@spinekit/media 0.1.1

package/dist/providers/media-provider.config.mjs

@@ -0,0 +1,97 @@
+//#region src/providers/media-provider.config.ts
+/** Required credential fields per provider — the completeness check is data, not code. */
+const REQUIRED = {
+	s3: [
+		"bucket",
+		"region",
+		"accessKeyId",
+		"secretAccessKey"
+	],
+	gcs: ["bucket"],
+	"cloudflare-images": ["accountId", "apiToken"],
+	cloudinary: [
+		"cloudName",
+		"apiKey",
+		"apiSecret"
+	],
+	imagekit: [
+		"publicKey",
+		"privateKey",
+		"urlEndpoint"
+	],
+	imgbb: ["apiKey"],
+	local: ["basePath"],
+	memory: []
+};
+/** Field names never echoed in an error message. */
+const SECRET_FIELDS = /* @__PURE__ */ new Set([
+	"secretAccessKey",
+	"apiToken",
+	"apiSecret",
+	"privateKey",
+	"apiKey",
+	"credentials"
+]);
+/** Which required fields are missing. Exported so a host can pre-flight its own config. */
+function missingProviderFields(config) {
+	const required = REQUIRED[config.kind] ?? [];
+	const bag = config;
+	return required.filter((f) => {
+		const v = bag[f];
+		return v === void 0 || v === null || v === "";
+	});
+}
+async function resolveMediaProvider(config, options = {}) {
+	if (!config || missingProviderFields(config).length > 0) {
+		if (options.fallback) return options.fallback();
+		const missing = config ? missingProviderFields(config) : ["<no provider configured>"];
+		throw new Error(`[spine-media] storage provider ${config ? `"${config.kind}" ` : ""}is not fully configured. Missing: ${missing.filter((m) => !SECRET_FIELDS.has(m) || true).join(", ")}. Supply the missing values, choose a different \`kind\`, or pass an explicit \`fallback\` if this deployment genuinely intends a non-persistent driver.`);
+	}
+	switch (config.kind) {
+		case "s3": {
+			const { S3Provider } = await import("@classytic/media-kit/providers/s3");
+			return new S3Provider({
+				bucket: config.bucket,
+				region: config.region,
+				credentials: {
+					accessKeyId: config.accessKeyId,
+					secretAccessKey: config.secretAccessKey
+				},
+				...config.publicUrl ? { publicUrl: config.publicUrl } : {},
+				...config.acl ? { acl: config.acl } : {}
+			});
+		}
+		case "gcs": {
+			const { GCSProvider } = await import("@classytic/media-kit/providers/gcs");
+			return new GCSProvider({ ...config });
+		}
+		case "cloudflare-images": {
+			const { CloudflareImagesProvider } = await import("@classytic/media-kit/providers/cloudflare-images");
+			return new CloudflareImagesProvider({ ...config });
+		}
+		case "cloudinary": {
+			const { CloudinaryProvider } = await import("@classytic/media-kit/providers/cloudinary");
+			return new CloudinaryProvider({ ...config });
+		}
+		case "imagekit": {
+			const { ImageKitProvider } = await import("@classytic/media-kit/providers/imagekit");
+			return new ImageKitProvider({ ...config });
+		}
+		case "imgbb": {
+			const { ImgbbProvider } = await import("@classytic/media-kit/providers/imgbb");
+			return new ImgbbProvider({ ...config });
+		}
+		case "local": {
+			const { LocalProvider } = await import("@classytic/media-kit/providers/local");
+			return new LocalProvider({
+				basePath: config.basePath,
+				baseUrl: config.publicUrl ?? ""
+			});
+		}
+		case "memory":
+			if (!options.fallback) throw new Error("[spine-media] kind 'memory' persists nothing and must not be selected implicitly. Pass a `fallback` that returns your in-memory driver, so the choice is visible at the composition site.");
+			return options.fallback();
+	}
+}
+//#endregion
+export { missingProviderFields, resolveMediaProvider };

package/dist/providers/memory.provider.d.mts

@@ -0,0 +1,5 @@
+import { StorageDriver } from "@classytic/media-kit";
+//#region src/providers/memory.provider.d.ts
+declare function createMemoryDriver(): Promise<StorageDriver>;
+//#endregion
+export { createMemoryDriver };

