toiljs 0.0.55 → 0.0.57

package/src/io/codec.ts

@@ -34,60 +34,81 @@ export class DataWriter {
         this.view = new DataView(this.buf.buffer);
     }
 
-    /**
-     * Ensures room for `extra` more bytes and returns the offset to write at. Grows
-     * (doubling) when needed, reassigning `buf`/`view`. Callers MUST read the returned
-     * offset into a local before touching `this.view`/`this.buf`, since a grow swaps
-     * them out from under a stale receiver.
-     */
-    private reserve(extra: number): number {
-        const need = this.off + extra;
-        if (need > this.buf.length) {
-            let n = this.buf.length;
-            while (n < need) n <<= 1;
-            const bigger = new Uint8Array(n);
-            bigger.set(this.buf.subarray(0, this.off));
-            this.buf = bigger;
-            this.view = new DataView(this.buf.buffer);
-        }
-        const at = this.off;
-        this.off += extra;
-        return at;
+    /** Writes an unsigned 8-bit byte (the low 8 bits of `v`). */
+    writeU8(v: number): this {
+        const at = this.reserve(1);
+        this.view.setUint8(at, v & 0xff);
+        return this;
     }
 
-    /** Writes an unsigned 8-bit byte (the low 8 bits of `v`). */
-    writeU8(v: number): this { const at = this.reserve(1); this.view.setUint8(at, v & 0xff); return this; }
     /** Writes an unsigned 16-bit integer. @param be - big-endian if true (default little-endian). */
-    writeU16(v: number, be?: boolean): this { const at = this.reserve(2); this.view.setUint16(at, v & 0xffff, !be); return this; }
+    writeU16(v: number, be?: boolean): this {
+        const at = this.reserve(2);
+        this.view.setUint16(at, v & 0xffff, !be);
+        return this;
+    }
+
     /** Writes an unsigned 32-bit integer. @param be - big-endian if true (default little-endian). */
-    writeU32(v: number, be?: boolean): this { const at = this.reserve(4); this.view.setUint32(at, v >>> 0, !be); return this; }
+    writeU32(v: number, be?: boolean): this {
+        const at = this.reserve(4);
+        this.view.setUint32(at, v >>> 0, !be);
+        return this;
+    }
+
     /** Writes an unsigned 64-bit integer (low 64 bits of `v`). @param be - big-endian if true. */
-    writeU64(v: bigint, be?: boolean): this { const at = this.reserve(8); this.view.setBigUint64(at, v & MASK64, !be); return this; }
+    writeU64(v: bigint, be?: boolean): this {
+        const at = this.reserve(8);
+        this.view.setBigUint64(at, v & MASK64, !be);
+        return this;
+    }
+
     /** Writes a signed 8-bit integer. */
-    writeI8(v: number): this { const at = this.reserve(1); this.view.setInt8(at, v); return this; }
+    writeI8(v: number): this {
+        const at = this.reserve(1);
+        this.view.setInt8(at, v);
+        return this;
+    }
+
     /** Writes a signed 16-bit integer. @param be - big-endian if true (default little-endian). */
-    writeI16(v: number, be?: boolean): this { const at = this.reserve(2); this.view.setInt16(at, v, !be); return this; }
+    writeI16(v: number, be?: boolean): this {
+        const at = this.reserve(2);
+        this.view.setInt16(at, v, !be);
+        return this;
+    }
+
     /** Writes a signed 32-bit integer. @param be - big-endian if true (default little-endian). */
-    writeI32(v: number, be?: boolean): this { const at = this.reserve(4); this.view.setInt32(at, v | 0, !be); return this; }
+    writeI32(v: number, be?: boolean): this {
+        const at = this.reserve(4);
+        this.view.setInt32(at, v | 0, !be);
+        return this;
+    }
+
     /** Writes a signed 64-bit integer. @param be - big-endian if true (default little-endian). */
-    writeI64(v: bigint, be?: boolean): this { const at = this.reserve(8); this.view.setBigInt64(at, BigInt.asIntN(64, v), !be); return this; }
+    writeI64(v: bigint, be?: boolean): this {
+        const at = this.reserve(8);
+        this.view.setBigInt64(at, BigInt.asIntN(64, v), !be);
+        return this;
+    }
+
     /** Writes a 32-bit float. @param be - big-endian if true (default little-endian). */
-    writeF32(v: number, be?: boolean): this { const at = this.reserve(4); this.view.setFloat32(at, v, !be); return this; }
-    /** Writes a 64-bit float. @param be - big-endian if true (default little-endian). */
-    writeF64(v: number, be?: boolean): this { const at = this.reserve(8); this.view.setFloat64(at, v, !be); return this; }
-    /** Writes a boolean as one byte (1 or 0). */
-    writeBool(v: boolean): this { return this.writeU8(v ? 1 : 0); }
+    writeF32(v: number, be?: boolean): this {
+        const at = this.reserve(4);
+        this.view.setFloat32(at, v, !be);
+        return this;
+    }
 
