@btst/stack 2.11.0 → 2.11.1

package/dist/packages/stack/src/plugins/media/api/plugin.cjs

@@ -22,9 +22,12 @@ const mediaBackendPlugin = (config) => api.defineBackendPlugin({
   api: (adapter) => ({
     listAssets: (params) => getters.listAssets(adapter, params),
     getAssetById: (id) => getters.getAssetById(adapter, id),
+    createAsset: (input) => mutations.createAsset(adapter, input),
+    updateAsset: (id, input) => mutations.updateAsset(adapter, id, input),
     listFolders: (params) => getters.listFolders(adapter, params),
     getFolderById: (id) => getters.getFolderById(adapter, id),
-    getFolderByName: (name, parentId, tenantId) => getters.getFolderByName(adapter, name, parentId, tenantId)
+    getFolderByName: (name, parentId, tenantId) => getters.getFolderByName(adapter, name, parentId, tenantId),
+    createFolder: (input) => mutations.createFolder(adapter, input)
   }),
   routes: (adapter) => {
     const {

package/dist/packages/stack/src/plugins/media/api/plugin.mjs

@@ -3,7 +3,7 @@ import { z } from 'zod';
 import { mediaSchema } from '../db.mjs';
 import { AssetListQuerySchema, createAssetSchema, updateAssetSchema, createFolderSchema, uploadTokenRequestSchema } from '../schemas.mjs';
 import { getFolderByName, getFolderById, listFolders, getAssetById, listAssets } from './getters.mjs';
-import { createAsset, updateAsset, deleteAsset, createFolder, deleteFolder } from './mutations.mjs';
+import { createFolder, updateAsset, createAsset, deleteAsset, deleteFolder } from './mutations.mjs';
 import { isDirectAdapter, isS3Adapter, isVercelBlobAdapter } from './storage-adapter.mjs';
 import { runHookWithShim } from '../../utils.mjs';
 
@@ -20,9 +20,12 @@ const mediaBackendPlugin = (config) => defineBackendPlugin({
   api: (adapter) => ({
     listAssets: (params) => listAssets(adapter, params),
     getAssetById: (id) => getAssetById(adapter, id),
+    createAsset: (input) => createAsset(adapter, input),
+    updateAsset: (id, input) => updateAsset(adapter, id, input),
     listFolders: (params) => listFolders(adapter, params),
     getFolderById: (id) => getFolderById(adapter, id),
-    getFolderByName: (name, parentId, tenantId) => getFolderByName(adapter, name, parentId, tenantId)
+    getFolderByName: (name, parentId, tenantId) => getFolderByName(adapter, name, parentId, tenantId),
+    createFolder: (input) => createFolder(adapter, input)
   }),
   routes: (adapter) => {
     const {

package/dist/plugins/blog/api/index.d.cts

@@ -1,5 +1,5 @@
-export { B as BLOG_QUERY_KEYS, h as BlogApiContext, k as BlogApiRouter, i as BlogBackendHooks, e as BlogRouteKey, N as NextPreviousPostsQuerySchema, P as PostListParams, f as PostListQuerySchema, c as PostListResult, j as blogBackendPlugin, d as createBlogQueryKeys, g as getAllPosts, b as getAllTags, a as getPostBySlug } from '../../../shared/stack.DjgpFWq3.cjs';
-import { P as Post, T as Tag, S as SerializedPost, a as SerializedTag } from '../../../shared/stack.BQmuNl5p.cjs';
+export { B as BLOG_QUERY_KEYS, h as BlogApiContext, k as BlogApiRouter, i as BlogBackendHooks, e as BlogRouteKey, N as NextPreviousPostsQuerySchema, P as PostListParams, f as PostListQuerySchema, c as PostListResult, j as blogBackendPlugin, d as createBlogQueryKeys, g as getAllPosts, b as getAllTags, a as getPostBySlug } from '../../../shared/stack.DEW8EtFu.cjs';
+import { P as Post, T as Tag, S as SerializedPost, a as SerializedTag } from '../../../shared/stack.Sod_PZhB.cjs';
 import '@tanstack/react-query';
 import '@btst/stack/plugins/client';
 import '@btst/stack/plugins/api';

