@btst/stack 3.0.0-rc.1 → 3.0.0-rc.3

package/dist/plugins/media/client/index.d.mts

@@ -1,93 +1,14 @@
-import * as _btst_stack_plugins_client from '@btst/stack/plugins/client';
+import * as _btst_stack_client from '@btst/stack/client';
 import * as _btst_yar from '@btst/yar';
+import * as React from 'react';
 import { ComponentType } from 'react';
-import { QueryClient } from '@tanstack/react-query';
+import { a as MediaIdentityPartition } from '../../../shared/stack.Cbd7sD5M.mjs';
 import { L as LibraryPageComponent } from '../../../shared/stack.Dg_m1SkT.mjs';
-import { S as SerializedAsset } from '../../../shared/stack.BMlLOMED.mjs';
+import { S as SerializedAsset } from '../../../shared/stack.DjGixVx3.mjs';
+import '@btst/db';
+import '@btst/stack/context';
 import 'react/jsx-runtime';
 
-interface MediaLoaderContext {
-    path: string;
-    isSSR: boolean;
-    apiBaseURL: string;
-    apiBasePath: string;
-    headers?: HeadersInit;
-}
-interface MediaClientHooks {
-    /** Called before the media library data is fetched during SSR. Throw to cancel. */
-    beforeLoadLibrary?: (context: MediaLoaderContext) => Promise<void> | void;
-    /** Called after the media library data is fetched during SSR. */
-    afterLoadLibrary?: (context: MediaLoaderContext) => Promise<void> | void;
-    /** Called when an error occurs during the SSR loader. */
-    onLoadError?: (error: Error, context: MediaLoaderContext) => Promise<void> | void;
-}
-interface MediaClientConfig {
-    /** Base URL for API calls (e.g., "http://localhost:3000") */
-    apiBaseURL: string;
-    /** Path where the API is mounted (e.g., "/api/data") */
-    apiBasePath: string;
-    /** Base URL of your site for SEO meta tags */
-    siteBaseURL: string;
-    /** Path where pages are mounted (e.g., "/pages") */
-    siteBasePath: string;
-    /** React Query client — used by the SSR loader to prefetch data */
-    queryClient: QueryClient;
-    /** Optional headers forwarded with SSR API requests (e.g. auth cookies) */
-    headers?: HeadersInit;
-    /** Optional lifecycle hooks for the media client plugin */
-    hooks?: MediaClientHooks;
-    /**
-     * Optional page component overrides.
-     * Replace any plugin page with a custom React component.
-     * The built-in component is used as the fallback when not provided.
-     */
-    pageComponents?: {
-        /** Replaces the media library page */
-        library?: ComponentType;
-    };
-}
-/**
- * Media client plugin.
- * Registers the /media library route.
- *
- * Configure overrides in StackProvider:
- * ```tsx
- * <StackProvider overrides={{ media: { apiBaseURL, apiBasePath, queryClient, uploadMode: "direct", navigate } }}>
- * ```
- *
- * @example
- * ```ts
- * import { mediaClientPlugin } from "@btst/stack/plugins/media/client"
- *
- * const clientPlugins = [
- *   mediaClientPlugin({ apiBaseURL, apiBasePath, siteBaseURL, siteBasePath, queryClient }),
- *   // ...other plugins
- * ]
- * ```
- */
-declare const mediaClientPlugin: (config: MediaClientConfig) => _btst_stack_plugins_client.ClientPlugin<Record<string, never>, {
-    library: _btst_yar.DefinedRoute<"/media", {
-        readonly page: typeof LibraryPageComponent;
-        readonly loader: () => Promise<void>;
-        readonly meta: () => ({
-            title: string;
-            name?: undefined;
-            content?: undefined;
-            property?: undefined;
-        } | {
-            name: string;
-            content: string;
-            title?: undefined;
-            property?: undefined;
-        } | {
-            property: string;
-            content: string;
-            title?: undefined;
-            name?: undefined;
-        })[];
-    }, _btst_yar.RouteMeta>;
-}>;
-
 /**
  * Canvas-based client-side image compression.
  *
@@ -125,6 +46,11 @@ interface ImageCompressionOptions {
  * - `"vercel-blob"` — Vercel Blob, uses the `@vercel/blob/client` SDK for direct upload
  */
 type MediaUploadMode = "direct" | "s3" | "vercel-blob";
+/** Browser-safe Media factory values carried by the resolved client stack. */
+interface MediaProviderConfig {
+    /** Upload transport matching the server-side storage adapter. */
+    readonly uploadMode?: MediaUploadMode;
+}
 /**
  * Overridable components and functions for the Media plugin.
  *
@@ -132,19 +58,6 @@ type MediaUploadMode = "direct" | "s3" | "vercel-blob";
  * via the StackProvider overrides.
  */
 interface MediaPluginOverrides {
-    /**
-     * React Query client — used by the MediaPicker to cache and fetch assets.
-     */
-    queryClient: QueryClient;
-    /**
-     * Upload mode — must match the storageAdapter configured in mediaBackendPlugin.
-     * @default "direct"
-     */
-    uploadMode?: MediaUploadMode;
-    /**
-     * Optional headers to pass with API requests (e.g., for SSR auth).
-     */
-    headers?: HeadersInit;
     /**
      * Client-side image compression applied before upload via the Canvas API.
      *
@@ -176,17 +89,116 @@ interface MediaRouteContext {
     [key: string]: unknown;
 }
 
