@ultrst-armada/kloks 1.7.1 → 1.8.0

package/packages/backend/dist/chunk-M4GSR46Y.js

@@ -0,0 +1,205 @@
+// src/auth/SessionManager.ts
+var SessionManager = class {
+  ttl;
+  constructor(ttlMs = 864e5) {
+    this.ttl = ttlMs;
+  }
+  generateToken(userId) {
+    return `sess::${userId}::${Date.now()}::${Math.random().toString(36).substring(2, 9)}`;
+  }
+  createSession(userId, role) {
+    return {
+      token: this.generateToken(userId),
+      userId,
+      role,
+      expiresAt: Date.now() + this.ttl
+    };
+  }
+  isValid(session) {
+    return Date.now() < session.expiresAt;
+  }
+};
+
+// src/auth/RateLimiter.ts
+var RateLimiter = class {
+  attempts = /* @__PURE__ */ new Map();
+  windowMs;
+  maxUser;
+  maxAdmin;
+  constructor(windowMs = 9e5, maxUser = 5, maxAdmin = 3) {
+    this.windowMs = windowMs;
+    this.maxUser = maxUser;
+    this.maxAdmin = maxAdmin;
+  }
+  check(identifier, isAdminAttempt = false) {
+    const now = Date.now();
+    let record = this.attempts.get(identifier);
+    if (!record || now - record.windowStart > this.windowMs) {
+      record = { count: 0, windowStart: now };
+      this.attempts.set(identifier, record);
+    }
+    record.count++;
+    const limit = isAdminAttempt ? this.maxAdmin : this.maxUser;
+    if (record.count > limit) {
+      throw new Error("Too many requests. Please try again later.");
+    }
+  }
+  reset(identifier) {
+    this.attempts.delete(identifier);
+  }
+};
+
+// src/auth/CanonicalAuthClient.ts
+var cleanBaseUrl = (value) => value.trim().replace(/\/+$/, "");
+var CanonicalAuthClient = class {
+  baseUrl;
+  fetcher;
+  credentials;
+  constructor(options) {
+    if (!options.baseUrl?.trim()) throw new Error("Canonical auth base URL is required.");
+    this.baseUrl = cleanBaseUrl(options.baseUrl);
+    this.fetcher = options.fetcher ?? fetch;
+    this.credentials = options.credentials ?? "include";
+  }
+  async request(path, init = {}) {
+    const response = await this.fetcher(`${this.baseUrl}/api/auth${path}`, {
+      ...init,
+      credentials: this.credentials,
+      headers: { "Content-Type": "application/json", ...init.headers ?? {} }
+    });
+    const text = await response.text();
+    let data = {};
+    try {
+      data = text ? JSON.parse(text) : {};
+    } catch {
+      data = { message: text };
+    }
+    return { status: response.status, data };
+  }
+  async signInEmail(email, password) {
+    const result = await this.request("/sign-in/email", {
+      method: "POST",
+      body: JSON.stringify({ email: email.trim().toLowerCase(), password })
+    });
+    if (result.status >= 400 || result.data?.error) {
+      return { success: false, status: result.status, error: result.data?.error?.message ?? result.data?.message ?? "Authentication failed." };
+    }
+    return { success: true, status: result.status, user: result.data?.user, session: result.data?.session };
+  }
+  async signUpEmail(email, password, name) {
+    const result = await this.request("/sign-up/email", {
+      method: "POST",
+      body: JSON.stringify({ email: email.trim().toLowerCase(), password, name: name.trim() })
+    });
+    if (result.status >= 400 || result.data?.error) {
+      return { success: false, status: result.status, error: result.data?.error?.message ?? result.data?.message ?? "Registration failed." };
+    }
+    return { success: true, status: result.status, user: result.data?.user, session: result.data?.session };
+  }
+  async signInGoogle(callbackURL) {
+    const result = await this.request("/sign-in/social", {
+      method: "POST",
+      body: JSON.stringify({ provider: "google", callbackURL })
+    });
+    if (result.status >= 400 || result.data?.error) {
+      return { success: false, status: result.status, error: result.data?.error?.message ?? result.data?.message ?? "Google sign-in failed." };
