trellis 3.2.0 → 3.2.2

package/dist/chunk-CAG4FULI.js

@@ -0,0 +1,121 @@
+// src/server/sprites.ts
+import { execFile, spawn } from "child_process";
+import { promisify } from "util";
+var execFileAsync = promisify(execFile);
+async function runSpriteCmd(args) {
+  try {
+    const { stdout } = await execFileAsync("sprite", args);
+    return stdout.trim();
+  } catch (err) {
+    throw new Error(
+      `sprite ${args[0]} failed (exit ${err.code ?? "?"}): ${err.stderr ?? err.message}`
+    );
+  }
+}
+async function runSpriteExec(spriteName, shellCommand, extraArgs = []) {
+  return runSpriteCmd([
+    "exec",
+    "-s",
+    spriteName,
+    ...extraArgs,
+    "--",
+    "bash",
+    "-c",
+    shellCommand
+  ]);
+}
+async function runSpriteCopy(localPath, spriteName, remotePath) {
+  try {
+    await execFileAsync("sprite", [
+      "exec",
+      "-s",
+      spriteName,
+      "--file",
+      `${localPath}:${remotePath}`,
+      "echo",
+      "uploaded"
+    ]);
+  } catch (err) {
+    throw new Error(
+      `sprite file upload failed (exit ${err.code ?? "?"}): ${err.stderr ?? err.message}`
+    );
+  }
+}
+var SPRITE_ENSURE_BUN_SH = `
+set -e
+export PATH="$HOME/.bun/bin:$PATH"
+if ! command -v bun >/dev/null 2>&1; then
+  curl -fsSL https://bun.sh/install | bash
+  export PATH="$HOME/.bun/bin:$PATH"
+fi
+command -v bun
+`.trim();
+function parseSpriteUrlOutput(stdout) {
+  const match = stdout.match(/URL:\s*(https:\/\/\S+)/i);
+  if (!match) {
+    throw new Error(`Could not parse sprite URL from output: ${stdout.trim()}`);
+  }
+  return match[1].replace(/\/$/, "");
+}
+async function resolveSpritePublicUrl(spriteName) {
+  const out = await runSpriteCmd(["url", "-s", spriteName]);
+  return parseSpriteUrlOutput(out);
+}
+async function ensureSpritePublicAccess(spriteName) {
+  try {
+    await runSpriteCmd(["url", "update", "--auth", "public", "-s", spriteName]);
+  } catch (err) {
+    const msg = String(err.message ?? err);
+    if (/already|unchanged|public/i.test(msg)) return;
+    throw err;
+  }
+}
+async function ensureSprite(spriteName) {
+  try {
+    await runSpriteCmd(["create", spriteName, "--skip-console"]);
+  } catch (err) {
+    const msg = String(err.message ?? err);
+    if (/already exists|duplicate|conflict/i.test(msg)) return;
+    throw err;
+  }
+}
+async function runSpriteInteractive(args) {
+  return new Promise((resolve, reject) => {
+    const proc = spawn("sprite", args, { stdio: "inherit" });
+    proc.on("close", (code) => {
+      if (code !== 0)
+        reject(new Error(`sprite ${args[0]} failed (exit ${code})`));
+      else resolve();
+    });
+    proc.on("error", reject);
+  });
+}
+async function assertSpriteCli() {
+  await runSpriteCmd(["--version"]).catch(() => {
+    throw new Error(
+      "`sprite` CLI not found. Install it from https://docs.sprites.dev and authenticate."
+    );
+  });
+}
+function resolveSprite(explicitName) {
+  if (explicitName) {
+    return explicitName;
+  }
+  throw new Error(
+    "No sprite specified. Use --sprite <name> or set an active sprite with `trellis vm use <name>`"
+  );
+}
+
+export {
+  runSpriteCmd,
+  runSpriteExec,
+  runSpriteCopy,
+  SPRITE_ENSURE_BUN_SH,
+  parseSpriteUrlOutput,
+  resolveSpritePublicUrl,
+  ensureSpritePublicAccess,
+  ensureSprite,
+  runSpriteInteractive,
+  assertSpriteCli,
+  resolveSprite
+};

package/dist/{chunk-GD5QJXSS.js → chunk-FWRS4CSC.js}

@@ -10,10 +10,10 @@ import {
   init_merge,
   init_milestone,
   init_op_log
-} from "./chunk-B3ZIFA2O.js";
+} from "./chunk-VBYUTRXX.js";
 import {
   init_types
-} from "./chunk-BXSTJVE3.js";
+} from "./chunk-N6MYZT4O.js";
 import {
   init_ops,
   isVcsOp

package/dist/{chunk-36VSSTL7.js → chunk-GU374KWZ.js}

@@ -1,7 +1,7 @@
 import {
   decisionEntityId,
   init_types
-} from "./chunk-BXSTJVE3.js";
+} from "./chunk-N6MYZT4O.js";
 import {
   createVcsOp,
   init_ops

package/dist/{chunk-3GDRZTAW.js → chunk-H6JB3PZ3.js}

@@ -1,6 +1,6 @@
 import {
   TrellisDb
-} from "./chunk-NZWFNHCS.js";
+} from "./chunk-J2TXUFCZ.js";
 
