@xuda.io/drive_module 1.1.1475 → 1.1.1477

package/index.mjs

@@ -14,7 +14,7 @@ import { imageSize } from 'image-size';
 import { getPackageManifest } from 'query-registry';
 
 // AWS SDK v3 Imports
-import { S3Client, GetObjectCommand, DeleteObjectCommand } from '@aws-sdk/client-s3';
+import { S3Client, GetObjectCommand, DeleteObjectCommand, PutObjectCommand } from '@aws-sdk/client-s3';
 import { Upload } from '@aws-sdk/lib-storage';
 
 console.log('Drive Module loaded...');
@@ -482,6 +482,25 @@ const get_folder_files = async function (uid, app_id, drive_type, path) {
   return [...(files_ret.data.children || []), ...(directory_ret.data.children || [])];
 };
 
+// Recursively flatten an entire folder subtree into a list of
+// { type, file_path } entries (every file + subfolder at any depth).
+// Each child returned by get_folder_files already carries its FULL
+// file_path (path.join(parent, name)), so we recurse on that directly.
+// Used by delete_drive_files to remove a non-empty folder and all of
+// its contents instead of refusing with "Directory is not empty".
+const collect_folder_descendants = async function (uid, app_id, drive_type, folder_full_path) {
+  const out = [];
+  const children = await get_folder_files(uid, app_id, drive_type, folder_full_path);
+  for (const child of children) {
+    out.push({ type: child.type, file_path: child.file_path });
+    if (child.type === 'directory') {
+      const sub = await collect_folder_descendants(uid, app_id, drive_type, child.file_path);
+      out.push(...sub);
+    }
+  }
+  return out;
+};
+
 export const delete_drive_files = async (req, job_id, headers) => {
   let ret = [];
   try {
@@ -507,9 +526,21 @@ export const delete_drive_files = async (req, job_id, headers) => {
       } catch (error) {}
 
       if (doc?.type === 'directory') {
-        const files_in_directory = await get_folder_files(uid, app_id, drive_type, path.join(doc.file_path, doc.folder_name));
-        if (files_in_directory?.length) {
-          throw new Error(`Directory is not empty`);
+        // Recursively delete the folder's entire subtree. Previously this
+        // refused with "Directory is not empty" — folders could never be
+        // deleted once they had any content. Now we gather every
+        // descendant (files + nested folders), fetch each real doc, mark
+        // it deleted (stat=4), and let the same bulk-save + cleanup below
+        // handle docs + filesystem/bucket removal for the whole tree.
+        const folder_full_path = path.join(doc.file_path, doc.folder_name);
+        const descendants = await collect_folder_descendants(uid, app_id, drive_type, folder_full_path);
+        for (const entry of descendants) {
+          try {
+            const child_doc = await get_drive_doc(entry.type, drive_type, app_id, uid, entry.file_path, headers);
+            child_doc.ts = Date.now();
+            child_doc.stat = 4;
+            docs.push(child_doc);
+          } catch (error) {}
         }
       }
     }
@@ -538,9 +569,15 @@ export const delete_drive_files = async (req, job_id, headers) => {
           switch (drive_type) {
             case 'studio': {
               const app_id_reference = await _common.get_project_app_id(app_id);
-              const target_dir = path.join(_conf[`studio_drive_path`], app_id_reference, doc.originalname);
+              // Resolve the on-disk path INCLUDING the doc's parent
+              // file_path (the old code dropped it, so nested files were
+              // never removed). For directory docs we rimraf the folder
+              // itself — recursively clearing the whole subtree on disk in
+              // one shot (the per-descendant-file rimrafs then no-op).
+              const rel = doc.type === 'directory' ? path.join(doc.file_path || '/', doc.folder_name) : path.join(doc.file_path || '/', doc.originalname);
+              const target_path = path.join(_conf[`studio_drive_path`], app_id_reference, rel);
 
-              rimraf.sync(target_dir);
+              rimraf.sync(target_path);
 
               misc_msa.rsync_drive_resources_to_remote_servers('studio', app_id_reference);
               break;
@@ -1094,7 +1131,13 @@ export const delete_file_bulk = async (req) => {
 
 export const upload_drive_file = async (req, job_id, headers = {}, file_obj) => {
   try {
-    const { drive_type, app_id, uid, make_public, tags = '', is_system, path: file_path } = req;
+    const { drive_type, app_id, make_public, tags = '', is_system, path: file_path } = req;
+    // uid comes from the authenticated token (token_ret), not the client body —
+    // multipart uploads (raw fetch FormData) can't rely on axios_ajax injecting
+    // it, and trusting a client-sent uid would be spoofable. Fall back to an
+    // explicit req.uid for internal callers (e.g. profile-image upload).
+    const uid = req.uid || req.token_ret?.data?.uid;
+    if (!uid) throw new Error('not authorized (no uid)');
 
     /// validations
     validate_drive_type(drive_type);
@@ -1965,6 +2008,16 @@ const save_drive_doc = async (drive_type, uid, app_id, doc) => {
   return save_ret;
 };
 
+// Stable hash of a script's source. Lets each server detect when its locally-built
+// dist is stale vs the current scriptData.value, so a changed script recompiles (and
+// re-rsyncs to datacenters) instead of being skipped just because vite_build_res exists.
+export const js_src_hash = (s) => {
+  s = String(s || '');
+  let h = 5381;
+  for (let i = 0; i < s.length; i++) h = ((h << 5) + h + s.charCodeAt(i)) >>> 0;
+  return h.toString(36) + '.' + s.length;
+};
+
 export const compile_javascript_program_in_studio_drive = async (req, job_id) => {
   const { app_id, doc } = req;
 