+    }
+    return {
+      success: true,
+      status: result.status,
+      user: result.data?.user,
+      session: result.data?.session,
+      redirectUrl: result.data?.url ?? result.data?.redirect
+    };
+  }
+  async requestGoogleDriveAccess(callbackURL) {
+    const result = await this.request("/link-social", {
+      method: "POST",
+      body: JSON.stringify({
+        provider: "google",
+        scopes: ["https://www.googleapis.com/auth/drive.file"],
+        ...callbackURL ? { callbackURL } : {}
+      })
+    });
+    if (result.status >= 400 || result.data?.error) {
+      return { success: false, status: result.status, error: result.data?.error?.message ?? result.data?.message ?? "Google Drive authorization failed." };
+    }
+    return { success: true, status: result.status, user: result.data?.user, session: result.data?.session };
+  }
+  async getSession(cookie) {
+    const headers = {};
+    if (cookie) headers.Cookie = cookie;
+    const result = await this.request("/get-session", { headers });
+    if (result.status >= 400 || !result.data?.user) return null;
+    return result.data;
+  }
+  async signOut() {
+    const result = await this.request("/sign-out", { method: "POST", body: "{}" });
+    return result.status < 400 && !result.data?.error;
+  }
+};
+function createCanonicalAuthClient(baseUrl, fetcher) {
+  return new CanonicalAuthClient({ baseUrl, fetcher });
+}
+
+// src/auth/UnifiedAuthCore.ts
+function requireAuthBaseUrl(env) {
+  const baseUrl = String(env?.SRKL_AUTH_BASE_URL ?? (typeof process !== "undefined" ? process.env.SRKL_AUTH_BASE_URL : "") ?? "").trim();
+  if (!baseUrl) {
+    throw new Error("SRKL_AUTH_BASE_URL is required. Local application auth is not supported.");
+  }
+  return baseUrl;
+}
+async function loginSystemUser(email, rawPass, isAdmin, _queryDb, env) {
+  if (!email?.trim() || !rawPass) return { success: false, status: 400, error: "Email and password are required" };
+  try {
+    const client = createCanonicalAuthClient(requireAuthBaseUrl(env));
+    const result = await client.signInEmail(email, rawPass);
+    if (!result.success || !result.user) {
+      return { success: false, status: result.status, error: result.error ?? "Invalid email or password" };
+    }
+    if (isAdmin && result.user.role !== "admin") {
+      return { success: false, status: 403, error: "Insufficient administrative privileges" };
+    }
+    return {
+      success: true,
+      status: result.status,
+      user: {
+        ...result.user,
+        username: result.user.username ?? result.user.email.split("@")[0],
+        role: result.user.role ?? "user",
+        status: result.user.status ?? "ACTIVE"
+      },
+      token: typeof result.session?.token === "string" ? result.session.token : void 0
+    };
+  } catch (error) {
+    return { success: false, status: 503, error: error instanceof Error ? error.message : "Canonical authentication service unavailable" };
+  }
+}
+async function resolveUserFromToken(tokenOrUserId, _queryDb, env) {
+  if (!tokenOrUserId) return null;
+  try {
+    const client = createCanonicalAuthClient(requireAuthBaseUrl(env));
+    const session = await client.getSession(
+      tokenOrUserId.startsWith("Bearer ") ? `better-auth.session_token=${tokenOrUserId.slice(7).trim()}` : void 0
+    );
+    if (!session?.user) return null;
+    return {
+      ...session.user,
+      username: session.user.username ?? session.user.email.split("@")[0],
+      role: session.user.role ?? "user",
+      status: session.user.status ?? "ACTIVE"
+    };
+  } catch {
+    return null;
+  }
+}
+
+export {
+  SessionManager,
+  RateLimiter,
+  CanonicalAuthClient,
+  createCanonicalAuthClient,
+  loginSystemUser,
+  resolveUserFromToken
+};

