@btst/stack 2.3.0 → 2.5.0

package/dist/shared/{stack.CP68pFEH.d.mts → stack.C9Mg2Q46.d.cts}

@@ -1,5 +1,5 @@
 import * as _btst_stack_plugins_api from '@btst/stack/plugins/api';
-import { a as SerializedContentItemWithType, S as SerializedContentType, b as ContentType, c as ContentItem, d as SerializedContentItem, e as ContentItemWithType, f as CMSBackendConfig, I as InverseRelation } from './stack.CVDTkMoO.mjs';
+import { a as SerializedContentItemWithType, S as SerializedContentType, b as ContentType, c as ContentItem, d as SerializedContentItem, e as ContentItemWithType, f as CMSBackendConfig, I as InverseRelation } from './stack.B8QD11QU.cjs';
 import * as better_call from 'better-call';
 import { z } from 'zod';
 import { Adapter } from '@btst/db';
@@ -78,6 +78,35 @@ declare function getContentItemById(adapter: Adapter, id: string): Promise<Seria
  */
 declare function getContentItemBySlug(adapter: Adapter, contentTypeSlug: string, slug: string): Promise<SerializedContentItemWithType | null>;
 
+/**
+ * Input for creating a new CMS content item.
+ */
+interface CreateCMSContentItemInput {
+    /** URL-safe slug for the item */
+    slug: string;
+    /** Arbitrary data payload — should match the content type schema */
+    data: Record<string, unknown>;
+}
+/**
+ * Create a new content item for a content type (looked up by slug).
+ *
+ * Bypasses Zod schema validation and relation processing — the caller is
+ * responsible for providing valid, relation-free data. For relation fields or
+ * schema validation, use the HTTP endpoint instead.
+ *
+ * Throws if the content type is not found or the slug is already taken within
+ * that content type.
+ *
+ * @remarks **Security:** No authorization hooks (`onBeforeCreate`, `onAfterCreate`)
+ * are called. The caller is responsible for any access-control checks before
+ * invoking this function.
+ *
+ * @param adapter - The database adapter
+ * @param contentTypeSlug - Slug of the target content type
+ * @param input - Item slug and data payload
+ */
+declare function createCMSContentItem(adapter: Adapter, contentTypeSlug: string, input: CreateCMSContentItemInput): Promise<SerializedContentItem>;
+
 /**
  * Route keys for the CMS plugin — matches the keys returned by
  * `stackClient.router.getRoute(path).routeKey`.
@@ -257,6 +286,7 @@ declare const cmsBackendPlugin: (config: CMSBackendConfig) => _btst_stack_plugin
     getContentItemBySlug: (contentTypeSlug: string, slug: string) => Promise<SerializedContentItemWithType<Record<string, unknown>> | null>;
     getContentItemById: (id: string) => Promise<SerializedContentItemWithType<Record<string, unknown>> | null>;
     prefetchForRoute: CMSPrefetchForRoute;
+    createContentItem: (typeSlug: string, input: Parameters<typeof createCMSContentItem>[2]) => Promise<SerializedContentItem>;
 }>;
 type CMSApiRouter = ReturnType<ReturnType<typeof cmsBackendPlugin>["routes"]>;
 
@@ -293,5 +323,5 @@ declare const CMS_QUERY_KEYS: {
     contentDetail: (typeSlug: string, id: string) => readonly ["cmsContent", "detail", string, string];
 };
 
-export { cmsBackendPlugin as c, getAllContentItems as d, getContentItemBySlug as e, getContentItemById as f, getAllContentTypes as g, serializeContentItem as h, serializeContentItemWithType as i, CMS_QUERY_KEYS as j, serializeContentType as s };
-export type { CMSApiRouter as C, ContentListDiscriminator as a, CMSRouteKey as b };
+export { cmsBackendPlugin as c, getAllContentItems as d, getContentItemBySlug as e, getContentItemById as f, getAllContentTypes as g, serializeContentItem as h, serializeContentItemWithType as i, createCMSContentItem as j, CMS_QUERY_KEYS as l, serializeContentType as s };
+export type { CMSApiRouter as C, ContentListDiscriminator as a, CMSRouteKey as b, CreateCMSContentItemInput as k };

package/dist/shared/{stack.BeSm90va.d.ts → stack.CTDVxbrA.d.ts}

@@ -5,7 +5,7 @@ import * as _btst_stack_plugins_api from '@btst/stack/plugins/api';
 import * as better_call from 'better-call';
 import * as zod_v4_core from 'zod/v4/core';
 import * as zod from 'zod';
-import { LanguageModel, Tool } from 'ai';
+import { Tool, LanguageModel } from 'ai';
 
