toiljs 0.0.115 → 0.0.117

package/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,90 +0,0 @@
-name: Bug Report
-description: Report a bug in toiljs
-title: "[Bug]: "
-labels: ["bug", "triage"]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Thanks for taking the time to report a bug.
-
-        **Security Notice**: If this is a security vulnerability, DO NOT create a public issue. Report it privately via [GitHub Security Advisories](https://github.com/dacely-cloud/toiljs/security/advisories/new).
-
-  - type: textarea
-    id: description
-    attributes:
-      label: Bug Description
-      description: A clear and concise description of the bug.
-      placeholder: Describe the bug...
-    validations:
-      required: true
-
-  - type: textarea
-    id: reproduction
-    attributes:
-      label: Steps to Reproduce
-      description: Steps to reproduce the behavior.
-      placeholder: |
-        1. ...
-        2. ...
-        3. ...
-    validations:
-      required: true
-
-  - type: textarea
-    id: expected
-    attributes:
-      label: Expected Behavior
-      description: What did you expect to happen?
-    validations:
-      required: true
-
-  - type: textarea
-    id: actual
-    attributes:
-      label: Actual Behavior
-      description: What actually happened?
-    validations:
-      required: true
-
-  - type: input
-    id: version
-    attributes:
-      label: toiljs Version
-      description: What version of toiljs are you using?
-      placeholder: "0.0.1"
-    validations:
-      required: true
-
-  - type: input
-    id: node-version
-    attributes:
-      label: Node.js Version
-      description: What version of Node.js are you using?
-      placeholder: "22.0.0"
-    validations:
-      required: true
-
-  - type: textarea
-    id: code
-    attributes:
-      label: Code Example
-      description: Minimal code that reproduces the issue.
-      render: typescript
-
-  - type: textarea
-    id: logs
-    attributes:
-      label: Relevant Logs
-      description: Please copy and paste any relevant log output.
-      render: shell
-
-  - type: checkboxes
-    id: terms
-    attributes:
-      label: Checklist
-      options:
-        - label: I have searched existing issues to ensure this bug hasn't been reported
-          required: true
-        - label: This is NOT a security vulnerability (those should be reported privately)
-          required: true

package/.github/ISSUE_TEMPLATE/config.yml

@@ -1,8 +0,0 @@
-blank_issues_enabled: true
-contact_links:
-  - name: Security Vulnerability
-    url: https://github.com/dacely-cloud/toiljs/security/advisories/new
-    about: Report a security vulnerability privately. DO NOT create a public issue for security vulnerabilities.
-  - name: Toil Website
-    url: https://toil.org/
-    about: Visit the Toil homepage for documentation and support.

package/.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,20 +0,0 @@
----
-name: Feature request
-about: Suggest an idea for this project
-title: ''
-labels: ''
-assignees: ''
-
----
-
-**Is your feature request related to a problem? Please describe.**
-A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
-
-**Describe the solution you'd like**
-A clear and concise description of what you want to happen.
-
-**Describe alternatives you've considered**
-A clear and concise description of any alternative solutions or features you've considered.
-
-**Additional context**
-Add any other context or screenshots about the feature request here.

package/.github/PULL_REQUEST_TEMPLATE.md

@@ -1,43 +0,0 @@
-## Description
-<!-- Brief description of the changes in this PR -->
-
-## Type of Change
-<!-- Mark the relevant option with an "x" -->
-
-- [ ] Bug fix (non-breaking change that fixes an issue)
-- [ ] New feature (non-breaking change that adds functionality)
-- [ ] Breaking change (fix or feature that would cause existing functionality to change)
-- [ ] Performance improvement
-- [ ] Refactoring (no functional changes)
-- [ ] Documentation update
-- [ ] CI/CD changes
-- [ ] Dependencies update
-
-## Checklist
-
-### Build & Tests
-- [ ] `npm install` completes without errors
-- [ ] `npm test` passes all tests
-
-### Code Quality
-- [ ] Code follows the project's coding standards
-- [ ] No new compiler warnings introduced
-- [ ] Error handling is appropriate
-
-### Documentation
-- [ ] Code comments added for complex logic
-- [ ] Public APIs are documented
-- [ ] README updated (if applicable)
-
-### Security
-- [ ] No sensitive data (keys, credentials) committed
-- [ ] No new security vulnerabilities introduced
-
-## Testing
-<!-- Describe how you tested these changes -->
-
-## Related Issues
-<!-- Link any related issues: Fixes #123, Relates to #456 -->
-
----
-By submitting this PR, I confirm that my contribution is made under the terms of the project's license.

