hazo_files 1.4.4 → 1.4.5

package/README.md

@@ -45,13 +45,20 @@ For the NamingRuleConfigurator component (drag-and-drop interface), also install
 npm install @dnd-kit/core @dnd-kit/sortable @dnd-kit/utilities
 ```
 
+For cloud storage providers (install only what you need):
+
+```bash
+npm install googleapis        # Google Drive support
+npm install dropbox           # Dropbox support
+```
+
 For database tracking and LLM extraction features (optional):
 
 ```bash
 npm install hazo_connect      # Database tracking
 npm install hazo_llm_api      # LLM document extraction
 npm install server-only       # Server-side safety (recommended)
-# Note: xxhash-wasm is included automatically as a dependency
+npm install xxhash-wasm       # File change detection (optional)
 ```
 
 ### Tailwind CSS v4 Setup (Required for UI Components)

package/{hazo_files_config.ini → config/hazo_files_config.ini.sample}

@@ -1,8 +1,9 @@
 ; Hazo Files Configuration
 ; This file configures the file management system
+; Copy to hazo_files_config.ini and fill in your values
 
 [general]
-; Available providers: local, google_drive
+; Available providers: local, google_drive, dropbox
 provider = local
 
 [local]
@@ -25,6 +26,18 @@ access_token =
 ; Optional: Root folder ID to use as base (empty = root of Drive)
 root_folder_id =
 
+[dropbox]
+; Dropbox OAuth credentials
+; These can also be set via environment variables:
+; HAZO_DROPBOX_CLIENT_ID, HAZO_DROPBOX_CLIENT_SECRET, etc.
+client_id =
+client_secret =
+redirect_uri = http://localhost:3000/api/auth/callback/dropbox
+refresh_token =
+access_token =
+; Optional: Root folder path within Dropbox (empty = root)
+root_path =
+
 [naming]
 ; Comma-separated list of supported date format tokens for naming rules
 ; Available: YYYY, YY, MM, M, DD, D, MMM, MMMM, YYYY-MM-DD, YYYY-MMM-DD, DD-MM-YYYY, MM-DD-YYYY

package/dist/index.d.mts

@@ -685,9 +685,9 @@ declare class FileManager {
      */
     initialize(config?: HazoFilesConfig): Promise<void>;
     /**
-     * Initialize synchronously (uses sync config loading)
+     * @deprecated Storage modules require async initialization. Use initialize() instead.
      */
-    initializeSync(config?: HazoFilesConfig): void;
+    initializeSync(_config?: HazoFilesConfig): void;
     /**
      * Check if manager is initialized
      */

package/dist/index.d.ts

@@ -685,9 +685,9 @@ declare class FileManager {
      */
     initialize(config?: HazoFilesConfig): Promise<void>;
     /**
-     * Initialize synchronously (uses sync config loading)
+     * @deprecated Storage modules require async initialization. Use initialize() instead.
      */
-    initializeSync(config?: HazoFilesConfig): void;
+    initializeSync(_config?: HazoFilesConfig): void;
     /**
      * Check if manager is initialized
      */

package/dist/index.js

@@ -1096,6 +1096,9 @@ var LocalStorageModule = class extends BaseStorageModule {
       if (!stats || stats.isDirectory()) {
         throw new FileNotFoundError(virtualPath);
       }
+      if (newName.includes("/") || newName.includes("\\") || newName.includes("..")) {
+        throw new InvalidPathError(newName, 'Name must not contain path separators or ".."');
+      }
       this.validateExtension(newName);
       const parentDir = path2.dirname(fullPath);
       const newFullPath = path2.join(parentDir, newName);
@@ -1110,7 +1113,7 @@ var LocalStorageModule = class extends BaseStorageModule {
       const item = await this.statToItem(newFullPath, newStats);
       return this.successResult(item);
     } catch (error) {
-      if (error instanceof FileNotFoundError || error instanceof FileExistsError || error instanceof InvalidExtensionError) {
+      if (error instanceof FileNotFoundError || error instanceof FileExistsError || error instanceof InvalidExtensionError || error instanceof InvalidPathError) {
         return this.errorResult(error.message);
       }
       return this.errorResult(`Failed to rename file: ${error.message}`);
@@ -1124,6 +1127,9 @@ var LocalStorageModule = class extends BaseStorageModule {
       if (!stats || !stats.isDirectory()) {
         throw new DirectoryNotFoundError(virtualPath);
       }
+      if (newName.includes("/") || newName.includes("\\") || newName.includes("..")) {
+        throw new InvalidPathError(newName, 'Name must not contain path separators or ".."');
+      }
       const parentDir = path2.dirname(fullPath);
       const newFullPath = path2.join(parentDir, newName);
       if (!options.overwrite) {
@@ -1137,7 +1143,7 @@ var LocalStorageModule = class extends BaseStorageModule {
       const item = await this.statToItem(newFullPath, newStats);
       return this.successResult(item);
     } catch (error) {
-      if (error instanceof DirectoryNotFoundError || error instanceof DirectoryExistsError) {
+      if (error instanceof DirectoryNotFoundError || error instanceof DirectoryExistsError || error instanceof InvalidPathError) {
         return this.errorResult(error.message);
       }
       return this.errorResult(`Failed to rename folder: ${error.message}`);
@@ -1279,9 +1285,12 @@ var GoogleDriveAuth = class {
    */