+/** Resolved request context supplied to Media SSR loader hooks. */
+interface MediaLoaderContext {
+    /** Normalized Media route path being loaded. */
+    path: string;
+    /** Whether the hook is running during server-side rendering. */
+    isSSR: boolean;
+    /** Resolved absolute origin for the Media backend. */
+    apiBaseURL: string;
+    /** Resolved path where the Media backend is mounted. */
+    apiBasePath: string;
+    /** Request-scoped server headers used by the Media SSR loader. */
+    headers?: Headers;
+}
+interface MediaClientHooks {
+    /** Called before the media library data is fetched during SSR. Throw to cancel. */
+    beforeLoadLibrary?: (context: MediaLoaderContext) => Promise<void> | void;
+    /** Called after the media library data is fetched during SSR. */
+    afterLoadLibrary?: (context: MediaLoaderContext) => Promise<void> | void;
+    /**
+     * Reports an SSR loader failure once. Callback failures are contained and
+     * cannot make the loader reject.
+     */
+    onErrorLoad?: (error: Error, context: MediaLoaderContext) => Promise<void> | void;
+}
+/**
+ * Media-specific client configuration. Shared API, site, query-client, and
+ * request-header values are inherited from `createClientStack()`.
+ */
+interface MediaClientConfig {
+    /** Upload transport matching the storage adapter configured on the backend. */
+    uploadMode?: MediaUploadMode;
+    /** Identity snapshot used to align protected SSR prefetch and browser keys. */
+    identityPartition?: MediaIdentityPartition;
+    /** Optional lifecycle hooks for the media client plugin. */
+    hooks?: MediaClientHooks;
+    /** Optional replacement for the media library page. */
+    pageComponents?: {
+        library?: ComponentType;
+    };
+}
+/** Registers the Media library against the enclosing resolved client runtime. */
+declare const mediaClientPlugin: (config?: MediaClientConfig) => _btst_stack_client.ClientPluginDefinition<MediaPluginOverrides, {
+    library: _btst_yar.DefinedRoute<"/media", {
+        readonly page: React.LazyExoticComponent<typeof LibraryPageComponent>;
+        readonly loader: () => Promise<void>;
+        readonly meta: () => ({
+            title: string;
+            name?: undefined;
+            content?: undefined;
+            property?: undefined;
+        } | {
+            name: string;
+            content: string;
+            title?: undefined;
+            property?: undefined;
+        } | {
+            property: string;
+            content: string;
+            title?: undefined;
+            name?: undefined;
+        })[];
+    }, _btst_yar.RouteMeta>;
+}, "media", {
+    uploadMode?: MediaUploadMode | undefined;
+}, never>;
+
+/** Transport and preprocessing options for an imperative Media upload. */
 interface MediaUploadClientConfig {
+    /** Resolved Media API base URL. */
     apiBaseURL: string;
+    /** Mount path of the resolved Media API endpoint. */
     apiBasePath: string;
+    /** Browser-safe headers sent with Media API requests. Never include secrets. */
     headers?: HeadersInit;
+    /**
+     * Fetch credentials mode applied only to Media API requests.
+     * Configure this explicitly when a cross-origin Media endpoint accepts
+     * browser credentials. It is not forwarded to storage upload URLs and does
+     * not make server-only headers safe to expose.
+     */
+    credentials?: RequestCredentials;
+    /** Upload transport matching the backend Media storage adapter. Defaults to `"direct"`. */
     uploadMode?: MediaUploadMode;
+    /** Client-side image compression options, or `false` to skip compression. */
     imageCompression?: ImageCompressionOptions | false;
 }
+/** Browser-safe Media runtime exposed as `stack.provider.plugins.media`. */
+interface MediaUploadProviderRuntime {
+    /** Resolved browser transport for the Media API. */
+    readonly api: {
+        /** Resolved Media API base URL. */
+        readonly baseURL: string;
+        /** Media API mount path. */
+        readonly basePath: string;
+        /** Explicitly public headers safe to expose to browser code. */
+        readonly browserHeaders?: HeadersInit;
+        /** Explicit browser Fetch credentials behavior. */
+        readonly credentials?: RequestCredentials;
+    };
+    /** Browser-safe Media factory configuration. */
+    readonly config?: MediaProviderConfig;
+}
 interface UploadAssetInput {
     file: File;
     folderId?: string;
 }
+/**
+ * Bind imperative uploads to the Media endpoint resolved by `createClientStack`.
+ */
+declare function createMediaUploadConfig(runtime: MediaUploadProviderRuntime, overrides?: Pick<MediaUploadClientConfig, "imageCompression">): MediaUploadClientConfig;
 /**
  * Upload an asset using the media plugin's configured storage mode.
  *
@@ -196,5 +208,5 @@ interface UploadAssetInput {
  */
 declare function uploadAsset(config: MediaUploadClientConfig, input: UploadAssetInput): Promise<SerializedAsset>;
 