@@ -2158,6 +2211,7 @@ export default {
     misc_msa.rsync_drive_resources_to_remote_servers('studio', app_id);
     const vite_build_res = {
       code: 1,
+      src_hash: js_src_hash(inputCode),
       data: {
         build_ret,
         dependencies: devDependencies,
@@ -2255,6 +2309,415 @@ export const get_user_drive_file = async function (uid, filename) {
   return drive_ret;
 };
 
+// ── Static-site vibe: see + edit the site's source folder directly through the
+// cpi (Spaces + CouchDB) — no temp dir, no server disk growth. The "folder" is
+// the app's static_website.source.folder_path; files live in Spaces, hierarchy
+// in CouchDB. These back the static-site assistant's tools.
+
+const _site_source_folder = async (app_id) => {
+  const ret = await db_module.get_couch_doc('xuda_master', app_id);
+  const a = ret?.data;
+  if (!a || a.app_type !== 'static_website') return null;
+  return a.static_website?.source?.folder_path || null;
+};
+
+// Put bytes to the region bucket + upsert the matching user_drive doc. Reused by
+// write_site_file (assistant edits) and by version restore (override dev folder).
+const _write_user_drive_file = async (uid, project_id, dir, name, buffer, mime) => {
+  const region = process.env.XUDA_HOSTNAME;
+  const Bucket = _conf.storage_bucket?.[region]?.name;
+  const s3 = _drive_s3_for(region);
+  if (!s3 || !Bucket) return { code: -1, data: `no storage bucket for region ${region}` };
+  const existing = await db_module.find_app_couch_query(project_id, {
+    selector: { docType: 'user_drive', type: 'file', stat: 3, file_path: dir, originalname: name },
+    limit: 1,
+  });
+  let doc = existing?.docs?.[0] || null;
+  const ext = path.extname(name).toLowerCase();
+  const Key = doc?.bucket?.[region]?.Key || doc?.bucket?.[region]?.key || `drv_${project_id}_${await _common.xuda_get_uuid('user')}${ext}`;
+  await s3.send(new PutObjectCommand({ Bucket, Key, Body: buffer, ContentType: mime || _drive_content_type_for(name) }));
+  if (doc) {
+    doc.size = buffer.length;
+    doc.date_modified = Date.now();
+    doc.mime = mime || doc.mime || _drive_content_type_for(name);
+    doc.bucket = { ...(doc.bucket || {}), [region]: { Bucket, Key } };
+  } else {
+    doc = {
+      _id: Key,
+      docType: 'user_drive',
+      type: 'file',
+      stat: 3,
+      uid,
+      originalname: name,
+      file_path: dir,
+      file_ext: ext,
+      mime: mime || _drive_content_type_for(name),
+      size: buffer.length,
+      date_created: Date.now(),
+      date_modified: Date.now(),
+      server_file_name: Key,
+      bucket: { [region]: { Bucket, Key } },
+    };
+  }
+  await save_user_drive_file(uid, doc);
+  return { code: 1, data: { Key, size: buffer.length } };
+};
+
+// List the site's source files (paths only — lightweight, no bytes).
+export const list_site_files = async (req) => {
+  try {
+    const { uid } = req || {};
+    let folder = req?.site_folder;
+    if (!folder && req?.app_id) folder = await _site_source_folder(req.app_id);
+    if (!uid || !folder) return { code: -1, data: 'uid + (site_folder or app_id) required' };
+    // Plan A: the source lives on the studio fs — list the real files on disk.
+    const { dir } = await _static_site_fs_dir(uid, folder);
+    if (!fs.existsSync(dir)) return { code: 1, data: { folder, files: [] } };
+    const scan = await fs_module.dree_scan(dir, { stat: true, size: true, depth: 100, symbolicLinks: false, hash: false });
+    const files = [];
+    const walk = (node) => {
+      if (!node) return;
+      if (node.type === 'file') {
+        const rel = node.path.replace(dir, '').replace(/^\/+/, '');
+        if (rel) files.push({ path: rel, size: node.size || 0 });
+      }
+      (node.children || []).forEach(walk);
+    };
+    if (scan.code === 1) walk(scan.data);
+    files.sort((a, b) => a.path.localeCompare(b.path));
+    return { code: 1, data: { folder, files } };
+  } catch (err) {
+    return { code: -400, data: err.message };
+  }
+};
+
+// Read one source file's text content.
+export const read_site_file = async (req) => {
+  try {
+    const { uid, app_id } = req;
+    const rel = String(req.path || '').replace(/^\/+/, '');
+    if (!uid || !app_id || !rel) return { code: -1, data: 'uid + app_id + path required' };
+    const folder = await _site_source_folder(app_id);
+    if (!folder) return { code: -1, data: 'no source folder for this site' };
+    const full = path.posix.join(folder, rel);
+    const project_id = await get_account_default_project_id(uid);
+    const ret = await db_module.find_app_couch_query(project_id, {
+      selector: { docType: 'user_drive', type: 'file', stat: 3, file_path: path.posix.dirname(full), originalname: path.posix.basename(full) },
+      limit: 1,
+    });
+    const d = ret?.docs?.[0];
+    if (!d) return { code: -1, data: `file not found: ${rel}` };
+    const region = _pick_file_region(d);
+    const b = (region && d.bucket?.[region]) || {};
+    const Bucket = b.Bucket || b.bucket;
+    const Key = b.Key || b.key;
+    const s3 = region ? _drive_s3_for(region) : null;
+    if (!s3 || !Bucket || !Key) return { code: -1, data: 'file bytes unavailable' };
+    const obj = await s3.send(new GetObjectCommand({ Bucket, Key }));
+    const buf = await _stream_to_buffer(obj.Body);
+    return { code: 1, data: { path: rel, content: buf.toString('utf8'), size: buf.length } };
+  } catch (err) {
+    return { code: -400, data: err.message };
+  }
+};
+
+// Write/overwrite one source file. Does NOT publish — the user deploys via the
+// Build modal, so changes are always accepted explicitly.
+export const write_site_file = async (req) => {
+  try {
+    const { uid, app_id } = req;
+    const rel = String(req.path || '').replace(/^\/+/, '');
+    const content = req.content;
+    if (!uid || !app_id || !rel || typeof content !== 'string') return { code: -1, data: 'uid + app_id + path + content (string) required' };
+    const folder = await _site_source_folder(app_id);
+    if (!folder) return { code: -1, data: 'no source folder for this site' };
+    const full = path.posix.join(folder, rel);
+    const w = await _write_user_drive_file(uid, await get_account_default_project_id(uid), path.posix.dirname(full), path.posix.basename(full), Buffer.from(content, 'utf8'), _drive_content_type_for(path.posix.basename(full)));
+    if (w.code < 0) return w;
+    return { code: 1, data: { path: rel, size: w.data.size } };
