require("express");
+const manager_1 = require("../../models/manager");
+const auth_1 = require("../../utils/auth");
+const jobQueue_1 = require("../../services/jobQueue");
+const workers_1 = require("../../services/workers");
+const workerJobs_1 = require("../../services/workerJobs");
+/** Where workers call back to: this router, as the request reached it (unless the host says). */
+const callbackBaseOf = (req, config) => config.workerOptions?.callbackBaseUrl ?? `${req.protocol}://${req.get('host')}${req.baseUrl}`;
+exports.callbackBaseOf = callbackBaseOf;
+// A project's processing workers (its own and the host's), and its jobs: asking a worker to
+// process an asset, following them, and retrying a failed one.
+function workerRouter(config) {
+    const router = (0, express_1.Router)();
+    const Project = (0, manager_1.getModel)('projects');
+    const failed = (res, what, err) => {
+        if (err instanceof workers_1.WorkerError)
+            return res.status(err.status).json({ message: err.message });
+        res.status(500).json({ message: `Failed to ${what}`, details: err?.message });
+    };
+    const projectFor = async (req, res, edit) => {
+        const auth = req.auth;
+        const project = await Project.findOne({ _id: req.params.projectId });
+        if (!project) {
+            res.status(404).json({ message: 'Project not found' });
+            return null;
+        }
+        if (!(edit ? auth_1.canEditProject : auth_1.isProjectMember)(project, auth.userId)) {
+            res.status(403).json({ message: 'Unauthorized' });
+            return null;
+        }
+        return project;
+    };
+    // ── Workers ──
+    router.get('/projects/:projectId/workers', async (req, res) => {
+        try {
+            const project = await projectFor(req, res, false);
+            if (!project)
+                return;
+            res.json({ data: await (0, workers_1.availableWorkers)(project, req.auth, config) });
+        }
+        catch (err) {
+            failed(res, 'list workers', err);
+        }
+    });
+    router.post('/projects/:projectId/workers', async (req, res) => {
+        try {
+            const auth = req.auth;
+            const project = await projectFor(req, res, true);
+            if (!project)
+                return;
+            const worker = (0, workers_1.newWorkerConnection)(req.body ?? {}, req.params.projectId, auth.userId, config);
+            await (0, workers_1.assertPublicEndpoint)(worker.apiUrl, config);
+            await Project.update({ _id: req.params.projectId }, { $push: { renderFarmConnections: worker } });
+            res.status(201).json({ data: (0, workers_1.summarizeProjectWorker)(worker) });
+        }
+        catch (err) {
+            failed(res, 'connect the worker', err);
+        }
+    });
+    router.delete('/projects/:projectId/workers/:workerId', async (req, res) => {
+        try {
+            const project = await projectFor(req, res, true);
+            if (!project)
+                return;
+            if (!(0, workers_1.projectWorkers)(project).some(w => w.id === req.params.workerId))
+                return res.status(404).json({ message: 'Worker not found' });
+            await Project.update({ _id: req.params.projectId }, { $pull: { renderFarmConnections: { id: req.params.workerId } } });
+            res.json({ message: 'Worker removed' });
+        }
+        catch (err) {
+            failed(res, 'remove the worker', err);
+        }
+    });
+    // ── Jobs ──
+    router.get('/projects/:projectId/jobs', async (req, res) => {
+        try {
+            const project = await projectFor(req, res, false);
+            if (!project)
+                return;
+            const assetId = typeof req.query.assetId === 'string' ? req.query.assetId : undefined;
+            res.json({ data: (await (0, jobQueue_1.listJobs)(req.params.projectId, assetId)).map(workerJobs_1.publicJob) });
+        }
+        catch (err) {
+            failed(res, 'list jobs', err);
+        }
+    });
+    // A worker processes an asset (or one of its versions): { assetId, versionId?, worker:
+    // { source, id }, kind, profile?, resultMode?: 'derived' | 'version' }.
+    router.post('/projects/:projectId/jobs/process', async (req, res) => {
+        try {
+            const project = await projectFor(req, res, true);
+            if (!project)
+                return;
+            const job = await (0, workerJobs_1.enqueueWorkerJob)(project, req.body ?? {}, req.auth, config, (0, exports.callbackBaseOf)(req, config));
+            res.status(202).json({ job: (0, workerJobs_1.publicJob)(job) });
+        }
+        catch (err) {
+            failed(res, 'start the job', err);
+        }
+    });
+    router.post('/projects/:projectId/jobs/:jobId/retry', async (req, res) => {
+        try {
+            const project = await projectFor(req, res, true);
+            if (!project)
+                return;
+            const job = await (0, jobQueue_1.getJob)(req.params.jobId);
+            if (!job || job.projectId !== req.params.projectId)
+                return res.status(404).json({ message: 'Job not found' });
+            if (!job.worker)
+                return res.status(400).json({ message: 'Only a worker job can be retried' });
+            const retried = await (0, workerJobs_1.retryWorkerJob)(job.jobId, config);
+            if (!retried)
+                return res.status(409).json({ message: `Only a failed job can be retried; this one is ${job.status}` });
+            res.status(202).json({ job: (0, workerJobs_1.publicJob)(retried) });
+        }
+        catch (err) {
+            failed(res, 'retry the job', err);
+        }
+    });
+    return router;
+}

