trellis 3.2.0 → 3.2.2

package/dist/chunk-KZYJJIRN.js

@@ -1,946 +0,0 @@
-import {
-  parseSimple
-} from "./chunk-X46IECAC.js";
-import {
-  QueryEngine
-} from "./chunk-2I5JU73Y.js";
-
-// src/server/server.ts
-import { existsSync, readFileSync } from "fs";
-import { dirname, join } from "path";
-import { fileURLToPath } from "url";
-
-// src/server/auth.ts
-var ANONYMOUS = {
-  userId: null,
-  tenantId: null,
-  roles: [],
-  claims: {},
-  authenticated: false
-};
-function base64UrlEncode(input) {
-  return btoa(String.fromCharCode(...input)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function base64UrlDecode(input) {
-  const padded = input.replace(/-/g, "+").replace(/_/g, "/");
-  const padLen = (4 - padded.length % 4) % 4;
-  const base64 = padded + "=".repeat(padLen);
-  const binary = atob(base64);
-  return Uint8Array.from(binary, (c) => c.charCodeAt(0));
-}
-async function hmacKey(secret) {
-  return crypto.subtle.importKey(
-    "raw",
-    new TextEncoder().encode(secret),
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["sign", "verify"]
-  );
-}
-async function signJwt(payload, secret, expiresInSeconds = 86400) {
-  const header = { alg: "HS256", typ: "JWT" };
-  const now = Math.floor(Date.now() / 1e3);
-  const claims = { iat: now, exp: now + expiresInSeconds, ...payload };
-  const enc = new TextEncoder();
-  const headerB64 = base64UrlEncode(enc.encode(JSON.stringify(header)));
-  const payloadB64 = base64UrlEncode(enc.encode(JSON.stringify(claims)));
-  const signing = `${headerB64}.${payloadB64}`;
-  const key = await hmacKey(secret);
-  const sig = await crypto.subtle.sign("HMAC", key, enc.encode(signing));
-  const sigB64 = base64UrlEncode(new Uint8Array(sig));
-  return `${signing}.${sigB64}`;
-}
-async function verifyJwt(token, secret) {
-  const parts = token.split(".");
-  if (parts.length !== 3) return null;
-  const [headerB64, payloadB64, sigB64] = parts;
-  const enc = new TextEncoder();
-  const signing = `${headerB64}.${payloadB64}`;
-  try {
-    const key = await hmacKey(secret);
-    const sigRaw = base64UrlDecode(sigB64);
-    const sigBuf = sigRaw.buffer.slice(
-      sigRaw.byteOffset,
-      sigRaw.byteOffset + sigRaw.byteLength
-    );
-    const valid = await crypto.subtle.verify(
-      "HMAC",
-      key,
-      sigBuf,
-      enc.encode(signing)
-    );
-    if (!valid) return null;
-    const claims = JSON.parse(
-      new TextDecoder().decode(base64UrlDecode(payloadB64))
-    );
-    const now = Math.floor(Date.now() / 1e3);
-    if (typeof claims.exp === "number" && claims.exp < now) return null;
-    return claims;
-  } catch {
-    return null;
-  }
-}
-async function resolveAuth(authHeader, config) {
-  if (!authHeader) {
-    return config.allowPublic === false ? { ...ANONYMOUS, authenticated: false } : ANONYMOUS;
-  }
-  const token = authHeader.startsWith("Bearer ") ? authHeader.slice(7) : authHeader;
-  if (config.apiKey && token === config.apiKey) {
-    return {
-      userId: "service",
-      tenantId: null,
-      roles: ["admin"],
-      claims: { sub: "service" },
-      authenticated: true
-    };
-  }
-  if (config.jwtSecret) {
-    const claims = await verifyJwt(token, config.jwtSecret);
