streamby-core 0.42.0 → 0.43.1

package/CHANGELOG.md

@@ -1,5 +1,78 @@
 # Changelog
 
+## 0.43.1
+
+### Fixed
+
+- **Inviting a member to a SQL project, or asking to join one, answered 500**: both write who
+  invited the member (`invitedBy`), a column `streamby.project_members` didn't have. It's added
+  at startup to existing tables, and is in the table made new.
+- **Accepting or rejecting an invitation to a SQL project failed too**: they changed the project's
+  `members` as a MongoDB project has them, a field a SQL project doesn't have (its members are
+  rows of `project_members`); they change the member's row now. A SQL project's members are read
+  with `invitedBy`, so whoever invited them is told the answer.
+
+## 0.43.0
+
+### Added
+
+- **License metadata of assets**, for crediting the ones taken from others: `sourceUrl`,
+  `creatorName`, `creatorUrl`, `licenseType` and `comments`, all optional, in `asset_rights`.
+  The license is one of a closed list (`LICENSE_TYPES`: CC BY, CC BY-SA, CC BY-ND, CC BY-NC,
+  CC BY-NC-SA, CC BY-NC-ND, CC0, Free Standard, Standard, Editorial), checked by the server; the
+  links are http(s) URLs. It can be given with an upload (query params of `GET .../upload-url`;
+  an API token needs `rights:write` too). An `assetRightsEvent` to the project's active members
+  on each change, and when an asset is deleted.
+- **Credits sheets**: project documents of a new kind, `credits`, that a workflow's Credits sheet
+  node makes (`CREDITS_SHEET_NODE`). One keeps only its sources (assets and Storage folders picked,
+  and the Ingest nodes connected to its node); its rows are made when it's read, from each asset's
+  metadata, with its status: complete when it has an asset and each has its creator, source and
+  license. Routes `GET /projects/:projectId/credits-sheets` and `.../credits-sheets/:docId`
+  (`rights:read`). Types `CreditsSheet`, `SheetRow`, `SheetSources` and `SheetStatus`.
+- MCP: `get_credits_sheet`; `request_asset_upload` takes the license metadata.
+- **The workflow defines the project.** Each resource is a node of it, bound by the resource's
+  id in its data. A resource added or removed from its section (`POST`/`DELETE` of a connection,
+  an API, an export, a pipeline, a project integration) adds or removes its node; saving the
+  workflow connects what its nodes were set to (`"__connect__:<integrationId>"`), makes the APIs
+  drafted on them (`data.connectionDraft`) and removes the resources whose nodes are gone,
+  answering `{ data, project, errors }`. A save needs `baseUpdatedAt` (a 409 over a newer version)
+  and a `nodeSchema` with `nodes` and `edges` lists (a 400 otherwise); an app connected with OAuth
+  can't remove resources through it (a 403 listing them). Pipelines and exports drafted on nodes
+  are made on save too. A node with a configuration of its own (a data source's table, an
+  Ingest's file) consumes its resource and is never merged into its node.
+  A workflow made before this is brought to it once, when it's read (`resourceNodesAt`).
+- **What depends on a resource**, asked before removing it: `GET /projects/:id/dependents/:kind/:resourceId`
+  (connections, exports, pipelines): the workflow's, exports' and pipelines' nodes that use it,
+  and the files, folders, deliverables and shots kept for it. `GET /user/integrations/:id/dependents`:
+  the project connections that use an account's integration.
+- **A change to a project's resources answers its list as it is then**, for the client to show
+  without asking again: connecting or disconnecting a database (`dbConnections`), a storage
+  (`storageConnections`, with built-ins' `available`) or an API (`connections`), deleting an
+  export (`exports`) or a pipeline (`pipelines`); `POST`/`DELETE /projects/:id/integrations`
+  answer the `project`; deleting an account's integration, each project it was disconnected
+  from (`affected`).
+- **A built-in connected again keeps the id it had** (`disconnectedBuiltins` on the project; a
+  new `disconnectedBuiltins` column in a PostgreSQL projects table, added at startup), so its
+  files and records are its own again.
+
+### Changed
+
+- **`asset_rights` holds the license metadata only.** `rightsHolder`, `licenseUrl`, `territory`,
+  `expiresAt`, `usageRestrictions` and `notes` are gone: not read, and dropped from a record when
+  it's next saved; a `licenseType` off the list reads as none. `set_asset_rights` and
+  `get_asset_rights` take and give the new fields.
+
+### Fixed
+
+- Deleting an asset or a project deletes its license metadata (it was left behind).
+- A built-in database or storage can be disconnected from a project (it was refused with a 403,
+  though the backfill already left a disconnected one alone): what the project keeps in it stays.
+- Deleting an account's integration disconnects the project connections that use it (they were
+  left pointing at nothing).
+- `POST .../connections/db` and `.../connections/storage` with an `integrationId` connect a
+  built-in too (they refused it as an unknown integration, and checked the pool's `sql`/`nosql`
+  as the type): with an integration, its name and type are the integration's.
+
 ## 0.42.0
 
