@hydra-acp/archiver 0.1.6 → 0.1.8

package/README.md

@@ -1,6 +1,6 @@
 # hydra-acp-archiver
 
-Sync extension for [hydra-acp](https://github.com/smagnuso/hydra-acp). Keeps your agent sessions in sync across the machines you work on by uploading session bundles to a shared backend (Google Drive, plain filesystem) after every turn and importing peers' bundles in the background.
+Sync extension for [hydra-acp](https://github.com/smagnuso/hydra-acp). Keeps your agent sessions in sync across the machines you work on by uploading session bundles to a shared backend (Google Drive, S3, plain filesystem) after every turn and importing peers' bundles in the background. Supports optional AES-256-GCM encryption so data at rest is unreadable without your shared key.
 
 Runs as a daemon-managed process, so sessions started on machine A become available on machine B without any manual export/import.
 
@@ -78,7 +78,7 @@ You provide your own OAuth client (Google's terms make it impractical to ship a
 6. Run:
 
    ```sh
-   hydra-acp-archiver login
+   hydra-acp-archiver gdrive login
    ```
 
    Your browser opens to Google's consent screen. The "Google hasn't verified this app" interstitial is expected for an unverified personal-use client — click **Advanced → Go to (unsafe)** and approve. The redirect lands on a transient local server, the archiver writes `~/.hydra-acp/archiver-google-token.json` (mode 0600), and you're done.
@@ -91,6 +91,44 @@ Repeat the same login flow on each machine that should sync, using the **same Go
 
 If you want a different Drive folder per "team" or "context," set `HYDRA_ACP_ARCHIVER_DRIVE_FOLDER` on every participating machine to the same value.
 
+## S3 backend
+
+Works with any S3-compatible store: AWS S3, Cloudflare R2, Backblaze B2, MinIO, Wasabi, etc.
+
+Credentials come from the standard AWS SDK chain — environment variables (`AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY`), `~/.aws/credentials`, or an IAM role. Set `AWS_PROFILE` to use a non-default credentials profile.
+
+```json
+{
+  "extensions": {
+    "hydra-acp-archiver": {
+      "command": ["node"],
+      "args": ["/home/you/dev/hydra-acp-archiver/dist/index.js"],
+      "env": {
+        "HYDRA_ACP_ARCHIVER_BACKEND": "s3",
+        "HYDRA_ACP_ARCHIVER_S3_BUCKET": "my-hydra-archive",
+        "HYDRA_ACP_ARCHIVER_S3_REGION": "us-east-1"
+      }
+    }
+  }
+}
+```
+
+For S3-compatible endpoints (R2, MinIO, B2):
+
+```json
+"HYDRA_ACP_ARCHIVER_S3_ENDPOINT": "https://<accountid>.r2.cloudflarestorage.com"
+```
+
+**Multi-machine setup**: point every machine at the same bucket.
+
+**Data separation**: the archiver sets a prefix automatically so users sharing a bucket don't see each other's sessions:
+- **Encryption on**: prefix defaults to the key fingerprint (e.g. `a1b2c3d4e5f6a7b8/`). Everyone sharing the same key lands in the same namespace; different keys land in different namespaces. Rotating the key changes the prefix, causing a full re-upload with the new key.
+- **Encryption off**: prefix defaults to your OS username (e.g. `alice/`).
+
+Set `HYDRA_ACP_ARCHIVER_PREFIX` explicitly to override the default.
+
+**Delete semantics**: blobs are hard-deleted. Enable [S3 bucket versioning](https://docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html) if you want recoverability.
+
 ## Filesystem backend
 
 Useful for testing locally, or for pointing at a folder that a separate sync tool (Syncthing, Dropbox client) already mirrors across your machines.
@@ -110,13 +148,120 @@ Useful for testing locally, or for pointing at a folder that a separate sync too
 }
 ```
 
+## Encryption
+
+All three backends support optional AES-256-GCM encryption. When enabled, blobs are encrypted before upload and decrypted after download — the backend never sees plaintext.
+
+Generate a key on one machine:
+
+```sh
+hydra-acp-archiver keygen
+```
+
+This writes a 32-byte key as a hex file (mode 0600) and prints:
+
+```
+key written to ~/.hydra-acp/archiver-key
+key fingerprint: a1b2c3d4e5f6a7b8
+
+Copy ~/.hydra-acp/archiver-key to every machine that should share this archive.