package/dist/providers/memory.provider.mjs

@@ -0,0 +1,68 @@
+import { Readable } from "node:stream";
+//#region src/providers/memory.provider.ts
+/**
+* In-memory storage driver — tests only.
+*
+* Conforms to media-kit v3's `StorageDriver` interface so the engine can
+* fall back to a heap-backed store when no S3 bucket is configured.
+*/
+async function createMemoryDriver() {
+	const store = /* @__PURE__ */ new Map();
+	async function toBuffer(input) {
+		if (Buffer.isBuffer(input)) return input;
+		const chunks = [];
+		for await (const chunk of input) if (Buffer.isBuffer(chunk)) chunks.push(chunk);
+		else if (chunk instanceof Uint8Array) chunks.push(Buffer.from(chunk));
+		else if (typeof chunk === "string") chunks.push(Buffer.from(chunk));
+		return Buffer.concat(chunks);
+	}
+	return {
+		name: "memory",
+		async write(key, data, contentType) {
+			const buffer = await toBuffer(data);
+			store.set(key, {
+				buffer,
+				contentType,
+				lastModified: /* @__PURE__ */ new Date()
+			});
+			return {
+				key,
+				url: `memory://${key}`,
+				size: buffer.length
+			};
+		},
+		async read(key) {
+			const f = store.get(key);
+			if (!f) throw new Error(`Not found: ${key}`);
+			return Readable.from(f.buffer);
+		},
+		async delete(key) {
+			return store.delete(key);
+		},
+		async exists(key) {
+			return store.has(key);
+		},
+		async stat(key) {
+			const f = store.get(key);
+			if (!f) throw new Error(`Not found: ${key}`);
+			return {
+				size: f.buffer.length,
+				contentType: f.contentType,
+				lastModified: f.lastModified
+			};
+		},
+		getPublicUrl(key) {
+			return `memory://${key}`;
+		},
+		async getSignedUploadUrl(key, _contentType, expiresIn) {
+			return {
+				uploadUrl: `memory://${key}?upload=1`,
+				key,
+				publicUrl: `memory://${key}`,
+				expiresIn: expiresIn ?? 3600
+			};
+		}
+	};
+}
+//#endregion
+export { createMemoryDriver };

package/dist/resources/media/media.buffered-upload.d.mts

@@ -0,0 +1,47 @@
+import { PermissionCheck } from "@classytic/arc/permissions";
+import { MediaRepository } from "@classytic/media-kit";
+import { RouteDefinition } from "@classytic/arc/types";
+import { FastifyRequest } from "fastify";
+//#region src/resources/media/media.buffered-upload.d.ts
+interface BufferedMediaUploadEngine {
+  repositories: {
+    media: Pick<MediaRepository, 'upload'>;
+  };
+}
+interface BufferedMediaUploadFolderInput {
+  /** Untrusted text field supplied by the multipart request, when present. */
+  requestedFolder?: string;
+  request: FastifyRequest;
+}
+interface BufferedMediaUploadRouteOptions {
+  /** Arc permission gate for this opt-in route. */
+  permission: PermissionCheck;
+  /** Per-file buffer ceiling. Required because buffering is process memory. */
+  maxFileSize: number;
+  /** Whole-request buffer ceiling. Required so concurrency has a known bound. */
+  maxTotalBytes: number;
+  /** Explicit allow-list; exact MIME values and subtype wildcards are supported. */
+  allowedMimeTypes: readonly string[];
+  /**
+   * Host-owned folder policy. The helper never trusts `body.folder` directly.
+   * Omit it to let MediaKit apply its configured default folder.
+   */
+  resolveFolder?: (input: BufferedMediaUploadFolderInput) => string | undefined;
+  /** Authorize the resolved folder after multipart parsing and before bytes are persisted. */
+  authorizeFolder?: (input: BufferedMediaUploadFolderInput & {
+    folder?: string;
+  }) => void | Promise<void>;
+  /** Resource-relative route path. */
+  path?: string;
+  /** Multipart file field. */
+  fileField?: string;
+  /** OpenAPI summary override. */
+  summary?: string;
+}
+/**
+ * Build one authenticated, single-file buffered upload route for a Media module
+ * seam. The returned route is inert until a host adds it to `seams.routes`.
+ */
+declare function createBufferedMediaUploadRoute(engine: BufferedMediaUploadEngine, options: BufferedMediaUploadRouteOptions): RouteDefinition;
+//#endregion
+export { BufferedMediaUploadEngine, BufferedMediaUploadFolderInput, BufferedMediaUploadRouteOptions, createBufferedMediaUploadRoute };

