@btst/stack 3.0.0-rc.2 → 3.0.0-rc.4

package/dist/shared/stack.CvlC5kqe.d.cts

@@ -0,0 +1,331 @@
+import { PermissionFactsFor } from '@btst/stack/authorization';
+import { StackIdentity } from '@btst/stack/context';
+import { DeepReadonly } from '@btst/stack/plugins/api';
+import { z } from 'zod';
+import { kanbanPermissions } from '../plugins/kanban/permissions.cjs';
+
+/** Browser-safe board create input. Ownership and timestamps are server-owned. */
+declare const createBoardSchema: z.ZodObject<{
+    slug: z.ZodOptional<z.ZodString>;
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** Browser-safe board update input. Ownership and timestamps are server-owned. */
+declare const updateBoardSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    slug: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    id: z.ZodNonOptional<z.ZodOptional<z.ZodString>>;
+}, z.core.$strip>;
+/** Browser-safe column create input. Server-owned timestamps are not accepted. */
+declare const createColumnSchema: z.ZodObject<{
+    title: z.ZodString;
+    order: z.ZodOptional<z.ZodNumber>;
+    boardId: z.ZodString;
+}, z.core.$strip>;
+/** Browser-safe column update input. Server-owned timestamps are not accepted. */
+declare const updateColumnSchema: z.ZodObject<{
+    title: z.ZodOptional<z.ZodString>;
+    order: z.ZodOptional<z.ZodOptional<z.ZodNumber>>;
+    boardId: z.ZodOptional<z.ZodString>;
+    id: z.ZodNonOptional<z.ZodOptional<z.ZodString>>;
+}, z.core.$strip>;
+/** Browser-safe task create input. Dates cross the boundary as ISO strings. */
+declare const createTaskSchema: z.ZodObject<{
+    completedAt: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodISODateTime, z.ZodDate]>, z.ZodTransform<string, string | Date>>>;
+    title: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    priority: z.ZodOptional<z.ZodEnum<{
+        LOW: "LOW";
+        MEDIUM: "MEDIUM";
+        HIGH: "HIGH";
+        URGENT: "URGENT";
+    }>>;
+    order: z.ZodOptional<z.ZodNumber>;
+    columnId: z.ZodString;
+    assigneeId: z.ZodNullable<z.ZodOptional<z.ZodString>>;
+    isArchived: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+/** Browser-safe task update input. Dates cross the boundary as ISO strings. */
+declare const updateTaskSchema: z.ZodObject<{
+    completedAt: z.ZodOptional<z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodISODateTime, z.ZodDate]>, z.ZodTransform<string, string | Date>>>>;
+    title: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    priority: z.ZodOptional<z.ZodOptional<z.ZodEnum<{
+        LOW: "LOW";
+        MEDIUM: "MEDIUM";
+        HIGH: "HIGH";
+        URGENT: "URGENT";
+    }>>>;
+    order: z.ZodOptional<z.ZodOptional<z.ZodNumber>>;
+    columnId: z.ZodOptional<z.ZodString>;
+    assigneeId: z.ZodOptional<z.ZodNullable<z.ZodOptional<z.ZodString>>>;
+    isArchived: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
+    id: z.ZodNonOptional<z.ZodOptional<z.ZodString>>;
+}, z.core.$strip>;
+declare const BoardListQuerySchema: z.ZodObject<{
+    slug: z.ZodOptional<z.ZodString>;
+    ownerId: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    offset: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    limit: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+}, z.core.$strip>;
+declare const reorderColumnsSchema: z.ZodObject<{
+    boardId: z.ZodString;
+    columnIds: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+declare const reorderTasksSchema: z.ZodObject<{
+    columnId: z.ZodString;
+    taskIds: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+declare const moveTaskSchema: z.ZodObject<{