package/packages/backend/dist/{chunk-JUPWFW7V.js → chunk-RBQ4CW3T.js}

@@ -1,10 +1,12 @@
 import {
-  BaseStorageAdapter,
   ensureS3DirectoryMarker,
   permanentDeleteS3Folder,
   permanentDeleteS3Object,
   renameS3Folder
-} from "./chunk-R45CEV46.js";
+} from "./chunk-SHZAQTIT.js";
+import {
+  BaseStorageAdapter
+} from "./chunk-KKRWZDMN.js";
 
 // src/storage/S3Adapter.ts
 var S3Client;

package/packages/backend/dist/{chunk-R45CEV46.js → chunk-SHZAQTIT.js}

@@ -1,53 +1,7 @@
-// src/storage/BaseStorageAdapter.ts
-import { SkipoBase } from "@ultrst-armada/kloks/functions";
-var BaseStorageAdapter = class extends SkipoBase {
-  config;
-  constructor(config) {
-    super({ name: "BaseStorageAdapter" });
-    this.config = config;
-  }
-  async deleteFolder(pathStr) {
-    const items = await this.list(pathStr);
-    let count = 0;
-    for (const item of items) {
-      await this.delete(item.path);
-      count++;
-    }
-    return { success: true, deletedCount: count };
-  }
-  async renameFolder(oldPath, newPath) {
-    const items = await this.list(oldPath);
-    let count = 0;
-    for (const item of items) {
-      const rel = item.path.startsWith(oldPath) ? item.path.slice(oldPath.length).replace(/^\/+/, "") : item.path;
-      const target = `${newPath.replace(/\/+$/, "")}/${rel}`;
-      const data = await this.read(item.path);
-      await this.write(target, data);
-      await this.delete(item.path);
-      count++;
-    }
-    return { success: true, movedCount: count };
-  }
-  async ensureDirectory(pathStr) {
-    await this.mkdir(pathStr);
-  }
-  async testConnection() {
-    const start = performance.now();
-    try {
-      await this.list("");
-      return { ok: true, latencyMs: Math.round(performance.now() - start) };
-    } catch (e) {
-      return { ok: false, latencyMs: Math.round(performance.now() - start), error: e.message };
-    }
-  }
-  normalizePath(p) {
-    return p.replace(/\\/g, "/").replace(/^\/+/, "");
-  }
-  getExtension(p) {
-    const parts = p.split(".");
-    return parts.length > 1 ? parts[parts.length - 1] : "";
-  }
-};
+import {
+  BaseStorageAdapter,
+  GoogleDriveAdapter
+} from "./chunk-KKRWZDMN.js";
 
 // src/storage/LocalFSAdapter.ts
 import { promises as fs } from "fs";
@@ -495,185 +449,6 @@ var BackblazeB2Adapter = class extends BaseStorageAdapter {
   }
 };
 
