toiljs 0.0.112 → 0.0.114

package/src/devserver/analytics/index.ts

@@ -15,8 +15,19 @@ import type { DbDevState } from '../db/index.js';
 import type { MemoryRef } from '../runtime/host.js';
 
 /** Frame version + counter count, kept in lockstep with the edge (`analytics.rs` / `metric_id.rs`). */
-const FRAME_VERSION = 2;
+const FRAME_VERSION = 3;
 const METRIC_COUNTERS = 42;
+
+/** The sustained-rate window: requests are metered over a 3-minute ROLLING window. A plan's
+ *  `sustained_rps` (X) allows `X * BURST_WINDOW_SECS` requests across it; instantaneous spikes above
+ *  that are NOT capped per-tier (only the box `firewall.global_pps` DDoS backstop applies). */
+export const BURST_WINDOW_SECS = 180;
+
+/** The plan's sustained rate in requests/second, derived from the rolling window's allowance.
+ *  `0` means unmetered (no sustained cap), and must NOT be divided into a rate. */
+export function sustainedRpsCap(reqBurstCap: number): number {
+    return reqBurstCap === 0 ? 0 : reqBurstCap / BURST_WINDOW_SECS;
+}
 /** MetricId indices we seed with sample data (others default 0). Mirrors the AUTHORITATIVE edge wire
  *  contract EXACTLY (`toil-backend/src/analytics/metric_id.rs`): counter ids 0..=41, gauge ids
  *  ConnectedStreamsAvg=42, CommittedMemoryAvg=44. There is NO WasmDispatches (removed + reindexed); the
@@ -43,10 +54,16 @@ interface DevTenantStats {
     life: bigint[]; // length METRIC_COUNTERS, indexed by MetricId
     connectedStreams: number;
     committedMemory: number;
-    reqMinuteUsed: number;
-    reqMinuteCap: number;
-    reqDayUsed: number;
-    reqDayCap: number;
+    // Fleet-global requests in the trailing 3-minute ROLLING window, and its allowance
+    // (= sustained_rps * BURST_WINDOW_SECS; 0 = unmetered). Spikes are not tier-capped.
+    reqBurstUsed: number;
+    reqBurstCap: number;
+    // Fleet-global requests in the current 30-day tumbling bucket, and the 30-day quota (0 = unmetered).
+    req30dUsed: number;
+    req30dCap: number;
+    // Derived (NOT part of the wire frame): the plan's sustained request rate, `reqBurstCap /
+    // BURST_WINDOW_SECS` (0 = unmetered). Surfaced so a dev dashboard can show "X sustained rps".
+    sustainedRpsCap: number;
     // LIVE per-second rates (f64), appended after the windows. Mirrors the edge `encode_stats`.
     rps: number;
     bytesInPerSec: number;
@@ -76,14 +93,18 @@ function devStats(): DevTenantStats {
     life[MID.MemGrownBytes] = 262144n;
     life[MID.CacheHits] = 900n;
     life[MID.CacheMisses] = 100n;
+    // Free tier: sustained 1000 rps -> a 3-minute burst cap of 1000 * 180 = 180_000, plus a 30-day
+    // quota of 10_000_000. `used` values are small so the dashboard shows plenty of headroom.
+    const reqBurstCap: number = 180_000;
     return {
         life,
         connectedStreams: 3,
         committedMemory: 65536,
-        reqMinuteUsed: 5,
-        reqMinuteCap: 100,
-        reqDayUsed: 42,
-        reqDayCap: 5000,
+        reqBurstUsed: 1_200,
+        reqBurstCap,
+        req30dUsed: 250_000,
+        req30dCap: 10_000_000,
+        sustainedRpsCap: sustainedRpsCap(reqBurstCap),
         // Plausible non-zero live rates so a dev dashboard shows moving gauges.
         rps: 0.7,
         bytesInPerSec: 68.2,
@@ -97,10 +118,12 @@ function devStats(): DevTenantStats {
 }
 
