trellis 3.2.0 → 3.2.2

package/dist/{chunk-3ETIIPPB.js → chunk-2W3MHTMG.js}

@@ -1,3 +1,6 @@
+import {
+  DEFAULT_TENANT
+} from "./chunk-JHHEXEDM.js";
 import {
   rel
 } from "./chunk-44FFQKQX.js";
@@ -11,8 +14,8 @@ import {
 } from "./chunk-X5FLTRUB.js";
 
 // src/server/server.ts
-import { existsSync, readFileSync } from "fs";
-import { dirname, join } from "path";
+import { existsSync as existsSync2, readFileSync } from "fs";
+import { dirname, join as join2 } from "path";
 import { fileURLToPath } from "url";
 
 // src/server/auth.ts
@@ -367,14 +370,124 @@ async function hydrateAndResolve(kernel, bindings, entityType, resolve) {
   });
 }
 
+// src/server/usage-meter.ts
+import { existsSync, readdirSync, statSync } from "fs";
+import { join } from "path";
+var EMPTY_BUCKET = () => ({
+  graph_io: 0,
+  storage_bytes: 0,
+  egress_bytes: 0
+});
+function resolveUsageTenantId(tenantId) {
+  return tenantId ?? DEFAULT_TENANT;
+}
+function dayKey(date) {
+  return date.toISOString().slice(0, 10);
+}
+function dirSize(dir) {
+  let total = 0;
+  for (const ent of readdirSync(dir, { withFileTypes: true })) {
+    const p = join(dir, ent.name);
+    if (ent.isDirectory()) total += dirSize(p);
+    else if (ent.isFile()) total += statSync(p).size;
+  }
+  return total;
+}
+function sampleTenantStorage(pool, tenantId) {
+  let total = 0;
+  const sqlitePath = pool.dbFilePath(tenantId);
+  if (existsSync(sqlitePath)) {
+    total += statSync(sqlitePath).size;
+  }
+  const blobDir = join(pool.dataPath(), "blobs");
+  if (existsSync(blobDir)) {
+    total += dirSize(blobDir);
+  }
+  return total;
+}
+function verifyAdminKey(req) {
+  const expected = process.env.TURTLEDB_ADMIN_KEY;
+  if (!expected) return false;
+  const auth = req.headers.get("authorization");
+  if (auth?.startsWith("Bearer ")) {
+    return auth.slice("Bearer ".length) === expected;
+  }
+  return req.headers.get("x-turtledb-admin-key") === expected;
+}
+var UsageMeter = class {
+  buckets = /* @__PURE__ */ new Map();
+  storageSampledAt = /* @__PURE__ */ new Map();
+  now;
+  constructor(opts = {}) {
+    this.now = opts.now ?? (() => /* @__PURE__ */ new Date());
+  }
+  recordGraphIo(tenantId, count = 1) {
+    if (count <= 0) return;
+    const bucket = this._bucket(tenantId);
+    bucket.graph_io += count;
+  }
+  recordEgress(tenantId, bytes) {
+    if (bytes <= 0) return;
+    const bucket = this._bucket(tenantId);
+    bucket.egress_bytes += bytes;
+  }
+  /** Set storage gauge for the current day (from sampler, not incremental). */
+  recordStorage(tenantId, bytes) {
+    const bucket = this._bucket(tenantId);
+    bucket.storage_bytes = bytes;
+    this.storageSampledAt.set(`${tenantId}:${this._today()}`, this.now().toISOString());
+  }
+  sampleStorage(pool, tenantId) {
+    const id = resolveUsageTenantId(tenantId);
+    const bytes = sampleTenantStorage(pool, id);
+    this.recordStorage(id, bytes);
+    return bytes;
+  }
+  getUsage(tenantId, day) {
+    const d = day ?? this._today();
+    const tenantBuckets = this.buckets.get(tenantId);
+    const meters = tenantBuckets?.get(d) ?? EMPTY_BUCKET();
+    const sampledAt = this.storageSampledAt.get(`${tenantId}:${d}`);
+    return {
+      tenantId,
+      day: d,
+      meters: { ...meters },
+      ...sampledAt ? { storageSampledAt: sampledAt } : {}
+    };
+  }
+  /** All day keys recorded for a tenant (sorted ascending). */
+  listDays(tenantId) {
+    const tenantBuckets = this.buckets.get(tenantId);
+    if (!tenantBuckets) return [];
+    return Array.from(tenantBuckets.keys()).sort();
+  }
+  _today() {
+    return dayKey(this.now());
+  }
+  _bucket(tenantId) {
+    const id = resolveUsageTenantId(tenantId);
+    const d = this._today();
+    if (!this.buckets.has(id)) {
+      this.buckets.set(id, /* @__PURE__ */ new Map());
