trellis 3.1.35 → 3.2.2

package/dist/{index-53f3b8p8.js → chunk-2W3MHTMG.js}

@@ -1,17 +1,21 @@
-// @bun
 import {
-  parseSimple
-} from "./index-n9f2qyh5.js";
+  DEFAULT_TENANT
+} from "./chunk-JHHEXEDM.js";
+import {
+  rel
+} from "./chunk-44FFQKQX.js";
 import {
-  QueryEngine
-} from "./index-yp88he8n.js";
+  entityRecordToPlain,
+  hydrateBindings,
+  resolveRelations
+} from "./chunk-JUEMDWLU.js";
 import {
-  __require
-} from "./index-a76rekgs.js";
+  parseSimple
+} from "./chunk-X5FLTRUB.js";
 
 // src/server/server.ts
-import { existsSync, readFileSync } from "fs";
-import { dirname, join } from "path";
+import { existsSync as existsSync2, readFileSync } from "fs";
+import { dirname, join as join2 } from "path";
 import { fileURLToPath } from "url";
 
 // src/server/auth.ts
@@ -33,13 +37,19 @@ function base64UrlDecode(input) {
   return Uint8Array.from(binary, (c) => c.charCodeAt(0));
 }
 async function hmacKey(secret) {
-  return crypto.subtle.importKey("raw", new TextEncoder().encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign", "verify"]);
+  return crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign", "verify"]
+  );
 }
 async function signJwt(payload, secret, expiresInSeconds = 86400) {
   const header = { alg: "HS256", typ: "JWT" };
-  const now = Math.floor(Date.now() / 1000);
+  const now = Math.floor(Date.now() / 1e3);
   const claims = { iat: now, exp: now + expiresInSeconds, ...payload };
-  const enc = new TextEncoder;
+  const enc = new TextEncoder();
   const headerB64 = base64UrlEncode(enc.encode(JSON.stringify(header)));
   const payloadB64 = base64UrlEncode(enc.encode(JSON.stringify(claims)));
   const signing = `${headerB64}.${payloadB64}`;
@@ -50,22 +60,29 @@ async function signJwt(payload, secret, expiresInSeconds = 86400) {
 }
 async function verifyJwt(token, secret) {
   const parts = token.split(".");
-  if (parts.length !== 3)
-    return null;
+  if (parts.length !== 3) return null;
   const [headerB64, payloadB64, sigB64] = parts;
-  const enc = new TextEncoder;
+  const enc = new TextEncoder();
   const signing = `${headerB64}.${payloadB64}`;
   try {
     const key = await hmacKey(secret);
     const sigRaw = base64UrlDecode(sigB64);
-    const sigBuf = sigRaw.buffer.slice(sigRaw.byteOffset, sigRaw.byteOffset + sigRaw.byteLength);
-    const valid = await crypto.subtle.verify("HMAC", key, sigBuf, enc.encode(signing));
-    if (!valid)
-      return null;
-    const claims = JSON.parse(new TextDecoder().decode(base64UrlDecode(payloadB64)));
-    const now = Math.floor(Date.now() / 1000);
-    if (typeof claims.exp === "number" && claims.exp < now)
-      return null;
+    const sigBuf = sigRaw.buffer.slice(
+      sigRaw.byteOffset,
+      sigRaw.byteOffset + sigRaw.byteLength
+    );
+    const valid = await crypto.subtle.verify(
+      "HMAC",
+      key,
+      sigBuf,
+      enc.encode(signing)
+    );
+    if (!valid) return null;
+    const claims = JSON.parse(
+      new TextDecoder().decode(base64UrlDecode(payloadB64))
+    );
+    const now = Math.floor(Date.now() / 1e3);
+    if (typeof claims.exp === "number" && claims.exp < now) return null;
     return claims;
   } catch {
     return null;
@@ -157,34 +174,50 @@ async function exchangeOAuthCode(provider, code, redirectUri) {
     id: String(user.id ?? user.sub ?? ""),
     email: String(user.email ?? ""),
     name: String(user.name ?? user.login ?? ""),
-    avatarUrl: user.picture ?? user.avatar_url ?? undefined
+    avatarUrl: user.picture ?? user.avatar_url ?? void 0
   };
 }
 
 // src/server/permissions.ts
-class PermissionRegistry {
-  rules = new Map;
+var PermissionRegistry = class {
+  rules = /* @__PURE__ */ new Map();
   defaultRule = "authenticated";
+  /**
+   * Register permissions for an entity type.
+   */
   register(entityType, permissions) {
     this.rules.set(entityType, permissions);
   }
+  /**
+   * Set the fallback rule used when an entity type has no declared permissions.
+   */
   setDefault(rule) {
     this.defaultRule = rule;
   }
+  /**
+   * Get the permission rule for a specific operation on an entity type.
+   * Falls back to the default rule if not declared.
+   */
   getRule(entityType, op) {
     const def = this.rules.get(entityType);
     return def?.[op] ?? this.defaultRule;
   }
+  /**
+   * Check whether an auth context is allowed to perform an operation.
+   */
   check(auth, entityType, op, entity = null) {
     const rule = this.getRule(entityType, op);
     return evaluateRule(rule, auth, entity);
   }
+  /**
+   * Assert access — throws a PermissionError if denied.
