@ultrst-armada/kloks 1.7.1 → 1.9.0

package/packages/backend/dist/{chunk-R45CEV46.js → chunk-SHZAQTIT.js}

@@ -1,53 +1,7 @@
-// src/storage/BaseStorageAdapter.ts
-import { SkipoBase } from "@ultrst-armada/kloks/functions";
-var BaseStorageAdapter = class extends SkipoBase {
-  config;
-  constructor(config) {
-    super({ name: "BaseStorageAdapter" });
-    this.config = config;
-  }
-  async deleteFolder(pathStr) {
-    const items = await this.list(pathStr);
-    let count = 0;
-    for (const item of items) {
-      await this.delete(item.path);
-      count++;
-    }
-    return { success: true, deletedCount: count };
-  }
-  async renameFolder(oldPath, newPath) {
-    const items = await this.list(oldPath);
-    let count = 0;
-    for (const item of items) {
-      const rel = item.path.startsWith(oldPath) ? item.path.slice(oldPath.length).replace(/^\/+/, "") : item.path;
-      const target = `${newPath.replace(/\/+$/, "")}/${rel}`;
-      const data = await this.read(item.path);
-      await this.write(target, data);
-      await this.delete(item.path);
-      count++;
-    }
-    return { success: true, movedCount: count };
-  }
-  async ensureDirectory(pathStr) {
-    await this.mkdir(pathStr);
-  }
-  async testConnection() {
-    const start = performance.now();
-    try {
-      await this.list("");
-      return { ok: true, latencyMs: Math.round(performance.now() - start) };
-    } catch (e) {
-      return { ok: false, latencyMs: Math.round(performance.now() - start), error: e.message };
-    }
-  }
-  normalizePath(p) {
-    return p.replace(/\\/g, "/").replace(/^\/+/, "");
-  }
-  getExtension(p) {
-    const parts = p.split(".");
-    return parts.length > 1 ? parts[parts.length - 1] : "";
-  }
-};
+import {
+  BaseStorageAdapter,
+  GoogleDriveAdapter
+} from "./chunk-KKRWZDMN.js";
 
 // src/storage/LocalFSAdapter.ts
 import { promises as fs } from "fs";
@@ -495,185 +449,6 @@ var BackblazeB2Adapter = class extends BaseStorageAdapter {
   }
 };
 