   async exchangeCodeForTokens(code) {
     const { tokens } = await this.oauth2Client.getToken(code);
+    if (!tokens.access_token) {
+      throw new Error("No access token received from Google OAuth");
+    }
     this.tokens = {
       accessToken: tokens.access_token,
-      refreshToken: tokens.refresh_token,
+      refreshToken: tokens.refresh_token ?? this.tokens?.refreshToken ?? "",
       expiryDate: tokens.expiry_date || void 0,
       scope: tokens.scope || void 0
     };
@@ -1466,7 +1475,8 @@ var GoogleDriveModule = class extends BaseStorageModule {
     const segments = normalized.split("/").filter(Boolean);
     let currentParentId = this.rootFolderId;
     for (const segment of segments) {
-      const query = `name='${segment}' and '${currentParentId}' in parents and trashed=false`;
+      const escapedSegment = segment.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+      const query = `name='${escapedSegment}' and '${currentParentId}' in parents and trashed=false`;
       const response = await this.drive.files.list({
         q: query,
         fields: "files(id, name, mimeType)",
@@ -1534,7 +1544,8 @@ var GoogleDriveModule = class extends BaseStorageModule {
       if (!parentId) {
         throw new DirectoryNotFoundError(parentPath);
       }
-      const existingQuery = `name='${folderName}' and '${parentId}' in parents and mimeType='${FOLDER_MIME_TYPE}' and trashed=false`;
+      const escapedFolderName = folderName.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+      const existingQuery = `name='${escapedFolderName}' and '${parentId}' in parents and mimeType='${FOLDER_MIME_TYPE}' and trashed=false`;
       const existingResponse = await this.drive.files.list({
         q: existingQuery,
         fields: "files(id)",
@@ -1597,7 +1608,8 @@ var GoogleDriveModule = class extends BaseStorageModule {
         throw new DirectoryNotFoundError(parentPath);
       }
       if (!options.overwrite) {
-        const existingQuery = `name='${fileName}' and '${parentId}' in parents and trashed=false`;
+        const escapedFileName = fileName.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+        const existingQuery = `name='${escapedFileName}' and '${parentId}' in parents and trashed=false`;
         const existingResponse = await this.drive.files.list({
           q: existingQuery,
           fields: "files(id)",
@@ -2552,20 +2564,12 @@ var FileManager = class {
     this.initialized = true;
   }
   /**
-   * Initialize synchronously (uses sync config loading)
+   * @deprecated Storage modules require async initialization. Use initialize() instead.
    */
-  initializeSync(config) {
-    if (this.initialized) {
-      return;
-    }
-    if (config) {
-      this.config = config;
-    } else if (this.options.config) {
-      this.config = this.options.config;
-    } else {
-      this.config = loadConfig(this.options.configPath);
-    }
-    this.module = createModule(this.config.provider);
+  initializeSync(_config) {
+    throw new Error(
+      "initializeSync is not supported. Storage modules require async initialization. Use initialize() instead."
+    );
   }
   /**
    * Check if manager is initialized
@@ -4007,7 +4011,7 @@ var TrackedFileManager = class extends FileManager {
     }
     let buffer;
     if (typeof downloadResult.data === "string") {
-      buffer = Buffer.from(downloadResult.data, "utf-8");
+      return null;
     } else if (downloadResult.data instanceof Buffer) {
       buffer = downloadResult.data;
     } else {
@@ -5322,7 +5326,13 @@ var HAZO_FILES_TABLE_SCHEMA = {
     "content_tag"
   ]
 };
+function validateTableName(tableName) {
+  if (!/^[a-z_][a-z0-9_]*$/i.test(tableName)) {
+    throw new Error(`Invalid table name: ${tableName}`);
+  }
+}
 function getSchemaForTable(tableName, dbType) {
+  validateTableName(tableName);
   const schema = HAZO_FILES_TABLE_SCHEMA[dbType];
   const defaultName = HAZO_FILES_TABLE_SCHEMA.tableName;
   return {
@@ -5392,6 +5402,7 @@ WHERE file_refs IS NULL OR ref_count IS NULL OR status IS NULL`
   ]
 };
 function getMigrationForTable(tableName, dbType) {
+  validateTableName(tableName);
   const migration = HAZO_FILES_MIGRATION_V2[dbType];
   const defaultName = HAZO_FILES_MIGRATION_V2.tableName;
   return {
@@ -5451,6 +5462,7 @@ var HAZO_FILES_NAMING_TABLE_SCHEMA = {
   ]
 };
 function getNamingSchemaForTable(tableName, dbType) {
+  validateTableName(tableName);
   const schema = HAZO_FILES_NAMING_TABLE_SCHEMA[dbType];
   const defaultName = HAZO_FILES_NAMING_TABLE_SCHEMA.tableName;
   return {
@@ -5487,6 +5499,7 @@ var HAZO_FILES_MIGRATION_V3 = {
   ]
 };
 function getMigrationV3ForTable(tableName, dbType) {
+  validateTableName(tableName);
   const migration = HAZO_FILES_MIGRATION_V3[dbType];
   const defaultName = HAZO_FILES_MIGRATION_V3.tableName;
   return {

package/dist/index.mjs

@@ -913,6 +913,9 @@ var LocalStorageModule = class extends BaseStorageModule {
       if (!stats || stats.isDirectory()) {
         throw new FileNotFoundError(virtualPath);
       }
+      if (newName.includes("/") || newName.includes("\\") || newName.includes("..")) {
