@ultrst-armada/kloks 1.7.1 → 1.8.0

package/.krusbl-release-attestation.json

@@ -1,8 +1,8 @@
 {
   "schema": 1,
   "packageName": "@ultrst-armada/kloks",
-  "version": "1.7.1",
-  "sourceCommit": "67d641336636d076f15240809b73c0a4f9f438b5",
+  "version": "1.8.0",
+  "sourceCommit": "d364f4fd5a705bea93c4fb0a93ff9740c1050f49",
   "releaseWorkflow": "npm Release",
-  "workflowRunId": "40193283076"
+  "workflowRunId": "40208606705"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultrst-armada/kloks",
-  "version": "1.7.1",
+  "version": "1.8.0",
   "private": false,
   "publishConfig": {
     "access": "public",

package/packages/backend/dist/{BaseStorageAdapter-6x_BQiB3.d.ts → BaseStorageAdapter-EUCSvJse.d.ts}

@@ -22,6 +22,7 @@ interface StorageConfig {
     googleClientId?: string;
     googleRedirectUri?: string;
     googleAccessToken?: string;
+    googleAccessTokenExpiresAt?: number;
     googleRefreshToken?: string;
     googleRootFolderId?: string;
 }

package/packages/backend/dist/auth/index.d.ts

@@ -26,31 +26,69 @@ declare class AdminGuard extends SkipoBase {
     static verifyUser(authHeaderOrToken: string | null | undefined, provider: BaseAccountProvider): Promise<AuthSession>;
 }
 
-/**
- * @file UnifiedAuthCore.ts
- * @description Strict Universal Authentication against "ultrst-users" and "ultrst-credentials".
- * Zero offline dummy fallbacks. Runs across Node.js, Vercel, and Cloudflare Workers (< 200 lines).
- */
-interface SystemUser {
+interface CanonicalAuthUser {
     id: string;
     email: string;
-    username: string;
     name: string;
+    username?: string;
+    role?: string;
+    status?: string;
+    appProfiles?: Record<string, unknown>;
+    emailVerified?: boolean;
+}
+interface CanonicalAuthSession {
+    session: Record<string, unknown>;
+    user: CanonicalAuthUser;
+}
+interface CanonicalAuthClientOptions {
+    baseUrl: string;
+    fetcher?: typeof fetch;
+    credentials?: RequestCredentials;
+}
+interface AuthResult {
+    success: boolean;
+    status: number;
+    user?: CanonicalAuthUser;
+    session?: Record<string, unknown>;
+    error?: string;
+    redirectUrl?: string;
+}
+declare class CanonicalAuthClient {
+    private readonly baseUrl;
+    private readonly fetcher;
+    private readonly credentials;
+    constructor(options: CanonicalAuthClientOptions);
+    private request;
+    signInEmail(email: string, password: string): Promise<AuthResult>;
+    signUpEmail(email: string, password: string, name: string): Promise<AuthResult>;
+    signInGoogle(callbackURL: string): Promise<AuthResult>;
+    requestGoogleDriveAccess(callbackURL?: string): Promise<AuthResult>;
+    getSession(cookie?: string): Promise<CanonicalAuthSession | null>;
+    signOut(): Promise<boolean>;
+}
+declare function createCanonicalAuthClient(baseUrl: string, fetcher?: typeof fetch): CanonicalAuthClient;
+
+interface SystemUser extends CanonicalAuthUser {
+    username: string;
     role: string;
     status: string;
-    appProfiles?: Record<string, any>;
+    appProfiles?: Record<string, unknown>;
+}
+interface AuthEnvironment {
+    SRKL_AUTH_BASE_URL?: string;
+    [key: string]: unknown;
 }
-declare function loginSystemUser(email: string, rawPass: string, isAdmin: boolean, queryDb: (sql: string, params?: unknown[]) => Promise<{
+declare function loginSystemUser(email: string, rawPass: string, isAdmin: boolean, _queryDb: (sql: string, params?: unknown[]) => Promise<{
     rows: any[];
-}>): Promise<{
+}>, env?: AuthEnvironment): Promise<{
     success: boolean;
     status: number;
     token?: string;
     user?: SystemUser;
     error?: string;
 }>;
-declare function resolveUserFromToken(tokenOrUserId: string, queryDb: (sql: string, params?: unknown[]) => Promise<{
+declare function resolveUserFromToken(tokenOrUserId: string, _queryDb: (sql: string, params?: unknown[]) => Promise<{
     rows: any[];
-}>): Promise<SystemUser | null>;
+}>, env?: AuthEnvironment): Promise<SystemUser | null>;
 