+   */
   assert(auth, entityType, op, entity = null) {
     if (!this.check(auth, entityType, op, entity)) {
       throw new PermissionError(auth, entityType, op);
     }
   }
-}
+};
 function evaluateRule(rule, auth, entity) {
   if (rule === "public") {
     return true;
@@ -193,9 +226,10 @@ function evaluateRule(rule, auth, entity) {
     return auth.authenticated;
   }
   if (rule === "own") {
-    if (!auth.authenticated || !auth.userId)
-      return false;
-    const ownerFact = entity?.facts.find((f) => f.a === "ownerId" || f.a === "createdBy");
+    if (!auth.authenticated || !auth.userId) return false;
+    const ownerFact = entity?.facts.find(
+      (f) => f.a === "ownerId" || f.a === "createdBy"
+    );
     return ownerFact?.v === auth.userId;
   }
   if (typeof rule === "object") {
@@ -215,11 +249,7 @@ function evaluateRule(rule, auth, entity) {
   }
   return false;
 }
-
-class PermissionError extends Error {
-  auth;
-  entityType;
-  op;
+var PermissionError = class extends Error {
   constructor(auth, entityType, op) {
     const who = auth.authenticated ? `user:${auth.userId}` : "anonymous";
     super(`Permission denied: ${who} cannot ${op} ${entityType}`);
@@ -235,7 +265,7 @@ class PermissionError extends Error {
       code: 403
     };
   }
-}
+};
 var PUBLIC_READ = {
   read: "public",
   create: "authenticated",
@@ -261,20 +291,212 @@ var ADMIN_ONLY = {
   delete: { role: "admin" }
 };
 
+// src/schema/kernel-resolve.ts
+import { z } from "zod";
+function ontologyTypeName(id) {
+  return id.includes(":") ? id.split(":").pop() : id;
+}
+function findOntologyByTypeName(kernel, typeName) {
+  return kernel.listOntologies().find((s) => {
+    const short = ontologyTypeName(s["@id"]);
+    return short === typeName || short.toLowerCase() === typeName.toLowerCase() || s.label === typeName;
+  });
+}
+function schemaHandleFromOntology(def, typeName) {
+  const name = typeName ?? ontologyTypeName(def["@id"]);
+  const relations = {};
+  for (const field of def.fields) {
+    if (field.valueType === "relation" && field.relation?.targetSchema) {
+      const target = ontologyTypeName(field.relation.targetSchema);
+      relations[field.name] = rel(
+        target,
+        field.relation.cardinality ?? "one"
+      );
+    }
+  }
+  return {
+    type: name,
+    zod: z.object({}),
+    relations,
+    computed: {},
+    definition: def,
+    toOntologySchema: () => {
+      throw new Error("schemaHandleFromOntology: legacy adapter not available");
+    }
+  };
+}
+function createSchemaLookup(kernel) {
+  const cache = /* @__PURE__ */ new Map();
+  return (typeName) => {
+    if (cache.has(typeName)) return cache.get(typeName);
+    const def = findOntologyByTypeName(kernel, typeName);
+    if (!def) return null;
+    const handle = schemaHandleFromOntology(def, typeName);
+    cache.set(typeName, handle);
+    return handle;
+  };
+}
+function createKernelResolveClient(kernel) {
+  return {
+    read: async (id) => {
+      const entity = kernel.getEntity(id);
+      return entity ? entityRecordToPlain(entity) : null;
+    },
+    query: async (q) => {
+      const parsed = parseSimple(q);
+      const qr = await kernel.query(parsed);
+      return {
+        bindings: hydrateBindings(
+          kernel,
+          qr.bindings
+        ),
+        executionTime: qr.executionTime
+      };
+    }
+  };
+}
+async function hydrateAndResolve(kernel, bindings, entityType, resolve) {
+  let entities = hydrateBindings(kernel, bindings);
+  if (!entityType || !resolve || Object.keys(resolve).length === 0) {
+    return entities;
+  }
+  const def = findOntologyByTypeName(kernel, entityType);
+  if (!def) return entities;
+  const schema = schemaHandleFromOntology(def, entityType);
+  const client = createKernelResolveClient(kernel);
+  const lookup = createSchemaLookup(kernel);
+  return resolveRelations(client, schema, entities, resolve, {
+    schemaLookup: lookup
+  });
+}
+
+// src/server/usage-meter.ts
+import { existsSync, readdirSync, statSync } from "fs";
+import { join } from "path";
+var EMPTY_BUCKET = () => ({
+  graph_io: 0,
+  storage_bytes: 0,
+  egress_bytes: 0
+});
+function resolveUsageTenantId(tenantId) {
+  return tenantId ?? DEFAULT_TENANT;
+}
+function dayKey(date) {
+  return date.toISOString().slice(0, 10);
+}
+function dirSize(dir) {
+  let total = 0;
+  for (const ent of readdirSync(dir, { withFileTypes: true })) {
+    const p = join(dir, ent.name);
+    if (ent.isDirectory()) total += dirSize(p);
+    else if (ent.isFile()) total += statSync(p).size;
+  }
+  return total;
+}
+function sampleTenantStorage(pool, tenantId) {
+  let total = 0;
+  const sqlitePath = pool.dbFilePath(tenantId);