 /**
  * Context passed to AI Chat API hooks
@@ -24,49 +24,61 @@ interface ChatApiContext<TBody = any, TParams = any, TQuery = any> {
  */
 interface AiChatBackendHooks {
     /**
-     * Called before processing a chat message. Return false to deny access.
+     * Called before processing a chat message. Throw an error to deny access.
      * @param messages - Array of messages being sent
      * @param context - Request context with headers, etc.
      */
     onBeforeChat?: (messages: Array<{
         role: string;
         content: string;
-    }>, context: ChatApiContext) => Promise<boolean> | boolean;
+    }>, context: ChatApiContext) => Promise<void> | void;
     /**
-     * Called before listing conversations. Return false to deny access.
+     * Called before listing conversations. Throw an error to deny access.
      * @param context - Request context with headers, etc.
      */
-    onBeforeListConversations?: (context: ChatApiContext) => Promise<boolean> | boolean;
+    onBeforeListConversations?: (context: ChatApiContext) => Promise<void> | void;
     /**
-     * Called before getting a single conversation. Return false to deny access.
+     * Called before getting a single conversation. Throw an error to deny access.
      * @param conversationId - ID of the conversation being accessed
      * @param context - Request context with headers, etc.
      */
-    onBeforeGetConversation?: (conversationId: string, context: ChatApiContext) => Promise<boolean> | boolean;
+    onBeforeGetConversation?: (conversationId: string, context: ChatApiContext) => Promise<void> | void;
     /**
-     * Called before creating a conversation. Return false to deny access.
+     * Called before creating a conversation. Throw an error to deny access.
      * @param data - Conversation data being created
      * @param context - Request context with headers, etc.
      */
     onBeforeCreateConversation?: (data: {
         id?: string;
         title?: string;
-    }, context: ChatApiContext) => Promise<boolean> | boolean;
+    }, context: ChatApiContext) => Promise<void> | void;
     /**
-     * Called before updating a conversation. Return false to deny access.
+     * Called before updating a conversation. Throw an error to deny access.
      * @param conversationId - ID of the conversation being updated
      * @param data - Updated conversation data
      * @param context - Request context with headers, etc.
      */
     onBeforeUpdateConversation?: (conversationId: string, data: {
         title?: string;
-    }, context: ChatApiContext) => Promise<boolean> | boolean;
+    }, context: ChatApiContext) => Promise<void> | void;
     /**
-     * Called before deleting a conversation. Return false to deny access.
+     * Called before deleting a conversation. Throw an error to deny access.
      * @param conversationId - ID of the conversation being deleted
      * @param context - Request context with headers, etc.
      */
-    onBeforeDeleteConversation?: (conversationId: string, context: ChatApiContext) => Promise<boolean> | boolean;
+    onBeforeDeleteConversation?: (conversationId: string, context: ChatApiContext) => Promise<void> | void;
+    /**
+     * Called after the structural routeName/allowlist validation, with the list
+     * of tool names that passed. Return a filtered subset to further restrict
+     * which tools the LLM sees, or return [] to suppress all page tools.
+     * Throw an Error to abort the entire chat request with a 403 response.
+     * Not called when no tools passed the structural validation step.
+     *
+     * @param toolNames - Names that passed the routeName allowlist check
+     * @param routeName - routeName claimed by the request (may be undefined)
+     * @param context   - Full request context (headers, body, etc.)
+     */
+    onBeforeToolsActivated?: (toolNames: string[], routeName: string | undefined, context: ChatApiContext) => Promise<string[]> | string[];
     /**
      * Called after a chat message is processed successfully
      * @param conversationId - ID of the conversation
@@ -152,6 +164,23 @@ type AiChatMode = "authenticated" | "public";
 /**
  * Configuration for AI Chat backend plugin
  */
+/**
+ * Extracts only the literal (non-index-signature) keys from a type.
+ * For `Record<string, T>` this resolves to `never`, so collision checks are
+ * skipped when the tools map is typed with a broad string index.
+ */
+type KnownKeys<T> = {
+    [K in keyof T]: string extends K ? never : K;
+}[keyof T];
+/**
+ * Ensures `TClientTools` has no keys that are also literal keys in `TTools`.
+ * Colliding keys are mapped to `never`, which produces a compile-time error
+ * at the point of the duplicate key. When `TTools` uses a string index
+ * signature the check is skipped to avoid false positives.
+ */
+type NoKeyCollision<TTools, TClientTools extends Record<string, Tool>> = KnownKeys<TTools> & keyof TClientTools extends never ? TClientTools : {
+    [K in keyof TClientTools]: K extends KnownKeys<TTools> ? never : TClientTools[K];
+};
 interface AiChatBackendConfig {
     /**
      * The language model to use for chat completions.
@@ -182,6 +211,29 @@ interface AiChatBackendConfig {
      * @see https://ai-sdk.dev/docs/ai-sdk-core/tools-and-tool-calling
      */
     tools?: Record<string, Tool>;
+    /**
+     * Enable route-aware page tools.
+     * When true, the server will include tool schemas for client-side page tools
+     * (e.g. fillBlogForm, updatePageLayers) based on the availableTools list
+     * sent with each request.
+     * @default false
+     */
+    enablePageTools?: boolean;
+    /**
+     * Custom client-side tool schemas for non-BTST pages.
+     * Merged with built-in page tool schemas (fillBlogForm, updatePageLayers).
+     * Only included when enablePageTools is true and the tool name appears in
+     * the availableTools list sent with the request.
+     *
+     * @example
+     * clientToolSchemas: {
+     *   addToCart: tool({
+     *     description: "Add current product to cart",
+     *     parameters: z.object({ quantity: z.number().int().min(1) }),
+     *   }),
+     * }
+     */
+    clientToolSchemas?: Record<string, Tool>;
     /**
      * Optional hooks for customizing plugin behavior
      */
@@ -194,7 +246,10 @@ interface AiChatBackendConfig {
  *
  * @param config - Configuration including model, tools, and optional hooks
  */
-declare const aiChatBackendPlugin: (config: AiChatBackendConfig) => _btst_stack_plugins_api.BackendPlugin<{
+declare const aiChatBackendPlugin: <TTools extends Record<string, Tool> = Record<never, Tool>, TClientTools extends Record<string, Tool> = Record<never, Tool>>(config: Omit<AiChatBackendConfig, "tools" | "clientToolSchemas"> & {
+    tools?: TTools;
+    clientToolSchemas?: NoKeyCollision<TTools, TClientTools>;
+}) => _btst_stack_plugins_api.BackendPlugin<{
     chat: better_call.StrictEndpoint<"/chat", {
         method: "POST";
         body: zod.ZodObject<{
@@ -223,6 +278,9 @@ declare const aiChatBackendPlugin: (config: AiChatBackendConfig) => _btst_stack_
             }, zod_v4_core.$strip>]>>;
             conversationId: zod.ZodOptional<zod.ZodString>;
             model: zod.ZodOptional<zod.ZodString>;
+            pageContext: zod.ZodOptional<zod.ZodString>;
+            availableTools: zod.ZodOptional<zod.ZodArray<zod.ZodString>>;
+            routeName: zod.ZodOptional<zod.ZodString>;
         }, zod_v4_core.$strip>;
     }, Response>;
     createConversation: better_call.StrictEndpoint<"/chat/conversations", {