+        throw new InvalidPathError(newName, 'Name must not contain path separators or ".."');
+      }
       this.validateExtension(newName);
       const parentDir = path2.dirname(fullPath);
       const newFullPath = path2.join(parentDir, newName);
@@ -927,7 +930,7 @@ var LocalStorageModule = class extends BaseStorageModule {
       const item = await this.statToItem(newFullPath, newStats);
       return this.successResult(item);
     } catch (error) {
-      if (error instanceof FileNotFoundError || error instanceof FileExistsError || error instanceof InvalidExtensionError) {
+      if (error instanceof FileNotFoundError || error instanceof FileExistsError || error instanceof InvalidExtensionError || error instanceof InvalidPathError) {
         return this.errorResult(error.message);
       }
       return this.errorResult(`Failed to rename file: ${error.message}`);
@@ -941,6 +944,9 @@ var LocalStorageModule = class extends BaseStorageModule {
       if (!stats || !stats.isDirectory()) {
         throw new DirectoryNotFoundError(virtualPath);
       }
+      if (newName.includes("/") || newName.includes("\\") || newName.includes("..")) {
+        throw new InvalidPathError(newName, 'Name must not contain path separators or ".."');
+      }
       const parentDir = path2.dirname(fullPath);
       const newFullPath = path2.join(parentDir, newName);
       if (!options.overwrite) {
@@ -954,7 +960,7 @@ var LocalStorageModule = class extends BaseStorageModule {
       const item = await this.statToItem(newFullPath, newStats);
       return this.successResult(item);
     } catch (error) {
-      if (error instanceof DirectoryNotFoundError || error instanceof DirectoryExistsError) {
+      if (error instanceof DirectoryNotFoundError || error instanceof DirectoryExistsError || error instanceof InvalidPathError) {
         return this.errorResult(error.message);
       }
       return this.errorResult(`Failed to rename folder: ${error.message}`);
@@ -1096,9 +1102,12 @@ var GoogleDriveAuth = class {
    */
   async exchangeCodeForTokens(code) {
     const { tokens } = await this.oauth2Client.getToken(code);
+    if (!tokens.access_token) {
+      throw new Error("No access token received from Google OAuth");
+    }
     this.tokens = {
       accessToken: tokens.access_token,
-      refreshToken: tokens.refresh_token,
+      refreshToken: tokens.refresh_token ?? this.tokens?.refreshToken ?? "",
       expiryDate: tokens.expiry_date || void 0,
       scope: tokens.scope || void 0
     };
@@ -1283,7 +1292,8 @@ var GoogleDriveModule = class extends BaseStorageModule {
     const segments = normalized.split("/").filter(Boolean);
     let currentParentId = this.rootFolderId;
     for (const segment of segments) {
-      const query = `name='${segment}' and '${currentParentId}' in parents and trashed=false`;
+      const escapedSegment = segment.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+      const query = `name='${escapedSegment}' and '${currentParentId}' in parents and trashed=false`;
       const response = await this.drive.files.list({
         q: query,
         fields: "files(id, name, mimeType)",
@@ -1351,7 +1361,8 @@ var GoogleDriveModule = class extends BaseStorageModule {
       if (!parentId) {
         throw new DirectoryNotFoundError(parentPath);
       }
-      const existingQuery = `name='${folderName}' and '${parentId}' in parents and mimeType='${FOLDER_MIME_TYPE}' and trashed=false`;
+      const escapedFolderName = folderName.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+      const existingQuery = `name='${escapedFolderName}' and '${parentId}' in parents and mimeType='${FOLDER_MIME_TYPE}' and trashed=false`;
       const existingResponse = await this.drive.files.list({
         q: existingQuery,
         fields: "files(id)",
@@ -1414,7 +1425,8 @@ var GoogleDriveModule = class extends BaseStorageModule {
         throw new DirectoryNotFoundError(parentPath);
       }
       if (!options.overwrite) {
-        const existingQuery = `name='${fileName}' and '${parentId}' in parents and trashed=false`;
+        const escapedFileName = fileName.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+        const existingQuery = `name='${escapedFileName}' and '${parentId}' in parents and trashed=false`;
         const existingResponse = await this.drive.files.list({
           q: existingQuery,
           fields: "files(id)",
@@ -2369,20 +2381,12 @@ var FileManager = class {
     this.initialized = true;
   }
   /**
-   * Initialize synchronously (uses sync config loading)
+   * @deprecated Storage modules require async initialization. Use initialize() instead.
    */
-  initializeSync(config) {
-    if (this.initialized) {
-      return;
-    }
-    if (config) {
-      this.config = config;
-    } else if (this.options.config) {
-      this.config = this.options.config;
-    } else {
-      this.config = loadConfig(this.options.configPath);
-    }
-    this.module = createModule(this.config.provider);
+  initializeSync(_config) {
+    throw new Error(
+      "initializeSync is not supported. Storage modules require async initialization. Use initialize() instead."