+    }
+    const tenantBuckets = this.buckets.get(id);
+    if (!tenantBuckets.has(d)) {
+      tenantBuckets.set(d, EMPTY_BUCKET());
+    }
+    return tenantBuckets.get(d);
+  }
+};
+
 // src/server/realtime.ts
 var SubscriptionManager = class {
   clients = /* @__PURE__ */ new Map();
   pool;
   permissions;
-  constructor(pool, permissions = null) {
+  meter;
+  constructor(pool, permissions = null, meter = null) {
     this.pool = pool;
     this.permissions = permissions;
+    this.meter = meter;
   }
   // -------------------------------------------------------------------------
   // Client lifecycle
@@ -463,10 +576,11 @@ var SubscriptionManager = class {
       });
       return;
     }
-    const kernel = this.pool.get(tid);
+    const kernel = await this.pool.preload(tid);
     let result;
     try {
       const qr = await kernel.query(parsedQuery);
+      this._recordGraphIo(tid);
       result = await hydrateAndResolve(
         kernel,
         qr.bindings,
@@ -502,11 +616,12 @@ var SubscriptionManager = class {
     });
   }
   async _pushUpdate(client, sub) {
-    const kernel = this.pool.get(sub.tenantId);
+    const kernel = await this.pool.preload(sub.tenantId);
     let newResult;
     try {
       const parsed = parseSimple(sub.query);
       const qr = await kernel.query(parsed);
+      this._recordGraphIo(sub.tenantId);
       newResult = await hydrateAndResolve(
         kernel,
         qr.bindings,
@@ -530,9 +645,17 @@ var SubscriptionManager = class {
       ...resolved ? { resolved: true } : {}
     });
   }
+  _recordGraphIo(tenantId) {
+    this.meter?.recordGraphIo(resolveUsageTenantId(tenantId));
+  }
   _send(client, payload) {
+    const data = JSON.stringify(payload);
+    if (this.meter) {
+      const tid = resolveUsageTenantId(client.tenantId ?? DEFAULT_TENANT);
+      this.meter.recordEgress(tid, new TextEncoder().encode(data).length);
+    }
     try {
-      client.ws.send(JSON.stringify(payload));
+      client.ws.send(data);
     } catch {
     }
   }
@@ -573,7 +696,8 @@ function buildServerContext(opts) {
     apiKey: config.apiKey,
     allowPublic: true
   };
-  const subs = new SubscriptionManager(pool, permissions ?? null);
+  const meter = new UsageMeter();
+  const subs = new SubscriptionManager(pool, permissions ?? null, meter);
   const handleHttp = async (req) => {
     const url = new URL(req.url);
     const path = url.pathname;
@@ -587,6 +711,7 @@ function buildServerContext(opts) {
         pool,
         permissions: permissions ?? null,
         subs,
+        meter,
         authConfig,
         config,
         oauthProviders: opts.oauthProviders ?? {}
@@ -638,17 +763,20 @@ async function startServerNode(opts) {
     }
   });
 }
+function recordGraphIo(ctx, tenantId) {
+  ctx.meter.recordGraphIo(resolveUsageTenantId(tenantId));
+}
 async function route(req, url, path, auth, tenantId, ctx) {
   const method = req.method.toUpperCase();
   if (method === "GET" && path === "/__trellis/inspector.js") {
     const candidates = [
-      join(__moduleDir, "db", "inspector.js"),
+      join2(__moduleDir, "db", "inspector.js"),
       // chunk lives in dist/, inspector in dist/db/
-      join(__moduleDir, "inspector.js")
+      join2(__moduleDir, "inspector.js")
       // chunk lives in dist/db/, inspector alongside
     ];
     for (const p of candidates) {
-      if (existsSync(p)) {
+      if (existsSync2(p)) {
         return new Response(readFileSync(p, "utf-8"), {
           headers: { "Content-Type": "application/javascript; charset=utf-8" }
         });
@@ -663,11 +791,11 @@ async function route(req, url, path, auth, tenantId, ctx) {
   }
   if (method === "GET" && path === "/__trellis/trellis.css") {
     const candidates = [
-      join(__moduleDir, "db", "trellis.css"),