package/.github/changelog-config.json

@@ -1,45 +0,0 @@
-{
-  "categories": [
-    {
-      "title": "### Breaking Changes",
-      "labels": ["breaking", "breaking-change", "BREAKING-CHANGE"]
-    },
-    {
-      "title": "### Features",
-      "labels": ["feature", "feat", "enhancement"]
-    },
-    {
-      "title": "### Bug Fixes",
-      "labels": ["bug", "fix", "bugfix"]
-    },
-    {
-      "title": "### Performance",
-      "labels": ["performance", "perf"]
-    },
-    {
-      "title": "### Documentation",
-      "labels": ["documentation", "docs"]
-    },
-    {
-      "title": "### Dependencies",
-      "labels": ["dependencies", "deps"]
-    },
-    {
-      "title": "### Other Changes",
-      "labels": []
-    }
-  ],
-  "sort": {
-    "order": "ASC",
-    "on_property": "mergedAt"
-  },
-  "template": "#{{CHANGELOG}}",
-  "pr_template": "- #{{TITLE}} (#{{NUMBER}}) by @#{{AUTHOR}}",
-  "empty_template": "- No changes",
-  "max_tags_to_fetch": 200,
-  "max_pull_requests": 200,
-  "max_back_track_time_days": 365,
-  "tag_resolver": {
-    "method": "semver"
-  }
-}

package/.github/dependabot.yml

@@ -1,27 +0,0 @@
-version: 2
-
-updates:
-    - package-ecosystem: 'npm'
-      directory: '/'
-      schedule:
-          interval: 'daily'
-          time: '06:00'
-          timezone: 'America/Toronto'
-      open-pull-requests-limit: 10
-      rebase-strategy: 'auto'
-
-      groups:
-          production-deps:
-              dependency-type: 'production'
-              update-types: ['minor', 'patch']
-          dev-deps:
-              dependency-type: 'development'
-              update-types: ['minor', 'patch']
-
-      commit-message:
-          prefix: '⬆️'
-          include: scope
-
-      labels:
-          - 'dependencies'
-          - 'npm'

