trellis 3.2.0 → 3.2.3

package/dist/{chunk-3ETIIPPB.js → chunk-2AACZRII.js}

@@ -1,3 +1,6 @@
+import {
+  DEFAULT_TENANT
+} from "./chunk-JHHEXEDM.js";
 import {
   rel
 } from "./chunk-44FFQKQX.js";
@@ -11,8 +14,8 @@ import {
 } from "./chunk-X5FLTRUB.js";
 
 // src/server/server.ts
-import { existsSync, readFileSync } from "fs";
-import { dirname, join } from "path";
+import { existsSync as existsSync2, readFileSync } from "fs";
+import { dirname, join as join2 } from "path";
 import { fileURLToPath } from "url";
 
 // src/server/auth.ts
@@ -367,14 +370,124 @@ async function hydrateAndResolve(kernel, bindings, entityType, resolve) {
   });
 }
 
+// src/server/usage-meter.ts
+import { existsSync, readdirSync, statSync } from "fs";
+import { join } from "path";
+var EMPTY_BUCKET = () => ({
+  graph_io: 0,
+  storage_bytes: 0,
+  egress_bytes: 0
+});
+function resolveUsageTenantId(tenantId) {
+  return tenantId ?? DEFAULT_TENANT;
+}
+function dayKey(date) {
+  return date.toISOString().slice(0, 10);
+}
+function dirSize(dir) {
+  let total = 0;
+  for (const ent of readdirSync(dir, { withFileTypes: true })) {
+    const p = join(dir, ent.name);
+    if (ent.isDirectory()) total += dirSize(p);
+    else if (ent.isFile()) total += statSync(p).size;
+  }
+  return total;
+}
+function sampleTenantStorage(pool, tenantId) {
+  let total = 0;
+  const sqlitePath = pool.dbFilePath(tenantId);
+  if (existsSync(sqlitePath)) {
+    total += statSync(sqlitePath).size;
+  }
+  const blobDir = join(pool.dataPath(), "blobs");
+  if (existsSync(blobDir)) {
+    total += dirSize(blobDir);
+  }
+  return total;
+}
+function verifyAdminKey(req) {
+  const expected = process.env.TURTLEDB_ADMIN_KEY;
+  if (!expected) return false;
+  const auth = req.headers.get("authorization");
+  if (auth?.startsWith("Bearer ")) {
+    return auth.slice("Bearer ".length) === expected;
+  }
+  return req.headers.get("x-turtledb-admin-key") === expected;
+}
+var UsageMeter = class {
+  buckets = /* @__PURE__ */ new Map();
+  storageSampledAt = /* @__PURE__ */ new Map();
+  now;
+  constructor(opts = {}) {
+    this.now = opts.now ?? (() => /* @__PURE__ */ new Date());
+  }
+  recordGraphIo(tenantId, count = 1) {
+    if (count <= 0) return;
+    const bucket = this._bucket(tenantId);
+    bucket.graph_io += count;
+  }
+  recordEgress(tenantId, bytes) {
+    if (bytes <= 0) return;
+    const bucket = this._bucket(tenantId);
+    bucket.egress_bytes += bytes;
+  }
+  /** Set storage gauge for the current day (from sampler, not incremental). */
+  recordStorage(tenantId, bytes) {
+    const bucket = this._bucket(tenantId);
+    bucket.storage_bytes = bytes;
+    this.storageSampledAt.set(`${tenantId}:${this._today()}`, this.now().toISOString());
+  }
+  sampleStorage(pool, tenantId) {
+    const id = resolveUsageTenantId(tenantId);
+    const bytes = sampleTenantStorage(pool, id);
+    this.recordStorage(id, bytes);
+    return bytes;
+  }
+  getUsage(tenantId, day) {