 ### Added

package/README.md

@@ -132,7 +132,7 @@ hash is stored, with a short prefix to tell it apart.
 | Production | `production:read`, `production:write`, `production:delete` | Sequences, shots and tasks. |
 | Workflow | `workflow:read`, `workflow:write` | The workflow and its pipelines. |
 | Exports | `exports:read`, `exports:write` | The project's exports. |
-| Rights | `rights:read`, `rights:write` | Assets' rights. |
+| Rights | `rights:read`, `rights:write` | Assets' license metadata, and reading credits sheets. |
 | Jobs | `jobs:read`, `jobs:run` | Following jobs; starting them (transcoding, rendering, AI, publishing a deliverable). |
 | Documents | `docs:read`, `docs:write`, `docs:publish`, `docs:delete` | The project's documents: reading them and their history; creating, editing and moving them; publishing them (the version its exports deliver, and whether they deliver it); deleting them. |
 | Account | `projects:create` | Creating projects. A user's token only; the token reaches what it creates. |
@@ -285,7 +285,7 @@ A token sees only the tools whose permissions it has (an app: those its scopes g
 | `list_assets` (by category, optionally in one storage connection, and filtered by name), `get_asset_metadata` | `assets:read` |
 | `update_asset_metadata` | `assets:write` |
 | `delete_asset` | `assets:delete` |
-| `get_asset_rights` / `set_asset_rights` | `rights:read` / `rights:write` |
+| `get_asset_rights`, `get_credits_sheet` / `set_asset_rights` | `rights:read` / `rights:write` |
 | `get_workflow`, `list_pipelines`, `get_pipeline` | `workflow:read` |
 | `create_pipeline`, `update_pipeline` | `workflow:write` |
 | `list_exports` | `project:read` and `exports:read` |
@@ -298,7 +298,7 @@ A token sees only the tools whose permissions it has (an app: those its scopes g
 | `create_sequence`, `create_shot`, `create_task` | `production:write` and `workflow:write` |
 | `delete_sequence`, `delete_shot`, `delete_task` | `production:delete` |
 | `list_asset_versions`, `get_asset_download_url`, `list_deliverables` | `assets:read` |
-| `request_asset_upload`, `mark_deliverable`, `remove_deliverable` | `assets:write` |
+| `request_asset_upload` (with license metadata, also `rights:write`), `mark_deliverable`, `remove_deliverable` | `assets:write` |
 | `list_documents`, `get_document`, `list_document_versions` | `docs:read` |
 | `create_document`, `update_document`, `update_document_section` | `docs:write` |
 
@@ -476,7 +476,7 @@ or collections), each one in a single project, in folders.
 | Route | Permission |
 |---|---|
 | `GET /projects/:projectId/documents`: the tree, without contents | `docs:read` |
-| `POST /projects/:projectId/documents` `{ title, content?, kind?: 'document' \| 'folder', parentId?, position? }` | `docs:write` |
+| `POST /projects/:projectId/documents` `{ title, content?, kind?: 'document' \| 'folder' \| 'credits', parentId?, position? }` | `docs:write` |
 | `GET /projects/:projectId/documents/:docId` | `docs:read` |
 | `PATCH /projects/:projectId/documents/:docId` `{ baseVersion, title?, content? }` (a new version) and/or `{ parentId?, position? }` | `docs:write` |
 | `PATCH /projects/:projectId/documents/:docId` `{ exportable }` | `docs:write` and `docs:publish` |
@@ -493,6 +493,44 @@ In MongoDB, a save writes the document and its version in a transaction when the
 
