@btst/stack 2.12.1 → 2.12.2

package/dist/plugins/media/api/index.d.cts

@@ -1,4 +1,4 @@
-export { C as CreateAssetInput, e as CreateFolderInput, M as MEDIA_QUERY_KEYS, g as MediaApiContext, j as MediaApiRouter, i as MediaBackendConfig, h as MediaBackendHooks, U as UpdateAssetInput, f as assetListDiscriminator, c as createAsset, a as createFolder, d as deleteAsset, b as deleteFolder, m as mediaBackendPlugin, u as updateAsset } from '../../../shared/stack.vVFh38aS.cjs';
+export { C as CreateAssetInput, e as CreateFolderInput, M as MEDIA_QUERY_KEYS, g as MediaApiContext, j as MediaApiRouter, i as MediaBackendConfig, h as MediaBackendHooks, U as UpdateAssetInput, f as assetListDiscriminator, c as createAsset, a as createFolder, d as deleteAsset, b as deleteFolder, m as mediaBackendPlugin, u as updateAsset } from '../../../shared/stack.BrNVff5Q.cjs';
 export { A as AssetListParams, d as AssetListResult, F as FolderListParams, g as getAssetById, b as getFolderById, c as getFolderByName, l as listAssets, a as listFolders } from '../../../shared/stack.jU2iG86n.cjs';
 import { A as Asset, S as SerializedAsset, F as Folder, a as SerializedFolder } from '../../../shared/stack.BMlLOMED.cjs';
 export { D as DirectStorageAdapter, a as S3StorageAdapter, b as S3UploadToken, S as StorageAdapter, U as UploadOptions, c as VercelBlobHandlerCallbacks, V as VercelBlobStorageAdapter } from '../../../shared/stack.lkebw2nj.cjs';

package/dist/plugins/media/api/index.d.mts

@@ -1,4 +1,4 @@
-export { C as CreateAssetInput, e as CreateFolderInput, M as MEDIA_QUERY_KEYS, g as MediaApiContext, j as MediaApiRouter, i as MediaBackendConfig, h as MediaBackendHooks, U as UpdateAssetInput, f as assetListDiscriminator, c as createAsset, a as createFolder, d as deleteAsset, b as deleteFolder, m as mediaBackendPlugin, u as updateAsset } from '../../../shared/stack.DpZoZd98.mjs';
+export { C as CreateAssetInput, e as CreateFolderInput, M as MEDIA_QUERY_KEYS, g as MediaApiContext, j as MediaApiRouter, i as MediaBackendConfig, h as MediaBackendHooks, U as UpdateAssetInput, f as assetListDiscriminator, c as createAsset, a as createFolder, d as deleteAsset, b as deleteFolder, m as mediaBackendPlugin, u as updateAsset } from '../../../shared/stack.zpwVhSJb.mjs';
 export { A as AssetListParams, d as AssetListResult, F as FolderListParams, g as getAssetById, b as getFolderById, c as getFolderByName, l as listAssets, a as listFolders } from '../../../shared/stack.C7u9lq9T.mjs';
 import { A as Asset, S as SerializedAsset, F as Folder, a as SerializedFolder } from '../../../shared/stack.BMlLOMED.mjs';
 export { D as DirectStorageAdapter, a as S3StorageAdapter, b as S3UploadToken, S as StorageAdapter, U as UploadOptions, c as VercelBlobHandlerCallbacks, V as VercelBlobStorageAdapter } from '../../../shared/stack.lkebw2nj.mjs';