 // src/react/provider.tsx
 import React, {

package/dist/{chunk-ZHVI7BQN.js → chunk-IZX2PLIB.js}

@@ -1,3 +1,6 @@
+import {
+  DEFAULT_TENANT
+} from "./chunk-SGMDTWJJ.js";
 import {
   rel
 } from "./chunk-44FFQKQX.js";
@@ -5,14 +8,14 @@ import {
   entityRecordToPlain,
   hydrateBindings,
   resolveRelations
-} from "./chunk-BRGYDO7D.js";
+} from "./chunk-JUEMDWLU.js";
 import {
   parseSimple
 } from "./chunk-X5FLTRUB.js";
 
 // src/server/server.ts
-import { existsSync, readFileSync } from "fs";
-import { dirname, join } from "path";
+import { existsSync as existsSync2, readFileSync } from "fs";
+import { dirname, join as join2 } from "path";
 import { fileURLToPath } from "url";
 
 // src/server/auth.ts
@@ -367,14 +370,124 @@ async function hydrateAndResolve(kernel, bindings, entityType, resolve) {
   });
 }
 
+// src/server/usage-meter.ts
+import { existsSync, readdirSync, statSync } from "fs";
+import { join } from "path";
+var EMPTY_BUCKET = () => ({
+  graph_io: 0,
+  storage_bytes: 0,
+  egress_bytes: 0
+});
+function resolveUsageTenantId(tenantId) {
+  return tenantId ?? DEFAULT_TENANT;
+}
+function dayKey(date) {
+  return date.toISOString().slice(0, 10);
+}
+function dirSize(dir) {
+  let total = 0;
+  for (const ent of readdirSync(dir, { withFileTypes: true })) {
+    const p = join(dir, ent.name);
+    if (ent.isDirectory()) total += dirSize(p);
+    else if (ent.isFile()) total += statSync(p).size;
+  }
+  return total;
+}
+function sampleTenantStorage(pool, tenantId) {
+  let total = 0;
+  const sqlitePath = pool.dbFilePath(tenantId);
+  if (existsSync(sqlitePath)) {
+    total += statSync(sqlitePath).size;
+  }
+  const blobDir = join(pool.dataPath(), "blobs");
+  if (existsSync(blobDir)) {
+    total += dirSize(blobDir);
+  }
+  return total;
+}
+function verifyAdminKey(req) {
+  const expected = process.env.TURTLEDB_ADMIN_KEY;
+  if (!expected) return false;
+  const auth = req.headers.get("authorization");
+  if (auth?.startsWith("Bearer ")) {
+    return auth.slice("Bearer ".length) === expected;
+  }
+  return req.headers.get("x-turtledb-admin-key") === expected;
+}
+var UsageMeter = class {
+  buckets = /* @__PURE__ */ new Map();
+  storageSampledAt = /* @__PURE__ */ new Map();
+  now;
+  constructor(opts = {}) {
+    this.now = opts.now ?? (() => /* @__PURE__ */ new Date());
+  }
+  recordGraphIo(tenantId, count = 1) {
+    if (count <= 0) return;
+    const bucket = this._bucket(tenantId);
+    bucket.graph_io += count;
+  }
+  recordEgress(tenantId, bytes) {
+    if (bytes <= 0) return;
+    const bucket = this._bucket(tenantId);
+    bucket.egress_bytes += bytes;
+  }
+  /** Set storage gauge for the current day (from sampler, not incremental). */
+  recordStorage(tenantId, bytes) {
+    const bucket = this._bucket(tenantId);
+    bucket.storage_bytes = bytes;
+    this.storageSampledAt.set(`${tenantId}:${this._today()}`, this.now().toISOString());
+  }
+  sampleStorage(pool, tenantId) {
+    const id = resolveUsageTenantId(tenantId);
+    const bytes = sampleTenantStorage(pool, id);
+    this.recordStorage(id, bytes);
+    return bytes;
+  }
+  getUsage(tenantId, day) {
+    const d = day ?? this._today();
+    const tenantBuckets = this.buckets.get(tenantId);
+    const meters = tenantBuckets?.get(d) ?? EMPTY_BUCKET();
+    const sampledAt = this.storageSampledAt.get(`${tenantId}:${d}`);
+    return {
+      tenantId,
+      day: d,
+      meters: { ...meters },
+      ...sampledAt ? { storageSampledAt: sampledAt } : {}
+    };
+  }
+  /** All day keys recorded for a tenant (sorted ascending). */
+  listDays(tenantId) {
+    const tenantBuckets = this.buckets.get(tenantId);
+    if (!tenantBuckets) return [];
+    return Array.from(tenantBuckets.keys()).sort();
+  }
+  _today() {
+    return dayKey(this.now());
+  }
+  _bucket(tenantId) {
+    const id = resolveUsageTenantId(tenantId);
+    const d = this._today();
+    if (!this.buckets.has(id)) {
+      this.buckets.set(id, /* @__PURE__ */ new Map());
+    }