-// src/storage/GoogleDriveOAuth.ts
-var AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
-var TOKEN_URL = "https://oauth2.googleapis.com/token";
-function createGoogleDriveAuthorizationUrl(config, state, codeChallenge) {
-  const params = new URLSearchParams({
-    client_id: config.clientId,
-    redirect_uri: config.redirectUri,
-    response_type: "code",
-    access_type: "offline",
-    prompt: "consent",
-    scope: (config.scopes || ["https://www.googleapis.com/auth/drive.file"]).join(" "),
-    state
-  });
-  if (codeChallenge) {
-    params.set("code_challenge", codeChallenge);
-    params.set("code_challenge_method", "S256");
-  }
-  return `${AUTH_URL}?${params.toString()}`;
-}
-async function exchangeGoogleDriveCode(config, code, codeVerifier) {
-  const body = new URLSearchParams({
-    client_id: config.clientId,
-    redirect_uri: config.redirectUri,
-    code,
-    grant_type: "authorization_code"
-  });
-  if (config.clientSecret) body.set("client_secret", config.clientSecret);
-  if (codeVerifier) body.set("code_verifier", codeVerifier);
-  const response = await fetch(TOKEN_URL, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body
-  });
-  if (!response.ok) throw new Error(`Google OAuth token exchange failed: ${response.status}`);
-  const data = await response.json();
-  return {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token,
-    expiresAt: data.expires_in ? Date.now() + Number(data.expires_in) * 1e3 : void 0,
-    tokenType: data.token_type
-  };
-}
-async function refreshGoogleDriveAccessToken(clientId, refreshToken) {
-  const body = new URLSearchParams({
-    client_id: clientId,
-    refresh_token: refreshToken,
-    grant_type: "refresh_token"
-  });
-  const response = await fetch(TOKEN_URL, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body
-  });
-  if (!response.ok) throw new Error(`Google OAuth refresh failed: ${response.status}`);
-  const data = await response.json();
-  return {
-    accessToken: data.access_token,
-    expiresAt: data.expires_in ? Date.now() + Number(data.expires_in) * 1e3 : void 0,
-    tokenType: data.token_type
-  };
-}
-
-// src/storage/GoogleDriveAdapter.ts
-var GoogleDriveAdapter = class extends BaseStorageAdapter {
-  async token() {
-    const accessToken = this.config.googleAccessToken || this.config.accessKey;
-    const expiresAt = Number(this.config.googleAccessTokenExpiresAt || 0);
-    if (accessToken && (!expiresAt || expiresAt > Date.now() + 6e4)) return accessToken;
-    const refreshToken = this.config.googleRefreshToken;
-    const clientId = this.config.googleClientId;
-    if (!refreshToken || !clientId) throw new Error("Google Drive OAuth credentials are incomplete.");
-    const refreshed = await refreshGoogleDriveAccessToken(clientId, refreshToken);
-    this.config.googleAccessToken = refreshed.accessToken;
-    this.config.googleAccessTokenExpiresAt = refreshed.expiresAt;
-    return refreshed.accessToken;
-  }
-  async request(url, init = {}) {
-    const headers = new Headers(init.headers);
-    headers.set("Authorization", `Bearer ${await this.token()}`);
-    return fetch(url, { ...init, headers });
-  }
-  async findChild(parentId, name) {
-    const q = `'${parentId}' in parents and name = '${name.replace(/'/g, "\\'")}' and trashed = false`;
-    const res = await this.request(`https://www.googleapis.com/drive/v3/files?q=${encodeURIComponent(q)}&fields=files(id,name,size,modifiedTime,mimeType)&pageSize=10`);
-    if (!res.ok) throw new Error(`Google Drive lookup failed: ${res.status}`);
-    const data = await res.json();
-    return data.files?.[0] || null;
-  }
-  async resolveParent(relativeDir, create = false) {
-    let parent = this.config.googleRootFolderId || this.config.rootFolderId || "root";
-    for (const part of this.normalizePath(relativeDir).split("/").filter(Boolean)) {
-      let child = await this.findChild(parent, part);
-      if (!child && create) {
-        const res = await this.request("https://www.googleapis.com/drive/v3/files", {
-          method: "POST",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({ name: part, mimeType: "application/vnd.google-apps.folder", parents: [parent] })
-        });
-        if (!res.ok) throw new Error(`Google Drive folder creation failed: ${res.status}`);