-export { mediaClientPlugin, uploadAsset };
-export type { MediaPluginOverrides, MediaUploadClientConfig, MediaUploadMode, UploadAssetInput };
+export { createMediaUploadConfig, mediaClientPlugin, uploadAsset };
+export type { MediaClientConfig, MediaClientHooks, MediaLoaderContext, MediaPluginOverrides, MediaProviderConfig, MediaUploadClientConfig, MediaUploadMode, MediaUploadProviderRuntime, UploadAssetInput };

package/dist/plugins/media/client/index.d.ts

@@ -1,93 +1,14 @@
-import * as _btst_stack_plugins_client from '@btst/stack/plugins/client';
+import * as _btst_stack_client from '@btst/stack/client';
 import * as _btst_yar from '@btst/yar';
+import * as React from 'react';
 import { ComponentType } from 'react';
-import { QueryClient } from '@tanstack/react-query';
+import { a as MediaIdentityPartition } from '../../../shared/stack.BMmvEBH_.js';
 import { L as LibraryPageComponent } from '../../../shared/stack.Dg_m1SkT.js';
-import { S as SerializedAsset } from '../../../shared/stack.BMlLOMED.js';
+import { S as SerializedAsset } from '../../../shared/stack.DjGixVx3.js';
+import '@btst/db';
+import '@btst/stack/context';
 import 'react/jsx-runtime';
 