package/dist/plugins/blog/api/index.d.mts

@@ -1,5 +1,5 @@
-export { B as BLOG_QUERY_KEYS, h as BlogApiContext, k as BlogApiRouter, i as BlogBackendHooks, e as BlogRouteKey, N as NextPreviousPostsQuerySchema, P as PostListParams, f as PostListQuerySchema, c as PostListResult, j as blogBackendPlugin, d as createBlogQueryKeys, g as getAllPosts, b as getAllTags, a as getPostBySlug } from '../../../shared/stack.IUeyQKrm.mjs';
-import { P as Post, T as Tag, S as SerializedPost, a as SerializedTag } from '../../../shared/stack.BQmuNl5p.mjs';
+export { B as BLOG_QUERY_KEYS, h as BlogApiContext, k as BlogApiRouter, i as BlogBackendHooks, e as BlogRouteKey, N as NextPreviousPostsQuerySchema, P as PostListParams, f as PostListQuerySchema, c as PostListResult, j as blogBackendPlugin, d as createBlogQueryKeys, g as getAllPosts, b as getAllTags, a as getPostBySlug } from '../../../shared/stack.DvMUCTTl.mjs';
+import { P as Post, T as Tag, S as SerializedPost, a as SerializedTag } from '../../../shared/stack.Sod_PZhB.mjs';
 import '@tanstack/react-query';
 import '@btst/stack/plugins/client';
 import '@btst/stack/plugins/api';

package/dist/plugins/blog/api/index.d.ts

@@ -1,5 +1,5 @@
-export { B as BLOG_QUERY_KEYS, h as BlogApiContext, k as BlogApiRouter, i as BlogBackendHooks, e as BlogRouteKey, N as NextPreviousPostsQuerySchema, P as PostListParams, f as PostListQuerySchema, c as PostListResult, j as blogBackendPlugin, d as createBlogQueryKeys, g as getAllPosts, b as getAllTags, a as getPostBySlug } from '../../../shared/stack.D7HSzZdG.js';
-import { P as Post, T as Tag, S as SerializedPost, a as SerializedTag } from '../../../shared/stack.BQmuNl5p.js';
+export { B as BLOG_QUERY_KEYS, h as BlogApiContext, k as BlogApiRouter, i as BlogBackendHooks, e as BlogRouteKey, N as NextPreviousPostsQuerySchema, P as PostListParams, f as PostListQuerySchema, c as PostListResult, j as blogBackendPlugin, d as createBlogQueryKeys, g as getAllPosts, b as getAllTags, a as getPostBySlug } from '../../../shared/stack.qta0-CPq.js';
+import { P as Post, T as Tag, S as SerializedPost, a as SerializedTag } from '../../../shared/stack.Sod_PZhB.js';
 import '@tanstack/react-query';
 import '@btst/stack/plugins/client';
 import '@btst/stack/plugins/api';

package/dist/plugins/blog/client/hooks/index.d.cts

@@ -1,6 +1,6 @@
-export { P as PostCreateInput, e as PostUpdateInput, o as UseNextPreviousPostsOptions, p as UseNextPreviousPostsResult, d as UsePostResult, b as UsePostSearchOptions, c as UsePostSearchResult, U as UsePostsOptions, a as UsePostsResult, r as UseRecentPostsOptions, s as UseRecentPostsResult, k as useCreatePost, m as useDeletePost, q as useNextPreviousPosts, g as usePost, n as usePostSearch, u as usePosts, t as useRecentPosts, h as useSuspensePost, f as useSuspensePosts, j as useSuspenseTags, i as useTags, l as useUpdatePost } from '../../../../shared/stack.AJTXI7kw.cjs';
+export { P as PostCreateInput, e as PostUpdateInput, o as UseNextPreviousPostsOptions, p as UseNextPreviousPostsResult, d as UsePostResult, b as UsePostSearchOptions, c as UsePostSearchResult, U as UsePostsOptions, a as UsePostsResult, r as UseRecentPostsOptions, s as UseRecentPostsResult, k as useCreatePost, m as useDeletePost, q as useNextPreviousPosts, g as usePost, n as usePostSearch, u as usePosts, t as useRecentPosts, h as useSuspensePost, f as useSuspensePosts, j as useSuspenseTags, i as useTags, l as useUpdatePost } from '../../../../shared/stack.DGsFF5qb.cjs';
 import '@tanstack/react-query';
-import '../../../../shared/stack.BQmuNl5p.cjs';
+import '../../../../shared/stack.Sod_PZhB.cjs';
 import 'zod';
 
 declare function useDebounce<T>(value: T, delay?: number): T;

