@btst/stack 2.12.0 → 2.12.2

package/dist/shared/{stack.B8QD11QU.d.mts → stack.DFtpFS00.d.mts}

@@ -158,6 +158,16 @@ interface CMSBackendConfig {
     contentTypes: ContentTypeConfig[];
     /** Optional hooks for customizing behavior */
     hooks?: CMSBackendHooks;
+    /**
+     * Maximum number of items that can be requested in a single page.
+     * Applied to all list endpoints (`/content/:typeSlug`, by-relation, and inverse-relation).
+     *
+     * Raise this when your content types have many items and you need to fetch
+     * large pages (e.g. for SSG, CSV export, or programmatic access).
+     *
+     * @default 1000
+     */
+    maxPageSize?: number;
 }
 
 export type { ContentTypeConfig as C, InverseRelation as I, PaginatedContentItems as P, SerializedContentType as S, SerializedContentItemWithType as a, ContentType as b, ContentItem as c, SerializedContentItem as d, ContentItemWithType as e, CMSBackendConfig as f };

package/dist/shared/{stack.B8QD11QU.d.cts → stack.DFtpFS00.d.ts}

@@ -158,6 +158,16 @@ interface CMSBackendConfig {
     contentTypes: ContentTypeConfig[];
     /** Optional hooks for customizing behavior */
     hooks?: CMSBackendHooks;
+    /**
+     * Maximum number of items that can be requested in a single page.
+     * Applied to all list endpoints (`/content/:typeSlug`, by-relation, and inverse-relation).
+     *
+     * Raise this when your content types have many items and you need to fetch
+     * large pages (e.g. for SSG, CSV export, or programmatic access).
+     *
+     * @default 1000
+     */
+    maxPageSize?: number;
 }
 
 export type { ContentTypeConfig as C, InverseRelation as I, PaginatedContentItems as P, SerializedContentType as S, SerializedContentItemWithType as a, ContentType as b, ContentItem as c, SerializedContentItem as d, ContentItemWithType as e, CMSBackendConfig as f };

package/dist/shared/{stack.BvuqACtA.d.cts → stack.DNLuzDb3.d.cts}

@@ -1,7 +1,7 @@
 import * as _tanstack_react_query from '@tanstack/react-query';
 import { S as SerializedPost, a as SerializedTag } from './stack.Dsatjh0B.cjs';
 import { z } from 'zod';
-import { c as createPostSchema, u as updatePostSchema } from './stack.DuQOcInS.cjs';
+import { c as createPostSchema, u as updatePostSchema } from './stack.CuhcFsAx.cjs';
 
 /**
  * Options for the usePosts hook
@@ -136,14 +136,14 @@ declare function useCreatePost(): _tanstack_react_query.UseMutationResult<Serial
         name: string;
         slug: string;
     })[];
+    published: boolean;
     title: string;
     content: string;
     excerpt: string;
-    published: boolean;
     slug?: string | undefined;
+    publishedAt?: Date | undefined;
     createdAt?: Date | undefined;
     updatedAt?: Date | undefined;
-    publishedAt?: Date | undefined;
     image?: string | undefined;
 }, unknown>;
 /** Update an existing post by id */

package/dist/shared/{stack.Cs8R5HxD.d.mts → stack.Dfc44JiE.d.mts}

@@ -1,7 +1,7 @@
 import * as _tanstack_react_query from '@tanstack/react-query';
 import { S as SerializedPost, a as SerializedTag } from './stack.Dsatjh0B.mjs';
 import { z } from 'zod';
-import { c as createPostSchema, u as updatePostSchema } from './stack.DuQOcInS.mjs';
+import { c as createPostSchema, u as updatePostSchema } from './stack.CuhcFsAx.mjs';
 