package/dist/resources/media/media.buffered-upload.mjs

@@ -0,0 +1,76 @@
+import { scopeFirstCtx } from "@classytic/arc/scope";
+import { UnauthorizedError } from "@classytic/arc/utils";
+import { multipartBody } from "@classytic/arc/middleware";
+//#region src/resources/media/media.buffered-upload.ts
+/**
+* Optional application-server ingress for deliberately small media uploads.
+*
+* Large assets belong on the module's direct-to-storage routes. This helper is
+* only the bounded buffering mechanism: every deployment must state its byte,
+* MIME, permission, and folder-selection policy when it opts in.
+*/
+function requirePositiveInteger(value, name) {
+	if (!Number.isSafeInteger(value) || value <= 0) throw new Error(`createBufferedMediaUploadRoute: ${name} must be a positive integer`);
+}
+function validateOptions(options) {
+	requirePositiveInteger(options.maxFileSize, "maxFileSize");
+	requirePositiveInteger(options.maxTotalBytes, "maxTotalBytes");
+	if (options.allowedMimeTypes.length === 0) throw new Error("createBufferedMediaUploadRoute: allowedMimeTypes must not be empty");
+	if (options.allowedMimeTypes.some((value) => value.trim() === "" || ["*", "*/*"].includes(value.trim()))) throw new Error("createBufferedMediaUploadRoute: allowedMimeTypes must be an explicit allow-list");
+	if (options.fileField !== void 0 && options.fileField.trim() === "") throw new Error("createBufferedMediaUploadRoute: fileField must not be empty");
+	if (options.path !== void 0 && !options.path.startsWith("/")) throw new Error("createBufferedMediaUploadRoute: path must start with /");
+}
+/**
+* Build one authenticated, single-file buffered upload route for a Media module
+* seam. The returned route is inert until a host adds it to `seams.routes`.
+*/
+function createBufferedMediaUploadRoute(engine, options) {
+	validateOptions(options);
+	const fileField = options.fileField ?? "file";
+	return {
+		method: "POST",
+		path: options.path ?? "/upload",
+		summary: options.summary ?? "Upload one small media asset through the application server",
+		permissions: options.permission,
+		preHandler: [multipartBody({
+			requiredFields: [fileField],
+			maxFiles: 1,
+			maxFileSize: options.maxFileSize,
+			maxTotalBytes: options.maxTotalBytes,
+			allowedMimeTypes: [...options.allowedMimeTypes]
+		})],
+		rawHandler: async (request, reply) => {
+			const { actorId: userId, organizationId } = scopeFirstCtx(request, { orgHeader: false });
+			if (!userId) throw new UnauthorizedError();
+			const body = request.body;
+			const file = body._files?.[fileField];
+			if (!file) throw Object.assign(/* @__PURE__ */ new Error(`Missing required file field: ${fileField}`), {
+				statusCode: 400,
+				code: "media.file_required"
+			});
+			const folder = options.resolveFolder?.({
+				...typeof body.folder === "string" ? { requestedFolder: body.folder } : {},
+				request
+			});
+			await options.authorizeFolder?.({
+				...typeof body.folder === "string" ? { requestedFolder: body.folder } : {},
+				...folder !== void 0 ? { folder } : {},
+				request
+			});
+			const asset = await engine.repositories.media.upload({
+				buffer: file.buffer,
+				filename: file.filename,
+				mimeType: file.mimetype,
+				...folder !== void 0 ? { folder } : {},
+				...typeof body.alt === "string" ? { alt: body.alt } : {},
+				...typeof body.title === "string" ? { title: body.title } : {}
+			}, {
+				userId,
+				...organizationId !== void 0 ? { organizationId } : {}
+			});
+			return reply.code(201).send(asset);
+		}
+	};
+}
+//#endregion
+export { createBufferedMediaUploadRoute };