+    taskId: z.ZodString;
+    targetColumnId: z.ZodString;
+    targetOrder: z.ZodNumber;
+}, z.core.$strip>;
+
+/**
+ * Priority levels for tasks
+ */
+type Priority = "LOW" | "MEDIUM" | "HIGH" | "URGENT";
+/**
+ * Kanban Board
+ */
+type Board = {
+    id: string;
+    name: string;
+    slug: string;
+    description?: string;
+    ownerId?: string;
+    organizationId?: string;
+    createdAt: Date;
+    updatedAt: Date;
+};
+/**
+ * Kanban Column
+ */
+type Column = {
+    id: string;
+    title: string;
+    order: number;
+    boardId: string;
+    createdAt: Date;
+    updatedAt: Date;
+};
+/**
+ * Kanban Task
+ */
+type Task = {
+    id: string;
+    title: string;
+    description?: string;
+    priority: Priority;
+    order: number;
+    columnId: string;
+    assigneeId?: string | null;
+    completedAt?: Date;
+    isArchived: boolean;
+    createdAt: Date;
+    updatedAt: Date;
+};
+/**
+ * Column with its tasks
+ */
+type ColumnWithTasks = Column & {
+    tasks: Task[];
+};
+/**
+ * Board with columns and tasks
+ */
+type BoardWithColumns = Board & {
+    columns: ColumnWithTasks[];
+};
+/** Board with column metadata only, used by collection reads. */
+type BoardWithColumnsOnly = Board & {
+    columns: Column[];
+};
+interface SerializedTask extends Omit<Task, "createdAt" | "updatedAt" | "completedAt"> {
+    completedAt?: string;
+    createdAt: string;
+    updatedAt: string;
+}
+interface SerializedColumn extends Omit<Column, "createdAt" | "updatedAt"> {
+    createdAt: string;
+    updatedAt: string;
+    tasks?: SerializedTask[];
+}
+interface SerializedBoard extends Omit<Board, "createdAt" | "updatedAt"> {
+    createdAt: string;
+    updatedAt: string;
+    columns?: SerializedColumn[];
+}
+interface SerializedBoardWithColumns extends SerializedBoard {
+    columns: SerializedColumn[];
+}
+/** Board summary returned by the collection operation (task rows are omitted). */
+interface SerializedBoardSummary extends Omit<SerializedBoard, "columns"> {
+    columns: ReadonlyArray<Omit<SerializedColumn, "tasks">>;
+}
+/** Typed, immutable context passed to Kanban lifecycle hooks after authorization. */
+interface KanbanApiContext<TInput = unknown, TFacts = unknown> {
+    readonly input: DeepReadonly<TInput>;
+    readonly facts: DeepReadonly<TFacts>;
+    readonly identity: DeepReadonly<StackIdentity> | null;
+    readonly request?: Request;
+    readonly headers?: Headers;
+    /** @deprecated Read validated values from `input`. */
+    readonly body?: unknown;
+    /** @deprecated Read validated values from `input`. */
+    readonly params?: unknown;
+    /** @deprecated Read validated values from `input`. */
+    readonly query?: unknown;
+}
+/** Lifecycle context for an operation that completed successfully. */
+interface KanbanApiResultContext<TInput = unknown, TFacts = unknown, TResult = unknown> extends KanbanApiContext<TInput, TFacts> {
+    readonly result: DeepReadonly<TResult>;
+}
+type BoardReadFacts = PermissionFactsFor<typeof kanbanPermissions.board.read>;
+type BoardCreateFacts = PermissionFactsFor<typeof kanbanPermissions.board.create>;
+type BoardUpdateFacts = PermissionFactsFor<typeof kanbanPermissions.board.update>;
+type BoardDeleteFacts = PermissionFactsFor<typeof kanbanPermissions.board.delete>;
+type ColumnCreateFacts = PermissionFactsFor<typeof kanbanPermissions.column.create>;
+type ColumnUpdateFacts = PermissionFactsFor<typeof kanbanPermissions.column.update>;
+type ColumnDeleteFacts = PermissionFactsFor<typeof kanbanPermissions.column.delete>;
+type ColumnReorderFacts = PermissionFactsFor<typeof kanbanPermissions.column.reorder>;
