@ultrst-armada/kloks 1.8.0 → 1.10.0

package/.krusbl-release-attestation.json

@@ -1,8 +1,8 @@
 {
   "schema": 1,
   "packageName": "@ultrst-armada/kloks",
-  "version": "1.8.0",
-  "sourceCommit": "d364f4fd5a705bea93c4fb0a93ff9740c1050f49",
+  "version": "1.10.0",
+  "sourceCommit": "302682bf08b2a4adcb8109f8f4a6a44651b25909",
   "releaseWorkflow": "npm Release",
-  "workflowRunId": "40208606705"
+  "workflowRunId": "40287961465"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultrst-armada/kloks",
-  "version": "1.8.0",
+  "version": "1.10.0",
   "private": false,
   "publishConfig": {
     "access": "public",
@@ -164,7 +164,7 @@
     "typescript": "^5.7.3",
     "vitest": "^3.1.0"
   },
-  "packageManager": "pnpm@9.15.0",
+  "packageManager": "pnpm@10.33.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/dinilmusick/Kloks.git"

package/packages/backend/dist/auth/index.js

@@ -3,7 +3,7 @@ import {
   BaseAccountProvider,
   LocalAccountProvider,
   PasswordHasher
-} from "../chunk-HT2SEDHD.js";
+} from "../chunk-W6JNJD3Q.js";
 import {
   CanonicalAuthClient,
   RateLimiter,
@@ -11,7 +11,7 @@ import {
   createCanonicalAuthClient,
   loginSystemUser,
   resolveUserFromToken
-} from "../chunk-M4GSR46Y.js";
+} from "../chunk-WTBAG4AV.js";
 export {
   AdminGuard,
   BaseAccountProvider,

package/packages/backend/dist/{chunk-SQGBAWZN.js → chunk-OYVHKYJW.js}

@@ -297,9 +297,10 @@ var COMMANDS2 = {
   test: { command: "pnpm", args: ["run", "test", "--if-present"] },
   build: { command: "pnpm", args: ["run", "build", "--if-present"] },
   krnl: { command: "pnpm", args: ["exec", "krnl", "validate"] },
-  frnl: { command: "pnpm", args: ["exec", "frnl", "validate"] }
+  frnl: { command: "pnpm", args: ["exec", "frnl", "validate"] },
+  "lockfile-check": { command: "pnpm", args: ["install", "--frozen-lockfile", "--ignore-scripts"] }
 };
-var DEFAULT_LAYERS = ["syntax", "lint", "krnl", "frnl"];
+var DEFAULT_LAYERS = ["lockfile-check", "syntax", "lint", "krnl", "frnl"];
 var commandText = (command, args) => [command, ...args].join(" ");
 var CodeValidationRuntime = class {
   constructor(runtime5 = new WebContainerRuntime()) {
@@ -310,9 +311,9 @@ var CodeValidationRuntime = class {
     if (input.files) await this.runtime.mount(input.files);
     const diagnostics = [];
     if (input.install) {
-      const installed = await this.runtime.runCommand("pnpm", ["install", "--no-frozen-lockfile"], input.cwd, input.env);
-      diagnostics.push({ layer: "lint", ok: installed.exitCode === 0, exitCode: installed.exitCode, output: installed.output, command: "pnpm install --no-frozen-lockfile" });
-      if (installed.exitCode !== 0) return { ok: false, diagnostics, failedLayers: ["lint"] };
+      const installed = await this.runtime.runCommand("pnpm", ["install", "--frozen-lockfile", "--ignore-scripts"], input.cwd, input.env);
+      diagnostics.push({ layer: "lockfile-check", ok: installed.exitCode === 0, exitCode: installed.exitCode, output: installed.output, command: "pnpm install --frozen-lockfile --ignore-scripts" });
+      if (installed.exitCode !== 0) return { ok: false, diagnostics, failedLayers: ["lockfile-check"] };
     }
     const layers = input.layers?.length ? input.layers : DEFAULT_LAYERS;
     for (const layer of layers) {
@@ -337,7 +338,7 @@ var runtime2 = new CodeValidationRuntime();
 var CodeValidationServiceDefinition = createServiceDefinition({
   id: "kloks.backend.codeValidation",
   name: "CodeValidationService",
-  version: "1.0.0",
+  version: "1.1.0",
   operations: { validate: { id: "CodeValidationService.validate", name: "validate", handler: async (input) => runtime2.validate(input) } }
 });
 var CodeValidationServiceFacade = {

