toiljs 0.0.68 → 0.0.70

package/src/devserver/runtime/host.ts

@@ -102,7 +102,7 @@ export function readBytes(ref: MemoryRef, ptr: number, len: number): Buffer {
  * Bounds-checked write of a variable-length result into a guest out-buffer, with
  * the edge's inline-drain return protocol: the byte length on success, or `-1`
  * (STATUS_TOO_SMALL) when `outCap` is too small (the guest retries with a bigger
- * buffer). Used by the handleless `mstore.*` imports (RECONCILIATION Part 4 F2).
+ * buffer).
  */
 export function writeBytesOut(
     ref: MemoryRef,
@@ -217,12 +217,8 @@ export function buildEnvImports(
         // the buffer is too small (the guest retries bigger), -2 if absent.
         env_get: (keyPtr: number, keyLen: number, outPtr: number, outCap: number): number =>
             envLookup(ref, keyPtr, keyLen, outPtr, outCap, false),
-        env_get_secure: (
-            keyPtr: number,
-            keyLen: number,
-            outPtr: number,
-            outCap: number,
-        ): number => envLookup(ref, keyPtr, keyLen, outPtr, outCap, true),
+        env_get_secure: (keyPtr: number, keyLen: number, outPtr: number, outCap: number): number =>
+            envLookup(ref, keyPtr, keyLen, outPtr, outCap, true),
 
         thread_spawn: (_startArg: number): number => -1,
 

package/src/devserver/runtime/module.ts

@@ -21,7 +21,14 @@ import {
     persistDb,
     setDbCatalog,
 } from '../db/index.js';
-import { parseRouteKinds, routeKindForRequest, type RouteKindEntry } from '../db/routeKinds.js';
+import {
+    parseRouteKinds,
+    parseRpcKinds,
+    routeKindForRequest,
+    rpcKindForId,
+    type RouteKindEntry,
+    type RpcKindEntry,
+} from '../db/routeKinds.js';
 import {
     decodeResponseEnvelope,
     encodeRequestEnvelope,
@@ -157,6 +164,7 @@ export class WasmServerModule {
     private module: WebAssembly.Module | null = null;
     private loadedMtimeMs = -1;
     private routeKinds: readonly RouteKindEntry[] = [];
+    private rpcKinds: readonly RpcKindEntry[] = [];
     private derives: readonly DeriveEntry[] = [];
     // Set when a (re)compile loaded a module with @derive methods; the first
     // dispatch afterward rebuilds every materialized view from its sources.
@@ -182,6 +190,7 @@ export class WasmServerModule {
         } catch {
             this.module = null;
             this.routeKinds = [];
+            this.rpcKinds = [];
             this.derives = [];
             this.derivesDirty = false;
             this.loadedMtimeMs = -1;
@@ -197,6 +206,7 @@ export class WasmServerModule {
         // after a @data type evolves + rebuild, old on-disk rows now look out of date.
         setDbCatalog(bytes);
         this.routeKinds = parseRouteKinds(bytes);
+        this.rpcKinds = parseRpcKinds(bytes);
         this.derives = parseDerives(bytes);
         this.module = module;
         this.loadedMtimeMs = mtimeMs;
@@ -224,9 +234,25 @@ export class WasmServerModule {
         const ref: MemoryRef = { memory: null };
         const state = freshDispatchState();
         state.clientIp = req.clientIp ?? '';
-        // Match the edge DB gate: the HTTP method is the baseline authority,
-        // and `toildb.route_kinds` can only tighten a mutating route to query.
-        state.db.functionKind = dbFunctionKindForRequest(this.routeKinds, req.method, req.path);
+        // Match the edge DB gate: the HTTP method is the baseline authority, and `toildb.route_kinds`
+        // can only tighten a mutating route to query. The reserved /__toil_rpc endpoint is the inverse -
+        // a @remote defaults to read-only (Query); only an @action @remote (in rpc_kinds) may write.
+        const rpcPath = req.path.split('?')[0] ?? req.path;
+        const rpcMethod = req.method.toUpperCase();
+        const rpcMutating =
+            rpcMethod === 'POST' || rpcMethod === 'PUT' || rpcMethod === 'PATCH' || rpcMethod === 'DELETE';
+        if (rpcPath === '/__toil_rpc' && rpcMutating) {
+            const idHeader = req.headers.find(([n]) => n.toLowerCase() === 'toil-rpc')?.[1];
+            // Strict u32 parse, mirroring the host's `v.parse::<u32>()`: reject trailing garbage/whitespace
+            // and out-of-range ids so a malformed header falls through to read-only Query, exactly as prod.
+            const id = idHeader !== undefined && /^\d+$/.test(idHeader) ? Number(idHeader) : NaN;
+            state.db.functionKind =
+                Number.isInteger(id) && id <= 0xffffffff
+                    ? rpcKindForId(this.rpcKinds, id)
+                    : DbFunctionKind.Query;
+        } else {
+            state.db.functionKind = dbFunctionKindForRequest(this.routeKinds, req.method, req.path);
+        }
         const instance = new WebAssembly.Instance(this.module, buildHostImports(ref, state));
         const exports = instance.exports as unknown as HandleExports;
         ref.memory = exports.memory;