+type TaskCreateFacts = PermissionFactsFor<typeof kanbanPermissions.task.create>;
+type TaskUpdateFacts = PermissionFactsFor<typeof kanbanPermissions.task.update>;
+type TaskDeleteFacts = PermissionFactsFor<typeof kanbanPermissions.task.delete>;
+type TaskMoveFacts = PermissionFactsFor<typeof kanbanPermissions.task.move>;
+type TaskReorderFacts = PermissionFactsFor<typeof kanbanPermissions.task.reorder>;
+type UpdateBoardInput = {
+    id: string;
+    data: Omit<z.output<typeof updateBoardSchema>, "id">;
+};
+type UpdateColumnInput = {
+    id: string;
+    data: Omit<z.output<typeof updateColumnSchema>, "id">;
+};
+type UpdateTaskInput = {
+    id: string;
+    data: Omit<z.output<typeof updateTaskSchema>, "id">;
+};
+/** Context for the board collection operation. */
+type BoardListOperationContext = KanbanApiContext<z.output<typeof BoardListQuerySchema>, BoardReadFacts>;
+/** Successful result context for the board collection operation. */
+type BoardListOperationResultContext = KanbanApiResultContext<z.output<typeof BoardListQuerySchema>, BoardReadFacts, {
+    items: readonly SerializedBoardSummary[];
+    total: number;
+    limit?: number;
+    offset?: number;
+}>;
+/** Context for reading one board. */
+type BoardReadOperationContext = KanbanApiContext<{
+    id: string;
+}, BoardReadFacts>;
+/** Successful result context for reading one board. */
+type BoardReadOperationResultContext = KanbanApiResultContext<{
+    id: string;
+}, BoardReadFacts, SerializedBoardWithColumns>;
+/** Context for creating one board. */
+type BoardCreateOperationContext = KanbanApiContext<z.output<typeof createBoardSchema>, BoardCreateFacts>;
+/** Successful result context for creating one board. */
+type BoardCreateOperationResultContext = KanbanApiResultContext<z.output<typeof createBoardSchema>, BoardCreateFacts, SerializedBoardWithColumns>;
+/** Context for updating one board. */
+type BoardUpdateOperationContext = KanbanApiContext<UpdateBoardInput, BoardUpdateFacts>;
+/** Successful result context for updating one board. */
+type BoardUpdateOperationResultContext = KanbanApiResultContext<UpdateBoardInput, BoardUpdateFacts, SerializedBoard>;
+/** Context for deleting one board. */
+type BoardDeleteOperationContext = KanbanApiContext<{
+    id: string;
+}, BoardDeleteFacts>;
+/** Successful result context for deleting one board. */
+type BoardDeleteOperationResultContext = KanbanApiResultContext<{
+    id: string;
+}, BoardDeleteFacts, {
+    success: true;
+}>;
+/** Context for creating one column. */
+type ColumnCreateOperationContext = KanbanApiContext<z.output<typeof createColumnSchema>, ColumnCreateFacts>;
+/** Successful result context for creating one column. */
+type ColumnCreateOperationResultContext = KanbanApiResultContext<z.output<typeof createColumnSchema>, ColumnCreateFacts, SerializedColumn>;
+/** Context for updating one column. */
+type ColumnUpdateOperationContext = KanbanApiContext<UpdateColumnInput, ColumnUpdateFacts>;
+/** Successful result context for updating one column. */
+type ColumnUpdateOperationResultContext = KanbanApiResultContext<UpdateColumnInput, ColumnUpdateFacts, SerializedColumn>;
+/** Context for deleting one column. */
+type ColumnDeleteOperationContext = KanbanApiContext<{
+    id: string;
+}, ColumnDeleteFacts>;
+/** Successful result context for deleting one column. */
+type ColumnDeleteOperationResultContext = KanbanApiResultContext<{
+    id: string;
+}, ColumnDeleteFacts, {
+    success: true;
+}>;
+/** Context for reordering a board's columns. */