+  if (existsSync(sqlitePath)) {
+    total += statSync(sqlitePath).size;
+  }
+  const blobDir = join(pool.dataPath(), "blobs");
+  if (existsSync(blobDir)) {
+    total += dirSize(blobDir);
+  }
+  return total;
+}
+function verifyAdminKey(req) {
+  const expected = process.env.TURTLEDB_ADMIN_KEY;
+  if (!expected) return false;
+  const auth = req.headers.get("authorization");
+  if (auth?.startsWith("Bearer ")) {
+    return auth.slice("Bearer ".length) === expected;
+  }
+  return req.headers.get("x-turtledb-admin-key") === expected;
+}
+var UsageMeter = class {
+  buckets = /* @__PURE__ */ new Map();
+  storageSampledAt = /* @__PURE__ */ new Map();
+  now;
+  constructor(opts = {}) {
+    this.now = opts.now ?? (() => /* @__PURE__ */ new Date());
+  }
+  recordGraphIo(tenantId, count = 1) {
+    if (count <= 0) return;
+    const bucket = this._bucket(tenantId);
+    bucket.graph_io += count;
+  }
+  recordEgress(tenantId, bytes) {
+    if (bytes <= 0) return;
+    const bucket = this._bucket(tenantId);
+    bucket.egress_bytes += bytes;
+  }
+  /** Set storage gauge for the current day (from sampler, not incremental). */
+  recordStorage(tenantId, bytes) {
+    const bucket = this._bucket(tenantId);
+    bucket.storage_bytes = bytes;
+    this.storageSampledAt.set(`${tenantId}:${this._today()}`, this.now().toISOString());
+  }
+  sampleStorage(pool, tenantId) {
+    const id = resolveUsageTenantId(tenantId);
+    const bytes = sampleTenantStorage(pool, id);
+    this.recordStorage(id, bytes);
+    return bytes;
+  }
+  getUsage(tenantId, day) {
+    const d = day ?? this._today();
+    const tenantBuckets = this.buckets.get(tenantId);
+    const meters = tenantBuckets?.get(d) ?? EMPTY_BUCKET();
+    const sampledAt = this.storageSampledAt.get(`${tenantId}:${d}`);
+    return {
+      tenantId,
+      day: d,
+      meters: { ...meters },
+      ...sampledAt ? { storageSampledAt: sampledAt } : {}
+    };
+  }
+  /** All day keys recorded for a tenant (sorted ascending). */
+  listDays(tenantId) {
+    const tenantBuckets = this.buckets.get(tenantId);
+    if (!tenantBuckets) return [];
+    return Array.from(tenantBuckets.keys()).sort();
+  }
+  _today() {
+    return dayKey(this.now());
+  }
+  _bucket(tenantId) {
+    const id = resolveUsageTenantId(tenantId);
+    const d = this._today();
+    if (!this.buckets.has(id)) {
+      this.buckets.set(id, /* @__PURE__ */ new Map());
+    }
+    const tenantBuckets = this.buckets.get(id);
+    if (!tenantBuckets.has(d)) {
+      tenantBuckets.set(d, EMPTY_BUCKET());
+    }
+    return tenantBuckets.get(d);
+  }
+};
+
 // src/server/realtime.ts
-class SubscriptionManager {
-  clients = new Map;
+var SubscriptionManager = class {
+  clients = /* @__PURE__ */ new Map();
   pool;
   permissions;
-  constructor(pool, permissions = null) {
+  meter;
+  constructor(pool, permissions = null, meter = null) {
     this.pool = pool;
     this.permissions = permissions;
+    this.meter = meter;
   }
+  // -------------------------------------------------------------------------
+  // Client lifecycle
+  // -------------------------------------------------------------------------
   addClient(clientId, ws, auth, tenantId) {
     this.clients.set(clientId, {
       id: clientId,
       ws,
-      subscriptions: new Map,
+      subscriptions: /* @__PURE__ */ new Map(),
       auth,
       tenantId
     });
@@ -282,10 +504,12 @@ class SubscriptionManager {
   removeClient(clientId) {
     this.clients.delete(clientId);
   }
+  // -------------------------------------------------------------------------
+  // Message handling
+  // -------------------------------------------------------------------------
   async handleMessage(clientId, raw) {
     const client = this.clients.get(clientId);
-    if (!client)
-      return;
+    if (!client) return;
     let msg;
     try {
       msg = JSON.parse(raw);
@@ -298,7 +522,11 @@ class SubscriptionManager {
       return;
     }
     if (msg.type === "subscribe") {
-      await this._handleSubscribe(client, msg.id, msg.query, msg.tenantId);
+      await this._handleSubscribe(client, msg.id, msg.query, {
+        tenantId: msg.tenantId,
+        entityType: msg.entityType,
+        resolve: msg.resolve
+      });
       return;
     }
     if (msg.type === "unsubscribe") {
@@ -306,6 +534,13 @@ class SubscriptionManager {
       return;
     }
   }
+  // -------------------------------------------------------------------------
+  // Notify — called after every mutation
+  // -------------------------------------------------------------------------
+  /**
+   * Re-evaluate all subscriptions for a given tenant and push diffs.
+   * Called after every write op lands.