 /**
- * Encode the v2 snapshot frame BYTE-FOR-BYTE like the edge (`analytics.rs` `encode_stats`), FIXED
- * layout (no strings). Counters/levels are u64; the 7 trailing LIVE per-second rates are f64:
+ * Encode the v3 snapshot frame BYTE-FOR-BYTE like the edge (`analytics.rs` `encode_stats`), FIXED
+ * layout (no strings). The v2 -> v3 bump renamed two u64 pairs (req_minute_* -> req_burst_*,
+ * req_day_* -> req_30d_*); the BYTE LAYOUT is UNCHANGED (same field count, order, and widths).
+ * Counters/levels are u64; the 7 trailing LIVE per-second rates are f64:
  *   u16 version | u64 now_ms | u32 count | u64 × count | u64 connectedStreams | u64 committedMemory |
- *   u64 reqMinuteUsed | u64 reqMinuteCap | u64 reqDayUsed | u64 reqDayCap |
+ *   u64 reqBurstUsed | u64 reqBurstCap | u64 req30dUsed | u64 req30dCap |
  *   f64 rps | f64 bytesInPerSec | f64 bytesOutPerSec | f64 streamBytesInPerSec |
  *   f64 streamBytesOutPerSec | f64 dbOpsPerSec | f64 gasPerSec
  * The rates are APPENDED (version-gated by length): the guest's bounds-checked reader yields 0.0 for a
@@ -120,10 +143,10 @@ function encodeStats(s: DevTenantStats): Buffer {
     }
     body.writeBigUInt64LE(BigInt(s.connectedStreams), o); o += 8;
     body.writeBigUInt64LE(BigInt(s.committedMemory), o); o += 8;
-    body.writeBigUInt64LE(BigInt(s.reqMinuteUsed), o); o += 8;
-    body.writeBigUInt64LE(BigInt(s.reqMinuteCap), o); o += 8;
-    body.writeBigUInt64LE(BigInt(s.reqDayUsed), o); o += 8;
-    body.writeBigUInt64LE(BigInt(s.reqDayCap), o); o += 8;
+    body.writeBigUInt64LE(BigInt(s.reqBurstUsed), o); o += 8;
+    body.writeBigUInt64LE(BigInt(s.reqBurstCap), o); o += 8;
+    body.writeBigUInt64LE(BigInt(s.req30dUsed), o); o += 8;
+    body.writeBigUInt64LE(BigInt(s.req30dCap), o); o += 8;
     body.writeDoubleLE(s.rps, o); o += 8;
     body.writeDoubleLE(s.bytesInPerSec, o); o += 8;
     body.writeDoubleLE(s.bytesOutPerSec, o); o += 8;
@@ -165,7 +188,7 @@ function rangeShape(range: number, metricId: number): { count: number; bucketSec
 }
 
 /**
- * Encode the v2 series frame BYTE-FOR-BYTE like the edge `encode_series` (points are u64 now):
+ * Encode the v3 series frame BYTE-FOR-BYTE like the edge `encode_series` (points are u64 now):
  *   u16 version | u16 metricId | u32 bucketSecs | u64 headMs | u32 count | u64 × count
  * A synthetic gentle ramp so a dev dashboard draws a non-flat line.
  */

package/src/devserver/daemon/host.ts

@@ -10,6 +10,12 @@
  *   - Part 3 error bridge: a u16 subsystem code `c` is returned as `-(0x10000 + c)`;
  *     the buffer sentinels `-1` (TOO_SMALL) / `-2` (ABSENT) are unchanged.
  *
+ * These live in their OWN wasm module namespace, `daemon`, with BARE names, exactly
+ * as the edge registers them (toil-backend `src/wasm/cold/imports.rs`, `NS_DAEMON`).
+ * They are NOT dotted names under `env` like `data.*` / `crypto.*` are: a cold box
+ * that declares them that way resolves here and then trap-stubs at the edge, which
+ * is the one shape of drift a dev emulator must never hide.
+ *
  * The cold box also imports the request-surface `env.*` MINUS the response/stream
  * functions it must not have (no `set_status`/`set_header`/`respond_file`/
  * `client_ip`/`ratelimit_check`); it keeps `@data`/crypto/env/`Date.now`/email so a
@@ -38,10 +44,14 @@ export interface ResolvedDaemonConfig {
 