 ---
 
+## ©️ License metadata and credits sheets
+
+Each asset can carry its **license metadata**, for all its versions: where it was taken from
+(`sourceUrl`), who made it (`creatorName`, `creatorUrl`), its license (`licenseType`) and
+`comments`. All are optional; the links are http(s) URLs, and the license is one of
+`CC BY`, `CC BY-SA`, `CC BY-ND`, `CC BY-NC`, `CC BY-NC-SA`, `CC BY-NC-ND`, `CC0`, `Free Standard`,
+`Standard` and `Editorial` (`LICENSE_TYPES`, exported). It's kept in the `asset_rights`
+collection, the only place it lives, and goes with its asset or its project when they're deleted.
+It can be given with the upload: `licenseType`, `sourceUrl`, `creatorName`, `creatorUrl` and
+`comments` as query params of `GET .../upload-url` (an API token needs `rights:write` too).
+
+A **credits sheet** is a project document of kind `credits`, made by a Credits sheet node of the
+workflow (its `data.documentId`). It keeps only what feeds it, as its content:
+`{ "assetIds": [...], "folderIds": [...] }` (assets and Storage folders picked, with everything
+inside them); the Ingest nodes connected to its node feed it too, with the asset each imports
+(`data.fileId`). Its rows are made each time it's read, from each asset's metadata, so two sheets
+with the same asset show the same, and editing a row is setting its asset's metadata. Deleting
+the node leaves the document; an asset deleted leaves the sheet.
+
+A sheet is **complete** when it has an asset and each one has its creator, source and license;
+**incomplete** otherwise, each row listing what it lacks (`missing`).
+
+- **In real time**, an `assetRightsEvent` reaches the project's active members on each change:
+  `{ projectId, action: 'saved' | 'deleted', assetIds, rights? }` (`deleted`: the asset is gone).
+
+| Route | Permission |
+|---|---|
+| `GET /projects/:projectId/assets/:assetId/rights` | `rights:read` |
+| `PUT /projects/:projectId/assets/:assetId/rights` `{ sourceUrl?, creatorName?, creatorUrl?, licenseType?, comments? }` (the fields given; empty or `null` clears one) | `rights:write` |
+| `GET /projects/:projectId/credits-sheets`: each with `{ id, title, status, rows, incomplete }` | `rights:read` |
+| `GET /projects/:projectId/credits-sheets/:docId`: `{ document, sources, rows, status }` | `rights:read` |
+
+Each row: `{ assetId, name, category, sourceUrl, creatorName, creatorUrl, licenseType, comments, missing, from }`,
+`from` saying how it got there (`asset`, `folder`, `ingest`). Editors and admins set the metadata
+(as they edit the asset); every member reads it.
+
+---
+
 ## ⚙️ Processing workers
 
 StreamBy doesn't process assets itself (optimizing a glTF, making LODs, transcoding...): it
@@ -598,6 +636,56 @@ A job its worker doesn't complete before its deadline is sent again, up to
 
 ---
 
+## 🧭 The workflow defines the project
+
+Each of a project's resources (a database, an API, a storage, a service, an export, a pipeline)
+is a node of its workflow, bound to it by the resource's id in its data (`connectionId`,
+`storageConnectionId`, `integrationConnectionId`, `exportId`, `pipelineId`). One node per
+resource; a data source reading one of a database's tables is a node of its own.
+
+- **From a section** (or an agent): adding a resource adds its node to the saved workflow, and
+  removing it removes its nodes.
+- **Saving the workflow** (`PATCH /projects/:id/workflow` `{ nodeSchema, baseUpdatedAt }`) makes
+  the project what it defines, then answers `{ data, project, errors }`: the workflow, the
+  project's lists as they are then, and what couldn't be done. A node set to an integration the
+  project doesn't have (`"__connect__:<integrationId>"`) connects it; an API, a pipeline or an
+  export drafted on a node (`data.connectionDraft`, `data.pipelineDraft`, `data.exportDraft`) is
+  made; a resource whose nodes are all gone is removed.
+  - `baseUpdatedAt` (the workflow's `updatedAt` as it was read) is required with a `nodeSchema`,
+    and `nodeSchema` must be `{ nodes: [...], edges: [...] }`: a 400 otherwise. Saved over a newer
+    version, it's a 409 with the workflow as it is now.
+  - An app connected with OAuth removes nothing through it, as it deletes nothing: a save that
+    would remove resources is a 403 listing them (`removing`).
+  - A node holding a configuration of its own beside its resource's id (a data source reading one
+    table, an Ingest importing one file) consumes the resource: never merged into its node.
+- **Reading it** (`GET`) never rewrites it, except once, for a workflow made before this: the
+  nodes once drawn from the project's lists are bound by their ids, a resource without a node gets
+  one, and two nodes of the same resource are merged.
+
+---
+
+## 🔌 Removing a project's resources
+
+Before a connection (database, API, storage, service), an export or a pipeline is removed, the
+UI asks what depends on it: `GET /projects/:id/dependents/:kind/:resourceId` (`kind`: `db`,
+`api`, `storage`, `service`, `export`, `pipeline`; `project:read`) answers
+`{ dependents: [{ type, name, id?, count? }] }`: the nodes that use it in the workflow, the
+exports and the pipelines (`workflow`, `export`, `pipeline`: they stop working without it), and
+what's kept for it (`files` and `folders` of a storage, `deliverables` and `shots` of an
+export). Removing it changes none of them.
+
+**Built-ins** (the host's database and storage) are disconnected like any connection, and what
+the project keeps in them stays. They're connected again as any integration is, by its id in
+the pool (`GET /user/integrations`): `POST /projects/:id/integrations` `{ integrationId }`, or
+`POST .../connections/db` and `.../connections/storage` with `integrationId` (its name and type
+come from the integration). One connected again keeps the id it had (`disconnectedBuiltins`
+on the project), so its files and records are its own again.
+
+Deleting an account's integration disconnects the project connections that use it;
+`GET /user/integrations/:id/dependents` lists them first.
+
+---
+
 ## 👥 Project roles
 