 /**
  * Options for the usePosts hook
@@ -136,14 +136,14 @@ declare function useCreatePost(): _tanstack_react_query.UseMutationResult<Serial
         name: string;
         slug: string;
     })[];
+    published: boolean;
     title: string;
     content: string;
     excerpt: string;
-    published: boolean;
     slug?: string | undefined;
+    publishedAt?: Date | undefined;
     createdAt?: Date | undefined;
     updatedAt?: Date | undefined;
-    publishedAt?: Date | undefined;
     image?: string | undefined;
 }, unknown>;
 /** Update an existing post by id */

package/dist/shared/{stack.ueI-K4xy.d.mts → stack.DiodAFAa.d.mts}

@@ -6,7 +6,7 @@ import * as _btst_stack_plugins_api from '@btst/stack/plugins/api';
 import { DBAdapter } from '@btst/db';
 import * as better_call from 'better-call';
 import { z } from 'zod';
-import { c as createPostSchema, u as updatePostSchema } from './stack.DuQOcInS.mjs';
+import { c as createPostSchema, u as updatePostSchema } from './stack.CuhcFsAx.mjs';
 
 /**
  * Parameters for filtering/paginating posts.
@@ -325,11 +325,11 @@ declare const blogBackendPlugin: (hooks?: BlogBackendHooks) => _btst_stack_plugi
                 slug: string;
             })[] | undefined;
             slug?: string | undefined;
+            published?: boolean | undefined;
+            publishedAt?: unknown;
             createdAt?: unknown;
             updatedAt?: unknown;
-            publishedAt?: unknown;
             image?: string | undefined;
-            published?: boolean | undefined;
         }, {
             title: string;
             content: string;
@@ -342,11 +342,11 @@ declare const blogBackendPlugin: (hooks?: BlogBackendHooks) => _btst_stack_plugi
                 slug: string;
             })[] | undefined;
             slug?: string | undefined;
+            published?: boolean | undefined;
+            publishedAt?: unknown;
             createdAt?: unknown;
             updatedAt?: unknown;
-            publishedAt?: unknown;
             image?: string | undefined;
-            published?: boolean | undefined;
         }>;
     }, Post>;
     readonly updatePost: better_call.StrictEndpoint<"/posts/:id", {} & {

package/dist/shared/{stack.CxWEN62M.d.ts → stack.ufcExQIR.d.ts}

@@ -6,7 +6,7 @@ import * as _btst_stack_plugins_api from '@btst/stack/plugins/api';
 import { DBAdapter } from '@btst/db';
 import * as better_call from 'better-call';
 import { z } from 'zod';
-import { c as createPostSchema, u as updatePostSchema } from './stack.DuQOcInS.js';
+import { c as createPostSchema, u as updatePostSchema } from './stack.CuhcFsAx.js';
 
 /**
  * Parameters for filtering/paginating posts.
@@ -325,11 +325,11 @@ declare const blogBackendPlugin: (hooks?: BlogBackendHooks) => _btst_stack_plugi
                 slug: string;
             })[] | undefined;
             slug?: string | undefined;
+            published?: boolean | undefined;
+            publishedAt?: unknown;
             createdAt?: unknown;
             updatedAt?: unknown;
-            publishedAt?: unknown;
             image?: string | undefined;
-            published?: boolean | undefined;
         }, {
             title: string;
             content: string;
@@ -342,11 +342,11 @@ declare const blogBackendPlugin: (hooks?: BlogBackendHooks) => _btst_stack_plugi
                 slug: string;
             })[] | undefined;
             slug?: string | undefined;
+            published?: boolean | undefined;
+            publishedAt?: unknown;
             createdAt?: unknown;
             updatedAt?: unknown;
-            publishedAt?: unknown;
             image?: string | undefined;
-            published?: boolean | undefined;
         }>;
     }, Post>;
     readonly updatePost: better_call.StrictEndpoint<"/posts/:id", {} & {