package/src/devserver/stream/index.ts

@@ -98,8 +98,8 @@ export class DevStreamBox {
      *  cold artifact, a missing `stream_dispatch`/`memory`, or a bad module throws. */
     static load(wasm: Buffer): DevStreamBox {
         const surface = parseSurface(wasm);
-        if (surface === 'invalid' || surface.targetMode !== 'hot') {
-            throw new Error('stream box requires a hot artifact with a valid toil.surface');
+        if (surface === 'invalid' || surface.targetMode !== 'hot' || !surface.flags.stream) {
+            throw new Error('stream box requires a hot stream artifact with a valid toil.surface');
         }
         const ref: { memory: WebAssembly.Memory | null } = { memory: null };
         const state = freshStreamBoxState();
@@ -192,7 +192,10 @@ export class DevStreamBox {
     }
 
     private static resolveStreamInfo(e: StreamExports): StreamInfo | null {
-        if (typeof e.stream_info_offset !== 'function' || typeof e.stream_info_capacity !== 'function') {
+        if (
+            typeof e.stream_info_offset !== 'function' ||
+            typeof e.stream_info_capacity !== 'function'
+        ) {
             return null;
         }
         return { offset: e.stream_info_offset() >>> 0, cap: e.stream_info_capacity() >>> 0 };
@@ -277,7 +280,8 @@ export class DevStreamBox {
         dv.setUint16(f + 2, 0, true); // flags
         dv.setUint32(f + 4, n, true); // length
         dv.setUint32(f + 8, 0, true); // msg_seq
-        if (n > 0) new Uint8Array(this.exports.memory.buffer, f + RING_FRAME_HEADER, n).set(inbound);
+        if (n > 0)
+            new Uint8Array(this.exports.memory.buffer, f + RING_FRAME_HEADER, n).set(inbound);
         dv.setUint32(base + RC_WRITE, w + frameLen, true);
     }
 

package/src/devserver/wasm/surface.ts

@@ -26,6 +26,20 @@ import { DataReader } from 'toiljs/io';
 
 import { customSection } from './sections.js';
 
+export const SURFACE_FORMAT_VERSION = 1;
+export const SURFACE_ABI_VERSION = 1;
+
+const TARGET_HOT = 0;
+const TARGET_COLD = 1;
+const FLAG_REST = 1 << 0;
+const FLAG_STREAM = 1 << 1;
+const FLAG_DAEMON = 1 << 2;
+const FLAG_SCHEDULED = 1 << 3;
+const FLAG_DATABASE = 1 << 4;
+const FLAG_RENDER = 1 << 5;
+const FLAG_KNOWN_MASK =
+    FLAG_REST | FLAG_STREAM | FLAG_DAEMON | FLAG_SCHEDULED | FLAG_DATABASE | FLAG_RENDER;
+
 export interface SurfaceFlags {
     readonly rest: boolean;
     readonly stream: boolean;
@@ -57,16 +71,31 @@ export function parseSurface(wasm: Buffer): Surface | 'invalid' {
     if (sec === null) return 'invalid';
 