package/dist/shared/{stack.C-Ptrz8s.d.ts → stack.Cj_zKww4.d.ts}

@@ -83,21 +83,21 @@ interface LoaderContext {
  */
 interface UIBuilderClientHooks {
     /**
-     * Called before loading the page list. Return false to cancel loading.
+     * Called before loading the page list. Throw an error to cancel loading.
      * @param context - Loader context with path, params, etc.
      */
-    beforeLoadPageList?: (context: LoaderContext) => Promise<boolean> | boolean;
+    beforeLoadPageList?: (context: LoaderContext) => Promise<void> | void;
     /**
      * Called after the page list is loaded.
      * @param context - Loader context
      */
     afterLoadPageList?: (context: LoaderContext) => Promise<void> | void;
     /**
-     * Called before loading the page builder. Return false to cancel loading.
+     * Called before loading the page builder. Throw an error to cancel loading.
      * @param pageId - The page ID (undefined for new pages)
      * @param context - Loader context
      */
-    beforeLoadPageBuilder?: (pageId: string | undefined, context: LoaderContext) => Promise<boolean> | boolean;
+    beforeLoadPageBuilder?: (pageId: string | undefined, context: LoaderContext) => Promise<void> | void;
     /**
      * Called after the page builder is loaded.
      * @param pageId - The page ID (undefined for new pages)

package/dist/shared/{stack.TIBF2AOx.d.ts → stack.CxaFNQCV.d.mts}

@@ -1,18 +1,18 @@
 import * as _btst_stack_plugins_api from '@btst/stack/plugins/api';
 import * as better_call from 'better-call';
 import { Adapter } from '@btst/db';
-import { B as BoardWithColumns, d as Board, e as Column, T as Task, C as ColumnWithTasks } from './stack.DJaKVY7v.js';
+import { B as BoardWithColumns, P as Priority, T as Task, d as Board, e as Column, C as ColumnWithTasks } from './stack.DJaKVY7v.mjs';
 import { z } from 'zod';
 import { QueryClient } from '@tanstack/react-query';
 
