trellis 3.1.35 → 3.2.0

package/dist/chunk-ZHVI7BQN.js

@@ -0,0 +1,1077 @@
+import {
+  rel
+} from "./chunk-44FFQKQX.js";
+import {
+  entityRecordToPlain,
+  hydrateBindings,
+  resolveRelations
+} from "./chunk-BRGYDO7D.js";
+import {
+  parseSimple
+} from "./chunk-X5FLTRUB.js";
+
+// src/server/server.ts
+import { existsSync, readFileSync } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+
+// src/server/auth.ts
+var ANONYMOUS = {
+  userId: null,
+  tenantId: null,
+  roles: [],
+  claims: {},
+  authenticated: false
+};
+function base64UrlEncode(input) {
+  return btoa(String.fromCharCode(...input)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64UrlDecode(input) {
+  const padded = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padLen = (4 - padded.length % 4) % 4;
+  const base64 = padded + "=".repeat(padLen);
+  const binary = atob(base64);
+  return Uint8Array.from(binary, (c) => c.charCodeAt(0));
+}
+async function hmacKey(secret) {
+  return crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign", "verify"]
+  );
+}
+async function signJwt(payload, secret, expiresInSeconds = 86400) {
+  const header = { alg: "HS256", typ: "JWT" };
+  const now = Math.floor(Date.now() / 1e3);
+  const claims = { iat: now, exp: now + expiresInSeconds, ...payload };
+  const enc = new TextEncoder();
+  const headerB64 = base64UrlEncode(enc.encode(JSON.stringify(header)));
+  const payloadB64 = base64UrlEncode(enc.encode(JSON.stringify(claims)));
+  const signing = `${headerB64}.${payloadB64}`;
+  const key = await hmacKey(secret);
+  const sig = await crypto.subtle.sign("HMAC", key, enc.encode(signing));
+  const sigB64 = base64UrlEncode(new Uint8Array(sig));
+  return `${signing}.${sigB64}`;
+}
+async function verifyJwt(token, secret) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  const [headerB64, payloadB64, sigB64] = parts;
+  const enc = new TextEncoder();
+  const signing = `${headerB64}.${payloadB64}`;
+  try {
+    const key = await hmacKey(secret);
+    const sigRaw = base64UrlDecode(sigB64);
+    const sigBuf = sigRaw.buffer.slice(
+      sigRaw.byteOffset,
+      sigRaw.byteOffset + sigRaw.byteLength
+    );
+    const valid = await crypto.subtle.verify(
+      "HMAC",
+      key,
+      sigBuf,
+      enc.encode(signing)
+    );
+    if (!valid) return null;
+    const claims = JSON.parse(
+      new TextDecoder().decode(base64UrlDecode(payloadB64))
+    );
+    const now = Math.floor(Date.now() / 1e3);
+    if (typeof claims.exp === "number" && claims.exp < now) return null;
+    return claims;
+  } catch {
+    return null;
+  }
+}
+async function resolveAuth(authHeader, config) {
+  if (!authHeader) {
+    return config.allowPublic === false ? { ...ANONYMOUS, authenticated: false } : ANONYMOUS;
+  }
+  const token = authHeader.startsWith("Bearer ") ? authHeader.slice(7) : authHeader;
+  if (config.apiKey && token === config.apiKey) {
+    return {
+      userId: "service",
+      tenantId: null,
+      roles: ["admin"],
+      claims: { sub: "service" },
+      authenticated: true
+    };
+  }
+  if (config.jwtSecret) {
+    const claims = await verifyJwt(token, config.jwtSecret);
+    if (claims) {
+      return {
+        userId: claims.sub ?? null,
+        tenantId: claims.tenantId ?? null,
+        roles: Array.isArray(claims.roles) ? claims.roles : typeof claims.role === "string" ? [claims.role] : [],
+        claims,
+        authenticated: true
+      };
+    }
+  }
+  return ANONYMOUS;
+}
+var GOOGLE_PROVIDER = {
+  name: "google",
+  authUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+  tokenUrl: "https://oauth2.googleapis.com/token",
+  userInfoUrl: "https://www.googleapis.com/oauth2/v3/userinfo",
+  scopes: ["openid", "email", "profile"]
+};
+var GITHUB_PROVIDER = {
+  name: "github",
+  authUrl: "https://github.com/login/oauth/authorize",
+  tokenUrl: "https://github.com/login/oauth/access_token",
+  userInfoUrl: "https://api.github.com/user",
+  scopes: ["read:user", "user:email"]
+};
+function buildOAuthUrl(provider, redirectUri, state) {
+  const params = new URLSearchParams({
+    client_id: provider.clientId,
+    redirect_uri: redirectUri,
+    response_type: "code",
+    scope: provider.scopes.join(" "),
+    state