package/.github/workflows/ci.yml

@@ -1,222 +0,0 @@
-name: CI for TOILJS
-
-on:
-  push:
-    branches:
-      - main
-    tags:
-      - 'v*'
-  pull_request:
-
-jobs:
-  test:
-    name: Build & test
-    # Runs on PRs and pushes to main, but not on the version-tag publish runs.
-    if: ${{ github.event_name == 'pull_request' || github.ref == 'refs/heads/main' }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version: '24.x'
-
-      - name: Install dependencies
-        run: npm install
-
-      - name: Build
-        run: npm run build
-
-      - name: Test
-        # The example wasm is not built here, so the wasm-gated end-to-end specs
-        # (ssr-render, example-guestbook) skip; the SSR unit tests (golden
-        # byte-identity, attr holes, extraction, codegen) and the rest run.
-        run: npx vitest run
-
-  publish:
-    if: ${{ startsWith(github.ref, 'refs/tags/') }}
-    runs-on: ubuntu-latest
-
-    permissions:
-      contents: write
-      id-token: write
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version: '24.x'
-          registry-url: 'https://registry.npmjs.org'
-
-      - name: Update npm
-        run: npm install -g npm@11.18.0 # pinned: npm 12's global install drops `sigstore`, breaking --provenance
-
-      - name: Install dependencies
-        run: npm install
-
-      - name: Build the project
-        run: npm run build
-
-      - name: Determine npm tag
-        id: npm_tag
-        run: |
-          VERSION="${{ github.ref_name }}"
-          if [[ "$VERSION" == *"-alpha"* ]]; then
-            echo "tag=alpha" >> $GITHUB_OUTPUT
-          elif [[ "$VERSION" == *"-beta"* ]]; then
-            echo "tag=beta" >> $GITHUB_OUTPUT
-          elif [[ "$VERSION" == *"-rc"* ]]; then
-            echo "tag=rc" >> $GITHUB_OUTPUT
-          else
-            echo "tag=latest" >> $GITHUB_OUTPUT
-          fi
-          echo "Determined npm tag: $(cat $GITHUB_OUTPUT | grep tag | cut -d= -f2)"
-
-      - name: Publish to npm
-        run: npm publish --access public --tag ${{ steps.npm_tag.outputs.tag }}
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-  release:
-    if: ${{ startsWith(github.ref, 'refs/tags/') }}
-    runs-on: ubuntu-latest
-    needs: publish
-
-    permissions:
-      contents: write
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-
-      - name: Determine if prerelease
-        id: prerelease
-        run: |
-          VERSION="${{ github.ref_name }}"
-          if [[ "$VERSION" == *"-alpha"* ]] || [[ "$VERSION" == *"-beta"* ]] || [[ "$VERSION" == *"-rc"* ]]; then
-            echo "is_prerelease=true" >> $GITHUB_OUTPUT
-          else
-            echo "is_prerelease=false" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Generate changelog
-        id: changelog
-        uses: mikepenz/release-changelog-builder-action@v6
-        with:
-          ignorePreReleases: ${{ steps.prerelease.outputs.is_prerelease == 'false' }}
-          configurationJson: |
-            {
-              "categories": [
-                {
-                  "title": "### Breaking Changes",
-                  "labels": ["breaking", "breaking-change", "BREAKING-CHANGE"]
-                },
-                {
-                  "title": "### Features",
-                  "labels": ["feature", "feat", "enhancement"]
-                },