 /** RECONCILIATION Part 3 u16 error registry (the subset the daemon imports use). */
 export const enum AbiError {
-    DaemonScheduleRejected = 0x0403,
+    DaemonNotLeader = 0x0401,
+    DaemonLeaseLost = 0x0402,
     DaemonCallFailed = 0x0405,
 }
 
+/** The edge's `EPOCH_NONE` / "no such task" sentinel: a plain -1, not a bridged error. */
+const DAEMON_NONE = -1n;
+
 /** Encode a u16 subsystem error per the Part 3 negative-return bridge:
  *  `code = (-v) - 0x10000`, so `v = -(0x10000 + code)`. */
 export function encodeAbiError(code: number): number {
@@ -64,26 +74,27 @@ export interface DaemonRuntime {
  *  `number | bigint` individually, matching the existing db/crypto import maps). */
 type HostFnMap = Record<string, (...args: number[]) => number | bigint>;
 
-/** Build the `daemon.*` host imports, closing over the resident `DaemonRuntime`.
- *  These imports do not read guest memory (they answer from the resident scheduler
- *  state), so they take no `MemoryRef`. */
+/** Build the `daemon` namespace, closing over the resident `DaemonRuntime`. The names
+ *  are BARE (`is_leader`, not `daemon.is_leader`): they are keyed under the `daemon`
+ *  wasm module, matching the edge. These imports do not read guest memory (they answer
+ *  from the resident scheduler state), so they take no `MemoryRef`. */
 export function buildDaemonNamespace(rt: DaemonRuntime): HostFnMap {
     return {
-        'daemon.is_leader': (): number => (rt.isLeader() ? 1 : 0),
-        'daemon.current_epoch': (): bigint => rt.epoch(),
+        is_leader: (): number => (rt.isLeader() ? 1 : 0),
+        // The edge answers -1 (EPOCH_NONE) when this node does not hold the lease.
+        current_epoch: (): bigint => (rt.isLeader() ? rt.epoch() : DAEMON_NONE),
         // The dev lease never expires, so yield/sleep never report LEASE_LOST.
-        'daemon.yield': (): number => 0,
-        'daemon.sleep_ms': (_ms: number | bigint): number => 0,
-        'daemon.task_count': (): number => rt.taskCount(),
-        'daemon.next_fire_ms': (taskId: number): bigint => {
+        yield: (): number => 0,
+        sleep_ms: (_ms: number | bigint): number => 0,
+        task_count: (): number => rt.taskCount(),
+        // An unknown / never-firing task is -1 at the edge, NOT a bridged error.
+        next_fire_ms: (taskId: number): bigint => {
             const at = rt.nextFireMs(taskId);
-            return at === null
-                ? BigInt(encodeAbiError(AbiError.DaemonScheduleRejected))
-                : BigInt(at);
+            return at === null ? DAEMON_NONE : BigInt(at);
         },
         // Outbound HTTP call stub: dev returns a "call failed" sentinel rather than
         // performing real network I/O from a synchronous wasm import (section 5.4).
-        'daemon.http_call': (
+        http_call: (
             _reqPtr: number,
             _reqLen: number,
             _outPtr: number,
@@ -103,10 +114,9 @@ export function freshDaemonState(): DaemonState {
 }
 
 /**
- * The full `env` import object for the cold daemon box: the request-surface env
- * MINUS the response/stream functions (built by `buildEnvImports`), PLUS the
- * `daemon.*` namespace. The cold box has no `handle` entry and no response
- * surface.
+ * The import object for the cold daemon box: the request-surface `env` MINUS the
+ * response/stream functions (built by `buildEnvImports`), plus the separate
+ * `daemon` module. The cold box has no `handle` entry and no response surface.
  */
 export function buildDaemonImports(
     ref: MemoryRef,
@@ -118,7 +128,7 @@ export function buildDaemonImports(
             ...buildEnvImports(ref, state),
             ...buildCryptoImports(ref, state.crypto),
             ...buildDatabaseImports(ref, state.db),
-            ...buildDaemonNamespace(rt),
         },
+        daemon: buildDaemonNamespace(rt),
     };
 }

package/src/devserver/daemon/index.ts

@@ -195,12 +195,19 @@ export class DaemonHost implements DaemonRuntime {
         const imports = buildDaemonImports(ref, this.state, this);
 