-interface MediaLoaderContext {
-    path: string;
-    isSSR: boolean;
-    apiBaseURL: string;
-    apiBasePath: string;
-    headers?: HeadersInit;
-}
-interface MediaClientHooks {
-    /** Called before the media library data is fetched during SSR. Throw to cancel. */
-    beforeLoadLibrary?: (context: MediaLoaderContext) => Promise<void> | void;
-    /** Called after the media library data is fetched during SSR. */
-    afterLoadLibrary?: (context: MediaLoaderContext) => Promise<void> | void;
-    /** Called when an error occurs during the SSR loader. */
-    onLoadError?: (error: Error, context: MediaLoaderContext) => Promise<void> | void;
-}
-interface MediaClientConfig {
-    /** Base URL for API calls (e.g., "http://localhost:3000") */
-    apiBaseURL: string;
-    /** Path where the API is mounted (e.g., "/api/data") */
-    apiBasePath: string;
-    /** Base URL of your site for SEO meta tags */
-    siteBaseURL: string;
-    /** Path where pages are mounted (e.g., "/pages") */
-    siteBasePath: string;
-    /** React Query client — used by the SSR loader to prefetch data */
-    queryClient: QueryClient;
-    /** Optional headers forwarded with SSR API requests (e.g. auth cookies) */
-    headers?: HeadersInit;
-    /** Optional lifecycle hooks for the media client plugin */
-    hooks?: MediaClientHooks;
-    /**
-     * Optional page component overrides.
-     * Replace any plugin page with a custom React component.
-     * The built-in component is used as the fallback when not provided.
-     */
-    pageComponents?: {
-        /** Replaces the media library page */
-        library?: ComponentType;
-    };
-}
-/**
- * Media client plugin.
- * Registers the /media library route.
- *
- * Configure overrides in StackProvider:
- * ```tsx
- * <StackProvider overrides={{ media: { apiBaseURL, apiBasePath, queryClient, uploadMode: "direct", navigate } }}>
- * ```
- *
- * @example
- * ```ts
- * import { mediaClientPlugin } from "@btst/stack/plugins/media/client"
- *
- * const clientPlugins = [
- *   mediaClientPlugin({ apiBaseURL, apiBasePath, siteBaseURL, siteBasePath, queryClient }),
- *   // ...other plugins
- * ]
- * ```
- */
-declare const mediaClientPlugin: (config: MediaClientConfig) => _btst_stack_plugins_client.ClientPlugin<Record<string, never>, {
-    library: _btst_yar.DefinedRoute<"/media", {
-        readonly page: typeof LibraryPageComponent;
-        readonly loader: () => Promise<void>;
-        readonly meta: () => ({
-            title: string;
-            name?: undefined;
-            content?: undefined;
-            property?: undefined;
-        } | {
-            name: string;
-            content: string;
-            title?: undefined;
-            property?: undefined;
-        } | {
-            property: string;
-            content: string;
-            title?: undefined;
-            name?: undefined;
-        })[];
-    }, _btst_yar.RouteMeta>;
-}>;
-
 /**
  * Canvas-based client-side image compression.
  *
@@ -125,6 +46,11 @@ interface ImageCompressionOptions {
  * - `"vercel-blob"` — Vercel Blob, uses the `@vercel/blob/client` SDK for direct upload
  */
 type MediaUploadMode = "direct" | "s3" | "vercel-blob";
+/** Browser-safe Media factory values carried by the resolved client stack. */
+interface MediaProviderConfig {
+    /** Upload transport matching the server-side storage adapter. */
+    readonly uploadMode?: MediaUploadMode;
+}
 /**
  * Overridable components and functions for the Media plugin.
  *
@@ -132,19 +58,6 @@ type MediaUploadMode = "direct" | "s3" | "vercel-blob";
  * via the StackProvider overrides.
  */
 interface MediaPluginOverrides {
-    /**
-     * React Query client — used by the MediaPicker to cache and fetch assets.
-     */
-    queryClient: QueryClient;
-    /**
-     * Upload mode — must match the storageAdapter configured in mediaBackendPlugin.
-     * @default "direct"
-     */
-    uploadMode?: MediaUploadMode;
-    /**
-     * Optional headers to pass with API requests (e.g., for SSR auth).
-     */
-    headers?: HeadersInit;
     /**
      * Client-side image compression applied before upload via the Canvas API.
      *
@@ -176,17 +89,116 @@ interface MediaRouteContext {
     [key: string]: unknown;
 }
 