-        child = await res.json();
-      }
-      if (!child) throw new Error(`Google Drive directory not found: ${part}`);
-      parent = child.id;
-    }
-    return parent;
-  }
-  split(pathStr) {
-    const key = this.normalizePath(pathStr);
-    const i = key.lastIndexOf("/");
-    return i < 0 ? { dir: "", name: key } : { dir: key.slice(0, i), name: key.slice(i + 1) };
-  }
-  async read(pathStr) {
-    const { dir, name } = this.split(pathStr);
-    const parent = await this.resolveParent(dir);
-    const file = await this.findChild(parent, name);
-    if (!file) throw new Error(`Google Drive file not found: ${pathStr}`);
-    const res = await this.request(`https://www.googleapis.com/drive/v3/files/${file.id}?alt=media`);
-    if (!res.ok) throw new Error(`Google Drive download failed: ${res.status}`);
-    return new Uint8Array(await res.arrayBuffer());
-  }
-  async write(pathStr, data, contentType = "application/octet-stream") {
-    const { dir, name } = this.split(pathStr);
-    const parent = await this.resolveParent(dir, true);
-    const existing = await this.findChild(parent, name);
-    const bytes = typeof data === "string" ? new TextEncoder().encode(data) : data;
-    const form = new FormData();
-    form.append("metadata", new Blob([JSON.stringify({ name, mimeType: contentType, ...existing ? {} : { parents: [parent] } })], { type: "application/json" }));
-    form.append("file", new Blob([bytes], { type: contentType }));
-    const url = existing ? `https://www.googleapis.com/upload/drive/v3/files/${existing.id}?uploadType=multipart` : "https://www.googleapis.com/upload/drive/v3/files?uploadType=multipart";
-    const res = await this.request(url, { method: existing ? "PATCH" : "POST", body: form });
-    if (!res.ok) throw new Error(`Google Drive upload failed: ${res.status}`);
-  }
-  async delete(pathStr) {
-    const { dir, name } = this.split(pathStr);
-    const parent = await this.resolveParent(dir);
-    const file = await this.findChild(parent, name);
-    if (!file) return;
-    const res = await this.request(`https://www.googleapis.com/drive/v3/files/${file.id}`, { method: "DELETE" });
-    if (!res.ok && res.status !== 404) throw new Error(`Google Drive delete failed: ${res.status}`);
-  }
-  async exists(pathStr) {
-    try {
-      await this.stat(pathStr);
-      return true;
-    } catch {
-      return false;
-    }
-  }
-  async list(pathStr = "") {
-    const parent = await this.resolveParent(pathStr);
-    const q = `'${parent}' in parents and trashed = false`;
-    const res = await this.request(`https://www.googleapis.com/drive/v3/files?q=${encodeURIComponent(q)}&fields=files(id,name,size,modifiedTime,mimeType)&pageSize=1000`);
-    if (!res.ok) throw new Error(`Google Drive list failed: ${res.status}`);
-    const data = await res.json();
-    return (data.files || []).map((f) => ({ path: this.normalizePath(pathStr ? `${pathStr}/${f.name}` : f.name), size: Number(f.size || 0), modifiedAt: f.modifiedTime ? Date.parse(f.modifiedTime) : 0 }));
-  }
-  async stat(pathStr) {
-    const { dir, name } = this.split(pathStr);
-    const parent = await this.resolveParent(dir);
-    const file = await this.findChild(parent, name);
-    if (!file) throw new Error(`Google Drive file not found: ${pathStr}`);
-    return { path: pathStr, size: Number(file.size || 0), modifiedAt: file.modifiedTime ? Date.parse(file.modifiedTime) : 0 };
-  }
-  async mkdir(pathStr) {
-    await this.resolveParent(pathStr, true);
-  }
-  async testConnection() {
-    const start = performance.now();
-    try {
-      const res = await this.request("https://www.googleapis.com/drive/v3/about?fields=user");
-      if (!res.ok) throw new Error(`Google Drive authorization failed: ${res.status}`);
-      const data = await res.json();
-      return { ok: true, latencyMs: Math.round(performance.now() - start), details: { email: data.user?.emailAddress } };
-    } catch (e) {
-      return { ok: false, latencyMs: Math.round(performance.now() - start), error: e.message };
-    }
-  }
-};
-
 // src/storage/SupabaseStorageAdapter.ts
 var createClient;
 var SupabaseStorageAdapter = class extends BaseStorageAdapter {
@@ -769,7 +544,6 @@ var StorageAdapterFactory = class {
 };
 