-    /** Writes the `count` 64-bit limbs of `u` (low limb first in LE, high limb first in BE). */
-    private writeLimbs(u: bigint, count: number, be: boolean): this {
-        if (be) {
-            for (let i = count - 1; i >= 0; i--) this.writeU64((u >> BigInt(i * 64)) & MASK64, true);
-        } else {
-            for (let i = 0; i < count; i++) this.writeU64((u >> BigInt(i * 64)) & MASK64, false);
-        }
+    /** Writes a 64-bit float. @param be - big-endian if true (default little-endian). */
+    writeF64(v: number, be?: boolean): this {
+        const at = this.reserve(8);
+        this.view.setFloat64(at, v, !be);
         return this;
     }
 
+    /** Writes a boolean as one byte (1 or 0). */
+    writeBool(v: boolean): this {
+        return this.writeU8(v ? 1 : 0);
+    }
+
     /** Writes a `u32` length prefix followed by the raw bytes. @param be - endianness of the prefix. */
     writeBytes(bytes: Uint8Array, be?: boolean): this {
         this.writeU32(bytes.length, be);
@@ -110,19 +131,66 @@ export class DataWriter {
     }
 
     /** Writes an unsigned 128-bit integer as two 64-bit limbs. @param be - big-endian if true. */
-    writeU128(v: bigint, be?: boolean): this { return this.writeLimbs(BigInt.asUintN(128, v), 2, !!be); }
+    writeU128(v: bigint, be?: boolean): this {
+        return this.writeLimbs(BigInt.asUintN(128, v), 2, !!be);
+    }
+
     /** Writes a signed 128-bit integer as two 64-bit limbs (two's complement). @param be - big-endian if true. */
-    writeI128(v: bigint, be?: boolean): this { return this.writeLimbs(BigInt.asUintN(128, v), 2, !!be); }
+    writeI128(v: bigint, be?: boolean): this {
+        return this.writeLimbs(BigInt.asUintN(128, v), 2, !!be);
+    }
+
     /** Writes an unsigned 256-bit integer as four 64-bit limbs. @param be - big-endian if true. */
-    writeU256(v: bigint, be?: boolean): this { return this.writeLimbs(BigInt.asUintN(256, v), 4, !!be); }
+    writeU256(v: bigint, be?: boolean): this {
+        return this.writeLimbs(BigInt.asUintN(256, v), 4, !!be);
+    }
+
     /** Writes a signed 256-bit integer as four 64-bit limbs (two's complement). @param be - big-endian if true. */
-    writeI256(v: bigint, be?: boolean): this { return this.writeLimbs(BigInt.asUintN(256, v), 4, !!be); }
+    writeI256(v: bigint, be?: boolean): this {
+        return this.writeLimbs(BigInt.asUintN(256, v), 4, !!be);
+    }
 
     /** Number of bytes written so far. */
-    length(): number { return this.off; }
+    length(): number {
+        return this.off;
+    }
 
     /** A fresh copy of exactly the bytes written. */
-    toBytes(): Uint8Array<ArrayBuffer> { return this.buf.slice(0, this.off); }
+    toBytes(): Uint8Array<ArrayBuffer> {
+        return this.buf.slice(0, this.off);
+    }
+
+    /**
+     * Ensures room for `extra` more bytes and returns the offset to write at. Grows
+     * (doubling) when needed, reassigning `buf`/`view`. Callers MUST read the returned
+     * offset into a local before touching `this.view`/`this.buf`, since a grow swaps
+     * them out from under a stale receiver.
+     */
+    private reserve(extra: number): number {
+        const need = this.off + extra;
+        if (need > this.buf.length) {
+            let n = this.buf.length;
+            while (n < need) n <<= 1;
+            const bigger = new Uint8Array(n);
+            bigger.set(this.buf.subarray(0, this.off));
+            this.buf = bigger;
+            this.view = new DataView(this.buf.buffer);
+        }
+        const at = this.off;
+        this.off += extra;
+        return at;
+    }
+
+    /** Writes the `count` 64-bit limbs of `u` (low limb first in LE, high limb first in BE). */
+    private writeLimbs(u: bigint, count: number, be: boolean): this {
+        if (be) {
+            for (let i = count - 1; i >= 0; i--)
+                this.writeU64((u >> BigInt(i * 64)) & MASK64, true);
+        } else {
+            for (let i = 0; i < count; i++) this.writeU64((u >> BigInt(i * 64)) & MASK64, false);
+        }
+        return this;
+    }
 }
 