-// src/storage/GoogleDriveOAuth.ts
-var AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
-var TOKEN_URL = "https://oauth2.googleapis.com/token";
-function createGoogleDriveAuthorizationUrl(config, state, codeChallenge) {
-  const params = new URLSearchParams({
-    client_id: config.clientId,
-    redirect_uri: config.redirectUri,
-    response_type: "code",
-    access_type: "offline",
-    prompt: "consent",
-    scope: (config.scopes || ["https://www.googleapis.com/auth/drive.file"]).join(" "),
-    state
-  });
-  if (codeChallenge) {
-    params.set("code_challenge", codeChallenge);
-    params.set("code_challenge_method", "S256");
-  }
-  return `${AUTH_URL}?${params.toString()}`;
-}
-async function exchangeGoogleDriveCode(config, code, codeVerifier) {
-  const body = new URLSearchParams({
-    client_id: config.clientId,
-    redirect_uri: config.redirectUri,
-    code,
-    grant_type: "authorization_code"
-  });
-  if (config.clientSecret) body.set("client_secret", config.clientSecret);
-  if (codeVerifier) body.set("code_verifier", codeVerifier);
-  const response = await fetch(TOKEN_URL, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body
-  });
-  if (!response.ok) throw new Error(`Google OAuth token exchange failed: ${response.status}`);
-  const data = await response.json();
-  return {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token,
-    expiresAt: data.expires_in ? Date.now() + Number(data.expires_in) * 1e3 : void 0,
-    tokenType: data.token_type
-  };
-}
-async function refreshGoogleDriveAccessToken(clientId, refreshToken) {
-  const body = new URLSearchParams({
-    client_id: clientId,
-    refresh_token: refreshToken,
-    grant_type: "refresh_token"
-  });
-  const response = await fetch(TOKEN_URL, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body
-  });
-  if (!response.ok) throw new Error(`Google OAuth refresh failed: ${response.status}`);
-  const data = await response.json();
-  return {
-    accessToken: data.access_token,
-    expiresAt: data.expires_in ? Date.now() + Number(data.expires_in) * 1e3 : void 0,
-    tokenType: data.token_type
-  };
-}
-
-// src/storage/GoogleDriveAdapter.ts
-var GoogleDriveAdapter = class extends BaseStorageAdapter {
-  async token() {
-    const accessToken = this.config.googleAccessToken || this.config.accessKey;
-    const expiresAt = Number(this.config.googleAccessTokenExpiresAt || 0);
-    if (accessToken && (!expiresAt || expiresAt > Date.now() + 6e4)) return accessToken;
-    const refreshToken = this.config.googleRefreshToken;
-    const clientId = this.config.googleClientId;
-    if (!refreshToken || !clientId) throw new Error("Google Drive OAuth credentials are incomplete.");
-    const refreshed = await refreshGoogleDriveAccessToken(clientId, refreshToken);
-    this.config.googleAccessToken = refreshed.accessToken;
-    this.config.googleAccessTokenExpiresAt = refreshed.expiresAt;
-    return refreshed.accessToken;
-  }
-  async request(url, init = {}) {
-    const headers = new Headers(init.headers);
-    headers.set("Authorization", `Bearer ${await this.token()}`);
-    return fetch(url, { ...init, headers });
-  }
-  async findChild(parentId, name) {
-    const q = `'${parentId}' in parents and name = '${name.replace(/'/g, "\\'")}' and trashed = false`;
-    const res = await this.request(`https://www.googleapis.com/drive/v3/files?q=${encodeURIComponent(q)}&fields=files(id,name,size,modifiedTime,mimeType)&pageSize=10`);
-    if (!res.ok) throw new Error(`Google Drive lookup failed: ${res.status}`);
-    const data = await res.json();
-    return data.files?.[0] || null;
-  }
-  async resolveParent(relativeDir, create = false) {
-    let parent = this.config.googleRootFolderId || this.config.rootFolderId || "root";
-    for (const part of this.normalizePath(relativeDir).split("/").filter(Boolean)) {
-      let child = await this.findChild(parent, part);
-      if (!child && create) {
-        const res = await this.request("https://www.googleapis.com/drive/v3/files", {
-          method: "POST",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({ name: part, mimeType: "application/vnd.google-apps.folder", parents: [parent] })
-        });
-        if (!res.ok) throw new Error(`Google Drive folder creation failed: ${res.status}`);