+  });
+  return `${provider.authUrl}?${params}`;
+}
+async function exchangeOAuthCode(provider, code, redirectUri) {
+  const tokenRes = await fetch(provider.tokenUrl, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json"
+    },
+    body: new URLSearchParams({
+      client_id: provider.clientId,
+      client_secret: provider.clientSecret,
+      code,
+      redirect_uri: redirectUri,
+      grant_type: "authorization_code"
+    })
+  });
+  if (!tokenRes.ok) {
+    throw new Error(`OAuth token exchange failed: ${tokenRes.status}`);
+  }
+  const tokenData = await tokenRes.json();
+  const accessToken = tokenData.access_token;
+  const userRes = await fetch(provider.userInfoUrl, {
+    headers: {
+      Authorization: `Bearer ${accessToken}`,
+      Accept: "application/json"
+    }
+  });
+  if (!userRes.ok) {
+    throw new Error(`OAuth user info fetch failed: ${userRes.status}`);
+  }
+  const user = await userRes.json();
+  return {
+    id: String(user.id ?? user.sub ?? ""),
+    email: String(user.email ?? ""),
+    name: String(user.name ?? user.login ?? ""),
+    avatarUrl: user.picture ?? user.avatar_url ?? void 0
+  };
+}
+
+// src/server/permissions.ts
+var PermissionRegistry = class {
+  rules = /* @__PURE__ */ new Map();
+  defaultRule = "authenticated";
+  /**
+   * Register permissions for an entity type.
+   */
+  register(entityType, permissions) {
+    this.rules.set(entityType, permissions);
+  }
+  /**
+   * Set the fallback rule used when an entity type has no declared permissions.
+   */
+  setDefault(rule) {
+    this.defaultRule = rule;
+  }
+  /**
+   * Get the permission rule for a specific operation on an entity type.
+   * Falls back to the default rule if not declared.
+   */
+  getRule(entityType, op) {
+    const def = this.rules.get(entityType);
+    return def?.[op] ?? this.defaultRule;
+  }
+  /**
+   * Check whether an auth context is allowed to perform an operation.
+   */
+  check(auth, entityType, op, entity = null) {
+    const rule = this.getRule(entityType, op);
+    return evaluateRule(rule, auth, entity);
+  }
+  /**
+   * Assert access — throws a PermissionError if denied.
+   */
+  assert(auth, entityType, op, entity = null) {
+    if (!this.check(auth, entityType, op, entity)) {
+      throw new PermissionError(auth, entityType, op);
+    }
+  }
+};
+function evaluateRule(rule, auth, entity) {
+  if (rule === "public") {
+    return true;
+  }
+  if (rule === "authenticated") {
+    return auth.authenticated;
+  }
+  if (rule === "own") {
+    if (!auth.authenticated || !auth.userId) return false;
+    const ownerFact = entity?.facts.find(
+      (f) => f.a === "ownerId" || f.a === "createdBy"
+    );
+    return ownerFact?.v === auth.userId;
+  }
+  if (typeof rule === "object") {
+    if ("role" in rule) {
+      return auth.roles.includes(rule.role);
+    }
+    if ("roles" in rule) {
+      return rule.roles.some((r) => auth.roles.includes(r));
+    }
+    if ("fn" in rule) {
+      try {
+        return rule.fn(auth, entity);
+      } catch {
+        return false;
+      }
+    }
+  }
+  return false;
+}
+var PermissionError = class extends Error {
+  constructor(auth, entityType, op) {
+    const who = auth.authenticated ? `user:${auth.userId}` : "anonymous";
+    super(`Permission denied: ${who} cannot ${op} ${entityType}`);
+    this.auth = auth;
+    this.entityType = entityType;
+    this.op = op;
+    this.name = "PermissionError";
+  }
+  toResponse() {
+    return {
+      error: "Forbidden",
+      message: this.message,
+      code: 403
+    };
+  }
+};
+var PUBLIC_READ = {
+  read: "public",
+  create: "authenticated",
+  update: "authenticated",
+  delete: "authenticated"
+};
+var FULLY_PUBLIC = {
+  read: "public",
+  create: "public",
+  update: "public",
+  delete: "public"
+};
+var OWNER_ONLY = {
+  read: "own",
+  create: "authenticated",
+  update: "own",
+  delete: "own"
+};
+var ADMIN_ONLY = {
+  read: { role: "admin" },
+  create: { role: "admin" },
+  update: { role: "admin" },
+  delete: { role: "admin" }
+};
+
+// src/schema/kernel-resolve.ts
+import { z } from "zod";
+function ontologyTypeName(id) {
+  return id.includes(":") ? id.split(":").pop() : id;
+}
+function findOntologyByTypeName(kernel, typeName) {