 declare const createBoardSchema: z.ZodObject<{
     description: z.ZodOptional<z.ZodString>;
     name: z.ZodString;
-    createdAt: z.ZodOptional<z.ZodCoercedDate<unknown>>;
-    updatedAt: z.ZodOptional<z.ZodCoercedDate<unknown>>;
     slug: z.ZodOptional<z.ZodString>;
     ownerId: z.ZodOptional<z.ZodString>;
     organizationId: z.ZodOptional<z.ZodString>;
+    createdAt: z.ZodOptional<z.ZodCoercedDate<unknown>>;
+    updatedAt: z.ZodOptional<z.ZodCoercedDate<unknown>>;
 }, z.core.$strip>;
 declare const updateBoardSchema: z.ZodObject<{
     createdAt: z.ZodOptional<z.ZodOptional<z.ZodCoercedDate<unknown>>>;
@@ -28,8 +28,8 @@ declare const createColumnSchema: z.ZodObject<{
     title: z.ZodString;
     createdAt: z.ZodOptional<z.ZodCoercedDate<unknown>>;
     updatedAt: z.ZodOptional<z.ZodCoercedDate<unknown>>;
-    boardId: z.ZodString;
     order: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    boardId: z.ZodString;
 }, z.core.$strip>;
 declare const updateColumnSchema: z.ZodObject<{
     createdAt: z.ZodOptional<z.ZodOptional<z.ZodCoercedDate<unknown>>>;
@@ -109,6 +109,58 @@ declare function getAllBoards(adapter: Adapter, params?: z.infer<typeof BoardLis
  */
 declare function getBoardById(adapter: Adapter, id: string): Promise<BoardWithColumns | null>;
 