-    if (claims) {
-      return {
-        userId: claims.sub ?? null,
-        tenantId: claims.tenantId ?? null,
-        roles: Array.isArray(claims.roles) ? claims.roles : typeof claims.role === "string" ? [claims.role] : [],
-        claims,
-        authenticated: true
-      };
-    }
-  }
-  return ANONYMOUS;
-}
-var GOOGLE_PROVIDER = {
-  name: "google",
-  authUrl: "https://accounts.google.com/o/oauth2/v2/auth",
-  tokenUrl: "https://oauth2.googleapis.com/token",
-  userInfoUrl: "https://www.googleapis.com/oauth2/v3/userinfo",
-  scopes: ["openid", "email", "profile"]
-};
-var GITHUB_PROVIDER = {
-  name: "github",
-  authUrl: "https://github.com/login/oauth/authorize",
-  tokenUrl: "https://github.com/login/oauth/access_token",
-  userInfoUrl: "https://api.github.com/user",
-  scopes: ["read:user", "user:email"]
-};
-function buildOAuthUrl(provider, redirectUri, state) {
-  const params = new URLSearchParams({
-    client_id: provider.clientId,
-    redirect_uri: redirectUri,
-    response_type: "code",
-    scope: provider.scopes.join(" "),
-    state
-  });
-  return `${provider.authUrl}?${params}`;
-}
-async function exchangeOAuthCode(provider, code, redirectUri) {
-  const tokenRes = await fetch(provider.tokenUrl, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json"
-    },
-    body: new URLSearchParams({
-      client_id: provider.clientId,
-      client_secret: provider.clientSecret,
-      code,
-      redirect_uri: redirectUri,
-      grant_type: "authorization_code"
-    })
-  });
-  if (!tokenRes.ok) {
-    throw new Error(`OAuth token exchange failed: ${tokenRes.status}`);
-  }
-  const tokenData = await tokenRes.json();
-  const accessToken = tokenData.access_token;
-  const userRes = await fetch(provider.userInfoUrl, {
-    headers: {
-      Authorization: `Bearer ${accessToken}`,
-      Accept: "application/json"
-    }
-  });
-  if (!userRes.ok) {
-    throw new Error(`OAuth user info fetch failed: ${userRes.status}`);
-  }
-  const user = await userRes.json();
-  return {
-    id: String(user.id ?? user.sub ?? ""),
-    email: String(user.email ?? ""),
-    name: String(user.name ?? user.login ?? ""),
-    avatarUrl: user.picture ?? user.avatar_url ?? void 0
-  };
-}
-
-// src/server/permissions.ts
-var PermissionRegistry = class {
-  rules = /* @__PURE__ */ new Map();
-  defaultRule = "authenticated";
-  /**
-   * Register permissions for an entity type.
-   */
-  register(entityType, permissions) {
-    this.rules.set(entityType, permissions);
-  }
-  /**
-   * Set the fallback rule used when an entity type has no declared permissions.
-   */
-  setDefault(rule) {
-    this.defaultRule = rule;
-  }
-  /**
-   * Get the permission rule for a specific operation on an entity type.
-   * Falls back to the default rule if not declared.
-   */
-  getRule(entityType, op) {
-    const def = this.rules.get(entityType);
-    return def?.[op] ?? this.defaultRule;
-  }
-  /**
-   * Check whether an auth context is allowed to perform an operation.
-   */
-  check(auth, entityType, op, entity = null) {
-    const rule = this.getRule(entityType, op);
-    return evaluateRule(rule, auth, entity);
-  }
-  /**
-   * Assert access — throws a PermissionError if denied.