 export {
-  BaseStorageAdapter,
   LocalFSAdapter,
   ensureS3DirectoryMarker,
   permanentDeleteS3Object,
@@ -779,10 +553,6 @@ export {
   resolveBackblazeEndpoint,
   normalizeBackblazeCredentials,
   BackblazeB2Adapter,
-  createGoogleDriveAuthorizationUrl,
-  exchangeGoogleDriveCode,
-  refreshGoogleDriveAccessToken,
-  GoogleDriveAdapter,
   SupabaseStorageAdapter,
   StorageAdapterFactory
 };

package/packages/backend/dist/{chunk-7ZT2ZPPH.js → chunk-UMEO6XS4.js}

@@ -1,13 +1,13 @@
 import {
   workspaceGraphService
-} from "./chunk-F6IDQLC2.js";
+} from "./chunk-VKSGYMAH.js";
 import {
   getSrklAccounts,
   srklListBackblazeBuckets
 } from "./chunk-XHADDA75.js";
 import {
   StorageAdapterFactory
-} from "./chunk-R45CEV46.js";
+} from "./chunk-SHZAQTIT.js";
 import {
   b2ListBuckets
 } from "./chunk-4QEMALXF.js";
@@ -30,7 +30,7 @@ import {
   SessionManager,
   loginSystemUser,
   resolveUserFromToken
-} from "./chunk-ZDH4XI7W.js";
+} from "./chunk-WTBAG4AV.js";
 import {
   createService,
   createServiceDefinition
@@ -56,12 +56,12 @@ var AuthServiceDefinition = createServiceDefinition({
     login: {
       id: "AuthService.login",
       name: "login",
-      handler: async (input) => loginSystemUser(input.email, input.password, Boolean(input.isAdmin), (sql, params) => queryUnifiedDb(sql, params, input.env))
+      handler: async (input) => loginSystemUser(input.email, input.password, Boolean(input.isAdmin), (sql, params) => queryUnifiedDb(sql, params, input.env), input.env)
     },
     resolveUser: {
       id: "AuthService.resolveUser",
       name: "resolveUser",
-      handler: async (input) => resolveUserFromToken(input.tokenOrUserId, (sql, params) => queryUnifiedDb(sql, params, input.env))
+      handler: async (input) => resolveUserFromToken(input.tokenOrUserId, (sql, params) => queryUnifiedDb(sql, params, input.env), input.env)
     },
     checkRateLimit: {
       id: "AuthService.checkRateLimit",

package/packages/backend/dist/{chunk-F6IDQLC2.js → chunk-VKSGYMAH.js}

@@ -1,6 +1,6 @@
 import {
   StorageAdapterFactory
-} from "./chunk-R45CEV46.js";
+} from "./chunk-SHZAQTIT.js";
 import {
   findUserWorkspace
 } from "./chunk-6K75XXFD.js";

package/packages/backend/dist/{chunk-MPYASJ5A.js → chunk-W6JNJD3Q.js}

@@ -1,7 +1,7 @@
 import {
   RateLimiter,
   SessionManager
-} from "./chunk-ZDH4XI7W.js";
+} from "./chunk-WTBAG4AV.js";
 