-                {
-                  "title": "### Bug Fixes",
-                  "labels": ["bug", "fix", "bugfix"]
-                },
-                {
-                  "title": "### Performance",
-                  "labels": ["performance", "perf"]
-                },
-                {
-                  "title": "### Documentation",
-                  "labels": ["documentation", "docs"]
-                },
-                {
-                  "title": "### Dependencies",
-                  "labels": ["dependencies", "deps"]
-                },
-                {
-                  "title": "### Other Changes",
-                  "labels": []
-                }
-              ],
-              "sort": {
-                "order": "ASC",
-                "on_property": "mergedAt"
-              },
-              "template": "#{{CHANGELOG}}",
-              "pr_template": "- #{{TITLE}} ([##{{NUMBER}}](#{{URL}})) by @#{{AUTHOR}}",
-              "empty_template": "- No changes",
-              "max_tags_to_fetch": 200,
-              "max_pull_requests": 200,
-              "max_back_track_time_days": 365,
-              "tag_resolver": {
-                "method": "semver"
-              }
-            }
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Update CHANGELOG.md
-        env:
-          CHANGELOG_CONTENT: ${{ steps.changelog.outputs.changelog }}
-        run: |
-          TAG="${{ github.ref_name }}"
-          DATE=$(date +%Y-%m-%d)
-          NEW_HEADER="## [$TAG] - $DATE"
-
-          # Write changelog content to temp file using env var (avoids shell escaping)
-          printf '%s\n' "$CHANGELOG_CONTENT" > /tmp/new_entry.md
-
-          if [ -f CHANGELOG.md ]; then
-            # Create new file with entry inserted after header line
-            {
-              head -n 1 CHANGELOG.md
-              echo ""
-              echo "$NEW_HEADER"
-              echo ""
-              cat /tmp/new_entry.md
-              echo ""
-              tail -n +2 CHANGELOG.md
-            } > /tmp/CHANGELOG_NEW.md
-            mv /tmp/CHANGELOG_NEW.md CHANGELOG.md
-          else
-            # Create new CHANGELOG.md
-            {
-              echo "# Changelog"
-              echo ""
-              echo "All notable changes to this project will be documented in this file."
-              echo ""
-              echo "This changelog is automatically generated from merged pull requests."
-              echo ""
-              echo "$NEW_HEADER"
-              echo ""
-              cat /tmp/new_entry.md
-            } > CHANGELOG.md
-          fi
-
-          rm -f /tmp/new_entry.md
-
-      - name: Commit changelog
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add CHANGELOG.md
-          git diff --staged --quiet || git commit -m "docs: update CHANGELOG.md for ${{ github.ref_name }}"
-          git push origin HEAD:main || echo "No changes to push or push failed"
-
-      - name: Create GitHub Release
-        uses: softprops/action-gh-release@v3
-        with:
-          tag_name: ${{ github.ref_name }}
-          name: Release ${{ github.ref_name }}
-          body: ${{ steps.changelog.outputs.changelog }}
-          prerelease: ${{ steps.prerelease.outputs.is_prerelease == 'true' }}
-          generate_release_notes: false
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