-   */
-  assert(auth, entityType, op, entity = null) {
-    if (!this.check(auth, entityType, op, entity)) {
-      throw new PermissionError(auth, entityType, op);
-    }
-  }
-};
-function evaluateRule(rule, auth, entity) {
-  if (rule === "public") {
-    return true;
-  }
-  if (rule === "authenticated") {
-    return auth.authenticated;
-  }
-  if (rule === "own") {
-    if (!auth.authenticated || !auth.userId) return false;
-    const ownerFact = entity?.facts.find(
-      (f) => f.a === "ownerId" || f.a === "createdBy"
-    );
-    return ownerFact?.v === auth.userId;
-  }
-  if (typeof rule === "object") {
-    if ("role" in rule) {
-      return auth.roles.includes(rule.role);
-    }
-    if ("roles" in rule) {
-      return rule.roles.some((r) => auth.roles.includes(r));
-    }
-    if ("fn" in rule) {
-      try {
-        return rule.fn(auth, entity);
-      } catch {
-        return false;
-      }
-    }
-  }
-  return false;
-}
-var PermissionError = class extends Error {
-  constructor(auth, entityType, op) {
-    const who = auth.authenticated ? `user:${auth.userId}` : "anonymous";
-    super(`Permission denied: ${who} cannot ${op} ${entityType}`);
-    this.auth = auth;
-    this.entityType = entityType;
-    this.op = op;
-    this.name = "PermissionError";
-  }
-  toResponse() {
-    return {
-      error: "Forbidden",
-      message: this.message,
-      code: 403
-    };
-  }
-};
-var PUBLIC_READ = {
-  read: "public",
-  create: "authenticated",
-  update: "authenticated",
-  delete: "authenticated"
-};
-var FULLY_PUBLIC = {
-  read: "public",
-  create: "public",
-  update: "public",
-  delete: "public"
-};
-var OWNER_ONLY = {
-  read: "own",
-  create: "authenticated",
-  update: "own",
-  delete: "own"
-};
-var ADMIN_ONLY = {
-  read: { role: "admin" },
-  create: { role: "admin" },
-  update: { role: "admin" },
-  delete: { role: "admin" }
-};
-
-// src/server/realtime.ts
-var SubscriptionManager = class {
-  clients = /* @__PURE__ */ new Map();
-  pool;
-  permissions;
-  constructor(pool, permissions = null) {
-    this.pool = pool;
-    this.permissions = permissions;
-  }
-  // -------------------------------------------------------------------------
-  // Client lifecycle
-  // -------------------------------------------------------------------------
-  addClient(clientId, ws, auth, tenantId) {
-    this.clients.set(clientId, {
-      id: clientId,
-      ws,
-      subscriptions: /* @__PURE__ */ new Map(),
-      auth,
-      tenantId
-    });
-  }
-  removeClient(clientId) {
-    this.clients.delete(clientId);
-  }
-  // -------------------------------------------------------------------------
-  // Message handling
-  // -------------------------------------------------------------------------
-  async handleMessage(clientId, raw) {
-    const client = this.clients.get(clientId);
-    if (!client) return;
-    let msg;
-    try {
-      msg = JSON.parse(raw);
-    } catch {
-      this._send(client, { type: "error", id: "", message: "Invalid JSON" });
-      return;
-    }
-    if (msg.type === "ping") {
-      this._send(client, { type: "pong" });
-      return;
-    }
-    if (msg.type === "subscribe") {
-      await this._handleSubscribe(client, msg.id, msg.query, msg.tenantId);
-      return;
-    }
-    if (msg.type === "unsubscribe") {
-      client.subscriptions.delete(msg.id);
-      return;
-    }
-  }
-  // -------------------------------------------------------------------------
-  // Notify — called after every mutation
-  // -------------------------------------------------------------------------
-  /**
-   * Re-evaluate all subscriptions for a given tenant and push diffs.
-   * Called after every write op lands.
-   */
-  async notify(tenantId) {
-    const tid = tenantId ?? null;
-    const dead = [];
-    for (const [clientId, client] of this.clients) {
-      if (client.ws.readyState !== 1) {
-        dead.push(clientId);