+    );
   }
   /**
    * Check if manager is initialized
@@ -3824,7 +3828,7 @@ var TrackedFileManager = class extends FileManager {
     }
     let buffer;
     if (typeof downloadResult.data === "string") {
-      buffer = Buffer.from(downloadResult.data, "utf-8");
+      return null;
     } else if (downloadResult.data instanceof Buffer) {
       buffer = downloadResult.data;
     } else {
@@ -5139,7 +5143,13 @@ var HAZO_FILES_TABLE_SCHEMA = {
     "content_tag"
   ]
 };
+function validateTableName(tableName) {
+  if (!/^[a-z_][a-z0-9_]*$/i.test(tableName)) {
+    throw new Error(`Invalid table name: ${tableName}`);
+  }
+}
 function getSchemaForTable(tableName, dbType) {
+  validateTableName(tableName);
   const schema = HAZO_FILES_TABLE_SCHEMA[dbType];
   const defaultName = HAZO_FILES_TABLE_SCHEMA.tableName;
   return {
@@ -5209,6 +5219,7 @@ WHERE file_refs IS NULL OR ref_count IS NULL OR status IS NULL`
   ]
 };
 function getMigrationForTable(tableName, dbType) {
+  validateTableName(tableName);
   const migration = HAZO_FILES_MIGRATION_V2[dbType];
   const defaultName = HAZO_FILES_MIGRATION_V2.tableName;
   return {
@@ -5268,6 +5279,7 @@ var HAZO_FILES_NAMING_TABLE_SCHEMA = {
   ]
 };
 function getNamingSchemaForTable(tableName, dbType) {
+  validateTableName(tableName);
   const schema = HAZO_FILES_NAMING_TABLE_SCHEMA[dbType];
   const defaultName = HAZO_FILES_NAMING_TABLE_SCHEMA.tableName;
   return {
@@ -5304,6 +5316,7 @@ var HAZO_FILES_MIGRATION_V3 = {
   ]
 };
 function getMigrationV3ForTable(tableName, dbType) {
+  validateTableName(tableName);
   const migration = HAZO_FILES_MIGRATION_V3[dbType];
   const defaultName = HAZO_FILES_MIGRATION_V3.tableName;
   return {

package/dist/server/index.d.mts

@@ -685,9 +685,9 @@ declare class FileManager {
      */
     initialize(config?: HazoFilesConfig): Promise<void>;
     /**
-     * Initialize synchronously (uses sync config loading)
+     * @deprecated Storage modules require async initialization. Use initialize() instead.
      */
-    initializeSync(config?: HazoFilesConfig): void;
+    initializeSync(_config?: HazoFilesConfig): void;
     /**
      * Check if manager is initialized
      */

package/dist/server/index.d.ts

@@ -685,9 +685,9 @@ declare class FileManager {
      */
     initialize(config?: HazoFilesConfig): Promise<void>;
     /**
-     * Initialize synchronously (uses sync config loading)
+     * @deprecated Storage modules require async initialization. Use initialize() instead.
      */
-    initializeSync(config?: HazoFilesConfig): void;
+    initializeSync(_config?: HazoFilesConfig): void;
     /**
      * Check if manager is initialized
      */

package/dist/server/index.js

@@ -1098,6 +1098,9 @@ var LocalStorageModule = class extends BaseStorageModule {
       if (!stats || stats.isDirectory()) {
         throw new FileNotFoundError(virtualPath);
       }
+      if (newName.includes("/") || newName.includes("\\") || newName.includes("..")) {
+        throw new InvalidPathError(newName, 'Name must not contain path separators or ".."');
+      }
       this.validateExtension(newName);
       const parentDir = path2.dirname(fullPath);
       const newFullPath = path2.join(parentDir, newName);
@@ -1112,7 +1115,7 @@ var LocalStorageModule = class extends BaseStorageModule {
       const item = await this.statToItem(newFullPath, newStats);
       return this.successResult(item);
     } catch (error) {
-      if (error instanceof FileNotFoundError || error instanceof FileExistsError || error instanceof InvalidExtensionError) {
+      if (error instanceof FileNotFoundError || error instanceof FileExistsError || error instanceof InvalidExtensionError || error instanceof InvalidPathError) {
         return this.errorResult(error.message);
       }
       return this.errorResult(`Failed to rename file: ${error.message}`);
@@ -1126,6 +1129,9 @@ var LocalStorageModule = class extends BaseStorageModule {
       if (!stats || !stats.isDirectory()) {
         throw new DirectoryNotFoundError(virtualPath);
       }
+      if (newName.includes("/") || newName.includes("\\") || newName.includes("..")) {
+        throw new InvalidPathError(newName, 'Name must not contain path separators or ".."');
+      }
       const parentDir = path2.dirname(fullPath);
       const newFullPath = path2.join(parentDir, newName);
       if (!options.overwrite) {
@@ -1139,7 +1145,7 @@ var LocalStorageModule = class extends BaseStorageModule {
       const item = await this.statToItem(newFullPath, newStats);
       return this.successResult(item);
     } catch (error) {
-      if (error instanceof DirectoryNotFoundError || error instanceof DirectoryExistsError) {
+      if (error instanceof DirectoryNotFoundError || error instanceof DirectoryExistsError || error instanceof InvalidPathError) {
         return this.errorResult(error.message);
       }
       return this.errorResult(`Failed to rename folder: ${error.message}`);
@@ -1281,9 +1287,12 @@ var GoogleDriveAuth = class {
    */
   async exchangeCodeForTokens(code) {