package/dist/resources/media/media.routes.d.mts

@@ -0,0 +1,28 @@
+import { BufferedMediaUploadEngine, BufferedMediaUploadFolderInput, BufferedMediaUploadRouteOptions, createBufferedMediaUploadRoute } from "./media.buffered-upload.mjs";
+import { MediaRepository } from "@classytic/media-kit";
+import { RouteDefinition } from "@classytic/arc/types";
+//#region src/resources/media/media.routes.d.ts
+/**
+ * The repository verbs these routes require.
+ *
+ * `MediaRepository` declares folder/tag operations OPTIONAL — media-kit can be configured
+ * without them. be-prod's looser tsconfig let the routes call them unguarded; under this
+ * package's `exactOptionalPropertyTypes` every call was an error, which is the honest
+ * reading: mounting these routes against an engine that lacks the verbs would throw at
+ * request time.
+ *
+ * Stating the requirement in the TYPE means a caller finds out at composition, not from a
+ * 500 in production.
+ */
+type MediaRoutesRepository = MediaRepository & Required<Pick<MediaRepository, 'addTags' | 'deleteFolder' | 'getBreadcrumb' | 'getFolderStats' | 'getFolderTree' | 'getSubfolders' | 'hardDeleteMany' | 'move' | 'removeTags' | 'renameFolder'>>;
+type PermissionGate = import('@classytic/arc/permissions').PermissionCheck;
+/**
+ * Library-management routes merged into the arc-media `/media` resource.
+ *
+ * @param repo   the media-kit repository the module bootstrapped (single source)
+ * @param manage the gate guarding every mutation (folders/tags/bulk/move/meta);
+ *               reads reuse it too — the library is a platform-admin surface.
+ */
+declare function buildMediaExtensionRoutes(repo: MediaRoutesRepository, manage: PermissionGate): RouteDefinition[];
+//#endregion
+export { type BufferedMediaUploadEngine, type BufferedMediaUploadFolderInput, type BufferedMediaUploadRouteOptions, MediaRoutesRepository, buildMediaExtensionRoutes, createBufferedMediaUploadRoute };