+  return kernel.listOntologies().find((s) => {
+    const short = ontologyTypeName(s["@id"]);
+    return short === typeName || short.toLowerCase() === typeName.toLowerCase() || s.label === typeName;
+  });
+}
+function schemaHandleFromOntology(def, typeName) {
+  const name = typeName ?? ontologyTypeName(def["@id"]);
+  const relations = {};
+  for (const field of def.fields) {
+    if (field.valueType === "relation" && field.relation?.targetSchema) {
+      const target = ontologyTypeName(field.relation.targetSchema);
+      relations[field.name] = rel(
+        target,
+        field.relation.cardinality ?? "one"
+      );
+    }
+  }
+  return {
+    type: name,
+    zod: z.object({}),
+    relations,
+    computed: {},
+    definition: def,
+    toOntologySchema: () => {
+      throw new Error("schemaHandleFromOntology: legacy adapter not available");
+    }
+  };
+}
+function createSchemaLookup(kernel) {
+  const cache = /* @__PURE__ */ new Map();
+  return (typeName) => {
+    if (cache.has(typeName)) return cache.get(typeName);
+    const def = findOntologyByTypeName(kernel, typeName);
+    if (!def) return null;
+    const handle = schemaHandleFromOntology(def, typeName);
+    cache.set(typeName, handle);
+    return handle;
+  };
+}
+function createKernelResolveClient(kernel) {
+  return {
+    read: async (id) => {
+      const entity = kernel.getEntity(id);
+      return entity ? entityRecordToPlain(entity) : null;
+    },
+    query: async (q) => {
+      const parsed = parseSimple(q);
+      const qr = await kernel.query(parsed);
+      return {
+        bindings: hydrateBindings(
+          kernel,
+          qr.bindings
+        ),
+        executionTime: qr.executionTime
+      };
+    }
+  };
+}
+async function hydrateAndResolve(kernel, bindings, entityType, resolve) {
+  let entities = hydrateBindings(kernel, bindings);
+  if (!entityType || !resolve || Object.keys(resolve).length === 0) {
+    return entities;
+  }
+  const def = findOntologyByTypeName(kernel, entityType);
+  if (!def) return entities;
+  const schema = schemaHandleFromOntology(def, entityType);
+  const client = createKernelResolveClient(kernel);
+  const lookup = createSchemaLookup(kernel);
+  return resolveRelations(client, schema, entities, resolve, {
+    schemaLookup: lookup
+  });
+}
+
+// src/server/realtime.ts
+var SubscriptionManager = class {
+  clients = /* @__PURE__ */ new Map();
+  pool;
+  permissions;
+  constructor(pool, permissions = null) {
+    this.pool = pool;
+    this.permissions = permissions;
+  }
+  // -------------------------------------------------------------------------
+  // Client lifecycle
+  // -------------------------------------------------------------------------
+  addClient(clientId, ws, auth, tenantId) {
+    this.clients.set(clientId, {
+      id: clientId,
+      ws,
+      subscriptions: /* @__PURE__ */ new Map(),
+      auth,
+      tenantId
+    });
+  }
+  removeClient(clientId) {
+    this.clients.delete(clientId);
+  }
+  // -------------------------------------------------------------------------
+  // Message handling
+  // -------------------------------------------------------------------------
+  async handleMessage(clientId, raw) {
+    const client = this.clients.get(clientId);
+    if (!client) return;
+    let msg;
+    try {
+      msg = JSON.parse(raw);
+    } catch {
+      this._send(client, { type: "error", id: "", message: "Invalid JSON" });
+      return;
+    }
+    if (msg.type === "ping") {
+      this._send(client, { type: "pong" });
+      return;
+    }
+    if (msg.type === "subscribe") {
+      await this._handleSubscribe(client, msg.id, msg.query, {
+        tenantId: msg.tenantId,
+        entityType: msg.entityType,
+        resolve: msg.resolve
+      });
+      return;
+    }
+    if (msg.type === "unsubscribe") {
+      client.subscriptions.delete(msg.id);
+      return;
+    }
+  }
+  // -------------------------------------------------------------------------
+  // Notify — called after every mutation
+  // -------------------------------------------------------------------------
+  /**
+   * Re-evaluate all subscriptions for a given tenant and push diffs.
+   * Called after every write op lands.