 What a user can do in a project depends on their role in that project, as an active member

package/dist/adapters/database/connectionManager.js

@@ -101,6 +101,7 @@ const createTables = async (pool) => {
       ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS workflow            JSONB;
       ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS pipelines           JSONB DEFAULT '[]';
       ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "builtinBackfilledAt" TIMESTAMP WITH TIME ZONE;
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "disconnectedBuiltins" JSONB DEFAULT '[]';
       -- Written when a project is made (routes/project) and by its connection routes.
       ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS public              BOOLEAN DEFAULT TRUE;
       ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS category            TEXT;
@@ -122,6 +123,7 @@ const createTables = async (pool) => {
         archived     BOOLEAN NOT NULL DEFAULT FALSE,
         "archivedBy" VARCHAR(255),
         "archivedAt" TIMESTAMP WITH TIME ZONE,
+        "invitedBy"  VARCHAR(255),
         "createdAt"  TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
         "updatedAt"  TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
         UNIQUE ("projectId", "userId")
@@ -129,6 +131,8 @@ const createTables = async (pool) => {
     `);
         await pool.query(`
       ALTER TABLE streamby.project_members ADD COLUMN IF NOT EXISTS status VARCHAR(50) NOT NULL DEFAULT 'active';
+      -- Who invited a pending member (or the member, asking to join): told when it's answered.
+      ALTER TABLE streamby.project_members ADD COLUMN IF NOT EXISTS "invitedBy" VARCHAR(255);
     `);
         console.log('✅ "project_members" table ensured to exist.');
         // Migrate projectId FK column from UUID to TEXT if table predates this schema version

package/dist/index.d.ts

@@ -4,6 +4,10 @@ export { createNotification } from './services/notification';
 export type { UserPlan, UserSubscription, Auth, ApiTokenScope, ApiTokenKind, ApiTokenPermission, ProjectPermission, AccountPermission, OAuthClientInfo, OAuthResourceConfig, ProjectDocument, DocumentVersion, DocumentAuthor, DocumentKind } from './types';
 export { resolveApiToken, API_TOKEN_PREFIX } from './services/apiTokens';
 export { PROJECT_PERMISSIONS, ACCOUNT_PERMISSIONS } from './services/apiTokenPermissions';
+export { LICENSE_TYPES } from './services/rights';
+export type { AssetRights, LicenseType } from './services/rights';
+export { CREDITS_SHEET_NODE } from './services/creditsSheets';
+export type { CreditsSheet, SheetRow, SheetSources, SheetStatus } from './services/creditsSheets';
 export type { ResolvedApiToken } from './services/apiTokens';
 export { createOAuthTokenVerifier, looksLikeOAuthAccessToken, protectedResourceMetadata, defaultResourceMetadataUrl, permissionsForOAuthScopes, OAUTH_SCOPES, OAUTH_SCOPE_PERMISSIONS, } from './services/oauthTokens';
 export type { VerifiedOAuthToken, OAuthTokenVerifierOptions, Jwks, Jwk, OAuthScope } from './services/oauthTokens';

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OAUTH_SCOPE_PERMISSIONS = exports.OAUTH_SCOPES = exports.permissionsForOAuthScopes = exports.defaultResourceMetadataUrl = exports.protectedResourceMetadata = exports.looksLikeOAuthAccessToken = exports.createOAuthTokenVerifier = exports.ACCOUNT_PERMISSIONS = exports.PROJECT_PERMISSIONS = exports.API_TOKEN_PREFIX = exports.resolveApiToken = exports.createNotification = exports.emitToUser = exports.createStreamByRouter = void 0;
+exports.OAUTH_SCOPE_PERMISSIONS = exports.OAUTH_SCOPES = exports.permissionsForOAuthScopes = exports.defaultResourceMetadataUrl = exports.protectedResourceMetadata = exports.looksLikeOAuthAccessToken = exports.createOAuthTokenVerifier = exports.CREDITS_SHEET_NODE = exports.LICENSE_TYPES = exports.ACCOUNT_PERMISSIONS = exports.PROJECT_PERMISSIONS = exports.API_TOKEN_PREFIX = exports.resolveApiToken = exports.createNotification = exports.emitToUser = exports.createStreamByRouter = void 0;
 var createRouter_1 = require("./middleware/createRouter");
 Object.defineProperty(exports, "createStreamByRouter", { enumerable: true, get: function () { return createRouter_1.createStreamByRouter; } });
 var wsHub_1 = require("./services/wsHub");
@@ -13,6 +13,10 @@ Object.defineProperty(exports, "API_TOKEN_PREFIX", { enumerable: true, get: func
 var apiTokenPermissions_1 = require("./services/apiTokenPermissions");
 Object.defineProperty(exports, "PROJECT_PERMISSIONS", { enumerable: true, get: function () { return apiTokenPermissions_1.PROJECT_PERMISSIONS; } });
 Object.defineProperty(exports, "ACCOUNT_PERMISSIONS", { enumerable: true, get: function () { return apiTokenPermissions_1.ACCOUNT_PERMISSIONS; } });
+var rights_1 = require("./services/rights");
+Object.defineProperty(exports, "LICENSE_TYPES", { enumerable: true, get: function () { return rights_1.LICENSE_TYPES; } });
+var creditsSheets_1 = require("./services/creditsSheets");
+Object.defineProperty(exports, "CREDITS_SHEET_NODE", { enumerable: true, get: function () { return creditsSheets_1.CREDITS_SHEET_NODE; } });
 var oauthTokens_1 = require("./services/oauthTokens");
 Object.defineProperty(exports, "createOAuthTokenVerifier", { enumerable: true, get: function () { return oauthTokens_1.createOAuthTokenVerifier; } });
 Object.defineProperty(exports, "looksLikeOAuthAccessToken", { enumerable: true, get: function () { return oauthTokens_1.looksLikeOAuthAccessToken; } });