package/dist/plugins/blog/client/hooks/index.d.mts

@@ -1,6 +1,6 @@
-export { P as PostCreateInput, e as PostUpdateInput, o as UseNextPreviousPostsOptions, p as UseNextPreviousPostsResult, d as UsePostResult, b as UsePostSearchOptions, c as UsePostSearchResult, U as UsePostsOptions, a as UsePostsResult, r as UseRecentPostsOptions, s as UseRecentPostsResult, k as useCreatePost, m as useDeletePost, q as useNextPreviousPosts, g as usePost, n as usePostSearch, u as usePosts, t as useRecentPosts, h as useSuspensePost, f as useSuspensePosts, j as useSuspenseTags, i as useTags, l as useUpdatePost } from '../../../../shared/stack.6mEHS2WH.mjs';
+export { P as PostCreateInput, e as PostUpdateInput, o as UseNextPreviousPostsOptions, p as UseNextPreviousPostsResult, d as UsePostResult, b as UsePostSearchOptions, c as UsePostSearchResult, U as UsePostsOptions, a as UsePostsResult, r as UseRecentPostsOptions, s as UseRecentPostsResult, k as useCreatePost, m as useDeletePost, q as useNextPreviousPosts, g as usePost, n as usePostSearch, u as usePosts, t as useRecentPosts, h as useSuspensePost, f as useSuspensePosts, j as useSuspenseTags, i as useTags, l as useUpdatePost } from '../../../../shared/stack.NtflNnnH.mjs';
 import '@tanstack/react-query';
-import '../../../../shared/stack.BQmuNl5p.mjs';
+import '../../../../shared/stack.Sod_PZhB.mjs';
 import 'zod';
 
 declare function useDebounce<T>(value: T, delay?: number): T;

package/dist/plugins/blog/client/hooks/index.d.ts

@@ -1,6 +1,6 @@
-export { P as PostCreateInput, e as PostUpdateInput, o as UseNextPreviousPostsOptions, p as UseNextPreviousPostsResult, d as UsePostResult, b as UsePostSearchOptions, c as UsePostSearchResult, U as UsePostsOptions, a as UsePostsResult, r as UseRecentPostsOptions, s as UseRecentPostsResult, k as useCreatePost, m as useDeletePost, q as useNextPreviousPosts, g as usePost, n as usePostSearch, u as usePosts, t as useRecentPosts, h as useSuspensePost, f as useSuspensePosts, j as useSuspenseTags, i as useTags, l as useUpdatePost } from '../../../../shared/stack.QYn-Px94.js';
+export { P as PostCreateInput, e as PostUpdateInput, o as UseNextPreviousPostsOptions, p as UseNextPreviousPostsResult, d as UsePostResult, b as UsePostSearchOptions, c as UsePostSearchResult, U as UsePostsOptions, a as UsePostsResult, r as UseRecentPostsOptions, s as UseRecentPostsResult, k as useCreatePost, m as useDeletePost, q as useNextPreviousPosts, g as usePost, n as usePostSearch, u as usePosts, t as useRecentPosts, h as useSuspensePost, f as useSuspensePosts, j as useSuspenseTags, i as useTags, l as useUpdatePost } from '../../../../shared/stack.QrBE0Bc8.js';
 import '@tanstack/react-query';
-import '../../../../shared/stack.BQmuNl5p.js';
+import '../../../../shared/stack.Sod_PZhB.js';
 import 'zod';
 
 declare function useDebounce<T>(value: T, delay?: number): T;

package/dist/plugins/blog/client/index.d.cts

@@ -2,8 +2,8 @@ import * as _btst_stack_plugins_client from '@btst/stack/plugins/client';
 import * as _btst_yar from '@btst/yar';
 import { ComponentType, ReactNode } from 'react';
 import { QueryClient } from '@tanstack/react-query';
-import { P as Post, S as SerializedPost } from '../../../shared/stack.BQmuNl5p.cjs';
-export { U as UsePostsOptions, a as UsePostsResult } from '../../../shared/stack.AJTXI7kw.cjs';
+import { P as Post, S as SerializedPost } from '../../../shared/stack.Sod_PZhB.cjs';
+export { U as UsePostsOptions, a as UsePostsResult } from '../../../shared/stack.DGsFF5qb.cjs';
 import 'zod';
 
 /**

package/dist/plugins/blog/client/index.d.mts

@@ -2,8 +2,8 @@ import * as _btst_stack_plugins_client from '@btst/stack/plugins/client';
 import * as _btst_yar from '@btst/yar';
 import { ComponentType, ReactNode } from 'react';
 import { QueryClient } from '@tanstack/react-query';
-import { P as Post, S as SerializedPost } from '../../../shared/stack.BQmuNl5p.mjs';
-export { U as UsePostsOptions, a as UsePostsResult } from '../../../shared/stack.6mEHS2WH.mjs';
+import { P as Post, S as SerializedPost } from '../../../shared/stack.Sod_PZhB.mjs';
+export { U as UsePostsOptions, a as UsePostsResult } from '../../../shared/stack.NtflNnnH.mjs';
 import 'zod';
 