package/dist/shared/{stack.DpZoZd98.d.mts → stack.zpwVhSJb.d.mts}

@@ -188,6 +188,15 @@ interface MediaBackendConfig {
      * Provide this option only when you need to override the automatic default (e.g. to allow
      * assets from a CDN in front of your storage that uses a different domain). When using
      * `localAdapter`, setting `allowedUrlPrefixes` explicitly opts `POST /media/assets` back in.
+     *
+     * @remarks
+     * Protocol-only prefixes such as `"https://"` (and especially `"http://"`) disable
+     * origin-based restrictions entirely — any URL with that scheme will be accepted.
+     * Only use them when you intentionally want to allow assets from arbitrary hosts:
+     * `"http://"` URLs will be blocked as mixed content on HTTPS pages, and if your
+     * `onAfterUpload` hook fetches asset URLs server-side, accepting arbitrary hosts
+     * can expose an SSRF surface. Prefer full origin prefixes like
+     * `"https://cdn.example.com"` whenever possible.
      */
     allowedUrlPrefixes?: string[];
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@btst/stack",
-  "version": "2.12.0",
+  "version": "2.12.2",
   "description": "A composable, plugin-based library for building full-stack applications.",
   "repository": {
     "type": "git",
@@ -755,7 +755,7 @@
     }
   },
   "dependencies": {
-    "@btst/db": "2.2.1",
+    "@btst/db": "2.2.2",
     "@lukemorales/query-key-factory": "^1.3.4",
     "@milkdown/crepe": "^7.17.1",
     "@milkdown/kit": "^7.17.1",
@@ -814,7 +814,7 @@
     "@ai-sdk/react": "^2.0.94",
     "@aws-sdk/client-s3": "^3.1011.0",
     "@aws-sdk/s3-request-presigner": "^3.1011.0",
-    "@btst/adapter-memory": "2.2.1",
+    "@btst/adapter-memory": "2.2.2",
     "@btst/yar": "1.2.0",
     "@types/react": "^19.0.0",
     "@types/slug": "^5.0.9",
@@ -823,8 +823,8 @@
     "ai": "^5.0.94",
     "better-call": "catalog:",
     "knip": "^5.61.2",
-    "react": "^19.1.1",
-    "react-dom": "^19.1.1",
+    "react": "^19.2.7",
+    "react-dom": "^19.2.7",
     "react-error-boundary": "^4.1.2",
     "rollup-plugin-preserve-directives": "0.4.0",
     "rollup-plugin-visualizer": "^5.12.0",