+  } catch (err) {
+    return { code: -400, data: err.message };
+  }
+};
+
+// ── Plan A: static-site SOURCE on the STUDIO drive (real filesystem, pinned to
+// the home region, never replicated) so codex can edit it in place — no temp
+// dir, no Spaces round-trip for editing. Keyed by the account project id (same
+// key the user drive used), under /static-sites/<site>:
+//   <studio_drive_path>/<account_project_id>/<site_folder>/...
+// Serving still snapshots to Spaces at deploy time; this is only the editable source.
+const _static_site_fs_dir = async (uid, site_folder) => {
+  const ref = await get_account_default_project_id(uid);
+  const folder = String(site_folder || '').replace(/^\/+|\/+$/g, '');
+  // Containment: the resolved dir must stay under this account's own root, so a
+  // crafted site_folder/draft_folder ('../../other-account', '../../../etc') can't
+  // escape the tenant or reach the host filesystem.
+  const base = path.join(_conf.studio_drive_path, ref);
+  const dir = path.resolve(base, folder);
+  if (dir !== base && !dir.startsWith(base + path.sep)) throw new Error('invalid site_folder path');
+  return { ref, dir };
+};
+
+// Bulk-write source files to the fs (create + upload). Each file is
+// { path, content (utf8) | content_b64 (binary) }.
+export const ingest_static_site_source = async (req) => {
+  try {
+    const { uid, site_folder, files } = req || {};
+    if (!uid || !site_folder || !Array.isArray(files)) return { code: -1, data: 'uid + site_folder + files[] required' };
+    const { dir } = await _static_site_fs_dir(uid, site_folder);
+    fs.mkdirSync(dir, { recursive: true });
+    let count = 0;
+    for (const f of files) {
+      const rel = String(f.path || '').replace(/^\/+/, '');
+      if (!rel) continue;
+      const full = path.resolve(dir, rel);
+      if (full !== dir && !full.startsWith(dir + path.sep)) continue; // reject path traversal in per-file paths
+      const parent = path.dirname(full);
+      fs.mkdirSync(parent, { recursive: true });
+      const buf = f.content_b64 != null ? Buffer.from(f.content_b64, 'base64') : Buffer.from(f.content ?? '', 'utf8');
+      const w = await fs_module.save_file(full, buf);
+      if (w.code < 0) return { code: -1, data: `write failed for ${rel}: ${w.data}` };
+      count++;
+    }
+    return { code: 1, data: { dir, file_count: count } };
+  } catch (err) {
+    return { code: -400, data: err.message };
+  }
+};
+
+// Read every file under the site's source dir (deploy → snapshot to Spaces).
+// Returns [{ path, content_b64, content_type }].
+export const read_static_site_source = async (req) => {
+  try {
+    const { uid, site_folder } = req || {};
+    if (!uid || !site_folder) return { code: -1, data: 'uid + site_folder required' };
+    const { dir } = await _static_site_fs_dir(uid, site_folder);
+    if (!(await file_exists(dir))) return { code: -1, data: `source dir not found: ${dir}` };
+    const scan = await fs_module.dree_scan(dir, { stat: true, size: true, depth: 100, symbolicLinks: false, hash: false });
+    if (scan.code < 0) return { code: -1, data: scan.data };
+    const files = [];
+    const walk = async (node) => {
+      if (!node) return;
+      if (node.type === 'file') {
+        const rd = await fs_module.read_file(node.path, { encoding: null, flag: 'r' });
+        if (rd.code === 1) {
+          const buf = Buffer.isBuffer(rd.data) ? rd.data : Buffer.from(rd.data);
+          const rel = node.path.replace(dir, '').replace(/^\/+/, '');
+          files.push({ path: rel, content_b64: buf.toString('base64'), content_type: _drive_content_type_for(node.name || rel) });
+        }
+      }
+      for (const c of node.children || []) await walk(c);
+    };
+    await walk(scan.data);
+    return { code: 1, data: { dir, file_count: files.length, files } };
+  } catch (err) {
+    return { code: -400, data: err.message };
+  }
+};
+
+// Single source of truth for a static site's source dir on the studio fs, so
+// the vibe flow (codex cwd), deploy (read), and restore all resolve the SAME
+// path. ai_module calls this so it never has to recompute the account ref.
+export const get_static_site_dir = async (req) => {
+  try {
+    const { uid, site_folder } = req || {};
+    if (!uid || !site_folder) return { code: -1, data: 'uid + site_folder required' };
+    const { ref, dir } = await _static_site_fs_dir(uid, site_folder);
+    return { code: 1, data: { ref, dir } };
+  } catch (err) {
+    return { code: -400, data: err.message };
+  }
+};
+
+// List the account's static-site source folders on the studio fs. The create
+// wizard's "choose an existing folder" picker uses this — a user's sites/uploads
+// live here (studio fs), NOT on the Spaces user drive (which is why the old
+// get_drive_files_user picker showed nothing). Account-scoped (no app yet).
+export const list_static_site_folders = async (req) => {
+  try {
+    const uid = req?.uid || req?.token_ret?.data?.uid;
+    if (!uid) return { code: -1, data: 'not authorized' };
+    const ref = await get_account_default_project_id(uid);
+    const base = path.join(_conf.studio_drive_path, ref, 'static-sites');
+    if (!fs.existsSync(base)) return { code: 1, data: { folders: [] } };
+    const folders = [];
+    for (const e of fs.readdirSync(base, { withFileTypes: true })) {
+      if (!e.isDirectory()) continue;
+      const dir = path.join(base, e.name);
+      let bytes = 0;
+      let file_count = 0;
+      let has_index = false;
+      let mtime = 0;
+      let birthtime = 0;
+      try {
+        const walk = (d, rel) => {
+          for (const f of fs.readdirSync(d, { withFileTypes: true })) {
+            const r = rel ? rel + '/' + f.name : f.name;
+            const p = path.join(d, f.name);
+            if (f.isDirectory()) walk(p, r);
+            else {
+              file_count++;
+              try {
+                bytes += fs.statSync(p).size;
+              } catch (err) {}
+              if (/^index\.html?$/i.test(r)) has_index = true;
+            }
+          }
+        };
+        walk(dir, '');
+        const st = fs.statSync(dir);
+        mtime = st.mtimeMs;
+        // Creation time (ext4 stores crtime as birthtime); fall back where the
+        // filesystem doesn't report it so the field is always populated.
+        birthtime = st.birthtimeMs || st.ctimeMs || st.mtimeMs;
+      } catch (err) {}