+/**
+ * Input for creating a new Kanban task.
+ */
+interface CreateKanbanTaskInput {
+    title: string;
+    columnId: string;
+    description?: string;
+    priority?: Priority;
+    assigneeId?: string;
+}
+/**
+ * Create a new task in a Kanban column.
+ * Computes the next order value from existing tasks in the column.
+ *
+ * @remarks **Security:** No authorization hooks (onBeforeCreateTask) are called.
+ * The caller is responsible for any access-control checks before invoking this
+ * function.
+ *
+ * @param adapter - The database adapter
+ * @param input - Task creation input
+ */
+declare function createKanbanTask(adapter: Adapter, input: CreateKanbanTaskInput): Promise<Task>;
+/**
+ * Find a board by slug, or create it with the given name and custom column titles.
+ *
+ * Concurrency-safe at two levels:
+ * - **Same process**: concurrent calls with the same slug share a single in-flight
+ *   Promise (via `_pendingBoardCreations`), so only one DB write is attempted.
+ * - **Cross-instance**: the DB `unique` constraint on `slug` causes the losing
+ *   write to throw; the catch block re-fetches and returns the winner's board.
+ *
+ * @remarks **Security:** No authorization hooks are called. The caller is
+ * responsible for any access-control checks before invoking this function.
+ *
+ * @param adapter - The database adapter
+ * @param slug - Unique URL-safe slug for the board
+ * @param name - Display name for the board (used only on creation)
+ * @param columnTitles - Ordered list of column names to create (used only on creation)
+ */
+declare function findOrCreateKanbanBoard(adapter: Adapter, slug: string, name: string, columnTitles: string[]): Promise<Board>;
+/**
+ * Retrieve all columns for a given board, sorted by order.
+ * Co-located with mutations because it is primarily used alongside
+ * {@link createKanbanTask} to resolve column IDs before task creation.
+ *
+ * @remarks **Security:** No authorization hooks are called.
+ *
+ * @param adapter - The database adapter
+ * @param boardId - The board ID
+ */
+declare function getKanbanColumnsByBoardId(adapter: Adapter, boardId: string): Promise<Column[]>;
+
 /**
  * Route keys for the Kanban plugin — matches the keys returned by
  * `stackClient.router.getRoute(path).routeKey`.
@@ -137,25 +189,25 @@ interface KanbanApiContext<TBody = unknown, TParams = unknown, TQuery = unknown>
  */
 interface KanbanBackendHooks {
     /**
-     * Called before listing boards. Return false to deny access.
+     * Called before listing boards. Throw an error to deny access.
      */
-    onBeforeListBoards?: (filter: z.infer<typeof BoardListQuerySchema>, context: KanbanApiContext) => Promise<boolean> | boolean;
+    onBeforeListBoards?: (filter: z.infer<typeof BoardListQuerySchema>, context: KanbanApiContext) => Promise<void> | void;
     /**
-     * Called before creating a board. Return false to deny access.
+     * Called before creating a board. Throw an error to deny access.
      */
-    onBeforeCreateBoard?: (data: z.infer<typeof createBoardSchema>, context: KanbanApiContext) => Promise<boolean> | boolean;
+    onBeforeCreateBoard?: (data: z.infer<typeof createBoardSchema>, context: KanbanApiContext) => Promise<void> | void;
     /**
-     * Called before reading a single board. Return false to deny access.
+     * Called before reading a single board. Throw an error to deny access.
      */
-    onBeforeReadBoard?: (boardId: string, context: KanbanApiContext) => Promise<boolean> | boolean;
+    onBeforeReadBoard?: (boardId: string, context: KanbanApiContext) => Promise<void> | void;
     /**
-     * Called before updating a board. Return false to deny access.
+     * Called before updating a board. Throw an error to deny access.
      */
-    onBeforeUpdateBoard?: (boardId: string, data: z.infer<typeof updateBoardSchema>, context: KanbanApiContext) => Promise<boolean> | boolean;
+    onBeforeUpdateBoard?: (boardId: string, data: z.infer<typeof updateBoardSchema>, context: KanbanApiContext) => Promise<void> | void;
     /**
-     * Called before deleting a board. Return false to deny access.
+     * Called before deleting a board. Throw an error to deny access.
      */
-    onBeforeDeleteBoard?: (boardId: string, context: KanbanApiContext) => Promise<boolean> | boolean;
+    onBeforeDeleteBoard?: (boardId: string, context: KanbanApiContext) => Promise<void> | void;
     /**
      * Called after boards are listed successfully.
      * Receives the items array (same shape as `board[]`) for consistency
@@ -199,17 +251,17 @@ interface KanbanBackendHooks {
      */
     onDeleteBoardError?: (error: Error, context: KanbanApiContext) => Promise<void> | void;
     /**
-     * Called before creating a column. Return false to deny access.
+     * Called before creating a column. Throw an error to deny access.
      */
-    onBeforeCreateColumn?: (data: z.infer<typeof createColumnSchema>, context: KanbanApiContext) => Promise<boolean> | boolean;
+    onBeforeCreateColumn?: (data: z.infer<typeof createColumnSchema>, context: KanbanApiContext) => Promise<void> | void;
     /**
-     * Called before updating a column. Return false to deny access.
+     * Called before updating a column. Throw an error to deny access.
      */
-    onBeforeUpdateColumn?: (columnId: string, data: z.infer<typeof updateColumnSchema>, context: KanbanApiContext) => Promise<boolean> | boolean;