-        continue;
-      }
-      if (client.tenantId !== tid) continue;
-      for (const [subId, sub] of client.subscriptions) {
-        if (sub.tenantId !== tid) continue;
-        await this._pushUpdate(client, sub);
-      }
-    }
-    for (const id of dead) this.clients.delete(id);
-  }
-  get clientCount() {
-    return this.clients.size;
-  }
-  // -------------------------------------------------------------------------
-  // Private
-  // -------------------------------------------------------------------------
-  async _handleSubscribe(client, subId, queryStr, tenantId) {
-    const tid = tenantId ?? client.tenantId ?? null;
-    let parsedQuery;
-    try {
-      parsedQuery = parseSimple(queryStr);
-    } catch (err) {
-      this._send(client, {
-        type: "error",
-        id: subId,
-        message: `Invalid query: ${err instanceof Error ? err.message : String(err)}`
-      });
-      return;
-    }
-    const kernel = this.pool.get(tid);
-    const engine = new QueryEngine(kernel.getStore());
-    let result;
-    try {
-      const qr = engine.execute(parsedQuery);
-      result = qr.bindings;
-    } catch (err) {
-      this._send(client, {
-        type: "error",
-        id: subId,
-        message: `Query failed: ${err instanceof Error ? err.message : String(err)}`
-      });
-      return;
-    }
-    const sub = {
-      id: subId,
-      query: queryStr,
-      tenantId: tid,
-      auth: client.auth,
-      lastResult: result
-    };
-    client.subscriptions.set(subId, sub);
-    this._send(client, { type: "subscribed", id: subId });
-    this._send(client, {
-      type: "data",
-      id: subId,
-      result,
-      diff: { added: result, updated: [], removed: [] }
-    });
-  }
-  async _pushUpdate(client, sub) {
-    const kernel = this.pool.get(sub.tenantId);
-    const engine = new QueryEngine(kernel.getStore());
-    let newResult;
-    try {
-      const parsed = parseSimple(sub.query);
-      const qr = engine.execute(parsed);
-      newResult = qr.bindings;
-    } catch {
-      return;
-    }
-    const diff = computeDiff(sub.lastResult, newResult);
-    if (diff.added.length === 0 && diff.updated.length === 0 && diff.removed.length === 0) {
-      return;
-    }
-    sub.lastResult = newResult;
-    this._send(client, { type: "data", id: sub.id, result: newResult, diff });
-  }
-  _send(client, payload) {
-    try {
-      client.ws.send(JSON.stringify(payload));
-    } catch {
-    }
-  }
-};
-function entityId(row) {
-  return String(row["?e"] ?? row.id ?? row.e ?? JSON.stringify(row));
-}
-function computeDiff(prev, next) {
-  const prevMap = new Map(prev.map((r) => [entityId(r), r]));
-  const nextMap = new Map(next.map((r) => [entityId(r), r]));
-  const added = [];
-  const updated = [];
-  const removed = [];
-  for (const [id, row] of nextMap) {
-    if (!prevMap.has(id)) {
-      added.push(row);
-    } else if (JSON.stringify(prevMap.get(id)) !== JSON.stringify(row)) {
-      updated.push(row);
-    }
-  }
-  for (const [id, row] of prevMap) {
-    if (!nextMap.has(id)) removed.push(row);
-  }
-  return { added, updated, removed };
-}
-
-// src/server/server.ts
-var __moduleDir = import.meta.dir ?? dirname(fileURLToPath(import.meta.url));
-async function startServer(opts) {
-  return startServerNode(opts);
-}
-var startServerCrossRuntime = startServer;
-function buildServerContext(opts) {
-  const { pool, permissions, config } = opts;
-  const port = opts.port ?? config.port ?? 3e3;
-  const authConfig = {
-    jwtSecret: config.jwtSecret,
-    apiKey: config.apiKey,
-    allowPublic: true
-  };
-  const subs = new SubscriptionManager(pool, permissions ?? null);
-  const handleHttp = async (req) => {
-    const url = new URL(req.url);
-    const path = url.pathname;
-    const auth = await resolveAuth(
-      req.headers.get("authorization"),
-      authConfig
-    );
-    const tenantId = auth.tenantId ?? url.searchParams.get("tenantId") ?? null;