+   */
+  async notify(tenantId) {
+    const tid = tenantId ?? null;
+    const dead = [];
+    for (const [clientId, client] of this.clients) {
+      if (client.ws.readyState !== 1) {
+        dead.push(clientId);
+        continue;
+      }
+      if (client.tenantId !== tid) continue;
+      for (const [subId, sub] of client.subscriptions) {
+        if (sub.tenantId !== tid) continue;
+        await this._pushUpdate(client, sub);
+      }
+    }
+    for (const id of dead) this.clients.delete(id);
+  }
+  get clientCount() {
+    return this.clients.size;
+  }
+  // -------------------------------------------------------------------------
+  // Private
+  // -------------------------------------------------------------------------
+  async _handleSubscribe(client, subId, queryStr, opts = {}) {
+    const tid = opts.tenantId ?? client.tenantId ?? null;
+    let parsedQuery;
+    try {
+      parsedQuery = parseSimple(queryStr);
+    } catch (err) {
+      this._send(client, {
+        type: "error",
+        id: subId,
+        message: `Invalid query: ${err instanceof Error ? err.message : String(err)}`
+      });
+      return;
+    }
+    const kernel = this.pool.get(tid);
+    let result;
+    try {
+      const qr = await kernel.query(parsedQuery);
+      result = await hydrateAndResolve(
+        kernel,
+        qr.bindings,
+        opts.entityType,
+        opts.resolve
+      );
+    } catch (err) {
+      this._send(client, {
+        type: "error",
+        id: subId,
+        message: `Query failed: ${err instanceof Error ? err.message : String(err)}`
+      });
+      return;
+    }
+    const resolved = Boolean(opts.entityType) && Boolean(opts.resolve && Object.keys(opts.resolve).length > 0);
+    const sub = {
+      id: subId,
+      query: queryStr,
+      tenantId: tid,
+      auth: client.auth,
+      lastResult: result,
+      entityType: opts.entityType,
+      resolve: opts.resolve
+    };
+    client.subscriptions.set(subId, sub);
+    this._send(client, { type: "subscribed", id: subId });
+    this._send(client, {
+      type: "data",
+      id: subId,
+      result,
+      diff: { added: result, updated: [], removed: [] },
+      ...resolved ? { resolved: true } : {}
+    });
+  }
+  async _pushUpdate(client, sub) {
+    const kernel = this.pool.get(sub.tenantId);
+    let newResult;
+    try {
+      const parsed = parseSimple(sub.query);
+      const qr = await kernel.query(parsed);
+      newResult = await hydrateAndResolve(
+        kernel,
+        qr.bindings,
+        sub.entityType,
+        sub.resolve
+      );
+    } catch {
+      return;
+    }
+    const diff = computeDiff(sub.lastResult, newResult);
+    if (diff.added.length === 0 && diff.updated.length === 0 && diff.removed.length === 0) {
+      return;
+    }
+    sub.lastResult = newResult;
+    const resolved = Boolean(sub.entityType) && Boolean(sub.resolve && Object.keys(sub.resolve).length > 0);
+    this._send(client, {
+      type: "data",
+      id: sub.id,
+      result: newResult,
+      diff,
+      ...resolved ? { resolved: true } : {}
+    });
+  }
+  _send(client, payload) {
+    try {
+      client.ws.send(JSON.stringify(payload));
+    } catch {
+    }
+  }
+};
+function entityId(row) {
+  return String(row["?e"] ?? row.id ?? row.e ?? JSON.stringify(row));
+}
+function computeDiff(prev, next) {
+  const prevMap = new Map(prev.map((r) => [entityId(r), r]));
+  const nextMap = new Map(next.map((r) => [entityId(r), r]));
+  const added = [];
+  const updated = [];
+  const removed = [];
+  for (const [id, row] of nextMap) {
+    if (!prevMap.has(id)) {
+      added.push(row);
+    } else if (JSON.stringify(prevMap.get(id)) !== JSON.stringify(row)) {
+      updated.push(row);
+    }
+  }
+  for (const [id, row] of prevMap) {
+    if (!nextMap.has(id)) removed.push(row);
+  }
+  return { added, updated, removed };
+}
+
+// src/server/server.ts
+var __moduleDir = import.meta.dir ?? dirname(fileURLToPath(import.meta.url));
+async function startServer(opts) {
+  return startServerNode(opts);
+}
+var startServerCrossRuntime = startServer;
+function buildServerContext(opts) {
+  const { pool, permissions, config } = opts;
+  const port = opts.port ?? config.port ?? 3e3;
+  const authConfig = {