-export { AdminGuard, AuthSession, BaseAccountProvider, CreateUserData, LocalAccountProvider, PasswordHasher, type SystemUser, User, loginSystemUser, resolveUserFromToken };
+export { AdminGuard, type AuthEnvironment, type AuthResult, AuthSession, BaseAccountProvider, CanonicalAuthClient, type CanonicalAuthClientOptions, type CanonicalAuthSession, type CanonicalAuthUser, CreateUserData, LocalAccountProvider, PasswordHasher, type SystemUser, User, createCanonicalAuthClient, loginSystemUser, resolveUserFromToken };

package/packages/backend/dist/auth/index.js

@@ -3,20 +3,24 @@ import {
   BaseAccountProvider,
   LocalAccountProvider,
   PasswordHasher
-} from "../chunk-MPYASJ5A.js";
+} from "../chunk-HT2SEDHD.js";
 import {
+  CanonicalAuthClient,
   RateLimiter,
   SessionManager,
+  createCanonicalAuthClient,
   loginSystemUser,
   resolveUserFromToken
-} from "../chunk-ZDH4XI7W.js";
+} from "../chunk-M4GSR46Y.js";
 export {
   AdminGuard,
   BaseAccountProvider,
+  CanonicalAuthClient,
   LocalAccountProvider,
   PasswordHasher,
   RateLimiter,
   SessionManager,
+  createCanonicalAuthClient,
   loginSystemUser,
   resolveUserFromToken
 };

package/packages/backend/dist/{chunk-F6IDQLC2.js → chunk-5RXXC6GE.js}

@@ -1,9 +1,9 @@
-import {
-  StorageAdapterFactory
-} from "./chunk-R45CEV46.js";
 import {
   findUserWorkspace
 } from "./chunk-6K75XXFD.js";
+import {
+  StorageAdapterFactory
+} from "./chunk-SHZAQTIT.js";
 
 // src/services/workspaceGraphService.ts
 function slugify(name) {

package/packages/backend/dist/{chunk-7ZT2ZPPH.js → chunk-BPFZCDS4.js}

@@ -1,16 +1,10 @@
-import {
-  workspaceGraphService
-} from "./chunk-F6IDQLC2.js";
 import {
   getSrklAccounts,
   srklListBackblazeBuckets
 } from "./chunk-XHADDA75.js";
 import {
-  StorageAdapterFactory
-} from "./chunk-R45CEV46.js";
-import {
-  b2ListBuckets
-} from "./chunk-4QEMALXF.js";
+  workspaceGraphService
+} from "./chunk-5RXXC6GE.js";
 import {
   formatCanonicalWorkspaceFolderName,
   sanitizeWorkspaceName
@@ -25,12 +19,18 @@ import {
 import {
   queryUnifiedDb
 } from "./chunk-VAFCR2MS.js";
+import {
+  b2ListBuckets
+} from "./chunk-4QEMALXF.js";
+import {
+  StorageAdapterFactory
+} from "./chunk-SHZAQTIT.js";
 import {
   RateLimiter,
   SessionManager,
   loginSystemUser,
   resolveUserFromToken
-} from "./chunk-ZDH4XI7W.js";
+} from "./chunk-M4GSR46Y.js";
 import {
   createService,
   createServiceDefinition
@@ -56,12 +56,12 @@ var AuthServiceDefinition = createServiceDefinition({
     login: {
       id: "AuthService.login",
       name: "login",
-      handler: async (input) => loginSystemUser(input.email, input.password, Boolean(input.isAdmin), (sql, params) => queryUnifiedDb(sql, params, input.env))
+      handler: async (input) => loginSystemUser(input.email, input.password, Boolean(input.isAdmin), (sql, params) => queryUnifiedDb(sql, params, input.env), input.env)
     },
     resolveUser: {
       id: "AuthService.resolveUser",
       name: "resolveUser",
-      handler: async (input) => resolveUserFromToken(input.tokenOrUserId, (sql, params) => queryUnifiedDb(sql, params, input.env))
+      handler: async (input) => resolveUserFromToken(input.tokenOrUserId, (sql, params) => queryUnifiedDb(sql, params, input.env), input.env)
     },
     checkRateLimit: {
       id: "AuthService.checkRateLimit",