-      join(__moduleDir, "trellis.css")
+      join2(__moduleDir, "db", "trellis.css"),
+      join2(__moduleDir, "trellis.css")
     ];
     for (const p of candidates) {
-      if (existsSync(p)) {
+      if (existsSync2(p)) {
         return new Response(readFileSync(p, "utf-8"), {
           headers: { "Content-Type": "text/css; charset=utf-8" }
         });
@@ -695,7 +823,7 @@ async function route(req, url, path, auth, tenantId, ctx) {
     });
   }
   if (method === "GET" && path === "/health") {
-    const kernel = ctx.pool.get(tenantId);
+    const kernel = await ctx.pool.preload(tenantId);
     const ops = kernel.readAllOps().length;
     return json({
       status: "ok",
@@ -703,6 +831,9 @@ async function route(req, url, path, auth, tenantId, ctx) {
       tenants: ctx.pool.activeTenants().length
     });
   }
+  if (method === "GET" && path === "/admin/usage") {
+    return handleAdminUsage(req, url, ctx);
+  }
   if (path === "/entities" || path === "/entities/") {
     if (method === "POST") return handleCreate(req, auth, tenantId, ctx);
     if (method === "GET") return handleList(url, auth, tenantId, ctx);
@@ -748,7 +879,7 @@ async function handleCreate(req, auth, tenantId, ctx) {
   const body = await req.json();
   if (!body.type) return json({ error: "type is required" }, 400);
   ctx.permissions?.assert(auth, body.type, "create");
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const entityId2 = `${body.type.toLowerCase()}:${crypto.randomUUID()}`;
   const attrs = {
     ...body.attributes
@@ -761,32 +892,35 @@ async function handleCreate(req, auth, tenantId, ctx) {
     attrs,
     body.links
   );
+  recordGraphIo(ctx, tenantId);
   await ctx.subs.notify(tenantId);
   return json({ id: entityId2, op: result.op.hash }, 201);
 }
 async function handleRead(id, auth, tenantId, ctx) {
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const entity = kernel.getEntity(id);
   if (!entity) return json({ error: "Not Found" }, 404);
   ctx.permissions?.assert(auth, entity.type, "read", entity);
   return json(entityToJson(entity));
 }
 async function handleUpdate(req, id, auth, tenantId, ctx) {
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const entity = kernel.getEntity(id);
   if (!entity) return json({ error: "Not Found" }, 404);
   ctx.permissions?.assert(auth, entity.type, "update", entity);
   const updates = await req.json();
   await kernel.updateEntity(id, updates);
+  recordGraphIo(ctx, tenantId);
   await ctx.subs.notify(tenantId);
   return json({ id, updated: true });
 }
 async function handleDelete(id, auth, tenantId, ctx) {
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const entity = kernel.getEntity(id);
   if (!entity) return json({ error: "Not Found" }, 404);
   ctx.permissions?.assert(auth, entity.type, "delete", entity);
   await kernel.deleteEntity(id);
+  recordGraphIo(ctx, tenantId);
   await ctx.subs.notify(tenantId);
   return json({ id, deleted: true });
 }
@@ -794,7 +928,7 @@ async function handleList(url, auth, tenantId, ctx) {
   const type = url.searchParams.get("type") ?? void 0;
   const limit = parseInt(url.searchParams.get("limit") ?? "100");
   const offset = parseInt(url.searchParams.get("offset") ?? "0");
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   let entities = kernel.listEntities(type);
   if (ctx.permissions && type) {
     entities = entities.filter(
@@ -818,8 +952,9 @@ async function handleQuery(req, auth, tenantId, ctx) {
   } catch (err) {
     return json({ error: "Invalid query", message: String(err) }, 400);
   }
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const result = await kernel.query(parsed);
+  recordGraphIo(ctx, tenantId);
   const bindings = hydrateBindings(
     kernel,
     result.bindings
@@ -832,18 +967,22 @@ async function handleQuery(req, auth, tenantId, ctx) {