+Then add to your extension env config:
+  "HYDRA_ACP_ARCHIVER_KEY_PATH": "/home/you/.hydra-acp/archiver-key"
+```
+
+Copy the key file to each machine, then set `HYDRA_ACP_ARCHIVER_KEY_PATH` in every extension env block. The fingerprint lets you verify all machines have the same key.
+
+**Key mismatch**: if a blob was encrypted with a different key, the archiver logs `key mismatch` and skips that blob rather than failing with a confusing crypto error.
+
+**Enabling encryption on an existing archive**: the key fingerprint becomes the new prefix, so old unencrypted blobs (written under a different prefix) are simply ignored — no decryption errors. The cold sweep re-uploads all sessions under the new prefix. To clean up old blobs, remove them from the backend manually.
+
+## Prefix and namespace isolation
+
+Every backend supports an optional namespace prefix. The archiver sets one automatically so multiple users sharing the same storage container don't interfere with each other.
+
+### How the prefix is chosen
+
+1. **`HYDRA_ACP_ARCHIVER_PREFIX` is set** — that value is used verbatim. Set it to `""` to disable the prefix entirely (not recommended on shared storage).
+2. **Encryption is on, no explicit prefix** — the key fingerprint (first 8 bytes of SHA-256 of the key, encoded as 16 hex chars followed by `/`) is used, e.g. `a1b2c3d4e5f6a7b8/`. Everyone sharing the same key lands in the same namespace; different keys land in different namespaces. Rotating the key changes the prefix, which isolates new blobs from old ones.
+3. **Encryption off, no explicit prefix** — the OS username (sanitized to lowercase alphanumeric + hyphens, followed by `/`) is used, e.g. `alice/`.
+
+### Host segregation
+
+Within the user prefix, each machine writes to its own subdirectory named by its host ID. The full storage path is `<user-prefix><hostId>/<lineageId>.hydra.archive`. For example:
+
+```
+a1b2c3d4e5f6a7b8/
+  alice-macbook/uuid1.hydra.archive
+  alice-macbook/uuid2.hydra.archive
+  alice-desktop/uuid3.hydra.archive
+```
+
+The pull loop reads across all host subdirectories (seeing all peers' sessions) but skips its own host's files entirely — cheaper than parsing envelopes for self-loop detection. The session-ID check remains as a second layer for edge cases.
+
+Set `HYDRA_ACP_ARCHIVER_HOST_ID` to override the default (`os.hostname()` sanitized). Useful in containers or after a machine rename. Use the same value consistently across daemon restarts on a machine — changing it creates a new subdirectory and triggers a full re-upload.
+
+### What the prefix does per backend
+
+| Backend | Prefix behaviour |
+|---|---|
+| **S3** | Prepended to the S3 object key. `ListObjectsV2` is called with the `Prefix` parameter so only matching objects are fetched — efficient on large shared buckets. |
+| **fs** | Resolved as a subdirectory of the archive directory. Files land at `<dir>/<prefix>/<key>`. Each prefix gets its own isolated directory. |
+| **Google Drive** | Prepended to the Drive filename. Drive has no native directory structure within a folder, so `alice/uuid.hydra.archive` is literally the filename. `list()` filters client-side. |
+
+### Key rotation and re-upload
+
+When encryption is enabled and you regenerate the key (`hydra-acp-archiver keygen`), the fingerprint prefix changes. The new prefix namespace is empty, so the cold sweep on the next daemon start re-uploads all sessions encrypted with the new key. Old blobs under the previous prefix are simply ignored — no decryption errors, no manual cleanup required (though you can delete the old prefix from the bucket/dir when convenient).
+
+## Configuration file
+
+Instead of setting environment variables in `config.json`, you can use a plain-text config file at `~/.hydra-acp/archiver.conf` (override with `HYDRA_ACP_ARCHIVER_CONF`). Environment variables always take precedence over file values.
+
+```sh
+# ~/.hydra-acp/archiver.conf
+# All keys are optional — omit any you don't need.
+# Env vars override these values when both are set.