package/packages/backend/dist/{chunk-6W7OAGNV.js → chunk-BTMIK44G.js}

@@ -11,6 +11,9 @@ import {
   b2UploadFile,
   queryUnifiedDb
 } from "./chunk-VAFCR2MS.js";
+import {
+  GoogleDriveAdapter
+} from "./chunk-KKRWZDMN.js";
 
 // src/workspace/WorkspaceFS.ts
 import { SkipoBase } from "@ultrst-armada/kloks/functions";
@@ -374,6 +377,86 @@ async function syncWorkspace(workspaceId) {
       };
     }
   }
+  const isGoogleDrive = workspace.storageProvider === "google_drive" || workspace.storageConfig?.type === "google_drive";
+  if (isGoogleDrive) {
+    const creds = workspace.storageConfig || connection?.credentials || connection || {};
+    const rootFolderId = creds.googleRootFolderId || creds.rootFolderId || workspace.googleRootFolderId;
+    const adapter = new GoogleDriveAdapter({
+      provider: "google_drive",
+      googleAccessToken: creds.googleAccessToken || creds.accessToken,
+      googleAccessTokenExpiresAt: creds.googleAccessTokenExpiresAt,
+      googleRefreshToken: creds.googleRefreshToken || creds.refreshToken,
+      googleClientId: creds.googleClientId || process.env.GOOGLE_CLIENT_ID,
+      googleRootFolderId: rootFolderId
+    });
+    try {
+      const remoteFiles = await adapter.list("");
+      const remoteMap = /* @__PURE__ */ new Map();
+      for (const rf of remoteFiles) {
+        if (rf.path) remoteMap.set(rf.path, { size: rf.size, timestamp: rf.modifiedAt });
+      }
+      const localFiles = await collectLocalFiles(workingDir);
+      const localMap = /* @__PURE__ */ new Map();
+      for (const lf of localFiles) {
+        localMap.set(lf.relPath, lf);
+      }
+      for (const [relPath, rInfo] of remoteMap.entries()) {
+        const lFile = localMap.get(relPath);
+        const shouldDownload = !lFile || rInfo.timestamp > lFile.mtimeMs + 2e3;
+        if (shouldDownload) {
+          const buf = await adapter.read(relPath);
+          const destPath = path.join(workingDir, relPath);
+          await fs.promises.mkdir(path.dirname(destPath), { recursive: true });
+          await fs.promises.writeFile(destPath, buf);
+          try {
+            const fileTime = new Date(rInfo.timestamp);
+            await fs.promises.utimes(destPath, fileTime, fileTime);
+          } catch {
+          }
+          syncedFiles.push({ fileName: relPath, action: "DOWNLOADED", sizeBytes: buf.byteLength });
+          downloadedCount++;
+        }
+      }
+      for (const [relPath, lFile] of localMap.entries()) {
+        const rInfo = remoteMap.get(relPath);
+        const shouldUpload = !rInfo || lFile.mtimeMs > rInfo.timestamp + 2e3;
+        if (shouldUpload) {
+          const content = await fs.promises.readFile(lFile.fullPath);
+          await adapter.write(relPath, new Uint8Array(content));
+          syncedFiles.push({ fileName: relPath, action: "UPLOADED", sizeBytes: lFile.sizeBytes });
+          uploadedCount++;
+        } else if (!syncedFiles.some((f) => f.fileName === relPath)) {
+          syncedFiles.push({ fileName: relPath, action: "UP_TO_DATE", sizeBytes: lFile.sizeBytes });
+        }
+      }
+      return {
+        success: true,
+        workspaceId,
+        folderKey,
+        workingDir,
+        persistenceType: "google_drive",
+        targetLocation: `GoogleDrive://${rootFolderId || "root"}`,
+        syncedFiles,
+        uploadedCount,
+        downloadedCount,
+        syncedAt: nowIso
+      };
+    } catch (err) {
+      return {
+        success: false,
+        workspaceId,
+        folderKey,
+        workingDir,
+        persistenceType: "google_drive",
+        targetLocation: `GoogleDrive://${rootFolderId || "root"}`,
+        syncedFiles,
+        uploadedCount,
+        downloadedCount,
+        syncedAt: nowIso,
+        error: err.message || "Google Drive sync failed."
+      };
+    }
+  }
   const vaultDir = path.resolve(process.cwd(), folderKey);
   await fs.promises.mkdir(vaultDir, { recursive: true });
   try {
@@ -490,7 +573,7 @@ var WorkingWorkspaceService = class {
   }
   async deleteFile(_workspaceId, filePath) {
     const cleanRel = filePath.replace(/^\/+/, "");
-    const fullPath = path2.resolve(this.getWorkingDir(), cleanRel);
+    const fullPath = path2.resolve(this.getWorkingDir(_workspaceId), cleanRel);
     try {
       await fs2.promises.unlink(fullPath);
       return { success: true };

