@btst/stack 2.11.0 → 2.11.2

package/dist/{packages/stack/src/plugins → plugins}/media/api/adapters/local.mjs

@@ -22,7 +22,13 @@ function localAdapter(options = {}) {
       const encodedFilename = url.split("/").pop();
       if (!encodedFilename) return;
       const filename = decodeURIComponent(encodedFilename);
-      const filePath = path.join(uploadDir, filename);
+      const resolvedUploadDir = path.resolve(uploadDir);
+      const filePath = path.join(resolvedUploadDir, filename);
+      if (!filePath.startsWith(resolvedUploadDir + path.sep)) {
+        throw new Error(
+          `Refusing to delete file outside upload directory: ${filePath}`
+        );
+      }
       try {
         await fs.unlink(filePath);
       } catch (err) {

package/dist/plugins/media/api/adapters/s3.d.cts

@@ -1,4 +1,4 @@
-import { S as S3StorageAdapter } from '../../../../shared/stack.DO6vOGQG.cjs';
+import { a as S3StorageAdapter } from '../../../../shared/stack.lkebw2nj.cjs';
 
 interface S3StorageAdapterOptions {
     /**

package/dist/plugins/media/api/adapters/s3.d.mts

@@ -1,4 +1,4 @@
-import { S as S3StorageAdapter } from '../../../../shared/stack.DO6vOGQG.mjs';
+import { a as S3StorageAdapter } from '../../../../shared/stack.lkebw2nj.mjs';
 
 interface S3StorageAdapterOptions {
     /**

package/dist/plugins/media/api/adapters/s3.d.ts

@@ -1,4 +1,4 @@
-import { S as S3StorageAdapter } from '../../../../shared/stack.DO6vOGQG.js';
+import { a as S3StorageAdapter } from '../../../../shared/stack.lkebw2nj.js';
 
 interface S3StorageAdapterOptions {
     /**

package/dist/plugins/media/api/adapters/vercel-blob.d.cts

@@ -1,4 +1,4 @@
-import { V as VercelBlobStorageAdapter } from '../../../../shared/stack.DO6vOGQG.cjs';
+import { V as VercelBlobStorageAdapter } from '../../../../shared/stack.lkebw2nj.cjs';
 
 interface VercelBlobStorageAdapterOptions {
     /**

package/dist/plugins/media/api/adapters/vercel-blob.d.mts

@@ -1,4 +1,4 @@
-import { V as VercelBlobStorageAdapter } from '../../../../shared/stack.DO6vOGQG.mjs';
+import { V as VercelBlobStorageAdapter } from '../../../../shared/stack.lkebw2nj.mjs';
 
 interface VercelBlobStorageAdapterOptions {
     /**

package/dist/plugins/media/api/adapters/vercel-blob.d.ts

@@ -1,4 +1,4 @@
-import { V as VercelBlobStorageAdapter } from '../../../../shared/stack.DO6vOGQG.js';
+import { V as VercelBlobStorageAdapter } from '../../../../shared/stack.lkebw2nj.js';
 
 interface VercelBlobStorageAdapterOptions {
     /**

package/dist/plugins/media/api/index.cjs

@@ -5,7 +5,6 @@ const getters = require('../../../packages/stack/src/plugins/media/api/getters.c
 const mutations = require('../../../packages/stack/src/plugins/media/api/mutations.cjs');
 const serializers = require('../../../packages/stack/src/plugins/media/api/serializers.cjs');
 const queryKeyDefs = require('../../../packages/stack/src/plugins/media/api/query-key-defs.cjs');
-const local = require('../../../packages/stack/src/plugins/media/api/adapters/local.cjs');
 
 
 
@@ -24,4 +23,3 @@ exports.serializeAsset = serializers.serializeAsset;
 exports.serializeFolder = serializers.serializeFolder;
 exports.MEDIA_QUERY_KEYS = queryKeyDefs.MEDIA_QUERY_KEYS;
 exports.assetListDiscriminator = queryKeyDefs.assetListDiscriminator;
-exports.localAdapter = local.localAdapter;