+type ColumnReorderOperationContext = KanbanApiContext<z.output<typeof reorderColumnsSchema>, ColumnReorderFacts>;
+/** Successful result context for reordering a board's columns. */
+type ColumnReorderOperationResultContext = KanbanApiResultContext<z.output<typeof reorderColumnsSchema>, ColumnReorderFacts, {
+    success: true;
+}>;
+/** Context for creating one task. */
+type TaskCreateOperationContext = KanbanApiContext<z.output<typeof createTaskSchema>, TaskCreateFacts>;
+/** Successful result context for creating one task. */
+type TaskCreateOperationResultContext = KanbanApiResultContext<z.output<typeof createTaskSchema>, TaskCreateFacts, SerializedTask>;
+/** Context for updating one task. */
+type TaskUpdateOperationContext = KanbanApiContext<UpdateTaskInput, TaskUpdateFacts>;
+/** Successful result context for updating one task. */
+type TaskUpdateOperationResultContext = KanbanApiResultContext<UpdateTaskInput, TaskUpdateFacts, SerializedTask>;
+/** Context for deleting one task. */
+type TaskDeleteOperationContext = KanbanApiContext<{
+    id: string;
+}, TaskDeleteFacts>;
+/** Successful result context for deleting one task. */
+type TaskDeleteOperationResultContext = KanbanApiResultContext<{
+    id: string;
+}, TaskDeleteFacts, {
+    success: true;
+}>;
+/** Context for moving one task. */
+type TaskMoveOperationContext = KanbanApiContext<z.output<typeof moveTaskSchema>, TaskMoveFacts>;
+/** Successful result context for moving one task. */
+type TaskMoveOperationResultContext = KanbanApiResultContext<z.output<typeof moveTaskSchema>, TaskMoveFacts, SerializedTask>;
+/** Context for reordering a column's tasks. */
+type TaskReorderOperationContext = KanbanApiContext<z.output<typeof reorderTasksSchema>, TaskReorderFacts>;
+/** Successful result context for reordering a column's tasks. */
+type TaskReorderOperationResultContext = KanbanApiResultContext<z.output<typeof reorderTasksSchema>, TaskReorderFacts, {
+    success: true;
+}>;
+/** Configuration hooks for Kanban. Authorization always runs before these hooks. */
+interface KanbanBackendHooks {
+    onBeforeListBoards?: (filter: z.output<typeof BoardListQuerySchema>, context: BoardListOperationContext) => Promise<void> | void;
+    onBeforeCreateBoard?: (data: z.output<typeof createBoardSchema>, context: BoardCreateOperationContext) => Promise<void> | void;
+    onBeforeGetBoard?: (boardId: string, context: BoardReadOperationContext) => Promise<void> | void;
+    onBeforeUpdateBoard?: (boardId: string, data: z.output<typeof updateBoardSchema>, context: BoardUpdateOperationContext) => Promise<void> | void;
+    onBeforeDeleteBoard?: (boardId: string, context: BoardDeleteOperationContext) => Promise<void> | void;
+    onAfterListBoards?: (boards: readonly DeepReadonly<SerializedBoardSummary>[], filter: z.output<typeof BoardListQuerySchema>, context: BoardListOperationResultContext) => Promise<void> | void;
+    onAfterGetBoard?: (board: DeepReadonly<SerializedBoardWithColumns>, context: BoardReadOperationResultContext) => Promise<void> | void;
+    onAfterCreateBoard?: (board: DeepReadonly<SerializedBoardWithColumns>, context: BoardCreateOperationResultContext) => Promise<void> | void;
+    onAfterUpdateBoard?: (board: DeepReadonly<SerializedBoard>, context: BoardUpdateOperationResultContext) => Promise<void> | void;
+    onAfterDeleteBoard?: (boardId: string, context: BoardDeleteOperationResultContext) => Promise<void> | void;
+    onErrorListBoards?: (error: Error, context: BoardListOperationContext) => Promise<void> | void;
+    onErrorGetBoard?: (error: Error, context: BoardReadOperationContext) => Promise<void> | void;