package/dist/plugins/media/api/index.d.ts

@@ -1,4 +1,4 @@
-export { C as CreateAssetInput, e as CreateFolderInput, M as MEDIA_QUERY_KEYS, g as MediaApiContext, j as MediaApiRouter, i as MediaBackendConfig, h as MediaBackendHooks, U as UpdateAssetInput, f as assetListDiscriminator, c as createAsset, a as createFolder, d as deleteAsset, b as deleteFolder, m as mediaBackendPlugin, u as updateAsset } from '../../../shared/stack.C5ucdatf.js';
+export { C as CreateAssetInput, e as CreateFolderInput, M as MEDIA_QUERY_KEYS, g as MediaApiContext, j as MediaApiRouter, i as MediaBackendConfig, h as MediaBackendHooks, U as UpdateAssetInput, f as assetListDiscriminator, c as createAsset, a as createFolder, d as deleteAsset, b as deleteFolder, m as mediaBackendPlugin, u as updateAsset } from '../../../shared/stack.COetIi--.js';
 export { A as AssetListParams, d as AssetListResult, F as FolderListParams, g as getAssetById, b as getFolderById, c as getFolderByName, l as listAssets, a as listFolders } from '../../../shared/stack.DD-ZORI7.js';
 import { A as Asset, S as SerializedAsset, F as Folder, a as SerializedFolder } from '../../../shared/stack.BMlLOMED.js';
 export { D as DirectStorageAdapter, a as S3StorageAdapter, b as S3UploadToken, S as StorageAdapter, U as UploadOptions, c as VercelBlobHandlerCallbacks, V as VercelBlobStorageAdapter } from '../../../shared/stack.lkebw2nj.js';

package/dist/plugins/media/query-keys.d.cts

@@ -1,5 +1,5 @@
 import * as _tanstack_react_query from '@tanstack/react-query';
-import { j as MediaApiRouter, A as AssetListDiscriminator } from '../../shared/stack.vVFh38aS.cjs';
+import { j as MediaApiRouter, A as AssetListDiscriminator } from '../../shared/stack.BrNVff5Q.cjs';
 import { createApiClient } from '@btst/stack/plugins/client';
 import { S as SerializedAsset, a as SerializedFolder } from '../../shared/stack.BMlLOMED.cjs';
 import { A as AssetListParams } from '../../shared/stack.jU2iG86n.cjs';

package/dist/plugins/media/query-keys.d.mts

@@ -1,5 +1,5 @@
 import * as _tanstack_react_query from '@tanstack/react-query';
-import { j as MediaApiRouter, A as AssetListDiscriminator } from '../../shared/stack.DpZoZd98.mjs';
+import { j as MediaApiRouter, A as AssetListDiscriminator } from '../../shared/stack.zpwVhSJb.mjs';
 import { createApiClient } from '@btst/stack/plugins/client';
 import { S as SerializedAsset, a as SerializedFolder } from '../../shared/stack.BMlLOMED.mjs';
 import { A as AssetListParams } from '../../shared/stack.C7u9lq9T.mjs';

package/dist/plugins/media/query-keys.d.ts

@@ -1,5 +1,5 @@
 import * as _tanstack_react_query from '@tanstack/react-query';
-import { j as MediaApiRouter, A as AssetListDiscriminator } from '../../shared/stack.C5ucdatf.js';
+import { j as MediaApiRouter, A as AssetListDiscriminator } from '../../shared/stack.COetIi--.js';
 import { createApiClient } from '@btst/stack/plugins/client';
 import { S as SerializedAsset, a as SerializedFolder } from '../../shared/stack.BMlLOMED.js';
 import { A as AssetListParams } from '../../shared/stack.DD-ZORI7.js';

package/dist/shared/{stack.DPTRuLUH.d.ts → stack.BnSAhKJi.d.ts}

@@ -1,7 +1,7 @@
 import * as _tanstack_react_query from '@tanstack/react-query';
 import { S as SerializedPost, a as SerializedTag } from './stack.Dsatjh0B.js';
 import { z } from 'zod';
-import { c as createPostSchema, u as updatePostSchema } from './stack.DuQOcInS.js';
+import { c as createPostSchema, u as updatePostSchema } from './stack.CuhcFsAx.js';
 