package/packages/backend/dist/{chunk-BPFZCDS4.js → chunk-UMEO6XS4.js}

@@ -1,10 +1,16 @@
+import {
+  workspaceGraphService
+} from "./chunk-VKSGYMAH.js";
 import {
   getSrklAccounts,
   srklListBackblazeBuckets
 } from "./chunk-XHADDA75.js";
 import {
-  workspaceGraphService
-} from "./chunk-5RXXC6GE.js";
+  StorageAdapterFactory
+} from "./chunk-SHZAQTIT.js";
+import {
+  b2ListBuckets
+} from "./chunk-4QEMALXF.js";
 import {
   formatCanonicalWorkspaceFolderName,
   sanitizeWorkspaceName
@@ -19,18 +25,12 @@ import {
 import {
   queryUnifiedDb
 } from "./chunk-VAFCR2MS.js";
-import {
-  b2ListBuckets
-} from "./chunk-4QEMALXF.js";
-import {
-  StorageAdapterFactory
-} from "./chunk-SHZAQTIT.js";
 import {
   RateLimiter,
   SessionManager,
   loginSystemUser,
   resolveUserFromToken
-} from "./chunk-M4GSR46Y.js";
+} from "./chunk-WTBAG4AV.js";
 import {
   createService,
   createServiceDefinition

package/packages/backend/dist/{chunk-HT2SEDHD.js → chunk-W6JNJD3Q.js}

@@ -1,7 +1,7 @@
 import {
   RateLimiter,
   SessionManager
-} from "./chunk-M4GSR46Y.js";
+} from "./chunk-WTBAG4AV.js";
 
 // src/auth/PasswordHasher.ts
 var bcrypt = null;

package/packages/backend/dist/{chunk-M4GSR46Y.js → chunk-WTBAG4AV.js}

@@ -180,9 +180,11 @@ async function resolveUserFromToken(tokenOrUserId, _queryDb, env) {
   if (!tokenOrUserId) return null;
   try {
     const client = createCanonicalAuthClient(requireAuthBaseUrl(env));
-    const session = await client.getSession(
-      tokenOrUserId.startsWith("Bearer ") ? `better-auth.session_token=${tokenOrUserId.slice(7).trim()}` : void 0
-    );
+    const credential = tokenOrUserId.trim();
+    if (!credential) return null;
+    const token = credential.replace(/^Bearer[ \t]+/i, "").trim();
+    if (!token) return null;
+    const session = await client.getSession(`better-auth.session_token=${token}`);
     if (!session?.user) return null;
     return {
       ...session.user,

package/packages/backend/dist/development/index.d.ts

@@ -144,7 +144,7 @@ declare const DevelopmentServiceFacade: {
     execute: <TIn = unknown, TOut = unknown>(op: string, input?: TIn) => Promise<TOut>;
 };
 
-type ValidationLayer = 'syntax' | 'lint' | 'test' | 'build' | 'krnl' | 'frnl' | 'law-l9';
+type ValidationLayer = 'syntax' | 'lint' | 'test' | 'build' | 'krnl' | 'frnl' | 'lockfile-check' | 'law-l9';
 interface CodeValidationInput {
     layers?: ValidationLayer[];
     cwd?: string;

package/packages/backend/dist/development/index.js

@@ -21,7 +21,7 @@ import {
   WebContainerServiceFacade,
   codeDiagnosticsService,
   resolveDevelopmentCommand
-} from "../chunk-SQGBAWZN.js";
+} from "../chunk-OYVHKYJW.js";
 import "../chunk-TY32TUNI.js";
 export {
   AgentHarnessRuntime,

package/packages/backend/dist/index.d.ts

@@ -765,6 +765,7 @@ declare function buildProjectObservability(projects: any[], deployments: any[],
     fastDataTransferFormatted: string;
     middlewareInvocations: number;
     middlewareInvocationsFormatted: string;
+    latestDeploymentId: any;
     latestDeploymentUrl: string;
     latestDeploymentStatus: string;
     latestDeploymentCreatedAt: string;
@@ -780,8 +781,46 @@ declare function buildProjectsList(observability: any[]): {
     domain: any;
     domains: any;
     updatedAt: any;
+    deploymentId: any;
 }[];
 