+/** Resolved request context supplied to Media SSR loader hooks. */
+interface MediaLoaderContext {
+    /** Normalized Media route path being loaded. */
+    path: string;
+    /** Whether the hook is running during server-side rendering. */
+    isSSR: boolean;
+    /** Resolved absolute origin for the Media backend. */
+    apiBaseURL: string;
+    /** Resolved path where the Media backend is mounted. */
+    apiBasePath: string;
+    /** Request-scoped server headers used by the Media SSR loader. */
+    headers?: Headers;
+}
+interface MediaClientHooks {
+    /** Called before the media library data is fetched during SSR. Throw to cancel. */
+    beforeLoadLibrary?: (context: MediaLoaderContext) => Promise<void> | void;
+    /** Called after the media library data is fetched during SSR. */
+    afterLoadLibrary?: (context: MediaLoaderContext) => Promise<void> | void;
+    /**
+     * Reports an SSR loader failure once. Callback failures are contained and
+     * cannot make the loader reject.
+     */
+    onErrorLoad?: (error: Error, context: MediaLoaderContext) => Promise<void> | void;
+}
+/**
+ * Media-specific client configuration. Shared API, site, query-client, and
+ * request-header values are inherited from `createClientStack()`.
+ */
+interface MediaClientConfig {
+    /** Upload transport matching the storage adapter configured on the backend. */
+    uploadMode?: MediaUploadMode;
+    /** Identity snapshot used to align protected SSR prefetch and browser keys. */
+    identityPartition?: MediaIdentityPartition;
+    /** Optional lifecycle hooks for the media client plugin. */
+    hooks?: MediaClientHooks;
+    /** Optional replacement for the media library page. */
+    pageComponents?: {
+        library?: ComponentType;
+    };
+}
+/** Registers the Media library against the enclosing resolved client runtime. */
+declare const mediaClientPlugin: (config?: MediaClientConfig) => _btst_stack_client.ClientPluginDefinition<MediaPluginOverrides, {
+    library: _btst_yar.DefinedRoute<"/media", {
+        readonly page: React.LazyExoticComponent<typeof LibraryPageComponent>;
+        readonly loader: () => Promise<void>;
+        readonly meta: () => ({
+            title: string;
+            name?: undefined;
+            content?: undefined;
+            property?: undefined;
+        } | {
+            name: string;
+            content: string;
+            title?: undefined;
+            property?: undefined;
+        } | {
+            property: string;
+            content: string;
+            title?: undefined;
+            name?: undefined;
+        })[];
+    }, _btst_yar.RouteMeta>;
+}, "media", {
+    uploadMode?: MediaUploadMode | undefined;
+}, never>;
+
+/** Transport and preprocessing options for an imperative Media upload. */
 interface MediaUploadClientConfig {
+    /** Resolved Media API base URL. */
     apiBaseURL: string;
+    /** Mount path of the resolved Media API endpoint. */
     apiBasePath: string;
+    /** Browser-safe headers sent with Media API requests. Never include secrets. */
     headers?: HeadersInit;
+    /**
+     * Fetch credentials mode applied only to Media API requests.
+     * Configure this explicitly when a cross-origin Media endpoint accepts
+     * browser credentials. It is not forwarded to storage upload URLs and does
+     * not make server-only headers safe to expose.
+     */
+    credentials?: RequestCredentials;
+    /** Upload transport matching the backend Media storage adapter. Defaults to `"direct"`. */
     uploadMode?: MediaUploadMode;
+    /** Client-side image compression options, or `false` to skip compression. */
     imageCompression?: ImageCompressionOptions | false;
 }
+/** Browser-safe Media runtime exposed as `stack.provider.plugins.media`. */
+interface MediaUploadProviderRuntime {
+    /** Resolved browser transport for the Media API. */
+    readonly api: {
+        /** Resolved Media API base URL. */
+        readonly baseURL: string;
+        /** Media API mount path. */
+        readonly basePath: string;
+        /** Explicitly public headers safe to expose to browser code. */
+        readonly browserHeaders?: HeadersInit;
+        /** Explicit browser Fetch credentials behavior. */
+        readonly credentials?: RequestCredentials;
+    };
+    /** Browser-safe Media factory configuration. */
+    readonly config?: MediaProviderConfig;
+}
 interface UploadAssetInput {
     file: File;
     folderId?: string;
 }
+/**
+ * Bind imperative uploads to the Media endpoint resolved by `createClientStack`.
+ */
+declare function createMediaUploadConfig(runtime: MediaUploadProviderRuntime, overrides?: Pick<MediaUploadClientConfig, "imageCompression">): MediaUploadClientConfig;
 /**
  * Upload an asset using the media plugin's configured storage mode.
  *
@@ -196,5 +208,5 @@ interface UploadAssetInput {
  */
 declare function uploadAsset(config: MediaUploadClientConfig, input: UploadAssetInput): Promise<SerializedAsset>;
 