package/dist/mcp/tools.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TOOLS = void 0;
 const zod_1 = require("zod");
+const rights_1 = require("../services/rights");
 const tool = (definition) => definition;
 const id = (what) => zod_1.z.string().min(1).describe(`The ${what}'s id`);
 const projectId = id('project');
@@ -25,14 +26,13 @@ const taskFields = {
     dueDate: zod_1.z.string().optional().describe('An ISO 8601 date'),
     notes: zod_1.z.string().optional(),
 };
+// An asset's license metadata: what crediting it takes. Each is optional; an empty one clears it.
 const rightsFields = {
-    rightsHolder: zod_1.z.string().optional(),
-    licenseType: zod_1.z.string().optional().describe('e.g. CC0, CC BY 4.0, proprietary'),
-    licenseUrl: zod_1.z.string().optional(),
-    territory: zod_1.z.string().optional(),
-    expiresAt: zod_1.z.string().optional().describe('An ISO 8601 date'),
-    usageRestrictions: zod_1.z.string().optional(),
-    notes: zod_1.z.string().optional(),
+    sourceUrl: zod_1.z.string().optional().describe('Where the asset was taken from (an http(s) URL)'),
+    creatorName: zod_1.z.string().optional().describe('Who made it'),
+    creatorUrl: zod_1.z.string().optional().describe("The creator's page (an http(s) URL)"),
+    licenseType: zod_1.z.enum(rights_1.LICENSE_TYPES).or(zod_1.z.literal('')).optional().describe('Its license'),
+    comments: zod_1.z.string().optional(),
 };
 // Only the fields given (an unset optional field isn't sent as undefined).
 const defined = (fields) => Object.fromEntries(Object.entries(fields).filter(([, value]) => value !== undefined));
@@ -86,7 +86,7 @@ exports.TOOLS = [
     }),
     tool({
         name: 'get_asset_rights', title: "Get an asset's rights", permissions: ['rights:read'],
-        description: "An asset's rights: holder, license, territory, expiry and restrictions.",
+        description: "An asset's license metadata: where it was taken from, its creator (name and link), its license and comments; null if it has none.",
         input: { projectId, assetId: id('asset') },
         projectOf: byProject,
         call: ({ projectId, assetId }) => ({ method: 'GET', path: `/projects/${enc(projectId)}/assets/${enc(assetId)}/rights` }),
@@ -164,7 +164,7 @@ exports.TOOLS = [
     }),
     tool({
         name: 'set_asset_rights', title: "Set an asset's rights", permissions: ['rights:write'], write: true,
-        description: "Sets an asset's rights: holder, license, territory, expiry, restrictions and notes. They show in the file's Rights tab, in Storage.",
+        description: `Sets an asset's license metadata (the fields given; an empty one clears it): where it was taken from, its creator (name and link), its license (one of: ${rights_1.LICENSE_TYPES.join(', ')}) and comments. It shows in the file's Rights tab, in Storage, and in every credits sheet the asset is in.`,
         input: { projectId, assetId: id('asset'), ...rightsFields },
         projectOf: byProject,
         call: ({ projectId, assetId, ...rights }) => ({ method: 'PUT', path: `/projects/${enc(projectId)}/assets/${enc(assetId)}/rights`, body: defined(rights) }),
@@ -245,6 +245,7 @@ exports.TOOLS = [
             "It doesn't upload anything: the file is sent by the tool that has it (for example Blender's MCP, running Python), with an HTTP PUT of its bytes to `upload.url` and the `upload.headers` given, before `expiresAt`.",
             "The URL works for that file only. A new version keeps the asset's URL (it replaces what it serves); the earlier ones are archived and can still be downloaded.",
             "Categories: images, audios, videos, 3d-models (.glb, .gltf, .obj, .fbx, .stl, .ply); contentType must match it.",
+            "For a new asset taken from someone else (a CC model, a stock image), give its license metadata too, so it's credited (it needs the rights:write permission); for a new version, set_asset_rights changes it.",
         ].join(' '),
         input: {
             projectId,
@@ -253,10 +254,14 @@ exports.TOOLS = [
             contentType: zod_1.z.string().min(1).describe('Its MIME type (e.g. model/gltf-binary, image/png, video/mp4)'),
             assetId: zod_1.z.string().optional().describe('An existing asset to upload a new version of; a new asset if not given'),
             connectionId: zod_1.z.string().optional().describe("A storage connection to store it in; the project's built-in storage if not given"),
+            ...rightsFields,
         },
         projectOf: byProject,
-        call: ({ projectId, category, fileName, contentType, assetId, connectionId }) => {
-            const query = new URLSearchParams({ fileName, contentType, ...(connectionId && !assetId ? { category } : {}) });
+        call: ({ projectId, category, fileName, contentType, assetId, connectionId, ...rights }) => {
+            const query = new URLSearchParams({
+                fileName, contentType, ...(connectionId && !assetId ? { category } : {}),
+                ...(assetId ? {} : defined(rights)),
+            });
             const files = connectionId ? `/projects/${enc(projectId)}/connections/storage/${enc(connectionId)}` : `/projects/${enc(projectId)}/storage`;
             const path = assetId
                 ? `${files}/files/${enc(assetId)}/replace-url`
@@ -358,6 +363,15 @@ exports.TOOLS = [
         call: ({ projectId, jobId }) => ({ method: 'POST', path: `/projects/${enc(projectId)}/jobs/${enc(jobId)}/retry` }),
         pick: (data) => data?.job,
     }),
+    // ── Credits sheets ──
+    tool({
+        name: 'get_credits_sheet', title: 'Read a credits sheet', permissions: ['rights:read'],
+        description: "A credits sheet (a document of kind 'credits', made by a Credits sheet node of the workflow; list_documents lists them): a row per asset fed to it (picked on it, in a Storage folder picked, or imported by an Ingest node connected to it) with that asset's license metadata as it is now, and its status: 'complete' when it has an asset and each has its creator, source and license; 'incomplete' otherwise, each row listing what it lacks (`missing`). To fill a row in, set_asset_rights on its asset.",
+        input: { projectId, documentId: id('credits sheet') },
+        projectOf: byProject,
+        call: ({ projectId, documentId }) => ({ method: 'GET', path: `/projects/${enc(projectId)}/credits-sheets/${enc(documentId)}` }),
+        pick: (data) => data && { id: data.document?.id, title: data.document?.title, status: data.status, rows: data.rows },
+    }),
     // ── Documents ──
     tool({
         name: 'list_documents', title: 'List documents', permissions: ['docs:read'],