package/dist/plugins/media/api/index.d.cts

@@ -1,81 +1,11 @@
-export { a as MEDIA_QUERY_KEYS, c as MediaApiContext, M as MediaApiRouter, e as MediaBackendConfig, d as MediaBackendHooks, b as assetListDiscriminator, m as mediaBackendPlugin } from '../../../shared/stack.D6zyQnMo.cjs';
+export { C as CreateAssetInput, e as CreateFolderInput, M as MEDIA_QUERY_KEYS, g as MediaApiContext, j as MediaApiRouter, i as MediaBackendConfig, h as MediaBackendHooks, U as UpdateAssetInput, f as assetListDiscriminator, c as createAsset, a as createFolder, d as deleteAsset, b as deleteFolder, m as mediaBackendPlugin, u as updateAsset } from '../../../shared/stack.vVFh38aS.cjs';
 export { A as AssetListParams, d as AssetListResult, F as FolderListParams, g as getAssetById, b as getFolderById, c as getFolderByName, l as listAssets, a as listFolders } from '../../../shared/stack.jU2iG86n.cjs';
-import { DBAdapter } from '@btst/db';
-import { A as Asset, F as Folder, S as SerializedAsset, a as SerializedFolder } from '../../../shared/stack.BMlLOMED.cjs';
-import { D as DirectStorageAdapter } from '../../../shared/stack.DO6vOGQG.cjs';
-export { S as S3StorageAdapter, b as S3UploadToken, a as StorageAdapter, U as UploadOptions, c as VercelBlobHandlerCallbacks, V as VercelBlobStorageAdapter } from '../../../shared/stack.DO6vOGQG.cjs';
+import { A as Asset, S as SerializedAsset, F as Folder, a as SerializedFolder } from '../../../shared/stack.BMlLOMED.cjs';
+export { D as DirectStorageAdapter, a as S3StorageAdapter, b as S3UploadToken, S as StorageAdapter, U as UploadOptions, c as VercelBlobHandlerCallbacks, V as VercelBlobStorageAdapter } from '../../../shared/stack.lkebw2nj.cjs';
 import '@btst/stack/plugins/api';
 import 'better-call';
 import 'zod';
-
-/**
- * Input for creating a new asset record.
- */
-interface CreateAssetInput {
-    filename: string;
-    originalName: string;
-    mimeType: string;
-    size: number;
-    url: string;
-    folderId?: string;
-    alt?: string;
-    tenantId?: string;
-}
-/**
- * Input for updating an existing asset record.
- */
-interface UpdateAssetInput {
-    alt?: string;
-    folderId?: string | null;
-}
-/**
- * Input for creating a new folder.
- */
-interface CreateFolderInput {
-    name: string;
-    parentId?: string;
-    tenantId?: string;
-}
-/**
- * Create an asset record in the database.
- * Pure DB function — no authorization hooks, no HTTP context.
- *
- * @remarks **Security:** No authorization hooks (e.g. `onBeforeUpload`) are called.
- * The caller is responsible for any access-control checks before invoking this function.
- */
-declare function createAsset(adapter: DBAdapter, input: CreateAssetInput): Promise<Asset>;
-/**
- * Update an asset's `alt` text or `folderId`.
- * Pure DB function — no authorization hooks, no HTTP context.
- *
- * @remarks **Security:** No authorization hooks are called.
- */
-declare function updateAsset(adapter: DBAdapter, id: string, input: UpdateAssetInput): Promise<Asset | null>;
-/**
- * Delete an asset record from the database by its ID.
- * Does NOT delete the underlying file — the caller must do that via the storage adapter.
- * Pure DB function — no authorization hooks, no HTTP context.
- *
- * @remarks **Security:** No authorization hooks are called.
- */
-declare function deleteAsset(adapter: DBAdapter, id: string): Promise<void>;
-/**
- * Create a folder record in the database.
- * Pure DB function — no authorization hooks, no HTTP context.
- *
- * @remarks **Security:** No authorization hooks are called.
- */
-declare function createFolder(adapter: DBAdapter, input: CreateFolderInput): Promise<Folder>;
-/**
- * Delete a folder record from the database by its ID.
- * Child folders are cascade-deleted automatically. Throws if the folder or
- * any of its descendants contain assets (which have associated storage files
- * that must be deleted via the storage adapter first).
- * Pure DB function — no authorization hooks, no HTTP context.
- *
- * @remarks **Security:** No authorization hooks are called.
- */
-declare function deleteFolder(adapter: DBAdapter, id: string): Promise<void>;
+import '@btst/db';
 
 /**
  * Serialize an Asset for SSR/SSG use (convert dates to strings).
@@ -88,31 +18,4 @@ declare function serializeAsset(asset: Asset): SerializedAsset;
  */
 declare function serializeFolder(folder: Folder): SerializedFolder;
 
