toiljs 0.0.113 → 0.0.115

package/src/devserver/daemon/host.ts

@@ -10,6 +10,12 @@
  *   - Part 3 error bridge: a u16 subsystem code `c` is returned as `-(0x10000 + c)`;
  *     the buffer sentinels `-1` (TOO_SMALL) / `-2` (ABSENT) are unchanged.
  *
+ * These live in their OWN wasm module namespace, `daemon`, with BARE names, exactly
+ * as the edge registers them (toil-backend `src/wasm/cold/imports.rs`, `NS_DAEMON`).
+ * They are NOT dotted names under `env` like `data.*` / `crypto.*` are: a cold box
+ * that declares them that way resolves here and then trap-stubs at the edge, which
+ * is the one shape of drift a dev emulator must never hide.
+ *
  * The cold box also imports the request-surface `env.*` MINUS the response/stream
  * functions it must not have (no `set_status`/`set_header`/`respond_file`/
  * `client_ip`/`ratelimit_check`); it keeps `@data`/crypto/env/`Date.now`/email so a
@@ -38,10 +44,14 @@ export interface ResolvedDaemonConfig {
 
 /** RECONCILIATION Part 3 u16 error registry (the subset the daemon imports use). */
 export const enum AbiError {
-    DaemonScheduleRejected = 0x0403,
+    DaemonNotLeader = 0x0401,
+    DaemonLeaseLost = 0x0402,
     DaemonCallFailed = 0x0405,
 }
 
+/** The edge's `EPOCH_NONE` / "no such task" sentinel: a plain -1, not a bridged error. */
+const DAEMON_NONE = -1n;
+
 /** Encode a u16 subsystem error per the Part 3 negative-return bridge:
  *  `code = (-v) - 0x10000`, so `v = -(0x10000 + code)`. */
 export function encodeAbiError(code: number): number {
@@ -64,26 +74,27 @@ export interface DaemonRuntime {
  *  `number | bigint` individually, matching the existing db/crypto import maps). */
 type HostFnMap = Record<string, (...args: number[]) => number | bigint>;
 
-/** Build the `daemon.*` host imports, closing over the resident `DaemonRuntime`.
- *  These imports do not read guest memory (they answer from the resident scheduler
- *  state), so they take no `MemoryRef`. */
+/** Build the `daemon` namespace, closing over the resident `DaemonRuntime`. The names
+ *  are BARE (`is_leader`, not `daemon.is_leader`): they are keyed under the `daemon`
+ *  wasm module, matching the edge. These imports do not read guest memory (they answer
+ *  from the resident scheduler state), so they take no `MemoryRef`. */
 export function buildDaemonNamespace(rt: DaemonRuntime): HostFnMap {
     return {
-        'daemon.is_leader': (): number => (rt.isLeader() ? 1 : 0),
-        'daemon.current_epoch': (): bigint => rt.epoch(),
+        is_leader: (): number => (rt.isLeader() ? 1 : 0),
+        // The edge answers -1 (EPOCH_NONE) when this node does not hold the lease.
+        current_epoch: (): bigint => (rt.isLeader() ? rt.epoch() : DAEMON_NONE),
         // The dev lease never expires, so yield/sleep never report LEASE_LOST.
-        'daemon.yield': (): number => 0,
-        'daemon.sleep_ms': (_ms: number | bigint): number => 0,
-        'daemon.task_count': (): number => rt.taskCount(),
-        'daemon.next_fire_ms': (taskId: number): bigint => {
+        yield: (): number => 0,
+        sleep_ms: (_ms: number | bigint): number => 0,
+        task_count: (): number => rt.taskCount(),
+        // An unknown / never-firing task is -1 at the edge, NOT a bridged error.
+        next_fire_ms: (taskId: number): bigint => {
             const at = rt.nextFireMs(taskId);
-            return at === null
-                ? BigInt(encodeAbiError(AbiError.DaemonScheduleRejected))
-                : BigInt(at);
+            return at === null ? DAEMON_NONE : BigInt(at);
         },
         // Outbound HTTP call stub: dev returns a "call failed" sentinel rather than
         // performing real network I/O from a synchronous wasm import (section 5.4).
-        'daemon.http_call': (
+        http_call: (
             _reqPtr: number,
             _reqLen: number,
             _outPtr: number,
@@ -103,10 +114,9 @@ export function freshDaemonState(): DaemonState {
 }
 