+      folders.push({ folder_path: `/static-sites/${e.name}`, file_path: '/static-sites', folder_name: e.name, file_count, bytes, has_index, mtime, birthtime });
+    }
+    folders.sort((a, b) => b.mtime - a.mtime);
+    return { code: 1, data: { folders } };
+  } catch (err) {
+    return { code: -400, data: err.message };
+  }
+};
+
+// Reap abandoned static-site draft folders: any /static-sites/* dir not adopted
+// by a live static_website app AND older than max_age_hours. Fail-safe — if the
+// app enumeration fails we abort and delete NOTHING (never risk a live source).
+// dry_run (default true) reports without deleting. Called by the daily cron.
+export const cleanup_static_site_drafts = async (req) => {
+  try {
+    const dry_run = !(req && req.dry_run === false); // default true; pass dry_run:false to actually delete
+    const max_age_hours = (req && req.max_age_hours) || 24;
+    const max_age_ms = max_age_hours * 3600000;
+
+    // 1) Referenced set from LIVE apps. Any failure -> abort, delete nothing.
+    let apps;
+    try {
+      const r = await db_module.find_couch_query('xuda_master', { selector: { app_type: 'static_website' }, limit: 100000 });
+      apps = (r && r.docs) || [];
+    } catch (e) {
+      return { code: -1, data: 'aborted: could not enumerate apps (' + e.message + ')' };
+    }
+    if (!Array.isArray(apps)) return { code: -1, data: 'aborted: app enumeration returned no array' };
+    const referenced = new Set();
+    for (const a of apps) {
+      const fp = a && a.static_website && a.static_website.source && a.static_website.source.folder_path;
+      if (typeof fp === 'string' && fp.indexOf('/static-sites/') === 0)
+        referenced.add(
+          fp
+            .replace(/^\/+|\/+$/g, '')
+            .split('/')
+            .pop(),
+        );
+    }
+
+    // 2) Walk the studio fs, classify each /static-sites/* folder. Match by name
+    // (random-suffixed, globally unique in practice) — a false match only keeps
+    // an orphan, it never deletes a live source.
+    const now = Date.now();
+    const base_root = _conf.studio_drive_path;
+    const report = { scanned: 0, kept_referenced: 0, kept_recent: 0, deleted: [], errors: [], dry_run, max_age_hours, referenced_count: referenced.size };
+    let refs = [];
+    try {
+      refs = fs.readdirSync(base_root);
+    } catch (e) {
+      return { code: -1, data: 'aborted: cannot read studio_drive_path (' + e.message + ')' };
+    }
+    for (const ref of refs) {
+      const ss = path.join(base_root, ref, 'static-sites');
+      let names = [];
+      try {
+        if (!fs.existsSync(ss)) continue;
+        names = fs.readdirSync(ss);
+      } catch (e) {
+        continue;
+      }
+      for (const name of names) {
+        const dir = path.join(ss, name);
+        let st;
+        try {
+          st = fs.statSync(dir);
+          if (!st.isDirectory()) continue;
+        } catch (e) {
+          continue;
+        }
+        report.scanned++;
+        if (referenced.has(name)) {
+          report.kept_referenced++;
+          continue;
+        }
+        const age_ms = now - st.mtimeMs;
+        if (age_ms <= max_age_ms) {
+          report.kept_recent++;
+          continue;
+        }
+        const entry = { ref: ref.slice(0, 16), name, age_h: +(age_ms / 3600000).toFixed(1) };
+        if (dry_run) {
+          report.deleted.push({ ...entry, would_delete: true });
+        } else {
+          try {
+            fs.rmSync(dir, { recursive: true, force: true });
+            report.deleted.push(entry);
+          } catch (e) {
+            report.errors.push({ name, error: e.message });
+          }
+        }
+      }
+    }
+    return { code: 1, data: report };
+  } catch (err) {
+    return { code: -400, data: err.message };
+  }
+};
+
+// Live DEV preview URL — serves the editable fs source (the uncommitted edits)
+// over the existing /studio-drive/ route (cross-region proxied), so the vibe
+// panel shows the dev files, not the deployed version. Relative assets resolve
+// at the sub-path; cache-bust with a ts query so the iframe always reloads fresh.
+export const get_static_site_preview_url = async (req) => {
+  try {
+    const { uid, site_folder } = req || {};
+    if (!uid || !site_folder) return { code: -1, data: 'uid + site_folder required' };
+    const { ref } = await _static_site_fs_dir(uid, site_folder);
+    const folder = String(site_folder).replace(/^\/+|\/+$/g, '');
+    return { code: 1, data: { url: `https://${process.env.XUDA_HOSTNAME}/studio-drive/${ref}/${folder}/index.html` } };
+  } catch (err) {
+    return { code: -400, data: err.message };
+  }
+};
+
+// Restore: overwrite the editable source on the studio fs with a deployed
+// version's snapshot (read from Spaces via its manifest). True replace — the dev
+// folder becomes exactly that version, so the next vibe/build starts clean.
+export const restore_site_fs_from_manifest = async (req) => {
+  try {
+    const { uid, site_folder, manifest } = req || {};
+    if (!uid || !site_folder || !manifest || typeof manifest !== 'object') return { code: -1, data: 'uid + site_folder + manifest required' };
+    const { dir } = await _static_site_fs_dir(uid, site_folder);
+    if (fs.existsSync(dir)) fs.rmSync(dir, { recursive: true, force: true });
+    fs.mkdirSync(dir, { recursive: true });
+    let count = 0;
+    for (const [p, entry] of Object.entries(manifest)) {
+      const rel = String(p || '').replace(/^\/+/, '');
+      if (!rel || !entry) continue;
+      const region = entry.region;
+      const Bucket = entry.bucket || entry.Bucket;
+      const Key = entry.key || entry.Key;
+      const s3 = region ? _drive_s3_for(region) : null;
+      if (!s3 || !Bucket || !Key) continue;
+      const obj = await s3.send(new GetObjectCommand({ Bucket, Key }));
+      const buf = await _stream_to_buffer(obj.Body);
+      const full = path.join(dir, rel);
+      fs.mkdirSync(path.dirname(full), { recursive: true });
+      fs.writeFileSync(full, buf);
+      count++;
+    }
+    return { code: 1, data: { dir, file_count: count } };
+  } catch (err) {
+    return { code: -400, data: err.message };
+  }
+};
+
 export const save_user_drive_file = async function (uid, drive_doc) {
   const app_id = await get_account_default_project_id(uid);
   const save_ret = await db_module.save_app_couch_doc(app_id, drive_doc);
@@ -2273,6 +2736,262 @@ function getExtensionFromString(str) {
   return match ? match[1].toLowerCase() : '';
 }
 