+    onErrorCreateBoard?: (error: Error, context: BoardCreateOperationContext) => Promise<void> | void;
+    onErrorUpdateBoard?: (error: Error, context: BoardUpdateOperationContext) => Promise<void> | void;
+    onErrorDeleteBoard?: (error: Error, context: BoardDeleteOperationContext) => Promise<void> | void;
+    onBeforeCreateColumn?: (data: z.output<typeof createColumnSchema>, context: ColumnCreateOperationContext) => Promise<void> | void;
+    onBeforeUpdateColumn?: (columnId: string, data: z.output<typeof updateColumnSchema>, context: ColumnUpdateOperationContext | ColumnReorderOperationContext) => Promise<void> | void;
+    onBeforeDeleteColumn?: (columnId: string, context: ColumnDeleteOperationContext) => Promise<void> | void;
+    onAfterCreateColumn?: (column: DeepReadonly<SerializedColumn>, context: ColumnCreateOperationResultContext) => Promise<void> | void;
+    onAfterUpdateColumn?: (column: DeepReadonly<SerializedColumn>, context: ColumnUpdateOperationResultContext | ColumnReorderOperationResultContext) => Promise<void> | void;
+    onAfterDeleteColumn?: (columnId: string, context: ColumnDeleteOperationResultContext) => Promise<void> | void;
+    onBeforeCreateTask?: (data: z.output<typeof createTaskSchema>, context: TaskCreateOperationContext) => Promise<void> | void;
+    onBeforeUpdateTask?: (taskId: string, data: z.output<typeof updateTaskSchema>, context: TaskUpdateOperationContext | TaskMoveOperationContext | TaskReorderOperationContext) => Promise<void> | void;
+    onBeforeDeleteTask?: (taskId: string, context: TaskDeleteOperationContext) => Promise<void> | void;
+    onAfterCreateTask?: (task: DeepReadonly<SerializedTask>, context: TaskCreateOperationResultContext) => Promise<void> | void;
+    onAfterUpdateTask?: (task: DeepReadonly<SerializedTask>, context: TaskUpdateOperationResultContext | TaskMoveOperationResultContext | TaskReorderOperationResultContext) => Promise<void> | void;
+    onAfterDeleteTask?: (taskId: string, context: TaskDeleteOperationResultContext) => Promise<void> | void;
+}
+
+export { BoardListQuerySchema as B, createBoardSchema as c, createColumnSchema as f, createTaskSchema as g, reorderTasksSchema as h, moveTaskSchema as m, reorderColumnsSchema as r };
+export type { ColumnCreateOperationContext as A, Column as C, ColumnCreateOperationResultContext as D, ColumnUpdateOperationContext as E, ColumnUpdateOperationResultContext as F, ColumnDeleteOperationContext as G, ColumnDeleteOperationResultContext as H, ColumnReorderOperationContext as I, ColumnReorderOperationResultContext as J, KanbanBackendHooks as K, TaskCreateOperationContext as L, TaskCreateOperationResultContext as M, TaskUpdateOperationContext as N, TaskUpdateOperationResultContext as O, Priority as P, TaskDeleteOperationContext as Q, TaskDeleteOperationResultContext as R, SerializedBoardSummary as S, Task as T, TaskMoveOperationContext as U, TaskMoveOperationResultContext as V, TaskReorderOperationContext as W, TaskReorderOperationResultContext as X, SerializedBoardWithColumns as a, SerializedBoard as b, SerializedColumn as d, SerializedTask as e, BoardWithColumns as i, BoardWithColumnsOnly as j, Board as k, ColumnWithTasks as l, KanbanApiContext as n, KanbanApiResultContext as o, BoardListOperationContext as p, BoardListOperationResultContext as q, BoardReadOperationContext as s, BoardReadOperationResultContext as t, BoardCreateOperationContext as u, BoardCreateOperationResultContext as v, BoardUpdateOperationContext as w, BoardUpdateOperationResultContext as x, BoardDeleteOperationContext as y, BoardDeleteOperationResultContext as z };