 async function handleCreateOntology(req, auth, tenantId, ctx) {
   const schema = await req.json();
   if (!schema || !schema["@id"] || !Array.isArray(schema.fields)) {
-    return json({ error: "A SchemaDefinition (with @id and fields) is required" }, 400);
+    return json(
+      { error: "A SchemaDefinition (with @id and fields) is required" },
+      400
+    );
   }
   if ((schema.tier ?? "user") === "core") {
     return json({ error: "Core ontologies are immutable" }, 403);
   }
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const exists = kernel.listOntologies().some((ont) => ont["@id"] === schema["@id"]);
   if (exists) {
     return json({ id: schema["@id"], registered: false, existed: true }, 200);
   }
   try {
     kernel.createOntology(schema);
+    recordGraphIo(ctx, tenantId);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     if (msg.includes("already exists")) {
@@ -861,7 +1000,7 @@ async function handleUpload(req, auth, tenantId, ctx) {
   const buffer = new Uint8Array(await req.arrayBuffer());
   const hashBuf = await crypto.subtle.digest("SHA-256", buffer);
   const hash = `blob:${Array.from(new Uint8Array(hashBuf)).map((b) => b.toString(16).padStart(2, "0")).join("")}`;
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const backend = kernel.getBackend();
   if (!backend.hasBlob(hash)) {
     backend.putBlob(hash, buffer);
@@ -869,7 +1008,7 @@ async function handleUpload(req, auth, tenantId, ctx) {
   return json({ hash, size: buffer.length, contentType }, 201);
 }
 async function handleFileDownload(hash, ctx, tenantId) {
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const backend = kernel.getBackend();
   const blob = backend.getBlob(hash);
   if (!blob) return json({ error: "Not Found" }, 404);
@@ -877,6 +1016,7 @@ async function handleFileDownload(hash, ctx, tenantId) {
     blob.byteOffset,
     blob.byteOffset + blob.byteLength
   );
+  ctx.meter.recordEgress(resolveUsageTenantId(tenantId), blob.byteLength);
   return new Response(cleanBuf, {
     headers: { "Content-Type": "application/octet-stream" }
   });
@@ -889,7 +1029,7 @@ async function handleRegister(req, tenantId, ctx) {
   if (!body.email || !body.password) {
     return json({ error: "email and password are required" }, 400);
   }
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const existing = kernel.listEntities("User", { email: body.email });
   if (existing.length > 0) {
     return json({ error: "Email already registered" }, 409);
@@ -917,7 +1057,7 @@ async function handleLogin(req, tenantId, ctx) {
   if (!body.email || !body.password) {
     return json({ error: "email and password are required" }, 400);
   }
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const users = kernel.listEntities("User", { email: body.email });
   if (users.length === 0) {
     return json({ error: "Invalid credentials" }, 401);
@@ -960,7 +1100,7 @@ async function handleOAuthCallback(url, providerName, tenantId, ctx) {
   } catch (err) {
     return json({ error: "OAuth exchange failed", message: String(err) }, 400);
   }
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const oauthId = `oauth:${providerName}:${profile.id}`;
   let users = kernel.listEntities("User", { oauthId });
   let userId;
@@ -1046,6 +1186,24 @@ async function verifyPassword(password, stored) {
   const hash = Array.from(new Uint8Array(bits)).map((b) => b.toString(16).padStart(2, "0")).join("");
   return hash === expectedHash;
 }
+function handleAdminUsage(req, url, ctx) {
+  if (!process.env.TURTLEDB_ADMIN_KEY) {
+    return json({ error: "Admin usage not configured" }, 501);
+  }
+  if (!verifyAdminKey(req)) {
+    return json({ error: "Unauthorized" }, 401);
+  }
+  const tenant = url.searchParams.get("tenant");
+  if (!tenant) {
+    return json({ error: "tenant query param is required" }, 400);