         // Fail-closed up front, with names, when the cold box imports anything outside its allowed
-        // surface (the request env subset + crypto + @data + daemon.*; NO response/stream
-        // functions). Mirrors `WasmServerModule.assertImportSurface` (section 7.1).
-        const provided = new Set(Object.keys((imports as { env: Record<string, unknown> }).env));
+        // surface (the request env subset + crypto + @data, and the separate `daemon` module; NO
+        // response/stream functions). Mirrors `WasmServerModule.assertImportSurface` (section 7.1).
+        // Both namespaces are checked: `daemon.*` is its own wasm module at the edge, so a guest
+        // that declares those names under `env` must fail HERE rather than trap only in production.
+        // A non-function import is rejected outright, as the edge does (`NonFunctionImport`):
+        // no memory/global/table is ever registered, so leaving one to fail later would
+        // surface as an opaque LinkError rather than a named, fail-closed diagnostic.
+        const provided = imports as Record<string, Record<string, unknown>>;
         const missing = WebAssembly.Module.imports(this.module)
-            .filter((i) => i.kind === 'function' && (i.module !== 'env' || !provided.has(i.name)))
-            .map((i) => `${i.module}.${i.name}`);
+            .filter(
+                (i) => i.kind !== 'function' || !Object.hasOwn(provided[i.module] ?? {}, i.name),
+            )
+            .map((i) => `${i.module}.${i.name}${i.kind === 'function' ? '' : ` (${i.kind})`}`);
         if (missing.length > 0) {
             this.log(
                 pc.red(

package/test/analytics-dev.test.ts

@@ -1,6 +1,6 @@
 /**
  * Dev-server analytics stub parity: the `env.analytics_read` / `env.analytics_series` dev imports must
- * encode the v2 frames BYTE-FOR-BYTE like the edge (`analytics.rs`), so a guest's toilscript `Analytics`
+ * encode the v3 frames BYTE-FOR-BYTE like the edge (`analytics.rs`), so a guest's toilscript `Analytics`
  * decode is identical in dev and prod. We decode the stashed frame positionally, exactly as the guest.
  */
 import { describe, expect, it } from 'vitest';
@@ -16,7 +16,7 @@ function harness() {
     return { imports: buildAnalyticsImports(ref, db), db };
 }
 
-describe('dev analytics stub v2 frame parity', () => {
+describe('dev analytics stub v3 frame parity', () => {
     it('analytics_read encodes the fixed-layout snapshot frame', () => {
         const { imports, db } = harness();
         const n = imports.analytics_read(0, 0);
@@ -29,7 +29,7 @@ describe('dev analytics stub v2 frame parity', () => {
         const u64 = () => { const v = buf.readBigUInt64LE(p); p += 8; return v; };
         const f64 = () => { const v = buf.readDoubleLE(p); p += 8; return v; };
 
-        expect(u16()).toBe(2); // FRAME_VERSION
+        expect(u16()).toBe(3); // FRAME_VERSION
         u64(); // now_ms
         const count = u32();
         expect(count).toBe(42); // METRIC_COUNTERS (edge N_COUNTERS; no WasmDispatches)
@@ -44,10 +44,10 @@ describe('dev analytics stub v2 frame parity', () => {
         expect(life[41]).toBe(100n); // CacheMisses (id 41, was 42)
         expect(u64()).toBe(3n); // connectedStreams
         expect(u64()).toBe(65536n); // committedMemory
-        expect(u64()).toBe(5n); // reqMinuteUsed
-        expect(u64()).toBe(100n); // reqMinuteCap
-        expect(u64()).toBe(42n); // reqDayUsed
-        expect(u64()).toBe(5000n); // reqDayCap
+        expect(u64()).toBe(1_200n); // reqBurstUsed (current 3-min tumbling bucket)
+        expect(u64()).toBe(180_000n); // reqBurstCap (sustained 1000 rps * 180s window)
+        expect(u64()).toBe(250_000n); // req30dUsed (current 30-day bucket)
+        expect(u64()).toBe(10_000_000n); // req30dCap (30-day quota)
         // 7 LIVE per-second rates (f64 LE), appended after the windows.
         expect(f64()).toBeCloseTo(0.7); // rps
         expect(f64()).toBeCloseTo(68.2); // bytesInPerSec
@@ -66,7 +66,7 @@ describe('dev analytics stub v2 frame parity', () => {
         const buf = db.lastResult as unknown as Buffer;
         expect(n).toBe(buf.length);
         let p = 0;
-        expect(buf.readUInt16LE(p)).toBe(2); p += 2; // version
+        expect(buf.readUInt16LE(p)).toBe(3); p += 2; // version
         expect(buf.readUInt16LE(p)).toBe(0); p += 2; // metric id
         expect(buf.readUInt32LE(p)).toBe(3600); p += 4; // bucketSecs
         p += 8; // headMs