+   */
   async notify(tenantId) {
     const tid = tenantId ?? null;
     const dead = [];
@@ -314,22 +549,22 @@ class SubscriptionManager {
         dead.push(clientId);
         continue;
       }
-      if (client.tenantId !== tid)
-        continue;
+      if (client.tenantId !== tid) continue;
       for (const [subId, sub] of client.subscriptions) {
-        if (sub.tenantId !== tid)
-          continue;
+        if (sub.tenantId !== tid) continue;
         await this._pushUpdate(client, sub);
       }
     }
-    for (const id of dead)
-      this.clients.delete(id);
+    for (const id of dead) this.clients.delete(id);
   }
   get clientCount() {
     return this.clients.size;
   }
-  async _handleSubscribe(client, subId, queryStr, tenantId) {
-    const tid = tenantId ?? client.tenantId ?? null;
+  // -------------------------------------------------------------------------
+  // Private
+  // -------------------------------------------------------------------------
+  async _handleSubscribe(client, subId, queryStr, opts = {}) {
+    const tid = opts.tenantId ?? client.tenantId ?? null;
     let parsedQuery;
     try {
       parsedQuery = parseSimple(queryStr);
@@ -341,12 +576,17 @@ class SubscriptionManager {
       });
       return;
     }
-    const kernel = this.pool.get(tid);
-    const engine = new QueryEngine(kernel.getStore());
+    const kernel = await this.pool.preload(tid);
     let result;
     try {
-      const qr = engine.execute(parsedQuery);
-      result = qr.bindings;
+      const qr = await kernel.query(parsedQuery);
+      this._recordGraphIo(tid);
+      result = await hydrateAndResolve(
+        kernel,
+        qr.bindings,
+        opts.entityType,
+        opts.resolve
+      );
     } catch (err) {
       this._send(client, {
         type: "error",
@@ -355,12 +595,15 @@ class SubscriptionManager {
       });
       return;
     }
+    const resolved = Boolean(opts.entityType) && Boolean(opts.resolve && Object.keys(opts.resolve).length > 0);
     const sub = {
       id: subId,
       query: queryStr,
       tenantId: tid,
       auth: client.auth,
-      lastResult: result
+      lastResult: result,
+      entityType: opts.entityType,
+      resolve: opts.resolve
     };
     client.subscriptions.set(subId, sub);
     this._send(client, { type: "subscribed", id: subId });
@@ -368,17 +611,23 @@ class SubscriptionManager {
       type: "data",
       id: subId,
       result,
-      diff: { added: result, updated: [], removed: [] }
+      diff: { added: result, updated: [], removed: [] },
+      ...resolved ? { resolved: true } : {}
     });
   }
   async _pushUpdate(client, sub) {
-    const kernel = this.pool.get(sub.tenantId);
-    const engine = new QueryEngine(kernel.getStore());
+    const kernel = await this.pool.preload(sub.tenantId);
     let newResult;
     try {
       const parsed = parseSimple(sub.query);
-      const qr = engine.execute(parsed);
-      newResult = qr.bindings;
+      const qr = await kernel.query(parsed);
+      this._recordGraphIo(sub.tenantId);
+      newResult = await hydrateAndResolve(
+        kernel,
+        qr.bindings,
+        sub.entityType,
+        sub.resolve
+      );
     } catch {
       return;
     }
@@ -387,14 +636,30 @@ class SubscriptionManager {
       return;
     }
     sub.lastResult = newResult;
-    this._send(client, { type: "data", id: sub.id, result: newResult, diff });
+    const resolved = Boolean(sub.entityType) && Boolean(sub.resolve && Object.keys(sub.resolve).length > 0);
+    this._send(client, {
+      type: "data",
+      id: sub.id,
+      result: newResult,
+      diff,
+      ...resolved ? { resolved: true } : {}
+    });
+  }
+  _recordGraphIo(tenantId) {
+    this.meter?.recordGraphIo(resolveUsageTenantId(tenantId));
   }
   _send(client, payload) {
+    const data = JSON.stringify(payload);
+    if (this.meter) {
+      const tid = resolveUsageTenantId(client.tenantId ?? DEFAULT_TENANT);
+      this.meter.recordEgress(tid, new TextEncoder().encode(data).length);
+    }
     try {
-      client.ws.send(JSON.stringify(payload));
-    } catch {}
+      client.ws.send(data);
+    } catch {
+    }
   }
-}
+};
 function entityId(row) {
   return String(row["?e"] ?? row.id ?? row.e ?? JSON.stringify(row));
 }
@@ -412,47 +677,41 @@ function computeDiff(prev, next) {
     }
   }
   for (const [id, row] of prevMap) {
-    if (!nextMap.has(id))
-      removed.push(row);
+    if (!nextMap.has(id)) removed.push(row);
   }
   return { added, updated, removed };
 }
 
 // src/server/server.ts
 var __moduleDir = import.meta.dir ?? dirname(fileURLToPath(import.meta.url));
-function startServer(opts) {
-  return startServerBun(opts);
-}
-async function startServerCrossRuntime(opts) {
-  if (typeof globalThis.Bun !== "undefined") {
-    const bunServer = startServerBun(opts);
-    return {
-      port: bunServer.port ?? opts.port ?? opts.config.port ?? 3000,
-      hostname: bunServer.hostname,
-      stop: (closeActive) => bunServer.stop(closeActive)
-    };
-  }
+async function startServer(opts) {
   return startServerNode(opts);
 }
+var startServerCrossRuntime = startServer;
 function buildServerContext(opts) {
   const { pool, permissions, config } = opts;