-        child = await res.json();
-      }
-      if (!child) throw new Error(`Google Drive directory not found: ${part}`);
-      parent = child.id;
-    }
-    return parent;
-  }
-  split(pathStr) {
-    const key = this.normalizePath(pathStr);
-    const i = key.lastIndexOf("/");
-    return i < 0 ? { dir: "", name: key } : { dir: key.slice(0, i), name: key.slice(i + 1) };
-  }
-  async read(pathStr) {
-    const { dir, name } = this.split(pathStr);
-    const parent = await this.resolveParent(dir);
-    const file = await this.findChild(parent, name);
-    if (!file) throw new Error(`Google Drive file not found: ${pathStr}`);
-    const res = await this.request(`https://www.googleapis.com/drive/v3/files/${file.id}?alt=media`);
-    if (!res.ok) throw new Error(`Google Drive download failed: ${res.status}`);
-    return new Uint8Array(await res.arrayBuffer());
-  }
-  async write(pathStr, data, contentType = "application/octet-stream") {
-    const { dir, name } = this.split(pathStr);
-    const parent = await this.resolveParent(dir, true);
-    const existing = await this.findChild(parent, name);
-    const bytes = typeof data === "string" ? new TextEncoder().encode(data) : data;
-    const form = new FormData();
-    form.append("metadata", new Blob([JSON.stringify({ name, mimeType: contentType, ...existing ? {} : { parents: [parent] } })], { type: "application/json" }));
-    form.append("file", new Blob([bytes], { type: contentType }));
-    const url = existing ? `https://www.googleapis.com/upload/drive/v3/files/${existing.id}?uploadType=multipart` : "https://www.googleapis.com/upload/drive/v3/files?uploadType=multipart";
-    const res = await this.request(url, { method: existing ? "PATCH" : "POST", body: form });
-    if (!res.ok) throw new Error(`Google Drive upload failed: ${res.status}`);
-  }
-  async delete(pathStr) {
-    const { dir, name } = this.split(pathStr);
-    const parent = await this.resolveParent(dir);
-    const file = await this.findChild(parent, name);
-    if (!file) return;
-    const res = await this.request(`https://www.googleapis.com/drive/v3/files/${file.id}`, { method: "DELETE" });
-    if (!res.ok && res.status !== 404) throw new Error(`Google Drive delete failed: ${res.status}`);
-  }
-  async exists(pathStr) {
-    try {
-      await this.stat(pathStr);
-      return true;
-    } catch {
-      return false;
-    }
-  }
-  async list(pathStr = "") {
-    const parent = await this.resolveParent(pathStr);
-    const q = `'${parent}' in parents and trashed = false`;
-    const res = await this.request(`https://www.googleapis.com/drive/v3/files?q=${encodeURIComponent(q)}&fields=files(id,name,size,modifiedTime,mimeType)&pageSize=1000`);
-    if (!res.ok) throw new Error(`Google Drive list failed: ${res.status}`);
-    const data = await res.json();
-    return (data.files || []).map((f) => ({ path: this.normalizePath(pathStr ? `${pathStr}/${f.name}` : f.name), size: Number(f.size || 0), modifiedAt: f.modifiedTime ? Date.parse(f.modifiedTime) : 0 }));
-  }
-  async stat(pathStr) {
-    const { dir, name } = this.split(pathStr);
-    const parent = await this.resolveParent(dir);
-    const file = await this.findChild(parent, name);
-    if (!file) throw new Error(`Google Drive file not found: ${pathStr}`);
-    return { path: pathStr, size: Number(file.size || 0), modifiedAt: file.modifiedTime ? Date.parse(file.modifiedTime) : 0 };
-  }
-  async mkdir(pathStr) {
-    await this.resolveParent(pathStr, true);
-  }
-  async testConnection() {
-    const start = performance.now();
-    try {
-      const res = await this.request("https://www.googleapis.com/drive/v3/about?fields=user");
-      if (!res.ok) throw new Error(`Google Drive authorization failed: ${res.status}`);
-      const data = await res.json();
-      return { ok: true, latencyMs: Math.round(performance.now() - start), details: { email: data.user?.emailAddress } };
-    } catch (e) {
-      return { ok: false, latencyMs: Math.round(performance.now() - start), error: e.message };
-    }
-  }
-};
-
 // src/storage/SupabaseStorageAdapter.ts
 var createClient;
 var SupabaseStorageAdapter = class extends BaseStorageAdapter {
@@ -769,7 +544,6 @@ var StorageAdapterFactory = class {
 };
 