+/**
+ * Provider deployment-control operations.
+ *
+ * Vercel: pauses/resumes a project's production service.
+ * Cloudflare Pages: disables/enables automatic production and preview deployments.
+ */
+type CloudflarePagesPreviewSetting = 'all' | 'none' | 'custom';
+interface CloudflarePagesPauseState {
+    productionDeploymentsEnabled: boolean;
+    previewDeploymentSetting: CloudflarePagesPreviewSetting;
+}
+interface DeploymentControlResult {
+    success: true;
+    provider: 'VERCEL' | 'CLOUDFLARE';
+    projectId: string;
+    controlState: 'ACTIVE' | 'PAUSED';
+    pauseState?: CloudflarePagesPauseState;
+}
+interface CredentialPayload {
+    token?: string;
+    apiToken?: string;
+    accessToken?: string;
+    teamId?: string;
+    accountId?: string;
+    cfAccountId?: string;
+    accountTag?: string;
+    authKey?: string;
+    globalApiKey?: string;
+    authEmail?: string;
+    email?: string;
+    credentials?: Record<string, any>;
+}
+declare function pauseVercelProject(projectId: string, payload?: CredentialPayload, userId?: string, env?: Record<string, unknown>): Promise<DeploymentControlResult>;
+declare function resumeVercelProject(projectId: string, payload?: CredentialPayload, userId?: string, env?: Record<string, unknown>): Promise<DeploymentControlResult>;
+declare function pauseCloudflarePagesProject(projectName: string, payload?: CredentialPayload, userId?: string, env?: Record<string, unknown>): Promise<DeploymentControlResult>;
+declare function resumeCloudflarePagesProject(projectName: string, pauseState: CloudflarePagesPauseState, payload?: CredentialPayload, userId?: string, env?: Record<string, unknown>): Promise<DeploymentControlResult>;
+
 declare function createWavBuffer(sampleRate: number, numChannels: number, samples: Float32Array[]): Buffer;
 
 declare function ensureGlobalSamples(globalSamplesDir: string): Promise<void>;
@@ -1638,4 +1677,4 @@ declare function resolveSystemDatabaseUrl(env?: Record<string, string | undefine
  */
 declare function tryResolveSystemDatabaseUrl(env?: Record<string, string | undefined>): string | null;
 