-  const port = opts.port ?? config.port ?? 3000;
+  const port = opts.port ?? config.port ?? 3e3;
   const authConfig = {
     jwtSecret: config.jwtSecret,
     apiKey: config.apiKey,
     allowPublic: true
   };
-  const subs = new SubscriptionManager(pool, permissions ?? null);
+  const meter = new UsageMeter();
+  const subs = new SubscriptionManager(pool, permissions ?? null, meter);
   const handleHttp = async (req) => {
     const url = new URL(req.url);
     const path = url.pathname;
-    const auth = await resolveAuth(req.headers.get("authorization"), authConfig);
+    const auth = await resolveAuth(
+      req.headers.get("authorization"),
+      authConfig
+    );
     const tenantId = auth.tenantId ?? url.searchParams.get("tenantId") ?? null;
     try {
       return await route(req, url, path, auth, tenantId, {
         pool,
         permissions: permissions ?? null,
         subs,
+        meter,
         authConfig,
         config,
         oauthProviders: opts.oauthProviders ?? {}
@@ -467,42 +726,6 @@ function buildServerContext(opts) {
   };
   return { port, authConfig, subs, handleHttp };
 }
-function startServerBun(opts) {
-  const { port, subs, handleHttp } = buildServerContext(opts);
-  return Bun.serve({
-    port,
-    async fetch(req, server) {
-      if (req.headers.get("upgrade") === "websocket") {
-        const upgraded = server.upgrade(req, { data: undefined });
-        if (upgraded)
-          return;
-        return new Response("WebSocket upgrade failed", { status: 400 });
-      }
-      return handleHttp(req);
-    },
-    websocket: {
-      async open(ws) {
-        const id = crypto.randomUUID();
-        ws.__clientId = id;
-        subs.addClient(id, ws, {
-          userId: null,
-          tenantId: null,
-          roles: [],
-          claims: {},
-          authenticated: false
-        }, null);
-      },
-      async message(ws, raw) {
-        const id = ws.__clientId;
-        await subs.handleMessage(id, typeof raw === "string" ? raw : new TextDecoder().decode(raw));
-      },
-      close(ws) {
-        const id = ws.__clientId;
-        subs.removeClient(id);
-      }
-    }
-  });
-}
 async function startServerNode(opts) {
   const { port, subs, handleHttp } = buildServerContext(opts);
   const { startNodeServer } = await import("./server/node-adapter.js");
@@ -513,17 +736,25 @@ async function startServerNode(opts) {
       open(ws) {
         const id = crypto.randomUUID();
         ws.__clientId = id;
-        subs.addClient(id, ws, {
-          userId: null,
-          tenantId: null,
-          roles: [],
-          claims: {},
-          authenticated: false
-        }, null);
+        subs.addClient(
+          id,
+          ws,
+          {
+            userId: null,
+            tenantId: null,
+            roles: [],
+            claims: {},
+            authenticated: false
+          },
+          null
+        );
       },
       async message(ws, raw) {
         const id = ws.__clientId;
-        await subs.handleMessage(id, typeof raw === "string" ? raw : raw.toString());
+        await subs.handleMessage(
+          id,
+          typeof raw === "string" ? raw : raw.toString()
+        );
       },
       close(ws) {
         const id = ws.__clientId;
@@ -532,31 +763,39 @@ async function startServerNode(opts) {
     }
   });
 }
+function recordGraphIo(ctx, tenantId) {
+  ctx.meter.recordGraphIo(resolveUsageTenantId(tenantId));
+}
 async function route(req, url, path, auth, tenantId, ctx) {
   const method = req.method.toUpperCase();
   if (method === "GET" && path === "/__trellis/inspector.js") {
     const candidates = [
-      join(__moduleDir, "db", "inspector.js"),
-      join(__moduleDir, "inspector.js")
+      join2(__moduleDir, "db", "inspector.js"),
+      // chunk lives in dist/, inspector in dist/db/
+      join2(__moduleDir, "inspector.js")
+      // chunk lives in dist/db/, inspector alongside
     ];
     for (const p of candidates) {
-      if (existsSync(p)) {
+      if (existsSync2(p)) {
         return new Response(readFileSync(p, "utf-8"), {
           headers: { "Content-Type": "application/javascript; charset=utf-8" }
         });
       }
     }
-    return new Response("/* Trellis DB Inspector: run `bun run build:inspector` first */", {
-      headers: { "Content-Type": "application/javascript" }
-    });
+    return new Response(
+      "/* Trellis DB Inspector: run `bun run build:inspector` first */",
+      {
+        headers: { "Content-Type": "application/javascript" }
+      }
+    );
   }
   if (method === "GET" && path === "/__trellis/trellis.css") {
     const candidates = [
-      join(__moduleDir, "db", "trellis.css"),
-      join(__moduleDir, "trellis.css")
+      join2(__moduleDir, "db", "trellis.css"),
+      join2(__moduleDir, "trellis.css")
     ];
     for (const p of candidates) {
-      if (existsSync(p)) {
+      if (existsSync2(p)) {
         return new Response(readFileSync(p, "utf-8"), {
           headers: { "Content-Type": "text/css; charset=utf-8" }
         });
@@ -584,7 +823,7 @@ async function route(req, url, path, auth, tenantId, ctx) {
     });
   }
   if (method === "GET" && path === "/health") {