+    jwtSecret: config.jwtSecret,
+    apiKey: config.apiKey,
+    allowPublic: true
+  };
+  const subs = new SubscriptionManager(pool, permissions ?? null);
+  const handleHttp = async (req) => {
+    const url = new URL(req.url);
+    const path = url.pathname;
+    const auth = await resolveAuth(
+      req.headers.get("authorization"),
+      authConfig
+    );
+    const tenantId = auth.tenantId ?? url.searchParams.get("tenantId") ?? null;
+    try {
+      return await route(req, url, path, auth, tenantId, {
+        pool,
+        permissions: permissions ?? null,
+        subs,
+        authConfig,
+        config,
+        oauthProviders: opts.oauthProviders ?? {}
+      });
+    } catch (err) {
+      if (err instanceof PermissionError) {
+        return json(err.toResponse(), 403);
+      }
+      const msg = err instanceof Error ? err.message : String(err);
+      return json({ error: "Internal Server Error", message: msg }, 500);
+    }
+  };
+  return { port, authConfig, subs, handleHttp };
+}
+async function startServerNode(opts) {
+  const { port, subs, handleHttp } = buildServerContext(opts);
+  const { startNodeServer } = await import("./server/node-adapter.js");
+  return startNodeServer({
+    port,
+    fetch: handleHttp,
+    websocket: {
+      open(ws) {
+        const id = crypto.randomUUID();
+        ws.__clientId = id;
+        subs.addClient(
+          id,
+          ws,
+          {
+            userId: null,
+            tenantId: null,
+            roles: [],
+            claims: {},
+            authenticated: false
+          },
+          null
+        );
+      },
+      async message(ws, raw) {
+        const id = ws.__clientId;
+        await subs.handleMessage(
+          id,
+          typeof raw === "string" ? raw : raw.toString()
+        );
+      },
+      close(ws) {
+        const id = ws.__clientId;
+        subs.removeClient(id);
+      }
+    }
+  });
+}
+async function route(req, url, path, auth, tenantId, ctx) {
+  const method = req.method.toUpperCase();
+  if (method === "GET" && path === "/__trellis/inspector.js") {
+    const candidates = [
+      join(__moduleDir, "db", "inspector.js"),
+      // chunk lives in dist/, inspector in dist/db/
+      join(__moduleDir, "inspector.js")
+      // chunk lives in dist/db/, inspector alongside
+    ];
+    for (const p of candidates) {
+      if (existsSync(p)) {
+        return new Response(readFileSync(p, "utf-8"), {
+          headers: { "Content-Type": "application/javascript; charset=utf-8" }
+        });
+      }
+    }
+    return new Response(
+      "/* Trellis DB Inspector: run `bun run build:inspector` first */",
+      {
+        headers: { "Content-Type": "application/javascript" }
+      }
+    );
+  }
+  if (method === "GET" && path === "/__trellis/trellis.css") {
+    const candidates = [
+      join(__moduleDir, "db", "trellis.css"),
+      join(__moduleDir, "trellis.css")
+    ];
+    for (const p of candidates) {
+      if (existsSync(p)) {
+        return new Response(readFileSync(p, "utf-8"), {
+          headers: { "Content-Type": "text/css; charset=utf-8" }
+        });
+      }
+    }
+    return new Response("/* Trellis CSS not found */", {
+      headers: { "Content-Type": "text/css" }
+    });
+  }
+  if (method === "GET" && (path === "/" || path === "/inspector")) {
+    const html = `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Trellis DB Inspector</title>
+  <link rel="stylesheet" href="/__trellis/trellis.css">
+</head>
+<body>
+  <script src="/__trellis/inspector.js"></script>
+</body>
+</html>`;
+    return new Response(html, {
+      headers: { "Content-Type": "text/html; charset=utf-8" }
+    });
+  }
+  if (method === "GET" && path === "/health") {
+    const kernel = ctx.pool.get(tenantId);
+    const ops = kernel.readAllOps().length;
+    return json({
+      status: "ok",
+      ops,
+      tenants: ctx.pool.activeTenants().length
+    });
+  }
+  if (path === "/entities" || path === "/entities/") {
+    if (method === "POST") return handleCreate(req, auth, tenantId, ctx);
+    if (method === "GET") return handleList(url, auth, tenantId, ctx);
+  }
+  const entityMatch = path.match(/^\/entities\/([^/]+)$/);
+  if (entityMatch) {
+    const id = decodeURIComponent(entityMatch[1]);