     const { tokens } = await this.oauth2Client.getToken(code);
+    if (!tokens.access_token) {
+      throw new Error("No access token received from Google OAuth");
+    }
     this.tokens = {
       accessToken: tokens.access_token,
-      refreshToken: tokens.refresh_token,
+      refreshToken: tokens.refresh_token ?? this.tokens?.refreshToken ?? "",
       expiryDate: tokens.expiry_date || void 0,
       scope: tokens.scope || void 0
     };
@@ -1468,7 +1477,8 @@ var GoogleDriveModule = class extends BaseStorageModule {
     const segments = normalized.split("/").filter(Boolean);
     let currentParentId = this.rootFolderId;
     for (const segment of segments) {
-      const query = `name='${segment}' and '${currentParentId}' in parents and trashed=false`;
+      const escapedSegment = segment.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+      const query = `name='${escapedSegment}' and '${currentParentId}' in parents and trashed=false`;
       const response = await this.drive.files.list({
         q: query,
         fields: "files(id, name, mimeType)",
@@ -1536,7 +1546,8 @@ var GoogleDriveModule = class extends BaseStorageModule {
       if (!parentId) {
         throw new DirectoryNotFoundError(parentPath);
       }
-      const existingQuery = `name='${folderName}' and '${parentId}' in parents and mimeType='${FOLDER_MIME_TYPE}' and trashed=false`;
+      const escapedFolderName = folderName.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+      const existingQuery = `name='${escapedFolderName}' and '${parentId}' in parents and mimeType='${FOLDER_MIME_TYPE}' and trashed=false`;
       const existingResponse = await this.drive.files.list({
         q: existingQuery,
         fields: "files(id)",
@@ -1599,7 +1610,8 @@ var GoogleDriveModule = class extends BaseStorageModule {
         throw new DirectoryNotFoundError(parentPath);
       }
       if (!options.overwrite) {
-        const existingQuery = `name='${fileName}' and '${parentId}' in parents and trashed=false`;
+        const escapedFileName = fileName.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+        const existingQuery = `name='${escapedFileName}' and '${parentId}' in parents and trashed=false`;
         const existingResponse = await this.drive.files.list({
           q: existingQuery,
           fields: "files(id)",
@@ -2554,20 +2566,12 @@ var FileManager = class {
     this.initialized = true;
   }
   /**
-   * Initialize synchronously (uses sync config loading)
+   * @deprecated Storage modules require async initialization. Use initialize() instead.
    */
-  initializeSync(config) {
-    if (this.initialized) {
-      return;
-    }
-    if (config) {
-      this.config = config;
-    } else if (this.options.config) {
-      this.config = this.options.config;
-    } else {
-      this.config = loadConfig(this.options.configPath);
-    }
-    this.module = createModule(this.config.provider);
+  initializeSync(_config) {
+    throw new Error(
+      "initializeSync is not supported. Storage modules require async initialization. Use initialize() instead."
+    );
   }
   /**
    * Check if manager is initialized
@@ -4009,7 +4013,7 @@ var TrackedFileManager = class extends FileManager {
     }
     let buffer;
     if (typeof downloadResult.data === "string") {
-      buffer = Buffer.from(downloadResult.data, "utf-8");
+      return null;
     } else if (downloadResult.data instanceof Buffer) {
       buffer = downloadResult.data;
     } else {
@@ -5392,7 +5396,13 @@ var HAZO_FILES_TABLE_SCHEMA = {
     "content_tag"
   ]
 };
+function validateTableName(tableName) {
+  if (!/^[a-z_][a-z0-9_]*$/i.test(tableName)) {
+    throw new Error(`Invalid table name: ${tableName}`);
+  }
+}
 function getSchemaForTable(tableName, dbType) {
+  validateTableName(tableName);
   const schema = HAZO_FILES_TABLE_SCHEMA[dbType];
   const defaultName = HAZO_FILES_TABLE_SCHEMA.tableName;
   return {
@@ -5462,6 +5472,7 @@ WHERE file_refs IS NULL OR ref_count IS NULL OR status IS NULL`
   ]
 };
 function getMigrationForTable(tableName, dbType) {
+  validateTableName(tableName);
   const migration = HAZO_FILES_MIGRATION_V2[dbType];
   const defaultName = HAZO_FILES_MIGRATION_V2.tableName;
   return {
@@ -5521,6 +5532,7 @@ var HAZO_FILES_NAMING_TABLE_SCHEMA = {
   ]
 };
 function getNamingSchemaForTable(tableName, dbType) {
+  validateTableName(tableName);
   const schema = HAZO_FILES_NAMING_TABLE_SCHEMA[dbType];
   const defaultName = HAZO_FILES_NAMING_TABLE_SCHEMA.tableName;
   return {
@@ -5557,6 +5569,7 @@ var HAZO_FILES_MIGRATION_V3 = {
   ]
 };
 function getMigrationV3ForTable(tableName, dbType) {
+  validateTableName(tableName);
   const migration = HAZO_FILES_MIGRATION_V3[dbType];
   const defaultName = HAZO_FILES_MIGRATION_V3.tableName;
   return {
@@ -5606,6 +5619,9 @@ async function migrateToV3(executor, dbType, tableName) {
 try {
   require("server-only");
 } catch {
+  console.warn(
+    '[hazo_files/server] "server-only" package not installed. Install it to prevent this module from being bundled in client code.'