-    const kernel = ctx.pool.get(tenantId);
+    const kernel = await ctx.pool.preload(tenantId);
     const ops = kernel.readAllOps().length;
     return json({
       status: "ok",
@@ -592,25 +831,27 @@ async function route(req, url, path, auth, tenantId, ctx) {
       tenants: ctx.pool.activeTenants().length
     });
   }
+  if (method === "GET" && path === "/admin/usage") {
+    return handleAdminUsage(req, url, ctx);
+  }
   if (path === "/entities" || path === "/entities/") {
-    if (method === "POST")
-      return handleCreate(req, auth, tenantId, ctx);
-    if (method === "GET")
-      return handleList(url, auth, tenantId, ctx);
+    if (method === "POST") return handleCreate(req, auth, tenantId, ctx);
+    if (method === "GET") return handleList(url, auth, tenantId, ctx);
   }
   const entityMatch = path.match(/^\/entities\/([^/]+)$/);
   if (entityMatch) {
     const id = decodeURIComponent(entityMatch[1]);
-    if (method === "GET")
-      return handleRead(id, auth, tenantId, ctx);
+    if (method === "GET") return handleRead(id, auth, tenantId, ctx);
     if (method === "PUT" || method === "PATCH")
       return handleUpdate(req, id, auth, tenantId, ctx);
-    if (method === "DELETE")
-      return handleDelete(id, auth, tenantId, ctx);
+    if (method === "DELETE") return handleDelete(id, auth, tenantId, ctx);
   }
   if (method === "POST" && path === "/query") {
     return handleQuery(req, auth, tenantId, ctx);
   }
+  if (method === "POST" && (path === "/ontologies" || path === "/ontologies/")) {
+    return handleCreateOntology(req, auth, tenantId, ctx);
+  }
   if (method === "POST" && path === "/upload") {
     return handleUpload(req, auth, tenantId, ctx);
   }
@@ -636,59 +877,63 @@ async function route(req, url, path, auth, tenantId, ctx) {
 }
 async function handleCreate(req, auth, tenantId, ctx) {
   const body = await req.json();
-  if (!body.type)
-    return json({ error: "type is required" }, 400);
+  if (!body.type) return json({ error: "type is required" }, 400);
   ctx.permissions?.assert(auth, body.type, "create");
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const entityId2 = `${body.type.toLowerCase()}:${crypto.randomUUID()}`;
   const attrs = {
     ...body.attributes
   };
-  if (auth.userId)
-    attrs.createdBy = auth.userId;
-  if (auth.tenantId)
-    attrs.tenantId = auth.tenantId;
-  const result = await kernel.createEntity(entityId2, body.type, attrs, body.links);
+  if (auth.userId) attrs.createdBy = auth.userId;
+  if (auth.tenantId) attrs.tenantId = auth.tenantId;
+  const result = await kernel.createEntity(
+    entityId2,
+    body.type,
+    attrs,
+    body.links
+  );
+  recordGraphIo(ctx, tenantId);
   await ctx.subs.notify(tenantId);
   return json({ id: entityId2, op: result.op.hash }, 201);
 }
 async function handleRead(id, auth, tenantId, ctx) {
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const entity = kernel.getEntity(id);
-  if (!entity)
-    return json({ error: "Not Found" }, 404);
+  if (!entity) return json({ error: "Not Found" }, 404);
   ctx.permissions?.assert(auth, entity.type, "read", entity);
   return json(entityToJson(entity));
 }
 async function handleUpdate(req, id, auth, tenantId, ctx) {
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const entity = kernel.getEntity(id);
-  if (!entity)
-    return json({ error: "Not Found" }, 404);
+  if (!entity) return json({ error: "Not Found" }, 404);
   ctx.permissions?.assert(auth, entity.type, "update", entity);
   const updates = await req.json();
   await kernel.updateEntity(id, updates);
+  recordGraphIo(ctx, tenantId);
   await ctx.subs.notify(tenantId);
   return json({ id, updated: true });
 }
 async function handleDelete(id, auth, tenantId, ctx) {
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const entity = kernel.getEntity(id);
-  if (!entity)
-    return json({ error: "Not Found" }, 404);
+  if (!entity) return json({ error: "Not Found" }, 404);
   ctx.permissions?.assert(auth, entity.type, "delete", entity);
   await kernel.deleteEntity(id);
+  recordGraphIo(ctx, tenantId);
   await ctx.subs.notify(tenantId);
   return json({ id, deleted: true });
 }
 async function handleList(url, auth, tenantId, ctx) {
-  const type = url.searchParams.get("type") ?? undefined;
+  const type = url.searchParams.get("type") ?? void 0;
   const limit = parseInt(url.searchParams.get("limit") ?? "100");
   const offset = parseInt(url.searchParams.get("offset") ?? "0");
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   let entities = kernel.listEntities(type);
   if (ctx.permissions && type) {
-    entities = entities.filter((e) => ctx.permissions.check(auth, e.type, "read", e));
+    entities = entities.filter(
+      (e) => ctx.permissions.check(auth, e.type, "read", e)
+    );
   }
   const page = entities.slice(offset, offset + limit);
   return json({
@@ -700,22 +945,53 @@ async function handleList(url, auth, tenantId, ctx) {
 }
 async function handleQuery(req, auth, tenantId, ctx) {
   const body = await req.json();
-  if (!body.query)
-    return json({ error: "query is required" }, 400);
+  if (!body.query) return json({ error: "query is required" }, 400);
   let parsed;
   try {
     parsed = parseSimple(body.query);