package/test/daemon-emulation.test.ts

@@ -16,7 +16,7 @@
  */
 
 import { spawnSync } from 'node:child_process';
-import { existsSync, mkdtempSync, rmSync, utimesSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdtempSync, readFileSync, rmSync, utimesSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -24,7 +24,11 @@ import { fileURLToPath } from 'node:url';
 import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from 'vitest';
 
 import { DaemonHost } from '../src/devserver/daemon/index.js';
-import type { ResolvedDaemonConfig } from '../src/devserver/daemon/host.js';
+import {
+    buildDaemonImports,
+    freshDaemonState,
+    type ResolvedDaemonConfig,
+} from '../src/devserver/daemon/host.js';
 
 const here = dirname(fileURLToPath(import.meta.url));
 const FIXTURE = join(here, 'fixtures', 'daemon-app.ts');
@@ -91,6 +95,44 @@ describe.skipIf(!existsSync(LOCAL_TOILSCRIPT_BIN))('dev daemon emulation', () =>
         expect(toilscriptAvailable, 'cold compile of the @daemon fixture failed').toBe(true);
     });
 
+    // The edge registers these in their OWN wasm module (`NS_DAEMON`), not as dotted
+    // names under `env` the way `data.*` and `crypto.*` are. A cold box that gets it
+    // wrong resolves against this emulator and then trap-stubs in production, so pin
+    // the namespace on both sides: the guest's declared imports, and what we provide.
+    it('declares its daemon imports in the `daemon` module with bare names', () => {
+        const module = new WebAssembly.Module(readFileSync(coldWasm));
+        const daemonImports = WebAssembly.Module.imports(module)
+            .filter((i) => i.module === 'daemon')
+            .map((i) => i.name)
+            .sort();
+        expect(daemonImports).toEqual(['current_epoch', 'is_leader', 'task_count']);
+        expect(
+            WebAssembly.Module.imports(module).filter((i) => i.name.startsWith('daemon.')),
+        ).toEqual([]);
+    });
+
+    it('provides the daemon host functions under the `daemon` namespace', () => {
+        const imports = buildDaemonImports({ memory: null }, freshDaemonState(), {
+            isLeader: () => true,
+            epoch: () => 1n,
+            taskCount: () => 0,
+            nextFireMs: () => null,
+        }) as unknown as Record<string, Record<string, unknown>>;
+        expect(Object.keys(imports).sort()).toEqual(['daemon', 'env']);
+        expect(Object.keys(imports.daemon).sort()).toEqual([
+            'current_epoch',
+            'http_call',
+            'is_leader',
+            'next_fire_ms',
+            'sleep_ms',
+            'task_count',
+            'yield',
+        ]);
+        expect(Object.keys(imports.env).some((k) => k.startsWith('daemon.'))).toBe(false);
+        // An unknown task is the edge's plain -1 sentinel, not a bridged error code.
+        expect((imports.daemon.next_fire_ms as (id: number) => bigint)(9)).toBe(-1n);
+    });
+
     it('runs daemon_start exactly once on load', () => {
         const host = new DaemonHost(coldWasm, DAEMON_CFG, 'all', () => {});
         host.refresh();

package/test/doctor.test.ts

@@ -18,7 +18,9 @@ import {
     checkSeoUrl,
     checkServerTsPlugin,
     checkStyling,
+    checkTypeScript,
     findRelativeAssets,
+    rangeMajor,
     satisfiesMin,
     summarize,
 } from '../src/cli/diagnostics';
@@ -91,6 +93,32 @@ describe('config + environment checks', () => {
         expect(checkPeer('react', '^19.0.0', '>=18.0.0').status).toBe('pass');
     });
 