+    if (method === "GET") return handleRead(id, auth, tenantId, ctx);
+    if (method === "PUT" || method === "PATCH")
+      return handleUpdate(req, id, auth, tenantId, ctx);
+    if (method === "DELETE") return handleDelete(id, auth, tenantId, ctx);
+  }
+  if (method === "POST" && path === "/query") {
+    return handleQuery(req, auth, tenantId, ctx);
+  }
+  if (method === "POST" && (path === "/ontologies" || path === "/ontologies/")) {
+    return handleCreateOntology(req, auth, tenantId, ctx);
+  }
+  if (method === "POST" && path === "/upload") {
+    return handleUpload(req, auth, tenantId, ctx);
+  }
+  const fileMatch = path.match(/^\/files\/([^/]+)$/);
+  if (method === "GET" && fileMatch) {
+    return handleFileDownload(fileMatch[1], ctx, tenantId);
+  }
+  if (method === "POST" && path === "/auth/register") {
+    return handleRegister(req, tenantId, ctx);
+  }
+  if (method === "POST" && path === "/auth/login") {
+    return handleLogin(req, tenantId, ctx);
+  }
+  const oauthMatch = path.match(/^\/auth\/oauth\/([^/]+)(\/callback)?$/);
+  if (oauthMatch) {
+    const providerName = oauthMatch[1];
+    const isCallback = !!oauthMatch[2];
+    if (isCallback)
+      return handleOAuthCallback(url, providerName, tenantId, ctx);
+    return handleOAuthRedirect(providerName, url, ctx);
+  }
+  return json({ error: "Not Found" }, 404);
+}
+async function handleCreate(req, auth, tenantId, ctx) {
+  const body = await req.json();
+  if (!body.type) return json({ error: "type is required" }, 400);
+  ctx.permissions?.assert(auth, body.type, "create");
+  const kernel = ctx.pool.get(tenantId);
+  const entityId2 = `${body.type.toLowerCase()}:${crypto.randomUUID()}`;
+  const attrs = {
+    ...body.attributes
+  };
+  if (auth.userId) attrs.createdBy = auth.userId;
+  if (auth.tenantId) attrs.tenantId = auth.tenantId;
+  const result = await kernel.createEntity(
+    entityId2,
+    body.type,
+    attrs,
+    body.links
+  );
+  await ctx.subs.notify(tenantId);
+  return json({ id: entityId2, op: result.op.hash }, 201);
+}
+async function handleRead(id, auth, tenantId, ctx) {
+  const kernel = ctx.pool.get(tenantId);
+  const entity = kernel.getEntity(id);
+  if (!entity) return json({ error: "Not Found" }, 404);
+  ctx.permissions?.assert(auth, entity.type, "read", entity);
+  return json(entityToJson(entity));
+}
+async function handleUpdate(req, id, auth, tenantId, ctx) {
+  const kernel = ctx.pool.get(tenantId);
+  const entity = kernel.getEntity(id);
+  if (!entity) return json({ error: "Not Found" }, 404);
+  ctx.permissions?.assert(auth, entity.type, "update", entity);
+  const updates = await req.json();
+  await kernel.updateEntity(id, updates);
+  await ctx.subs.notify(tenantId);
+  return json({ id, updated: true });
+}
+async function handleDelete(id, auth, tenantId, ctx) {
+  const kernel = ctx.pool.get(tenantId);
+  const entity = kernel.getEntity(id);
+  if (!entity) return json({ error: "Not Found" }, 404);
+  ctx.permissions?.assert(auth, entity.type, "delete", entity);
+  await kernel.deleteEntity(id);
+  await ctx.subs.notify(tenantId);
+  return json({ id, deleted: true });
+}
+async function handleList(url, auth, tenantId, ctx) {
+  const type = url.searchParams.get("type") ?? void 0;
+  const limit = parseInt(url.searchParams.get("limit") ?? "100");
+  const offset = parseInt(url.searchParams.get("offset") ?? "0");
+  const kernel = ctx.pool.get(tenantId);
+  let entities = kernel.listEntities(type);
+  if (ctx.permissions && type) {
+    entities = entities.filter(
+      (e) => ctx.permissions.check(auth, e.type, "read", e)
+    );
+  }
+  const page = entities.slice(offset, offset + limit);
+  return json({
+    data: page.map(entityToJson),
+    total: entities.length,
+    limit,
+    offset
+  });
+}
+async function handleQuery(req, auth, tenantId, ctx) {
+  const body = await req.json();
+  if (!body.query) return json({ error: "query is required" }, 400);
+  let parsed;
+  try {
+    parsed = parseSimple(body.query);
+  } catch (err) {
+    return json({ error: "Invalid query", message: String(err) }, 400);
+  }
+  const kernel = ctx.pool.get(tenantId);
+  const result = await kernel.query(parsed);
+  const bindings = hydrateBindings(
