toiljs 0.0.116 → 0.0.118

package/src/compiler/vite.ts

@@ -1,245 +0,0 @@
-import fs from 'node:fs';
-import { createRequire } from 'node:module';
-import path from 'node:path';
-import { pathToFileURL } from 'node:url';
-
-import pc from 'picocolors';
-import react from '@vitejs/plugin-react';
-import { imagetools } from 'vite-imagetools';
-import { nodePolyfills } from 'vite-plugin-node-polyfills';
-import { createLogger, type InlineConfig, type Logger, mergeConfig, type PluginOption } from 'vite';
-
-import { type ResolvedToilConfig } from './config.js';
-import { fontPreloadPlugin } from './fonts.js';
-import { imageReportPlugin } from './image-report.js';
-import { imageBlurPlugin } from './image-blur.js';
-import { toilPlugin } from './plugin.js';
-import { prerenderPlugin } from './prerender.js';
-import { sriPlugin } from './sri.js';
-
-// `vite-plugin-node-polyfills` rewrites react/react-dom to import its `vite-plugin-node-polyfills/
-// shims/*` modules. When a consumer links toiljs by symlink (`file:`/workspace), that package lives
-// only in toiljs's own node_modules, so resolving those bare specifiers from the consumer root
-// fails ("Failed to resolve import vite-plugin-node-polyfills/shims/process"). Alias them to
-// absolute paths resolved from toiljs's location so the build works however toiljs was installed.
-const polyfillPkgRoot = path.dirname(
-    path.dirname(createRequire(import.meta.url).resolve('vite-plugin-node-polyfills')),
-);
-const polyfillShimAliases: Record<string, string> = {
-    'vite-plugin-node-polyfills/shims/buffer': path.join(
-        polyfillPkgRoot,
-        'shims/buffer/dist/index.js',
-    ),
-    'vite-plugin-node-polyfills/shims/global': path.join(
-        polyfillPkgRoot,
-        'shims/global/dist/index.js',
-    ),
-    'vite-plugin-node-polyfills/shims/process': path.join(
-        polyfillPkgRoot,
-        'shims/process/dist/index.js',
-    ),
-};
-
-/** Image extensions routed to `images/` in the build output. */
-const IMAGE_EXT = /^(png|jpe?g|svg|gif|tiff|bmp|ico|webp|avif)$/i;
-/** Font extensions routed to `fonts/`. */
-const FONT_EXT = /^(woff|woff2|eot|ttf|otf)$/i;
-
-/**
- * Resolves bare `shared/*` imports to the project's `shared/` folder (replacing a plain alias so it
- * can run early), and fails `shared/server` with an actionable message when the module has not been
- * generated yet (it comes from the server build, which must run first), instead of Vite's opaque
- * `UNLOADABLE_DEPENDENCY`.
- */
-function sharedResolverPlugin(cfg: ResolvedToilConfig): PluginOption {
-    const sharedDir = path.join(cfg.root, 'shared');
-    const serverModule = path.join(sharedDir, 'server.ts');
-    // Posix-normalized: Vite hands `transform` forward-slash module ids while path.join is OS-native, so a
-    // raw `===` would silently never match on Windows (the surface would regress to "client not loaded").
-    const routesModule = path.join(cfg.toilDir, 'routes.ts').replace(/\\/g, '/');
-    return {
-        name: 'toiljs:shared-resolver',
-        enforce: 'pre',
-        resolveId(source: string) {
-            if (source !== 'shared' && !source.startsWith('shared/')) return null;
-            const rel = source === 'shared' ? 'index' : source.slice('shared/'.length);
-            for (const ext of ['', '.ts', '.tsx', '.js', '.jsx', '.mjs']) {
-                const candidate = path.join(sharedDir, rel + ext);
-                if (fs.existsSync(candidate)) return candidate;
-            }
-            if (source === 'shared/server') {
-                throw new Error(
-                    'toiljs: "shared/server" is generated by the server build but is missing. ' +
-                        'Run the server build first (it emits shared/server.ts from your @data/@remote code): ' +
-                        '`npm run build:server`  (toilscript --target release --rpcModule shared/server.ts).',
-                );
-            }
-            return null;
-        },
-        transform(code: string, id: string) {
-            // Guarantee the generated client surface (shared/server.ts: __toilRest/__toilRpc/__toilStream
-            // + globalThis.Server) is EVALUATED. Otherwise it is dead unless some route happens to
-            // value-import a @data type - a type-only import is erased and never attaches, so
-            // `Server.<rpc>()` / `Server.REST` / `Server.Stream` would throw "client not loaded". Inject a
-            // side-effect import from the always-loaded route manifest; idempotent and a no-op for a
-            // client-only project (no shared/server.ts).