+// ============================================================================
+//   Static-website source read (user drive -> deploy-ready blobs)
+// ============================================================================
+//
+// read_user_drive_folder is the bridge between a user's drive and the
+// static-site hosting layer (domains_module.deploy_site). Given a folder
+// reference in the user's drive, it walks every file at or below that
+// folder, pulls the bytes from Spaces/R2, and returns them shaped exactly
+// the way deploy_site wants: [{ path, content_b64, content_type }] where
+// `path` is RELATIVE to the folder reference (leading slash).
+//   reference "/my-site", file at file_path "/my-site/css" name "app.css"
+//   -> { path: "/css/app.css", ... }
+//   reference "/my-site", file at file_path "/my-site" name "index.html"
+//   -> { path: "/index.html", ... }
+
+const _drive_content_type_for = (name) => {
+  const ext = (getExtensionFromString(name) || '').toLowerCase();
+  const map = {
+    html: 'text/html',
+    htm: 'text/html',
+    css: 'text/css',
+    js: 'application/javascript',
+    mjs: 'application/javascript',
+    json: 'application/json',
+    svg: 'image/svg+xml',
+    png: 'image/png',
+    jpg: 'image/jpeg',
+    jpeg: 'image/jpeg',
+    gif: 'image/gif',
+    webp: 'image/webp',
+    ico: 'image/x-icon',
+    avif: 'image/avif',
+    txt: 'text/plain',
+    xml: 'application/xml',
+    woff: 'font/woff',
+    woff2: 'font/woff2',
+    ttf: 'font/ttf',
+    otf: 'font/otf',
+    eot: 'application/vnd.ms-fontobject',
+    map: 'application/json',
+    webmanifest: 'application/manifest+json',
+    pdf: 'application/pdf',
+    mp4: 'video/mp4',
+    webm: 'video/webm',
+    wasm: 'application/wasm',
+  };
+  return map[ext] || 'application/octet-stream';
+};
+
+// Plan C / regional drives: a user's file lives in a specific region's
+// Spaces bucket (doc.bucket is keyed by region-host, e.g. "eu.xuda.ai").
+// Because this read can run on a different server than where the file
+// lives (create_static_website runs on master; the file may be in eu),
+// we must address the file's OWN region — not the current server's.
+// Spaces is S3 over the internet, so any server can reach any region.
+const _drive_s3_cache = {};
+const _drive_s3_for = (region_host) => {
+  const conf = _conf.storage_bucket?.[region_host];
+  if (!conf) return null;
+  if (!_drive_s3_cache[region_host]) {
+    _drive_s3_cache[region_host] = new S3Client({
+      endpoint: conf.endpoint,
+      region: conf.region,
+      credentials: {
+        accessKeyId: _conf.digitalocean.spaces_access_key,
+        secretAccessKey: _conf.digitalocean.spaces_secret_key,
+      },
+      forcePathStyle: false,
+    });
+  }
+  return _drive_s3_cache[region_host];
+};
+
+// Pick which region to read a file from: prefer the current server's
+// region if the file is replicated there (lowest latency), else any
+// region in the file's bucket map that we have config for.
+const _pick_file_region = (doc) => {
+  const bmap = doc?.bucket || {};
+  const here = process.env.XUDA_HOSTNAME;
+  if (bmap[here] && _conf.storage_bucket?.[here]) return here;
+  for (const region of Object.keys(bmap)) {
+    if (_conf.storage_bucket?.[region]) return region;
+  }
+  return null;
+};
+
+const _stream_to_buffer = async (stream) => {
+  if (!stream) return Buffer.alloc(0);
+  // AWS SDK v3 Body is a Node Readable in this runtime.
+  if (typeof stream.transformToByteArray === 'function') {
+    return Buffer.from(await stream.transformToByteArray());
+  }
+  const chunks = [];
+  for await (const chunk of stream) {
+    chunks.push(typeof chunk === 'string' ? Buffer.from(chunk) : chunk);
+  }
+  return Buffer.concat(chunks);
+};
+
+export const read_user_drive_folder = async (req) => {
+  try {
+    const { uid } = req || {};
+    if (!uid) return { code: -1, data: 'uid required' };
+    // Normalize the folder reference: strip trailing slashes; '' -> '/'.
+    const root = String(req.folder_path || '/').replace(/\/+$/, '') || '/';
+
+    const app_id = await get_account_default_project_id(uid);
+    const ret = await db_module.find_app_couch_query(app_id, {
+      selector: { docType: 'user_drive', type: 'file', stat: 3 },
+      limit: 100000,
+    });
+
+    // Keep only files at the reference folder or any subfolder of it.
+    const docs = (ret?.docs || []).filter((d) => {
+      const fp = d.file_path || '/';
+      if (root === '/') return true;
+      return fp === root || fp.startsWith(root + '/');
+    });
+    if (!docs.length) return { code: -1, data: `no files found under ${root}` };
+
+    const files = [];
+    const skipped = [];
+    for (const d of docs) {
+      // Resolve the file's own region, then read from THAT region's bucket.
+      const region = _pick_file_region(d);
+      const b = (region && d.bucket?.[region]) || {};
+      const Bucket = b.Bucket || b.bucket || (region && _conf.storage_bucket?.[region]?.name);
+      const Key = b.Key || b.key;
+      const s3 = region ? _drive_s3_for(region) : null;
+      if (!s3 || !Bucket || !Key) {
+        // No reachable region (e.g. datacenter-scp file with no Spaces
+        // entry, or a region we have no config for) — surface it.
+        skipped.push(d.originalname || d._id);
+        continue;
+      }
+      try {
+        const obj = await s3.send(new GetObjectCommand({ Bucket, Key }));
+        const buf = await _stream_to_buffer(obj.Body);
+        const fp = d.file_path || '/';
+        const rel_dir = root === '/' ? fp : fp.slice(root.length); // '' | '/css'
+        const rel_path = path.posix.join('/', rel_dir || '/', d.originalname);
+        files.push({
+          path: rel_path,
+          content_b64: buf.toString('base64'),
+          content_type: d.mime || _drive_content_type_for(d.originalname),
+        });