-interface LocalStorageAdapterOptions {
-    /**
-     * Absolute path to the directory where uploaded files are stored.
-     * @default "./public/uploads"
-     */
-    uploadDir?: string;
-    /**
-     * URL prefix used to build the public URL for uploaded files.
-     * @default "/uploads"
-     */
-    publicPath?: string;
-}
-/**
- * Create a local filesystem storage adapter.
- * Files are written to `uploadDir` and served at `publicPath`.
- * Suitable for development and self-hosted deployments.
- *
- * @example
- * ```ts
- * mediaBackendPlugin({
- *   storageAdapter: localAdapter({ uploadDir: "./public/uploads", publicPath: "/uploads" })
- * })
- * ```
- */
-declare function localAdapter(options?: LocalStorageAdapterOptions): DirectStorageAdapter;
-
-export { DirectStorageAdapter, createAsset, createFolder, deleteAsset, deleteFolder, localAdapter, serializeAsset, serializeFolder, updateAsset };
-export type { CreateAssetInput, CreateFolderInput, LocalStorageAdapterOptions, UpdateAssetInput };
+export { serializeAsset, serializeFolder };

package/dist/plugins/media/api/index.d.mts

@@ -1,81 +1,11 @@
-export { a as MEDIA_QUERY_KEYS, c as MediaApiContext, M as MediaApiRouter, e as MediaBackendConfig, d as MediaBackendHooks, b as assetListDiscriminator, m as mediaBackendPlugin } from '../../../shared/stack.C_MUwwgR.mjs';
+export { C as CreateAssetInput, e as CreateFolderInput, M as MEDIA_QUERY_KEYS, g as MediaApiContext, j as MediaApiRouter, i as MediaBackendConfig, h as MediaBackendHooks, U as UpdateAssetInput, f as assetListDiscriminator, c as createAsset, a as createFolder, d as deleteAsset, b as deleteFolder, m as mediaBackendPlugin, u as updateAsset } from '../../../shared/stack.DpZoZd98.mjs';
 export { A as AssetListParams, d as AssetListResult, F as FolderListParams, g as getAssetById, b as getFolderById, c as getFolderByName, l as listAssets, a as listFolders } from '../../../shared/stack.C7u9lq9T.mjs';
-import { DBAdapter } from '@btst/db';
-import { A as Asset, F as Folder, S as SerializedAsset, a as SerializedFolder } from '../../../shared/stack.BMlLOMED.mjs';
-import { D as DirectStorageAdapter } from '../../../shared/stack.DO6vOGQG.mjs';
-export { S as S3StorageAdapter, b as S3UploadToken, a as StorageAdapter, U as UploadOptions, c as VercelBlobHandlerCallbacks, V as VercelBlobStorageAdapter } from '../../../shared/stack.DO6vOGQG.mjs';
+import { A as Asset, S as SerializedAsset, F as Folder, a as SerializedFolder } from '../../../shared/stack.BMlLOMED.mjs';
+export { D as DirectStorageAdapter, a as S3StorageAdapter, b as S3UploadToken, S as StorageAdapter, U as UploadOptions, c as VercelBlobHandlerCallbacks, V as VercelBlobStorageAdapter } from '../../../shared/stack.lkebw2nj.mjs';
 import '@btst/stack/plugins/api';
 import 'better-call';
 import 'zod';
-
-/**
- * Input for creating a new asset record.
- */
-interface CreateAssetInput {
-    filename: string;
-    originalName: string;
-    mimeType: string;
-    size: number;
-    url: string;
-    folderId?: string;
-    alt?: string;
-    tenantId?: string;
-}
-/**
- * Input for updating an existing asset record.
- */
-interface UpdateAssetInput {
-    alt?: string;
-    folderId?: string | null;
-}
-/**
- * Input for creating a new folder.
- */
-interface CreateFolderInput {
-    name: string;
-    parentId?: string;
-    tenantId?: string;
-}
-/**
- * Create an asset record in the database.
- * Pure DB function — no authorization hooks, no HTTP context.
- *
- * @remarks **Security:** No authorization hooks (e.g. `onBeforeUpload`) are called.
- * The caller is responsible for any access-control checks before invoking this function.
- */
-declare function createAsset(adapter: DBAdapter, input: CreateAssetInput): Promise<Asset>;
-/**
- * Update an asset's `alt` text or `folderId`.
- * Pure DB function — no authorization hooks, no HTTP context.
- *
- * @remarks **Security:** No authorization hooks are called.
- */
-declare function updateAsset(adapter: DBAdapter, id: string, input: UpdateAssetInput): Promise<Asset | null>;
-/**
- * Delete an asset record from the database by its ID.
- * Does NOT delete the underlying file — the caller must do that via the storage adapter.
- * Pure DB function — no authorization hooks, no HTTP context.
- *
- * @remarks **Security:** No authorization hooks are called.
- */
-declare function deleteAsset(adapter: DBAdapter, id: string): Promise<void>;
-/**
- * Create a folder record in the database.
- * Pure DB function — no authorization hooks, no HTTP context.
- *
- * @remarks **Security:** No authorization hooks are called.
- */
-declare function createFolder(adapter: DBAdapter, input: CreateFolderInput): Promise<Folder>;
-/**
- * Delete a folder record from the database by its ID.
- * Child folders are cascade-deleted automatically. Throws if the folder or
- * any of its descendants contain assets (which have associated storage files
- * that must be deleted via the storage adapter first).
- * Pure DB function — no authorization hooks, no HTTP context.
- *
- * @remarks **Security:** No authorization hooks are called.
- */
-declare function deleteFolder(adapter: DBAdapter, id: string): Promise<void>;
+import '@btst/db';
 