-            if ((id.split('?')[0] ?? id).replace(/\\/g, '/') === routesModule && fs.existsSync(serverModule)) {
-                return { code: `import 'shared/server';\n${code}`, map: null };
-            }
-            return null;
-        },
-    };
-}
-
-/** Routes a built asset to a typed sub-folder (`images/`, `fonts/`, `css/`, else `assets/`). CSS is
- *  content-hashed (`[name]-[hash]`) because we put Subresource Integrity on `<link rel=stylesheet>`:
- *  a stable URL whose bytes change across deploys would make a client holding stale HTML fail the
- *  integrity check and BLOCK the stylesheet. Hashing pins the URL to its bytes, so the baked integrity
- *  can never falsely mismatch (identical to how JS chunks are hashed). Images/fonts stay stable-named:
- *  they carry no SRI and are commonly referenced by fixed path. */
-function assetFileName(name: string): string {
-    const ext = name.split('.').pop() ?? '';
-    if (IMAGE_EXT.test(ext)) return 'images/[name][extname]';
-    if (FONT_EXT.test(ext)) return 'fonts/[name][extname]';
-    if (/^css$/i.test(ext)) return 'css/[name]-[hash][extname]';
-    return 'assets/[name][extname]';
-}
-
-/**
- * Loads the Tailwind v4 Vite plugin if the project has `@tailwindcss/vite` installed (added by
- * `toiljs create`/`configure` when Tailwind is enabled). Resolved from the project root so it picks
- * up the project's copy; returns `undefined` when Tailwind is off, so the plugin simply isn't added.
- */
-async function tailwindPlugin(root: string): Promise<PluginOption | undefined> {
-    let resolved: string;
-    try {
-        resolved = createRequire(path.join(root, 'package.json')).resolve('@tailwindcss/vite');
-    } catch {
-        return undefined;
-    }
-    const mod = (await import(pathToFileURL(resolved).href)) as { default?: () => PluginOption };
-    return mod.default?.();
-}
-
-/** Splits React's runtime into its own long-lived chunk for better caching. */
-function manualChunks(id: string): string | undefined {
-    if (!id.includes('node_modules')) return undefined;
-    if (
-        id.includes('node_modules/react-dom') ||
-        id.includes('node_modules/react/') ||
-        id.includes('node_modules/scheduler')
-    ) {
-        return 'react';
-    }
-    return undefined;
-}
-
-/**
- * Builds the framework-owned Vite config. Vite's `root` is the generated `.toil` dir so its
- * `index.html` (built from the project's `public/index.html` template) emits at the output root
- * with assets resolving correctly; static `public/` assets are mirrored to `.toil/public` and
- * picked up via Vite's default publicDir. `fs.allow` opens the project (for `client/`) and the
- * framework runtime. The opinionated default, Node polyfills
- * (Buffer/global/process), React plugin, toil route plugin, typed asset folders, React chunk
- * splitting and tuned build options, is applied here; `toiljs/client` is aliased to the
- * runtime, and the user's `client.vite` overrides deep-merge on top.
- */
-/**
- * Vite's `(ssr)` environment label is dark blue — nearly invisible on a black
- * terminal. Wrap the default logger to recolor `(ssr)` magenta (purple) and
- * `(client)` cyan, so the dev reload logs are readable.