package/packages/backend/dist/{chunk-MPYASJ5A.js → chunk-HT2SEDHD.js}

@@ -1,7 +1,7 @@
 import {
   RateLimiter,
   SessionManager
-} from "./chunk-ZDH4XI7W.js";
+} from "./chunk-M4GSR46Y.js";
 
 // src/auth/PasswordHasher.ts
 var bcrypt = null;

package/packages/backend/dist/chunk-KKRWZDMN.js

@@ -0,0 +1,237 @@
+// src/storage/BaseStorageAdapter.ts
+import { SkipoBase } from "@ultrst-armada/kloks/functions";
+var BaseStorageAdapter = class extends SkipoBase {
+  config;
+  constructor(config) {
+    super({ name: "BaseStorageAdapter" });
+    this.config = config;
+  }
+  async deleteFolder(pathStr) {
+    const items = await this.list(pathStr);
+    let count = 0;
+    for (const item of items) {
+      await this.delete(item.path);
+      count++;
+    }
+    return { success: true, deletedCount: count };
+  }
+  async renameFolder(oldPath, newPath) {
+    const items = await this.list(oldPath);
+    let count = 0;
+    for (const item of items) {
+      const rel = item.path.startsWith(oldPath) ? item.path.slice(oldPath.length).replace(/^\/+/, "") : item.path;
+      const target = `${newPath.replace(/\/+$/, "")}/${rel}`;
+      const data = await this.read(item.path);
+      await this.write(target, data);
+      await this.delete(item.path);
+      count++;
+    }
+    return { success: true, movedCount: count };
+  }
+  async ensureDirectory(pathStr) {
+    await this.mkdir(pathStr);
+  }
+  async testConnection() {
+    const start = performance.now();
+    try {
+      await this.list("");
+      return { ok: true, latencyMs: Math.round(performance.now() - start) };
+    } catch (e) {
+      return { ok: false, latencyMs: Math.round(performance.now() - start), error: e.message };
+    }
+  }
+  normalizePath(p) {
+    return p.replace(/\\/g, "/").replace(/^\/+/, "");
+  }
+  getExtension(p) {
+    const parts = p.split(".");
+    return parts.length > 1 ? parts[parts.length - 1] : "";
+  }
+};
+
+// src/storage/GoogleDriveOAuth.ts
+var AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
+var TOKEN_URL = "https://oauth2.googleapis.com/token";
+function createGoogleDriveAuthorizationUrl(config, state, codeChallenge) {
+  const params = new URLSearchParams({
+    client_id: config.clientId,
+    redirect_uri: config.redirectUri,
+    response_type: "code",
+    access_type: "offline",
+    prompt: "consent",
+    scope: (config.scopes || ["https://www.googleapis.com/auth/drive.file"]).join(" "),
+    state
+  });
+  if (codeChallenge) {
+    params.set("code_challenge", codeChallenge);
+    params.set("code_challenge_method", "S256");
+  }
+  return `${AUTH_URL}?${params.toString()}`;
+}
+async function exchangeGoogleDriveCode(config, code, codeVerifier) {
+  const body = new URLSearchParams({
+    client_id: config.clientId,
+    redirect_uri: config.redirectUri,
+    code,
+    grant_type: "authorization_code"
+  });
+  if (config.clientSecret) body.set("client_secret", config.clientSecret);
+  if (codeVerifier) body.set("code_verifier", codeVerifier);
+  const response = await fetch(TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body
+  });
+  if (!response.ok) throw new Error(`Google OAuth token exchange failed: ${response.status}`);
+  const data = await response.json();
+  return {
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token,
+    expiresAt: data.expires_in ? Date.now() + Number(data.expires_in) * 1e3 : void 0,
+    tokenType: data.token_type
+  };
+}