+      } catch (err) {
+        console.error('[read_user_drive_folder] read fail', d._id, err.message);
+        skipped.push(d.originalname || d._id);
+      }
+    }
+
+    if (!files.length) return { code: -1, data: `no readable files under ${root}` };
+    return { code: 1, data: { files, file_count: files.length, skipped } };
+  } catch (err) {
+    return { code: -400, data: err.message };
+  }
+};
+
+// put_site_files — snapshot a set of static-site files into ONE region's
+// Spaces bucket under sites/{site_id}/{version}/{path}, public-read. Each
+// deploy writes a fresh immutable version directory, so older versions stay
+// intact for rollback. The router serves a site by fetching the returned
+// `location` (a public DO Spaces URL, globally reachable — Cloudflare caches
+// it at the edge), so no per-request cross-region copy is needed.
+//
+// Files land in the app's home region (data residency / Plan C). The returned
+// manifest is what the site doc stores as the version snapshot.
+//
+// req: { region_host, site_id, version, files:[{ path, content_b64, content_type? }] }
+// -> { manifest:{ [path]:{ key, bucket, region, location, content_type, bytes } }, file_count, bytes, region, version }
+export const put_site_files = async (req) => {
+  try {
+    const { site_id, version } = req || {};
+    const files = Array.isArray(req?.files) ? req.files : [];
+    if (!site_id || !version) return { code: -1, data: 'site_id and version required' };
+    if (!files.length) return { code: -1, data: 'no files' };
+
+    // Resolve the target region: caller's region_host if we have config for it,
+    // else fall back to this server's own region.
+    const region_host = req.region_host && _conf.storage_bucket?.[req.region_host] ? req.region_host : process.env.XUDA_HOSTNAME;
+    const conf = _conf.storage_bucket?.[region_host];
+    if (!conf) return { code: -1, data: `no storage config for region ${region_host}` };
+    const s3 = _drive_s3_for(region_host);
+    const Bucket = conf.name;
+    if (!s3 || !Bucket) return { code: -1, data: `no S3 client for region ${region_host}` };
+
+    const endpoint_host = String(conf.endpoint || '')
+      .replace(/^https?:\/\//, '')
+      .replace(/\/+$/, '');
+
+    const manifest = {};
+    let bytes = 0;
+    for (const f of files) {
+      const raw = String(f.path || '').replace(/\\/g, '/');
+      const norm = path.posix.join('/', raw); // '/index.html', '/css/app.css'
+      if (!norm || norm === '/' || norm.includes('..')) {
+        if (norm.includes('..')) return { code: -1, data: `bad path: ${raw}` };
+        continue;
+      }
+      const body = Buffer.from(String(f.content_b64 || ''), 'base64');
+      const content_type = f.content_type || _drive_content_type_for(norm) || 'application/octet-stream';
+      const Key = `sites/${site_id}/${version}${norm}`;
+      const up = new Upload({
+        client: s3,
+        params: { Bucket, Key, Body: body, ACL: 'public-read', ContentType: content_type },
+      });
+      const res = await up.done();
+      // Prefer the SDK-reported Location; reconstruct a virtual-hosted URL if absent.
+      const location = res?.Location || (endpoint_host ? `https://${Bucket}.${endpoint_host}/${Key}` : null);
+      manifest[norm] = { key: Key, bucket: Bucket, region: region_host, location, content_type, bytes: body.length };
+      bytes += body.length;
+    }
+
+    if (!Object.keys(manifest).length) return { code: -1, data: 'no valid files to upload' };
+    return { code: 1, data: { manifest, file_count: Object.keys(manifest).length, bytes, region: region_host, version } };
+  } catch (err) {
+    console.error('[put_site_files]', err);
+    return { code: -400, data: err.message };
+  }
+};
+
+// delete_site_files — best-effort removal of a site's (or one version's)
+// objects from its region bucket. Used by domains.delete_site so deleting a
+// site reclaims storage instead of orphaning blobs.
+// req: { region_host, site_id, version? }
+export const delete_site_files = async (req) => {
+  try {
+    const { site_id } = req || {};
+    if (!site_id) return { code: -1, data: 'site_id required' };
+    const region_host = req.region_host && _conf.storage_bucket?.[req.region_host] ? req.region_host : process.env.XUDA_HOSTNAME;
+    const conf = _conf.storage_bucket?.[region_host];
+    if (!conf) return { code: 1, data: { deleted: 0 } };
+    const s3 = _drive_s3_for(region_host);
+    const Bucket = conf.name;
+    const prefix = req.version ? `sites/${site_id}/${req.version}/` : `sites/${site_id}/`;
+
+    let deleted = 0;
+    let ContinuationToken;
+    const { ListObjectsV2Command } = await import('@aws-sdk/client-s3');
+    do {
+      const list = await s3.send(new ListObjectsV2Command({ Bucket, Prefix: prefix, ContinuationToken }));
+      for (const obj of list.Contents || []) {
+        await s3.send(new DeleteObjectCommand({ Bucket, Key: obj.Key }));
+        deleted++;
+      }
+      ContinuationToken = list.IsTruncated ? list.NextContinuationToken : undefined;
+    } while (ContinuationToken);
+
+    return { code: 1, data: { deleted, region: region_host } };
+  } catch (err) {
+    console.error('[delete_site_files]', err);
+    return { code: -400, data: err.message };
+  }
+};
+
 // Explicitly exporting dynamic functions for ESM compatibility
 export const get_drive_files_workspace = async (req, job_id, headers, file_obj) => {
   req.drive_type = 'workspace';
@@ -2284,6 +3003,7 @@ export const get_drive_files_studio = _common.location_sensitive(async (req, job
 });
 export const get_drive_files_user = async (req, job_id, headers, file_obj) => {
   req.drive_type = 'user';
+  if (!req.uid && req.token_ret?.data?.uid) req.uid = req.token_ret.data.uid; // user-drive ops resolve the project from the authenticated uid
   return await get_drive_files(req, job_id, headers, file_obj);
 };
 