-    try {
-      return await route(req, url, path, auth, tenantId, {
-        pool,
-        permissions: permissions ?? null,
-        subs,
-        authConfig,
-        config,
-        oauthProviders: opts.oauthProviders ?? {}
-      });
-    } catch (err) {
-      if (err instanceof PermissionError) {
-        return json(err.toResponse(), 403);
-      }
-      const msg = err instanceof Error ? err.message : String(err);
-      return json({ error: "Internal Server Error", message: msg }, 500);
-    }
-  };
-  return { port, authConfig, subs, handleHttp };
-}
-async function startServerNode(opts) {
-  const { port, subs, handleHttp } = buildServerContext(opts);
-  const { startNodeServer } = await import("./server/node-adapter.js");
-  return startNodeServer({
-    port,
-    fetch: handleHttp,
-    websocket: {
-      open(ws) {
-        const id = crypto.randomUUID();
-        ws.__clientId = id;
-        subs.addClient(
-          id,
-          ws,
-          {
-            userId: null,
-            tenantId: null,
-            roles: [],
-            claims: {},
-            authenticated: false
-          },
-          null
-        );
-      },
-      async message(ws, raw) {
-        const id = ws.__clientId;
-        await subs.handleMessage(
-          id,
-          typeof raw === "string" ? raw : raw.toString()
-        );
-      },
-      close(ws) {
-        const id = ws.__clientId;
-        subs.removeClient(id);
-      }
-    }
-  });
-}
-async function route(req, url, path, auth, tenantId, ctx) {
-  const method = req.method.toUpperCase();
-  if (method === "GET" && path === "/__trellis/inspector.js") {
-    const candidates = [
-      join(__moduleDir, "db", "inspector.js"),
-      // chunk lives in dist/, inspector in dist/db/
-      join(__moduleDir, "inspector.js")
-      // chunk lives in dist/db/, inspector alongside
-    ];
-    for (const p of candidates) {
-      if (existsSync(p)) {
-        return new Response(readFileSync(p, "utf-8"), {
-          headers: { "Content-Type": "application/javascript; charset=utf-8" }
-        });
-      }
-    }
-    return new Response(
-      "/* Trellis DB Inspector: run `bun run build:inspector` first */",
-      {
-        headers: { "Content-Type": "application/javascript" }
-      }
-    );
-  }
-  if (method === "GET" && path === "/__trellis/trellis.css") {
-    const candidates = [
-      join(__moduleDir, "db", "trellis.css"),
-      join(__moduleDir, "trellis.css")
-    ];
-    for (const p of candidates) {
-      if (existsSync(p)) {
-        return new Response(readFileSync(p, "utf-8"), {
-          headers: { "Content-Type": "text/css; charset=utf-8" }
-        });
-      }
-    }
-    return new Response("/* Trellis CSS not found */", {
-      headers: { "Content-Type": "text/css" }
-    });
-  }
-  if (method === "GET" && (path === "/" || path === "/inspector")) {
-    const html = `<!DOCTYPE html>
-<html lang="en">
-<head>
-  <meta charset="UTF-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title>Trellis DB Inspector</title>
-  <link rel="stylesheet" href="/__trellis/trellis.css">
-</head>
-<body>
-  <script src="/__trellis/inspector.js"></script>
-</body>
-</html>`;
-    return new Response(html, {
-      headers: { "Content-Type": "text/html; charset=utf-8" }
-    });
-  }
-  if (method === "GET" && path === "/health") {
-    const kernel = ctx.pool.get(tenantId);
-    const ops = kernel.readAllOps().length;
-    return json({
-      status: "ok",
-      ops,
-      tenants: ctx.pool.activeTenants().length
-    });
-  }
-  if (path === "/entities" || path === "/entities/") {
-    if (method === "POST") return handleCreate(req, auth, tenantId, ctx);
-    if (method === "GET") return handleList(url, auth, tenantId, ctx);
-  }
-  const entityMatch = path.match(/^\/entities\/([^/]+)$/);
-  if (entityMatch) {
-    const id = decodeURIComponent(entityMatch[1]);