package/dist/shared/stack.CxKc9evq.d.ts

@@ -0,0 +1,23 @@
+import { AnyAuthorizationContract } from '../authorization/index.js';
+import { M as MaybePromise } from './stack.CKXzdGiJ.js';
+
+/** Schema-bound identity source accepted at a framework serialization seam. */
+interface FrameworkIdentitySource<TContract extends AnyAuthorizationContract, TContext> {
+    readonly contract: TContract;
+    getIdentity(context: TContext): MaybePromise<unknown>;
+}
+/** Schema-bound identity source for frameworks that expose request headers only. */
+interface HeadersFrameworkIdentitySource<TContract extends AnyAuthorizationContract> {
+    readonly contract: TContract;
+    getIdentityFromHeaders(context: {
+        headers: Headers;
+    }): MaybePromise<unknown>;
+}
+declare const initialIdentitySnapshot: unique symbol;
+/** A schema-validated, JSON-safe identity envelope produced on the server. */
+interface InitialIdentitySnapshot<TIdentity> {
+    readonly initialIdentity: TIdentity | null;
+    readonly [initialIdentitySnapshot]: true;
+}
+
+export type { FrameworkIdentitySource as F, HeadersFrameworkIdentitySource as H, InitialIdentitySnapshot as I };

package/dist/shared/{stack.lkebw2nj.d.mts → stack.DVEjWKCT.d.cts}

@@ -68,6 +68,8 @@ interface VercelBlobTokenOptions {
     addRandomSuffix?: boolean;
     allowedContentTypes?: string[];
     maximumSizeInBytes?: number;
+    /** Server-normalized upload context bound into the signed client token. */
+    tokenPayload?: string;
 }
 /**
  * Minimal blob metadata sent back by Vercel Blob's upload completion callback.
@@ -76,7 +78,6 @@ interface VercelBlobTokenOptions {
 interface VercelBlobCallbackBlob {
     url: string;
     pathname: string;
-    [key: string]: unknown;
 }
 interface VercelBlobGenerateClientTokenBody {
     type: "blob.generate-client-token";
@@ -84,6 +85,7 @@ interface VercelBlobGenerateClientTokenBody {
         pathname: string;
         multipart: boolean;
         clientPayload: string | null;
+        callbackUrl?: string;
     };
 }
 interface VercelBlobUploadCompletedBody {
@@ -105,6 +107,14 @@ interface VercelBlobHandlerCallbacks {
      */
     onBeforeGenerateToken?: (pathname: string, clientPayload: string | null) => Promise<VercelBlobTokenOptions | void> | VercelBlobTokenOptions | void;
 }
+/** Provider-verified upload context carried by a completion callback. */
+interface VerifiedVercelBlobCallback {
+    pathname: string;
+    mimeType: string;
+    size?: number;
+    folderId?: string;
+    tenantId?: string;
+}
 /**
  * Vercel Blob storage adapter — uses the `@vercel/blob/client` `handleUpload`
  * protocol. The same endpoint handles both token generation and upload
@@ -119,9 +129,13 @@ interface VercelBlobStorageAdapter {
      */
     readonly urlHostnameSuffix: string;
     /**
-     * Process a raw request from `@vercel/blob/client`'s `upload()` or from
-     * Vercel Blob's upload-completion webhook. Returns a JSON-serialisable object
-     * that should be sent back as the response body.
+     * Verify the provider signature and parse only server-issued token context.
+     * This runs before a completion callback is allowed onto a public auth path.
+     */
+    verifyCallback(request: Request, body: VercelBlobUploadCompletedBody): Promise<VerifiedVercelBlobCallback>;
+    /**
+     * Process a client-token request or Vercel Blob's upload-completion webhook.
+     * Returns a JSON-serialisable object that should be sent as the response body.
      */
     handleRequest(request: Request, body: VercelBlobHandleUploadBody, callbacks: VercelBlobHandlerCallbacks): Promise<unknown>;
     /**
@@ -131,4 +145,4 @@ interface VercelBlobStorageAdapter {
 }
 type StorageAdapter = DirectStorageAdapter | S3StorageAdapter | VercelBlobStorageAdapter;
 
-export type { DirectStorageAdapter as D, StorageAdapter as S, UploadOptions as U, VercelBlobStorageAdapter as V, S3StorageAdapter as a, S3UploadToken as b, VercelBlobHandlerCallbacks as c };
+export type { DirectStorageAdapter as D, S3StorageAdapter as S, UploadOptions as U, VercelBlobStorageAdapter as V, StorageAdapter as a, S3UploadToken as b, VercelBlobHandlerCallbacks as c };