   } catch (err) {
     return json({ error: "Invalid query", message: String(err) }, 400);
   }
-  const kernel = ctx.pool.get(tenantId);
-  const engine = new QueryEngine(kernel.getStore());
-  const result = engine.execute(parsed);
+  const kernel = await ctx.pool.preload(tenantId);
+  const result = await kernel.query(parsed);
+  recordGraphIo(ctx, tenantId);
+  const bindings = hydrateBindings(
+    kernel,
+    result.bindings
+  );
   return json({
-    bindings: result.bindings,
+    bindings,
     executionTime: result.executionTime
   });
 }
+async function handleCreateOntology(req, auth, tenantId, ctx) {
+  const schema = await req.json();
+  if (!schema || !schema["@id"] || !Array.isArray(schema.fields)) {
+    return json(
+      { error: "A SchemaDefinition (with @id and fields) is required" },
+      400
+    );
+  }
+  if ((schema.tier ?? "user") === "core") {
+    return json({ error: "Core ontologies are immutable" }, 403);
+  }
+  const kernel = await ctx.pool.preload(tenantId);
+  const exists = kernel.listOntologies().some((ont) => ont["@id"] === schema["@id"]);
+  if (exists) {
+    return json({ id: schema["@id"], registered: false, existed: true }, 200);
+  }
+  try {
+    kernel.createOntology(schema);
+    recordGraphIo(ctx, tenantId);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("already exists")) {
+      return json({ id: schema["@id"], registered: false, existed: true }, 200);
+    }
+    return json({ error: "Could not register schema", message: msg }, 409);
+  }
+  return json({ id: schema["@id"], registered: true }, 201);
+}
 async function handleUpload(req, auth, tenantId, ctx) {
   if (!auth.authenticated && ctx.config.apiKey) {
     return json({ error: "Unauthorized" }, 401);
@@ -724,7 +1000,7 @@ async function handleUpload(req, auth, tenantId, ctx) {
   const buffer = new Uint8Array(await req.arrayBuffer());
   const hashBuf = await crypto.subtle.digest("SHA-256", buffer);
   const hash = `blob:${Array.from(new Uint8Array(hashBuf)).map((b) => b.toString(16).padStart(2, "0")).join("")}`;
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const backend = kernel.getBackend();
   if (!backend.hasBlob(hash)) {
     backend.putBlob(hash, buffer);
@@ -732,12 +1008,15 @@ async function handleUpload(req, auth, tenantId, ctx) {
   return json({ hash, size: buffer.length, contentType }, 201);
 }
 async function handleFileDownload(hash, ctx, tenantId) {
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const backend = kernel.getBackend();
   const blob = backend.getBlob(hash);
-  if (!blob)
-    return json({ error: "Not Found" }, 404);
-  const cleanBuf = blob.buffer.slice(blob.byteOffset, blob.byteOffset + blob.byteLength);
+  if (!blob) return json({ error: "Not Found" }, 404);
+  const cleanBuf = blob.buffer.slice(
+    blob.byteOffset,
+    blob.byteOffset + blob.byteLength
+  );
+  ctx.meter.recordEgress(resolveUsageTenantId(tenantId), blob.byteLength);
   return new Response(cleanBuf, {
     headers: { "Content-Type": "application/octet-stream" }
   });
@@ -750,7 +1029,7 @@ async function handleRegister(req, tenantId, ctx) {
   if (!body.email || !body.password) {
     return json({ error: "email and password are required" }, 400);
   }
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const existing = kernel.listEntities("User", { email: body.email });
   if (existing.length > 0) {
     return json({ error: "Email already registered" }, 409);
@@ -764,7 +1043,10 @@ async function handleRegister(req, tenantId, ctx) {
     role: "user",
     ...tenantId ? { tenantId } : {}
   });
-  const token = await signJwt({ sub: userId, email: body.email, roles: ["user"], tenantId }, ctx.config.jwtSecret);
+  const token = await signJwt(
+    { sub: userId, email: body.email, roles: ["user"], tenantId },
+    ctx.config.jwtSecret
+  );
   return json({ token, userId }, 201);
 }
 async function handleLogin(req, tenantId, ctx) {
@@ -775,7 +1057,7 @@ async function handleLogin(req, tenantId, ctx) {
   if (!body.email || !body.password) {
     return json({ error: "email and password are required" }, 400);
   }
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const users = kernel.listEntities("User", { email: body.email });
   if (users.length === 0) {
     return json({ error: "Invalid credentials" }, 401);
@@ -787,7 +1069,10 @@ async function handleLogin(req, tenantId, ctx) {
     return json({ error: "Invalid credentials" }, 401);
   }
   const role = String(roleFact?.v ?? "user");
-  const token = await signJwt({ sub: user.id, email: body.email, roles: [role], tenantId }, ctx.config.jwtSecret);
+  const token = await signJwt(
+    { sub: user.id, email: body.email, roles: [role], tenantId },
+    ctx.config.jwtSecret
+  );
   return json({ token, userId: user.id });
 }
 function handleOAuthRedirect(providerName, url, ctx) {
@@ -804,8 +1089,7 @@ async function handleOAuthCallback(url, providerName, tenantId, ctx) {
     return json({ error: "Auth not configured (no jwtSecret)" }, 501);
   }
   const code = url.searchParams.get("code");
-  if (!code)
-    return json({ error: "Missing code" }, 400);
+  if (!code) return json({ error: "Missing code" }, 400);