 /**

package/dist/plugins/blog/client/index.d.ts

@@ -2,8 +2,8 @@ import * as _btst_stack_plugins_client from '@btst/stack/plugins/client';
 import * as _btst_yar from '@btst/yar';
 import { ComponentType, ReactNode } from 'react';
 import { QueryClient } from '@tanstack/react-query';
-import { P as Post, S as SerializedPost } from '../../../shared/stack.BQmuNl5p.js';
-export { U as UsePostsOptions, a as UsePostsResult } from '../../../shared/stack.QYn-Px94.js';
+import { P as Post, S as SerializedPost } from '../../../shared/stack.Sod_PZhB.js';
+export { U as UsePostsOptions, a as UsePostsResult } from '../../../shared/stack.QrBE0Bc8.js';
 import 'zod';
 
 /**

package/dist/plugins/blog/query-keys.d.cts

@@ -1,7 +1,7 @@
 import '@tanstack/react-query';
-export { d as createBlogQueryKeys } from '../../shared/stack.DjgpFWq3.cjs';
+export { d as createBlogQueryKeys } from '../../shared/stack.DEW8EtFu.cjs';
 import '@btst/stack/plugins/client';
-import '../../shared/stack.BQmuNl5p.cjs';
+import '../../shared/stack.Sod_PZhB.cjs';
 import '@btst/stack/plugins/api';
 import '@btst/db';
 import 'better-call';

package/dist/plugins/blog/query-keys.d.mts

@@ -1,7 +1,7 @@
 import '@tanstack/react-query';
-export { d as createBlogQueryKeys } from '../../shared/stack.IUeyQKrm.mjs';
+export { d as createBlogQueryKeys } from '../../shared/stack.DvMUCTTl.mjs';
 import '@btst/stack/plugins/client';
-import '../../shared/stack.BQmuNl5p.mjs';
+import '../../shared/stack.Sod_PZhB.mjs';
 import '@btst/stack/plugins/api';
 import '@btst/db';
 import 'better-call';

package/dist/plugins/blog/query-keys.d.ts

@@ -1,7 +1,7 @@
 import '@tanstack/react-query';
-export { d as createBlogQueryKeys } from '../../shared/stack.D7HSzZdG.js';
+export { d as createBlogQueryKeys } from '../../shared/stack.qta0-CPq.js';
 import '@btst/stack/plugins/client';
-import '../../shared/stack.BQmuNl5p.js';
+import '../../shared/stack.Sod_PZhB.js';
 import '@btst/stack/plugins/api';
 import '@btst/db';
 import 'better-call';

package/dist/plugins/kanban/api/index.d.cts

@@ -1,4 +1,4 @@
-export { B as BoardListResult, C as CreateKanbanTaskInput, i as KANBAN_QUERY_KEYS, b as KanbanApiContext, K as KanbanApiRouter, c as KanbanBackendHooks, a as KanbanRouteKey, e as createKanbanTask, f as findOrCreateKanbanBoard, g as getAllBoards, d as getBoardById, h as getKanbanColumnsByBoardId, k as kanbanBackendPlugin } from '../../../shared/stack.eq5eg1yt.cjs';
+export { B as BoardListResult, C as CreateKanbanTaskInput, i as KANBAN_QUERY_KEYS, b as KanbanApiContext, K as KanbanApiRouter, c as KanbanBackendHooks, a as KanbanRouteKey, e as createKanbanTask, f as findOrCreateKanbanBoard, g as getAllBoards, d as getBoardById, h as getKanbanColumnsByBoardId, k as kanbanBackendPlugin } from '../../../shared/stack.BOokfhZD.cjs';
 import { B as BoardWithColumns, S as SerializedBoardWithColumns, C as ColumnWithTasks, a as SerializedColumn, T as Task, b as SerializedTask } from '../../../shared/stack.DJaKVY7v.cjs';
 import '@btst/stack/plugins/api';
 import '@btst/db';