package/dist/shared/{stack.lkebw2nj.d.ts → stack.DVEjWKCT.d.mts}

@@ -68,6 +68,8 @@ interface VercelBlobTokenOptions {
     addRandomSuffix?: boolean;
     allowedContentTypes?: string[];
     maximumSizeInBytes?: number;
+    /** Server-normalized upload context bound into the signed client token. */
+    tokenPayload?: string;
 }
 /**
  * Minimal blob metadata sent back by Vercel Blob's upload completion callback.
@@ -76,7 +78,6 @@ interface VercelBlobTokenOptions {
 interface VercelBlobCallbackBlob {
     url: string;
     pathname: string;
-    [key: string]: unknown;
 }
 interface VercelBlobGenerateClientTokenBody {
     type: "blob.generate-client-token";
@@ -84,6 +85,7 @@ interface VercelBlobGenerateClientTokenBody {
         pathname: string;
         multipart: boolean;
         clientPayload: string | null;
+        callbackUrl?: string;
     };
 }
 interface VercelBlobUploadCompletedBody {
@@ -105,6 +107,14 @@ interface VercelBlobHandlerCallbacks {
      */
     onBeforeGenerateToken?: (pathname: string, clientPayload: string | null) => Promise<VercelBlobTokenOptions | void> | VercelBlobTokenOptions | void;
 }
+/** Provider-verified upload context carried by a completion callback. */
+interface VerifiedVercelBlobCallback {
+    pathname: string;
+    mimeType: string;
+    size?: number;
+    folderId?: string;
+    tenantId?: string;
+}
 /**
  * Vercel Blob storage adapter — uses the `@vercel/blob/client` `handleUpload`
  * protocol. The same endpoint handles both token generation and upload
@@ -119,9 +129,13 @@ interface VercelBlobStorageAdapter {
      */
     readonly urlHostnameSuffix: string;
     /**
-     * Process a raw request from `@vercel/blob/client`'s `upload()` or from
-     * Vercel Blob's upload-completion webhook. Returns a JSON-serialisable object
-     * that should be sent back as the response body.
+     * Verify the provider signature and parse only server-issued token context.
+     * This runs before a completion callback is allowed onto a public auth path.
+     */
+    verifyCallback(request: Request, body: VercelBlobUploadCompletedBody): Promise<VerifiedVercelBlobCallback>;
+    /**
+     * Process a client-token request or Vercel Blob's upload-completion webhook.
+     * Returns a JSON-serialisable object that should be sent as the response body.
      */
     handleRequest(request: Request, body: VercelBlobHandleUploadBody, callbacks: VercelBlobHandlerCallbacks): Promise<unknown>;
     /**
@@ -131,4 +145,4 @@ interface VercelBlobStorageAdapter {
 }
 type StorageAdapter = DirectStorageAdapter | S3StorageAdapter | VercelBlobStorageAdapter;
 
-export type { DirectStorageAdapter as D, StorageAdapter as S, UploadOptions as U, VercelBlobStorageAdapter as V, S3StorageAdapter as a, S3UploadToken as b, VercelBlobHandlerCallbacks as c };
+export type { DirectStorageAdapter as D, S3StorageAdapter as S, UploadOptions as U, VercelBlobStorageAdapter as V, StorageAdapter as a, S3UploadToken as b, VercelBlobHandlerCallbacks as c };