-export { mediaClientPlugin, uploadAsset };
-export type { MediaPluginOverrides, MediaUploadClientConfig, MediaUploadMode, UploadAssetInput };
+export { createMediaUploadConfig, mediaClientPlugin, uploadAsset };
+export type { MediaClientConfig, MediaClientHooks, MediaLoaderContext, MediaPluginOverrides, MediaProviderConfig, MediaUploadClientConfig, MediaUploadMode, MediaUploadProviderRuntime, UploadAssetInput };

package/dist/plugins/media/client/index.mjs

@@ -1,2 +1,2 @@
 export { mediaClientPlugin } from '../../../packages/stack/src/plugins/media/client/plugin.mjs';
-export { uploadAsset } from '../../../packages/stack/src/plugins/media/client/upload.mjs';
+export { createMediaUploadConfig, uploadAsset } from '../../../packages/stack/src/plugins/media/client/upload.mjs';

package/dist/plugins/media/permissions.cjs

@@ -0,0 +1,63 @@
+'use strict';
+
+const authorization = require('@btst/stack/authorization');
+const z = require('zod');
+
+const tenantFact = { tenantId: z.z.string().optional() };
+const folderFact = {
+  folderId: z.z.string(),
+  parentId: z.z.string().optional(),
+  ...tenantFact
+};
+const assetFact = {
+  assetId: z.z.string(),
+  folderId: z.z.string().optional(),
+  mimeType: z.z.string(),
+  ...tenantFact
+};
+const mediaPermissions = authorization.definePermissions("media", {
+  library: {
+    /** Read the server-scoped asset/folder collection used by the library and picker. */
+    read: authorization.permission()
+  },
+  asset: {
+    /** Receive, present, or select one asset from an authorized collection read. */
+    read: authorization.permission(z.z.object(assetFact)),
+    /**
+     * Start or finish an upload. `callback` is reserved for a provider-verified
+     * completion callback whose context was bound into the server-issued token.
+     */
+    upload: authorization.permission(
+      z.z.object({
+        phase: z.z.enum(["initialize", "direct", "finalize", "callback"]),
+        folderId: z.z.string().optional(),
+        /** Omitted by pre-file browser gates; server operations always derive it. */
+        mimeType: z.z.string().optional(),
+        ...tenantFact
+      })
+    ),
+    /** Update a server-resolved asset. */
+    update: authorization.permission(
+      z.z.object({
+        ...assetFact,
+        /** `null` means moving to root; omitted means the folder is unchanged. */
+        targetFolderId: z.z.string().nullable().optional()
+      })
+    ),
+    /** Delete a server-resolved asset and its storage object. */
+    delete: authorization.permission(z.z.object(assetFact))
+  },
+  folder: {
+    /** Create a folder beneath a server-resolved parent. */
+    create: authorization.permission(
+      z.z.object({
+        parentId: z.z.string().optional(),
+        ...tenantFact
+      })
+    ),
+    /** Delete a server-resolved folder after authorizing every folder in its subtree. */
+    delete: authorization.permission(z.z.object(folderFact))
+  }
+});
+
+exports.mediaPermissions = mediaPermissions;