 // src/auth/PasswordHasher.ts
 var bcrypt = null;

package/packages/backend/dist/chunk-WTBAG4AV.js

@@ -0,0 +1,207 @@
+// src/auth/SessionManager.ts
+var SessionManager = class {
+  ttl;
+  constructor(ttlMs = 864e5) {
+    this.ttl = ttlMs;
+  }
+  generateToken(userId) {
+    return `sess::${userId}::${Date.now()}::${Math.random().toString(36).substring(2, 9)}`;
+  }
+  createSession(userId, role) {
+    return {
+      token: this.generateToken(userId),
+      userId,
+      role,
+      expiresAt: Date.now() + this.ttl
+    };
+  }
+  isValid(session) {
+    return Date.now() < session.expiresAt;
+  }
+};
+
+// src/auth/RateLimiter.ts
+var RateLimiter = class {
+  attempts = /* @__PURE__ */ new Map();
+  windowMs;
+  maxUser;
+  maxAdmin;
+  constructor(windowMs = 9e5, maxUser = 5, maxAdmin = 3) {
+    this.windowMs = windowMs;
+    this.maxUser = maxUser;
+    this.maxAdmin = maxAdmin;
+  }
+  check(identifier, isAdminAttempt = false) {
+    const now = Date.now();
+    let record = this.attempts.get(identifier);
+    if (!record || now - record.windowStart > this.windowMs) {
+      record = { count: 0, windowStart: now };
+      this.attempts.set(identifier, record);
+    }
+    record.count++;
+    const limit = isAdminAttempt ? this.maxAdmin : this.maxUser;
+    if (record.count > limit) {
+      throw new Error("Too many requests. Please try again later.");
+    }
+  }
+  reset(identifier) {
+    this.attempts.delete(identifier);
+  }
+};
+
+// src/auth/CanonicalAuthClient.ts
+var cleanBaseUrl = (value) => value.trim().replace(/\/+$/, "");
+var CanonicalAuthClient = class {
+  baseUrl;
+  fetcher;
+  credentials;
+  constructor(options) {
+    if (!options.baseUrl?.trim()) throw new Error("Canonical auth base URL is required.");
+    this.baseUrl = cleanBaseUrl(options.baseUrl);
+    this.fetcher = options.fetcher ?? fetch;
+    this.credentials = options.credentials ?? "include";
+  }
+  async request(path, init = {}) {
+    const response = await this.fetcher(`${this.baseUrl}/api/auth${path}`, {
+      ...init,
+      credentials: this.credentials,
+      headers: { "Content-Type": "application/json", ...init.headers ?? {} }
+    });
+    const text = await response.text();
+    let data = {};
+    try {
+      data = text ? JSON.parse(text) : {};
+    } catch {
+      data = { message: text };
+    }
+    return { status: response.status, data };
+  }
+  async signInEmail(email, password) {
+    const result = await this.request("/sign-in/email", {
+      method: "POST",
+      body: JSON.stringify({ email: email.trim().toLowerCase(), password })
+    });
+    if (result.status >= 400 || result.data?.error) {
+      return { success: false, status: result.status, error: result.data?.error?.message ?? result.data?.message ?? "Authentication failed." };
+    }
+    return { success: true, status: result.status, user: result.data?.user, session: result.data?.session };
+  }
+  async signUpEmail(email, password, name) {
+    const result = await this.request("/sign-up/email", {
+      method: "POST",
+      body: JSON.stringify({ email: email.trim().toLowerCase(), password, name: name.trim() })
+    });
+    if (result.status >= 400 || result.data?.error) {
+      return { success: false, status: result.status, error: result.data?.error?.message ?? result.data?.message ?? "Registration failed." };
+    }
+    return { success: true, status: result.status, user: result.data?.user, session: result.data?.session };
+  }
+  async signInGoogle(callbackURL) {
+    const result = await this.request("/sign-in/social", {
+      method: "POST",
+      body: JSON.stringify({ provider: "google", callbackURL })
+    });
+    if (result.status >= 400 || result.data?.error) {
+      return { success: false, status: result.status, error: result.data?.error?.message ?? result.data?.message ?? "Google sign-in failed." };
+    }
+    return {
+      success: true,
+      status: result.status,
+      user: result.data?.user,
+      session: result.data?.session,
+      redirectUrl: result.data?.url ?? result.data?.redirect
+    };
+  }
+  async requestGoogleDriveAccess(callbackURL) {
+    const result = await this.request("/link-social", {
+      method: "POST",
+      body: JSON.stringify({
+        provider: "google",
+        scopes: ["https://www.googleapis.com/auth/drive.file"],
+        ...callbackURL ? { callbackURL } : {}
+      })
+    });
+    if (result.status >= 400 || result.data?.error) {
+      return { success: false, status: result.status, error: result.data?.error?.message ?? result.data?.message ?? "Google Drive authorization failed." };
+    }
+    return { success: true, status: result.status, user: result.data?.user, session: result.data?.session };
+  }
+  async getSession(cookie) {
+    const headers = {};
+    if (cookie) headers.Cookie = cookie;
+    const result = await this.request("/get-session", { headers });
+    if (result.status >= 400 || !result.data?.user) return null;
+    return result.data;
+  }
+  async signOut() {
+    const result = await this.request("/sign-out", { method: "POST", body: "{}" });
+    return result.status < 400 && !result.data?.error;
+  }
+};
+function createCanonicalAuthClient(baseUrl, fetcher) {
+  return new CanonicalAuthClient({ baseUrl, fetcher });
+}
+
+// src/auth/UnifiedAuthCore.ts
+function requireAuthBaseUrl(env) {
+  const baseUrl = String(env?.SRKL_AUTH_BASE_URL ?? (typeof process !== "undefined" ? process.env.SRKL_AUTH_BASE_URL : "") ?? "").trim();
+  if (!baseUrl) {
+    throw new Error("SRKL_AUTH_BASE_URL is required. Local application auth is not supported.");
+  }
+  return baseUrl;
+}
+async function loginSystemUser(email, rawPass, isAdmin, _queryDb, env) {
+  if (!email?.trim() || !rawPass) return { success: false, status: 400, error: "Email and password are required" };
+  try {
+    const client = createCanonicalAuthClient(requireAuthBaseUrl(env));
+    const result = await client.signInEmail(email, rawPass);
+    if (!result.success || !result.user) {
+      return { success: false, status: result.status, error: result.error ?? "Invalid email or password" };
+    }
+    if (isAdmin && result.user.role !== "admin") {
+      return { success: false, status: 403, error: "Insufficient administrative privileges" };
+    }
+    return {
+      success: true,
+      status: result.status,
+      user: {
+        ...result.user,
+        username: result.user.username ?? result.user.email.split("@")[0],
+        role: result.user.role ?? "user",
+        status: result.user.status ?? "ACTIVE"
+      },
+      token: typeof result.session?.token === "string" ? result.session.token : void 0
+    };
+  } catch (error) {
+    return { success: false, status: 503, error: error instanceof Error ? error.message : "Canonical authentication service unavailable" };
+  }
+}
+async function resolveUserFromToken(tokenOrUserId, _queryDb, env) {
+  if (!tokenOrUserId) return null;
+  try {
+    const client = createCanonicalAuthClient(requireAuthBaseUrl(env));
+    const credential = tokenOrUserId.trim();
+    if (!credential) return null;
+    const token = credential.replace(/^Bearer[ \t]+/i, "").trim();
+    if (!token) return null;
+    const session = await client.getSession(`better-auth.session_token=${token}`);
+    if (!session?.user) return null;
+    return {
+      ...session.user,
+      username: session.user.username ?? session.user.email.split("@")[0],
+      role: session.user.role ?? "user",
+      status: session.user.status ?? "ACTIVE"
+    };
+  } catch {
+    return null;
+  }
+}
+
+export {
+  SessionManager,
+  RateLimiter,
+  CanonicalAuthClient,
+  createCanonicalAuthClient,
+  loginSystemUser,
+  resolveUserFromToken
+};