+async function refreshGoogleDriveAccessToken(clientId, refreshToken) {
+  const body = new URLSearchParams({
+    client_id: clientId,
+    refresh_token: refreshToken,
+    grant_type: "refresh_token"
+  });
+  const response = await fetch(TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body
+  });
+  if (!response.ok) throw new Error(`Google OAuth refresh failed: ${response.status}`);
+  const data = await response.json();
+  return {
+    accessToken: data.access_token,
+    expiresAt: data.expires_in ? Date.now() + Number(data.expires_in) * 1e3 : void 0,
+    tokenType: data.token_type
+  };
+}
+
+// src/storage/GoogleDriveAdapter.ts
+var GoogleDriveAdapter = class extends BaseStorageAdapter {
+  async token() {
+    const accessToken = this.config.googleAccessToken || this.config.accessKey;
+    const expiresAt = Number(this.config.googleAccessTokenExpiresAt || 0);
+    if (accessToken && (!expiresAt || expiresAt > Date.now() + 6e4)) return accessToken;
+    const refreshToken = this.config.googleRefreshToken;
+    const clientId = this.config.googleClientId;
+    if (!refreshToken || !clientId) throw new Error("Google Drive OAuth credentials are incomplete.");
+    const refreshed = await refreshGoogleDriveAccessToken(clientId, refreshToken);
+    this.config.googleAccessToken = refreshed.accessToken;
+    this.config.googleAccessTokenExpiresAt = refreshed.expiresAt;
+    return refreshed.accessToken;
+  }
+  async request(url, init = {}) {
+    const headers = new Headers(init.headers);
+    headers.set("Authorization", `Bearer ${await this.token()}`);
+    return fetch(url, { ...init, headers });
+  }
+  async findChild(parentId, name) {
+    const q = `'${parentId}' in parents and name = '${name.replace(/'/g, "\\'")}' and trashed = false`;
+    const res = await this.request(`https://www.googleapis.com/drive/v3/files?q=${encodeURIComponent(q)}&fields=files(id,name,size,modifiedTime,mimeType)&pageSize=10`);
+    if (!res.ok) throw new Error(`Google Drive lookup failed: ${res.status}`);
+    const data = await res.json();
+    return data.files?.[0] || null;
+  }
+  async resolveParent(relativeDir, create = false) {
+    let parent = this.config.googleRootFolderId || this.config.rootFolderId || "root";
+    for (const part of this.normalizePath(relativeDir).split("/").filter(Boolean)) {
+      let child = await this.findChild(parent, part);
+      if (!child && create) {
+        const res = await this.request("https://www.googleapis.com/drive/v3/files", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ name: part, mimeType: "application/vnd.google-apps.folder", parents: [parent] })
+        });
+        if (!res.ok) throw new Error(`Google Drive folder creation failed: ${res.status}`);
+        child = await res.json();
+      }
+      if (!child) throw new Error(`Google Drive directory not found: ${part}`);
+      parent = child.id;
+    }
+    return parent;
+  }
+  split(pathStr) {
+    const key = this.normalizePath(pathStr);
+    const i = key.lastIndexOf("/");
+    return i < 0 ? { dir: "", name: key } : { dir: key.slice(0, i), name: key.slice(i + 1) };
+  }
+  async read(pathStr) {
+    const { dir, name } = this.split(pathStr);
+    const parent = await this.resolveParent(dir);
+    const file = await this.findChild(parent, name);
+    if (!file) throw new Error(`Google Drive file not found: ${pathStr}`);
+    const res = await this.request(`https://www.googleapis.com/drive/v3/files/${file.id}?alt=media`);