+    const tenantBuckets = this.buckets.get(id);
+    if (!tenantBuckets.has(d)) {
+      tenantBuckets.set(d, EMPTY_BUCKET());
+    }
+    return tenantBuckets.get(d);
+  }
+};
+
 // src/server/realtime.ts
 var SubscriptionManager = class {
   clients = /* @__PURE__ */ new Map();
   pool;
   permissions;
-  constructor(pool, permissions = null) {
+  meter;
+  constructor(pool, permissions = null, meter = null) {
     this.pool = pool;
     this.permissions = permissions;
+    this.meter = meter;
   }
   // -------------------------------------------------------------------------
   // Client lifecycle
@@ -463,10 +576,11 @@ var SubscriptionManager = class {
       });
       return;
     }
-    const kernel = this.pool.get(tid);
+    const kernel = await this.pool.preload(tid);
     let result;
     try {
       const qr = await kernel.query(parsedQuery);
+      this._recordGraphIo(tid);
       result = await hydrateAndResolve(
         kernel,
         qr.bindings,
@@ -502,11 +616,12 @@ var SubscriptionManager = class {
     });
   }
   async _pushUpdate(client, sub) {
-    const kernel = this.pool.get(sub.tenantId);
+    const kernel = await this.pool.preload(sub.tenantId);
     let newResult;
     try {
       const parsed = parseSimple(sub.query);
       const qr = await kernel.query(parsed);
+      this._recordGraphIo(sub.tenantId);
       newResult = await hydrateAndResolve(
         kernel,
         qr.bindings,
@@ -530,9 +645,17 @@ var SubscriptionManager = class {
       ...resolved ? { resolved: true } : {}
     });
   }
+  _recordGraphIo(tenantId) {
+    this.meter?.recordGraphIo(resolveUsageTenantId(tenantId));
+  }
   _send(client, payload) {
+    const data = JSON.stringify(payload);
+    if (this.meter) {
+      const tid = resolveUsageTenantId(client.tenantId ?? DEFAULT_TENANT);
+      this.meter.recordEgress(tid, new TextEncoder().encode(data).length);
+    }
     try {
-      client.ws.send(JSON.stringify(payload));
+      client.ws.send(data);
     } catch {
     }
   }
@@ -573,7 +696,8 @@ function buildServerContext(opts) {
     apiKey: config.apiKey,
     allowPublic: true
   };
-  const subs = new SubscriptionManager(pool, permissions ?? null);
+  const meter = new UsageMeter();
+  const subs = new SubscriptionManager(pool, permissions ?? null, meter);
   const handleHttp = async (req) => {
     const url = new URL(req.url);
     const path = url.pathname;
@@ -587,6 +711,7 @@ function buildServerContext(opts) {
         pool,
         permissions: permissions ?? null,
         subs,
+        meter,
         authConfig,
         config,
         oauthProviders: opts.oauthProviders ?? {}
@@ -638,17 +763,20 @@ async function startServerNode(opts) {
     }
   });
 }
+function recordGraphIo(ctx, tenantId) {
+  ctx.meter.recordGraphIo(resolveUsageTenantId(tenantId));
+}
 async function route(req, url, path, auth, tenantId, ctx) {
   const method = req.method.toUpperCase();
   if (method === "GET" && path === "/__trellis/inspector.js") {
     const candidates = [
-      join(__moduleDir, "db", "inspector.js"),
+      join2(__moduleDir, "db", "inspector.js"),
       // chunk lives in dist/, inspector in dist/db/
-      join(__moduleDir, "inspector.js")
+      join2(__moduleDir, "inspector.js")
       // chunk lives in dist/db/, inspector alongside
     ];
     for (const p of candidates) {
-      if (existsSync(p)) {
+      if (existsSync2(p)) {
         return new Response(readFileSync(p, "utf-8"), {
           headers: { "Content-Type": "application/javascript; charset=utf-8" }
         });
@@ -663,11 +791,11 @@ async function route(req, url, path, auth, tenantId, ctx) {
   }
   if (method === "GET" && path === "/__trellis/trellis.css") {
     const candidates = [
-      join(__moduleDir, "db", "trellis.css"),
-      join(__moduleDir, "trellis.css")
+      join2(__moduleDir, "db", "trellis.css"),
+      join2(__moduleDir, "trellis.css")
     ];
     for (const p of candidates) {
-      if (existsSync(p)) {
+      if (existsSync2(p)) {