-    if (method === "GET") return handleRead(id, auth, tenantId, ctx);
-    if (method === "PUT" || method === "PATCH")
-      return handleUpdate(req, id, auth, tenantId, ctx);
-    if (method === "DELETE") return handleDelete(id, auth, tenantId, ctx);
-  }
-  if (method === "POST" && path === "/query") {
-    return handleQuery(req, auth, tenantId, ctx);
-  }
-  if (method === "POST" && path === "/upload") {
-    return handleUpload(req, auth, tenantId, ctx);
-  }
-  const fileMatch = path.match(/^\/files\/([^/]+)$/);
-  if (method === "GET" && fileMatch) {
-    return handleFileDownload(fileMatch[1], ctx, tenantId);
-  }
-  if (method === "POST" && path === "/auth/register") {
-    return handleRegister(req, tenantId, ctx);
-  }
-  if (method === "POST" && path === "/auth/login") {
-    return handleLogin(req, tenantId, ctx);
-  }
-  const oauthMatch = path.match(/^\/auth\/oauth\/([^/]+)(\/callback)?$/);
-  if (oauthMatch) {
-    const providerName = oauthMatch[1];
-    const isCallback = !!oauthMatch[2];
-    if (isCallback)
-      return handleOAuthCallback(url, providerName, tenantId, ctx);
-    return handleOAuthRedirect(providerName, url, ctx);
-  }
-  return json({ error: "Not Found" }, 404);
-}
-async function handleCreate(req, auth, tenantId, ctx) {
-  const body = await req.json();
-  if (!body.type) return json({ error: "type is required" }, 400);
-  ctx.permissions?.assert(auth, body.type, "create");
-  const kernel = ctx.pool.get(tenantId);
-  const entityId2 = `${body.type.toLowerCase()}:${crypto.randomUUID()}`;
-  const attrs = {
-    ...body.attributes
-  };
-  if (auth.userId) attrs.createdBy = auth.userId;
-  if (auth.tenantId) attrs.tenantId = auth.tenantId;
-  const result = await kernel.createEntity(
-    entityId2,
-    body.type,
-    attrs,
-    body.links
-  );
-  await ctx.subs.notify(tenantId);
-  return json({ id: entityId2, op: result.op.hash }, 201);
-}
-async function handleRead(id, auth, tenantId, ctx) {
-  const kernel = ctx.pool.get(tenantId);
-  const entity = kernel.getEntity(id);
-  if (!entity) return json({ error: "Not Found" }, 404);
-  ctx.permissions?.assert(auth, entity.type, "read", entity);
-  return json(entityToJson(entity));
-}
-async function handleUpdate(req, id, auth, tenantId, ctx) {
-  const kernel = ctx.pool.get(tenantId);
-  const entity = kernel.getEntity(id);
-  if (!entity) return json({ error: "Not Found" }, 404);
-  ctx.permissions?.assert(auth, entity.type, "update", entity);
-  const updates = await req.json();
-  await kernel.updateEntity(id, updates);
-  await ctx.subs.notify(tenantId);
-  return json({ id, updated: true });
-}
-async function handleDelete(id, auth, tenantId, ctx) {
-  const kernel = ctx.pool.get(tenantId);
-  const entity = kernel.getEntity(id);
-  if (!entity) return json({ error: "Not Found" }, 404);
-  ctx.permissions?.assert(auth, entity.type, "delete", entity);
-  await kernel.deleteEntity(id);
-  await ctx.subs.notify(tenantId);
-  return json({ id, deleted: true });
-}
-async function handleList(url, auth, tenantId, ctx) {
-  const type = url.searchParams.get("type") ?? void 0;
-  const limit = parseInt(url.searchParams.get("limit") ?? "100");
-  const offset = parseInt(url.searchParams.get("offset") ?? "0");
-  const kernel = ctx.pool.get(tenantId);
-  let entities = kernel.listEntities(type);
-  if (ctx.permissions && type) {
-    entities = entities.filter(
-      (e) => ctx.permissions.check(auth, e.type, "read", e)
-    );
-  }
-  const page = entities.slice(offset, offset + limit);
-  return json({
-    data: page.map(entityToJson),
-    total: entities.length,
-    limit,
-    offset
-  });
-}
-async function handleQuery(req, auth, tenantId, ctx) {
-  const body = await req.json();
-  if (!body.query) return json({ error: "query is required" }, 400);
-  let parsed;
-  try {
-    parsed = parseSimple(body.query);
-  } catch (err) {
-    return json({ error: "Invalid query", message: String(err) }, 400);