+    onBeforeUpdateColumn?: (columnId: string, data: z.infer<typeof updateColumnSchema>, context: KanbanApiContext) => Promise<void> | void;
     /**
-     * Called before deleting a column. Return false to deny access.
+     * Called before deleting a column. Throw an error to deny access.
      */
-    onBeforeDeleteColumn?: (columnId: string, context: KanbanApiContext) => Promise<boolean> | boolean;
+    onBeforeDeleteColumn?: (columnId: string, context: KanbanApiContext) => Promise<void> | void;
     /**
      * Called after a column is created successfully
      */
@@ -223,17 +275,17 @@ interface KanbanBackendHooks {
      */
     onColumnDeleted?: (columnId: string, context: KanbanApiContext) => Promise<void> | void;
     /**
-     * Called before creating a task. Return false to deny access.
+     * Called before creating a task. Throw an error to deny access.
      */
-    onBeforeCreateTask?: (data: z.infer<typeof createTaskSchema>, context: KanbanApiContext) => Promise<boolean> | boolean;
+    onBeforeCreateTask?: (data: z.infer<typeof createTaskSchema>, context: KanbanApiContext) => Promise<void> | void;
     /**
-     * Called before updating a task. Return false to deny access.
+     * Called before updating a task. Throw an error to deny access.
      */
-    onBeforeUpdateTask?: (taskId: string, data: z.infer<typeof updateTaskSchema>, context: KanbanApiContext) => Promise<boolean> | boolean;
+    onBeforeUpdateTask?: (taskId: string, data: z.infer<typeof updateTaskSchema>, context: KanbanApiContext) => Promise<void> | void;
     /**
-     * Called before deleting a task. Return false to deny access.
+     * Called before deleting a task. Throw an error to deny access.
      */
-    onBeforeDeleteTask?: (taskId: string, context: KanbanApiContext) => Promise<boolean> | boolean;
+    onBeforeDeleteTask?: (taskId: string, context: KanbanApiContext) => Promise<void> | void;
     /**
      * Called after a task is created successfully
      */
@@ -272,11 +324,11 @@ declare const kanbanBackendPlugin: (hooks?: KanbanBackendHooks) => _btst_stack_p
         body: z.ZodObject<{
             description: z.ZodOptional<z.ZodString>;
             name: z.ZodString;
-            createdAt: z.ZodOptional<z.ZodCoercedDate<unknown>>;
-            updatedAt: z.ZodOptional<z.ZodCoercedDate<unknown>>;
             slug: z.ZodOptional<z.ZodString>;
             ownerId: z.ZodOptional<z.ZodString>;
             organizationId: z.ZodOptional<z.ZodString>;
+            createdAt: z.ZodOptional<z.ZodCoercedDate<unknown>>;
+            updatedAt: z.ZodOptional<z.ZodCoercedDate<unknown>>;
         }, z.core.$strip>;
     }, {
         columns: ColumnWithTasks[];
@@ -294,11 +346,11 @@ declare const kanbanBackendPlugin: (hooks?: KanbanBackendHooks) => _btst_stack_p
         body: z.ZodObject<{
             description: z.ZodOptional<z.ZodOptional<z.ZodString>>;
             name: z.ZodOptional<z.ZodString>;
-            createdAt: z.ZodOptional<z.ZodOptional<z.ZodCoercedDate<unknown>>>;
-            updatedAt: z.ZodOptional<z.ZodOptional<z.ZodCoercedDate<unknown>>>;
             slug: z.ZodOptional<z.ZodString>;
             ownerId: z.ZodOptional<z.ZodOptional<z.ZodString>>;
             organizationId: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+            createdAt: z.ZodOptional<z.ZodOptional<z.ZodCoercedDate<unknown>>>;
+            updatedAt: z.ZodOptional<z.ZodOptional<z.ZodCoercedDate<unknown>>>;
         }, z.core.$strip>;
     }, Board>;
     readonly deleteBoard: better_call.StrictEndpoint<"/boards/:id", {
@@ -312,8 +364,8 @@ declare const kanbanBackendPlugin: (hooks?: KanbanBackendHooks) => _btst_stack_p
             title: z.ZodString;
             createdAt: z.ZodOptional<z.ZodCoercedDate<unknown>>;
             updatedAt: z.ZodOptional<z.ZodCoercedDate<unknown>>;
-            boardId: z.ZodString;
             order: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            boardId: z.ZodString;
         }, z.core.$strip>;
     }, Column>;
     readonly updateColumn: better_call.StrictEndpoint<"/columns/:id", {
@@ -322,8 +374,8 @@ declare const kanbanBackendPlugin: (hooks?: KanbanBackendHooks) => _btst_stack_p
             title: z.ZodOptional<z.ZodString>;
             createdAt: z.ZodOptional<z.ZodOptional<z.ZodCoercedDate<unknown>>>;
             updatedAt: z.ZodOptional<z.ZodOptional<z.ZodCoercedDate<unknown>>>;
-            boardId: z.ZodOptional<z.ZodString>;
             order: z.ZodOptional<z.ZodDefault<z.ZodOptional<z.ZodNumber>>>;
+            boardId: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>;
     }, Column>;
     readonly deleteColumn: better_call.StrictEndpoint<"/columns/:id", {
@@ -406,6 +458,9 @@ declare const kanbanBackendPlugin: (hooks?: KanbanBackendHooks) => _btst_stack_p
     getAllBoards: (params?: Parameters<typeof getAllBoards>[1]) => Promise<BoardListResult>;
     getBoardById: (id: string) => Promise<BoardWithColumns | null>;
     prefetchForRoute: KanbanPrefetchForRoute;
+    createTask: (input: Parameters<typeof createKanbanTask>[1]) => Promise<Task>;
+    findOrCreateBoard: (slug: string, name: string, columnTitles: string[]) => Promise<Board>;
+    getColumnsByBoardId: (boardId: string) => Promise<Column[]>;
 }>;
 type KanbanApiRouter = ReturnType<ReturnType<typeof kanbanBackendPlugin>["routes"]>;
 