         return new Response(readFileSync(p, "utf-8"), {
           headers: { "Content-Type": "text/css; charset=utf-8" }
         });
@@ -695,7 +823,7 @@ async function route(req, url, path, auth, tenantId, ctx) {
     });
   }
   if (method === "GET" && path === "/health") {
-    const kernel = ctx.pool.get(tenantId);
+    const kernel = await ctx.pool.preload(tenantId);
     const ops = kernel.readAllOps().length;
     return json({
       status: "ok",
@@ -703,6 +831,9 @@ async function route(req, url, path, auth, tenantId, ctx) {
       tenants: ctx.pool.activeTenants().length
     });
   }
+  if (method === "GET" && path === "/admin/usage") {
+    return handleAdminUsage(req, url, ctx);
+  }
   if (path === "/entities" || path === "/entities/") {
     if (method === "POST") return handleCreate(req, auth, tenantId, ctx);
     if (method === "GET") return handleList(url, auth, tenantId, ctx);
@@ -748,7 +879,7 @@ async function handleCreate(req, auth, tenantId, ctx) {
   const body = await req.json();
   if (!body.type) return json({ error: "type is required" }, 400);
   ctx.permissions?.assert(auth, body.type, "create");
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const entityId2 = `${body.type.toLowerCase()}:${crypto.randomUUID()}`;
   const attrs = {
     ...body.attributes
@@ -761,32 +892,35 @@ async function handleCreate(req, auth, tenantId, ctx) {
     attrs,
     body.links
   );
+  recordGraphIo(ctx, tenantId);
   await ctx.subs.notify(tenantId);
   return json({ id: entityId2, op: result.op.hash }, 201);
 }
 async function handleRead(id, auth, tenantId, ctx) {
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const entity = kernel.getEntity(id);
   if (!entity) return json({ error: "Not Found" }, 404);
   ctx.permissions?.assert(auth, entity.type, "read", entity);
   return json(entityToJson(entity));
 }
 async function handleUpdate(req, id, auth, tenantId, ctx) {
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const entity = kernel.getEntity(id);
   if (!entity) return json({ error: "Not Found" }, 404);
   ctx.permissions?.assert(auth, entity.type, "update", entity);
   const updates = await req.json();
   await kernel.updateEntity(id, updates);
+  recordGraphIo(ctx, tenantId);
   await ctx.subs.notify(tenantId);
   return json({ id, updated: true });
 }
 async function handleDelete(id, auth, tenantId, ctx) {
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const entity = kernel.getEntity(id);
   if (!entity) return json({ error: "Not Found" }, 404);
   ctx.permissions?.assert(auth, entity.type, "delete", entity);
   await kernel.deleteEntity(id);
+  recordGraphIo(ctx, tenantId);
   await ctx.subs.notify(tenantId);
   return json({ id, deleted: true });
 }
@@ -794,7 +928,7 @@ async function handleList(url, auth, tenantId, ctx) {
   const type = url.searchParams.get("type") ?? void 0;
   const limit = parseInt(url.searchParams.get("limit") ?? "100");
   const offset = parseInt(url.searchParams.get("offset") ?? "0");
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   let entities = kernel.listEntities(type);
   if (ctx.permissions && type) {
     entities = entities.filter(
@@ -818,8 +952,9 @@ async function handleQuery(req, auth, tenantId, ctx) {
   } catch (err) {
     return json({ error: "Invalid query", message: String(err) }, 400);
   }
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const result = await kernel.query(parsed);
+  recordGraphIo(ctx, tenantId);
   const bindings = hydrateBindings(
     kernel,
     result.bindings
@@ -832,18 +967,22 @@ async function handleQuery(req, auth, tenantId, ctx) {
 async function handleCreateOntology(req, auth, tenantId, ctx) {
   const schema = await req.json();
   if (!schema || !schema["@id"] || !Array.isArray(schema.fields)) {
-    return json({ error: "A SchemaDefinition (with @id and fields) is required" }, 400);
+    return json(
+      { error: "A SchemaDefinition (with @id and fields) is required" },
+      400
+    );
   }