 /**
@@ -132,11 +200,11 @@ export class DataWriter {
  * big-endian writer.
  */
 export class DataReader {
+    /** Cleared to false if any read ran past the end of the buffer. */
+    ok = true;
     private buf: Uint8Array;
     private view: DataView;
     private off = 0;
-    /** Cleared to false if any read ran past the end of the buffer. */
-    ok = true;
 
     /** @param bytes - the buffer to read from (its byteOffset/length are respected). */
     constructor(bytes: Uint8Array) {
@@ -144,47 +212,89 @@ export class DataReader {
         this.view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
     }
 
-    /** Returns true (and leaves `off` advanceable) if `n` more bytes are available; else clears `ok`. */
-    private has(n: number): boolean {
-        if (n < 0 || this.off + n > this.buf.length) {
-            this.ok = false;
-            return false;
-        }
-        return true;
+    /** Reads an unsigned 8-bit byte (0 past end). */
+    readU8(): number {
+        if (!this.has(1)) return 0;
+        const v = this.view.getUint8(this.off);
+        this.off += 1;
+        return v;
     }
 
-    /** Reads an unsigned 8-bit byte (0 past end). */
-    readU8(): number { if (!this.has(1)) return 0; const v = this.view.getUint8(this.off); this.off += 1; return v; }
     /** Reads an unsigned 16-bit integer. @param be - big-endian if true (default little-endian). */
-    readU16(be?: boolean): number { if (!this.has(2)) return 0; const v = this.view.getUint16(this.off, !be); this.off += 2; return v; }
+    readU16(be?: boolean): number {
+        if (!this.has(2)) return 0;
+        const v = this.view.getUint16(this.off, !be);
+        this.off += 2;
+        return v;
+    }
+
     /** Reads an unsigned 32-bit integer. @param be - big-endian if true (default little-endian). */
-    readU32(be?: boolean): number { if (!this.has(4)) return 0; const v = this.view.getUint32(this.off, !be); this.off += 4; return v >>> 0; }
+    readU32(be?: boolean): number {
+        if (!this.has(4)) return 0;
+        const v = this.view.getUint32(this.off, !be);
+        this.off += 4;
+        return v >>> 0;
+    }
+
     /** Reads an unsigned 64-bit integer. @param be - big-endian if true (default little-endian). */
-    readU64(be?: boolean): bigint { if (!this.has(8)) return 0n; const v = this.view.getBigUint64(this.off, !be); this.off += 8; return v; }
+    readU64(be?: boolean): bigint {
+        if (!this.has(8)) return 0n;
+        const v = this.view.getBigUint64(this.off, !be);
+        this.off += 8;
+        return v;
+    }
+
     /** Reads a signed 8-bit integer (0 past end). */
-    readI8(): number { if (!this.has(1)) return 0; const v = this.view.getInt8(this.off); this.off += 1; return v; }
+    readI8(): number {
+        if (!this.has(1)) return 0;
+        const v = this.view.getInt8(this.off);
+        this.off += 1;
+        return v;
+    }
+
     /** Reads a signed 16-bit integer. @param be - big-endian if true (default little-endian). */
-    readI16(be?: boolean): number { if (!this.has(2)) return 0; const v = this.view.getInt16(this.off, !be); this.off += 2; return v; }
+    readI16(be?: boolean): number {
+        if (!this.has(2)) return 0;
+        const v = this.view.getInt16(this.off, !be);
+        this.off += 2;
+        return v;
+    }
+
     /** Reads a signed 32-bit integer. @param be - big-endian if true (default little-endian). */
-    readI32(be?: boolean): number { if (!this.has(4)) return 0; const v = this.view.getInt32(this.off, !be); this.off += 4; return v; }
+    readI32(be?: boolean): number {
+        if (!this.has(4)) return 0;
+        const v = this.view.getInt32(this.off, !be);
+        this.off += 4;
+        return v;
+    }
+
     /** Reads a signed 64-bit integer. @param be - big-endian if true (default little-endian). */
-    readI64(be?: boolean): bigint { if (!this.has(8)) return 0n; const v = this.view.getBigInt64(this.off, !be); this.off += 8; return v; }
+    readI64(be?: boolean): bigint {
+        if (!this.has(8)) return 0n;
+        const v = this.view.getBigInt64(this.off, !be);
+        this.off += 8;
+        return v;
+    }
+
     /** Reads a 32-bit float. @param be - big-endian if true (default little-endian). */
-    readF32(be?: boolean): number { if (!this.has(4)) return 0; const v = this.view.getFloat32(this.off, !be); this.off += 4; return v; }
+    readF32(be?: boolean): number {
+        if (!this.has(4)) return 0;
+        const v = this.view.getFloat32(this.off, !be);
+        this.off += 4;
+        return v;
+    }
+
     /** Reads a 64-bit float. @param be - big-endian if true (default little-endian). */
-    readF64(be?: boolean): number { if (!this.has(8)) return 0; const v = this.view.getFloat64(this.off, !be); this.off += 8; return v; }
-    /** Reads a boolean (any non-zero byte is true). */
-    readBool(): boolean { return this.readU8() !== 0; }
+    readF64(be?: boolean): number {
+        if (!this.has(8)) return 0;
+        const v = this.view.getFloat64(this.off, !be);
+        this.off += 8;
+        return v;
+    }
 