package/packages/backend/dist/index.d.ts

@@ -1,6 +1,6 @@
 export { A as AuthCredentials, a as AuthSession, B as BaseAccountProvider, C as CreateUserData, R as RateLimiter, S as SessionManager, b as SignupInput, U as User, c as UserRole } from './BaseAccountProvider-DduKf5HG.js';
-export { AdminGuard, LocalAccountProvider, PasswordHasher, SystemUser, loginSystemUser, resolveUserFromToken } from './auth/index.js';
-export { B as BaseStorageAdapter, C as ConnectionTestResult, D as DeleteFolderResult, F as FileInfo, R as RenameFolderResult, S as StorageConfig, a as StorageMode, b as StorageProviderType, U as UploadResult } from './BaseStorageAdapter-6x_BQiB3.js';
+export { AdminGuard, AuthEnvironment, AuthResult, CanonicalAuthClient, CanonicalAuthClientOptions, CanonicalAuthSession, CanonicalAuthUser, LocalAccountProvider, PasswordHasher, SystemUser, createCanonicalAuthClient, loginSystemUser, resolveUserFromToken } from './auth/index.js';
+export { B as BaseStorageAdapter, C as ConnectionTestResult, D as DeleteFolderResult, F as FileInfo, R as RenameFolderResult, S as StorageConfig, a as StorageMode, b as StorageProviderType, U as UploadResult } from './BaseStorageAdapter-EUCSvJse.js';
 export { B2AuthToken, BackblazeB2Adapter, GoogleDriveAdapter, GoogleDriveOAuthConfig, GoogleDriveTokenSet, LocalFSAdapter, S3Adapter, StorageAdapterFactory, SupabaseStorageAdapter, authorizeB2, b2DownloadFile, b2ListBuckets, b2ListFileNames, b2UploadFile, createGoogleDriveAuthorizationUrl, ensureS3DirectoryMarker, exchangeGoogleDriveCode, isSecretMasked, normalizeBackblazeCredentials, permanentDeleteS3Folder, permanentDeleteS3Object, refreshGoogleDriveAccessToken, renameS3Folder, resolveBackblazeEndpoint } from './storage/index.js';
 export { CloneReplicationResult, ConflictPolicy, RemoteWorkspaceService, SyncEngine, SyncState, WorkingWorkspaceService, WorkspaceCloneSyncEngine, WorkspaceConfig, WorkspaceDescriptor, WorkspaceFS, WorkspaceFileEntry, WorkspaceListResult, WorkspaceLookupResult, WorkspaceMutationResult, WorkspaceSecondaryClone, WorkspaceService, WorkspaceSyncSummary, formatCanonicalWorkspaceFolderName, remoteWorkspaceService, sanitizeWorkspaceName, workingWorkspaceService } from './workspace/index.js';
 export { AuditEvent, AuditLogger, ClusterConfig, ControlPlaneManager, DatabaseClusterManager, HealthStatus, detectDatabaseEngine, getSystemDatabaseUrls, resolveSystemDatabaseClusterNodes } from './control-plane/index.js';
@@ -228,7 +228,7 @@ interface WorkspaceSyncSummary {
     workspaceId: string;
     folderKey: string;
     workingDir: string;
-    persistenceType: 'backblaze_b2' | 'local_fs';
+    persistenceType: 'backblaze_b2' | 'local_fs' | 'google_drive';
     targetLocation: string;
     syncedFiles: SyncFileResult[];
     uploadedCount: number;
@@ -765,6 +765,7 @@ declare function buildProjectObservability(projects: any[], deployments: any[],
     fastDataTransferFormatted: string;
     middlewareInvocations: number;
     middlewareInvocationsFormatted: string;
+    latestDeploymentId: any;
     latestDeploymentUrl: string;
     latestDeploymentStatus: string;
     latestDeploymentCreatedAt: string;
@@ -780,8 +781,46 @@ declare function buildProjectsList(observability: any[]): {
     domain: any;
     domains: any;
     updatedAt: any;
+    deploymentId: any;
 }[];
 
+/**
+ * Provider deployment-control operations.
+ *
+ * Vercel: pauses/resumes a project's production service.
+ * Cloudflare Pages: disables/enables automatic production and preview deployments.
+ */
+type CloudflarePagesPreviewSetting = 'all' | 'none' | 'custom';
+interface CloudflarePagesPauseState {
+    productionDeploymentsEnabled: boolean;
+    previewDeploymentSetting: CloudflarePagesPreviewSetting;
+}
+interface DeploymentControlResult {
+    success: true;
+    provider: 'VERCEL' | 'CLOUDFLARE';
+    projectId: string;
+    controlState: 'ACTIVE' | 'PAUSED';
+    pauseState?: CloudflarePagesPauseState;
+}
+interface CredentialPayload {
+    token?: string;
+    apiToken?: string;
+    accessToken?: string;
+    teamId?: string;
+    accountId?: string;
+    cfAccountId?: string;
+    accountTag?: string;
+    authKey?: string;
+    globalApiKey?: string;
+    authEmail?: string;
+    email?: string;
+    credentials?: Record<string, any>;
+}
+declare function pauseVercelProject(projectId: string, payload?: CredentialPayload, userId?: string, env?: Record<string, unknown>): Promise<DeploymentControlResult>;
+declare function resumeVercelProject(projectId: string, payload?: CredentialPayload, userId?: string, env?: Record<string, unknown>): Promise<DeploymentControlResult>;
+declare function pauseCloudflarePagesProject(projectName: string, payload?: CredentialPayload, userId?: string, env?: Record<string, unknown>): Promise<DeploymentControlResult>;
+declare function resumeCloudflarePagesProject(projectName: string, pauseState: CloudflarePagesPauseState, payload?: CredentialPayload, userId?: string, env?: Record<string, unknown>): Promise<DeploymentControlResult>;
+
 declare function createWavBuffer(sampleRate: number, numChannels: number, samples: Float32Array[]): Buffer;
 
 declare function ensureGlobalSamples(globalSamplesDir: string): Promise<void>;
@@ -1638,4 +1677,4 @@ declare function resolveSystemDatabaseUrl(env?: Record<string, string | undefine
  */
 declare function tryResolveSystemDatabaseUrl(env?: Record<string, string | undefined>): string | null;
 