- */
-function brandedLogger(): Logger {
-    const logger = createLogger();
-    const recolor = (msg: string): string =>
-        msg
-            .replace(/(?:\[[0-9;]*m)*\(ssr\)(?:\[[0-9;]*m)*/g, pc.magenta('(ssr)'))
-            .replace(/(?:\[[0-9;]*m)*\(client\)(?:\[[0-9;]*m)*/g, pc.cyan('(client)'));
-    const info = logger.info.bind(logger);
-    const warn = logger.warn.bind(logger);
-    logger.info = (msg, opts) => info(recolor(msg), opts);
-    logger.warn = (msg, opts) => warn(recolor(msg), opts);
-    return logger;
-}
-
-export async function createViteConfig(cfg: ResolvedToilConfig): Promise<InlineConfig> {
-    const frameworkRoot = path.resolve(path.dirname(cfg.runtimePath), '..', '..');
-    const tailwind = await tailwindPlugin(cfg.root);
-
-    const base: InlineConfig = {
-        root: cfg.toilDir,
-        base: cfg.base,
-        configFile: false,
-        customLogger: brandedLogger(),
-        plugins: [
-            tailwind,
-            // Auto-generate a tiny blurred base64 LQIP for `?toil` image imports (consumed by
-            // `Toil.Image` placeholder="blur"). Runs before imagetools (enforce:'pre') so it owns the
-            // `?toil` query; the bare re-imported src still flows through imagetools below.
-            cfg.images ? imageBlurPlugin() : undefined,
-            // Build-time image resize/optimization. Every *imported* raster image is compressed to
-            // webp by default (so a plain `<img src={imported}>` is optimized too, not just
-            // `Toil.Image`); add `?w=400;800&format=…` to resize or pick a format. `public/` assets
-            // referenced by string path are served as-is. Disabled by `client.images: false`.
-            cfg.images
-                ? imagetools({
-                      defaultDirectives: () =>
-                          new URLSearchParams({ format: 'webp', quality: '80' }),
-                  })
-                : undefined,
-            cfg.images ? imageReportPlugin(cfg.root, cfg.toilDir) : undefined,
-            // Subresource Integrity (build only): adds integrity="sha384-…" + crossorigin to every
-            // local script/stylesheet/modulepreload in the shell. MUST precede prerenderPlugin so the
-            // per-route/bracket/SSR pages baked from the shell inherit it (and the SSR .tmpl coherence
-            // hash covers it).
-            sriPlugin(cfg),
-            // Static per-route SEO prerender (build only): bakes each route's metadata into its HTML.
-            cfg.seo ? prerenderPlugin(cfg) : undefined,
-            // Preload bundled fonts (build only). Disabled by `client.fonts: false`.
-            cfg.fonts ? fontPreloadPlugin(cfg) : undefined,
-            nodePolyfills({ globals: { Buffer: true, global: true, process: true } }),
-            react(),
-            sharedResolverPlugin(cfg),
-            toilPlugin(cfg),
-        ],
-        resolve: {
-            alias: {
-                'toiljs/client': cfg.runtimePath,
-                'toiljs/routes': path.join(cfg.toilDir, 'routes.ts'),
-                // `client/*` -> the project's client source dir, so anything (pages, and notably
-                // `emails/*.tsx`) can reuse existing client assets, e.g. `import 'client/styles/x.css'`.
-                // Vite's string alias matches only `client` or `client/...`, never `toiljs/client`.
-                client: cfg.clientAbsDir,
-                // `shared/*` is resolved by sharedResolverPlugin (above) so a missing generated
-                // shared/server.ts gives an actionable error instead of an opaque load failure.
-                ...polyfillShimAliases,
-            },
-            dedupe: ['react', 'react-dom'],
-        },
-        server: {
-            port: cfg.port,
-            fs: { allow: [cfg.root, frameworkRoot] },
-        },
-        build: {
-            outDir: path.resolve(cfg.root, cfg.outDir),
-            emptyOutDir: true,
-            target: 'es2020',
-            modulePreload: false,
-            cssCodeSplit: false,
-            assetsInlineLimit: 10000,
-            chunkSizeWarningLimit: 3000,
-            commonjsOptions: {
-                strictRequires: true,
-                transformMixedEsModules: true,
-            },
-            rollupOptions: {
-                output: {
-                    chunkFileNames: 'assets/[name]-[hash].js',
-                    assetFileNames: (assetInfo) => assetFileName(assetInfo.names[0] ?? ''),
-                    manualChunks,
-                },
-            },
-        },
-    };
-    return mergeConfig(base, cfg.vite);
-}

package/src/devserver/analytics/index.ts

@@ -1,317 +0,0 @@
-/**
- * Dev-server stand-in for the edge `env.analytics_read` host import
- * (toil-backend `src/wasm/host/import_functions/analytics.rs`). It returns a fixed
- * sample `TenantStats` frame so a tenant's wasm exercises the toilscript `Analytics`
- * API under `toiljs dev`. The frame is stashed into the SAME per-request result
- * buffer the `data.*` ops use (`db.lastResult`), so the guest drains it with the
- * existing `data.take_result`.