 export {
-  BaseStorageAdapter,
   LocalFSAdapter,
   ensureS3DirectoryMarker,
   permanentDeleteS3Object,
@@ -779,10 +553,6 @@ export {
   resolveBackblazeEndpoint,
   normalizeBackblazeCredentials,
   BackblazeB2Adapter,
-  createGoogleDriveAuthorizationUrl,
-  exchangeGoogleDriveCode,
-  refreshGoogleDriveAccessToken,
-  GoogleDriveAdapter,
   SupabaseStorageAdapter,
   StorageAdapterFactory
 };

package/packages/backend/dist/index.d.ts

@@ -1,6 +1,6 @@
 export { A as AuthCredentials, a as AuthSession, B as BaseAccountProvider, C as CreateUserData, R as RateLimiter, S as SessionManager, b as SignupInput, U as User, c as UserRole } from './BaseAccountProvider-DduKf5HG.js';
-export { AdminGuard, LocalAccountProvider, PasswordHasher, SystemUser, loginSystemUser, resolveUserFromToken } from './auth/index.js';
-export { B as BaseStorageAdapter, C as ConnectionTestResult, D as DeleteFolderResult, F as FileInfo, R as RenameFolderResult, S as StorageConfig, a as StorageMode, b as StorageProviderType, U as UploadResult } from './BaseStorageAdapter-6x_BQiB3.js';
+export { AdminGuard, AuthEnvironment, AuthResult, CanonicalAuthClient, CanonicalAuthClientOptions, CanonicalAuthSession, CanonicalAuthUser, LocalAccountProvider, PasswordHasher, SystemUser, createCanonicalAuthClient, loginSystemUser, resolveUserFromToken } from './auth/index.js';
+export { B as BaseStorageAdapter, C as ConnectionTestResult, D as DeleteFolderResult, F as FileInfo, R as RenameFolderResult, S as StorageConfig, a as StorageMode, b as StorageProviderType, U as UploadResult } from './BaseStorageAdapter-EUCSvJse.js';
 export { B2AuthToken, BackblazeB2Adapter, GoogleDriveAdapter, GoogleDriveOAuthConfig, GoogleDriveTokenSet, LocalFSAdapter, S3Adapter, StorageAdapterFactory, SupabaseStorageAdapter, authorizeB2, b2DownloadFile, b2ListBuckets, b2ListFileNames, b2UploadFile, createGoogleDriveAuthorizationUrl, ensureS3DirectoryMarker, exchangeGoogleDriveCode, isSecretMasked, normalizeBackblazeCredentials, permanentDeleteS3Folder, permanentDeleteS3Object, refreshGoogleDriveAccessToken, renameS3Folder, resolveBackblazeEndpoint } from './storage/index.js';
 export { CloneReplicationResult, ConflictPolicy, RemoteWorkspaceService, SyncEngine, SyncState, WorkingWorkspaceService, WorkspaceCloneSyncEngine, WorkspaceConfig, WorkspaceDescriptor, WorkspaceFS, WorkspaceFileEntry, WorkspaceListResult, WorkspaceLookupResult, WorkspaceMutationResult, WorkspaceSecondaryClone, WorkspaceService, WorkspaceSyncSummary, formatCanonicalWorkspaceFolderName, remoteWorkspaceService, sanitizeWorkspaceName, workingWorkspaceService } from './workspace/index.js';
 export { AuditEvent, AuditLogger, ClusterConfig, ControlPlaneManager, DatabaseClusterManager, HealthStatus, detectDatabaseEngine, getSystemDatabaseUrls, resolveSystemDatabaseClusterNodes } from './control-plane/index.js';
@@ -228,7 +228,7 @@ interface WorkspaceSyncSummary {
     workspaceId: string;
     folderKey: string;
     workingDir: string;
-    persistenceType: 'backblaze_b2' | 'local_fs';
+    persistenceType: 'backblaze_b2' | 'local_fs' | 'google_drive';
     targetLocation: string;
     syncedFiles: SyncFileResult[];
     uploadedCount: number;