package/dist/middleware/routes/workerCallback.d.ts

@@ -0,0 +1,5 @@
+import { Router } from 'express';
+import { StorageAdapter, StreamByConfig } from '../../types';
+export declare function workerCallbackRouter(config: StreamByConfig & {
+    adapter?: StorageAdapter;
+}): Router;

package/dist/middleware/routes/workerCallback.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.workerCallbackRouter = workerCallbackRouter;
+const express_1 = require("express");
+const workers_1 = require("../../services/workers");
+const workerJobs_1 = require("../../services/workerJobs");
+// A worker calling back about the job it was sent: with no session, only the job's own token
+// (`Authorization: Bearer <callback.token>`), which works for that attempt alone.
+function workerCallbackRouter(config) {
+    const router = (0, express_1.Router)();
+    const handle = (action) => async (req, res) => {
+        try {
+            const job = await (0, workerJobs_1.authorizeCallback)(req.params.jobId, req.headers.authorization);
+            res.json(await action(job, req));
+        }
+        catch (err) {
+            if (err instanceof workers_1.WorkerError)
+                return res.status(err.status).json({ message: err.message });
+            console.error('❌ StreamBy workers: callback failed:', err?.message ?? err);
+            res.status(500).json({ message: 'Callback failed' });
+        }
+    };
+    router.post(`${workerJobs_1.WORKER_CALLBACK_PATH}/:jobId/progress`, handle(async (job, req) => ({ job: (0, workerJobs_1.publicJob)((await (0, workerJobs_1.reportProgress)(job, req.body)) ?? job) })));
+    router.post(`${workerJobs_1.WORKER_CALLBACK_PATH}/:jobId/upload-url`, handle((job, req) => (0, workerJobs_1.resultUploadUrl)(job, req.body, config)));
+    router.post(`${workerJobs_1.WORKER_CALLBACK_PATH}/:jobId/complete`, handle(async (job, req) => ({ job: (0, workerJobs_1.publicJob)(await (0, workerJobs_1.completeJob)(job, req.body, config)) })));
+    router.post(`${workerJobs_1.WORKER_CALLBACK_PATH}/:jobId/fail`, handle(async (job, req) => {
+        const after = await (0, workerJobs_1.failWorkerJob)(job, req.body, config);
+        return { job: after ? (0, workerJobs_1.publicJob)(after) : null };
+    }));
+    return router;
+}

package/dist/models/Model.js

@@ -45,11 +45,11 @@ class Model {
                     // Handle members filter for SQL projects
                     const userId = processedFilter.members.$elemMatch.userId;
                     const schema = this.schema || 'streamby'; // Default to 'streamby' if schema not provided
-                    const query = `
-            SELECT p.*, pm."userId" as memberUserId, pm.role as memberRole, pm.status as memberStatus, pm.archived as memberArchived
-            FROM "${schema}"."projects" p
-            JOIN "${schema}"."project_members" pm ON p.id = pm."projectId"
-            WHERE pm."userId" = $1
+                    const query = `
+            SELECT p.*, pm."userId" as memberUserId, pm.role as memberRole, pm.status as memberStatus, pm.archived as memberArchived
+            FROM "${schema}"."projects" p
+            JOIN "${schema}"."project_members" pm ON p.id = pm."projectId"
+            WHERE pm."userId" = $1
           `;
                     const result = await connection.query(query, [userId]);
                     sqlResults = result.rows.map(row => ({
@@ -219,10 +219,10 @@ class Model {
         else {
             const matchKey = value.id !== undefined ? 'id' : Object.keys(value)[0];
             const matchVal = String(value[matchKey]);
-            await connection.query(`UPDATE ${tbl} SET "${field}" = (
-          SELECT COALESCE(jsonb_agg(elem), '[]'::jsonb)
-          FROM jsonb_array_elements("${field}") elem
-          WHERE elem->>'${matchKey}' != $1
+            await connection.query(`UPDATE ${tbl} SET "${field}" = (
+          SELECT COALESCE(jsonb_agg(elem), '[]'::jsonb)
+          FROM jsonb_array_elements("${field}") elem
+          WHERE elem->>'${matchKey}' != $1
         ) WHERE id = $2`, [matchVal, id]);
         }
     }