-export { type AssetChannelType, type AssetDataType, type AssetFolderInfo, type AssetPoolItem, type AssetPoolScope, type B2AuthData, type BackendFacade, BaseDataProvider, BaseResourceFetcher, type CloudflareObservability, type CloudflareProjectItem, CloudflareResourceFetcher, type CloudflareUsageMetrics, type CredentialEntry, type CredentialManifest, type Deployment, type FunctionSet, FunctionalityTable, GRAPHS_ROOT, type IDataProvider, LEGACY_PROJECTS_ROOT, type OrchestrationFn, PROJECTS_ROOT, type ProjectMetadata, type PublicRouteRecord, type QueryFilter, ResourceFetcherRegistry, type Runtime, SAMPLES_GLOBAL_ROOT, SUPPORTED_AUDIO_EXTS, SUPPORTED_MIDI_EXTS, type ServerAudioSampleItem, type ServiceFacade, type ServiceRegistryRecord, type SortOrder, type SrklB2Account, SrklStorageService, type SyncFileResult, type UnifiedQueryResult, type UnifiedResourceMetricItem, type UnifiedResourceMetrics, VercelResourceFetcher, WORKSPACE_ASSETS_ROOT, WORKSPACE_ROOT, type WorkingWorkspaceConfig, type WorkspaceFolderResolution, type WorkspaceStorageConfig, b2DeleteFileVersion, b2DeleteFolder, buildProjectObservability, buildProjectsList, cleanDbUrl, computeDeploymentFinalWeight, computeUsageWeightScore, configureStarterProjectTemplate, createAssetSubfolder, createCredential, createGraphAssetFolder, createGraphAssetFolder as createGraphAssetSubfolder, createGraphPackage, createWavBuffer, createWorkspace, createWorkspaceGraph, decryptSecretFromBlob, deleteAssetFromGraph, deleteAssetFromPool, deleteCredential, deleteGlobalSample, deleteGraphPackage, deleteProject, deleteProjectSample, deleteRoute, deleteWorkspace, deleteWorkspaceFile, deleteWorkspaceFolder, deleteWorkspaceGraph, encryptSecretToBlob, ensureAssetPoolDirectories, ensureGlobalSamples, ensureGraphAssetDirectories, ensureProjectAssets, ensureProjectsRoot, ensureWorkspaceStructure, exportEncryptedCredentials, fetchCloudflareData, fetchVercelData, findUserWorkspace, findWorkspaceRecord, formatRelativeCreated, getAllRoutes, getAssetPoolLocationPath, getAssetPoolPublicUrl, getB2BucketId, getConnectedDeploymentNode, getConnectedWeightModifiers, getCredential, getDefaultWorkingWorkspaceDir, getExecutions, getGatewayConfig, getGraphPackageById, getPrimarySrklDeploymentUrl as getPrimarySrklCoreDeploymentUrl, getProjectById, getPublicRouteByPath, getPublicRoutes, getSrklAccounts as getSrklCoreAccounts, getSrklStatus, getUnifiedDbUrl, getUsers, getWeightModifierScore, getWorkingWorkspaceConfig, getWorkingWorkspaceDir, getWorkspaceFolderKey, getWorkspaceFolderPrefix, getWorkspaceGraph, getWorkspaceStorageDetails, getWorkspaces, importEncryptedCredentials, importGraphDependency, initGlobalSamplesDirectory, isB2Workspace, listAllGraphPackages, listAllProjects, listBackblazeBuckets, listCredentials, listGlobalSamples, listProjectSamples, listWorkspaceFiles, listWorkspaceGraphs, loadCredentialManifest, loadWorkspaceData, loginUser, matchGatewayIngress, matchGatewayIngressAsync, queryUnifiedDb, readWorkspaceFile, recordExecution, removeGraphDependency, renameAppInWorkspaceData, resolveDynamicRouteFromDb, resolveSystemDatabaseUrl, resolveWorkspaceConnection, resolveWorkspaceDir, saveAssetToGraph, saveAssetToPool, saveCredentialManifest, saveGlobalSample, saveGraphPackage, saveProject, saveProjectSample, saveWorkspaceData, saveWorkspaceGraph, scanAssetPool, scanGraphAssets, seedDefaultAssets, seedStarterGraphAssets, serverPublicRoutes, setServerPublicRoutes, setWorkingWorkspaceConfig, srklListBackblazeBuckets as srklCoreListBackblazeBuckets, syncWorkspace, syncWorkspaceCreateToBucket, syncWorkspaceDataToBucket, syncWorkspaceDeleteToBucket, tryResolveSystemDatabaseUrl, updateCredential, updateWorkspace, upsertRoute, validateServiceDefinition, writeWorkspaceFile };