 /**
  * Options for the usePosts hook
@@ -136,14 +136,14 @@ declare function useCreatePost(): _tanstack_react_query.UseMutationResult<Serial
         name: string;
         slug: string;
     })[];
+    published: boolean;
     title: string;
     content: string;
     excerpt: string;
-    published: boolean;
     slug?: string | undefined;
+    publishedAt?: Date | undefined;
     createdAt?: Date | undefined;
     updatedAt?: Date | undefined;
-    publishedAt?: Date | undefined;
     image?: string | undefined;
 }, unknown>;
 /** Update an existing post by id */

package/dist/shared/{stack.vVFh38aS.d.cts → stack.BrNVff5Q.d.cts}

@@ -188,6 +188,15 @@ interface MediaBackendConfig {
      * Provide this option only when you need to override the automatic default (e.g. to allow
      * assets from a CDN in front of your storage that uses a different domain). When using
      * `localAdapter`, setting `allowedUrlPrefixes` explicitly opts `POST /media/assets` back in.
+     *
+     * @remarks
+     * Protocol-only prefixes such as `"https://"` (and especially `"http://"`) disable
+     * origin-based restrictions entirely — any URL with that scheme will be accepted.
+     * Only use them when you intentionally want to allow assets from arbitrary hosts:
+     * `"http://"` URLs will be blocked as mixed content on HTTPS pages, and if your
+     * `onAfterUpload` hook fetches asset URLs server-side, accepting arbitrary hosts
+     * can expose an SSRF surface. Prefer full origin prefixes like
+     * `"https://cdn.example.com"` whenever possible.
      */
     allowedUrlPrefixes?: string[];
     /**

package/dist/shared/{stack.04aMRz_W.d.cts → stack.CLWhMntf.d.cts}

@@ -6,7 +6,7 @@ import * as _btst_stack_plugins_api from '@btst/stack/plugins/api';
 import { DBAdapter } from '@btst/db';
 import * as better_call from 'better-call';
 import { z } from 'zod';
-import { c as createPostSchema, u as updatePostSchema } from './stack.DuQOcInS.cjs';
+import { c as createPostSchema, u as updatePostSchema } from './stack.CuhcFsAx.cjs';
 
 /**
  * Parameters for filtering/paginating posts.
@@ -325,11 +325,11 @@ declare const blogBackendPlugin: (hooks?: BlogBackendHooks) => _btst_stack_plugi
                 slug: string;
             })[] | undefined;
             slug?: string | undefined;
+            published?: boolean | undefined;
+            publishedAt?: unknown;
             createdAt?: unknown;
             updatedAt?: unknown;
-            publishedAt?: unknown;
             image?: string | undefined;
-            published?: boolean | undefined;
         }, {
             title: string;
             content: string;
@@ -342,11 +342,11 @@ declare const blogBackendPlugin: (hooks?: BlogBackendHooks) => _btst_stack_plugi
                 slug: string;
             })[] | undefined;
             slug?: string | undefined;
+            published?: boolean | undefined;
+            publishedAt?: unknown;
             createdAt?: unknown;
             updatedAt?: unknown;
-            publishedAt?: unknown;
             image?: string | undefined;
-            published?: boolean | undefined;
         }>;
     }, Post>;
     readonly updatePost: better_call.StrictEndpoint<"/posts/:id", {} & {

package/dist/shared/{stack.C5ucdatf.d.ts → stack.COetIi--.d.ts}

@@ -188,6 +188,15 @@ interface MediaBackendConfig {
      * Provide this option only when you need to override the automatic default (e.g. to allow
      * assets from a CDN in front of your storage that uses a different domain). When using
      * `localAdapter`, setting `allowedUrlPrefixes` explicitly opts `POST /media/assets` back in.
+     *
+     * @remarks
+     * Protocol-only prefixes such as `"https://"` (and especially `"http://"`) disable
+     * origin-based restrictions entirely — any URL with that scheme will be accepted.
+     * Only use them when you intentionally want to allow assets from arbitrary hosts:
+     * `"http://"` URLs will be blocked as mixed content on HTTPS pages, and if your
+     * `onAfterUpload` hook fetches asset URLs server-side, accepting arbitrary hosts
+     * can expose an SSRF surface. Prefer full origin prefixes like
+     * `"https://cdn.example.com"` whenever possible.
      */
     allowedUrlPrefixes?: string[];
     /**

package/dist/shared/{stack.BvuqACtA.d.cts → stack.DNLuzDb3.d.cts}

@@ -1,7 +1,7 @@
 import * as _tanstack_react_query from '@tanstack/react-query';
 import { S as SerializedPost, a as SerializedTag } from './stack.Dsatjh0B.cjs';
 import { z } from 'zod';
-import { c as createPostSchema, u as updatePostSchema } from './stack.DuQOcInS.cjs';
+import { c as createPostSchema, u as updatePostSchema } from './stack.CuhcFsAx.cjs';
 