   if ((schema.tier ?? "user") === "core") {
     return json({ error: "Core ontologies are immutable" }, 403);
   }
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const exists = kernel.listOntologies().some((ont) => ont["@id"] === schema["@id"]);
   if (exists) {
     return json({ id: schema["@id"], registered: false, existed: true }, 200);
   }
   try {
     kernel.createOntology(schema);
+    recordGraphIo(ctx, tenantId);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     if (msg.includes("already exists")) {
@@ -861,7 +1000,7 @@ async function handleUpload(req, auth, tenantId, ctx) {
   const buffer = new Uint8Array(await req.arrayBuffer());
   const hashBuf = await crypto.subtle.digest("SHA-256", buffer);
   const hash = `blob:${Array.from(new Uint8Array(hashBuf)).map((b) => b.toString(16).padStart(2, "0")).join("")}`;
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const backend = kernel.getBackend();
   if (!backend.hasBlob(hash)) {
     backend.putBlob(hash, buffer);
@@ -869,7 +1008,7 @@ async function handleUpload(req, auth, tenantId, ctx) {
   return json({ hash, size: buffer.length, contentType }, 201);
 }
 async function handleFileDownload(hash, ctx, tenantId) {
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const backend = kernel.getBackend();
   const blob = backend.getBlob(hash);
   if (!blob) return json({ error: "Not Found" }, 404);
@@ -877,6 +1016,7 @@ async function handleFileDownload(hash, ctx, tenantId) {
     blob.byteOffset,
     blob.byteOffset + blob.byteLength
   );
+  ctx.meter.recordEgress(resolveUsageTenantId(tenantId), blob.byteLength);
   return new Response(cleanBuf, {
     headers: { "Content-Type": "application/octet-stream" }
   });
@@ -889,7 +1029,7 @@ async function handleRegister(req, tenantId, ctx) {
   if (!body.email || !body.password) {
     return json({ error: "email and password are required" }, 400);
   }
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const existing = kernel.listEntities("User", { email: body.email });
   if (existing.length > 0) {
     return json({ error: "Email already registered" }, 409);
@@ -917,7 +1057,7 @@ async function handleLogin(req, tenantId, ctx) {
   if (!body.email || !body.password) {
     return json({ error: "email and password are required" }, 400);
   }
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const users = kernel.listEntities("User", { email: body.email });
   if (users.length === 0) {
     return json({ error: "Invalid credentials" }, 401);
@@ -960,7 +1100,7 @@ async function handleOAuthCallback(url, providerName, tenantId, ctx) {
   } catch (err) {
     return json({ error: "OAuth exchange failed", message: String(err) }, 400);
   }
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const oauthId = `oauth:${providerName}:${profile.id}`;
   let users = kernel.listEntities("User", { oauthId });
   let userId;
@@ -1046,6 +1186,24 @@ async function verifyPassword(password, stored) {
   const hash = Array.from(new Uint8Array(bits)).map((b) => b.toString(16).padStart(2, "0")).join("");
   return hash === expectedHash;
 }
+function handleAdminUsage(req, url, ctx) {
+  if (!process.env.TURTLEDB_ADMIN_KEY) {
+    return json({ error: "Admin usage not configured" }, 501);
+  }
+  if (!verifyAdminKey(req)) {
+    return json({ error: "Unauthorized" }, 401);
+  }
+  const tenant = url.searchParams.get("tenant");
+  if (!tenant) {
+    return json({ error: "tenant query param is required" }, 400);
+  }
+  const refresh = url.searchParams.get("refresh") === "1";
+  if (refresh) {
+    ctx.meter.sampleStorage(ctx.pool, tenant);
+  }
+  const day = url.searchParams.get("day") ?? void 0;
+  return json(ctx.meter.getUsage(tenant, day));
+}
 function entityToJson(entity) {
   return entityRecordToPlain(entity);
 }
@@ -1071,6 +1229,11 @@ export {
   FULLY_PUBLIC,
   OWNER_ONLY,
   ADMIN_ONLY,
+  resolveUsageTenantId,
+  dayKey,
+  sampleTenantStorage,
+  verifyAdminKey,
+  UsageMeter,
   SubscriptionManager,
   startServer,
   startServerCrossRuntime