+
+BACKEND=s3
+
+# S3
+S3_BUCKET=my-hydra-archive
+S3_REGION=us-east-1
+# S3_ENDPOINT=https://<accountid>.r2.cloudflarestorage.com
+
+# Encryption
+KEY_PATH=/home/you/.hydra-acp/archiver-key
+
+# Identity
+HOST_ID=alice-macbook
+
+# Google Drive
+# GOOGLE_CREDENTIALS=/home/you/.hydra-acp/archiver-google-credentials.json
+# DRIVE_FOLDER=hydra-acp-archive
+
+# Tuning (rarely needed)
+# DEBOUNCE_MS=5000
+# PULL_MS=60000
+# DEBUG=false
+```
+
+Restrict permissions on the file if it contains sensitive paths: `chmod 600 ~/.hydra-acp/archiver.conf`.
+
+The file is optional — if it doesn't exist the archiver falls back to environment variables only.
+
 ## Environment variables
 
 | Variable | Default | Notes |
 | --- | --- | --- |
-| `HYDRA_ACP_ARCHIVER_BACKEND` | `google-drive` | `google-drive` \| `fs` |
+| `HYDRA_ACP_ARCHIVER_CONF` | `~/.hydra-acp/archiver.conf` | Path to the config file |
+| `HYDRA_ACP_ARCHIVER_BACKEND` | `google-drive` | `google-drive` \| `fs` \| `s3` |
 | `HYDRA_ACP_ARCHIVER_DRIVE_FOLDER` | `hydra-acp-archive` | Drive folder name |
 | `HYDRA_ACP_ARCHIVER_FS_DIR` | `~/.hydra-acp/archive` | Used when backend is `fs` |
+| `HYDRA_ACP_ARCHIVER_S3_BUCKET` | — | Bucket name (required for `s3`) |
+| `HYDRA_ACP_ARCHIVER_S3_REGION` | AWS SDK default | AWS region |
+| `HYDRA_ACP_ARCHIVER_S3_ENDPOINT` | — | Custom endpoint for R2/MinIO/B2 |
+| `HYDRA_ACP_ARCHIVER_PREFIX` | auto (fingerprint or username) | User-level namespace prefix applied by all backends |
+| `HYDRA_ACP_ARCHIVER_HOST_ID` | `os.hostname()` (sanitized) | Host identifier used as a subdirectory under the user prefix |
+| `HYDRA_ACP_ARCHIVER_KEY_PATH` | — | Path to encryption key file; if unset, encryption is off |
 | `HYDRA_ACP_ARCHIVER_GOOGLE_CREDENTIALS` | `~/.hydra-acp/archiver-google-credentials.json` | OAuth client JSON from GCP |
 | `HYDRA_ACP_ARCHIVER_CONFIG` | `~/.hydra-acp/archiver.config.js` | Rule file (optional) |
 | `HYDRA_ACP_ARCHIVER_POLL_MS` | `2000` | Session discovery cadence |
@@ -155,15 +300,16 @@ Return `false` to skip an upload. Any other value (including `undefined`) archiv
 - `~/.hydra-acp/archiver-state.json` — per-lineage cache of last uploaded hash + last seen remote upload, used for self-loop suppression. Safe to delete; archiver will rebuild it.
 - `~/.hydra-acp/archiver-google-credentials.json` — OAuth client JSON you downloaded.
 - `~/.hydra-acp/archiver-google-token.json` — refresh + access token (mode 0600). Re-run `hydra-acp-archiver login` to refresh.
+- `~/.hydra-acp/archiver-key` — encryption key (mode 0600), written by `hydra-acp-archiver keygen`. Copy this file to every machine in your sync group. Keep it safe — losing it means losing access to encrypted blobs.
 
 ## Troubleshooting
 
 - **`Missing HYDRA_ACP_TOKEN env var`** — you ran the archiver directly instead of via the daemon. Run it as a registered extension.
-- **`No Google OAuth token at …`** — run `hydra-acp-archiver login` first.
+- **`No Google OAuth token at …`** — run `hydra-acp-archiver gdrive login` first.
 - **`OAuth credentials file not found`** — follow the **First-time Google setup** steps to download the client JSON from GCP Console.