-    /** Reads `count` 64-bit limbs and recombines them (low limb first in LE, high first in BE). */
-    private readLimbs(count: number, be: boolean): bigint {
-        let result = 0n;
-        if (be) {
-            for (let i = count - 1; i >= 0; i--) result |= this.readU64(true) << BigInt(i * 64);
-        } else {
-            for (let i = 0; i < count; i++) result |= this.readU64(false) << BigInt(i * 64);
-        }
-        return result;
+    /** Reads a boolean (any non-zero byte is true). */
+    readBool(): boolean {
+        return this.readU8() !== 0;
     }
 
     /** Reads a `u32`-length-prefixed byte blob (empty past end). @param be - endianness of the prefix. */
@@ -199,21 +309,54 @@ export class DataReader {
     /** Reads a `u32`-byte-length-prefixed UTF-8 string (empty past end). @param be - endianness of the prefix. */
     readString(be?: boolean): string {
         const len = this.readU32(be);
-        if (!this.has(len)) return "";
+        if (!this.has(len)) return '';
         const s = utf8Decoder.decode(this.buf.subarray(this.off, this.off + len));
         this.off += len;
         return s;
     }
 
     /** Reads an unsigned 128-bit integer. @param be - big-endian if true (default little-endian). */
-    readU128(be?: boolean): bigint { return this.readLimbs(2, !!be); }
+    readU128(be?: boolean): bigint {
+        return this.readLimbs(2, !!be);
+    }
+
     /** Reads a signed 128-bit integer (two's complement). @param be - big-endian if true. */
-    readI128(be?: boolean): bigint { return BigInt.asIntN(128, this.readLimbs(2, !!be)); }
+    readI128(be?: boolean): bigint {
+        return BigInt.asIntN(128, this.readLimbs(2, !!be));
+    }
+
     /** Reads an unsigned 256-bit integer. @param be - big-endian if true (default little-endian). */
-    readU256(be?: boolean): bigint { return this.readLimbs(4, !!be); }
+    readU256(be?: boolean): bigint {
+        return this.readLimbs(4, !!be);
+    }
+
     /** Reads a signed 256-bit integer (two's complement). @param be - big-endian if true. */
-    readI256(be?: boolean): bigint { return BigInt.asIntN(256, this.readLimbs(4, !!be)); }
+    readI256(be?: boolean): bigint {
+        return BigInt.asIntN(256, this.readLimbs(4, !!be));
+    }
 