+  }
+  const refresh = url.searchParams.get("refresh") === "1";
+  if (refresh) {
+    ctx.meter.sampleStorage(ctx.pool, tenant);
+  }
+  const day = url.searchParams.get("day") ?? void 0;
+  return json(ctx.meter.getUsage(tenant, day));
+}
 function entityToJson(entity) {
   return entityRecordToPlain(entity);
 }
@@ -1071,6 +1229,11 @@ export {
   FULLY_PUBLIC,
   OWNER_ONLY,
   ADMIN_ONLY,
+  resolveUsageTenantId,
+  dayKey,
+  sampleTenantStorage,
+  verifyAdminKey,
+  UsageMeter,
   SubscriptionManager,
   startServer,
   startServerCrossRuntime

package/dist/{chunk-MBNBTJCR.js → chunk-6GEZ6DN5.js}

@@ -1,14 +1,14 @@
 import {
   TrellisVcsEngine,
   init_engine
-} from "./chunk-YY3GF7DH.js";
+} from "./chunk-L5N5PR2S.js";
 import {
   IdbOpLog
 } from "./chunk-MPXUVGT3.js";
 import {
   JsonOpLog,
   init_op_log
-} from "./chunk-B3ZIFA2O.js";
+} from "./chunk-VBYUTRXX.js";
 import {
   PartyKitRoomTransport,
   TrellisVcsSyncPeer

package/dist/chunk-7ZFRVCUE.js

@@ -0,0 +1,211 @@
+import {
+  SPRITE_ENSURE_BUN_SH,
+  assertSpriteCli,
+  ensureSprite,
+  ensureSpritePublicAccess,
+  resolveSpritePublicUrl,
+  runSpriteCopy,
+  runSpriteExec
+} from "./chunk-CAG4FULI.js";
+import {
+  updateConfig
+} from "./chunk-JA7AIHRK.js";
+import {
+  __require
+} from "./chunk-KFQGP6VL.js";
+
+// src/server/deploy.ts
+import { existsSync, writeFileSync, mkdirSync } from "fs";
+import { join, resolve } from "path";
+
+// src/server/deploy-meta.ts
+var DEPLOY_NAME_RE = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+var MIN_LEN = 3;
+var MAX_LEN = 32;
+var DeployNameError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "DeployNameError";
+  }
+};
+function normalizeDeployName(name) {
+  return name.trim().toLowerCase();
+}
+function validateDeployName(name) {
+  const normalized = normalizeDeployName(name);
+  if (!normalized) {
+    throw new DeployNameError("Deploy name is required.");
+  }
+  if (normalized.length < MIN_LEN || normalized.length > MAX_LEN) {
+    throw new DeployNameError(
+      `Deploy name must be ${MIN_LEN}\u2013${MAX_LEN} characters (got ${normalized.length}).`
+    );
+  }
+  if (normalized.includes("--")) {
+    throw new DeployNameError(
+      "Deploy name cannot contain consecutive hyphens."
+    );
+  }
+  if (!DEPLOY_NAME_RE.test(normalized)) {
+    throw new DeployNameError(
+      "Deploy name must start with a letter and use only lowercase letters, numbers, and single hyphens (e.g. my-app)."
+    );
+  }
+  return normalized;
+}
+function buildDeployUrl(name) {
+  const slug = validateDeployName(name);
+  return `https://${slug}.sprites.app`;
+}
+var SPRITE_PUBLIC_HTTP_PORT = 8080;
+
+// src/server/deploy.ts
+async function deploy(opts) {
+  const { configDir = ".", onProgress = () => {
+  } } = opts;
+  const listenPort = opts.port ?? SPRITE_PUBLIC_HTTP_PORT;
+  const name = validateDeployName(opts.name);
+  const apiKey = opts.apiKey ?? generateSecret("spk_");
+  const jwtSecret = opts.jwtSecret ?? generateSecret("jws_");
+  if (opts.stub) {
+    const url2 = buildDeployUrl(name);
+    onProgress("Stub deploy \u2014 skipping Sprites provisioning");
+    onProgress("Writing .trellis-db.json...");
+    writeRemoteDeployConfig({ name, url: url2, apiKey, configDir });
+    return { url: url2, name, apiKey };
+  }
+  onProgress("Checking Sprites CLI...");
+  await assertSpriteCli();
+  onProgress("Writing server entrypoint...");
+  const tmpDir = resolve(configDir, ".trellis-deploy");
+  if (!existsSync(tmpDir)) mkdirSync(tmpDir, { recursive: true });
+  const entrypoint = join(tmpDir, "server-entry.ts");
+  writeFileSync(
+    entrypoint,
+    generateServerEntrypoint({ port: listenPort, apiKey, jwtSecret })
+  );
+  onProgress("Bundling server with Bun...");
+  const bundlePath = join(tmpDir, "server.js");