- *
- * Dev is intentionally PERMISSIVE: it returns sample data for ANY domain (own or
- * named) so a dashboard can be built locally. The real `dacely.com`-only
- * authorization is enforced host-side at the edge; the dev server has no
- * multi-tenant host resolution to authorize against.
- */
-import type { DbDevState } from '../db/index.js';
-import type { MemoryRef } from '../runtime/host.js';
-
-/** Frame version + counter count, kept in lockstep with the edge (`analytics.rs` / `metric_id.rs`). */
-const FRAME_VERSION = 3;
-const METRIC_COUNTERS = 42;
-
-/** The sustained-rate window: requests are metered over a 3-minute ROLLING window. A plan's
- *  `sustained_rps` (X) allows `X * BURST_WINDOW_SECS` requests across it; instantaneous spikes above
- *  that are NOT capped per-tier (only the box `firewall.global_pps` DDoS backstop applies). */
-export const BURST_WINDOW_SECS = 180;
-
-/** The plan's sustained rate in requests/second, derived from the rolling window's allowance.
- *  `0` means unmetered (no sustained cap), and must NOT be divided into a rate. */
-export function sustainedRpsCap(reqBurstCap: number): number {
-    return reqBurstCap === 0 ? 0 : reqBurstCap / BURST_WINDOW_SECS;
-}
-/** MetricId indices we seed with sample data (others default 0). Mirrors the AUTHORITATIVE edge wire
- *  contract EXACTLY (`toil-backend/src/analytics/metric_id.rs`): counter ids 0..=41, gauge ids
- *  ConnectedStreamsAvg=42, CommittedMemoryAvg=44. There is NO WasmDispatches (removed + reindexed); the
- *  edge/guest are 42, so this must be 42 with matching indices or the dashboard mislabels every metric. */
-const MID = {
-    Requests: 0,
-    BytesOutL1: 1,
-    BytesInL1: 2,
-    Status2xx: 3,
-    Status4xx: 5,
-    StaticHits: 7,
-    GasUsed: 11,
-    DbOps: 12,
-    DbReads: 13,
-    DbWrites: 14,
-    StreamBytesIn: 24,
-    StreamBytesOut: 25,
-    MemGrownBytes: 38,
-    CacheHits: 40,
-    CacheMisses: 41,
-} as const;
-
-interface DevTenantStats {
-    life: bigint[]; // length METRIC_COUNTERS, indexed by MetricId
-    connectedStreams: number;
-    committedMemory: number;
-    // Fleet-global requests in the trailing 3-minute ROLLING window, and its allowance
-    // (= sustained_rps * BURST_WINDOW_SECS; 0 = unmetered). Spikes are not tier-capped.
-    reqBurstUsed: number;
-    reqBurstCap: number;
-    // Fleet-global requests in the current 30-day tumbling bucket, and the 30-day quota (0 = unmetered).
-    req30dUsed: number;
-    req30dCap: number;
-    // Derived (NOT part of the wire frame): the plan's sustained request rate, `reqBurstCap /
-    // BURST_WINDOW_SECS` (0 = unmetered). Surfaced so a dev dashboard can show "X sustained rps".
-    sustainedRpsCap: number;
-    // LIVE per-second rates (f64), appended after the windows. Mirrors the edge `encode_stats`.
-    rps: number;
-    bytesInPerSec: number;
-    bytesOutPerSec: number;
-    streamBytesInPerSec: number;
-    streamBytesOutPerSec: number;
-    dbOpsPerSec: number;
-    gasPerSec: number;
-    nowMs: number;
-}
-
-/** A plausible sample so a guest sees non-zero analytics under `toiljs dev`. */
-function devStats(): DevTenantStats {
-    const life = new Array<bigint>(METRIC_COUNTERS).fill(0n);
-    life[MID.Requests] = 42n;
-    life[MID.BytesOutL1] = 12345n;
-    life[MID.BytesInL1] = 4096n;
-    life[MID.Status2xx] = 40n;
-    life[MID.Status4xx] = 2n;
-    life[MID.StaticHits] = 8n;
-    life[MID.GasUsed] = 1_000_000n;
-    life[MID.DbOps] = 17n;
-    life[MID.DbReads] = 12n;
-    life[MID.DbWrites] = 5n;
-    life[MID.StreamBytesIn] = 2048n;
-    life[MID.StreamBytesOut] = 8192n;
-    life[MID.MemGrownBytes] = 262144n;
-    life[MID.CacheHits] = 900n;
-    life[MID.CacheMisses] = 100n;
-    // Free tier: sustained 1000 rps -> a 3-minute burst cap of 1000 * 180 = 180_000, plus a 30-day
-    // quota of 10_000_000. `used` values are small so the dashboard shows plenty of headroom.