package/dist/mcp/workflowNodes.js

@@ -9,6 +9,7 @@ const crypto_1 = __importDefault(require("crypto"));
 const manager_1 = require("../models/manager");
 const auth_1 = require("../utils/auth");
 const auth_2 = require("../services/auth");
+const workflowResources_1 = require("../services/workflowResources");
 // The node types that make a workflow's production section (as the UI groups them).
 const PRODUCTION_NODE_TYPES = new Set(['shotNode', 'assemblyNode', 'masterNode']);
 /** A Shot node, as the UI makes one dropped on the canvas without a position. */
@@ -32,14 +33,19 @@ async function ensureWorkflowNode(requirement, projectId, auth, api) {
     const project = await (0, manager_1.getModel)('projects').findOne({ _id: projectId });
     if (!project || !(0, auth_1.activeMemberOf)(project, auth.userId))
         return null;
-    const schema = project.workflow?.nodeSchema ?? null;
-    const nodes = Array.isArray(schema?.nodes) ? schema.nodes : [];
+    // The workflow as it's answered (brought to define the project, if it wasn't yet), and saved
+    // on that version: what changed since isn't undone.
+    const workflow = await (0, workflowResources_1.readWorkflow)(project);
+    const nodes = Array.isArray(workflow?.nodeSchema?.nodes) ? workflow.nodeSchema.nodes : [];
     if (nodes.some(node => PRODUCTION_NODE_TYPES.has(node?.type)))
         return null;
     const answer = await api({
         method: 'PATCH',
         path: `/projects/${encodeURIComponent(projectId)}/workflow`,
-        body: { nodeSchema: { ...(schema ?? {}), nodes: [...nodes, (0, exports.newShotNode)()], edges: Array.isArray(schema?.edges) ? schema.edges : [] } },
+        body: {
+            nodeSchema: { nodes: [...nodes, (0, exports.newShotNode)()], edges: Array.isArray(workflow?.nodeSchema?.edges) ? workflow.nodeSchema.edges : [] },
+            baseUpdatedAt: new Date(workflow.updatedAt).toISOString(),
+        },
     });
     if (answer.status >= 200 && answer.status < 300)
         return null;