package/src/plugins/cms/__tests__/schema-roundtrip.test.ts

@@ -804,3 +804,206 @@ describe("Zod to JSON Schema roundtrip", () => {
 		});
 	});
 });
+
+/**
+ * These tests confirm and protect against a bug where `useFieldArray` in
+ * AutoFormArray corrupts primitive string values in arrays like
+ * `structuredContraindications: z.array(z.string()).default([])`.
+ *
+ * When react-hook-form's `useFieldArray` processes a primitive array
+ * (e.g. `["pregnancy", "active malignancy"]`), it wraps each element as a
+ * tracking object `{ id: "rhf_generated_id" }`, discarding the original
+ * string value. When `form.watch()` fires, it returns these objects. The
+ * `handleValuesChange` callback then calls `setFormData(values)` which stores
+ * the corrupted objects. On form submit, `zodResolver` validates the corrupted
+ * values against `z.array(z.string())` and FAILS — causing the Save button
+ * to do nothing (no error shown, no API request made).
+ *
+ * The fix: AutoFormArray must NOT use `useFieldArray` for primitive (non-object)
+ * arrays. Instead it uses `form.watch` + `form.setValue` directly so primitive
+ * values are always preserved in the form state.
+ */
+describe("Primitive string array — useFieldArray corruption bug", () => {
+	/**
+	 * Simulates what zodToFormSchema + formSchemaToZod does:
+	 * Zod schema → JSON Schema (stored in DB) → reconstructed Zod schema.
+	 */
+	function roundtripSchema(schema: z.ZodType): z.ZodType {
+		const jsonSchema = z.toJSONSchema(schema, { unrepresentable: "any" });
+		return z.fromJSONSchema(jsonSchema as z.core.JSONSchema.JSONSchema);
+	}
+
+	it("z.array(z.string()) survives JSON Schema roundtrip and accepts string values", () => {
+		const schema = z.object({
+			structuredContraindications: z.array(z.string()).default([]),
+		});
+
+		const reconstructed = roundtripSchema(schema);
+
+		// Actual compound data — should PASS
+		expect(
+			reconstructed.safeParse({
+				structuredContraindications: [
+					"pregnancy",
+					"active malignancy",
+					"active cancer",
+					"trying to conceive",
+				],
+			}).success,
+		).toBe(true);
+
+		// Empty array — should PASS (default)
+		expect(
+			reconstructed.safeParse({ structuredContraindications: [] }).success,
+		).toBe(true);
+	});
+
+	it("useFieldArray-corrupted values (objects) fail z.array(z.string()) validation — this is the root cause of the silent save failure", () => {
+		const schema = z.object({
+			structuredContraindications: z.array(z.string()).default([]),
+		});
+
+		const reconstructed = roundtripSchema(schema);
+
+		// Simulates what react-hook-form's useFieldArray returns when used with
+		// primitive string arrays: each string is replaced by a tracking object
+		// { id: "rhf_generated_id" } and the original value is lost.
+		const corruptedByUseFieldArray = {
+			structuredContraindications: [
+				{ id: "rhf_internal_id_1" },
+				{ id: "rhf_internal_id_2" },
+				{ id: "rhf_internal_id_3" },
+				{ id: "rhf_internal_id_4" },
+			],
+		};
+
+		// This is the actual validation error that occurs when Save is clicked:
+		// zodResolver validates the corrupted objects against z.array(z.string())
+		// and FAILS, so onSubmit is never called → no API request → "nothing happens"
+		const result = reconstructed.safeParse(corruptedByUseFieldArray);
+		expect(result.success).toBe(false);
+		if (!result.success) {
+			// Confirm the error is specifically about the string array elements
+			const paths = result.error.issues.map((i) => i.path.join("."));
+			expect(
+				paths.some((p) => p.startsWith("structuredContraindications")),
+			).toBe(true);
+		}
+	});
+
+	it("primitive string array values are preserved correctly (NOT corrupted) when form state is managed without useFieldArray", () => {
+		// After the fix, AutoFormArray uses form.watch + form.setValue for primitive
+		// arrays. The values remain as strings throughout the lifecycle:
+		// initialData → formData → form state → zodResolver → submit
+
+		const schema = z.object({
+			structuredContraindications: z.array(z.string()).default([]),
+		});
+
+		const reconstructed = roundtripSchema(schema);
+
+		// The correctly-preserved values (no useFieldArray wrapping)
+		const preservedValues = {
+			structuredContraindications: [
+				"pregnancy",
+				"active malignancy",
+				"active cancer",
+				"trying to conceive",
+			],
+		};
+
+		// With the fix applied, these values pass validation → Save works
+		expect(reconstructed.safeParse(preservedValues).success).toBe(true);
+	});
+
+	it("compound schema with structuredContraindications passes full validation with string array values", () => {
+		// Representative subset of CompoundSchema fields that appear on the
+		// Epitalon compound page — verifies the full schema round-trip for the
+		// fields that are relevant to the reported bug.
+		const compoundSchema = z.object({
+			name: z.string().min(1),
+			compoundType: z.enum([
+				"healing-peptide",
+				"gh-axis",
+				"metabolic-peptide",
+				"sarm",
+				"steroid",
+				"nootropic",
+				"supplement",
+				"ancillary-pct",
+				"longevity",
+				"hair",
+				"skin",
+				"sexual",
+				"other",
+			]),
+			researchStatus: z.enum([
+				"research-only",
+				"approved",
+				"banned",
+				"grey-market",
+				"supplement",
+			]),
+			legalStatus: z.enum([
+				"OTC",
+				"Research",
+				"Grey-Market",
+				"Rx-Only",
+				"Schedule-III",
+				"Banned",
+			]),
+			doseUnit: z.enum(["mcg", "mg", "IU", "ml", "g"]),
+			doseFrequency: z.enum([
+				"once-daily",
+				"twice-daily",
+				"three-times-daily",
+				"every-other-day",
+				"weekly",
+				"twice-weekly",
+				"three-times-weekly",
+				"as-needed",
+				"custom",
+			]),
+			structuredContraindications: z.array(z.string()).default([]),
+			affiliates: z
+				.array(
+					z.object({
+						partnerId: z.object({ id: z.string() }).optional(),
+						title: z.string().optional(),
+						url: z.string().min(1),
+					}),
+				)
+				.default([]),
+		});
+
+		const reconstructed = roundtripSchema(compoundSchema);
+
+		// Epitalon-like data — all values as they come from parsedData
+		const epitalon = {
+			name: "Epitalon",
+			compoundType: "longevity",
+			researchStatus: "research-only",
+			legalStatus: "Research",
+			doseUnit: "mg",
+			doseFrequency: "once-daily",
+			// The 4 string items that were causing the silent save failure
+			structuredContraindications: [
+				"pregnancy",
+				"active malignancy",
+				"active cancer",
+				"trying to conceive",
+			],
+			affiliates: [
+				{
+					partnerId: { id: "v6yAqOSO_example_id" },
+					title: "Buy Epitalon 10mg",
+					url: "https://swisschems.is/product/epitalon-10mg-price-is-per-vial/",
+				},
+			],
+		};
+
+		const result = reconstructed.safeParse(epitalon);
+		// After the fix, this should PASS (the save button works)
+		expect(result.success).toBe(true);
+	});
+});