-    const reqBurstCap: number = 180_000;
-    return {
-        life,
-        connectedStreams: 3,
-        committedMemory: 65536,
-        reqBurstUsed: 1_200,
-        reqBurstCap,
-        req30dUsed: 250_000,
-        req30dCap: 10_000_000,
-        sustainedRpsCap: sustainedRpsCap(reqBurstCap),
-        // Plausible non-zero live rates so a dev dashboard shows moving gauges.
-        rps: 0.7,
-        bytesInPerSec: 68.2,
-        bytesOutPerSec: 205.75,
-        streamBytesInPerSec: 34.1,
-        streamBytesOutPerSec: 136.5,
-        dbOpsPerSec: 0.28,
-        gasPerSec: 16_666.67,
-        nowMs: 1_700_000_000_000,
-    };
-}
-
-/**
- * Encode the v3 snapshot frame BYTE-FOR-BYTE like the edge (`analytics.rs` `encode_stats`), FIXED
- * layout (no strings). The v2 -> v3 bump renamed two u64 pairs (req_minute_* -> req_burst_*,
- * req_day_* -> req_30d_*); the BYTE LAYOUT is UNCHANGED (same field count, order, and widths).
- * Counters/levels are u64; the 7 trailing LIVE per-second rates are f64:
- *   u16 version | u64 now_ms | u32 count | u64 × count | u64 connectedStreams | u64 committedMemory |
- *   u64 reqBurstUsed | u64 reqBurstCap | u64 req30dUsed | u64 req30dCap |
- *   f64 rps | f64 bytesInPerSec | f64 bytesOutPerSec | f64 streamBytesInPerSec |
- *   f64 streamBytesOutPerSec | f64 dbOpsPerSec | f64 gasPerSec
- * The rates are APPENDED (version-gated by length): the guest's bounds-checked reader yields 0.0 for a
- * pre-rates frame, so an older edge stays decodable.
- */
-function encodeStats(s: DevTenantStats): Buffer {
-    const head = Buffer.alloc(2 + 8 + 4);
-    head.writeUInt16LE(FRAME_VERSION, 0);
-    head.writeBigUInt64LE(BigInt(s.nowMs), 2);
-    head.writeUInt32LE(s.life.length, 10);
-    // 6 window u64s (48 bytes) + 7 rate f64s (56 bytes).
-    const body = Buffer.alloc(s.life.length * 8 + 48 + 56);
-    let o = 0;
-    for (const v of s.life) {
-        body.writeBigUInt64LE(v, o);
-        o += 8;
-    }
-    body.writeBigUInt64LE(BigInt(s.connectedStreams), o); o += 8;
-    body.writeBigUInt64LE(BigInt(s.committedMemory), o); o += 8;
-    body.writeBigUInt64LE(BigInt(s.reqBurstUsed), o); o += 8;
-    body.writeBigUInt64LE(BigInt(s.reqBurstCap), o); o += 8;
-    body.writeBigUInt64LE(BigInt(s.req30dUsed), o); o += 8;
-    body.writeBigUInt64LE(BigInt(s.req30dCap), o); o += 8;
-    body.writeDoubleLE(s.rps, o); o += 8;
-    body.writeDoubleLE(s.bytesInPerSec, o); o += 8;
-    body.writeDoubleLE(s.bytesOutPerSec, o); o += 8;
-    body.writeDoubleLE(s.streamBytesInPerSec, o); o += 8;
-    body.writeDoubleLE(s.streamBytesOutPerSec, o); o += 8;
-    body.writeDoubleLE(s.dbOpsPerSec, o); o += 8;
-    body.writeDoubleLE(s.gasPerSec, o);
-    return Buffer.concat([head, body]);
-}
-
-/** The metric ids carried in the per-minute ring (mirrors the edge `MINUTE_RING_METRICS` in
- *  `toil-backend/src/analytics/ring.rs` EXACTLY). Only these get minute resolution on the 1h/6h ranges;
- *  every other metric falls back to the hour ring there. These are the AUTHORITATIVE edge ids
- *  (Requests=0, BytesInL1=2, BytesOutL1=1, GasUsed=11, DbOps=12, StreamBytesIn=24, StreamBytesOut=25,
- *  MemGrownBytes=38, ConnectedStreamsAvg=42, CommittedMemoryAvg=44) -- must match the reindexed layout or
- *  the dev 1h/6h graphs pick the wrong ring for these metrics. */
-const MINUTE_RING_METRICS = new Set<number>([0, 1, 2, 11, 12, 24, 25, 38, 42, 44]);
-
-/**
- * Range id -> (bucketCount, bucketSecs), matching the edge `Range` + minute-ring fallback: 1h/6h are
- * per-minute ONLY for a minute-ring metric; otherwise they fall back to the hour ring (1h/6h buckets).