 /**
- * The full `env` import object for the cold daemon box: the request-surface env
- * MINUS the response/stream functions (built by `buildEnvImports`), PLUS the
- * `daemon.*` namespace. The cold box has no `handle` entry and no response
- * surface.
+ * The import object for the cold daemon box: the request-surface `env` MINUS the
+ * response/stream functions (built by `buildEnvImports`), plus the separate
+ * `daemon` module. The cold box has no `handle` entry and no response surface.
  */
 export function buildDaemonImports(
     ref: MemoryRef,
@@ -118,7 +128,7 @@ export function buildDaemonImports(
             ...buildEnvImports(ref, state),
             ...buildCryptoImports(ref, state.crypto),
             ...buildDatabaseImports(ref, state.db),
-            ...buildDaemonNamespace(rt),
         },
+        daemon: buildDaemonNamespace(rt),
     };
 }

package/src/devserver/daemon/index.ts

@@ -195,12 +195,19 @@ export class DaemonHost implements DaemonRuntime {
         const imports = buildDaemonImports(ref, this.state, this);
 
         // Fail-closed up front, with names, when the cold box imports anything outside its allowed
-        // surface (the request env subset + crypto + @data + daemon.*; NO response/stream
-        // functions). Mirrors `WasmServerModule.assertImportSurface` (section 7.1).
-        const provided = new Set(Object.keys((imports as { env: Record<string, unknown> }).env));
+        // surface (the request env subset + crypto + @data, and the separate `daemon` module; NO
+        // response/stream functions). Mirrors `WasmServerModule.assertImportSurface` (section 7.1).
+        // Both namespaces are checked: `daemon.*` is its own wasm module at the edge, so a guest
+        // that declares those names under `env` must fail HERE rather than trap only in production.
+        // A non-function import is rejected outright, as the edge does (`NonFunctionImport`):
+        // no memory/global/table is ever registered, so leaving one to fail later would
+        // surface as an opaque LinkError rather than a named, fail-closed diagnostic.
+        const provided = imports as Record<string, Record<string, unknown>>;
         const missing = WebAssembly.Module.imports(this.module)
-            .filter((i) => i.kind === 'function' && (i.module !== 'env' || !provided.has(i.name)))
-            .map((i) => `${i.module}.${i.name}`);
+            .filter(
+                (i) => i.kind !== 'function' || !Object.hasOwn(provided[i.module] ?? {}, i.name),
+            )
+            .map((i) => `${i.module}.${i.name}${i.kind === 'function' ? '' : ` (${i.kind})`}`);
         if (missing.length > 0) {
             this.log(
                 pc.red(

package/test/daemon-emulation.test.ts

@@ -16,7 +16,7 @@
  */
 
 import { spawnSync } from 'node:child_process';
-import { existsSync, mkdtempSync, rmSync, utimesSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdtempSync, readFileSync, rmSync, utimesSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -24,7 +24,11 @@ import { fileURLToPath } from 'node:url';
 import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from 'vitest';
 
 import { DaemonHost } from '../src/devserver/daemon/index.js';
-import type { ResolvedDaemonConfig } from '../src/devserver/daemon/host.js';
+import {
+    buildDaemonImports,
+    freshDaemonState,
+    type ResolvedDaemonConfig,
+} from '../src/devserver/daemon/host.js';
 
 const here = dirname(fileURLToPath(import.meta.url));
 const FIXTURE = join(here, 'fixtures', 'daemon-app.ts');
@@ -91,6 +95,44 @@ describe.skipIf(!existsSync(LOCAL_TOILSCRIPT_BIN))('dev daemon emulation', () =>
         expect(toilscriptAvailable, 'cold compile of the @daemon fixture failed').toBe(true);
     });
 
+    // The edge registers these in their OWN wasm module (`NS_DAEMON`), not as dotted
+    // names under `env` the way `data.*` and `crypto.*` are. A cold box that gets it
+    // wrong resolves against this emulator and then trap-stubs in production, so pin
+    // the namespace on both sides: the guest's declared imports, and what we provide.
+    it('declares its daemon imports in the `daemon` module with bare names', () => {
+        const module = new WebAssembly.Module(readFileSync(coldWasm));
+        const daemonImports = WebAssembly.Module.imports(module)
+            .filter((i) => i.module === 'daemon')
+            .map((i) => i.name)
+            .sort();
+        expect(daemonImports).toEqual(['current_epoch', 'is_leader', 'task_count']);
+        expect(
+            WebAssembly.Module.imports(module).filter((i) => i.name.startsWith('daemon.')),
+        ).toEqual([]);
+    });
+
+    it('provides the daemon host functions under the `daemon` namespace', () => {
+        const imports = buildDaemonImports({ memory: null }, freshDaemonState(), {
+            isLeader: () => true,
+            epoch: () => 1n,
+            taskCount: () => 0,
+            nextFireMs: () => null,
+        }) as unknown as Record<string, Record<string, unknown>>;
+        expect(Object.keys(imports).sort()).toEqual(['daemon', 'env']);
+        expect(Object.keys(imports.daemon).sort()).toEqual([
+            'current_epoch',
+            'http_call',
+            'is_leader',
+            'next_fire_ms',
+            'sleep_ms',
+            'task_count',
+            'yield',
+        ]);
+        expect(Object.keys(imports.env).some((k) => k.startsWith('daemon.'))).toBe(false);
+        // An unknown task is the edge's plain -1 sentinel, not a bridged error code.
+        expect((imports.daemon.next_fire_ms as (id: number) => bigint)(9)).toBe(-1n);
+    });
+
     it('runs daemon_start exactly once on load', () => {
         const host = new DaemonHost(coldWasm, DAEMON_CFG, 'all', () => {});
         host.refresh();