-export { type AssetChannelType, type AssetDataType, type AssetFolderInfo, type AssetPoolItem, type AssetPoolScope, type B2AuthData, type BackendFacade, BaseDataProvider, BaseResourceFetcher, type CloudflareObservability, type CloudflareProjectItem, CloudflareResourceFetcher, type CloudflareUsageMetrics, type CredentialEntry, type CredentialManifest, type Deployment, type FunctionSet, FunctionalityTable, GRAPHS_ROOT, type IDataProvider, LEGACY_PROJECTS_ROOT, type OrchestrationFn, PROJECTS_ROOT, type ProjectMetadata, type PublicRouteRecord, type QueryFilter, ResourceFetcherRegistry, type Runtime, SAMPLES_GLOBAL_ROOT, SUPPORTED_AUDIO_EXTS, SUPPORTED_MIDI_EXTS, type ServerAudioSampleItem, type ServiceFacade, type ServiceRegistryRecord, type SortOrder, type SrklB2Account, SrklStorageService, type SyncFileResult, type UnifiedQueryResult, type UnifiedResourceMetricItem, type UnifiedResourceMetrics, VercelResourceFetcher, WORKSPACE_ASSETS_ROOT, WORKSPACE_ROOT, type WorkingWorkspaceConfig, type WorkspaceFolderResolution, type WorkspaceStorageConfig, b2DeleteFileVersion, b2DeleteFolder, buildProjectObservability, buildProjectsList, cleanDbUrl, computeDeploymentFinalWeight, computeUsageWeightScore, configureStarterProjectTemplate, createAssetSubfolder, createCredential, createGraphAssetFolder, createGraphAssetFolder as createGraphAssetSubfolder, createGraphPackage, createWavBuffer, createWorkspace, createWorkspaceGraph, decryptSecretFromBlob, deleteAssetFromGraph, deleteAssetFromPool, deleteCredential, deleteGlobalSample, deleteGraphPackage, deleteProject, deleteProjectSample, deleteRoute, deleteWorkspace, deleteWorkspaceFile, deleteWorkspaceFolder, deleteWorkspaceGraph, encryptSecretToBlob, ensureAssetPoolDirectories, ensureGlobalSamples, ensureGraphAssetDirectories, ensureProjectAssets, ensureProjectsRoot, ensureWorkspaceStructure, exportEncryptedCredentials, fetchCloudflareData, fetchVercelData, findUserWorkspace, findWorkspaceRecord, formatRelativeCreated, getAllRoutes, getAssetPoolLocationPath, getAssetPoolPublicUrl, getB2BucketId, getConnectedDeploymentNode, getConnectedWeightModifiers, getCredential, getDefaultWorkingWorkspaceDir, getExecutions, getGatewayConfig, getGraphPackageById, getPrimarySrklDeploymentUrl as getPrimarySrklCoreDeploymentUrl, getProjectById, getPublicRouteByPath, getPublicRoutes, getSrklAccounts as getSrklCoreAccounts, getSrklStatus, getUnifiedDbUrl, getUsers, getWeightModifierScore, getWorkingWorkspaceConfig, getWorkingWorkspaceDir, getWorkspaceFolderKey, getWorkspaceFolderPrefix, getWorkspaceGraph, getWorkspaceStorageDetails, getWorkspaces, importEncryptedCredentials, importGraphDependency, initGlobalSamplesDirectory, isB2Workspace, listAllGraphPackages, listAllProjects, listBackblazeBuckets, listCredentials, listGlobalSamples, listProjectSamples, listWorkspaceFiles, listWorkspaceGraphs, loadCredentialManifest, loadWorkspaceData, loginUser, matchGatewayIngress, matchGatewayIngressAsync, queryUnifiedDb, readWorkspaceFile, recordExecution, removeGraphDependency, renameAppInWorkspaceData, resolveDynamicRouteFromDb, resolveSystemDatabaseUrl, resolveWorkspaceConnection, resolveWorkspaceDir, saveAssetToGraph, saveAssetToPool, saveCredentialManifest, saveGlobalSample, saveGraphPackage, saveProject, saveProjectSample, saveWorkspaceData, saveWorkspaceGraph, scanAssetPool, scanGraphAssets, seedDefaultAssets, seedStarterGraphAssets, serverPublicRoutes, setServerPublicRoutes, setWorkingWorkspaceConfig, srklListBackblazeBuckets as srklCoreListBackblazeBuckets, syncWorkspace, syncWorkspaceCreateToBucket, syncWorkspaceDataToBucket, syncWorkspaceDeleteToBucket, tryResolveSystemDatabaseUrl, updateCredential, updateWorkspace, upsertRoute, validateServiceDefinition, writeWorkspaceFile };
+export { type AssetChannelType, type AssetDataType, type AssetFolderInfo, type AssetPoolItem, type AssetPoolScope, type B2AuthData, type BackendFacade, BaseDataProvider, BaseResourceFetcher, type CloudflareObservability, type CloudflarePagesPauseState, type CloudflarePagesPreviewSetting, type CloudflareProjectItem, CloudflareResourceFetcher, type CloudflareUsageMetrics, type CredentialEntry, type CredentialManifest, type Deployment, type DeploymentControlResult, type FunctionSet, FunctionalityTable, GRAPHS_ROOT, type IDataProvider, LEGACY_PROJECTS_ROOT, type OrchestrationFn, PROJECTS_ROOT, type ProjectMetadata, type PublicRouteRecord, type QueryFilter, ResourceFetcherRegistry, type Runtime, SAMPLES_GLOBAL_ROOT, SUPPORTED_AUDIO_EXTS, SUPPORTED_MIDI_EXTS, type ServerAudioSampleItem, type ServiceFacade, type ServiceRegistryRecord, type SortOrder, type SrklB2Account, SrklStorageService, type SyncFileResult, type UnifiedQueryResult, type UnifiedResourceMetricItem, type UnifiedResourceMetrics, VercelResourceFetcher, WORKSPACE_ASSETS_ROOT, WORKSPACE_ROOT, type WorkingWorkspaceConfig, type WorkspaceFolderResolution, type WorkspaceStorageConfig, b2DeleteFileVersion, b2DeleteFolder, buildProjectObservability, buildProjectsList, cleanDbUrl, computeDeploymentFinalWeight, computeUsageWeightScore, configureStarterProjectTemplate, createAssetSubfolder, createCredential, createGraphAssetFolder, createGraphAssetFolder as createGraphAssetSubfolder, createGraphPackage, createWavBuffer, createWorkspace, createWorkspaceGraph, decryptSecretFromBlob, deleteAssetFromGraph, deleteAssetFromPool, deleteCredential, deleteGlobalSample, deleteGraphPackage, deleteProject, deleteProjectSample, deleteRoute, deleteWorkspace, deleteWorkspaceFile, deleteWorkspaceFolder, deleteWorkspaceGraph, encryptSecretToBlob, ensureAssetPoolDirectories, ensureGlobalSamples, ensureGraphAssetDirectories, ensureProjectAssets, ensureProjectsRoot, ensureWorkspaceStructure, exportEncryptedCredentials, fetchCloudflareData, fetchVercelData, findUserWorkspace, findWorkspaceRecord, formatRelativeCreated, getAllRoutes, getAssetPoolLocationPath, getAssetPoolPublicUrl, getB2BucketId, getConnectedDeploymentNode, getConnectedWeightModifiers, getCredential, getDefaultWorkingWorkspaceDir, getExecutions, getGatewayConfig, getGraphPackageById, getPrimarySrklDeploymentUrl as getPrimarySrklCoreDeploymentUrl, getProjectById, getPublicRouteByPath, getPublicRoutes, getSrklAccounts as getSrklCoreAccounts, getSrklStatus, getUnifiedDbUrl, getUsers, getWeightModifierScore, getWorkingWorkspaceConfig, getWorkingWorkspaceDir, getWorkspaceFolderKey, getWorkspaceFolderPrefix, getWorkspaceGraph, getWorkspaceStorageDetails, getWorkspaces, importEncryptedCredentials, importGraphDependency, initGlobalSamplesDirectory, isB2Workspace, listAllGraphPackages, listAllProjects, listBackblazeBuckets, listCredentials, listGlobalSamples, listProjectSamples, listWorkspaceFiles, listWorkspaceGraphs, loadCredentialManifest, loadWorkspaceData, loginUser, matchGatewayIngress, matchGatewayIngressAsync, pauseCloudflarePagesProject, pauseVercelProject, queryUnifiedDb, readWorkspaceFile, recordExecution, removeGraphDependency, renameAppInWorkspaceData, resolveDynamicRouteFromDb, resolveSystemDatabaseUrl, resolveWorkspaceConnection, resolveWorkspaceDir, resumeCloudflarePagesProject, resumeVercelProject, saveAssetToGraph, saveAssetToPool, saveCredentialManifest, saveGlobalSample, saveGraphPackage, saveProject, saveProjectSample, saveWorkspaceData, saveWorkspaceGraph, scanAssetPool, scanGraphAssets, seedDefaultAssets, seedStarterGraphAssets, serverPublicRoutes, setServerPublicRoutes, setWorkingWorkspaceConfig, srklListBackblazeBuckets as srklCoreListBackblazeBuckets, syncWorkspace, syncWorkspaceCreateToBucket, syncWorkspaceDataToBucket, syncWorkspaceDeleteToBucket, tryResolveSystemDatabaseUrl, updateCredential, updateWorkspace, upsertRoute, validateServiceDefinition, writeWorkspaceFile };