 /**
  * Options for the usePosts hook
@@ -136,14 +136,14 @@ declare function useCreatePost(): _tanstack_react_query.UseMutationResult<Serial
         name: string;
         slug: string;
     })[];
+    published: boolean;
     title: string;
     content: string;
     excerpt: string;
-    published: boolean;
     slug?: string | undefined;
+    publishedAt?: Date | undefined;
     createdAt?: Date | undefined;
     updatedAt?: Date | undefined;
-    publishedAt?: Date | undefined;
     image?: string | undefined;
 }, unknown>;
 /** Update an existing post by id */

package/dist/shared/{stack.Cs8R5HxD.d.mts → stack.Dfc44JiE.d.mts}

@@ -1,7 +1,7 @@
 import * as _tanstack_react_query from '@tanstack/react-query';
 import { S as SerializedPost, a as SerializedTag } from './stack.Dsatjh0B.mjs';
 import { z } from 'zod';
-import { c as createPostSchema, u as updatePostSchema } from './stack.DuQOcInS.mjs';
+import { c as createPostSchema, u as updatePostSchema } from './stack.CuhcFsAx.mjs';
 
 /**
  * Options for the usePosts hook
@@ -136,14 +136,14 @@ declare function useCreatePost(): _tanstack_react_query.UseMutationResult<Serial
         name: string;
         slug: string;
     })[];
+    published: boolean;
     title: string;
     content: string;
     excerpt: string;
-    published: boolean;
     slug?: string | undefined;
+    publishedAt?: Date | undefined;
     createdAt?: Date | undefined;
     updatedAt?: Date | undefined;
-    publishedAt?: Date | undefined;
     image?: string | undefined;
 }, unknown>;
 /** Update an existing post by id */

package/dist/shared/{stack.ueI-K4xy.d.mts → stack.DiodAFAa.d.mts}

@@ -6,7 +6,7 @@ import * as _btst_stack_plugins_api from '@btst/stack/plugins/api';
 import { DBAdapter } from '@btst/db';
 import * as better_call from 'better-call';
 import { z } from 'zod';
-import { c as createPostSchema, u as updatePostSchema } from './stack.DuQOcInS.mjs';
+import { c as createPostSchema, u as updatePostSchema } from './stack.CuhcFsAx.mjs';
 
 /**
  * Parameters for filtering/paginating posts.
@@ -325,11 +325,11 @@ declare const blogBackendPlugin: (hooks?: BlogBackendHooks) => _btst_stack_plugi
                 slug: string;
             })[] | undefined;
             slug?: string | undefined;
+            published?: boolean | undefined;
+            publishedAt?: unknown;
             createdAt?: unknown;
             updatedAt?: unknown;
-            publishedAt?: unknown;
             image?: string | undefined;
-            published?: boolean | undefined;
         }, {
             title: string;
             content: string;
@@ -342,11 +342,11 @@ declare const blogBackendPlugin: (hooks?: BlogBackendHooks) => _btst_stack_plugi
                 slug: string;
             })[] | undefined;
             slug?: string | undefined;
+            published?: boolean | undefined;
+            publishedAt?: unknown;
             createdAt?: unknown;
             updatedAt?: unknown;
-            publishedAt?: unknown;
             image?: string | undefined;
-            published?: boolean | undefined;
         }>;
     }, Post>;
     readonly updatePost: better_call.StrictEndpoint<"/posts/:id", {} & {

package/dist/shared/{stack.CxWEN62M.d.ts → stack.ufcExQIR.d.ts}

@@ -6,7 +6,7 @@ import * as _btst_stack_plugins_api from '@btst/stack/plugins/api';
 import { DBAdapter } from '@btst/db';
 import * as better_call from 'better-call';
 import { z } from 'zod';
-import { c as createPostSchema, u as updatePostSchema } from './stack.DuQOcInS.js';
+import { c as createPostSchema, u as updatePostSchema } from './stack.CuhcFsAx.js';
 