+    it('checkTypeScript fails an installed 7.x (the native port, no compiler API)', () => {
+        const check = checkTypeScript('7.0.2', '^7.0.2');
+        expect(check.status).toBe('fail');
+        expect(check.detail).toContain('7.0.2');
+        expect(check.fix).toContain('^6.0.3');
+    });
+
+    it('checkTypeScript fails a declared 7.x even while a supported copy is installed', () => {
+        // The installed copy still works, but the next install would pull the native port.
+        expect(checkTypeScript('6.0.3', '^7.0.0').status).toBe('fail');
+        expect(checkTypeScript('6.0.3', '>=7').status).toBe('fail');
+    });
+
+    it('checkTypeScript passes a supported 6.x and warns below the floor', () => {
+        expect(checkTypeScript('6.0.3', '^6.0.3').status).toBe('pass');
+        expect(checkTypeScript('5.9.3', '^5.9.0').status).toBe('warn');
+        expect(checkTypeScript(null, null).status).toBe('fail');
+    });
+
+    it('rangeMajor reads the major a range floats to, ignoring comparators', () => {
+        expect(rangeMajor('^7.0.2')).toBe(7);
+        expect(rangeMajor('>=6.0.0 <7.0.0')).toBe(6);
+        expect(rangeMajor('~6.0')).toBe(6);
+        expect(rangeMajor('*')).toBe(null);
+    });
+
     it('checkDuplicatePatterns flags repeated route URLs', () => {
         expect(checkDuplicatePatterns(['/', '/about', '/blog/:id']).status).toBe('pass');
         expect(checkDuplicatePatterns(['/a', '/a']).status).toBe('warn');

package/test/fixtures/daemon-app.ts

@@ -1,21 +1,26 @@
 // A minimal @daemon fixture for the dev daemon-emulation test. It declares the
-// `daemon.*` host imports directly (so it needs no toiljs globals lib) and records
+// daemon host imports directly (so it needs no toiljs globals lib) and records
 // its activity into resident daemon wasm memory. Compiled with `--targetMode cold`
 // by the test.
 //
 //   onStart()          -> increments `started` and stamps the lease epoch
 //   tick()  @scheduled -> increments `tickFast`   (1s interval)
 //   sixHourly() cron   -> increments `tickCron`   (0 */6 * * *)
+//
+// The imports live in the `daemon` wasm module with BARE names, as the edge
+// registers them; they are not dotted names under `env`. toilscript's stdlib
+// exposes the same surface as the ambient `Daemon` class (`~lib/daemon`), which
+// real daemons should use instead of hand-declaring these.
 
 // @ts-nocheck — this is AssemblyScript source compiled by toilscript, not TS.
 
-@external("env", "daemon.is_leader")
+@external("daemon", "is_leader")
 declare function daemonIsLeader(): i32;
 
-@external("env", "daemon.current_epoch")
+@external("daemon", "current_epoch")
 declare function daemonCurrentEpoch(): i64;
 
-@external("env", "daemon.task_count")
+@external("daemon", "task_count")
 declare function daemonTaskCount(): i32;
 
 let started: i32 = 0;

package/test/prerender.test.ts

@@ -3,9 +3,13 @@ import os from 'node:os';
 import path from 'node:path';
 
 import ts from 'typescript';
-import { afterEach, describe, expect, it } from 'vitest';
+import { afterEach, describe, expect, it, vi } from 'vitest';
 