 - **Files aren't appearing in Drive** — check `~/.hydra-acp/extensions/hydra-acp-archiver.log` for errors. Common: consent-screen test-user list doesn't include your Google account.
 - **Two machines kept overwriting each other** — that's last-writer-wins working as designed if both are actively editing the same session. Avoid editing the same session on two machines simultaneously; one of them will lose its diff. A future `activeOn` claim-lock will close this gap.
 
 ## Backends
 
-Current: `google-drive`, `fs`. Adding a new one means implementing the `SyncBackend` interface in `src/backend/types.ts` and wiring it into `src/backend/factory.ts`.
+Current: `google-drive`, `fs`, `s3`. Adding a new one means implementing the `SyncBackend` interface in `src/backend/types.ts` and wiring it into `src/backend/factory.ts`. Encryption is handled by the `EncryptedBackend` wrapper in `src/backend/encrypted.ts` — new backends get it for free.

package/dist/backend/encrypted.js

@@ -0,0 +1,59 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes, } from "node:crypto";
+const VERSION = 1;
+const VERSION_LEN = 1;
+const FINGERPRINT_LEN = 8;
+const IV_LEN = 12;
+const TAG_LEN = 16;
+// Offset to the start of ciphertext within a blob.
+const HEADER_LEN = VERSION_LEN + FINGERPRINT_LEN + IV_LEN;
+export class EncryptedBackend {
+    inner;
+    key;
+    keyFingerprint;
+    constructor(inner, key) {
+        this.inner = inner;
+        this.key = key;
+        if (key.length !== 32)
+            throw new Error("encryption key must be 32 bytes");
+        this.keyFingerprint = createHash("sha256").update(key).digest().subarray(0, FINGERPRINT_LEN);
+    }
+    init() {
+        return this.inner.init();
+    }
+    list() {
+        return this.inner.list();
+    }
+    delete(key) {
+        return this.inner.delete(key);
+    }
+    async put(key, data) {
+        const iv = randomBytes(IV_LEN);
+        const cipher = createCipheriv("aes-256-gcm", this.key, iv);
+        const ciphertext = Buffer.concat([cipher.update(data), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        await this.inner.put(key, Buffer.concat([Buffer.from([VERSION]), this.keyFingerprint, iv, ciphertext, tag]));
+    }
+    async get(key) {
+        const blob = await this.inner.get(key);
+        if (blob.length < HEADER_LEN + TAG_LEN)
+            throw new Error(`encrypted blob too short for key ${key}`);
+        const version = blob[0];
+        if (version !== VERSION)
+            throw new Error(`unsupported encryption version ${version} for key ${key}: upgrade the archiver`);
+        const fingerprint = blob.subarray(VERSION_LEN, VERSION_LEN + FINGERPRINT_LEN);
+        if (!fingerprint.equals(this.keyFingerprint))
+            throw new Error(`key mismatch: blob ${key} was encrypted with a different key`);
+        const iv = blob.subarray(VERSION_LEN + FINGERPRINT_LEN, HEADER_LEN);
+        const tag = blob.subarray(blob.length - TAG_LEN);
+        const ciphertext = blob.subarray(HEADER_LEN, blob.length - TAG_LEN);
+        const decipher = createDecipheriv("aes-256-gcm", this.key, iv);
+        decipher.setAuthTag(tag);
+        try {
+            return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+        }
+        catch {
+            throw new Error(`blob ${key} failed authentication — data may be corrupted`);
+        }
+    }
+}
+//# sourceMappingURL=encrypted.js.map

package/dist/backend/encrypted.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted.js","sourceRoot":"","sources":["../../src/backend/encrypted.