 /**
  * Parameters for filtering/paginating posts.
@@ -325,11 +325,11 @@ declare const blogBackendPlugin: (hooks?: BlogBackendHooks) => _btst_stack_plugi
                 slug: string;
             })[] | undefined;
             slug?: string | undefined;
+            published?: boolean | undefined;
+            publishedAt?: unknown;
             createdAt?: unknown;
             updatedAt?: unknown;
-            publishedAt?: unknown;
             image?: string | undefined;
-            published?: boolean | undefined;
         }, {
             title: string;
             content: string;
@@ -342,11 +342,11 @@ declare const blogBackendPlugin: (hooks?: BlogBackendHooks) => _btst_stack_plugi
                 slug: string;
             })[] | undefined;
             slug?: string | undefined;
+            published?: boolean | undefined;
+            publishedAt?: unknown;
             createdAt?: unknown;
             updatedAt?: unknown;
-            publishedAt?: unknown;
             image?: string | undefined;
-            published?: boolean | undefined;
         }>;
     }, Post>;
     readonly updatePost: better_call.StrictEndpoint<"/posts/:id", {} & {

package/dist/shared/{stack.DpZoZd98.d.mts → stack.zpwVhSJb.d.mts}

@@ -188,6 +188,15 @@ interface MediaBackendConfig {
      * Provide this option only when you need to override the automatic default (e.g. to allow
      * assets from a CDN in front of your storage that uses a different domain). When using
      * `localAdapter`, setting `allowedUrlPrefixes` explicitly opts `POST /media/assets` back in.
+     *
+     * @remarks
+     * Protocol-only prefixes such as `"https://"` (and especially `"http://"`) disable
+     * origin-based restrictions entirely — any URL with that scheme will be accepted.
+     * Only use them when you intentionally want to allow assets from arbitrary hosts:
+     * `"http://"` URLs will be blocked as mixed content on HTTPS pages, and if your
+     * `onAfterUpload` hook fetches asset URLs server-side, accepting arbitrary hosts
+     * can expose an SSRF surface. Prefer full origin prefixes like
+     * `"https://cdn.example.com"` whenever possible.
      */
     allowedUrlPrefixes?: string[];
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@btst/stack",
-  "version": "2.12.1",
+  "version": "2.12.2",
   "description": "A composable, plugin-based library for building full-stack applications.",
   "repository": {
     "type": "git",
@@ -755,7 +755,7 @@
     }
   },
   "dependencies": {
-    "@btst/db": "2.2.1",
+    "@btst/db": "2.2.2",
     "@lukemorales/query-key-factory": "^1.3.4",
     "@milkdown/crepe": "^7.17.1",
     "@milkdown/kit": "^7.17.1",
@@ -814,7 +814,7 @@
     "@ai-sdk/react": "^2.0.94",
     "@aws-sdk/client-s3": "^3.1011.0",
     "@aws-sdk/s3-request-presigner": "^3.1011.0",
-    "@btst/adapter-memory": "2.2.1",
+    "@btst/adapter-memory": "2.2.2",
     "@btst/yar": "1.2.0",
     "@types/react": "^19.0.0",
     "@types/slug": "^5.0.9",
@@ -823,8 +823,8 @@
     "ai": "^5.0.94",
     "better-call": "catalog:",
     "knip": "^5.61.2",
-    "react": "^19.1.1",
-    "react-dom": "^19.1.1",
+    "react": "^19.2.7",
+    "react-dom": "^19.2.7",
     "react-error-boundary": "^4.1.2",
     "rollup-plugin-preserve-directives": "0.4.0",
     "rollup-plugin-visualizer": "^5.12.0",