-  }
-  const kernel = ctx.pool.get(tenantId);
-  const engine = new QueryEngine(kernel.getStore());
-  const result = engine.execute(parsed);
-  return json({
-    bindings: result.bindings,
-    executionTime: result.executionTime
-  });
-}
-async function handleUpload(req, auth, tenantId, ctx) {
-  if (!auth.authenticated && ctx.config.apiKey) {
-    return json({ error: "Unauthorized" }, 401);
-  }
-  const contentType = req.headers.get("content-type") ?? "application/octet-stream";
-  const buffer = new Uint8Array(await req.arrayBuffer());
-  const hashBuf = await crypto.subtle.digest("SHA-256", buffer);
-  const hash = `blob:${Array.from(new Uint8Array(hashBuf)).map((b) => b.toString(16).padStart(2, "0")).join("")}`;
-  const kernel = ctx.pool.get(tenantId);
-  const backend = kernel.getBackend();
-  if (!backend.hasBlob(hash)) {
-    backend.putBlob(hash, buffer);
-  }
-  return json({ hash, size: buffer.length, contentType }, 201);
-}
-async function handleFileDownload(hash, ctx, tenantId) {
-  const kernel = ctx.pool.get(tenantId);
-  const backend = kernel.getBackend();
-  const blob = backend.getBlob(hash);
-  if (!blob) return json({ error: "Not Found" }, 404);
-  const cleanBuf = blob.buffer.slice(
-    blob.byteOffset,
-    blob.byteOffset + blob.byteLength
-  );
-  return new Response(cleanBuf, {
-    headers: { "Content-Type": "application/octet-stream" }
-  });
-}
-async function handleRegister(req, tenantId, ctx) {
-  if (!ctx.config.jwtSecret) {
-    return json({ error: "Auth not configured (no jwtSecret)" }, 501);
-  }
-  const body = await req.json();
-  if (!body.email || !body.password) {
-    return json({ error: "email and password are required" }, 400);
-  }
-  const kernel = ctx.pool.get(tenantId);
-  const existing = kernel.listEntities("User", { email: body.email });
-  if (existing.length > 0) {
-    return json({ error: "Email already registered" }, 409);
-  }
-  const userId = `user:${crypto.randomUUID()}`;
-  const pwHash = await hashPassword(body.password);
-  await kernel.createEntity(userId, "User", {
-    email: body.email,
-    name: body.name ?? "",
-    passwordHash: pwHash,
-    role: "user",
-    ...tenantId ? { tenantId } : {}
-  });
-  const token = await signJwt(
-    { sub: userId, email: body.email, roles: ["user"], tenantId },
-    ctx.config.jwtSecret
-  );
-  return json({ token, userId }, 201);
-}
-async function handleLogin(req, tenantId, ctx) {
-  if (!ctx.config.jwtSecret) {
-    return json({ error: "Auth not configured (no jwtSecret)" }, 501);
-  }
-  const body = await req.json();
-  if (!body.email || !body.password) {
-    return json({ error: "email and password are required" }, 400);
-  }
-  const kernel = ctx.pool.get(tenantId);
-  const users = kernel.listEntities("User", { email: body.email });
-  if (users.length === 0) {
-    return json({ error: "Invalid credentials" }, 401);
-  }
-  const user = users[0];
-  const pwHashFact = user.facts.find((f) => f.a === "passwordHash");
-  const roleFact = user.facts.find((f) => f.a === "role");
-  if (!pwHashFact || !await verifyPassword(body.password, String(pwHashFact.v))) {
-    return json({ error: "Invalid credentials" }, 401);
-  }
-  const role = String(roleFact?.v ?? "user");
-  const token = await signJwt(
-    { sub: user.id, email: body.email, roles: [role], tenantId },
-    ctx.config.jwtSecret
-  );
-  return json({ token, userId: user.id });
-}
-function handleOAuthRedirect(providerName, url, ctx) {
-  const provider = ctx.oauthProviders[providerName] ?? getBuiltinProvider(providerName, ctx);
-  if (!provider)
-    return json({ error: `Unknown provider: ${providerName}` }, 400);
-  const redirectUri = `${url.origin}/auth/oauth/${providerName}/callback`;
-  const state = crypto.randomUUID();
-  const authUrl = buildOAuthUrl(provider, redirectUri, state);
-  return Response.redirect(authUrl, 302);
-}