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,WAAW,GACZ,MAAM,aAAa,CAAC;AAGrB,MAAM,OAAO,GAAG,CAAC,CAAC;AAClB,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,MAAM,eAAe,GAAG,CAAC,CAAC;AAC1B,MAAM,MAAM,GAAG,EAAE,CAAC;AAClB,MAAM,OAAO,GAAG,EAAE,CAAC;AACnB,mDAAmD;AACnD,MAAM,UAAU,GAAG,WAAW,GAAG,eAAe,GAAG,MAAM,CAAC;AAE1D,MAAM,OAAO,gBAAgB;IAIR;IACA;IAJF,cAAc,CAAS;IAExC,YACmB,KAAkB,EAClB,GAAW;QADX,UAAK,GAAL,KAAK,CAAa;QAClB,QAAG,GAAH,GAAG,CAAQ;QAE5B,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;YACnB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;IAC/F,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,IAAY;QACjC,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACxE,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAChC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAClB,GAAG,EACH,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAClF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,MAAM,GAAG,UAAU,GAAG,OAAO;YACpC,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAC;QAE7D,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,OAAO,KAAK,OAAO;YACrB,MAAM,IAAI,KAAK,CAAC,kCAAkC,OAAO,YAAY,GAAG,wBAAwB,CAAC,CAAC;QAEpG,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW,GAAG,eAAe,CAAC,CAAC;QAC9E,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,qCAAqC,CAAC,CAAC;QAElF,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,GAAG,eAAe,EAAE,UAAU,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;QAEpE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC/D,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,gDAAgD,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;CACF"}

package/dist/backend/factory.js

@@ -1,14 +1,23 @@
 import { FsBackend } from "./fs.js";
 import { GoogleDriveBackend } from "./google-drive.js";
+import { S3Backend } from "./s3.js";
 export function makeBackend(config) {
     switch (config.backend) {
         case "fs":
-            return new FsBackend({ dir: config.fsDir });
+            return new FsBackend({ dir: config.fsDir, prefix: config.prefix });
         case "google-drive":
             return new GoogleDriveBackend({
                 credentialsPath: config.credentialsPath,
                 tokenPath: config.tokenPath,
                 folderName: config.driveFolderName,
+                prefix: config.prefix,
+            });
+        case "s3":
+            return new S3Backend({
+                bucket: config.s3Bucket,
+                region: config.s3Region,
+                endpoint: config.s3Endpoint,
+                prefix: config.prefix,
             });
         default: {
             const exhaustive = config.backend;

package/dist/backend/factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"factory.js","sourceRoot":"","sources":["../../src/backend/factory.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAGvD,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,QAAQ,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,KAAK,IAAI;YACP,OAAO,IAAI,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9C,KAAK,cAAc;YACjB,OAAO,IAAI,kBAAkB,CAAC;gBAC5B,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,UAAU,EAAE,MAAM,CAAC,eAAe;aACnC,CAAC,CAAC;QACL,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,MAAM,CAAC,OAAO,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"factory.js","sourceRoot":"","sources":["../../src/backend/factory.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAGpC,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,QAAQ,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,KAAK,IAAI;YACP,OAAO,IAAI,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACrE,KAAK,cAAc;YACjB,OAAO,IAAI,kBAAkB,CAAC;gBAC5B,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,UAAU,EAAE,MAAM,CAAC,eAAe;gBAClC,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC,CAAC;QACL,KAAK,IAAI;YACP,OAAO,IAAI,SAAS,CAAC;gBACnB,MAAM,EAAE,MAAM,CAAC,QAAQ;gBACvB,MAAM,EAAE,MAAM,CAAC,QAAQ;gBACvB,QAAQ,EAAE,MAAM,CAAC,UAAU;gBAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC,CAAC;QACL,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,MAAM,CAAC,OAAO,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/backend/fs.js

@@ -1,5 +1,5 @@
 import { mkdir, readFile, readdir, rename, stat, unlink, writeFile, } from "node:fs/promises";
-import { resolve } from "node:path";
+import { dirname, resolve } from "node:path";
 import { logger } from "../util/log.js";
 const log = logger("backend.fs");
 // Filesystem-backed implementation. Useful for tests, for users who want
@@ -7,17 +7,22 @@ const log = logger("backend.fs");
 // directory, and for development against a local daemon.