+    kernel,
+    result.bindings
+  );
+  return json({
+    bindings,
+    executionTime: result.executionTime
+  });
+}
+async function handleCreateOntology(req, auth, tenantId, ctx) {
+  const schema = await req.json();
+  if (!schema || !schema["@id"] || !Array.isArray(schema.fields)) {
+    return json({ error: "A SchemaDefinition (with @id and fields) is required" }, 400);
+  }
+  if ((schema.tier ?? "user") === "core") {
+    return json({ error: "Core ontologies are immutable" }, 403);
+  }
+  const kernel = ctx.pool.get(tenantId);
+  const exists = kernel.listOntologies().some((ont) => ont["@id"] === schema["@id"]);
+  if (exists) {
+    return json({ id: schema["@id"], registered: false, existed: true }, 200);
+  }
+  try {
+    kernel.createOntology(schema);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("already exists")) {
+      return json({ id: schema["@id"], registered: false, existed: true }, 200);
+    }
+    return json({ error: "Could not register schema", message: msg }, 409);
+  }
+  return json({ id: schema["@id"], registered: true }, 201);
+}
+async function handleUpload(req, auth, tenantId, ctx) {
+  if (!auth.authenticated && ctx.config.apiKey) {
+    return json({ error: "Unauthorized" }, 401);
+  }
+  const contentType = req.headers.get("content-type") ?? "application/octet-stream";
+  const buffer = new Uint8Array(await req.arrayBuffer());
+  const hashBuf = await crypto.subtle.digest("SHA-256", buffer);
+  const hash = `blob:${Array.from(new Uint8Array(hashBuf)).map((b) => b.toString(16).padStart(2, "0")).join("")}`;
+  const kernel = ctx.pool.get(tenantId);
+  const backend = kernel.getBackend();
+  if (!backend.hasBlob(hash)) {
+    backend.putBlob(hash, buffer);
+  }
+  return json({ hash, size: buffer.length, contentType }, 201);
+}
+async function handleFileDownload(hash, ctx, tenantId) {
+  const kernel = ctx.pool.get(tenantId);
+  const backend = kernel.getBackend();
+  const blob = backend.getBlob(hash);
+  if (!blob) return json({ error: "Not Found" }, 404);
+  const cleanBuf = blob.buffer.slice(
+    blob.byteOffset,
+    blob.byteOffset + blob.byteLength
+  );
+  return new Response(cleanBuf, {
+    headers: { "Content-Type": "application/octet-stream" }
+  });
+}
+async function handleRegister(req, tenantId, ctx) {
+  if (!ctx.config.jwtSecret) {
+    return json({ error: "Auth not configured (no jwtSecret)" }, 501);
+  }
+  const body = await req.json();
+  if (!body.email || !body.password) {
+    return json({ error: "email and password are required" }, 400);
+  }
+  const kernel = ctx.pool.get(tenantId);
+  const existing = kernel.listEntities("User", { email: body.email });
+  if (existing.length > 0) {
+    return json({ error: "Email already registered" }, 409);
+  }
+  const userId = `user:${crypto.randomUUID()}`;
+  const pwHash = await hashPassword(body.password);
+  await kernel.createEntity(userId, "User", {
+    email: body.email,
+    name: body.name ?? "",
+    passwordHash: pwHash,
+    role: "user",
+    ...tenantId ? { tenantId } : {}
+  });
+  const token = await signJwt(
+    { sub: userId, email: body.email, roles: ["user"], tenantId },
+    ctx.config.jwtSecret
+  );
+  return json({ token, userId }, 201);
+}
+async function handleLogin(req, tenantId, ctx) {
+  if (!ctx.config.jwtSecret) {
+    return json({ error: "Auth not configured (no jwtSecret)" }, 501);
+  }
+  const body = await req.json();
+  if (!body.email || !body.password) {
+    return json({ error: "email and password are required" }, 400);
+  }
+  const kernel = ctx.pool.get(tenantId);
+  const users = kernel.listEntities("User", { email: body.email });
+  if (users.length === 0) {
+    return json({ error: "Invalid credentials" }, 401);
+  }
+  const user = users[0];
+  const pwHashFact = user.facts.find((f) => f.a === "passwordHash");
+  const roleFact = user.facts.find((f) => f.a === "role");
+  if (!pwHashFact || !await verifyPassword(body.password, String(pwHashFact.v))) {
+    return json({ error: "Invalid credentials" }, 401);
+  }
+  const role = String(roleFact?.v ?? "user");
+  const token = await signJwt(
+    { sub: user.id, email: body.email, roles: [role], tenantId },
+    ctx.config.jwtSecret
+  );
+  return json({ token, userId: user.id });
+}