+    const d = day ?? this._today();
+    const tenantBuckets = this.buckets.get(tenantId);
+    const meters = tenantBuckets?.get(d) ?? EMPTY_BUCKET();
+    const sampledAt = this.storageSampledAt.get(`${tenantId}:${d}`);
+    return {
+      tenantId,
+      day: d,
+      meters: { ...meters },
+      ...sampledAt ? { storageSampledAt: sampledAt } : {}
+    };
+  }
+  /** All day keys recorded for a tenant (sorted ascending). */
+  listDays(tenantId) {
+    const tenantBuckets = this.buckets.get(tenantId);
+    if (!tenantBuckets) return [];
+    return Array.from(tenantBuckets.keys()).sort();
+  }
+  _today() {
+    return dayKey(this.now());
+  }
+  _bucket(tenantId) {
+    const id = resolveUsageTenantId(tenantId);
+    const d = this._today();
+    if (!this.buckets.has(id)) {
+      this.buckets.set(id, /* @__PURE__ */ new Map());
+    }
+    const tenantBuckets = this.buckets.get(id);
+    if (!tenantBuckets.has(d)) {
+      tenantBuckets.set(d, EMPTY_BUCKET());
+    }
+    return tenantBuckets.get(d);
+  }
+};
+
 // src/server/realtime.ts
 var SubscriptionManager = class {
   clients = /* @__PURE__ */ new Map();
   pool;
   permissions;
-  constructor(pool, permissions = null) {
+  meter;
+  constructor(pool, permissions = null, meter = null) {
     this.pool = pool;
     this.permissions = permissions;
+    this.meter = meter;
   }
   // -------------------------------------------------------------------------
   // Client lifecycle
@@ -463,10 +576,11 @@ var SubscriptionManager = class {
       });
       return;
     }
-    const kernel = this.pool.get(tid);
+    const kernel = await this.pool.preload(tid);
     let result;
     try {
       const qr = await kernel.query(parsedQuery);
+      this._recordGraphIo(tid);
       result = await hydrateAndResolve(
         kernel,
         qr.bindings,
@@ -502,11 +616,12 @@ var SubscriptionManager = class {
     });
   }
   async _pushUpdate(client, sub) {
-    const kernel = this.pool.get(sub.tenantId);
+    const kernel = await this.pool.preload(sub.tenantId);
     let newResult;
     try {
       const parsed = parseSimple(sub.query);
       const qr = await kernel.query(parsed);
+      this._recordGraphIo(sub.tenantId);
       newResult = await hydrateAndResolve(
         kernel,
         qr.bindings,
@@ -530,9 +645,17 @@ var SubscriptionManager = class {
       ...resolved ? { resolved: true } : {}
     });
   }
+  _recordGraphIo(tenantId) {
+    this.meter?.recordGraphIo(resolveUsageTenantId(tenantId));
+  }
   _send(client, payload) {
+    const data = JSON.stringify(payload);
+    if (this.meter) {
+      const tid = resolveUsageTenantId(client.tenantId ?? DEFAULT_TENANT);
+      this.meter.recordEgress(tid, new TextEncoder().encode(data).length);
+    }
     try {
-      client.ws.send(JSON.stringify(payload));
+      client.ws.send(data);
     } catch {
     }
   }
@@ -559,6 +682,55 @@ function computeDiff(prev, next) {
   return { added, updated, removed };
 }
 