package/.vscode/settings.json

@@ -1,10 +0,0 @@
-{
-    "eslint.validate": ["javascript", "typescript"],
-    "prettier.useEditorConfig": false,
-    "prettier.useTabs": false,
-    "prettier.configPath": ".prettierrc.json",
-    "prettier.requireConfig": true,
-    "prettier.tabWidth": 4,
-    "prettier.singleQuote": true,
-    "editor.formatOnSave": true,
-}

package/docs/README.md

@@ -1,107 +0,0 @@
-# toiljs
-
-toiljs is a full-stack web framework. You write your **frontend in React** and your **backend in
-TypeScript**, and toiljs turns the backend into a tiny, fast **WebAssembly** program that runs at the edge
-(on servers close to your users, all over the world). One language, one project, one deploy.
-
-If you have used Next.js, this will feel familiar: file-based routes, server code next to client code, a dev
-server with hot reload. The difference is what happens underneath. Your server code is compiled by
-**toilscript** (a TypeScript-to-WebAssembly compiler) into a sandboxed `.wasm` module, and it runs on the
-**Dacely edge** with a built-in worldwide database (**ToilDB**), streaming, background jobs, and auth all
-included.
-
-## The mental model
-
-```mermaid
-flowchart LR
-    A["Your project<br/>(TypeScript + React)"] -->|toiljs build| B["client bundle<br/>(React, runs in the browser)"]
-    A -->|toilscript compile| C["server.wasm<br/>(your backend, sandboxed)"]
-    B --> U["User's browser"]
-    C --> E["Dacely edge<br/>(worldwide)"]
-    E --> D[("ToilDB<br/>global database")]
-    U <-->|HTTP / WebTransport| E
-```
-
-- **client/** is your React app (pages, components, styles). It runs in the browser.
-- **server/** is your backend (routes, database, auth). It compiles to WebAssembly and runs on the edge.
-- **shared/** is the typed bridge: toiljs generates a client here so the browser calls your server with full
-  type safety.
-
-## Hello, toiljs
-
-```ts
-// server/routes/Hello.ts  (a backend HTTP route)
-import { Response } from 'toiljs/server/runtime';
-
-@rest('hello')
-class Hello {
-    @get('/')
-    public hi(): Response {
-        return Response.text('Hello from the edge!\n');
-    }
-}
-```
-
-```tsx
-// client/routes/index.tsx  (a frontend page)
-export default function Home() {
-    return <main><h1>Welcome</h1></main>;
-}
-```
-
-Run `toiljs dev`, open the browser, and both are live with hot reload. That is the whole loop.
-
-## Learn toiljs
-
-**Understand toil first**
-- [Understanding toil](./introduction/README.md): what toil is and the one big idea, then
-  [why toil and who it is for](./introduction/why-toil.md),
-  [the modern stack you get](./introduction/modern-stack.md),
-  [how it works](./introduction/how-it-works.md),
-  [what makes it hyper-scalable](./introduction/hyperscale.md),
-  [how it is distributed](./introduction/distributed.md),
-  [toil versus other frameworks](./introduction/vs-other-frameworks.md), and
-  [why it is built this way](./introduction/design-principles.md).
-
-**Start here**
-- [Getting started](./getting-started/README.md): install, create a project, project structure, your first
-  app, and migrating an existing React app.
-- [The CLI](./cli/README.md): `dev`, `build`, `create`, `doctor`, and every flag.
-- [Deploy](./getting-started/deploy.md): build for production, self-host it, and how the managed edge fits in.
-
-**Build the frontend**
-- [Frontend overview](./frontend/README.md), [Routing](./frontend/routing.md),
-  [Navigation](./frontend/navigation.md), [Components](./frontend/components.md),
-  [Rendering and SSR](./frontend/rendering.md), [Styling](./frontend/styling.md),
-  [Images](./frontend/images.md), [Metadata and SEO](./frontend/metadata.md),
-  [Fetching data](./frontend/data-fetching.md), [Scripts](./frontend/scripts.md),
-  [Search](./frontend/search.md), [The Toil global (reference)](./frontend/toil-global.md).
-
-**Build the backend**
-- [Backend overview](./backend/README.md), [HTTP routes (`@rest`)](./backend/rest.md),
-  [Typed RPC (`@service`/`@remote`)](./backend/rpc.md), [Data types (`@data`)](./backend/data.md).
-
-**The database (ToilDB)**
-- [Database overview and choosing a family](./database/README.md), [Setup (`@database`)](./database/setup.md),
-  [Documents](./database/documents.md), [Unique](./database/unique.md), [Counters](./database/counters.md),
-  [Events](./database/events.md), [Views and `@derive`](./database/views.md),
-  [Membership](./database/membership.md), [Capacity](./database/capacity.md).
-
-**Auth**: [the full auth guide](./auth/README.md) covers post-quantum login, sessions, and `ToilUserId`;
-[customizing the auth emails](./auth/emails.md) shows how to brand the verification, reset, and 2FA mail.
-
-**Realtime and background**
-- [Streams](./realtime/README.md) and [channels](./realtime/channels.md), [Daemons and scheduled
-  jobs](./background/daemons.md), [Derived views (`@derive`)](./background/derive.md).
-
-**Platform services**
-- [Caching](./services/caching.md), [Rate limiting](./services/ratelimit.md),
-  [Environment and secrets](./services/environment.md), [Email and 2FA](./services/email.md),
-  [Analytics](./services/analytics.md), [Crypto](./services/crypto.md), [Cookies](./services/cookies.md),
-  [Time](./services/time.md).
-
-**Concepts and reference**
-- [Writing toiljs correctly (AI + human quick rules)](./concepts/ai-guide.md),
-  [Compute tiers (L1 to L4)](./concepts/tiers.md), [Types (u64, u256, and friends)](./concepts/types.md),
-  [Every decorator](./concepts/decorators.md), [Configuration](./concepts/config.md),
-  [Security and SRI](./concepts/security.md).