package/packages/backend/dist/index.js

@@ -1,3 +1,17 @@
+import {
+  CompositeBackend,
+  EndpointGenerator,
+  LOCAL_STORAGE_GRAPHS_PREFIX,
+  NodeGraphPersistenceService,
+  createBackend,
+  createCompositeService,
+  createLocalService,
+  createRemoteService,
+  exportGraphAsJsonFile,
+  nodeGraphPersistence,
+  parseGraphJsonFile,
+  validateGraphDocument
+} from "./chunk-RBF2OGMC.js";
 import {
   CANONICAL_SRKL_URL,
   SrklClient,
@@ -17,19 +31,8 @@ import {
   useSrklServices
 } from "./chunk-3IUA66RS.js";
 import {
-  CompositeBackend,
-  EndpointGenerator,
-  LOCAL_STORAGE_GRAPHS_PREFIX,
-  NodeGraphPersistenceService,
-  createBackend,
-  createCompositeService,
-  createLocalService,
-  createRemoteService,
-  exportGraphAsJsonFile,
-  nodeGraphPersistence,
-  parseGraphJsonFile,
-  validateGraphDocument
-} from "./chunk-RBF2OGMC.js";
+  S3Adapter
+} from "./chunk-RBQ4CW3T.js";
 import {
   RemoteWorkspaceService,
   SyncEngine,
@@ -46,9 +49,6 @@ import {
   syncWorkspace,
   workingWorkspaceService
 } from "./chunk-BTMIK44G.js";
-import {
-  S3Adapter
-} from "./chunk-RBQ4CW3T.js";
 import {
   AuthServiceDefinition,
   AuthServiceFacade,
@@ -82,15 +82,35 @@ import {
   krnlWorkspaceGraphServiceFacade,
   krnlWorkspaceServiceDefinition,
   krnlWorkspaceServiceFacade
-} from "./chunk-BPFZCDS4.js";
+} from "./chunk-UMEO6XS4.js";
+import {
+  workspaceGraphService
+} from "./chunk-VKSGYMAH.js";
 import {
   getPrimarySrklDeploymentUrl,
   getSrklAccounts,
   srklListBackblazeBuckets
 } from "./chunk-XHADDA75.js";
 import {
-  workspaceGraphService
-} from "./chunk-5RXXC6GE.js";
+  BackblazeB2Adapter,
+  LocalFSAdapter,
+  StorageAdapterFactory,
+  SupabaseStorageAdapter,
+  ensureS3DirectoryMarker,
+  isSecretMasked,
+  normalizeBackblazeCredentials,
+  permanentDeleteS3Folder,
+  permanentDeleteS3Object,
+  renameS3Folder,
+  resolveBackblazeEndpoint
+} from "./chunk-SHZAQTIT.js";
+import {
+  authorizeB2,
+  b2DownloadFile,
+  b2ListBuckets,
+  b2ListFileNames,
+  b2UploadFile
+} from "./chunk-4QEMALXF.js";
 import {
   formatCanonicalWorkspaceFolderName,
   sanitizeWorkspaceName
@@ -125,26 +145,6 @@ import {
   getUnifiedDbUrl,
   queryUnifiedDb
 } from "./chunk-VAFCR2MS.js";
-import {
-  authorizeB2,
-  b2DownloadFile,
-  b2ListBuckets,
-  b2ListFileNames,
-  b2UploadFile
-} from "./chunk-4QEMALXF.js";
-import {
-  BackblazeB2Adapter,
-  LocalFSAdapter,
-  StorageAdapterFactory,
-  SupabaseStorageAdapter,
-  ensureS3DirectoryMarker,
-  isSecretMasked,
-  normalizeBackblazeCredentials,
-  permanentDeleteS3Folder,
-  permanentDeleteS3Object,
-  renameS3Folder,
-  resolveBackblazeEndpoint
-} from "./chunk-SHZAQTIT.js";
 import {
   BaseStorageAdapter,
   GoogleDriveAdapter,
@@ -163,7 +163,7 @@ import {
   BaseAccountProvider,
   LocalAccountProvider,
   PasswordHasher
-} from "./chunk-HT2SEDHD.js";
+} from "./chunk-W6JNJD3Q.js";
 import {
   CanonicalAuthClient,
   RateLimiter,
@@ -171,7 +171,7 @@ import {
   createCanonicalAuthClient,
   loginSystemUser,
   resolveUserFromToken
-} from "./chunk-M4GSR46Y.js";
+} from "./chunk-WTBAG4AV.js";
 import {
   BackendProvider,
   useBackend,
@@ -232,7 +232,7 @@ import {
   WebContainerServiceFacade,
   codeDiagnosticsService,
   resolveDevelopmentCommand
-} from "./chunk-SQGBAWZN.js";
+} from "./chunk-OYVHKYJW.js";
 import "./chunk-TY32TUNI.js";
 