package/dist/middleware/createRouter.js

@@ -45,6 +45,7 @@ const workerCallback_1 = require("./routes/workerCallback");
 const workerJobs_1 = require("../services/workerJobs");
 const deliverable_1 = require("./routes/deliverable");
 const document_1 = require("./routes/document");
+const projectResources_1 = require("./routes/projectResources");
 const documents_1 = require("../services/documents");
 function createStreamByRouter(config) {
     const router = express_1.default.Router();
@@ -153,5 +154,6 @@ function createStreamByRouter(config) {
     router.use((0, worker_1.workerRouter)({ ...config, adapter }));
     router.use((0, deliverable_1.deliverableRouter)({ ...config, adapter }));
     router.use((0, document_1.documentRouter)(config));
+    router.use((0, projectResources_1.projectResourcesRouter)(config));
     return router;
 }

package/dist/middleware/routes/connection.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.connectionRouter = connectionRouter;
 const express_1 = require("express");
+const workflowResources_1 = require("../../services/workflowResources");
 const manager_1 = require("../../models/manager");
 const auth_1 = require("../../utils/auth");
 const connection_1 = require("../../services/connection");
@@ -88,7 +89,8 @@ function connectionRouter(config) {
                 ...(description !== undefined && { description }),
                 ...(token !== undefined && { token }),
             });
-            return res.status(201).json({ data: (0, sanitize_1.sanitizeConnection)(connection) });
+            await (0, workflowResources_1.addToWorkflow)(projectId, 'api', connection);
+            return res.status(201).json({ data: (0, sanitize_1.sanitizeConnection)(connection), connections: (0, sanitize_1.sanitizeConnections)((await Project.findOne({ _id: projectId }))?.connections) });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to add connection', details: err.message });
@@ -178,7 +180,8 @@ function connectionRouter(config) {
                 return res.status(404).json({ message: 'Connection not found' });
             }
             await (0, connection_1.deleteConnection)(config, projectId, connectionId);
-            return res.status(200).json({ message: 'Connection deleted successfully.' });
+            await (0, workflowResources_1.removeFromWorkflow)(projectId, 'api', connectionId);
+            return res.status(200).json({ message: 'Connection deleted successfully.', connections: (0, sanitize_1.sanitizeConnections)((await Project.findOne({ _id: projectId }))?.connections) });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to delete connection', details: err.message });

package/dist/middleware/routes/dbConnection.js

@@ -2,6 +2,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.dbConnectionRouter = dbConnectionRouter;
 const express_1 = require("express");
+const workflowResources_1 = require("../../services/workflowResources");
+const projectResources_1 = require("./projectResources");
+const projectIntegration_1 = require("../../services/projectIntegration");
 const mongodb_1 = require("mongodb");
 const manager_1 = require("../../models/manager");
 const auth_1 = require("../../utils/auth");
@@ -45,11 +48,29 @@ function dbConnectionRouter(config) {
             res.status(500).json({ message: 'Failed to fetch DB connections', details: err.message });
         }
     });
+    // The project's database connections as they're answered, after each change too.
+    const listNow = async (projectId) => (0, sanitize_1.sanitizeConnections)((await Project.findOne({ _id: projectId }))?.dbConnections);
     // ─── Add DB connection ────────────────────────────────────────────────────
     router.post('/projects/:id/connections/db', async (req, res) => {
         try {
             const auth = req.auth;
             const { name, dbType, credential, integrationId, description } = req.body;
+            if (credential && integrationId) {
+                return res.status(400).json({ message: 'Provide only one of credential or integrationId' });
+            }
+            // An integration (the user's, or a built-in) is a named, typed database already.
+            if (integrationId) {
+                const project = await Project.findOne({ _id: req.params.id });
+                if (!project)
+                    return res.status(404).json({ message: 'Project not found' });
+                if (!(0, auth_1.canEditProject)(project, auth.userId))
+                    return res.status(403).json({ message: 'Unauthorized project access' });
+                const result = await (0, projectIntegration_1.connectIntegration)(project, integrationId, auth, config, { kind: 'database', description });
+                if ('error' in result)
+                    return res.status(result.status).json({ message: result.error });
+                await (0, workflowResources_1.addToWorkflow)(req.params.id, 'db', result.connection);
+                return res.status(201).json({ data: (0, sanitize_1.sanitizeConnection)(result.connection), dbConnections: await listNow(req.params.id) });
+            }
             if (!name || !dbType) {
                 return res.status(400).json({ message: 'name and dbType are required' });
             }
@@ -93,7 +114,8 @@ function dbConnectionRouter(config) {
                 ...(description !== undefined && { description }),
             };
             await Project.update({ _id: req.params.id }, { $push: { dbConnections: connection } });
-            return res.status(201).json({ data: (0, sanitize_1.sanitizeConnection)(connection) });
+            await (0, workflowResources_1.addToWorkflow)(req.params.id, 'db', connection);
+            return res.status(201).json({ data: (0, sanitize_1.sanitizeConnection)(connection), dbConnections: await listNow(req.params.id) });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to add DB connection', details: err.message });
@@ -111,11 +133,13 @@ function dbConnectionRouter(config) {
             const conn = (0, connectionResolver_1.findDbConnection)(project, req.params.connId);
             if (!conn)
                 return res.status(404).json({ message: 'DB connection not found' });
-            if (conn.source === 'builtin') {
-                return res.status(403).json({ message: 'Cannot delete a built-in database connection' });
-            }
+            // A built-in is disconnected, not deleted: what the project keeps in it stays, and it can
+            // be connected again (routes/projectResources).
             await Project.update({ _id: req.params.id }, { $pull: { dbConnections: { id: req.params.connId } } });
-            return res.status(200).json({ message: 'DB connection deleted successfully' });
+            if (conn.source === 'builtin')
+                await (0, projectResources_1.rememberDisconnectedBuiltin)(req.params.id, 'db', conn);
+            await (0, workflowResources_1.removeFromWorkflow)(req.params.id, 'db', req.params.connId);
+            return res.status(200).json({ message: 'DB connection deleted successfully', dbConnections: await listNow(req.params.id) });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to delete DB connection', details: err.message });