+    if (!res.ok) throw new Error(`Google Drive download failed: ${res.status}`);
+    return new Uint8Array(await res.arrayBuffer());
+  }
+  async write(pathStr, data, contentType = "application/octet-stream") {
+    const { dir, name } = this.split(pathStr);
+    const parent = await this.resolveParent(dir, true);
+    const existing = await this.findChild(parent, name);
+    const bytes = typeof data === "string" ? new TextEncoder().encode(data) : data;
+    const form = new FormData();
+    form.append("metadata", new Blob([JSON.stringify({ name, mimeType: contentType, ...existing ? {} : { parents: [parent] } })], { type: "application/json" }));
+    form.append("file", new Blob([bytes], { type: contentType }));
+    const url = existing ? `https://www.googleapis.com/upload/drive/v3/files/${existing.id}?uploadType=multipart` : "https://www.googleapis.com/upload/drive/v3/files?uploadType=multipart";
+    const res = await this.request(url, { method: existing ? "PATCH" : "POST", body: form });
+    if (!res.ok) throw new Error(`Google Drive upload failed: ${res.status}`);
+  }
+  async delete(pathStr) {
+    const { dir, name } = this.split(pathStr);
+    const parent = await this.resolveParent(dir);
+    const file = await this.findChild(parent, name);
+    if (!file) return;
+    const res = await this.request(`https://www.googleapis.com/drive/v3/files/${file.id}`, { method: "DELETE" });
+    if (!res.ok && res.status !== 404) throw new Error(`Google Drive delete failed: ${res.status}`);
+  }
+  async exists(pathStr) {
+    try {
+      await this.stat(pathStr);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  async list(pathStr = "") {
+    const parent = await this.resolveParent(pathStr);
+    const q = `'${parent}' in parents and trashed = false`;
+    const res = await this.request(`https://www.googleapis.com/drive/v3/files?q=${encodeURIComponent(q)}&fields=files(id,name,size,modifiedTime,mimeType)&pageSize=1000`);
+    if (!res.ok) throw new Error(`Google Drive list failed: ${res.status}`);
+    const data = await res.json();
+    return (data.files || []).map((f) => ({ path: this.normalizePath(pathStr ? `${pathStr}/${f.name}` : f.name), size: Number(f.size || 0), modifiedAt: f.modifiedTime ? Date.parse(f.modifiedTime) : 0 }));
+  }
+  async stat(pathStr) {
+    const { dir, name } = this.split(pathStr);
+    const parent = await this.resolveParent(dir);
+    const file = await this.findChild(parent, name);
+    if (!file) throw new Error(`Google Drive file not found: ${pathStr}`);
+    return { path: pathStr, size: Number(file.size || 0), modifiedAt: file.modifiedTime ? Date.parse(file.modifiedTime) : 0 };
+  }
+  async mkdir(pathStr) {
+    await this.resolveParent(pathStr, true);
+  }
+  async testConnection() {
+    const start = performance.now();
+    try {
+      const res = await this.request("https://www.googleapis.com/drive/v3/about?fields=user");
+      if (!res.ok) throw new Error(`Google Drive authorization failed: ${res.status}`);
+      const data = await res.json();
+      return { ok: true, latencyMs: Math.round(performance.now() - start), details: { email: data.user?.emailAddress } };
+    } catch (e) {
+      return { ok: false, latencyMs: Math.round(performance.now() - start), error: e.message };
+    }
+  }
+};
+
+export {
+  BaseStorageAdapter,
+  createGoogleDriveAuthorizationUrl,
+  exchangeGoogleDriveCode,
+  refreshGoogleDriveAccessToken,
+  GoogleDriveAdapter
+};