@@ -441,5 +496,5 @@ declare const KANBAN_QUERY_KEYS: {
     boardDetail: (boardId: string) => readonly ["boards", "detail", string];
 };
 
-export { getBoardById as d, KANBAN_QUERY_KEYS as e, getAllBoards as g, kanbanBackendPlugin as k };
-export type { BoardListResult as B, KanbanApiRouter as K, KanbanRouteKey as a, KanbanApiContext as b, KanbanBackendHooks as c, BoardsListDiscriminator as f };
+export { getBoardById as d, createKanbanTask as e, findOrCreateKanbanBoard as f, getAllBoards as g, getKanbanColumnsByBoardId as h, KANBAN_QUERY_KEYS as i, kanbanBackendPlugin as k };
+export type { BoardListResult as B, CreateKanbanTaskInput as C, KanbanApiRouter as K, KanbanRouteKey as a, KanbanApiContext as b, KanbanBackendHooks as c, BoardsListDiscriminator as j };

package/dist/shared/{stack.CMh_EdxW.d.cts → stack.D-b5zbPm.d.cts}

@@ -5,7 +5,7 @@ import * as _btst_stack_plugins_api from '@btst/stack/plugins/api';
 import * as better_call from 'better-call';
 import * as zod_v4_core from 'zod/v4/core';
 import * as zod from 'zod';
-import { LanguageModel, Tool } from 'ai';
+import { Tool, LanguageModel } from 'ai';
 