package/dist/plugins/media/permissions.d.cts

@@ -0,0 +1,64 @@
+import * as _btst_stack_authorization from '@btst/stack/authorization';
+import { z } from 'zod';
+
+/** Browser-safe, schema-backed permissions published by Media. */
+declare const mediaPermissions: _btst_stack_authorization.PermissionCatalog<"media", {
+    readonly library: {
+        /** Read the server-scoped asset/folder collection used by the library and picker. */
+        readonly read: _btst_stack_authorization.PermissionSeed<undefined>;
+    };
+    readonly asset: {
+        /** Receive, present, or select one asset from an authorized collection read. */
+        readonly read: _btst_stack_authorization.PermissionSeed<z.ZodObject<{
+            tenantId: z.ZodOptional<z.ZodString>;
+            assetId: z.ZodString;
+            folderId: z.ZodOptional<z.ZodString>;
+            mimeType: z.ZodString;
+        }, z.core.$strip>>;
+        /**
+         * Start or finish an upload. `callback` is reserved for a provider-verified
+         * completion callback whose context was bound into the server-issued token.
+         */
+        readonly upload: _btst_stack_authorization.PermissionSeed<z.ZodObject<{
+            tenantId: z.ZodOptional<z.ZodString>;
+            phase: z.ZodEnum<{
+                initialize: "initialize";
+                direct: "direct";
+                finalize: "finalize";
+                callback: "callback";
+            }>;
+            folderId: z.ZodOptional<z.ZodString>;
+            mimeType: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        /** Update a server-resolved asset. */
+        readonly update: _btst_stack_authorization.PermissionSeed<z.ZodObject<{
+            targetFolderId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            tenantId: z.ZodOptional<z.ZodString>;
+            assetId: z.ZodString;
+            folderId: z.ZodOptional<z.ZodString>;
+            mimeType: z.ZodString;
+        }, z.core.$strip>>;
+        /** Delete a server-resolved asset and its storage object. */
+        readonly delete: _btst_stack_authorization.PermissionSeed<z.ZodObject<{
+            tenantId: z.ZodOptional<z.ZodString>;
+            assetId: z.ZodString;
+            folderId: z.ZodOptional<z.ZodString>;
+            mimeType: z.ZodString;
+        }, z.core.$strip>>;
+    };
+    readonly folder: {
+        /** Create a folder beneath a server-resolved parent. */
+        readonly create: _btst_stack_authorization.PermissionSeed<z.ZodObject<{
+            tenantId: z.ZodOptional<z.ZodString>;
+            parentId: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        /** Delete a server-resolved folder after authorizing every folder in its subtree. */
+        readonly delete: _btst_stack_authorization.PermissionSeed<z.ZodObject<{
+            tenantId: z.ZodOptional<z.ZodString>;
+            folderId: z.ZodString;
+            parentId: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+    };
+}>;
+
+export { mediaPermissions };