 export class FsBackend {
     opts;
+    root;
     constructor(opts) {
         this.opts = opts;
+        this.root = opts.prefix !== "" ? resolve(opts.dir, opts.prefix) : opts.dir;
     }
     async init() {
-        await mkdir(this.opts.dir, { recursive: true });
-        log.info(`fs backend ready at ${this.opts.dir}`);
+        await mkdir(this.root, { recursive: true });
+        log.info(`fs backend ready at ${this.root}`);
     }
     async list() {
+        return this.walk(this.root, "");
+    }
+    async walk(dir, rel) {
         let names;
         try {
-            names = await readdir(this.opts.dir);
+            names = await readdir(dir);
         }
         catch (err) {
             const e = err;
@@ -31,17 +36,16 @@ export class FsBackend {
             if (name.startsWith(".") || name.endsWith(".tmp")) {
                 continue;
             }
-            const full = resolve(this.opts.dir, name);
+            const full = resolve(dir, name);
+            const entryRel = rel !== "" ? `${rel}/${name}` : name;
             try {
                 const s = await stat(full);
-                if (!s.isFile()) {
-                    continue;
+                if (s.isDirectory()) {
+                    out.push(...await this.walk(full, entryRel));
+                }
+                else if (s.isFile()) {
+                    out.push({ key: entryRel, size: s.size, modifiedAt: s.mtime.toISOString() });
                 }
-                out.push({
-                    key: name,
-                    size: s.size,
-                    modifiedAt: s.mtime.toISOString(),
-                });
             }
             catch (err) {
                 log.debug(`stat ${full}: ${err.message}`);
@@ -50,17 +54,18 @@ export class FsBackend {
         return out;
     }
     async get(key) {
-        return readFile(resolve(this.opts.dir, key));
+        return readFile(resolve(this.root, key));
     }
     async put(key, data) {
-        const dest = resolve(this.opts.dir, key);
+        const dest = resolve(this.root, key);
         const tmp = `${dest}.tmp`;
+        await mkdir(dirname(dest), { recursive: true });
         await writeFile(tmp, data);
         await rename(tmp, dest);
     }
     async delete(key) {
         try {
-            await unlink(resolve(this.opts.dir, key));
+            await unlink(resolve(this.root, key));
         }
         catch (err) {
             const e = err;

package/dist/backend/fs.js.map

@@ -1 +1 @@
-{"version":3,"file":"fs.js","sourceRoot":"","sources":["../../src/backend/fs.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,QAAQ,EACR,OAAO,EACP,MAAM,EACN,IAAI,EACJ,MAAM,EACN,SAAS,GACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAGxC,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;AAMjC,yEAAyE;AACzE,kEAAkE;AAClE,yDAAyD;AACzD,MAAM,OAAO,SAAS;IACS;IAA7B,YAA6B,IAAsB;QAAtB,SAAI,GAAJ,IAAI,CAAkB;IAAG,CAAC;IAEvD,KAAK,CAAC,IAAI;QACR,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,GAAG,CAAC,IAAI,CAAC,uBAAuB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,GAA4B,CAAC;YACvC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACxB,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,GAAG,GAAuB,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClD,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC1C,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC3B,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;oBAChB,SAAS;gBACX,CAAC;gBACD,GAAG,CAAC,IAAI,CAAC;oBACP,GAAG,EAAE,IAAI;oBACT,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE;iBAClC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,IAAY;QACjC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;QAC1B,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3B,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,GAA4B,CAAC;YACvC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACxB,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"fs.js","sourceRoot":"","sources":["../../src/backend/fs.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,QAAQ,EACR,OAAO,EACP,MAAM,EACN,IAAI,EACJ,MAAM,EACN,SAAS,GACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAGxC,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;AAOjC,yEAAyE;AACzE,kEAAkE;AAClE,yDAAyD;AACzD,MAAM,OAAO,SAAS;IAGS;IAFZ,IAAI,CAAS;IAE9B,YAA6B,IAAsB;QAAtB,SAAI,GAAJ,IAAI,CAAkB;QACjD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,uBAAuB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,IAAI;QACR,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAClC,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,GAAW;QACzC,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,GAA4B,CAAC;YACvC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACxB,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,GAAG,GAAuB,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClD,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAChC,MAAM,QAAQ,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACtD,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC3B,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;oBACpB,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;gBAC/C,CAAC;qBAAM,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;oBACtB,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;gBAC/E,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,IAAY;QACjC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;QAC1B,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3B,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,GAA4B,CAAC;YACvC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACxB,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/backend/google-drive.js

@@ -8,10 +8,21 @@ const FILE_MIME = "application/json";
 // Drive-backed implementation. Uses the drive.file scope, which limits
 // visibility to files the app created plus those explicitly handed to
 // it — so the archiver never sees the user's other Drive contents.