 /**
  * Serialize an Asset for SSR/SSG use (convert dates to strings).
@@ -88,31 +18,4 @@ declare function serializeAsset(asset: Asset): SerializedAsset;
  */
 declare function serializeFolder(folder: Folder): SerializedFolder;
 
-interface LocalStorageAdapterOptions {
-    /**
-     * Absolute path to the directory where uploaded files are stored.
-     * @default "./public/uploads"
-     */
-    uploadDir?: string;
-    /**
-     * URL prefix used to build the public URL for uploaded files.
-     * @default "/uploads"
-     */
-    publicPath?: string;
-}
-/**
- * Create a local filesystem storage adapter.
- * Files are written to `uploadDir` and served at `publicPath`.
- * Suitable for development and self-hosted deployments.
- *
- * @example
- * ```ts
- * mediaBackendPlugin({
- *   storageAdapter: localAdapter({ uploadDir: "./public/uploads", publicPath: "/uploads" })
- * })
- * ```
- */
-declare function localAdapter(options?: LocalStorageAdapterOptions): DirectStorageAdapter;
-
-export { DirectStorageAdapter, createAsset, createFolder, deleteAsset, deleteFolder, localAdapter, serializeAsset, serializeFolder, updateAsset };
-export type { CreateAssetInput, CreateFolderInput, LocalStorageAdapterOptions, UpdateAssetInput };
+export { serializeAsset, serializeFolder };