 // src/data/BaseDataProvider.ts
@@ -2058,6 +2058,8 @@ async function fetchCloudflareData(payload, rawUserId, env) {
         id: p.name || p.id,
         name: p.name,
         type: "PAGES_PROJECT",
+        providerProjectId: p.id,
+        providerDeploymentId: p.latest_deployment?.id,
         status: p.latest_deployment?.status || "READY",
         framework: "Cloudflare Pages",
         domain: pDomain,
@@ -2192,6 +2194,7 @@ function buildProjectObservability(projects, deployments, user) {
       fastDataTransferFormatted: "100 MB",
       middlewareInvocations: 10,
       middlewareInvocationsFormatted: "10",
+      latestDeploymentId: latestDep?.id,
       latestDeploymentUrl: `https://${cleanDeploymentUrl}`,
       latestDeploymentStatus: displayStatus,
       latestDeploymentCreatedAt: new Date(createdAtTime).toISOString(),
@@ -2209,7 +2212,8 @@ function buildProjectsList(observability) {
     url: po.latestDeploymentUrl,
     domain: po.domains && po.domains[0] || `${po.projectName}.vercel.app`,
     domains: po.domains || [`${po.projectName}.vercel.app`],
-    updatedAt: po.latestDeploymentCreatedAt
+    updatedAt: po.latestDeploymentCreatedAt,
+    deploymentId: po.latestDeploymentId
   }));
 }
 
@@ -2378,6 +2382,142 @@ async function fetchVercelData(payload, rawUserId, env) {
   }
 }
 