+//
+// The prefix is resolved into real Drive subfolders on init(). A prefix
+// of "a1b2c3d4/alice-macbook/" creates:
+//   hydra-acp-archive/
+//     a1b2c3d4/
+//       alice-macbook/
+//         <lineageId>.hydra.archive
+//
+// list() recurses into all immediate subfolders of the prefix folder so the
+// sync backend (prefix = "user/") can see files from all host subfolders.
 export class GoogleDriveBackend {
     opts;
     drive;
-    folderId;
+    // The Drive folder ID corresponding to the resolved prefix path.
+    prefixFolderId;
     constructor(opts) {
         this.opts = opts;
     }
@@ -21,39 +32,24 @@ export class GoogleDriveBackend {
             tokenPath: this.opts.tokenPath,
         });
         this.drive = google.drive({ version: "v3", auth });
-        this.folderId = await this.ensureFolder(this.opts.folderName);
-        log.info(`google-drive backend ready: folder="${this.opts.folderName}" id=${this.folderId}`);
+        // Walk the root folder name + each prefix segment, ensuring each exists.
+        let currentId = await this.ensureFolder(this.opts.folderName, undefined);
+        const segments = this.opts.prefix
+            .split("/")
+            .filter((s) => s !== "");
+        for (const seg of segments) {
+            currentId = await this.ensureFolder(seg, currentId);
+        }
+        this.prefixFolderId = currentId;
+        log.info(`google-drive backend ready: folder="${this.opts.folderName}" prefix="${this.opts.prefix}" id=${this.prefixFolderId}`);
     }
     async list() {
-        const drive = this.requireDrive();
-        const parent = this.requireFolderId();
-        const entries = [];
-        let pageToken;
-        do {
-            const res = await drive.files.list({
-                q: `'${parent}' in parents and trashed = false`,
-                fields: "nextPageToken, files(id, name, size, modifiedTime)",
-                spaces: "drive",
-                pageSize: 200,
-                ...(pageToken !== undefined ? { pageToken } : {}),
-            });
-            for (const f of res.data.files ?? []) {
-                if (!f.name) {
-                    continue;
-                }
-                entries.push({
-                    key: f.name,
-                    size: typeof f.size === "string" ? Number.parseInt(f.size, 10) : 0,
-                    modifiedAt: f.modifiedTime ?? new Date(0).toISOString(),
-                });
-            }
-            pageToken = res.data.nextPageToken ?? undefined;
-        } while (pageToken);
-        return entries;
+        return this.listFolder(this.requirePrefixFolderId(), "");
     }
     async get(key) {
         const drive = this.requireDrive();
-        const fileId = await this.findFileId(key);
+        const { parentId, name } = await this.resolveKey(key);
+        const fileId = await this.findFileId(name, parentId);
         if (!fileId) {
             throw new Error(`google-drive: no file named ${key}`);
         }
@@ -62,85 +58,120 @@ export class GoogleDriveBackend {
     }
     async put(key, data) {
         const drive = this.requireDrive();
-        const parent = this.requireFolderId();
-        const existing = await this.findFileId(key);
-        const media = {
-            mimeType: FILE_MIME,
-            body: Readable.from(data),
-        };
+        const { parentId, name } = await this.resolveKey(key);
+        const existing = await this.findFileId(name, parentId);
+        const media = { mimeType: FILE_MIME, body: Readable.from(data) };
         if (existing) {
-            await drive.files.update({
-                fileId: existing,
-                media,
-            });
+            await drive.files.update({ fileId: existing, media });
             return;
         }
         await drive.files.create({
-            requestBody: {
-                name: key,
-                mimeType: FILE_MIME,
-                parents: [parent],
-            },
+            requestBody: { name, mimeType: FILE_MIME, parents: [parentId] },
             media,
             fields: "id",
         });
     }
     async delete(key) {
-        const drive = this.requireDrive();
-        const fileId = await this.findFileId(key);
-        if (!fileId) {
+        const { parentId, name } = await this.resolveKey(key);
+        const fileId = await this.findFileId(name, parentId);
+        if (!fileId)
             return;
-        }
         // Trash rather than hard-delete — recoverable for 30 days.