@@ -2297,6 +3017,7 @@ export const get_drive_file_info_studio = _common.location_sensitive(async (req,
 });
 export const get_drive_file_info_user = async (req, job_id, headers, file_obj) => {
   req.drive_type = 'user';
+  if (!req.uid && req.token_ret?.data?.uid) req.uid = req.token_ret.data.uid; // user-drive ops resolve the project from the authenticated uid
   return await get_drive_file_info(req, job_id, headers, file_obj);
 };
 
@@ -2310,6 +3031,7 @@ export const delete_drive_files_studio = _common.location_sensitive(async (req,
 });
 export const delete_drive_files_user = async (req, job_id, headers, file_obj) => {
   req.drive_type = 'user';
+  if (!req.uid && req.token_ret?.data?.uid) req.uid = req.token_ret.data.uid; // user-drive ops resolve the project from the authenticated uid
   return await delete_drive_files(req, job_id, headers, file_obj);
 };
 
@@ -2323,6 +3045,7 @@ export const extract_drive_file_studio = _common.location_sensitive(async (req,
 });
 export const extract_drive_file_user = async (req, job_id, headers, file_obj) => {
   req.drive_type = 'user';
+  if (!req.uid && req.token_ret?.data?.uid) req.uid = req.token_ret.data.uid; // user-drive ops resolve the project from the authenticated uid
   return await extract_drive_file(req, job_id, headers, file_obj);
 };
 