+// src/core/deploymentControlCore.ts
+function firstString(...values) {
+  return values.find((value) => typeof value === "string" && value.trim().length > 0)?.trim() || "";
+}
+async function resolveVercelCredentials(payload, userId, env) {
+  const credentials = payload.credentials || {};
+  let token = firstString(payload.token, payload.apiToken, payload.accessToken, credentials.token, credentials.apiToken, credentials.accessToken);
+  let teamId = firstString(payload.teamId, credentials.teamId);
+  if ((!token || !teamId) && userId && (payload.accountId || credentials.accountId)) {
+    const accountId = firstString(payload.accountId, credentials.accountId);
+    const srkl = await getSrklAccounts2(userId, "vercel", env);
+    const account = srkl.accounts?.find((item) => item.id === accountId);
+    const accountCredentials = account?.credentials || account?.metadata?.credentials || {};
+    token ||= firstString(accountCredentials.token, accountCredentials.apiToken, accountCredentials.accessToken);
+    teamId ||= firstString(accountCredentials.teamId);
+  }
+  if (!token) throw new Error("Vercel API token is missing or not configured for this account.");
+  return { token, teamId };
+}
+async function resolveCloudflareCredentials(payload, userId, env) {
+  const credentials = payload.credentials || {};
+  let token = firstString(payload.token, payload.apiToken, payload.accessToken, credentials.token, credentials.apiToken, credentials.accessToken);
+  let accountId = firstString(payload.accountId, payload.cfAccountId, payload.accountTag, credentials.accountId, credentials.cfAccountId, credentials.accountTag);
+  let authKey = firstString(payload.authKey, payload.globalApiKey, credentials.authKey, credentials.globalApiKey);
+  let authEmail = firstString(payload.authEmail, payload.email, credentials.authEmail, credentials.email);
+  if (!token && !authKey || !accountId) {
+    const requestedAccountId = firstString(payload.accountId, credentials.accountId);
+    if (userId && requestedAccountId) {
+      const srkl = await getSrklAccounts2(userId, "cloudflare", env);
+      const account = srkl.accounts?.find((item) => item.id === requestedAccountId);
+      const accountCredentials = account?.credentials || account?.metadata?.credentials || {};
+      token ||= firstString(accountCredentials.token, accountCredentials.apiToken, accountCredentials.accessToken);
+      accountId ||= firstString(accountCredentials.accountId, accountCredentials.cfAccountId, accountCredentials.accountTag);
+      authKey ||= firstString(accountCredentials.authKey, accountCredentials.globalApiKey);
+      authEmail ||= firstString(accountCredentials.authEmail, accountCredentials.email);
+    }
+  }
+  if (!token && !authKey) throw new Error("Cloudflare API Token or Global API Key required.");
+  if (!accountId) throw new Error("Cloudflare Account ID is required.");
+  return { token, accountId, authKey, authEmail };
+}
+function cloudflareHeaders(token, authKey, authEmail) {
+  const headers = { "Content-Type": "application/json", "User-Agent": "Kloks-DeploymentControl/1.0" };
+  if (token) headers.Authorization = `Bearer ${token}`;
+  else {
+    headers["X-Auth-Key"] = authKey;
+    headers["X-Auth-Email"] = authEmail;
+  }
+  return headers;
+}
+async function assertOk(response, provider) {
+  if (response.ok) return;
+  const body = await response.json().catch(() => ({}));
+  const message = body?.error?.message || body?.errors?.[0]?.message || body?.message || response.statusText;
+  throw new Error(`${provider} API error (${response.status}): ${message}`);
+}
+async function pauseVercelProject(projectId, payload = {}, userId, env) {
+  if (!projectId?.trim()) throw new Error("Vercel project ID is required.");
+  const { token, teamId } = await resolveVercelCredentials(payload, userId, env);
+  const query = teamId ? `?teamId=${encodeURIComponent(teamId)}` : "";
+  const response = await fetch(`https://api.vercel.com/v1/projects/${encodeURIComponent(projectId)}/pause${query}`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" }
+  });
+  await assertOk(response, "Vercel");
+  return { success: true, provider: "VERCEL", projectId, controlState: "PAUSED" };
+}
+async function resumeVercelProject(projectId, payload = {}, userId, env) {
+  if (!projectId?.trim()) throw new Error("Vercel project ID is required.");
+  const { token, teamId } = await resolveVercelCredentials(payload, userId, env);
+  const query = teamId ? `?teamId=${encodeURIComponent(teamId)}` : "";
+  const response = await fetch(`https://api.vercel.com/v1/projects/${encodeURIComponent(projectId)}/unpause${query}`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" }
+  });
+  await assertOk(response, "Vercel");
+  return { success: true, provider: "VERCEL", projectId, controlState: "ACTIVE" };
+}
+async function pauseCloudflarePagesProject(projectName, payload = {}, userId, env) {
+  if (!projectName?.trim()) throw new Error("Cloudflare Pages project name is required.");
+  const { token, accountId, authKey, authEmail } = await resolveCloudflareCredentials(payload, userId, env);
+  const base = `https://api.cloudflare.com/client/v4/accounts/${encodeURIComponent(accountId)}/pages/projects/${encodeURIComponent(projectName)}`;
+  const currentResponse = await fetch(base, { headers: cloudflareHeaders(token, authKey, authEmail) });
+  await assertOk(currentResponse, "Cloudflare");
+  const current = await currentResponse.json();
+  const config = current?.result?.source?.config;
+  if (!config) throw new Error("Cloudflare Pages project has no source deployment configuration to pause.");
+  const pauseState = {
+    productionDeploymentsEnabled: config.production_deployments_enabled !== false,
+    previewDeploymentSetting: config.preview_deployment_setting || "all"
+  };
+  const updateResponse = await fetch(base, {
+    method: "PATCH",
+    headers: cloudflareHeaders(token, authKey, authEmail),
+    body: JSON.stringify({
+      source: {
+        type: current?.result?.source?.type,
+        config: {
+          ...config,
+          production_deployments_enabled: false,
+          preview_deployment_setting: "none"
+        }
+      }
+    })
+  });
+  await assertOk(updateResponse, "Cloudflare");
+  return { success: true, provider: "CLOUDFLARE", projectId: projectName, controlState: "PAUSED", pauseState };
+}
+async function resumeCloudflarePagesProject(projectName, pauseState, payload = {}, userId, env) {
+  if (!projectName?.trim()) throw new Error("Cloudflare Pages project name is required.");
+  if (!pauseState) throw new Error("Cloudflare Pages pause state is required to resume safely.");
+  const { token, accountId, authKey, authEmail } = await resolveCloudflareCredentials(payload, userId, env);
+  const base = `https://api.cloudflare.com/client/v4/accounts/${encodeURIComponent(accountId)}/pages/projects/${encodeURIComponent(projectName)}`;
+  const currentResponse = await fetch(base, { headers: cloudflareHeaders(token, authKey, authEmail) });
+  await assertOk(currentResponse, "Cloudflare");
+  const current = await currentResponse.json();
+  const config = current?.result?.source?.config;
+  if (!config) throw new Error("Cloudflare Pages project has no source deployment configuration to resume.");
+  const updateResponse = await fetch(base, {
+    method: "PATCH",
+    headers: cloudflareHeaders(token, authKey, authEmail),
+    body: JSON.stringify({
+      source: {
+        type: current?.result?.source?.type,
+        config: {
+          ...config,
+          production_deployments_enabled: pauseState.productionDeploymentsEnabled,
+          preview_deployment_setting: pauseState.previewDeploymentSetting
+        }
+      }
+    })
+  });
+  await assertOk(updateResponse, "Cloudflare");
+  return { success: true, provider: "CLOUDFLARE", projectId: projectName, controlState: "ACTIVE" };
+}
+
 // src/server/wavHelper.ts
 function createWavBuffer(sampleRate, numChannels, samples) {
   const numSamples = samples[0].length;
@@ -4430,6 +4570,8 @@ export {
   nodeGraphPersistence,
   normalizeBackblazeCredentials,
   parseGraphJsonFile,
+  pauseCloudflarePagesProject,
+  pauseVercelProject,
   permanentDeleteS3Folder,
   permanentDeleteS3Object,
   queryUnifiedDb,
@@ -4448,6 +4590,8 @@ export {
   resolveUserFromToken,
   resolveWorkspaceConnection,
   resolveWorkspaceDir,
+  resumeCloudflarePagesProject,
+  resumeVercelProject,
   sanitizeWorkspaceName,
   saveAssetToGraph,
   saveAssetToPool,