-        await drive.files.update({
+        await this.requireDrive().files.update({
             fileId,
             requestBody: { trashed: true },
         });
     }
     requireDrive() {
-        if (!this.drive) {
+        if (!this.drive)
             throw new Error("GoogleDriveBackend used before init()");
-        }
         return this.drive;
     }
-    requireFolderId() {
-        if (!this.folderId) {
+    requirePrefixFolderId() {
+        if (!this.prefixFolderId)
             throw new Error("GoogleDriveBackend used before init()");
+        return this.prefixFolderId;
+    }
+    // Resolve a key that may contain a host subdirectory segment
+    // (e.g. "alice-macbook/uuid.hydra.archive") into a (parentId, filename)
+    // pair, creating intermediate folders as needed.
+    async resolveKey(key) {
+        const parts = key.split("/");
+        const name = parts[parts.length - 1];
+        let parentId = this.requirePrefixFolderId();
+        for (const seg of parts.slice(0, -1)) {
+            parentId = await this.ensureFolder(seg, parentId);
         }
-        return this.folderId;
+        return { parentId, name };
     }
-    async ensureFolder(name) {
+    // Recursive list: returns files in folderId and all immediate subfolders,
+    // with keys relative to folderId (e.g. "alice-macbook/uuid.hydra.archive").
+    async listFolder(folderId, relPath) {
+        const drive = this.requireDrive();
+        const entries = [];
+        let pageToken;
+        do {
+            const res = await drive.files.list({
+                q: `'${folderId}' in parents and trashed = false`,
+                fields: "nextPageToken, files(id, name, size, modifiedTime, mimeType)",
+                spaces: "drive",
+                pageSize: 200,
+                ...(pageToken !== undefined ? { pageToken } : {}),
+            });
+            for (const f of res.data.files ?? []) {
+                if (!f.name)
+                    continue;
+                const entryRel = relPath !== "" ? `${relPath}/${f.name}` : f.name;
+                if (f.mimeType === FOLDER_MIME) {
+                    entries.push(...await this.listFolder(f.id, entryRel));
+                }
+                else {
+                    entries.push({
+                        key: entryRel,
+                        size: typeof f.size === "string" ? Number.parseInt(f.size, 10) : 0,
+                        modifiedAt: f.modifiedTime ?? new Date(0).toISOString(),
+                    });
+                }
+            }
+            pageToken = res.data.nextPageToken ?? undefined;
+        } while (pageToken);
+        return entries;
+    }
+    // Ensure a folder with the given name exists under parentId (or at root if
+    // parentId is undefined). Returns the folder's Drive ID.
+    async ensureFolder(name, parentId) {
         const drive = this.requireDrive();
         const escaped = name.replace(/'/g, "\\'");
+        const parentClause = parentId !== undefined
+            ? `'${parentId}' in parents and `
+            : "";
         const res = await drive.files.list({
-            q: `name = '${escaped}' and mimeType = '${FOLDER_MIME}' and trashed = false`,
+            q: `${parentClause}name = '${escaped}' and mimeType = '${FOLDER_MIME}' and trashed = false`,
             fields: "files(id, name)",
             spaces: "drive",
             pageSize: 10,
         });
         const existing = res.data.files?.[0];
-        if (existing?.id) {
+        if (existing?.id)
             return existing.id;
-        }
         const created = await drive.files.create({
             requestBody: {
                 name,
                 mimeType: FOLDER_MIME,
+                ...(parentId !== undefined ? { parents: [parentId] } : {}),
             },
             fields: "id",
         });
-        if (!created.data.id) {
+        if (!created.data.id)
             throw new Error("google-drive: folder create returned no id");
-        }
         log.info(`created Drive folder "${name}" id=${created.data.id}`);
         return created.data.id;
     }
-    async findFileId(key) {
+    async findFileId(name, parentId) {
         const drive = this.requireDrive();
-        const parent = this.requireFolderId();
-        const escaped = key.replace(/'/g, "\\'");
+        const escaped = name.replace(/'/g, "\\'");
         const res = await drive.files.list({
-            q: `'${parent}' in parents and name = '${escaped}' and trashed = false`,
+            q: `'${parentId}' in parents and name = '${escaped}' and trashed = false`,
             fields: "files(id, name)",
             spaces: "drive",
             pageSize: 2,