@@ -2336,6 +3059,7 @@ export const upload_drive_file_studio = _common.location_sensitive(async (req, j
 });
 export const upload_drive_file_user = async (req, job_id, headers, file_obj) => {
   req.drive_type = 'user';
+  if (!req.uid && req.token_ret?.data?.uid) req.uid = req.token_ret.data.uid; // user-drive ops resolve the project from the authenticated uid
   return await upload_drive_file(req, job_id, headers, file_obj);
 };
 
@@ -2349,6 +3073,7 @@ export const update_drive_file_studio = _common.location_sensitive(async (req, j
 });
 export const update_drive_file_user = async (req, job_id, headers, file_obj) => {
   req.drive_type = 'user';
+  if (!req.uid && req.token_ret?.data?.uid) req.uid = req.token_ret.data.uid; // user-drive ops resolve the project from the authenticated uid
   return await update_drive_file(req, job_id, headers, file_obj);
 };
 
@@ -2362,6 +3087,7 @@ export const create_drive_folder_studio = _common.location_sensitive(async (req,
 });
 export const create_drive_folder_user = async (req, job_id, headers, file_obj) => {
   req.drive_type = 'user';
+  if (!req.uid && req.token_ret?.data?.uid) req.uid = req.token_ret.data.uid; // user-drive ops resolve the project from the authenticated uid
   return await create_drive_folder(req, job_id, headers, file_obj);
 };
 
@@ -2375,6 +3101,7 @@ export const rename_drive_file_studio = _common.location_sensitive(async (req, j
 });
 export const rename_drive_file_user = async (req, job_id, headers, file_obj) => {
   req.drive_type = 'user';
+  if (!req.uid && req.token_ret?.data?.uid) req.uid = req.token_ret.data.uid; // user-drive ops resolve the project from the authenticated uid
   return await rename_drive_file(req, job_id, headers, file_obj);
 };
 
@@ -2388,6 +3115,7 @@ export const rename_drive_folder_studio = _common.location_sensitive(async (req,
 });
 export const rename_drive_folder_user = async (req, job_id, headers, file_obj) => {
   req.drive_type = 'user';
+  if (!req.uid && req.token_ret?.data?.uid) req.uid = req.token_ret.data.uid; // user-drive ops resolve the project from the authenticated uid
   return await rename_drive_folder(req, job_id, headers, file_obj);
 };
 
@@ -2401,6 +3129,7 @@ export const update_drive_file_sharing_mode_studio = _common.location_sensitive(
 });
 export const update_drive_file_sharing_mode_user = async (req, job_id, headers, file_obj) => {
   req.drive_type = 'user';
+  if (!req.uid && req.token_ret?.data?.uid) req.uid = req.token_ret.data.uid; // user-drive ops resolve the project from the authenticated uid
   return await update_drive_file_sharing_mode(req, job_id, headers, file_obj);
 };
 
@@ -2414,6 +3143,7 @@ export const delete_file_bulk_studio = _common.location_sensitive(async (req, jo
 });
 export const delete_file_bulk_user = async (req, job_id, headers, file_obj) => {
   req.drive_type = 'user';
+  if (!req.uid && req.token_ret?.data?.uid) req.uid = req.token_ret.data.uid; // user-drive ops resolve the project from the authenticated uid
   return await delete_file_bulk(req, job_id, headers, file_obj);
 };
 
@@ -2435,10 +3165,12 @@ export const check_drive_files_studio = _common.location_sensitive(async (req, j
 });
 export const check_drive_file_user = async (req, job_id, headers, file_obj) => {
   req.drive_type = 'user';
+  if (!req.uid && req.token_ret?.data?.uid) req.uid = req.token_ret.data.uid; // user-drive ops resolve the project from the authenticated uid
   return await check_drive_file(req, job_id, headers, file_obj);
 };
 export const check_drive_files_user = async (req, job_id, headers, file_obj) => {
   req.drive_type = 'user';
+  if (!req.uid && req.token_ret?.data?.uid) req.uid = req.token_ret.data.uid; // user-drive ops resolve the project from the authenticated uid
   return await check_drive_files(req, job_id, headers, file_obj);
 };
 
@@ -2452,6 +3184,7 @@ export const update_drive_file_tags_studio = _common.location_sensitive(async (r
 });
 export const update_drive_file_tags_user = async (req, job_id, headers, file_obj) => {
   req.drive_type = 'user';
+  if (!req.uid && req.token_ret?.data?.uid) req.uid = req.token_ret.data.uid; // user-drive ops resolve the project from the authenticated uid
   return await update_drive_file_tags(req, job_id, headers, file_obj);
 };
 
@@ -2465,6 +3198,7 @@ export const update_drive_addons_studio = _common.location_sensitive(async (req,
 });
 export const update_drive_addons_user = async (req, job_id, headers, file_obj) => {
   req.drive_type = 'user';
+  if (!req.uid && req.token_ret?.data?.uid) req.uid = req.token_ret.data.uid; // user-drive ops resolve the project from the authenticated uid
   return await update_drive_addons(req, job_id, headers, file_obj);
 };