 /**
  * Context passed to AI Chat API hooks
@@ -24,49 +24,61 @@ interface ChatApiContext<TBody = any, TParams = any, TQuery = any> {
  */
 interface AiChatBackendHooks {
     /**
-     * Called before processing a chat message. Return false to deny access.
+     * Called before processing a chat message. Throw an error to deny access.
      * @param messages - Array of messages being sent
      * @param context - Request context with headers, etc.
      */
     onBeforeChat?: (messages: Array<{
         role: string;
         content: string;
-    }>, context: ChatApiContext) => Promise<boolean> | boolean;
+    }>, context: ChatApiContext) => Promise<void> | void;
     /**
-     * Called before listing conversations. Return false to deny access.
+     * Called before listing conversations. Throw an error to deny access.
      * @param context - Request context with headers, etc.
      */
-    onBeforeListConversations?: (context: ChatApiContext) => Promise<boolean> | boolean;
+    onBeforeListConversations?: (context: ChatApiContext) => Promise<void> | void;
     /**
-     * Called before getting a single conversation. Return false to deny access.
+     * Called before getting a single conversation. Throw an error to deny access.
      * @param conversationId - ID of the conversation being accessed
      * @param context - Request context with headers, etc.
      */
-    onBeforeGetConversation?: (conversationId: string, context: ChatApiContext) => Promise<boolean> | boolean;
+    onBeforeGetConversation?: (conversationId: string, context: ChatApiContext) => Promise<void> | void;
     /**
-     * Called before creating a conversation. Return false to deny access.
+     * Called before creating a conversation. Throw an error to deny access.
      * @param data - Conversation data being created
      * @param context - Request context with headers, etc.
      */
     onBeforeCreateConversation?: (data: {
         id?: string;
         title?: string;
-    }, context: ChatApiContext) => Promise<boolean> | boolean;
+    }, context: ChatApiContext) => Promise<void> | void;
     /**
-     * Called before updating a conversation. Return false to deny access.
+     * Called before updating a conversation. Throw an error to deny access.
      * @param conversationId - ID of the conversation being updated
      * @param data - Updated conversation data
      * @param context - Request context with headers, etc.
      */
     onBeforeUpdateConversation?: (conversationId: string, data: {
         title?: string;
-    }, context: ChatApiContext) => Promise<boolean> | boolean;
+    }, context: ChatApiContext) => Promise<void> | void;
     /**
-     * Called before deleting a conversation. Return false to deny access.
+     * Called before deleting a conversation. Throw an error to deny access.
      * @param conversationId - ID of the conversation being deleted
      * @param context - Request context with headers, etc.
      */
-    onBeforeDeleteConversation?: (conversationId: string, context: ChatApiContext) => Promise<boolean> | boolean;
+    onBeforeDeleteConversation?: (conversationId: string, context: ChatApiContext) => Promise<void> | void;
+    /**
+     * Called after the structural routeName/allowlist validation, with the list
+     * of tool names that passed. Return a filtered subset to further restrict
+     * which tools the LLM sees, or return [] to suppress all page tools.
+     * Throw an Error to abort the entire chat request with a 403 response.
+     * Not called when no tools passed the structural validation step.
+     *
+     * @param toolNames - Names that passed the routeName allowlist check
+     * @param routeName - routeName claimed by the request (may be undefined)
+     * @param context   - Full request context (headers, body, etc.)
+     */
+    onBeforeToolsActivated?: (toolNames: string[], routeName: string | undefined, context: ChatApiContext) => Promise<string[]> | string[];
     /**
      * Called after a chat message is processed successfully
      * @param conversationId - ID of the conversation
@@ -152,6 +164,23 @@ type AiChatMode = "authenticated" | "public";
 /**
  * Configuration for AI Chat backend plugin
  */
+/**
+ * Extracts only the literal (non-index-signature) keys from a type.
+ * For `Record<string, T>` this resolves to `never`, so collision checks are
+ * skipped when the tools map is typed with a broad string index.
+ */
+type KnownKeys<T> = {
+    [K in keyof T]: string extends K ? never : K;
+}[keyof T];
+/**
+ * Ensures `TClientTools` has no keys that are also literal keys in `TTools`.
+ * Colliding keys are mapped to `never`, which produces a compile-time error
+ * at the point of the duplicate key. When `TTools` uses a string index
+ * signature the check is skipped to avoid false positives.
+ */
+type NoKeyCollision<TTools, TClientTools extends Record<string, Tool>> = KnownKeys<TTools> & keyof TClientTools extends never ? TClientTools : {
+    [K in keyof TClientTools]: K extends KnownKeys<TTools> ? never : TClientTools[K];
+};
 interface AiChatBackendConfig {
     /**
      * The language model to use for chat completions.
@@ -182,6 +211,29 @@ interface AiChatBackendConfig {
      * @see https://ai-sdk.dev/docs/ai-sdk-core/tools-and-tool-calling
      */
     tools?: Record<string, Tool>;
+    /**
+     * Enable route-aware page tools.
+     * When true, the server will include tool schemas for client-side page tools
+     * (e.g. fillBlogForm, updatePageLayers) based on the availableTools list
+     * sent with each request.
+     * @default false
+     */
+    enablePageTools?: boolean;
+    /**
+     * Custom client-side tool schemas for non-BTST pages.
+     * Merged with built-in page tool schemas (fillBlogForm, updatePageLayers).
+     * Only included when enablePageTools is true and the tool name appears in
+     * the availableTools list sent with the request.
+     *
+     * @example
+     * clientToolSchemas: {
+     *   addToCart: tool({
+     *     description: "Add current product to cart",
+     *     parameters: z.object({ quantity: z.number().int().min(1) }),
+     *   }),
+     * }
+     */
+    clientToolSchemas?: Record<string, Tool>;
     /**
      * Optional hooks for customizing plugin behavior
      */
@@ -194,7 +246,10 @@ interface AiChatBackendConfig {
  *
  * @param config - Configuration including model, tools, and optional hooks
  */
-declare const aiChatBackendPlugin: (config: AiChatBackendConfig) => _btst_stack_plugins_api.BackendPlugin<{
+declare const aiChatBackendPlugin: <TTools extends Record<string, Tool> = Record<never, Tool>, TClientTools extends Record<string, Tool> = Record<never, Tool>>(config: Omit<AiChatBackendConfig, "tools" | "clientToolSchemas"> & {
+    tools?: TTools;
+    clientToolSchemas?: NoKeyCollision<TTools, TClientTools>;
+}) => _btst_stack_plugins_api.BackendPlugin<{
     chat: better_call.StrictEndpoint<"/chat", {
         method: "POST";
         body: zod.ZodObject<{
@@ -223,6 +278,9 @@ declare const aiChatBackendPlugin: (config: AiChatBackendConfig) => _btst_stack_
             }, zod_v4_core.$strip>]>>;
             conversationId: zod.ZodOptional<zod.ZodString>;
             model: zod.ZodOptional<zod.ZodString>;
+            pageContext: zod.ZodOptional<zod.ZodString>;
+            availableTools: zod.ZodOptional<zod.ZodArray<zod.ZodString>>;
+            routeName: zod.ZodOptional<zod.ZodString>;
         }, zod_v4_core.$strip>;
     }, Response>;
     createConversation: better_call.StrictEndpoint<"/chat/conversations", {

package/dist/shared/{stack.Dw0Ly2TM.d.cts → stack.DTtmJPQO.d.mts}

@@ -1,6 +1,6 @@
 import * as _btst_stack_plugins_api from '@btst/stack/plugins/api';
 import * as better_call from 'better-call';
-import { S as SerializedForm, b as SerializedFormSubmissionWithData, F as Form, d as FormSubmission, a as SerializedFormSubmission, e as FormSubmissionWithForm, f as FormBuilderBackendConfig } from './stack.DdI5W6MB.cjs';
+import { S as SerializedForm, b as SerializedFormSubmissionWithData, F as Form, d as FormSubmission, a as SerializedFormSubmission, e as FormSubmissionWithForm, f as FormBuilderBackendConfig } from './stack.BozPgbrZ.mjs';
 import { z } from 'zod';
 import { Adapter } from '@btst/db';
 import { QueryClient } from '@tanstack/react-query';