package/src/plugins/cms/api/index.ts

@@ -18,3 +18,4 @@ export {
 	type CreateCMSContentItemOptions,
 } from "./mutations";
 export { CMS_QUERY_KEYS } from "./query-key-defs";
+export { createCMSQueryKeys } from "../query-keys";

package/src/plugins/cms/api/plugin.ts

@@ -18,7 +18,10 @@ import type {
 	RelationValue,
 	InverseRelation,
 } from "../types";
-import { listContentQuerySchema } from "../schemas";
+import {
+	createListContentQuerySchema,
+	DEFAULT_MAX_PAGE_SIZE,
+} from "../schemas";
 import { slugify } from "../utils";
 import {
 	getAllContentTypes,
@@ -492,6 +495,20 @@ export const cmsBackendPlugin = (config: CMSBackendConfig) => {
 		}),
 
 		routes: (adapter: Adapter) => {
+			// Build pagination schemas once — honours config.maxPageSize
+			const listContentQuerySchema = createListContentQuerySchema(
+				config.maxPageSize,
+			);
+			const paginationQuerySchema = z.object({
+				limit: z.coerce
+					.number()
+					.min(1)
+					.max(config.maxPageSize ?? DEFAULT_MAX_PAGE_SIZE)
+					.optional()
+					.default(20),
+				offset: z.coerce.number().min(0).optional().default(0),
+			});
+
 			// Helper to get content type by slug
 			const getContentType = async (
 				slug: string,
@@ -525,10 +542,10 @@ export const cmsBackendPlugin = (config: CMSBackendConfig) => {
 						sortBy: { field: "name", direction: "asc" },
 					});
 
-					// Get item counts for each content type
+					// Get item counts for each content type via adapter.count() (avoids N+1 scan)
 					const typesWithCounts = await Promise.all(
 						contentTypes.map(async (ct) => {
-							const items = await adapter.findMany<ContentItem>({
+							const itemCount: number = await adapter.count({
 								model: "contentItem",
 								where: [
 									{
@@ -540,7 +557,7 @@ export const cmsBackendPlugin = (config: CMSBackendConfig) => {
 							});
 							return {
 								...serializeContentType(ct),
-								itemCount: items.length,
+								itemCount,
 							};
 						}),
 					);
@@ -964,12 +981,12 @@ export const cmsBackendPlugin = (config: CMSBackendConfig) => {
 				{
 					method: "GET",
 					params: z.object({ typeSlug: z.string() }),
-					query: z.object({
-						field: z.string(),
-						targetId: z.string(),
-						limit: z.coerce.number().min(1).max(100).optional().default(20),
-						offset: z.coerce.number().min(0).optional().default(0),
-					}),
+					query: z
+						.object({
+							field: z.string(),
+							targetId: z.string(),
+						})
+						.merge(paginationQuerySchema),
 				},
 				async (ctx) => {
 					const { typeSlug } = ctx.params;
@@ -1144,12 +1161,12 @@ export const cmsBackendPlugin = (config: CMSBackendConfig) => {
 						slug: z.string(),
 						sourceType: z.string(),
 					}),
-					query: z.object({
-						itemId: z.string(),
-						fieldName: z.string(),
-						limit: z.coerce.number().min(1).max(100).optional().default(20),
-						offset: z.coerce.number().min(0).optional().default(0),
-					}),
+					query: z
+						.object({
+							itemId: z.string(),
+							fieldName: z.string(),
+						})
+						.merge(paginationQuerySchema),
 				},
 				async (ctx) => {
 					const { slug, sourceType } = ctx.params;