     /** Bytes left to read. */
-    remaining(): number { return this.buf.length - this.off; }
+    remaining(): number {
+        return this.buf.length - this.off;
+    }
+
+    /** Returns true (and leaves `off` advanceable) if `n` more bytes are available; else clears `ok`. */
+    private has(n: number): boolean {
+        if (n < 0 || this.off + n > this.buf.length) {
+            this.ok = false;
+            return false;
+        }
+        return true;
+    }
+
+    /** Reads `count` 64-bit limbs and recombines them (low limb first in LE, high first in BE). */
+    private readLimbs(count: number, be: boolean): bigint {
+        let result = 0n;
+        if (be) {
+            for (let i = count - 1; i >= 0; i--) result |= this.readU64(true) << BigInt(i * 64);
+        } else {
+            for (let i = 0; i < count; i++) result |= this.readU64(false) << BigInt(i * 64);
+        }
+        return result;
+    }
 }

package/test/devserver-database.test.ts

@@ -302,3 +302,63 @@ describe('toildb dev emulator (record family)', () => {
         expect(imports['data.get'](posts, kPtr, kLen)).toBe(-2);
     });
 });
+
+type Imports = Record<string, (...args: number[]) => number>;
+
+describe('toildb dev emulator (capacity family)', () => {
+    // Pull the last stashed i64 available into the buffer and read it.
+    function avail(imports: Imports, buf: Buffer, h: number, kPtr: number, kLen: number): bigint {
+        expect(imports['data.capacity_available'](h, kPtr, kLen)).toBe(8);
+        expect(imports['data.take_result'](512, 16)).toBe(8);
+        return buf.readBigInt64LE(512);
+    }
+
+    it('set_total / reserve / confirm / cancel keep the ledger consistent', () => {
+        const { imports, buf } = setup();
+        const h = resolve(imports, buf, 'App/seats');
+        const [kPtr, kLen] = put(buf, 32, 'showA');
+
+        // an empty ledger reads 0 available, never absent.
+        expect(avail(imports, buf, h, kPtr, kLen)).toBe(0n);
+
+        // restock to 10.
+        expect(imports['data.capacity_set_total'](h, kPtr, kLen, 10, 0)).toBe(0);
+        expect(avail(imports, buf, h, kPtr, kLen)).toBe(10n);
+
+        // reserve 3 -> a u64 id (> 0) is stashed, available drops to 7.
+        expect(imports['data.capacity_reserve'](h, kPtr, kLen, 3, 60000, 0)).toBe(8);
+        expect(imports['data.take_result'](512, 16)).toBe(8);
+        const id = buf.readBigUInt64LE(512);
+        expect(id > 0n).toBe(true);
+        expect(avail(imports, buf, h, kPtr, kLen)).toBe(7n);
+
+        // cancel returns the hold -> back to 10; a double-cancel is a no-op.
+        expect(imports['data.capacity_cancel'](h, kPtr, kLen, Number(id), 0)).toBe(1);
+        expect(avail(imports, buf, h, kPtr, kLen)).toBe(10n);
+        expect(imports['data.capacity_cancel'](h, kPtr, kLen, Number(id), 0)).toBe(0);
+
+        // reserve 4 then confirm -> a permanent consume; available holds at 6.
+        expect(imports['data.capacity_reserve'](h, kPtr, kLen, 4, 60000, 0)).toBe(8);
+        imports['data.take_result'](512, 16);
+        const id2 = Number(buf.readBigUInt64LE(512));
+        expect(imports['data.capacity_confirm'](h, kPtr, kLen, id2, 0)).toBe(1);
+        expect(avail(imports, buf, h, kPtr, kLen)).toBe(6n);
+        // a confirmed hold cannot be cancelled nor re-confirmed.
+        expect(imports['data.capacity_cancel'](h, kPtr, kLen, id2, 0)).toBe(0);
+        expect(imports['data.capacity_confirm'](h, kPtr, kLen, id2, 0)).toBe(0);
+    });
+
+    it('never oversells (a reserve beyond available is refused)', () => {
+        const { imports, buf } = setup();
+        const h = resolve(imports, buf, 'App/tickets');
+        const [kPtr, kLen] = put(buf, 32, 'vip');
+        imports['data.capacity_set_total'](h, kPtr, kLen, 5, 0);
+
+        // a hold for all 5 succeeds; a further hold for 1 is refused (-2 -> guest 0).
+        expect(imports['data.capacity_reserve'](h, kPtr, kLen, 5, 60000, 0)).toBe(8);
+        expect(imports['data.capacity_reserve'](h, kPtr, kLen, 1, 60000, 0)).toBe(-2);
+        // a non-positive amount is refused, and an invalid handle is rejected.
+        expect(imports['data.capacity_reserve'](h, kPtr, kLen, 0, 60000, 0)).toBe(-2);
+        expect(imports['data.capacity_available'](999, kPtr, kLen)).toBe(-1001);
+    });
+});