package/dist/plugins/media/api/index.d.ts

@@ -1,81 +1,11 @@
-export { a as MEDIA_QUERY_KEYS, c as MediaApiContext, M as MediaApiRouter, e as MediaBackendConfig, d as MediaBackendHooks, b as assetListDiscriminator, m as mediaBackendPlugin } from '../../../shared/stack.Bci0-plK.js';
+export { C as CreateAssetInput, e as CreateFolderInput, M as MEDIA_QUERY_KEYS, g as MediaApiContext, j as MediaApiRouter, i as MediaBackendConfig, h as MediaBackendHooks, U as UpdateAssetInput, f as assetListDiscriminator, c as createAsset, a as createFolder, d as deleteAsset, b as deleteFolder, m as mediaBackendPlugin, u as updateAsset } from '../../../shared/stack.C5ucdatf.js';
 export { A as AssetListParams, d as AssetListResult, F as FolderListParams, g as getAssetById, b as getFolderById, c as getFolderByName, l as listAssets, a as listFolders } from '../../../shared/stack.DD-ZORI7.js';
-import { DBAdapter } from '@btst/db';
-import { A as Asset, F as Folder, S as SerializedAsset, a as SerializedFolder } from '../../../shared/stack.BMlLOMED.js';
-import { D as DirectStorageAdapter } from '../../../shared/stack.DO6vOGQG.js';
-export { S as S3StorageAdapter, b as S3UploadToken, a as StorageAdapter, U as UploadOptions, c as VercelBlobHandlerCallbacks, V as VercelBlobStorageAdapter } from '../../../shared/stack.DO6vOGQG.js';
+import { A as Asset, S as SerializedAsset, F as Folder, a as SerializedFolder } from '../../../shared/stack.BMlLOMED.js';
+export { D as DirectStorageAdapter, a as S3StorageAdapter, b as S3UploadToken, S as StorageAdapter, U as UploadOptions, c as VercelBlobHandlerCallbacks, V as VercelBlobStorageAdapter } from '../../../shared/stack.lkebw2nj.js';
 import '@btst/stack/plugins/api';
 import 'better-call';
 import 'zod';
-
-/**
- * Input for creating a new asset record.
- */
-interface CreateAssetInput {
-    filename: string;
-    originalName: string;
-    mimeType: string;
-    size: number;
-    url: string;
-    folderId?: string;
-    alt?: string;
-    tenantId?: string;
-}
-/**
- * Input for updating an existing asset record.
- */
-interface UpdateAssetInput {
-    alt?: string;
-    folderId?: string | null;
-}
-/**
- * Input for creating a new folder.
- */
-interface CreateFolderInput {
-    name: string;
-    parentId?: string;
-    tenantId?: string;
-}
-/**
- * Create an asset record in the database.
- * Pure DB function — no authorization hooks, no HTTP context.
- *
- * @remarks **Security:** No authorization hooks (e.g. `onBeforeUpload`) are called.
- * The caller is responsible for any access-control checks before invoking this function.
- */
-declare function createAsset(adapter: DBAdapter, input: CreateAssetInput): Promise<Asset>;
-/**
- * Update an asset's `alt` text or `folderId`.
- * Pure DB function — no authorization hooks, no HTTP context.
- *
- * @remarks **Security:** No authorization hooks are called.
- */
-declare function updateAsset(adapter: DBAdapter, id: string, input: UpdateAssetInput): Promise<Asset | null>;
-/**
- * Delete an asset record from the database by its ID.
- * Does NOT delete the underlying file — the caller must do that via the storage adapter.
- * Pure DB function — no authorization hooks, no HTTP context.
- *
- * @remarks **Security:** No authorization hooks are called.
- */
-declare function deleteAsset(adapter: DBAdapter, id: string): Promise<void>;
-/**
- * Create a folder record in the database.
- * Pure DB function — no authorization hooks, no HTTP context.
- *
- * @remarks **Security:** No authorization hooks are called.
- */
-declare function createFolder(adapter: DBAdapter, input: CreateFolderInput): Promise<Folder>;
-/**
- * Delete a folder record from the database by its ID.
- * Child folders are cascade-deleted automatically. Throws if the folder or
- * any of its descendants contain assets (which have associated storage files
- * that must be deleted via the storage adapter first).
- * Pure DB function — no authorization hooks, no HTTP context.
- *
- * @remarks **Security:** No authorization hooks are called.
- */
-declare function deleteFolder(adapter: DBAdapter, id: string): Promise<void>;
+import '@btst/db';
 
 /**
  * Serialize an Asset for SSR/SSG use (convert dates to strings).
@@ -88,31 +18,4 @@ declare function serializeAsset(asset: Asset): SerializedAsset;
  */
 declare function serializeFolder(folder: Folder): SerializedFolder;
 
-interface LocalStorageAdapterOptions {
-    /**
-     * Absolute path to the directory where uploaded files are stored.
-     * @default "./public/uploads"
-     */
-    uploadDir?: string;
-    /**
-     * URL prefix used to build the public URL for uploaded files.
-     * @default "/uploads"
-     */
-    publicPath?: string;
-}
-/**
- * Create a local filesystem storage adapter.
- * Files are written to `uploadDir` and served at `publicPath`.
- * Suitable for development and self-hosted deployments.
- *
- * @example
- * ```ts
- * mediaBackendPlugin({
- *   storageAdapter: localAdapter({ uploadDir: "./public/uploads", publicPath: "/uploads" })
- * })
- * ```
- */
-declare function localAdapter(options?: LocalStorageAdapterOptions): DirectStorageAdapter;
-
-export { DirectStorageAdapter, createAsset, createFolder, deleteAsset, deleteFolder, localAdapter, serializeAsset, serializeFolder, updateAsset };
-export type { CreateAssetInput, CreateFolderInput, LocalStorageAdapterOptions, UpdateAssetInput };
+export { serializeAsset, serializeFolder };