package/dist/resources/media/media.routes.mjs

@@ -0,0 +1,203 @@
+import { BASE_FOLDERS } from "../../config/media.defaults.mjs";
+import { mediaSchemas } from "./media.schema.mjs";
+import { createBufferedMediaUploadRoute } from "./media.buffered-upload.mjs";
+import { NotFoundError } from "@classytic/arc/utils";
+//#region src/resources/media/media.routes.ts
+/** Actor context — the actor is ALWAYS the authenticated user, never the body. */
+function ctxOf(req) {
+	const user = req.user;
+	const userId = user?.id ?? user?._id;
+	return userId !== void 0 ? { userId } : {};
+}
+/**
+* Library-management routes merged into the arc-media `/media` resource.
+*
+* @param repo   the media-kit repository the module bootstrapped (single source)
+* @param manage the gate guarding every mutation (folders/tags/bulk/move/meta);
+*               reads reuse it too — the library is a platform-admin surface.
+*/
+function buildMediaExtensionRoutes(repo, manage) {
+	const r = repo;
+	return [
+		{
+			method: "GET",
+			path: "/folders",
+			permissions: manage,
+			summary: "Get allowed base folders",
+			rawHandler: async (_req, reply) => reply.send(BASE_FOLDERS)
+		},
+		{
+			method: "GET",
+			path: "/folders/tree",
+			permissions: manage,
+			summary: "Get folder tree",
+			rawHandler: async (req, reply) => reply.send(await r.getFolderTree(ctxOf(req)))
+		},
+		{
+			method: "GET",
+			path: "/folders/:folder/stats",
+			permissions: manage,
+			summary: "Get folder stats",
+			schema: mediaSchemas.folderParam,
+			rawHandler: async (req, reply) => {
+				const { folder } = req.params;
+				return reply.send(await r.getFolderStats(folder, ctxOf(req)));
+			}
+		},
+		{
+			method: "GET",
+			path: "/folders/:folder/breadcrumb",
+			permissions: manage,
+			summary: "Get folder breadcrumb",
+			schema: mediaSchemas.folderParam,
+			rawHandler: async (req, reply) => {
+				const { folder } = req.params;
+				return reply.send(r.getBreadcrumb(folder));
+			}
+		},
+		{
+			method: "GET",
+			path: "/folders/:folder/subfolders",
+			permissions: manage,
+			summary: "Get subfolders",
+			schema: mediaSchemas.folderParam,
+			rawHandler: async (req, reply) => {
+				const { folder } = req.params;
+				return reply.send(await r.getSubfolders(folder, ctxOf(req)));
+			}
+		},
+		{
+			method: "PATCH",
+			path: "/folders/:folder",
+			permissions: manage,
+			summary: "Rename folder",
+			schema: mediaSchemas.renameFolder,
+			handler: async (req) => {
+				const { folder } = req.params;
+				const { newName } = req.body ?? {};
+				return { data: await r.renameFolder(folder, newName, ctxOf(req)) };
+			}
+		},
+		{
+			method: "DELETE",
+			path: "/folders/:folder",
+			permissions: manage,
+			summary: "Delete folder (and its media)",
+			schema: mediaSchemas.folderParam,
+			handler: async (req) => {
+				const { folder } = req.params;
+				const results = await r.deleteFolder(folder, ctxOf(req));
+				const failed = results.failed ?? [];
+				const success = results.success ?? [];
+				if (success.length === 0 && failed.length === 0) throw new NotFoundError("No files in folder");
+				await req.server?.audit?.custom("media", folder, "folder_delete", {
+					deleted: success.length,
+					failed: failed.length
+				});
+				return {
+					status: failed.length ? 207 : 200,
+					data: {
+						success: failed.length === 0,
+						data: {
+							success,
+							failed
+						},
+						message: `Deleted ${success.length} files`
+					}
+				};
+			}
+		},
+		{
+			method: "POST",
+			path: "/bulk-delete",
+			permissions: manage,
+			summary: "Delete multiple files (storage + doc)",
+			schema: mediaSchemas.bulkDelete,
+			handler: async (req) => {
+				const { ids } = req.body ?? {};
+				const results = await r.hardDeleteMany(ids, ctxOf(req));
+				const failed = results.failed ?? [];
+				const success = results.success ?? [];
+				await req.server?.audit?.custom("media", ids.join(","), "bulk_delete", {
+					requested: ids.length,
+					deleted: success.length,
+					failed: failed.length
+				});
+				return {
+					status: failed.length ? 207 : 200,
+					data: {
+						success,
+						failed,
+						message: `Deleted ${success.length} of ${ids.length} files`
+					}
+				};
+			}
+		},
+		{
+			method: "POST",
+			path: "/move",
+			permissions: manage,
+			summary: "Move files to folder",
+			schema: mediaSchemas.move,
+			handler: async (req) => {
+				const { ids, targetFolder } = req.body ?? {};
+				const result = await r.move(ids, targetFolder, ctxOf(req));
+				return { data: {
+					...result,
+					message: `Moved ${result.modifiedCount ?? 0} files`
+				} };
+			}
+		},
+		{
+			method: "PATCH",
+			path: "/:id/meta",
+			permissions: manage,
+			summary: "Update media metadata (alt / title)",
+			schema: mediaSchemas.updateMeta,
+			handler: async (req) => {
+				const { id } = req.params;
+				const { alt, title } = req.body ?? {};
+				const patch = {};
+				if (alt !== void 0) patch.alt = alt;
+				if (title !== void 0) patch.title = title;
+				const before = await r.getById(id, {
+					...ctxOf(req),
+					throwOnNotFound: false
+				});
+				const updated = await r.update(id, patch, ctxOf(req));
+				if (!updated) throw new NotFoundError("Media");
+				await req.server?.audit?.update("media", id, {
+					alt: before?.alt,
+					title: before?.title
+				}, patch, ctxOf(req));
+				return { data: updated };
+			}
+		},
+		{
+			method: "POST",
+			path: "/:id/tags",
+			permissions: manage,
+			summary: "Add tags",
+			schema: mediaSchemas.addTags,
+			handler: async (req) => {
+				const { id } = req.params;
+				const { tags } = req.body ?? {};
+				return { data: await r.addTags(id, tags, ctxOf(req)) };
+			}
+		},
+		{
+			method: "DELETE",
+			path: "/:id/tags",
+			permissions: manage,
+			summary: "Remove tags",
+			schema: mediaSchemas.removeTags,
+			handler: async (req) => {
+				const { id } = req.params;
+				const { tags } = req.body ?? {};
+				return { data: await r.removeTags(id, tags, ctxOf(req)) };
+			}
+		}
+	];
+}
+//#endregion
+export { buildMediaExtensionRoutes, createBufferedMediaUploadRoute };