+// src/server/cors.ts
+var DEFAULT_METHODS = "GET, POST, PUT, DELETE, OPTIONS";
+var DEFAULT_HEADERS = "Content-Type, Authorization";
+function corsEnabledForConfig(apiKey) {
+  return Boolean(process.env.TRELLIS_CORS_ORIGINS) || Boolean(apiKey);
+}
+function allowedOrigins() {
+  const raw = process.env.TRELLIS_CORS_ORIGINS?.trim();
+  if (!raw || raw === "*") return "*";
+  return raw.split(",").map((s) => s.trim()).filter(Boolean);
+}
+function corsHeaders(req) {
+  const origins = allowedOrigins();
+  const requestOrigin = req.headers.get("Origin");
+  let allowOrigin = "*";
+  if (origins !== "*") {
+    if (requestOrigin && origins.includes(requestOrigin)) {
+      allowOrigin = requestOrigin;
+    } else if (origins.length === 1) {
+      allowOrigin = origins[0];
+    } else {
+      allowOrigin = origins[0] ?? "*";
+    }
+  }
+  return {
+    "Access-Control-Allow-Origin": allowOrigin,
+    "Access-Control-Allow-Methods": DEFAULT_METHODS,
+    "Access-Control-Allow-Headers": DEFAULT_HEADERS,
+    Vary: "Origin"
+  };
+}
+function withCors(req, res) {
+  const headers = new Headers(res.headers);
+  for (const [key, value] of Object.entries(corsHeaders(req))) {
+    headers.set(key, value);
+  }
+  return new Response(res.body, {
+    status: res.status,
+    statusText: res.statusText,
+    headers
+  });
+}
+function corsPreflightResponse(req) {
+  return new Response(null, {
+    status: 204,
+    headers: corsHeaders(req)
+  });
+}
+
 // src/server/server.ts
 var __moduleDir = import.meta.dir ?? dirname(fileURLToPath(import.meta.url));
 async function startServer(opts) {
@@ -573,8 +745,10 @@ function buildServerContext(opts) {
     apiKey: config.apiKey,
     allowPublic: true
   };
-  const subs = new SubscriptionManager(pool, permissions ?? null);
-  const handleHttp = async (req) => {
+  const meter = new UsageMeter();
+  const subs = new SubscriptionManager(pool, permissions ?? null, meter);
+  const enableCors = corsEnabledForConfig(config.apiKey);
+  const handleHttpInner = async (req) => {
     const url = new URL(req.url);
     const path = url.pathname;
     const auth = await resolveAuth(
@@ -587,6 +761,7 @@ function buildServerContext(opts) {
         pool,
         permissions: permissions ?? null,
         subs,
+        meter,
         authConfig,
         config,
         oauthProviders: opts.oauthProviders ?? {}
@@ -596,9 +771,30 @@ function buildServerContext(opts) {
         return json(err.toResponse(), 403);
       }
       const msg = err instanceof Error ? err.message : String(err);
-      return json({ error: "Internal Server Error", message: msg }, 500);
+      if (process.env.TRELLIS_DEBUG) {
+        console.error(
+          `[trellis] ${req.method} ${path} \u2192 500:`,
+          msg
+        );
+      }
+      return json(
+        {
+          error: "Internal Server Error",
+          message: msg,
+          method: req.method,
+          path
+        },
+        500
+      );
     }
   };
+  const handleHttp = async (req) => {
+    if (enableCors && req.method === "OPTIONS") {
+      return corsPreflightResponse(req);
+    }
+    const res = await handleHttpInner(req);
+    return enableCors ? withCors(req, res) : res;
+  };
   return { port, authConfig, subs, handleHttp };
 }
 async function startServerNode(opts) {
@@ -638,17 +834,20 @@ async function startServerNode(opts) {
     }
   });
 }
+function recordGraphIo(ctx, tenantId) {
+  ctx.meter.recordGraphIo(resolveUsageTenantId(tenantId));
+}
 async function route(req, url, path, auth, tenantId, ctx) {
   const method = req.method.toUpperCase();
   if (method === "GET" && path === "/__trellis/inspector.js") {
     const candidates = [
-      join(__moduleDir, "db", "inspector.js"),
+      join2(__moduleDir, "db", "inspector.js"),
       // chunk lives in dist/, inspector in dist/db/
-      join(__moduleDir, "inspector.js")
+      join2(__moduleDir, "inspector.js")
       // chunk lives in dist/db/, inspector alongside
     ];
     for (const p of candidates) {
-      if (existsSync(p)) {
+      if (existsSync2(p)) {
         return new Response(readFileSync(p, "utf-8"), {
           headers: { "Content-Type": "application/javascript; charset=utf-8" }
         });
@@ -663,11 +862,11 @@ async function route(req, url, path, auth, tenantId, ctx) {
   }
   if (method === "GET" && path === "/__trellis/trellis.css") {
     const candidates = [
-      join(__moduleDir, "db", "trellis.css"),
-      join(__moduleDir, "trellis.css")
+      join2(__moduleDir, "db", "trellis.css"),
+      join2(__moduleDir, "trellis.css")
     ];
     for (const p of candidates) {
-      if (existsSync(p)) {
+      if (existsSync2(p)) {
         return new Response(readFileSync(p, "utf-8"), {
           headers: { "Content-Type": "text/css; charset=utf-8" }
         });
@@ -695,7 +894,7 @@ async function route(req, url, path, auth, tenantId, ctx) {