package/dist/plugins/media/api/index.mjs

@@ -3,4 +3,3 @@ export { getAssetById, getFolderById, getFolderByName, listAssets, listFolders }
 export { createAsset, createFolder, deleteAsset, deleteFolder, updateAsset } from '../../../packages/stack/src/plugins/media/api/mutations.mjs';
 export { serializeAsset, serializeFolder } from '../../../packages/stack/src/plugins/media/api/serializers.mjs';
 export { MEDIA_QUERY_KEYS, assetListDiscriminator } from '../../../packages/stack/src/plugins/media/api/query-key-defs.mjs';
-export { localAdapter } from '../../../packages/stack/src/plugins/media/api/adapters/local.mjs';

package/dist/plugins/media/query-keys.d.cts

@@ -1,10 +1,10 @@
 import * as _tanstack_react_query from '@tanstack/react-query';
-import { M as MediaApiRouter, A as AssetListDiscriminator } from '../../shared/stack.D6zyQnMo.cjs';
+import { j as MediaApiRouter, A as AssetListDiscriminator } from '../../shared/stack.vVFh38aS.cjs';
 import { createApiClient } from '@btst/stack/plugins/client';
 import { S as SerializedAsset, a as SerializedFolder } from '../../shared/stack.BMlLOMED.cjs';
 import { A as AssetListParams } from '../../shared/stack.jU2iG86n.cjs';
 import '@btst/stack/plugins/api';
-import '../../shared/stack.DO6vOGQG.cjs';
+import '../../shared/stack.lkebw2nj.cjs';
 import 'better-call';
 import 'zod';
 import '@btst/db';

package/dist/plugins/media/query-keys.d.mts

@@ -1,10 +1,10 @@
 import * as _tanstack_react_query from '@tanstack/react-query';
-import { M as MediaApiRouter, A as AssetListDiscriminator } from '../../shared/stack.C_MUwwgR.mjs';
+import { j as MediaApiRouter, A as AssetListDiscriminator } from '../../shared/stack.DpZoZd98.mjs';
 import { createApiClient } from '@btst/stack/plugins/client';
 import { S as SerializedAsset, a as SerializedFolder } from '../../shared/stack.BMlLOMED.mjs';
 import { A as AssetListParams } from '../../shared/stack.C7u9lq9T.mjs';
 import '@btst/stack/plugins/api';
-import '../../shared/stack.DO6vOGQG.mjs';
+import '../../shared/stack.lkebw2nj.mjs';
 import 'better-call';
 import 'zod';
 import '@btst/db';

package/dist/plugins/media/query-keys.d.ts

@@ -1,10 +1,10 @@
 import * as _tanstack_react_query from '@tanstack/react-query';
-import { M as MediaApiRouter, A as AssetListDiscriminator } from '../../shared/stack.Bci0-plK.js';
+import { j as MediaApiRouter, A as AssetListDiscriminator } from '../../shared/stack.C5ucdatf.js';
 import { createApiClient } from '@btst/stack/plugins/client';
 import { S as SerializedAsset, a as SerializedFolder } from '../../shared/stack.BMlLOMED.js';
 import { A as AssetListParams } from '../../shared/stack.DD-ZORI7.js';
 import '@btst/stack/plugins/api';
-import '../../shared/stack.DO6vOGQG.js';
+import '../../shared/stack.lkebw2nj.js';
 import 'better-call';
 import 'zod';
 import '@btst/db';

package/dist/shared/{stack.Bci0-plK.d.ts → stack.C5ucdatf.d.ts}

@@ -1,9 +1,10 @@
 import * as _btst_stack_plugins_api from '@btst/stack/plugins/api';
-import { a as StorageAdapter, b as S3UploadToken } from './stack.DO6vOGQG.js';
+import { S as StorageAdapter, b as S3UploadToken } from './stack.lkebw2nj.js';
 import { d as AssetListResult, l as listAssets, a as listFolders, A as AssetListParams } from './stack.DD-ZORI7.js';
 import * as better_call from 'better-call';
 import { z } from 'zod';
 import { A as Asset, F as Folder } from './stack.BMlLOMED.js';
+import { DBAdapter } from '@btst/db';
 