-import { extractStaticMetadata } from '../src/compiler/prerender';
+import {
+    extractStaticMetadata,
+    loadTypeScript,
+    loadTypeScriptSync,
+} from '../src/compiler/prerender';
 
 const written: string[] = [];
 function tmp(source: string): string {
@@ -52,3 +56,61 @@ describe('extractStaticMetadata', () => {
         expect(extractStaticMetadata(ts, file)).toEqual({ title: 'X' });
     });
 });
+
+/**
+ * Builds a throwaway project root whose resolvable `typescript` is `main`-ed at a module exporting
+ * only `version` — the shape TypeScript 7 ships, having moved the compiler API to
+ * `typescript/unstable/*`. Resolution succeeds, so a truthy check can't tell it apart from a usable
+ * compiler; only probing the API can.
+ */
+function rootWithApiLessTypeScript(): string {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), `toil-ts7-${process.pid}-`));
+    dirs.push(root);
+    const pkgDir = path.join(root, 'node_modules', 'typescript');
+    fs.mkdirSync(pkgDir, { recursive: true });
+    fs.writeFileSync(path.join(root, 'package.json'), '{"name":"fixture"}');
+    fs.writeFileSync(
+        path.join(pkgDir, 'package.json'),
+        '{"name":"typescript","version":"7.0.2","main":"./version.cjs"}',
+    );
+    fs.writeFileSync(
+        path.join(pkgDir, 'version.cjs'),
+        `module.exports = { version: '7.0.2', versionMajorMinor: '7.0' };\n`,
+    );
+    return root;
+}
+
+const dirs: string[] = [];
+afterEach(() => {
+    for (const d of dirs.splice(0)) fs.rmSync(d, { recursive: true, force: true });
+});
+
+describe('loadTypeScript', () => {
+    it('returns null (not a half-built module) when typescript exposes no compiler API', async () => {
+        const root = rootWithApiLessTypeScript();
+        const warn = vi.spyOn(process.stderr, 'write').mockReturnValue(true);
+        try {
+            // Both must degrade rather than hand back `{ version }`, whose first `ts.ScriptTarget`
+            // read would throw `Cannot read properties of undefined (reading 'Latest')` mid-build.
+            expect(loadTypeScriptSync(root)).toBeNull();
+            await expect(loadTypeScript(root)).resolves.toBeNull();
+        } finally {
+            warn.mockRestore();
+        }
+    });
+
+    it('returns null when typescript is not installed at all', async () => {
+        const root = fs.mkdtempSync(path.join(os.tmpdir(), `toil-nots-${process.pid}-`));
+        dirs.push(root);
+        fs.writeFileSync(path.join(root, 'package.json'), '{"name":"fixture"}');
+        expect(loadTypeScriptSync(root)).toBeNull();
+        await expect(loadTypeScript(root)).resolves.toBeNull();
+    });
+
+    it('returns the compiler API when a usable typescript is installed', async () => {
+        // This repo's own root resolves its devDependency typescript, which has the classic API.
+        const root = path.resolve(__dirname, '..');
+        expect(loadTypeScriptSync(root)?.createSourceFile).toBeTypeOf('function');
+        expect((await loadTypeScript(root))?.ScriptTarget.Latest).toBeTypeOf('number');
+    });
+});

package/test/update.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it } from 'vitest';
 
-import { buildRows, classifyBump, parseNcuJson } from '../src/cli/updates';
+import { buildRows, classifyBump, parseNcuJson, withheldUpgrades } from '../src/cli/updates';
 
 describe('classifyBump', () => {
     it('classifies major / minor / patch from ranges', () => {
@@ -42,3 +42,17 @@ describe('buildRows', () => {
         expect(rows[0]).toMatchObject({ name: 'foo', from: '?', to: '^2.0.0', bump: 'major' });
     });
 });
+
+describe('withheldUpgrades', () => {
+    it('withholds an upgrade into typescript 7 (the native port has no compiler API)', () => {
+        expect(withheldUpgrades({ typescript: '^7.0.2', react: '^20.0.0' })).toEqual(['typescript']);
+    });
+
+    it('still offers typescript bumps inside the supported major', () => {
+        expect(withheldUpgrades({ typescript: '^6.1.0' })).toEqual([]);
+    });
+
+    it('ignores packages with no declared ceiling', () => {
+        expect(withheldUpgrades({ vite: '^9.0.0', eslint: '^11.0.0' })).toEqual([]);
+    });
+});

package/tsconfig.base.json

@@ -3,7 +3,6 @@
         "declaration": true,
         "noImplicitAny": true,
         "removeComments": true,
-        "suppressImplicitAnyIndexErrors": false,
         "preserveConstEnums": true,
         "resolveJsonModule": true,
         "skipLibCheck": true,