package/test/doctor.test.ts

@@ -18,7 +18,9 @@ import {
     checkSeoUrl,
     checkServerTsPlugin,
     checkStyling,
+    checkTypeScript,
     findRelativeAssets,
+    rangeMajor,
     satisfiesMin,
     summarize,
 } from '../src/cli/diagnostics';
@@ -91,6 +93,32 @@ describe('config + environment checks', () => {
         expect(checkPeer('react', '^19.0.0', '>=18.0.0').status).toBe('pass');
     });
 
+    it('checkTypeScript fails an installed 7.x (the native port, no compiler API)', () => {
+        const check = checkTypeScript('7.0.2', '^7.0.2');
+        expect(check.status).toBe('fail');
+        expect(check.detail).toContain('7.0.2');
+        expect(check.fix).toContain('^6.0.3');
+    });
+
+    it('checkTypeScript fails a declared 7.x even while a supported copy is installed', () => {
+        // The installed copy still works, but the next install would pull the native port.
+        expect(checkTypeScript('6.0.3', '^7.0.0').status).toBe('fail');
+        expect(checkTypeScript('6.0.3', '>=7').status).toBe('fail');
+    });
+
+    it('checkTypeScript passes a supported 6.x and warns below the floor', () => {
+        expect(checkTypeScript('6.0.3', '^6.0.3').status).toBe('pass');
+        expect(checkTypeScript('5.9.3', '^5.9.0').status).toBe('warn');
+        expect(checkTypeScript(null, null).status).toBe('fail');
+    });
+
+    it('rangeMajor reads the major a range floats to, ignoring comparators', () => {
+        expect(rangeMajor('^7.0.2')).toBe(7);
+        expect(rangeMajor('>=6.0.0 <7.0.0')).toBe(6);
+        expect(rangeMajor('~6.0')).toBe(6);
+        expect(rangeMajor('*')).toBe(null);
+    });
+
     it('checkDuplicatePatterns flags repeated route URLs', () => {
         expect(checkDuplicatePatterns(['/', '/about', '/blog/:id']).status).toBe('pass');
         expect(checkDuplicatePatterns(['/a', '/a']).status).toBe('warn');

package/test/fixtures/daemon-app.ts

@@ -1,21 +1,26 @@
 // A minimal @daemon fixture for the dev daemon-emulation test. It declares the
-// `daemon.*` host imports directly (so it needs no toiljs globals lib) and records
+// daemon host imports directly (so it needs no toiljs globals lib) and records
 // its activity into resident daemon wasm memory. Compiled with `--targetMode cold`
 // by the test.
 //
 //   onStart()          -> increments `started` and stamps the lease epoch
 //   tick()  @scheduled -> increments `tickFast`   (1s interval)
 //   sixHourly() cron   -> increments `tickCron`   (0 */6 * * *)
+//
+// The imports live in the `daemon` wasm module with BARE names, as the edge
+// registers them; they are not dotted names under `env`. toilscript's stdlib
+// exposes the same surface as the ambient `Daemon` class (`~lib/daemon`), which
+// real daemons should use instead of hand-declaring these.
 
 // @ts-nocheck — this is AssemblyScript source compiled by toilscript, not TS.
 
-@external("env", "daemon.is_leader")
+@external("daemon", "is_leader")
 declare function daemonIsLeader(): i32;
 
-@external("env", "daemon.current_epoch")
+@external("daemon", "current_epoch")
 declare function daemonCurrentEpoch(): i64;
 
-@external("env", "daemon.task_count")
+@external("daemon", "task_count")
 declare function daemonTaskCount(): i32;
 
 let started: i32 = 0;

package/test/prerender.test.ts

@@ -3,9 +3,13 @@ import os from 'node:os';
 import path from 'node:path';
 
 import ts from 'typescript';
-import { afterEach, describe, expect, it } from 'vitest';
+import { afterEach, describe, expect, it, vi } from 'vitest';
 