+export { type AssetChannelType, type AssetDataType, type AssetFolderInfo, type AssetPoolItem, type AssetPoolScope, type B2AuthData, type BackendFacade, BaseDataProvider, BaseResourceFetcher, type CloudflareObservability, type CloudflarePagesPauseState, type CloudflarePagesPreviewSetting, type CloudflareProjectItem, CloudflareResourceFetcher, type CloudflareUsageMetrics, type CredentialEntry, type CredentialManifest, type Deployment, type DeploymentControlResult, type FunctionSet, FunctionalityTable, GRAPHS_ROOT, type IDataProvider, LEGACY_PROJECTS_ROOT, type OrchestrationFn, PROJECTS_ROOT, type ProjectMetadata, type PublicRouteRecord, type QueryFilter, ResourceFetcherRegistry, type Runtime, SAMPLES_GLOBAL_ROOT, SUPPORTED_AUDIO_EXTS, SUPPORTED_MIDI_EXTS, type ServerAudioSampleItem, type ServiceFacade, type ServiceRegistryRecord, type SortOrder, type SrklB2Account, SrklStorageService, type SyncFileResult, type UnifiedQueryResult, type UnifiedResourceMetricItem, type UnifiedResourceMetrics, VercelResourceFetcher, WORKSPACE_ASSETS_ROOT, WORKSPACE_ROOT, type WorkingWorkspaceConfig, type WorkspaceFolderResolution, type WorkspaceStorageConfig, b2DeleteFileVersion, b2DeleteFolder, buildProjectObservability, buildProjectsList, cleanDbUrl, computeDeploymentFinalWeight, computeUsageWeightScore, configureStarterProjectTemplate, createAssetSubfolder, createCredential, createGraphAssetFolder, createGraphAssetFolder as createGraphAssetSubfolder, createGraphPackage, createWavBuffer, createWorkspace, createWorkspaceGraph, decryptSecretFromBlob, deleteAssetFromGraph, deleteAssetFromPool, deleteCredential, deleteGlobalSample, deleteGraphPackage, deleteProject, deleteProjectSample, deleteRoute, deleteWorkspace, deleteWorkspaceFile, deleteWorkspaceFolder, deleteWorkspaceGraph, encryptSecretToBlob, ensureAssetPoolDirectories, ensureGlobalSamples, ensureGraphAssetDirectories, ensureProjectAssets, ensureProjectsRoot, ensureWorkspaceStructure, exportEncryptedCredentials, fetchCloudflareData, fetchVercelData, findUserWorkspace, findWorkspaceRecord, formatRelativeCreated, getAllRoutes, getAssetPoolLocationPath, getAssetPoolPublicUrl, getB2BucketId, getConnectedDeploymentNode, getConnectedWeightModifiers, getCredential, getDefaultWorkingWorkspaceDir, getExecutions, getGatewayConfig, getGraphPackageById, getPrimarySrklDeploymentUrl as getPrimarySrklCoreDeploymentUrl, getProjectById, getPublicRouteByPath, getPublicRoutes, getSrklAccounts as getSrklCoreAccounts, getSrklStatus, getUnifiedDbUrl, getUsers, getWeightModifierScore, getWorkingWorkspaceConfig, getWorkingWorkspaceDir, getWorkspaceFolderKey, getWorkspaceFolderPrefix, getWorkspaceGraph, getWorkspaceStorageDetails, getWorkspaces, importEncryptedCredentials, importGraphDependency, initGlobalSamplesDirectory, isB2Workspace, listAllGraphPackages, listAllProjects, listBackblazeBuckets, listCredentials, listGlobalSamples, listProjectSamples, listWorkspaceFiles, listWorkspaceGraphs, loadCredentialManifest, loadWorkspaceData, loginUser, matchGatewayIngress, matchGatewayIngressAsync, pauseCloudflarePagesProject, pauseVercelProject, queryUnifiedDb, readWorkspaceFile, recordExecution, removeGraphDependency, renameAppInWorkspaceData, resolveDynamicRouteFromDb, resolveSystemDatabaseUrl, resolveWorkspaceConnection, resolveWorkspaceDir, resumeCloudflarePagesProject, resumeVercelProject, saveAssetToGraph, saveAssetToPool, saveCredentialManifest, saveGlobalSample, saveGraphPackage, saveProject, saveProjectSample, saveWorkspaceData, saveWorkspaceGraph, scanAssetPool, scanGraphAssets, seedDefaultAssets, seedStarterGraphAssets, serverPublicRoutes, setServerPublicRoutes, setWorkingWorkspaceConfig, srklListBackblazeBuckets as srklCoreListBackblazeBuckets, syncWorkspace, syncWorkspaceCreateToBucket, syncWorkspaceDataToBucket, syncWorkspaceDeleteToBucket, tryResolveSystemDatabaseUrl, updateCredential, updateWorkspace, upsertRoute, validateServiceDefinition, writeWorkspaceFile };