     });
   }
   if (method === "GET" && path === "/health") {
-    const kernel = ctx.pool.get(tenantId);
+    const kernel = await ctx.pool.preload(tenantId);
     const ops = kernel.readAllOps().length;
     return json({
       status: "ok",
@@ -703,6 +902,9 @@ async function route(req, url, path, auth, tenantId, ctx) {
       tenants: ctx.pool.activeTenants().length
     });
   }
+  if (method === "GET" && path === "/admin/usage") {
+    return handleAdminUsage(req, url, ctx);
+  }
   if (path === "/entities" || path === "/entities/") {
     if (method === "POST") return handleCreate(req, auth, tenantId, ctx);
     if (method === "GET") return handleList(url, auth, tenantId, ctx);
@@ -748,7 +950,7 @@ async function handleCreate(req, auth, tenantId, ctx) {
   const body = await req.json();
   if (!body.type) return json({ error: "type is required" }, 400);
   ctx.permissions?.assert(auth, body.type, "create");
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const entityId2 = `${body.type.toLowerCase()}:${crypto.randomUUID()}`;
   const attrs = {
     ...body.attributes
@@ -761,32 +963,35 @@ async function handleCreate(req, auth, tenantId, ctx) {
     attrs,
     body.links
   );
+  recordGraphIo(ctx, tenantId);
   await ctx.subs.notify(tenantId);
   return json({ id: entityId2, op: result.op.hash }, 201);
 }
 async function handleRead(id, auth, tenantId, ctx) {
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const entity = kernel.getEntity(id);
   if (!entity) return json({ error: "Not Found" }, 404);
   ctx.permissions?.assert(auth, entity.type, "read", entity);
   return json(entityToJson(entity));
 }
 async function handleUpdate(req, id, auth, tenantId, ctx) {
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const entity = kernel.getEntity(id);
   if (!entity) return json({ error: "Not Found" }, 404);
   ctx.permissions?.assert(auth, entity.type, "update", entity);
   const updates = await req.json();
   await kernel.updateEntity(id, updates);
+  recordGraphIo(ctx, tenantId);
   await ctx.subs.notify(tenantId);
   return json({ id, updated: true });
 }
 async function handleDelete(id, auth, tenantId, ctx) {
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const entity = kernel.getEntity(id);
   if (!entity) return json({ error: "Not Found" }, 404);
   ctx.permissions?.assert(auth, entity.type, "delete", entity);
   await kernel.deleteEntity(id);
+  recordGraphIo(ctx, tenantId);
   await ctx.subs.notify(tenantId);
   return json({ id, deleted: true });
 }
@@ -794,7 +999,7 @@ async function handleList(url, auth, tenantId, ctx) {
   const type = url.searchParams.get("type") ?? void 0;
   const limit = parseInt(url.searchParams.get("limit") ?? "100");
   const offset = parseInt(url.searchParams.get("offset") ?? "0");
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   let entities = kernel.listEntities(type);
   if (ctx.permissions && type) {
     entities = entities.filter(
@@ -818,8 +1023,9 @@ async function handleQuery(req, auth, tenantId, ctx) {
   } catch (err) {
     return json({ error: "Invalid query", message: String(err) }, 400);
   }
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const result = await kernel.query(parsed);
+  recordGraphIo(ctx, tenantId);
   const bindings = hydrateBindings(
     kernel,
     result.bindings
@@ -829,21 +1035,73 @@ async function handleQuery(req, auth, tenantId, ctx) {
     executionTime: result.executionTime
   });
 }
+async function readJsonObject(req, route2) {
+  const raw = await req.text();
+  if (!raw.trim()) {
+    if (process.env.TRELLIS_DEBUG) {
+      console.warn(`[trellis] ${req.method} ${route2}: empty request body`);
+    }
+    return {
+      ok: false,
+      response: json(
+        {
+          error: "Bad Request",
+          message: "Request body is empty \u2014 client may not have sent JSON (common on iOS HTTP dev)",
+          method: req.method,
+          path: route2,
+          bodyBytes: 0
+        },
+        400
+      )
+    };
+  }
+  try {
+    const data = JSON.parse(raw);
+    return { ok: true, data };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (process.env.TRELLIS_DEBUG) {
+      console.warn(
+        `[trellis] ${req.method} ${route2}: invalid JSON (${raw.length}B):`,
+        msg
+      );
+    }
+    return {
+      ok: false,
+      response: json(
+        {
+          error: "Bad Request",
+          message: `Invalid JSON: ${msg}`,
+          method: req.method,
+          path: route2,
+          bodyBytes: raw.length
+        },
+        400
+      )
+    };
+  }
+}
 async function handleCreateOntology(req, auth, tenantId, ctx) {
-  const schema = await req.json();
+  const parsed = await readJsonObject(req, "/ontologies");
+  if (!parsed.ok) return parsed.response;
+  const schema = parsed.data;
   if (!schema || !schema["@id"] || !Array.isArray(schema.fields)) {