package/test/devserver-secrets.test.ts

@@ -0,0 +1,59 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+import { buildHostImports, freshDispatchState, type MemoryRef } from '../src/devserver/host.js';
+
+/**
+ * The dev host warns (once) when the guest reads a framework auth secret that is unset, since the
+ * wasm then falls back to a PUBLISHED dev key (see `server/globals/auth.ts`). This is the visible
+ * counterpart to the silent fallback: without it, a server running on the dev host would sign
+ * sessions under a forgeable key with no signal. The repo root has no `.env.secrets`, so every
+ * lookup below is absent.
+ */
+function setup() {
+    const memory = new WebAssembly.Memory({ initial: 1 });
+    const ref: MemoryRef = { memory };
+    const env = buildHostImports(ref, freshDispatchState()).env as Record<
+        string,
+        (...a: number[]) => number
+    >;
+    const buf = Buffer.from(memory.buffer);
+    return { env, buf };
+}
+
+/** Writes `key` at offset 0 and runs `env_get_secure`, returning its status code. */
+function getSecure(env: Record<string, (...a: number[]) => number>, buf: Buffer, key: string): number {
+    const b = Buffer.from(key, 'utf8');
+    b.copy(buf, 0);
+    return env.env_get_secure(0, b.length, 256, 256);
+}
+
+afterEach(() => {
+    vi.restoreAllMocks();
+});
+
+describe('dev host secret fallback warning', () => {
+    it('warns once that an unset AUTH_SESSION_SECRET falls back to a published key', () => {
+        const write = vi.spyOn(process.stdout, 'write').mockReturnValue(true);
+        const { env, buf } = setup();
+
+        expect(getSecure(env, buf, 'AUTH_SESSION_SECRET')).toBe(-2); // ABSENT
+        // Repeated reads (a fresh wasm instance per request hits this every time) warn only once.
+        expect(getSecure(env, buf, 'AUTH_SESSION_SECRET')).toBe(-2);
+
+        const warnings = write.mock.calls
+            .map((c) => String(c[0]))
+            .filter((s) => s.includes('AUTH_SESSION_SECRET'));
+        expect(warnings).toHaveLength(1);
+        expect(warnings[0]).toContain('forge');
+        expect(warnings[0]).toContain('deployed node');
+    });
+
+    it('does not warn for an ordinary (non-framework) absent secret', () => {
+        const write = vi.spyOn(process.stdout, 'write').mockReturnValue(true);
+        const { env, buf } = setup();
+
+        expect(getSecure(env, buf, 'STRIPE_KEY')).toBe(-2); // ABSENT, no published default
+        const warned = write.mock.calls.some((c) => String(c[0]).includes('STRIPE_KEY'));
+        expect(warned).toBe(false);
+    });
+});

package/test/doctor.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, it } from 'vitest';
 
 import {
+    checkAuthSecrets,
     checkBasePath,
     checkDevScripts,
     checkDuplicatePatterns,
@@ -14,6 +15,7 @@ import {
     checkRootElement,
     checkRpcWiring,
     checkSeoUrl,
+    checkServerTsPlugin,
     checkStyling,
     findRelativeAssets,
     satisfiesMin,
@@ -189,6 +191,34 @@ describe('checkPrettierPlugin', () => {
     });
 });
 
+describe('checkServerTsPlugin', () => {
+    it('passes when the toilscript LS plugin is wired', () => {
+        expect(checkServerTsPlugin(true).status).toBe('pass');
+    });
+    it('warns (not fails) when missing, naming the TS2339 false positive and --fix', () => {
+        const c = checkServerTsPlugin(false);
+        expect(c.status).toBe('warn');
+        expect(c.detail).toContain('TS2339');
+        expect(c.fix).toContain('--fix');
+    });
+});
+
+describe('checkAuthSecrets', () => {
+    it('passes when auth is not used', () => {
+        expect(checkAuthSecrets({ usesAuth: false, sessionSecretSet: false }).status).toBe('pass');
+    });
+    it('passes when auth is used and the session secret is set', () => {
+        expect(checkAuthSecrets({ usesAuth: true, sessionSecretSet: true }).status).toBe('pass');
+    });
+    it('warns about session forgery when auth is used but the secret is unset', () => {
+        const c = checkAuthSecrets({ usesAuth: true, sessionSecretSet: false });
+        expect(c.status).toBe('warn');
+        expect(c.detail).toContain('AUTH_SESSION_SECRET');
+        expect(c.detail).toContain('forge');
+        expect(c.fix).toContain('.env.secrets');
+    });
+});
+
 describe('summarize', () => {
     it('tallies pass/warn/fail across groups', () => {
         const groups: CheckGroup[] = [