package/docs/auth/README.md

@@ -1,104 +0,0 @@
-# Authentication
-
-Toil ships a complete, **post-quantum password login** you turn on with one line. No passwords on your
-server, no third-party identity provider, no hand-written crypto: enable it and you get a `/auth/*` API,
-signed sessions, `@auth`-guarded routes, and a stable per-user identity.
-
-```ts
-// toil.config.ts
-import { defineConfig } from 'toiljs/compiler';
-
-export default defineConfig({
-    server: { auth: true }, // ← mounts the full /auth/* API + sessions
-});
-```
-
-That is the whole setup. The build appends the framework's auth controller to your server, so `/auth/*`
-is live and `@auth` works everywhere.
-
-## What you get
-
-| Endpoint | Purpose |
-| --- | --- |
-| `POST /auth/register/start`, `/register/finish` | Create an account (password never leaves the browser) |
-| `POST /auth/login/start`, `/login/finish` | Log in; sets a signed session cookie |
-| `GET /auth/me` *(`@auth`)* | The current user (`toilUserId` + `username`) |
-| `POST /auth/logout` *(`@auth`)* | Clear the session |
-
-Plus, in your own code:
-
-- **`@auth`** on any route (or a whole `@rest` class) → 401 unless there's a valid session.
-- **`AuthService.getUser()`** → the typed logged-in user.
-- **`AuthService.userId()`** → the stable [`ToilUserId`](./extending.md#toiluserid) (a 256-bit id you can
-  key your data on).
-- **The client**: `import { Auth } from 'toiljs/client'`, then `Auth.register(username, password)` /
-  `Auth.login(username, password)`. It does all the browser-side crypto and talks to `/auth/*` for you.
-
-## A login page in full
-
-```tsx
-// client/routes/login.tsx
-import { useState } from 'react';
-import { Auth } from 'toiljs/client';
-
-export default function Login() {
-    const [u, setU] = useState('');
-    const [p, setP] = useState('');
-    const [msg, setMsg] = useState('');
-
-    const register = async () => {
-        try { await Auth.register(u, p); setMsg('registered, now log in'); }
-        catch (e) { setMsg(parseError(e)); }
-    };
-    const login = async () => {
-        try { await Auth.login(u, p); setMsg('logged in'); }   // sets the session cookie
-        catch (e) { setMsg(parseError(e)); }
-    };
-
-    return (
-        <main>
-            <input value={u} onChange={(e) => setU(e.currentTarget.value)} placeholder="username" />
-            <input value={p} type="password" onChange={(e) => setP(e.currentTarget.value)} placeholder="password" />
-            <button onClick={register}>Register</button>
-            <button onClick={login}>Log in</button>
-            <p>{msg}</p>
-        </main>
-    );
-}
-```
-
-```ts
-// server/routes/Secret.ts, a route only a logged-in user can reach
-import { Response } from 'toiljs/server/runtime';
-
-@rest('secret')
-class Secret {
-    @auth                     // 401 without a valid session
-    @get('/')
-    public secret(): Response {
-        const user = AuthService.getUser()!;      // typed: { toilUserId, username }
-        return Response.text('hello ' + user.username + '\n');
-    }
-}
-```
-
-That's a real, production-grade auth system, the password is stretched with Argon2id in the browser into
-an ML-DSA-44 key pair, your server only ever stores a public key, and login is a mutually-authenticated
-ML-KEM-768 challenge. You didn't write any of it.
-
-## Where to go next
-
-- **[How it works](./how-it-works.md)**: the protocol (OPRF + Argon2id + ML-DSA + ML-KEM), sessions,
-  cookies, and the `ToilUserId`, with sequence diagrams.
-- **[Usage](./usage.md)**: enabling it, the client API, guarding routes, reading the user, the full wire
-  contract of each endpoint.
-- **[Configuration](./configuration.md)**: the secrets a deployment MUST set, the audience/domain, tuning
-  Argon2id, and the deploy checklist.
-- **[Extending & integrating](./extending.md)**: `ToilUserId`, keying your own data on a user, a custom
-  user shape / opting out, and the `AuthService` primitive reference.
-- **[Customizing the auth emails](./emails.md)**: replace the verification, password-reset, and 2FA
-  emails with your own branded React templates by dropping `emails/auth-*.tsx` files.
-
-> **One rule before you ship:** built-in auth runs with **insecure DEV fallback secrets** so it Just Works
-> locally. A deployment MUST set `AUTH_SESSION_SECRET`, `AUTH_OPRF_SEED`, and `AUTH_KEM_SK`. See
-> [Configuration](./configuration.md).