package/dist/plugins/kanban/api/index.d.mts

@@ -1,4 +1,4 @@
-export { B as BoardListResult, C as CreateKanbanTaskInput, i as KANBAN_QUERY_KEYS, b as KanbanApiContext, K as KanbanApiRouter, c as KanbanBackendHooks, a as KanbanRouteKey, e as createKanbanTask, f as findOrCreateKanbanBoard, g as getAllBoards, d as getBoardById, h as getKanbanColumnsByBoardId, k as kanbanBackendPlugin } from '../../../shared/stack.Dj04W2c3.mjs';
+export { B as BoardListResult, C as CreateKanbanTaskInput, i as KANBAN_QUERY_KEYS, b as KanbanApiContext, K as KanbanApiRouter, c as KanbanBackendHooks, a as KanbanRouteKey, e as createKanbanTask, f as findOrCreateKanbanBoard, g as getAllBoards, d as getBoardById, h as getKanbanColumnsByBoardId, k as kanbanBackendPlugin } from '../../../shared/stack.CWxAl9K3.mjs';
 import { B as BoardWithColumns, S as SerializedBoardWithColumns, C as ColumnWithTasks, a as SerializedColumn, T as Task, b as SerializedTask } from '../../../shared/stack.DJaKVY7v.mjs';
 import '@btst/stack/plugins/api';
 import '@btst/db';

package/dist/plugins/kanban/api/index.d.ts

@@ -1,4 +1,4 @@
-export { B as BoardListResult, C as CreateKanbanTaskInput, i as KANBAN_QUERY_KEYS, b as KanbanApiContext, K as KanbanApiRouter, c as KanbanBackendHooks, a as KanbanRouteKey, e as createKanbanTask, f as findOrCreateKanbanBoard, g as getAllBoards, d as getBoardById, h as getKanbanColumnsByBoardId, k as kanbanBackendPlugin } from '../../../shared/stack.CMbX8Q5C.js';
+export { B as BoardListResult, C as CreateKanbanTaskInput, i as KANBAN_QUERY_KEYS, b as KanbanApiContext, K as KanbanApiRouter, c as KanbanBackendHooks, a as KanbanRouteKey, e as createKanbanTask, f as findOrCreateKanbanBoard, g as getAllBoards, d as getBoardById, h as getKanbanColumnsByBoardId, k as kanbanBackendPlugin } from '../../../shared/stack.BvCR4-9H.js';
 import { B as BoardWithColumns, S as SerializedBoardWithColumns, C as ColumnWithTasks, a as SerializedColumn, T as Task, b as SerializedTask } from '../../../shared/stack.DJaKVY7v.js';
 import '@btst/stack/plugins/api';
 import '@btst/db';

package/dist/plugins/kanban/query-keys.d.cts

@@ -1,5 +1,5 @@
 import * as _tanstack_react_query from '@tanstack/react-query';
-import { K as KanbanApiRouter, j as BoardsListDiscriminator } from '../../shared/stack.eq5eg1yt.cjs';
+import { K as KanbanApiRouter, j as BoardsListDiscriminator } from '../../shared/stack.BOokfhZD.cjs';
 import { createApiClient } from '@btst/stack/plugins/client';
 import { S as SerializedBoardWithColumns } from '../../shared/stack.DJaKVY7v.cjs';
 import '@btst/stack/plugins/api';

package/dist/plugins/kanban/query-keys.d.mts

@@ -1,5 +1,5 @@
 import * as _tanstack_react_query from '@tanstack/react-query';
-import { K as KanbanApiRouter, j as BoardsListDiscriminator } from '../../shared/stack.Dj04W2c3.mjs';
+import { K as KanbanApiRouter, j as BoardsListDiscriminator } from '../../shared/stack.CWxAl9K3.mjs';
 import { createApiClient } from '@btst/stack/plugins/client';
 import { S as SerializedBoardWithColumns } from '../../shared/stack.DJaKVY7v.mjs';
 import '@btst/stack/plugins/api';

package/dist/plugins/kanban/query-keys.d.ts

@@ -1,5 +1,5 @@
 import * as _tanstack_react_query from '@tanstack/react-query';
-import { K as KanbanApiRouter, j as BoardsListDiscriminator } from '../../shared/stack.CMbX8Q5C.js';
+import { K as KanbanApiRouter, j as BoardsListDiscriminator } from '../../shared/stack.BvCR4-9H.js';
 import { createApiClient } from '@btst/stack/plugins/client';
 import { S as SerializedBoardWithColumns } from '../../shared/stack.DJaKVY7v.js';
 import '@btst/stack/plugins/api';

package/dist/{packages/stack/src/plugins → plugins}/media/api/adapters/local.cjs

@@ -40,7 +40,13 @@ function localAdapter(options = {}) {
       const encodedFilename = url.split("/").pop();
       if (!encodedFilename) return;
       const filename = decodeURIComponent(encodedFilename);
-      const filePath = path__namespace.join(uploadDir, filename);
+      const resolvedUploadDir = path__namespace.resolve(uploadDir);
+      const filePath = path__namespace.join(resolvedUploadDir, filename);
+      if (!filePath.startsWith(resolvedUploadDir + path__namespace.sep)) {
+        throw new Error(
+          `Refusing to delete file outside upload directory: ${filePath}`
+        );
+      }
       try {
         await fs__namespace.unlink(filePath);
       } catch (err) {