-import { extractStaticMetadata } from '../src/compiler/prerender';
+import {
+    extractStaticMetadata,
+    loadTypeScript,
+    loadTypeScriptSync,
+} from '../src/compiler/prerender';
 
 const written: string[] = [];
 function tmp(source: string): string {
@@ -52,3 +56,61 @@ describe('extractStaticMetadata', () => {
         expect(extractStaticMetadata(ts, file)).toEqual({ title: 'X' });
     });
 });
+
+/**
+ * Builds a throwaway project root whose resolvable `typescript` is `main`-ed at a module exporting
+ * only `version` — the shape TypeScript 7 ships, having moved the compiler API to
+ * `typescript/unstable/*`. Resolution succeeds, so a truthy check can't tell it apart from a usable
+ * compiler; only probing the API can.
+ */
+function rootWithApiLessTypeScript(): string {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), `toil-ts7-${process.pid}-`));
+    dirs.push(root);
+    const pkgDir = path.join(root, 'node_modules', 'typescript');
+    fs.mkdirSync(pkgDir, { recursive: true });
+    fs.writeFileSync(path.join(root, 'package.json'), '{"name":"fixture"}');
+    fs.writeFileSync(
+        path.join(pkgDir, 'package.json'),
+        '{"name":"typescript","version":"7.0.2","main":"./version.cjs"}',
+    );
+    fs.writeFileSync(
+        path.join(pkgDir, 'version.cjs'),
+        `module.exports = { version: '7.0.2', versionMajorMinor: '7.0' };\n`,
+    );
+    return root;
+}
+
+const dirs: string[] = [];
+afterEach(() => {
+    for (const d of dirs.splice(0)) fs.rmSync(d, { recursive: true, force: true });
+});
+
+describe('loadTypeScript', () => {
+    it('returns null (not a half-built module) when typescript exposes no compiler API', async () => {
+        const root = rootWithApiLessTypeScript();
+        const warn = vi.spyOn(process.stderr, 'write').mockReturnValue(true);
+        try {
+            // Both must degrade rather than hand back `{ version }`, whose first `ts.ScriptTarget`
+            // read would throw `Cannot read properties of undefined (reading 'Latest')` mid-build.
+            expect(loadTypeScriptSync(root)).toBeNull();
+            await expect(loadTypeScript(root)).resolves.toBeNull();
+        } finally {
+            warn.mockRestore();
+        }
+    });
+
+    it('returns null when typescript is not installed at all', async () => {
+        const root = fs.mkdtempSync(path.join(os.tmpdir(), `toil-nots-${process.pid}-`));
+        dirs.push(root);
+        fs.writeFileSync(path.join(root, 'package.json'), '{"name":"fixture"}');
+        expect(loadTypeScriptSync(root)).toBeNull();
+        await expect(loadTypeScript(root)).resolves.toBeNull();
+    });
+
+    it('returns the compiler API when a usable typescript is installed', async () => {
+        // This repo's own root resolves its devDependency typescript, which has the classic API.
+        const root = path.resolve(__dirname, '..');
+        expect(loadTypeScriptSync(root)?.createSourceFile).toBeTypeOf('function');
+        expect((await loadTypeScript(root))?.ScriptTarget.Latest).toBeTypeOf('number');
+    });
+});

package/test/update.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it } from 'vitest';
 
-import { buildRows, classifyBump, parseNcuJson } from '../src/cli/updates';
+import { buildRows, classifyBump, parseNcuJson, withheldUpgrades } from '../src/cli/updates';
 
 describe('classifyBump', () => {
     it('classifies major / minor / patch from ranges', () => {
@@ -42,3 +42,17 @@ describe('buildRows', () => {
         expect(rows[0]).toMatchObject({ name: 'foo', from: '?', to: '^2.0.0', bump: 'major' });
     });
 });
+
+describe('withheldUpgrades', () => {
+    it('withholds an upgrade into typescript 7 (the native port has no compiler API)', () => {
+        expect(withheldUpgrades({ typescript: '^7.0.2', react: '^20.0.0' })).toEqual(['typescript']);
+    });
+
+    it('still offers typescript bumps inside the supported major', () => {
+        expect(withheldUpgrades({ typescript: '^6.1.0' })).toEqual([]);
+    });
+
+    it('ignores packages with no declared ceiling', () => {
+        expect(withheldUpgrades({ vite: '^9.0.0', eslint: '^11.0.0' })).toEqual([]);
+    });
+});

package/tsconfig.base.json

@@ -3,7 +3,6 @@
         "declaration": true,
         "noImplicitAny": true,
         "removeComments": true,
-        "suppressImplicitAnyIndexErrors": false,
         "preserveConstEnums": true,
         "resolveJsonModule": true,
         "skipLibCheck": true,