package/packages/backend/dist/index.js

@@ -1,17 +1,3 @@
-import {
-  CompositeBackend,
-  EndpointGenerator,
-  LOCAL_STORAGE_GRAPHS_PREFIX,
-  NodeGraphPersistenceService,
-  createBackend,
-  createCompositeService,
-  createLocalService,
-  createRemoteService,
-  exportGraphAsJsonFile,
-  nodeGraphPersistence,
-  parseGraphJsonFile,
-  validateGraphDocument
-} from "./chunk-RBF2OGMC.js";
 import {
   CANONICAL_SRKL_URL,
   SrklClient,
@@ -31,8 +17,19 @@ import {
   useSrklServices
 } from "./chunk-3IUA66RS.js";
 import {
-  S3Adapter
-} from "./chunk-JUPWFW7V.js";
+  CompositeBackend,
+  EndpointGenerator,
+  LOCAL_STORAGE_GRAPHS_PREFIX,
+  NodeGraphPersistenceService,
+  createBackend,
+  createCompositeService,
+  createLocalService,
+  createRemoteService,
+  exportGraphAsJsonFile,
+  nodeGraphPersistence,
+  parseGraphJsonFile,
+  validateGraphDocument
+} from "./chunk-RBF2OGMC.js";
 import {
   RemoteWorkspaceService,
   SyncEngine,
@@ -48,7 +45,10 @@ import {
   setWorkingWorkspaceConfig,
   syncWorkspace,
   workingWorkspaceService
-} from "./chunk-6W7OAGNV.js";
+} from "./chunk-BTMIK44G.js";
+import {
+  S3Adapter
+} from "./chunk-RBQ4CW3T.js";
 import {
   AuthServiceDefinition,
   AuthServiceFacade,
@@ -82,40 +82,15 @@ import {
   krnlWorkspaceGraphServiceFacade,
   krnlWorkspaceServiceDefinition,
   krnlWorkspaceServiceFacade
-} from "./chunk-7ZT2ZPPH.js";
-import {
-  workspaceGraphService
-} from "./chunk-F6IDQLC2.js";
+} from "./chunk-BPFZCDS4.js";
 import {
   getPrimarySrklDeploymentUrl,
   getSrklAccounts,
   srklListBackblazeBuckets
 } from "./chunk-XHADDA75.js";
 import {
-  BackblazeB2Adapter,
-  BaseStorageAdapter,
-  GoogleDriveAdapter,
-  LocalFSAdapter,
-  StorageAdapterFactory,
-  SupabaseStorageAdapter,
-  createGoogleDriveAuthorizationUrl,
-  ensureS3DirectoryMarker,
-  exchangeGoogleDriveCode,
-  isSecretMasked,
-  normalizeBackblazeCredentials,
-  permanentDeleteS3Folder,
-  permanentDeleteS3Object,
-  refreshGoogleDriveAccessToken,
-  renameS3Folder,
-  resolveBackblazeEndpoint
-} from "./chunk-R45CEV46.js";
-import {
-  authorizeB2,
-  b2DownloadFile,
-  b2ListBuckets,
-  b2ListFileNames,
-  b2UploadFile
-} from "./chunk-4QEMALXF.js";
+  workspaceGraphService
+} from "./chunk-5RXXC6GE.js";
 import {
   formatCanonicalWorkspaceFolderName,
   sanitizeWorkspaceName
@@ -150,6 +125,33 @@ import {
   getUnifiedDbUrl,
   queryUnifiedDb
 } from "./chunk-VAFCR2MS.js";
+import {
+  authorizeB2,
+  b2DownloadFile,
+  b2ListBuckets,
+  b2ListFileNames,
+  b2UploadFile
+} from "./chunk-4QEMALXF.js";
+import {
+  BackblazeB2Adapter,
+  LocalFSAdapter,
+  StorageAdapterFactory,
+  SupabaseStorageAdapter,
+  ensureS3DirectoryMarker,
+  isSecretMasked,
+  normalizeBackblazeCredentials,
+  permanentDeleteS3Folder,
+  permanentDeleteS3Object,
+  renameS3Folder,
+  resolveBackblazeEndpoint
+} from "./chunk-SHZAQTIT.js";
+import {
+  BaseStorageAdapter,
+  GoogleDriveAdapter,
+  createGoogleDriveAuthorizationUrl,
+  exchangeGoogleDriveCode,
+  refreshGoogleDriveAccessToken
+} from "./chunk-KKRWZDMN.js";
 import {
   BaseApiRoute,
   createSSEResponse,
@@ -161,13 +163,15 @@ import {
   BaseAccountProvider,
   LocalAccountProvider,
   PasswordHasher
-} from "./chunk-MPYASJ5A.js";
+} from "./chunk-HT2SEDHD.js";
 import {
+  CanonicalAuthClient,
   RateLimiter,
   SessionManager,
+  createCanonicalAuthClient,
   loginSystemUser,
   resolveUserFromToken
-} from "./chunk-ZDH4XI7W.js";
+} from "./chunk-M4GSR46Y.js";
 import {
   BackendProvider,
   useBackend,
@@ -4210,6 +4214,7 @@ export {
   BaseStorageAdapter,
   CANONICAL_SRKL_URL,
   CallbackRegistry,
+  CanonicalAuthClient,
   CloudflareResourceFetcher,
   CodeDiagnosticsService,
   CodeValidationRuntime,
@@ -4308,6 +4313,7 @@ export {
   createAssetSubfolder,
   createBackend,
   createBackendClient,
+  createCanonicalAuthClient,
   createCompositeService,
   createCredential,
   createEmptyContract,

package/packages/backend/dist/krnl-services.js

@@ -31,15 +31,16 @@ import {
   krnlWorkspaceGraphServiceFacade,
   krnlWorkspaceServiceDefinition,
   krnlWorkspaceServiceFacade
-} from "./chunk-7ZT2ZPPH.js";
-import "./chunk-F6IDQLC2.js";
+} from "./chunk-BPFZCDS4.js";
 import "./chunk-XHADDA75.js";
-import "./chunk-R45CEV46.js";
-import "./chunk-4QEMALXF.js";
+import "./chunk-5RXXC6GE.js";
 import "./chunk-FZKBTF34.js";
 import "./chunk-6K75XXFD.js";
 import "./chunk-VAFCR2MS.js";
-import "./chunk-ZDH4XI7W.js";
+import "./chunk-4QEMALXF.js";
+import "./chunk-SHZAQTIT.js";
+import "./chunk-KKRWZDMN.js";
+import "./chunk-M4GSR46Y.js";
 import "./chunk-TY32TUNI.js";
 export {
   AuthServiceDefinition,