-async function handleOAuthCallback(url, providerName, tenantId, ctx) {
-  if (!ctx.config.jwtSecret) {
-    return json({ error: "Auth not configured (no jwtSecret)" }, 501);
-  }
-  const code = url.searchParams.get("code");
-  if (!code) return json({ error: "Missing code" }, 400);
-  const provider = ctx.oauthProviders[providerName] ?? getBuiltinProvider(providerName, ctx);
-  if (!provider)
-    return json({ error: `Unknown provider: ${providerName}` }, 400);
-  const redirectUri = `${url.origin}/auth/oauth/${providerName}/callback`;
-  let profile;
-  try {
-    profile = await exchangeOAuthCode(provider, code, redirectUri);
-  } catch (err) {
-    return json({ error: "OAuth exchange failed", message: String(err) }, 400);
-  }
-  const kernel = ctx.pool.get(tenantId);
-  const oauthId = `oauth:${providerName}:${profile.id}`;
-  let users = kernel.listEntities("User", { oauthId });
-  let userId;
-  if (users.length === 0) {
-    userId = `user:${crypto.randomUUID()}`;
-    await kernel.createEntity(userId, "User", {
-      email: profile.email,
-      name: profile.name,
-      avatarUrl: profile.avatarUrl ?? "",
-      oauthId,
-      oauthProvider: providerName,
-      role: "user",
-      ...tenantId ? { tenantId } : {}
-    });
-  } else {
-    userId = users[0].id;
-  }
-  const token = await signJwt(
-    { sub: userId, email: profile.email, roles: ["user"], tenantId },
-    ctx.config.jwtSecret
-  );
-  return json({ token, userId });
-}
-function getBuiltinProvider(name, ctx) {
-  if (name === "google") {
-    const cid = process.env.GOOGLE_CLIENT_ID;
-    const csec = process.env.GOOGLE_CLIENT_SECRET;
-    if (!cid || !csec) return null;
-    return { ...GOOGLE_PROVIDER, clientId: cid, clientSecret: csec };
-  }
-  if (name === "github") {
-    const cid = process.env.GITHUB_CLIENT_ID;
-    const csec = process.env.GITHUB_CLIENT_SECRET;
-    if (!cid || !csec) return null;
-    return { ...GITHUB_PROVIDER, clientId: cid, clientSecret: csec };
-  }
-  return null;
-}
-async function hashPassword(password) {
-  const salt = crypto.randomUUID().replace(/-/g, "");
-  const enc = new TextEncoder();
-  const keyMat = await crypto.subtle.importKey(
-    "raw",
-    enc.encode(password),
-    "PBKDF2",
-    false,
-    ["deriveBits"]
-  );
-  const bits = await crypto.subtle.deriveBits(
-    {
-      name: "PBKDF2",
-      salt: enc.encode(salt),
-      iterations: 1e5,
-      hash: "SHA-256"
-    },
-    keyMat,
-    256
-  );
-  const hash = Array.from(new Uint8Array(bits)).map((b) => b.toString(16).padStart(2, "0")).join("");
-  return `${salt}:${hash}`;
-}
-async function verifyPassword(password, stored) {
-  const [salt, expectedHash] = stored.split(":");
-  if (!salt || !expectedHash) return false;
-  const enc = new TextEncoder();
-  const keyMat = await crypto.subtle.importKey(
-    "raw",
-    enc.encode(password),
-    "PBKDF2",
-    false,
-    ["deriveBits"]
-  );
-  const bits = await crypto.subtle.deriveBits(
-    {
-      name: "PBKDF2",
-      salt: enc.encode(salt),
-      iterations: 1e5,
-      hash: "SHA-256"
-    },
-    keyMat,
-    256
-  );
-  const hash = Array.from(new Uint8Array(bits)).map((b) => b.toString(16).padStart(2, "0")).join("");
-  return hash === expectedHash;
-}
-function entityToJson(entity) {
-  const attrs = {};
-  for (const f of entity.facts) {
-    if (f.a !== "type") {
-      attrs[f.a] = f.v;
-    }
-  }
-  return { id: entity.id, type: entity.type, ...attrs };
-}
-function json(data, status = 200) {
-  return new Response(JSON.stringify(data), {
-    status,
-    headers: { "Content-Type": "application/json" }
-  });
-}
-
-export {
-  ANONYMOUS,
-  signJwt,
-  verifyJwt,
-  resolveAuth,
-  GOOGLE_PROVIDER,
-  GITHUB_PROVIDER,
-  buildOAuthUrl,
-  exchangeOAuthCode,
-  PermissionRegistry,
-  PermissionError,
-  PUBLIC_READ,
-  FULLY_PUBLIC,
-  OWNER_ONLY,
-  ADMIN_ONLY,
-  SubscriptionManager,
-  startServer,
-  startServerCrossRuntime
-};