-    return json({ error: "A SchemaDefinition (with @id and fields) is required" }, 400);
+    return json(
+      { error: "A SchemaDefinition (with @id and fields) is required" },
+      400
+    );
   }
   if ((schema.tier ?? "user") === "core") {
     return json({ error: "Core ontologies are immutable" }, 403);
   }
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const exists = kernel.listOntologies().some((ont) => ont["@id"] === schema["@id"]);
   if (exists) {
     return json({ id: schema["@id"], registered: false, existed: true }, 200);
   }
   try {
     kernel.createOntology(schema);
+    recordGraphIo(ctx, tenantId);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     if (msg.includes("already exists")) {
@@ -861,7 +1119,7 @@ async function handleUpload(req, auth, tenantId, ctx) {
   const buffer = new Uint8Array(await req.arrayBuffer());
   const hashBuf = await crypto.subtle.digest("SHA-256", buffer);
   const hash = `blob:${Array.from(new Uint8Array(hashBuf)).map((b) => b.toString(16).padStart(2, "0")).join("")}`;
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const backend = kernel.getBackend();
   if (!backend.hasBlob(hash)) {
     backend.putBlob(hash, buffer);
@@ -869,7 +1127,7 @@ async function handleUpload(req, auth, tenantId, ctx) {
   return json({ hash, size: buffer.length, contentType }, 201);
 }
 async function handleFileDownload(hash, ctx, tenantId) {
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const backend = kernel.getBackend();
   const blob = backend.getBlob(hash);
   if (!blob) return json({ error: "Not Found" }, 404);
@@ -877,6 +1135,7 @@ async function handleFileDownload(hash, ctx, tenantId) {
     blob.byteOffset,
     blob.byteOffset + blob.byteLength
   );
+  ctx.meter.recordEgress(resolveUsageTenantId(tenantId), blob.byteLength);
   return new Response(cleanBuf, {
     headers: { "Content-Type": "application/octet-stream" }
   });
@@ -889,7 +1148,7 @@ async function handleRegister(req, tenantId, ctx) {
   if (!body.email || !body.password) {
     return json({ error: "email and password are required" }, 400);
   }
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const existing = kernel.listEntities("User", { email: body.email });
   if (existing.length > 0) {
     return json({ error: "Email already registered" }, 409);
@@ -917,7 +1176,7 @@ async function handleLogin(req, tenantId, ctx) {
   if (!body.email || !body.password) {
     return json({ error: "email and password are required" }, 400);
   }
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const users = kernel.listEntities("User", { email: body.email });
   if (users.length === 0) {
     return json({ error: "Invalid credentials" }, 401);
@@ -960,7 +1219,7 @@ async function handleOAuthCallback(url, providerName, tenantId, ctx) {
   } catch (err) {
     return json({ error: "OAuth exchange failed", message: String(err) }, 400);
   }
-  const kernel = ctx.pool.get(tenantId);
+  const kernel = await ctx.pool.preload(tenantId);
   const oauthId = `oauth:${providerName}:${profile.id}`;
   let users = kernel.listEntities("User", { oauthId });
   let userId;
@@ -1046,6 +1305,24 @@ async function verifyPassword(password, stored) {
   const hash = Array.from(new Uint8Array(bits)).map((b) => b.toString(16).padStart(2, "0")).join("");
   return hash === expectedHash;
 }
+function handleAdminUsage(req, url, ctx) {
+  if (!process.env.TURTLEDB_ADMIN_KEY) {
+    return json({ error: "Admin usage not configured" }, 501);
+  }
+  if (!verifyAdminKey(req)) {
+    return json({ error: "Unauthorized" }, 401);
+  }
+  const tenant = url.searchParams.get("tenant");
+  if (!tenant) {
+    return json({ error: "tenant query param is required" }, 400);
+  }
+  const refresh = url.searchParams.get("refresh") === "1";
+  if (refresh) {
+    ctx.meter.sampleStorage(ctx.pool, tenant);
+  }
+  const day = url.searchParams.get("day") ?? void 0;
+  return json(ctx.meter.getUsage(tenant, day));
+}
 function entityToJson(entity) {
   return entityRecordToPlain(entity);
 }
@@ -1071,6 +1348,11 @@ export {
   FULLY_PUBLIC,
   OWNER_ONLY,
   ADMIN_ONLY,
+  resolveUsageTenantId,
+  dayKey,
+  sampleTenantStorage,
+  verifyAdminKey,
+  UsageMeter,
   SubscriptionManager,
   startServer,
   startServerCrossRuntime

package/dist/{chunk-3GDRZTAW.js → chunk-5KSGGKET.js}

@@ -1,6 +1,6 @@
 import {
   TrellisDb
-} from "./chunk-NZWFNHCS.js";
+} from "./chunk-6RWGFC3N.js";
 
 // src/react/provider.tsx
 import React, {

package/dist/{chunk-MBNBTJCR.js → chunk-6GEZ6DN5.js}

@@ -1,14 +1,14 @@
 import {
   TrellisVcsEngine,
   init_engine
-} from "./chunk-YY3GF7DH.js";
+} from "./chunk-L5N5PR2S.js";
 import {
   IdbOpLog
 } from "./chunk-MPXUVGT3.js";
 import {
   JsonOpLog,
   init_op_log
-} from "./chunk-B3ZIFA2O.js";
+} from "./chunk-VBYUTRXX.js";
 import {
   PartyKitRoomTransport,
   TrellisVcsSyncPeer