+  await runBun([
+    "build",
+    entrypoint,
+    "--outfile",
+    bundlePath,
+    "--target",
+    "bun",
+    "--format",
+    "esm"
+  ]);
+  onProgress(`Ensuring Sprite: ${name}...`);
+  await ensureSprite(name);
+  onProgress("Configuring public URL...");
+  await ensureSpritePublicAccess(name);
+  const url = await resolveSpritePublicUrl(name);
+  onProgress(`Uploading to Sprite: ${name}...`);
+  await runSpriteExec(name, "mkdir -p /home/sprite/trellis-db");
+  await runSpriteCopy(bundlePath, name, "/home/sprite/trellis-db/server.js");
+  onProgress("Ensuring Bun is installed...");
+  const bunPath = await runSpriteExec(name, SPRITE_ENSURE_BUN_SH);
+  if (!bunPath.includes("bun")) {
+    throw new Error(`Bun install failed on sprite ${name}: ${bunPath || "(no output)"}`);
+  }
+  onProgress("Starting server...");
+  await runSpriteExec(
+    name,
+    'pkill -f "/home/sprite/trellis-db/server.js" 2>/dev/null || true'
+  ).catch(() => {
+  });
+  const bun = bunPath.trim().split("\n").pop().trim();
+  await runSpriteExec(
+    name,
+    `cd /home/sprite/trellis-db && (nohup ${bun} run server.js >> server.log 2>&1 </dev/null &); exit 0`
+  );
+  onProgress("Waiting for health check...");
+  await waitForDeployHealth(url, 6e4);
+  onProgress("Writing .trellis-db.json...");
+  writeRemoteDeployConfig({ name, url, apiKey, configDir });
+  return { url, name, apiKey };
+}
+function writeRemoteDeployConfig(opts) {
+  updateConfig(
+    {
+      mode: "remote",
+      url: opts.url,
+      apiKey: opts.apiKey,
+      spriteName: opts.name,
+      deployedAt: (/* @__PURE__ */ new Date()).toISOString()
+    },
+    opts.configDir
+  );
+}
+async function waitForDeployHealth(url, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  const healthUrl = `${url.replace(/\/$/, "")}/health`;
+  let lastStatus = 0;
+  while (Date.now() < deadline) {
+    try {
+      const res = await fetch(healthUrl);
+      lastStatus = res.status;
+      if (res.ok) return;
+    } catch {
+    }
+    await new Promise((r) => setTimeout(r, 2e3));
+  }
+  throw new Error(
+    `Deploy health check timed out (${healthUrl}${lastStatus ? `, last status ${lastStatus}` : ""})`
+  );
+}
+function generateSecret(prefix) {
+  const bytes = new Uint8Array(24);
+  crypto.getRandomValues(bytes);
+  const b64 = btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  return `${prefix}${b64}`;
+}
+async function runBun(args) {
+  const { execFile } = __require("child_process");
+  const { promisify } = __require("util");
+  const execFileAsync = promisify(execFile);
+  try {
+    await execFileAsync("bun", args);
+  } catch (err) {
+    throw new Error(
+      `bun ${args[0]} failed (exit ${err.code ?? "?"}): ${err.stderr ?? err.message}`
+    );
+  }
+}
+function generateServerEntrypoint(opts) {
+  return `
+import { TenantPool, startServer } from 'trellis/server';
+import { readConfig, defaultLocalConfig, writeConfig } from 'trellis/client';
+import { join } from 'path';
+import { existsSync } from 'fs';
+
+const dbPath = '/home/sprite/trellis-db/data';
+const configDir = '/home/sprite/trellis-db';
+
+writeConfig(defaultLocalConfig(dbPath, {
+  apiKey: '${opts.apiKey}',
+  jwtSecret: '${opts.jwtSecret}',
+  port: ${opts.port},
+}), configDir);
+
+const config = readConfig(configDir)!;
+// Sprites VMs lack better-sqlite3 native bindings \u2014 use WASM sql.js backend.
+const pool = new TenantPool(dbPath, { backend: { backend: 'sqljs' } });
+await pool.preload();
+
+const server = startServer({ port: ${opts.port}, config, pool });
+
+console.log('Trellis DB running on port ${opts.port}');
+console.log(\`Listening on port ${opts.port}\`);
+`;
+}
+
+export {
+  DeployNameError,
+  normalizeDeployName,
+  validateDeployName,
+  buildDeployUrl,
+  SPRITE_PUBLIC_HTTP_PORT,
+  deploy
+};