package/dist/middleware/routes/document.js

@@ -11,6 +11,7 @@ const auth_1 = require("../../utils/auth");
 const wsHub_1 = require("../../services/wsHub");
 const documents_1 = require("../../services/documents");
 const auth_2 = require("../../services/auth");
+const creditsSheets_1 = require("../../services/creditsSheets");
 const MAX_TITLE = 200;
 const MAX_CONTENT = 1000000;
 // What happened to a project's documents, to whoever is in it now: a view of a document
@@ -30,7 +31,9 @@ function checkTitle(value) {
         return { error: `A title has at most ${MAX_TITLE} characters` };
     return value.trim();
 }
-function checkContent(value) {
+function checkContent(value, kind = 'document') {
+    if (kind === 'credits')
+        return (0, creditsSheets_1.checkSheetContent)(value);
     if (typeof value !== 'string')
         return { error: 'content must be text (markdown)' };
     if (value.length > MAX_CONTENT)
@@ -92,15 +95,15 @@ function documentRouter(_config) {
             if (!found)
                 return;
             const { project, auth, projectId } = found;
-            const kind = req.body?.kind === 'folder' ? 'folder' : 'document';
-            if (req.body?.kind !== undefined && !['document', 'folder'].includes(req.body.kind))
-                return res.status(400).json({ message: "kind is 'document' or 'folder'" });
+            if (req.body?.kind !== undefined && !['document', 'folder', 'credits'].includes(req.body.kind))
+                return res.status(400).json({ message: "kind is 'document', 'folder' or 'credits'" });
+            const kind = req.body?.kind ?? 'document';
             const title = checkTitle(req.body?.title);
             if (failed(title))
                 return res.status(400).json({ message: title.error });
             if (kind === 'folder' && req.body?.content)
                 return res.status(400).json({ message: 'A folder has no content' });
-            const content = kind === 'folder' ? '' : checkContent(req.body?.content ?? '');
+            const content = kind === 'folder' ? '' : checkContent(req.body?.content ?? '', kind);
             if (failed(content))
                 return res.status(400).json({ message: content.error });
             const store = (0, documents_1.documentStore)();
@@ -168,7 +171,7 @@ function documentRouter(_config) {
                     return res.status(400).json({ message: title.error });
                 if (current.kind === 'folder' && body.content)
                     return res.status(400).json({ message: 'A folder has no content' });
-                const content = body.content === undefined ? current.content : checkContent(body.content);
+                const content = body.content === undefined ? current.content : checkContent(body.content, current.kind);
                 if (failed(content))
                     return res.status(400).json({ message: content.error });
                 text = { title, content };
@@ -240,6 +243,8 @@ function documentRouter(_config) {
                 return res.status(404).json({ message: 'Document not found' });
             if (current.kind === 'folder')
                 return res.status(400).json({ message: 'A folder has no content' });
+            if (current.kind === 'credits')
+                return res.status(400).json({ message: 'A credits sheet has no sections: its content is its sources' });
             // A section of another version than the one it was read on could be another text.
             if (current.version !== baseVersion)
                 return conflict(res, current);

package/dist/middleware/routes/export.d.ts

@@ -1,3 +1,31 @@
 import { Router } from 'express';
 import { StreamByConfig } from '../../types';
+export declare const DEFAULT_NODE_SCHEMA: {
+    nodes: {
+        id: string;
+        type: string;
+        position: {
+            x: number;
+            y: number;
+        };
+        data: {
+            label: string;
+            subtitle: string;
+        };
+        width: number;
+        height: number;
+    }[];
+    edges: {
+        id: string;
+        source: string;
+        sourceHandle: string;
+        target: string;
+        targetHandle: string;
+        animated: boolean;
+        style: {
+            stroke: string;
+            strokeWidth: number;
+        };
+    }[];
+};
 export declare function exportRouter(config: StreamByConfig): Router;