+function handleOAuthRedirect(providerName, url, ctx) {
+  const provider = ctx.oauthProviders[providerName] ?? getBuiltinProvider(providerName, ctx);
+  if (!provider)
+    return json({ error: `Unknown provider: ${providerName}` }, 400);
+  const redirectUri = `${url.origin}/auth/oauth/${providerName}/callback`;
+  const state = crypto.randomUUID();
+  const authUrl = buildOAuthUrl(provider, redirectUri, state);
+  return Response.redirect(authUrl, 302);
+}
+async function handleOAuthCallback(url, providerName, tenantId, ctx) {
+  if (!ctx.config.jwtSecret) {
+    return json({ error: "Auth not configured (no jwtSecret)" }, 501);
+  }
+  const code = url.searchParams.get("code");
+  if (!code) return json({ error: "Missing code" }, 400);
+  const provider = ctx.oauthProviders[providerName] ?? getBuiltinProvider(providerName, ctx);
+  if (!provider)
+    return json({ error: `Unknown provider: ${providerName}` }, 400);
+  const redirectUri = `${url.origin}/auth/oauth/${providerName}/callback`;
+  let profile;
+  try {
+    profile = await exchangeOAuthCode(provider, code, redirectUri);
+  } catch (err) {
+    return json({ error: "OAuth exchange failed", message: String(err) }, 400);
+  }
+  const kernel = ctx.pool.get(tenantId);
+  const oauthId = `oauth:${providerName}:${profile.id}`;
+  let users = kernel.listEntities("User", { oauthId });
+  let userId;
+  if (users.length === 0) {
+    userId = `user:${crypto.randomUUID()}`;
+    await kernel.createEntity(userId, "User", {
+      email: profile.email,
+      name: profile.name,
+      avatarUrl: profile.avatarUrl ?? "",
+      oauthId,
+      oauthProvider: providerName,
+      role: "user",
+      ...tenantId ? { tenantId } : {}
+    });
+  } else {
+    userId = users[0].id;
+  }
+  const token = await signJwt(
+    { sub: userId, email: profile.email, roles: ["user"], tenantId },
+    ctx.config.jwtSecret
+  );
+  return json({ token, userId });
+}
+function getBuiltinProvider(name, ctx) {
+  if (name === "google") {
+    const cid = process.env.GOOGLE_CLIENT_ID;
+    const csec = process.env.GOOGLE_CLIENT_SECRET;
+    if (!cid || !csec) return null;
+    return { ...GOOGLE_PROVIDER, clientId: cid, clientSecret: csec };
+  }
+  if (name === "github") {
+    const cid = process.env.GITHUB_CLIENT_ID;
+    const csec = process.env.GITHUB_CLIENT_SECRET;
+    if (!cid || !csec) return null;
+    return { ...GITHUB_PROVIDER, clientId: cid, clientSecret: csec };
+  }
+  return null;
+}
+async function hashPassword(password) {
+  const salt = crypto.randomUUID().replace(/-/g, "");
+  const enc = new TextEncoder();
+  const keyMat = await crypto.subtle.importKey(
+    "raw",
+    enc.encode(password),
+    "PBKDF2",
+    false,
+    ["deriveBits"]
+  );
+  const bits = await crypto.subtle.deriveBits(
+    {
+      name: "PBKDF2",
+      salt: enc.encode(salt),
+      iterations: 1e5,
+      hash: "SHA-256"
+    },
+    keyMat,
+    256
+  );
+  const hash = Array.from(new Uint8Array(bits)).map((b) => b.toString(16).padStart(2, "0")).join("");
+  return `${salt}:${hash}`;
+}
+async function verifyPassword(password, stored) {
+  const [salt, expectedHash] = stored.split(":");
+  if (!salt || !expectedHash) return false;
+  const enc = new TextEncoder();
+  const keyMat = await crypto.subtle.importKey(
+    "raw",
+    enc.encode(password),
+    "PBKDF2",
+    false,
+    ["deriveBits"]
+  );
+  const bits = await crypto.subtle.deriveBits(
+    {
+      name: "PBKDF2",
+      salt: enc.encode(salt),
+      iterations: 1e5,
+      hash: "SHA-256"
+    },
+    keyMat,
+    256
+  );
+  const hash = Array.from(new Uint8Array(bits)).map((b) => b.toString(16).padStart(2, "0")).join("");
+  return hash === expectedHash;
+}
+function entityToJson(entity) {
+  return entityRecordToPlain(entity);
+}
+function json(data, status = 200) {
+  return new Response(JSON.stringify(data), {
+    status,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+
+export {
+  ANONYMOUS,
+  signJwt,
+  verifyJwt,
+  resolveAuth,
+  GOOGLE_PROVIDER,
+  GITHUB_PROVIDER,
+  buildOAuthUrl,
+  exchangeOAuthCode,
+  PermissionRegistry,
+  PermissionError,
+  PUBLIC_READ,
+  FULLY_PUBLIC,
+  OWNER_ONLY,
+  ADMIN_ONLY,
+  SubscriptionManager,
+  startServer,
+  startServerCrossRuntime
+};