+  );
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/server/index.mjs

@@ -920,6 +920,9 @@ var LocalStorageModule = class extends BaseStorageModule {
       if (!stats || stats.isDirectory()) {
         throw new FileNotFoundError(virtualPath);
       }
+      if (newName.includes("/") || newName.includes("\\") || newName.includes("..")) {
+        throw new InvalidPathError(newName, 'Name must not contain path separators or ".."');
+      }
       this.validateExtension(newName);
       const parentDir = path2.dirname(fullPath);
       const newFullPath = path2.join(parentDir, newName);
@@ -934,7 +937,7 @@ var LocalStorageModule = class extends BaseStorageModule {
       const item = await this.statToItem(newFullPath, newStats);
       return this.successResult(item);
     } catch (error) {
-      if (error instanceof FileNotFoundError || error instanceof FileExistsError || error instanceof InvalidExtensionError) {
+      if (error instanceof FileNotFoundError || error instanceof FileExistsError || error instanceof InvalidExtensionError || error instanceof InvalidPathError) {
         return this.errorResult(error.message);
       }
       return this.errorResult(`Failed to rename file: ${error.message}`);
@@ -948,6 +951,9 @@ var LocalStorageModule = class extends BaseStorageModule {
       if (!stats || !stats.isDirectory()) {
         throw new DirectoryNotFoundError(virtualPath);
       }
+      if (newName.includes("/") || newName.includes("\\") || newName.includes("..")) {
+        throw new InvalidPathError(newName, 'Name must not contain path separators or ".."');
+      }
       const parentDir = path2.dirname(fullPath);
       const newFullPath = path2.join(parentDir, newName);
       if (!options.overwrite) {
@@ -961,7 +967,7 @@ var LocalStorageModule = class extends BaseStorageModule {
       const item = await this.statToItem(newFullPath, newStats);
       return this.successResult(item);
     } catch (error) {
-      if (error instanceof DirectoryNotFoundError || error instanceof DirectoryExistsError) {
+      if (error instanceof DirectoryNotFoundError || error instanceof DirectoryExistsError || error instanceof InvalidPathError) {
         return this.errorResult(error.message);
       }
       return this.errorResult(`Failed to rename folder: ${error.message}`);
@@ -1103,9 +1109,12 @@ var GoogleDriveAuth = class {
    */
   async exchangeCodeForTokens(code) {
     const { tokens } = await this.oauth2Client.getToken(code);
+    if (!tokens.access_token) {
+      throw new Error("No access token received from Google OAuth");
+    }
     this.tokens = {
       accessToken: tokens.access_token,
-      refreshToken: tokens.refresh_token,
+      refreshToken: tokens.refresh_token ?? this.tokens?.refreshToken ?? "",
       expiryDate: tokens.expiry_date || void 0,
       scope: tokens.scope || void 0
     };
@@ -1290,7 +1299,8 @@ var GoogleDriveModule = class extends BaseStorageModule {
     const segments = normalized.split("/").filter(Boolean);
     let currentParentId = this.rootFolderId;
     for (const segment of segments) {
-      const query = `name='${segment}' and '${currentParentId}' in parents and trashed=false`;
+      const escapedSegment = segment.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+      const query = `name='${escapedSegment}' and '${currentParentId}' in parents and trashed=false`;
       const response = await this.drive.files.list({
         q: query,
         fields: "files(id, name, mimeType)",
@@ -1358,7 +1368,8 @@ var GoogleDriveModule = class extends BaseStorageModule {
       if (!parentId) {
         throw new DirectoryNotFoundError(parentPath);
       }
-      const existingQuery = `name='${folderName}' and '${parentId}' in parents and mimeType='${FOLDER_MIME_TYPE}' and trashed=false`;
+      const escapedFolderName = folderName.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+      const existingQuery = `name='${escapedFolderName}' and '${parentId}' in parents and mimeType='${FOLDER_MIME_TYPE}' and trashed=false`;
       const existingResponse = await this.drive.files.list({
         q: existingQuery,
         fields: "files(id)",
@@ -1421,7 +1432,8 @@ var GoogleDriveModule = class extends BaseStorageModule {
         throw new DirectoryNotFoundError(parentPath);
       }
       if (!options.overwrite) {
-        const existingQuery = `name='${fileName}' and '${parentId}' in parents and trashed=false`;
+        const escapedFileName = fileName.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+        const existingQuery = `name='${escapedFileName}' and '${parentId}' in parents and trashed=false`;
         const existingResponse = await this.drive.files.list({
           q: existingQuery,
           fields: "files(id)",
@@ -2376,20 +2388,12 @@ var FileManager = class {
     this.initialized = true;
   }
   /**
-   * Initialize synchronously (uses sync config loading)
+   * @deprecated Storage modules require async initialization. Use initialize() instead.
    */
-  initializeSync(config) {
-    if (this.initialized) {
-      return;
-    }
-    if (config) {
-      this.config = config;
-    } else if (this.options.config) {
-      this.config = this.options.config;
-    } else {
-      this.config = loadConfig(this.options.configPath);
-    }
-    this.module = createModule(this.config.provider);
+  initializeSync(_config) {
+    throw new Error(
+      "initializeSync is not supported. Storage modules require async initialization. Use initialize() instead."