package/src/plugins/media/__tests__/plugin.test.ts

@@ -293,6 +293,52 @@ describe("mediaBackendPlugin create-asset URL validation", () => {
 			"https://cdn.example.com/uploads/photo.jpg",
 		);
 	});
+
+	it("allows any HTTP(S) URL when protocol prefixes are explicitly configured", async () => {
+		const backend = createVercelBlobBackend({
+			allowedUrlPrefixes: ["https://", "http://"],
+		});
+
+		const response = await backend.handler(
+			new Request("http://localhost/api/media/assets", {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify(
+					createAssetRequestBody(
+						"https://images.example.net/affiliate/photo.jpg",
+					),
+				),
+			}),
+		);
+
+		expect(response.status).toBe(200);
+
+		const assets = await backend.api.media.listAssets();
+		expect(assets.items).toHaveLength(1);
+		expect(assets.items[0]?.url).toBe(
+			"https://images.example.net/affiliate/photo.jpg",
+		);
+
+		const httpResponse = await backend.handler(
+			new Request("http://localhost/api/media/assets", {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify(
+					createAssetRequestBody(
+						"http://images.example.net/affiliate/photo.jpg",
+					),
+				),
+			}),
+		);
+
+		expect(httpResponse.status).toBe(200);
+
+		const updatedAssets = await backend.api.media.listAssets();
+		expect(updatedAssets.items).toHaveLength(2);
+		expect(
+			updatedAssets.items.some((asset) => asset.url.startsWith("http://")),
+		).toBe(true);
+	});
 });
 
 describe("mediaBackendPlugin S3 URL validation", () => {

package/src/plugins/media/api/plugin.ts

@@ -41,7 +41,19 @@ function sanitizeS3KeySegment(s: string): string {
 }
 
 function matchesUrlPrefix(url: string, prefix: string): boolean {
-	const normalizedPrefix = `${prefix.replace(/\/+$/, "")}/`;
+	const trimmedPrefix = prefix.trim();
+	if (!trimmedPrefix) return false;
+
+	if (/^[a-z][a-z\d+.-]*:\/\//i.test(trimmedPrefix)) {
+		if (trimmedPrefix.endsWith("://")) {
+			return url.startsWith(trimmedPrefix);
+		}
+
+		const normalizedPrefix = trimmedPrefix.replace(/\/+$/, "");
+		return url === normalizedPrefix || url.startsWith(`${normalizedPrefix}/`);
+	}
+
+	const normalizedPrefix = `${trimmedPrefix.replace(/\/+$/, "")}/`;
 	return url.startsWith(normalizedPrefix);
 }
 
@@ -181,6 +193,15 @@ export interface MediaBackendConfig {
 	 * Provide this option only when you need to override the automatic default (e.g. to allow
 	 * assets from a CDN in front of your storage that uses a different domain). When using
 	 * `localAdapter`, setting `allowedUrlPrefixes` explicitly opts `POST /media/assets` back in.
+	 *
+	 * @remarks
+	 * Protocol-only prefixes such as `"https://"` (and especially `"http://"`) disable
+	 * origin-based restrictions entirely — any URL with that scheme will be accepted.
+	 * Only use them when you intentionally want to allow assets from arbitrary hosts:
+	 * `"http://"` URLs will be blocked as mixed content on HTTPS pages, and if your
+	 * `onAfterUpload` hook fetches asset URLs server-side, accepting arbitrary hosts
+	 * can expose an SSRF surface. Prefer full origin prefixes like
+	 * `"https://cdn.example.com"` whenever possible.
 	 */
 	allowedUrlPrefixes?: string[];
 

package/src/plugins/media/client/components/media-picker/url-tab.tsx

@@ -18,6 +18,7 @@ export function UrlTab({
 
 	const handleSubmit = async (e: React.FormEvent) => {
 		e.preventDefault();
+		e.stopPropagation();
 		setError(null);
 		const trimmed = url.trim();
 		if (!trimmed) return;
@@ -43,7 +44,10 @@ export function UrlTab({
 			<form onSubmit={handleSubmit} className="flex flex-col gap-2">
 				<div className="flex flex-col gap-2 sm:flex-row">
 					<Input
-						type="url"
+						type="text"
+						inputMode="url"
+						autoCapitalize="none"
+						autoCorrect="off"
 						value={url}
 						onChange={(e) => setUrl(e.target.value)}
 						placeholder="https://example.com/image.png"