package/dist/plugins/media/api/adapters/local.d.cts

@@ -0,0 +1,30 @@
+import { D as DirectStorageAdapter } from '../../../../shared/stack.lkebw2nj.cjs';
+
+interface LocalStorageAdapterOptions {
+    /**
+     * Absolute path to the directory where uploaded files are stored.
+     * @default "./public/uploads"
+     */
+    uploadDir?: string;
+    /**
+     * URL prefix used to build the public URL for uploaded files.
+     * @default "/uploads"
+     */
+    publicPath?: string;
+}
+/**
+ * Create a local filesystem storage adapter.
+ * Files are written to `uploadDir` and served at `publicPath`.
+ * Suitable for development and self-hosted deployments.
+ *
+ * @example
+ * ```ts
+ * mediaBackendPlugin({
+ *   storageAdapter: localAdapter({ uploadDir: "./public/uploads", publicPath: "/uploads" })
+ * })
+ * ```
+ */
+declare function localAdapter(options?: LocalStorageAdapterOptions): DirectStorageAdapter;
+
+export { localAdapter };
+export type { LocalStorageAdapterOptions };

package/dist/plugins/media/api/adapters/local.d.mts

@@ -0,0 +1,30 @@
+import { D as DirectStorageAdapter } from '../../../../shared/stack.lkebw2nj.mjs';
+
+interface LocalStorageAdapterOptions {
+    /**
+     * Absolute path to the directory where uploaded files are stored.
+     * @default "./public/uploads"
+     */
+    uploadDir?: string;
+    /**
+     * URL prefix used to build the public URL for uploaded files.
+     * @default "/uploads"
+     */
+    publicPath?: string;
+}
+/**
+ * Create a local filesystem storage adapter.
+ * Files are written to `uploadDir` and served at `publicPath`.
+ * Suitable for development and self-hosted deployments.
+ *
+ * @example
+ * ```ts
+ * mediaBackendPlugin({
+ *   storageAdapter: localAdapter({ uploadDir: "./public/uploads", publicPath: "/uploads" })
+ * })
+ * ```
+ */
+declare function localAdapter(options?: LocalStorageAdapterOptions): DirectStorageAdapter;
+
+export { localAdapter };
+export type { LocalStorageAdapterOptions };

package/dist/plugins/media/api/adapters/local.d.ts

@@ -0,0 +1,30 @@
+import { D as DirectStorageAdapter } from '../../../../shared/stack.lkebw2nj.js';
+
+interface LocalStorageAdapterOptions {
+    /**
+     * Absolute path to the directory where uploaded files are stored.
+     * @default "./public/uploads"
+     */
+    uploadDir?: string;
+    /**
+     * URL prefix used to build the public URL for uploaded files.
+     * @default "/uploads"
+     */
+    publicPath?: string;
+}
+/**
+ * Create a local filesystem storage adapter.
+ * Files are written to `uploadDir` and served at `publicPath`.
+ * Suitable for development and self-hosted deployments.
+ *
+ * @example
+ * ```ts
+ * mediaBackendPlugin({
+ *   storageAdapter: localAdapter({ uploadDir: "./public/uploads", publicPath: "/uploads" })
+ * })
+ * ```
+ */
+declare function localAdapter(options?: LocalStorageAdapterOptions): DirectStorageAdapter;
+
+export { localAdapter };
+export type { LocalStorageAdapterOptions };

package/dist/{packages/stack/src/plugins → plugins}/media/api/adapters/local.mjs

@@ -22,7 +22,13 @@ function localAdapter(options = {}) {
       const encodedFilename = url.split("/").pop();
       if (!encodedFilename) return;
       const filename = decodeURIComponent(encodedFilename);
-      const filePath = path.join(uploadDir, filename);
+      const resolvedUploadDir = path.resolve(uploadDir);
+      const filePath = path.join(resolvedUploadDir, filename);
+      if (!filePath.startsWith(resolvedUploadDir + path.sep)) {
+        throw new Error(
+          `Refusing to delete file outside upload directory: ${filePath}`
+        );
+      }
       try {
         await fs.unlink(filePath);
       } catch (err) {