+    );
   }
   /**
    * Check if manager is initialized
@@ -3831,7 +3835,7 @@ var TrackedFileManager = class extends FileManager {
     }
     let buffer;
     if (typeof downloadResult.data === "string") {
-      buffer = Buffer.from(downloadResult.data, "utf-8");
+      return null;
     } else if (downloadResult.data instanceof Buffer) {
       buffer = downloadResult.data;
     } else {
@@ -5214,7 +5218,13 @@ var HAZO_FILES_TABLE_SCHEMA = {
     "content_tag"
   ]
 };
+function validateTableName(tableName) {
+  if (!/^[a-z_][a-z0-9_]*$/i.test(tableName)) {
+    throw new Error(`Invalid table name: ${tableName}`);
+  }
+}
 function getSchemaForTable(tableName, dbType) {
+  validateTableName(tableName);
   const schema = HAZO_FILES_TABLE_SCHEMA[dbType];
   const defaultName = HAZO_FILES_TABLE_SCHEMA.tableName;
   return {
@@ -5284,6 +5294,7 @@ WHERE file_refs IS NULL OR ref_count IS NULL OR status IS NULL`
   ]
 };
 function getMigrationForTable(tableName, dbType) {
+  validateTableName(tableName);
   const migration = HAZO_FILES_MIGRATION_V2[dbType];
   const defaultName = HAZO_FILES_MIGRATION_V2.tableName;
   return {
@@ -5343,6 +5354,7 @@ var HAZO_FILES_NAMING_TABLE_SCHEMA = {
   ]
 };
 function getNamingSchemaForTable(tableName, dbType) {
+  validateTableName(tableName);
   const schema = HAZO_FILES_NAMING_TABLE_SCHEMA[dbType];
   const defaultName = HAZO_FILES_NAMING_TABLE_SCHEMA.tableName;
   return {
@@ -5379,6 +5391,7 @@ var HAZO_FILES_MIGRATION_V3 = {
   ]
 };
 function getMigrationV3ForTable(tableName, dbType) {
+  validateTableName(tableName);
   const migration = HAZO_FILES_MIGRATION_V3[dbType];
   const defaultName = HAZO_FILES_MIGRATION_V3.tableName;
   return {
@@ -5428,6 +5441,9 @@ async function migrateToV3(executor, dbType, tableName) {
 try {
   __require("server-only");
 } catch {
+  console.warn(
+    '[hazo_files/server] "server-only" package not installed. Install it to prevent this module from being bundled in client code.'
+  );
 }
 export {
   ALL_SYSTEM_VARIABLES,

package/migrations/001_initial_schema.sql

@@ -0,0 +1,49 @@
+-- hazo_files initial database schema (V1)
+-- Supports both PostgreSQL and SQLite
+--
+-- This creates the main file metadata tracking table.
+-- Use hazo_files HAZO_FILES_TABLE_SCHEMA export for programmatic access.
+
+-- ============================================
+-- SQLite version
+-- ============================================
+-- CREATE TABLE IF NOT EXISTS hazo_files (
+--   id TEXT PRIMARY KEY,
+--   filename TEXT NOT NULL,
+--   file_type TEXT NOT NULL,
+--   file_data TEXT DEFAULT '{}',
+--   created_at TEXT NOT NULL,
+--   changed_at TEXT NOT NULL,
+--   file_path TEXT NOT NULL,
+--   storage_type TEXT NOT NULL,
+--   file_hash TEXT,
+--   file_size INTEGER,
+--   file_changed_at TEXT
+-- );
+--
+-- CREATE INDEX IF NOT EXISTS idx_hazo_files_path ON hazo_files (file_path);
+-- CREATE INDEX IF NOT EXISTS idx_hazo_files_storage ON hazo_files (storage_type);
+-- CREATE UNIQUE INDEX IF NOT EXISTS idx_hazo_files_path_storage ON hazo_files (file_path, storage_type);
+-- CREATE INDEX IF NOT EXISTS idx_hazo_files_hash ON hazo_files (file_hash);
+
+-- ============================================
+-- PostgreSQL version (active)
+-- ============================================
+CREATE TABLE IF NOT EXISTS hazo_files (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  filename TEXT NOT NULL,
+  file_type TEXT NOT NULL,
+  file_data TEXT DEFAULT '{}',
+  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
+  changed_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
+  file_path TEXT NOT NULL,
+  storage_type TEXT NOT NULL,
+  file_hash TEXT,
+  file_size BIGINT,
+  file_changed_at TIMESTAMP WITH TIME ZONE
+);
+
+CREATE INDEX IF NOT EXISTS idx_hazo_files_path ON hazo_files (file_path);
+CREATE INDEX IF NOT EXISTS idx_hazo_files_storage ON hazo_files (storage_type);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_hazo_files_path_storage ON hazo_files (file_path, storage_type);
+CREATE INDEX IF NOT EXISTS idx_hazo_files_hash ON hazo_files (file_hash);

package/migrations/002_reference_tracking.sql

@@ -0,0 +1,51 @@
+-- hazo_files V2 migration - Reference Tracking
+-- Adds columns for file references, soft-delete, scoping, and provenance.
+-- Idempotent - safe to run multiple times.