package/dist/resources/media/media.schema.d.mts

@@ -0,0 +1,62 @@
+import { z } from "zod";
+//#region src/resources/media/media.schema.d.ts
+declare const mediaSchemas: {
+  /** GET /folders/:folder/* — bare folder param. */
+  folderParam: {
+    params: z.ZodObject<{
+      folder: z.ZodString;
+    }, z.core.$strip>;
+  };
+  /** PATCH /folders/:folder — rename. */
+  renameFolder: {
+    params: z.ZodObject<{
+      folder: z.ZodString;
+    }, z.core.$strip>;
+    body: z.ZodObject<{
+      newName: z.ZodString;
+    }, z.core.$strict>;
+  };
+  /** POST /bulk-delete. */
+  bulkDelete: {
+    body: z.ZodObject<{
+      ids: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>;
+  };
+  /** POST /move. */
+  move: {
+    body: z.ZodObject<{
+      ids: z.ZodArray<z.ZodString>;
+      targetFolder: z.ZodString;
+    }, z.core.$strict>;
+  };
+  /** PATCH /:id/meta — metadata only (never storage bytes). */
+  updateMeta: {
+    params: z.ZodObject<{
+      id: z.ZodString;
+    }, z.core.$strip>;
+    body: z.ZodObject<{
+      alt: z.ZodOptional<z.ZodString>;
+      title: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+  };
+  /** POST /:id/tags. */
+  addTags: {
+    params: z.ZodObject<{
+      id: z.ZodString;
+    }, z.core.$strip>;
+    body: z.ZodObject<{
+      tags: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>;
+  };
+  /** DELETE /:id/tags. */
+  removeTags: {
+    params: z.ZodObject<{
+      id: z.ZodString;
+    }, z.core.$strip>;
+    body: z.ZodObject<{
+      tags: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>;
+  };
+};
+//#endregion
+export { mediaSchemas };

package/dist/resources/media/media.schema.mjs

@@ -0,0 +1,54 @@
+import { BASE_FOLDERS } from "../../config/media.defaults.mjs";
+import { z } from "zod";
+//#region src/resources/media/media.schema.ts
+/**
+* Media extension-route schemas (Zod v4 — Arc convention).
+*
+* Arc auto-converts these to JSON Schema via `z.toJSONSchema()` for Fastify
+* validation + OpenAPI. These cover ONLY the library-management routes be-prod
+* adds on top of arc-media ([media.routes.ts](./media.routes.ts): folders /
+* tags / bulk-delete / move / metadata). The media resource's list/get/delete
+* schemas + the two-phase upload contract are owned by @spinekit/media.
+*/
+/** Folder path: must start with an allowed base folder, then `/segment` parts. */
+const folderPathPattern = new RegExp(`^(${BASE_FOLDERS.join("|")})(/[a-zA-Z0-9_-]+)*$`);
+const folderPath = z.string().regex(folderPathPattern, "Invalid folder path");
+const folderParam = z.object({ folder: z.string().min(1) });
+const idParam = z.object({ id: z.string().min(1) });
+const tagList = z.array(z.string().min(1).max(50)).min(1).max(20);
+const mediaSchemas = {
+	/** GET /folders/:folder/* — bare folder param. */
+	folderParam: { params: folderParam },
+	/** PATCH /folders/:folder — rename. */
+	renameFolder: {
+		params: folderParam,
+		body: z.object({ newName: z.string().min(1).regex(/^[a-zA-Z0-9_-]+$/, "Invalid folder name") }).strict()
+	},
+	/** POST /bulk-delete. */
+	bulkDelete: { body: z.object({ ids: z.array(z.string().min(1)).min(1).max(100).describe("Media IDs to delete") }).strict() },
+	/** POST /move. */
+	move: { body: z.object({
+		ids: z.array(z.string().min(1)).min(1).max(100),
+		targetFolder: folderPath.describe("Target folder path (e.g. products/featured)")
+	}).strict() },
+	/** PATCH /:id/meta — metadata only (never storage bytes). */
+	updateMeta: {
+		params: idParam,
+		body: z.object({
+			alt: z.string().max(255).optional(),
+			title: z.string().max(255).optional()
+		}).strict()
+	},
+	/** POST /:id/tags. */
+	addTags: {
+		params: idParam,
+		body: z.object({ tags: tagList }).strict()
+	},
+	/** DELETE /:id/tags. */
+	removeTags: {
+		params: idParam,
+		body: z.object({ tags: tagList }).strict()
+	}
+};
+//#endregion
+export { mediaSchemas };