package/dist/plugins/media/api/adapters/s3.d.cts

@@ -1,4 +1,4 @@
-import { S as S3StorageAdapter } from '../../../../shared/stack.DO6vOGQG.cjs';
+import { a as S3StorageAdapter } from '../../../../shared/stack.lkebw2nj.cjs';
 
 interface S3StorageAdapterOptions {
     /**

package/dist/plugins/media/api/adapters/s3.d.mts

@@ -1,4 +1,4 @@
-import { S as S3StorageAdapter } from '../../../../shared/stack.DO6vOGQG.mjs';
+import { a as S3StorageAdapter } from '../../../../shared/stack.lkebw2nj.mjs';
 
 interface S3StorageAdapterOptions {
     /**

package/dist/plugins/media/api/adapters/s3.d.ts

@@ -1,4 +1,4 @@
-import { S as S3StorageAdapter } from '../../../../shared/stack.DO6vOGQG.js';
+import { a as S3StorageAdapter } from '../../../../shared/stack.lkebw2nj.js';
 
 interface S3StorageAdapterOptions {
     /**

package/dist/plugins/media/api/adapters/vercel-blob.d.cts

@@ -1,4 +1,4 @@
-import { V as VercelBlobStorageAdapter } from '../../../../shared/stack.DO6vOGQG.cjs';
+import { V as VercelBlobStorageAdapter } from '../../../../shared/stack.lkebw2nj.cjs';
 
 interface VercelBlobStorageAdapterOptions {
     /**

package/dist/plugins/media/api/adapters/vercel-blob.d.mts

@@ -1,4 +1,4 @@
-import { V as VercelBlobStorageAdapter } from '../../../../shared/stack.DO6vOGQG.mjs';
+import { V as VercelBlobStorageAdapter } from '../../../../shared/stack.lkebw2nj.mjs';
 
 interface VercelBlobStorageAdapterOptions {
     /**

package/dist/plugins/media/api/adapters/vercel-blob.d.ts

@@ -1,4 +1,4 @@
-import { V as VercelBlobStorageAdapter } from '../../../../shared/stack.DO6vOGQG.js';
+import { V as VercelBlobStorageAdapter } from '../../../../shared/stack.lkebw2nj.js';
 
 interface VercelBlobStorageAdapterOptions {
     /**

package/dist/plugins/media/api/index.cjs

@@ -5,7 +5,6 @@ const getters = require('../../../packages/stack/src/plugins/media/api/getters.c
 const mutations = require('../../../packages/stack/src/plugins/media/api/mutations.cjs');
 const serializers = require('../../../packages/stack/src/plugins/media/api/serializers.cjs');
 const queryKeyDefs = require('../../../packages/stack/src/plugins/media/api/query-key-defs.cjs');
-const local = require('../../../packages/stack/src/plugins/media/api/adapters/local.cjs');
 
 
 
@@ -24,4 +23,3 @@ exports.serializeAsset = serializers.serializeAsset;
 exports.serializeFolder = serializers.serializeFolder;
 exports.MEDIA_QUERY_KEYS = queryKeyDefs.MEDIA_QUERY_KEYS;
 exports.assetListDiscriminator = queryKeyDefs.assetListDiscriminator;
-exports.localAdapter = local.localAdapter;