+
+-- ============================================
+-- SQLite version
+-- ============================================
+-- ALTER TABLE hazo_files ADD COLUMN file_refs TEXT DEFAULT '[]';
+-- ALTER TABLE hazo_files ADD COLUMN ref_count INTEGER DEFAULT 0;
+-- ALTER TABLE hazo_files ADD COLUMN status TEXT DEFAULT 'active';
+-- ALTER TABLE hazo_files ADD COLUMN scope_id TEXT;
+-- ALTER TABLE hazo_files ADD COLUMN uploaded_by TEXT;
+-- ALTER TABLE hazo_files ADD COLUMN storage_verified_at TEXT;
+-- ALTER TABLE hazo_files ADD COLUMN deleted_at TEXT;
+-- ALTER TABLE hazo_files ADD COLUMN original_filename TEXT;
+--
+-- CREATE INDEX IF NOT EXISTS idx_hazo_files_status ON hazo_files (status);
+-- CREATE INDEX IF NOT EXISTS idx_hazo_files_scope ON hazo_files (scope_id);
+-- CREATE INDEX IF NOT EXISTS idx_hazo_files_ref_count ON hazo_files (ref_count);
+-- CREATE INDEX IF NOT EXISTS idx_hazo_files_deleted ON hazo_files (deleted_at);
+--
+-- Backfill:
+-- UPDATE hazo_files SET
+--   file_refs = COALESCE(file_refs, '[]'),
+--   ref_count = COALESCE(ref_count, 0),
+--   status = COALESCE(status, 'active')
+-- WHERE file_refs IS NULL OR ref_count IS NULL OR status IS NULL;
+
+-- ============================================
+-- PostgreSQL version (active)
+-- ============================================
+ALTER TABLE hazo_files ADD COLUMN IF NOT EXISTS file_refs TEXT DEFAULT '[]';
+ALTER TABLE hazo_files ADD COLUMN IF NOT EXISTS ref_count INTEGER DEFAULT 0;
+ALTER TABLE hazo_files ADD COLUMN IF NOT EXISTS status TEXT DEFAULT 'active';
+ALTER TABLE hazo_files ADD COLUMN IF NOT EXISTS scope_id UUID;
+ALTER TABLE hazo_files ADD COLUMN IF NOT EXISTS uploaded_by UUID;
+ALTER TABLE hazo_files ADD COLUMN IF NOT EXISTS storage_verified_at TIMESTAMP WITH TIME ZONE;
+ALTER TABLE hazo_files ADD COLUMN IF NOT EXISTS deleted_at TIMESTAMP WITH TIME ZONE;
+ALTER TABLE hazo_files ADD COLUMN IF NOT EXISTS original_filename TEXT;
+
+CREATE INDEX IF NOT EXISTS idx_hazo_files_status ON hazo_files (status);
+CREATE INDEX IF NOT EXISTS idx_hazo_files_scope ON hazo_files (scope_id);
+CREATE INDEX IF NOT EXISTS idx_hazo_files_ref_count ON hazo_files (ref_count);
+CREATE INDEX IF NOT EXISTS idx_hazo_files_deleted ON hazo_files (deleted_at);
+
+-- Backfill defaults for existing records
+UPDATE hazo_files SET
+  file_refs = COALESCE(file_refs, '[]'),
+  ref_count = COALESCE(ref_count, 0),
+  status = COALESCE(status, 'active')
+WHERE file_refs IS NULL OR ref_count IS NULL OR status IS NULL;

package/migrations/003_content_tags.sql

@@ -0,0 +1,15 @@
+-- hazo_files V3 migration - Content Tagging
+-- Adds content_tag column for LLM-based document classification.
+-- Idempotent - safe to run multiple times.
+
+-- ============================================
+-- SQLite version
+-- ============================================
+-- ALTER TABLE hazo_files ADD COLUMN content_tag TEXT;
+-- CREATE INDEX IF NOT EXISTS idx_hazo_files_content_tag ON hazo_files (content_tag);
+
+-- ============================================
+-- PostgreSQL version (active)
+-- ============================================
+ALTER TABLE hazo_files ADD COLUMN IF NOT EXISTS content_tag TEXT;
+CREATE INDEX IF NOT EXISTS idx_hazo_files_content_tag ON hazo_files (content_tag);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hazo_files",
-  "version": "1.4.4",
+  "version": "1.4.5",
   "description": "File management including integration to cloud files",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -25,7 +25,8 @@
   "files": [
     "dist",
     "docs",
-    "hazo_files_config.ini",
+    "config",
+    "migrations",
     "README.md",
     ".env.example"
   ],
@@ -65,10 +66,7 @@
   },
   "homepage": "https://github.com/pub12/hazo_files#readme",
   "dependencies": {
-    "dropbox": "^10.34.0",
-    "googleapis": "^140.0.1",
-    "ini": "^4.1.3",
-    "xxhash-wasm": "^1.1.0"
+    "ini": "^4.1.3"
   },
   "devDependencies": {
     "@dnd-kit/core": "^6.3.1",
@@ -78,23 +76,29 @@
     "@types/node": "^20.10.0",
     "@types/react": "^18.2.45",
     "@types/react-dom": "^18.2.18",
+    "dropbox": "^10.34.0",
+    "googleapis": "^140.0.1",
     "hazo_llm_api": "^1.2.7",
     "react": "^18.2.0",
     "react-dom": "^18.2.0",
     "tsup": "^8.0.1",
     "typescript": "^5.3.3",
-    "vitest": "^4.0.15"
+    "vitest": "^4.0.15",
+    "xxhash-wasm": "^1.1.0"
   },
   "peerDependencies": {
     "@dnd-kit/core": "^6.0.0",
     "@dnd-kit/sortable": ">=8.0.0",
     "@dnd-kit/utilities": "^3.0.0",
+    "dropbox": "^10.0.0",
+    "googleapis": "^140.0.0",
     "hazo_connect": ">=2.0.0",
     "hazo_llm_api": ">=1.0.0",
     "hazo_logs": ">=1.0.0",
     "react": "^18.0.0",
     "react-dom": "^18.0.0",
-    "server-only": ">=0.0.1"
+    "server-only": ">=0.0.1",
+    "xxhash-wasm": "^1.0.0"
   },
   "peerDependenciesMeta": {
     "@dnd-kit/core": {
@@ -106,6 +110,12 @@
     "@dnd-kit/utilities": {
       "optional": true
     },
+    "dropbox": {
+      "optional": true
+    },
+    "googleapis": {
+      "optional": true
+    },
     "hazo_connect": {
       "optional": true
     },
@@ -117,6 +127,9 @@
     },
     "server-only": {
       "optional": true
+    },
+    "xxhash-wasm": {
+      "optional": true
     }
   }
 }