 declare const AssetListQuerySchema: z.ZodObject<{
     folderId: z.ZodOptional<z.ZodString>;
@@ -21,6 +22,75 @@ declare const createFolderSchema: z.ZodObject<{
     parentId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 
+/**
+ * Input for creating a new asset record.
+ */
+interface CreateAssetInput {
+    filename: string;
+    originalName: string;
+    mimeType: string;
+    size: number;
+    url: string;
+    folderId?: string;
+    alt?: string;
+    tenantId?: string;
+}
+/**
+ * Input for updating an existing asset record.
+ */
+interface UpdateAssetInput {
+    alt?: string;
+    folderId?: string | null;
+}
+/**
+ * Input for creating a new folder.
+ */
+interface CreateFolderInput {
+    name: string;
+    parentId?: string;
+    tenantId?: string;
+}
+/**
+ * Create an asset record in the database.
+ * Pure DB function — no authorization hooks, no HTTP context.
+ *
+ * @remarks **Security:** No authorization hooks (e.g. `onBeforeUpload`) are called.
+ * The caller is responsible for any access-control checks before invoking this function.
+ */
+declare function createAsset(adapter: DBAdapter, input: CreateAssetInput): Promise<Asset>;
+/**
+ * Update an asset's `alt` text or `folderId`.
+ * Pure DB function — no authorization hooks, no HTTP context.
+ *
+ * @remarks **Security:** No authorization hooks are called.
+ */
+declare function updateAsset(adapter: DBAdapter, id: string, input: UpdateAssetInput): Promise<Asset | null>;
+/**
+ * Delete an asset record from the database by its ID.
+ * Does NOT delete the underlying file — the caller must do that via the storage adapter.
+ * Pure DB function — no authorization hooks, no HTTP context.
+ *
+ * @remarks **Security:** No authorization hooks are called.
+ */
+declare function deleteAsset(adapter: DBAdapter, id: string): Promise<void>;
+/**
+ * Create a folder record in the database.
+ * Pure DB function — no authorization hooks, no HTTP context.
+ *
+ * @remarks **Security:** No authorization hooks are called.
+ */
+declare function createFolder(adapter: DBAdapter, input: CreateFolderInput): Promise<Folder>;
+/**
+ * Delete a folder record from the database by its ID.
+ * Child folders are cascade-deleted automatically. Throws if the folder or
+ * any of its descendants contain assets (which have associated storage files
+ * that must be deleted via the storage adapter first).
+ * Pure DB function — no authorization hooks, no HTTP context.
+ *
+ * @remarks **Security:** No authorization hooks are called.
+ */
+declare function deleteFolder(adapter: DBAdapter, id: string): Promise<void>;
+
 /**
  * Context passed to media API hooks.
  */
@@ -270,9 +340,12 @@ declare const mediaBackendPlugin: (config: MediaBackendConfig) => _btst_stack_pl
 }, {
     listAssets: (params?: Parameters<typeof listAssets>[1]) => Promise<AssetListResult>;
     getAssetById: (id: string) => Promise<Asset | null>;
+    createAsset: (input: Parameters<typeof createAsset>[1]) => Promise<Asset>;
+    updateAsset: (id: string, input: Parameters<typeof updateAsset>[2]) => Promise<Asset | null>;
     listFolders: (params?: Parameters<typeof listFolders>[1]) => Promise<Folder[]>;
     getFolderById: (id: string) => Promise<Folder | null>;
     getFolderByName: (name: string, parentId?: string | null, tenantId?: string) => Promise<Folder | null>;
+    createFolder: (input: Parameters<typeof createFolder>[1]) => Promise<Folder>;
 }>;
 type MediaApiRouter = ReturnType<ReturnType<typeof mediaBackendPlugin>["routes"]>;
 
@@ -300,5 +373,5 @@ declare const MEDIA_QUERY_KEYS: {
     foldersList: (parentId?: string | null) => readonly ["media", "folders", "list", string];
 };
 
-export { MEDIA_QUERY_KEYS as a, assetListDiscriminator as b, mediaBackendPlugin as m };
-export type { AssetListDiscriminator as A, MediaApiRouter as M, MediaApiContext as c, MediaBackendHooks as d, MediaBackendConfig as e };
+export { MEDIA_QUERY_KEYS as M, createFolder as a, deleteFolder as b, createAsset as c, deleteAsset as d, assetListDiscriminator as f, mediaBackendPlugin as m, updateAsset as u };
+export type { AssetListDiscriminator as A, CreateAssetInput as C, UpdateAssetInput as U, CreateFolderInput as e, MediaApiContext as g, MediaBackendHooks as h, MediaBackendConfig as i, MediaApiRouter as j };