package/packages/backend/dist/krnl-services.js

@@ -31,16 +31,16 @@ import {
   krnlWorkspaceGraphServiceFacade,
   krnlWorkspaceServiceDefinition,
   krnlWorkspaceServiceFacade
-} from "./chunk-BPFZCDS4.js";
+} from "./chunk-UMEO6XS4.js";
+import "./chunk-VKSGYMAH.js";
 import "./chunk-XHADDA75.js";
-import "./chunk-5RXXC6GE.js";
+import "./chunk-SHZAQTIT.js";
+import "./chunk-4QEMALXF.js";
 import "./chunk-FZKBTF34.js";
 import "./chunk-6K75XXFD.js";
 import "./chunk-VAFCR2MS.js";
-import "./chunk-4QEMALXF.js";
-import "./chunk-SHZAQTIT.js";
 import "./chunk-KKRWZDMN.js";
-import "./chunk-M4GSR46Y.js";
+import "./chunk-WTBAG4AV.js";
 import "./chunk-TY32TUNI.js";
 export {
   AuthServiceDefinition,

package/packages/backend/dist/services/index.js

@@ -14,10 +14,10 @@ import {
 } from "../chunk-RBF2OGMC.js";
 import {
   workspaceGraphService
-} from "../chunk-5RXXC6GE.js";
+} from "../chunk-VKSGYMAH.js";
+import "../chunk-SHZAQTIT.js";
 import "../chunk-6K75XXFD.js";
 import "../chunk-VAFCR2MS.js";
-import "../chunk-SHZAQTIT.js";
 import "../chunk-KKRWZDMN.js";
 import "../chunk-TY32TUNI.js";
 export {

package/packages/backend/dist/srkl/index.js

@@ -16,8 +16,8 @@ import {
   getSrklAccounts,
   srklListBackblazeBuckets
 } from "../chunk-XHADDA75.js";
-import "../chunk-VAFCR2MS.js";
 import "../chunk-4QEMALXF.js";
+import "../chunk-VAFCR2MS.js";
 export {
   CANONICAL_SRKL_URL,
   SrklClient,

package/packages/backend/dist/storage/index.js

@@ -1,13 +1,6 @@
 import {
   S3Adapter
 } from "../chunk-RBQ4CW3T.js";
-import {
-  authorizeB2,
-  b2DownloadFile,
-  b2ListBuckets,
-  b2ListFileNames,
-  b2UploadFile
-} from "../chunk-4QEMALXF.js";
 import {
   BackblazeB2Adapter,
   LocalFSAdapter,
@@ -21,6 +14,13 @@ import {
   renameS3Folder,
   resolveBackblazeEndpoint
 } from "../chunk-SHZAQTIT.js";
+import {
+  authorizeB2,
+  b2DownloadFile,
+  b2ListBuckets,
+  b2ListFileNames,
+  b2UploadFile
+} from "../chunk-4QEMALXF.js";
 import {
   BaseStorageAdapter,
   GoogleDriveAdapter,