   const provider = ctx.oauthProviders[providerName] ?? getBuiltinProvider(providerName, ctx);
   if (!provider)
     return json({ error: `Unknown provider: ${providerName}` }, 400);
@@ -816,7 +1100,7 @@ async function handleOAuthCallback(url, providerName, tenantId, ctx) {
   } catch (err) {
     return json({ error: "OAuth exchange failed", message: String(err) }, 400);
   }
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const oauthId = `oauth:${providerName}:${profile.id}`;
   let users = kernel.listEntities("User", { oauthId });
   let userId;
@@ -834,62 +1118,94 @@ async function handleOAuthCallback(url, providerName, tenantId, ctx) {
   } else {
     userId = users[0].id;
   }
-  const token = await signJwt({ sub: userId, email: profile.email, roles: ["user"], tenantId }, ctx.config.jwtSecret);
+  const token = await signJwt(
+    { sub: userId, email: profile.email, roles: ["user"], tenantId },
+    ctx.config.jwtSecret
+  );
   return json({ token, userId });
 }
 function getBuiltinProvider(name, ctx) {
   if (name === "google") {
     const cid = process.env.GOOGLE_CLIENT_ID;
     const csec = process.env.GOOGLE_CLIENT_SECRET;
-    if (!cid || !csec)
-      return null;
+    if (!cid || !csec) return null;
     return { ...GOOGLE_PROVIDER, clientId: cid, clientSecret: csec };
   }
   if (name === "github") {
     const cid = process.env.GITHUB_CLIENT_ID;
     const csec = process.env.GITHUB_CLIENT_SECRET;
-    if (!cid || !csec)
-      return null;
+    if (!cid || !csec) return null;
     return { ...GITHUB_PROVIDER, clientId: cid, clientSecret: csec };
   }
   return null;
 }
 async function hashPassword(password) {
   const salt = crypto.randomUUID().replace(/-/g, "");
-  const enc = new TextEncoder;
-  const keyMat = await crypto.subtle.importKey("raw", enc.encode(password), "PBKDF2", false, ["deriveBits"]);
-  const bits = await crypto.subtle.deriveBits({
-    name: "PBKDF2",
-    salt: enc.encode(salt),
-    iterations: 1e5,
-    hash: "SHA-256"
-  }, keyMat, 256);
+  const enc = new TextEncoder();
+  const keyMat = await crypto.subtle.importKey(
+    "raw",
+    enc.encode(password),
+    "PBKDF2",
+    false,
+    ["deriveBits"]
+  );
+  const bits = await crypto.subtle.deriveBits(
+    {
+      name: "PBKDF2",
+      salt: enc.encode(salt),
+      iterations: 1e5,
+      hash: "SHA-256"
+    },
+    keyMat,
+    256
+  );
   const hash = Array.from(new Uint8Array(bits)).map((b) => b.toString(16).padStart(2, "0")).join("");
   return `${salt}:${hash}`;
 }
 async function verifyPassword(password, stored) {
   const [salt, expectedHash] = stored.split(":");
-  if (!salt || !expectedHash)
-    return false;
-  const enc = new TextEncoder;
-  const keyMat = await crypto.subtle.importKey("raw", enc.encode(password), "PBKDF2", false, ["deriveBits"]);
-  const bits = await crypto.subtle.deriveBits({
-    name: "PBKDF2",
-    salt: enc.encode(salt),
-    iterations: 1e5,
-    hash: "SHA-256"
-  }, keyMat, 256);
+  if (!salt || !expectedHash) return false;
+  const enc = new TextEncoder();
+  const keyMat = await crypto.subtle.importKey(
+    "raw",
+    enc.encode(password),
+    "PBKDF2",
+    false,
+    ["deriveBits"]
+  );
+  const bits = await crypto.subtle.deriveBits(
+    {
+      name: "PBKDF2",
+      salt: enc.encode(salt),
+      iterations: 1e5,
+      hash: "SHA-256"
+    },
+    keyMat,
+    256
+  );
   const hash = Array.from(new Uint8Array(bits)).map((b) => b.toString(16).padStart(2, "0")).join("");
   return hash === expectedHash;
 }
-function entityToJson(entity) {
-  const attrs = {};
-  for (const f of entity.facts) {
-    if (f.a !== "type") {
-      attrs[f.a] = f.v;
-    }
+function handleAdminUsage(req, url, ctx) {
+  if (!process.env.TURTLEDB_ADMIN_KEY) {
+    return json({ error: "Admin usage not configured" }, 501);
   }
-  return { id: entity.id, type: entity.type, ...attrs };
+  if (!verifyAdminKey(req)) {
+    return json({ error: "Unauthorized" }, 401);
+  }
+  const tenant = url.searchParams.get("tenant");
+  if (!tenant) {
+    return json({ error: "tenant query param is required" }, 400);
+  }
+  const refresh = url.searchParams.get("refresh") === "1";
+  if (refresh) {
+    ctx.meter.sampleStorage(ctx.pool, tenant);
+  }
+  const day = url.searchParams.get("day") ?? void 0;
+  return json(ctx.meter.getUsage(tenant, day));
+}
+function entityToJson(entity) {
+  return entityRecordToPlain(entity);
 }
 function json(data, status = 200) {
   return new Response(JSON.stringify(data), {
@@ -898,4 +1214,27 @@ function json(data, status = 200) {
   });
 }
 
-export { ANONYMOUS, signJwt, verifyJwt, resolveAuth, GOOGLE_PROVIDER, GITHUB_PROVIDER, buildOAuthUrl, exchangeOAuthCode, PermissionRegistry, PermissionError, PUBLIC_READ, FULLY_PUBLIC, OWNER_ONLY, ADMIN_ONLY, SubscriptionManager, startServer, startServerCrossRuntime };
+export {
+  ANONYMOUS,
+  signJwt,
+  verifyJwt,
+  resolveAuth,
+  GOOGLE_PROVIDER,
+  GITHUB_PROVIDER,
+  buildOAuthUrl,
+  exchangeOAuthCode,
+  PermissionRegistry,
+  PermissionError,
+  PUBLIC_READ,
+  FULLY_PUBLIC,
+  OWNER_ONLY,
+  ADMIN_ONLY,
+  resolveUsageTenantId,
+  dayKey,
+  sampleTenantStorage,
+  verifyAdminKey,
+  UsageMeter,
+  SubscriptionManager,
+  startServer,
+  startServerCrossRuntime
+};