package/dist/plugins/media/api/index.d.cts

@@ -1,81 +1,11 @@
-export { a as MEDIA_QUERY_KEYS, c as MediaApiContext, M as MediaApiRouter, e as MediaBackendConfig, d as MediaBackendHooks, b as assetListDiscriminator, m as mediaBackendPlugin } from '../../../shared/stack.D6zyQnMo.cjs';
+export { C as CreateAssetInput, e as CreateFolderInput, M as MEDIA_QUERY_KEYS, g as MediaApiContext, j as MediaApiRouter, i as MediaBackendConfig, h as MediaBackendHooks, U as UpdateAssetInput, f as assetListDiscriminator, c as createAsset, a as createFolder, d as deleteAsset, b as deleteFolder, m as mediaBackendPlugin, u as updateAsset } from '../../../shared/stack.vVFh38aS.cjs';
 export { A as AssetListParams, d as AssetListResult, F as FolderListParams, g as getAssetById, b as getFolderById, c as getFolderByName, l as listAssets, a as listFolders } from '../../../shared/stack.jU2iG86n.cjs';
-import { DBAdapter } from '@btst/db';
-import { A as Asset, F as Folder, S as SerializedAsset, a as SerializedFolder } from '../../../shared/stack.BMlLOMED.cjs';
-import { D as DirectStorageAdapter } from '../../../shared/stack.DO6vOGQG.cjs';
-export { S as S3StorageAdapter, b as S3UploadToken, a as StorageAdapter, U as UploadOptions, c as VercelBlobHandlerCallbacks, V as VercelBlobStorageAdapter } from '../../../shared/stack.DO6vOGQG.cjs';
+import { A as Asset, S as SerializedAsset, F as Folder, a as SerializedFolder } from '../../../shared/stack.BMlLOMED.cjs';
+export { D as DirectStorageAdapter, a as S3StorageAdapter, b as S3UploadToken, S as StorageAdapter, U as UploadOptions, c as VercelBlobHandlerCallbacks, V as VercelBlobStorageAdapter } from '../../../shared/stack.lkebw2nj.cjs';
 import '@btst/stack/plugins/api';
 import 'better-call';
 import 'zod';
-
-/**
- * Input for creating a new asset record.
- */
-interface CreateAssetInput {
-    filename: string;
-    originalName: string;
-    mimeType: string;
-    size: number;
-    url: string;
-    folderId?: string;
-    alt?: string;
-    tenantId?: string;
-}
-/**
- * Input for updating an existing asset record.
- */
-interface UpdateAssetInput {
-    alt?: string;
-    folderId?: string | null;
-}
-/**
- * Input for creating a new folder.
- */
-interface CreateFolderInput {
-    name: string;
-    parentId?: string;
-    tenantId?: string;
-}
-/**
- * Create an asset record in the database.
- * Pure DB function — no authorization hooks, no HTTP context.
- *
- * @remarks **Security:** No authorization hooks (e.g. `onBeforeUpload`) are called.
- * The caller is responsible for any access-control checks before invoking this function.
- */
-declare function createAsset(adapter: DBAdapter, input: CreateAssetInput): Promise<Asset>;
-/**
- * Update an asset's `alt` text or `folderId`.
- * Pure DB function — no authorization hooks, no HTTP context.
- *
- * @remarks **Security:** No authorization hooks are called.
- */
-declare function updateAsset(adapter: DBAdapter, id: string, input: UpdateAssetInput): Promise<Asset | null>;
-/**
- * Delete an asset record from the database by its ID.
- * Does NOT delete the underlying file — the caller must do that via the storage adapter.
- * Pure DB function — no authorization hooks, no HTTP context.
- *
- * @remarks **Security:** No authorization hooks are called.
- */
-declare function deleteAsset(adapter: DBAdapter, id: string): Promise<void>;
-/**
- * Create a folder record in the database.
- * Pure DB function — no authorization hooks, no HTTP context.
- *
- * @remarks **Security:** No authorization hooks are called.
- */
-declare function createFolder(adapter: DBAdapter, input: CreateFolderInput): Promise<Folder>;
-/**
- * Delete a folder record from the database by its ID.
- * Child folders are cascade-deleted automatically. Throws if the folder or
- * any of its descendants contain assets (which have associated storage files
- * that must be deleted via the storage adapter first).
- * Pure DB function — no authorization hooks, no HTTP context.
- *
- * @remarks **Security:** No authorization hooks are called.
- */
-declare function deleteFolder(adapter: DBAdapter, id: string): Promise<void>;
+import '@btst/db';
 
 /**
  * Serialize an Asset for SSR/SSG use (convert dates to strings).
@@ -88,31 +18,4 @@ declare function serializeAsset(asset: Asset): SerializedAsset;
  */
 declare function serializeFolder(folder: Folder): SerializedFolder;
 
-interface LocalStorageAdapterOptions {
-    /**
-     * Absolute path to the directory where uploaded files are stored.
-     * @default "./public/uploads"
-     */
-    uploadDir?: string;
-    /**
-     * URL prefix used to build the public URL for uploaded files.
-     * @default "/uploads"
-     */
-    publicPath?: string;
-}
-/**
- * Create a local filesystem storage adapter.
- * Files are written to `uploadDir` and served at `publicPath`.
- * Suitable for development and self-hosted deployments.
- *
- * @example
- * ```ts
- * mediaBackendPlugin({
- *   storageAdapter: localAdapter({ uploadDir: "./public/uploads", publicPath: "/uploads" })
- * })
- * ```
- */
-declare function localAdapter(options?: LocalStorageAdapterOptions): DirectStorageAdapter;
-
-export { DirectStorageAdapter, createAsset, createFolder, deleteAsset, deleteFolder, localAdapter, serializeAsset, serializeFolder, updateAsset };
-export type { CreateAssetInput, CreateFolderInput, LocalStorageAdapterOptions, UpdateAssetInput };
+export { serializeAsset, serializeFolder };