- */
-function rangeShape(range: number, metricId: number): { count: number; bucketSecs: number } {
-    const isMinute = (range === 0 || range === 1) && MINUTE_RING_METRICS.has(metricId);
-    if (isMinute) return range === 0 ? { count: 60, bucketSecs: 60 } : { count: 360, bucketSecs: 60 };
-    switch (range) {
-        case 0: return { count: 1, bucketSecs: 3600 }; // 1h on the hour ring
-        case 1: return { count: 6, bucketSecs: 3600 }; // 6h on the hour ring
-        case 2: return { count: 12, bucketSecs: 3600 };
-        case 3: return { count: 24, bucketSecs: 3600 };
-        case 4: return { count: 72, bucketSecs: 3600 };
-        case 5: return { count: 168, bucketSecs: 3600 };
-        case 6: return { count: 336, bucketSecs: 3600 };
-        case 7: return { count: 720, bucketSecs: 3600 };
-        case 8: return { count: 60, bucketSecs: 86_400 }; // D60 on the DAY ring
-        case 9: return { count: 90, bucketSecs: 86_400 }; // D90 on the DAY ring
-        default: return { count: 24, bucketSecs: 3600 };
-    }
-}
-
-/**
- * Encode the v3 series frame BYTE-FOR-BYTE like the edge `encode_series` (points are u64 now):
- *   u16 version | u16 metricId | u32 bucketSecs | u64 headMs | u32 count | u64 × count
- * A synthetic gentle ramp so a dev dashboard draws a non-flat line.
- */
-function encodeSeries(metricId: number, range: number): Buffer {
-    const { count, bucketSecs } = rangeShape(range, metricId);
-    const nowMs = 1_700_000_000_000;
-    const head = Buffer.alloc(2 + 2 + 4 + 8 + 4);
-    head.writeUInt16LE(FRAME_VERSION, 0);
-    head.writeUInt16LE(metricId & 0xffff, 2);
-    head.writeUInt32LE(bucketSecs, 4);
-    head.writeBigUInt64LE(BigInt(nowMs), 8);
-    head.writeUInt32LE(count, 16);
-    const body = Buffer.alloc(count * 8);
-    for (let i = 0; i < count; i++) {
-        // A smooth ramp with a little variation, deterministic per (metric, index). Non-negative -> u64.
-        const v = BigInt(((i * 7 + metricId) % 50) + i);
-        body.writeBigUInt64LE(v, i * 8);
-    }
-    return Buffer.concat([head, body]);
-}
-
-/**
- * Encode a site page BYTE-FOR-BYTE like the edge (analytics.rs `encode_site_list`):
- *   count u32 | (u32 nameLen, name bytes)* | has_more u8, all little-endian.
- */
-function encodeSiteList(names: string[], hasMore: boolean): Buffer {
-    const parts: Buffer[] = [];
-    const head = Buffer.alloc(4);
-    head.writeUInt32LE(names.length, 0);
-    parts.push(head);
-    for (const name of names) {
-        const nb = Buffer.from(name, 'utf8');
-        const nl = Buffer.alloc(4);
-        nl.writeUInt32LE(nb.length, 0);
-        parts.push(nl, nb);
-    }
-    parts.push(Buffer.from([hasMore ? 1 : 0]));
-    return Buffer.concat(parts);
-}
-
-// Mirror the edge ABI bounds (analytics.rs) so dev exercises the SAME negative-status paths as prod.