package/dist/shared/{stack.lkebw2nj.d.cts → stack.DVEjWKCT.d.ts}

@@ -68,6 +68,8 @@ interface VercelBlobTokenOptions {
     addRandomSuffix?: boolean;
     allowedContentTypes?: string[];
     maximumSizeInBytes?: number;
+    /** Server-normalized upload context bound into the signed client token. */
+    tokenPayload?: string;
 }
 /**
  * Minimal blob metadata sent back by Vercel Blob's upload completion callback.
@@ -76,7 +78,6 @@ interface VercelBlobTokenOptions {
 interface VercelBlobCallbackBlob {
     url: string;
     pathname: string;
-    [key: string]: unknown;
 }
 interface VercelBlobGenerateClientTokenBody {
     type: "blob.generate-client-token";
@@ -84,6 +85,7 @@ interface VercelBlobGenerateClientTokenBody {
         pathname: string;
         multipart: boolean;
         clientPayload: string | null;
+        callbackUrl?: string;
     };
 }
 interface VercelBlobUploadCompletedBody {
@@ -105,6 +107,14 @@ interface VercelBlobHandlerCallbacks {
      */
     onBeforeGenerateToken?: (pathname: string, clientPayload: string | null) => Promise<VercelBlobTokenOptions | void> | VercelBlobTokenOptions | void;
 }
+/** Provider-verified upload context carried by a completion callback. */
+interface VerifiedVercelBlobCallback {
+    pathname: string;
+    mimeType: string;
+    size?: number;
+    folderId?: string;
+    tenantId?: string;
+}
 /**
  * Vercel Blob storage adapter — uses the `@vercel/blob/client` `handleUpload`
  * protocol. The same endpoint handles both token generation and upload
@@ -119,9 +129,13 @@ interface VercelBlobStorageAdapter {
      */
     readonly urlHostnameSuffix: string;
     /**
-     * Process a raw request from `@vercel/blob/client`'s `upload()` or from
-     * Vercel Blob's upload-completion webhook. Returns a JSON-serialisable object
-     * that should be sent back as the response body.
+     * Verify the provider signature and parse only server-issued token context.
+     * This runs before a completion callback is allowed onto a public auth path.
+     */
+    verifyCallback(request: Request, body: VercelBlobUploadCompletedBody): Promise<VerifiedVercelBlobCallback>;
+    /**
+     * Process a client-token request or Vercel Blob's upload-completion webhook.
+     * Returns a JSON-serialisable object that should be sent as the response body.
      */
     handleRequest(request: Request, body: VercelBlobHandleUploadBody, callbacks: VercelBlobHandlerCallbacks): Promise<unknown>;
     /**
@@ -131,4 +145,4 @@ interface VercelBlobStorageAdapter {
 }
 type StorageAdapter = DirectStorageAdapter | S3StorageAdapter | VercelBlobStorageAdapter;
 
-export type { DirectStorageAdapter as D, StorageAdapter as S, UploadOptions as U, VercelBlobStorageAdapter as V, S3StorageAdapter as a, S3UploadToken as b, VercelBlobHandlerCallbacks as c };
+export type { DirectStorageAdapter as D, S3StorageAdapter as S, UploadOptions as U, VercelBlobStorageAdapter as V, StorageAdapter as a, S3UploadToken as b, VercelBlobHandlerCallbacks as c };

package/dist/shared/{stack.Cp_6mO5s.d.mts → stack.DbbvHbhn.d.mts}

@@ -1,5 +1,5 @@
 import { ComponentType, ReactNode } from 'react';
-import { b as SerializedTask } from './stack.DJaKVY7v.mjs';
+import { e as SerializedTask } from './stack.DlCycSM-.mjs';
 
 interface KanbanCommonLocalization {
     backToBoards: string;
@@ -141,10 +141,6 @@ interface KanbanPluginOverrides {
      * Whether to show the attribution
      */
     showAttribution?: boolean;
-    /**
-     * Optional headers to pass with API requests (e.g., for SSR auth)
-     */
-    headers?: HeadersInit;
     /**
      * Function used to upload a new image file from the task description editor
      * and return its URL. This is separate from `imagePicker`, which selects an

package/dist/shared/{stack.DseBJmGF.d.ts → stack.DfrRYOIl.d.ts}

@@ -2,7 +2,7 @@ import * as _tanstack_react_query from '@tanstack/react-query';
 import { z } from 'zod';
 import { ResourceFormConfig, ResourceFormResult } from '@btst/stack/plugins/client/hooks';
 import { S as SerializedPost, a as SerializedTag } from './stack.Dsatjh0B.js';
-import { c as createPostSchema, u as updatePostSchema } from './stack.D18Dq3ve.js';
+import { c as createPostSchema, u as updatePostSchema } from './stack.CKc_Bais.js';
 
 /**
  * Options for the usePosts hook
@@ -137,6 +137,9 @@ declare function usePostForm<TValues>(config: ResourceFormConfig<TValues, Serial
 /** Create a new post */
 declare function useCreatePost(): _tanstack_react_query.UseMutationResult<SerializedPost | null, Error, {
     title: string;
+    content: string;
+    excerpt: string;
+    published: boolean;
     tags: ({
         name: string;
     } | {
@@ -144,9 +147,6 @@ declare function useCreatePost(): _tanstack_react_query.UseMutationResult<Serial
         name: string;
         slug: string;
     })[];
-    content: string;
-    excerpt: string;
-    published: boolean;
     slug?: string | undefined;
     publishedAt?: Date | undefined;
     createdAt?: Date | undefined;