-const MAX_DOMAIN_LEN = 256;
-const MAX_CURSOR_LEN = 256;
-const ABSENT = -2; // the edge's ABSENT sentinel; the guest maps a negative status to empty stats/list.
-// Pre-sorted so cursor pagination is deterministic and matches the edge's sorted enumeration.
-const SITE_SAMPLE = ['demo.dacely.com', 'example.com', 'shop.test'];
-
-/** The `env.analytics_read` + `env.analytics_list_sites` dev imports. Mirrors `buildDatabaseImports`. */
-export function buildAnalyticsImports(
-    ref: MemoryRef,
-    db: DbDevState,
-): Record<string, (...args: number[]) => number> {
-    return {
-        analytics_read: (domainPtr: number, domainLen: number): number => {
-            // Over-long domain -> ABSENT, mirroring the edge (which returns a negative status, not a
-            // trap); the guest maps it to empty stats. domainLen 0 = the caller's own stats.
-            if (domainLen > MAX_DOMAIN_LEN) return ABSENT;
-            if (domainLen > 0) {
-                if (!ref.memory) throw new Error('analytics_read called before memory was bound');
-                const m = Buffer.from(ref.memory.buffer);
-                if (domainPtr < 0 || domainPtr + domainLen > m.length) {
-                    throw new Error('analytics_read: domain out of bounds');
-                }
-            }
-            const frame = encodeStats(devStats());
-            db.lastResult = frame;
-            db.lastResultVersion = -1;
-            return frame.length;
-        },
-
-        // `env.analytics_series`: one metric's time-series for a range. Dev returns a synthetic ramp
-        // (real ring reads are edge-side). Mirrors the edge bounds + negative-status paths.
-        analytics_series: (
-            domainPtr: number,
-            domainLen: number,
-            metricId: number,
-            range: number,
-        ): number => {
-            if (domainLen > MAX_DOMAIN_LEN) return ABSENT;
-            // Valid metric ids are 0..=45 (counters 0..=41 + the 4 gauge avg/peak series 42..=45), matching
-            // the edge `MetricId::from_u16` (v < N_METRICS=46); ranges 0..=9 (H1..D30 + D60/D90).
-            if (metricId < 0 || metricId > 45 || range < 0 || range > 9) return ABSENT;
-            if (domainLen > 0) {
-                if (!ref.memory) throw new Error('analytics_series called before memory was bound');
-                const m = Buffer.from(ref.memory.buffer);
-                if (domainPtr < 0 || domainPtr + domainLen > m.length) {
-                    throw new Error('analytics_series: domain out of bounds');
-                }
-            }
-            const frame = encodeSeries(metricId, range);
-            db.lastResult = frame;
-            db.lastResultVersion = -1;
-            return frame.length;
-        },
-
-        // The dacely dashboard enumerate-all-sites stub. Dev returns a fixed SORTED sample for any
-        // caller (the real dacely.com-only authz is the edge), but mirrors the edge ABI exactly:
-        // over-long/non-utf8 cursor -> ABSENT, cursor = strictly-after, limit cap, and a REAL has_more.
-        analytics_list_sites: (cursorPtr: number, cursorLen: number, limit: number): number => {
-            if (cursorLen > MAX_CURSOR_LEN) return ABSENT;
-            let cursor = '';
-            if (cursorLen > 0) {
-                if (!ref.memory) throw new Error('analytics_list_sites called before memory was bound');
-                const m = Buffer.from(ref.memory.buffer);
-                if (cursorPtr < 0 || cursorPtr + cursorLen > m.length) {
-                    throw new Error('analytics_list_sites: cursor out of bounds');
-                }
-                const cb = m.subarray(cursorPtr, cursorPtr + cursorLen);
-                try {
-                    cursor = new TextDecoder('utf-8', { fatal: true }).decode(cb);
-                } catch {
-                    return ABSENT; // non-utf8 cursor -> empty page, mirroring the edge
-                }
-            }
-            const start = SITE_SAMPLE.findIndex((n) => n > cursor); // strictly after the cursor
-            const from = start < 0 ? SITE_SAMPLE.length : start;
-            const lim = limit > 0 ? Math.min(limit, 256) : 256;
-            const page = SITE_SAMPLE.slice(from, from + lim);
-            const hasMore = from + page.length < SITE_SAMPLE.length;
-            const frame = encodeSiteList(page, hasMore);
-            db.lastResult = frame;
-            db.lastResultVersion = -1;
-            return frame.length;
-        },
-    };
-}

package/src/devserver/config/dotenv.ts

@@ -1,102 +0,0 @@
-/**
- * Shared dotenv loader for the dev server (and the future Node self-host): reads
- * a project's `.env` (plain vars) + `.env.secrets` (secrets) and splits out the
- * framework-reserved `TOIL_*` keys (host-only), mirroring the edge's `env_store`.
- *
- * Vite/devserver-free on purpose — both the `Environment.get/getSecure` dev
- * source (`./env.ts`) and the email backend config (`./email/config.ts`) consume
- * this one loader, and the self-host will too.
- */
-import fs from 'node:fs';
-import path from 'node:path';
-
-/** Keys with this prefix are framework-reserved/host-only (never a tenant var/secret). */
-export const RESERVED_PREFIX = 'TOIL_';
-
-export interface LoadedEnv {
-    /** Non-reserved `.env` entries + `process.env` overlay → `Environment.get`. */
-    readonly vars: Map<string, string>;
-    /** Non-reserved `.env.secrets` entries → `Environment.getSecure`. */
-    readonly secrets: Map<string, string>;
-    /** Reserved `TOIL_*` entries from either file (+ `process.env`) → host-only config. */
-    readonly reserved: Map<string, string>;
-}
-
-const cache = new Map<string, LoadedEnv>();
-
-/** Parse one dotenv value: take inside matching quotes, else cut an inline ` #`. */
-function parseValue(rest: string): string {
-    const q = rest[0];
-    if (q === '"' || q === "'") {
-        const end = rest.indexOf(q, 1);
-        return end < 0 ? rest.slice(1) : rest.slice(1, end);
-    }
-    const hash = rest.indexOf(' #');
-    return (hash < 0 ? rest : rest.slice(0, hash)).trimEnd();
-}
-
-/**
- * Parse dotenv text into `plain` (non-reserved) and `reserved` (`TOIL_*`):
- * `KEY=value`, `#` comments, optional `export`, optional surrounding quotes.
- */
-function parseDotenv(
-    text: string,
-    plain: Map<string, string>,
-    reserved: Map<string, string>,
-): void {
-    for (const raw of text.split('\n')) {
-        let line = raw.trim();
-        if (line.length === 0 || line.startsWith('#')) continue;
-        if (line.startsWith('export ')) line = line.slice('export '.length);
-        const eq = line.indexOf('=');
-        if (eq < 0) continue;
-        const key = line.slice(0, eq).trim();
-        if (key.length === 0) continue;
-        const val = parseValue(line.slice(eq + 1).trim());
-        (key.startsWith(RESERVED_PREFIX) ? reserved : plain).set(key, val);
-    }
-}
-
-function readFileInto(
-    file: string,
-    plain: Map<string, string>,
-    reserved: Map<string, string>,
-): void {
-    try {
-        parseDotenv(fs.readFileSync(file, 'utf8'), plain, reserved);
-    } catch {
-        /* file absent: skip */
-    }
-}
-
-/**
- * Load `<root>/.env` + `<root>/.env.secrets`, cached by resolved root. `process.env`
- * overlays first (non-reserved → vars, `TOIL_*` → reserved), then the files take
- * precedence. Secrets come only from `.env.secrets`.
- */
-export function loadEnvFiles(root: string): LoadedEnv {
-    const key = path.resolve(root);
-    const hit = cache.get(key);
-    if (hit) return hit;
-
-    const vars = new Map<string, string>();
-    const secrets = new Map<string, string>();
-    const reserved = new Map<string, string>();
-
-    // process.env overlay: non-reserved as plain vars, TOIL_* as reserved config.
-    for (const [k, v] of Object.entries(process.env)) {
-        if (typeof v !== 'string') continue;
-        (k.startsWith(RESERVED_PREFIX) ? reserved : vars).set(k, v);
-    }
-    readFileInto(path.join(key, '.env'), vars, reserved);
-    readFileInto(path.join(key, '.env.secrets'), secrets, reserved);
-
-    const out: LoadedEnv = { vars, secrets, reserved };
-    cache.set(key, out);
-    return out;
-}
-
-/** Drop the cache (tests). */
-export function clearEnvCache(): void {
-    cache.clear();
-}