     const r = new DataReader(sec);
-    r.readU16(); // format_version
-    const targetMode = r.readU8() === 1 ? 'cold' : 'hot';
-    r.readU8(); // reserved0
+    const version = r.readU16(); // format_version
+    if (!r.ok || version !== SURFACE_FORMAT_VERSION) return 'invalid';
+    const targetModeByte = r.readU8();
+    if (!r.ok || (targetModeByte !== TARGET_HOT && targetModeByte !== TARGET_COLD)) {
+        return 'invalid';
+    }
+    const targetMode = targetModeByte === TARGET_COLD ? 'cold' : 'hot';
+    const reserved0 = r.readU8(); // reserved0
+    if (!r.ok || reserved0 !== 0) return 'invalid';
     const f = r.readU32(); // surface_flags
+    if (!r.ok || (f & ~FLAG_KNOWN_MASK) !== 0) return 'invalid';
+    if ((f & FLAG_SCHEDULED) !== 0 && (f & FLAG_DAEMON) === 0) return 'invalid';
+    if (targetMode === 'hot' && (f & (FLAG_DAEMON | FLAG_SCHEDULED)) !== 0) {
+        return 'invalid';
+    }
+    if (targetMode === 'cold' && (f & (FLAG_REST | FLAG_STREAM | FLAG_RENDER)) !== 0) {
+        return 'invalid';
+    }
     const abiVersion = r.readU16();
+    if (!r.ok || abiVersion !== SURFACE_ABI_VERSION) return 'invalid';
     const buildId = r.readString();
     const fingerprint = r.readU32();
     const dataCoherenceHash = r.readU32(); // exactly THREE u32 after build_id
     const pairCoherenceHash = r.readU32();
-    if (!r.ok) return 'invalid'; // PRESENT but corrupt => fail closed
+    if (!r.ok || r.remaining() !== 0) return 'invalid'; // PRESENT but corrupt => fail closed
     return {
         targetMode,
         flags: {

package/test/daemon-build.test.ts

@@ -33,6 +33,7 @@ import { fileURLToPath } from 'node:url';
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
 
 import {
+    assertNoStreamInRequestTier,
     buildServer,
     serverArtifacts,
     splitSurfaceFiles,
@@ -183,6 +184,58 @@ describe('splitSurfaceFiles per-pass classification', () => {
         expect(split.request).toContain('server/both.ts');
         expect(split.stream).not.toContain('server/both.ts');
     });
+
+    it('exposes the actual @stream modules in streamModules (not @rest or shared helpers)', () => {
+        const rels = lay({
+            'server/chat.ts': "@stream('chat')\nclass C {}\n",
+            'server/api.ts': '@rest\nclass A {}\n',
+            'server/util.ts': 'export function helper(): i32 { return 1; }\n',
+        });
+        const split = splitSurfaceFiles(tmp, rels);
+        expect(split.streamModules).toEqual(['server/chat.ts']);
+    });
+
+    it('REJECTS a value-import of a @stream module; allows clean/type-only/commented (audit #17/#7)', () => {
+        const rels = lay({
+            'server/main.ts': "import { A } from './api';\n", // request-tier (shared) entry
+            'server/api.ts': '@rest\nclass A {}\n',
+            'server/chat.ts': "@stream('chat')\nclass C {}\n",
+        });
+        const check = () => assertNoStreamInRequestTier(tmp, splitSurfaceFiles(tmp, rels));
+
+        // main imports only the @rest surface -> no stream code leaks into release.wasm.
+        expect(check).not.toThrow();
+
+        // The footgun: a request-tier file value-imports the @stream module.
+        writeFileSync(join(tmp, 'server', 'main.ts'), "import { C } from './chat';\nvoid C;\n");
+        expect(check).toThrow(/@stream class would be compiled into the REQUEST tier/);
+
+        // A type-only import is erased and never compiles @stream code -> allowed.
+        writeFileSync(join(tmp, 'server', 'main.ts'), "import type { C } from './chat';\n");
+        expect(check).not.toThrow();
+
+        // A COMMENTED-OUT import is dead code and must not false-positive (audit #7).
+        writeFileSync(
+            join(tmp, 'server', 'main.ts'),
+            "// import { C } from './chat';\nimport { A } from './api';\n",
+        );
+        expect(check).not.toThrow();
+    });
+
+    it('catches a @stream reached transitively through a plain helper NOT in the surface list (audit #6)', () => {
+        // util.ts is an UNDECORATED helper -> not in serverEntryFiles, so production hands splitSurfaceFiles
+        // only the entries+surfaces. The filesystem-resolving BFS must still traverse util.ts to reach the
+        // @stream module behind it.
+        lay({
+            'server/main.ts': "import './util';\n",
+            'server/util.ts': "import { C } from './chat';\nexport const x = 1;\n",
+            'server/chat.ts': "@stream('chat')\nclass C {}\n",
+        });
+        const surfacesOnly = ['server/main.ts', 'server/chat.ts']; // no plain util.ts, as in production
+        expect(() => assertNoStreamInRequestTier(tmp, splitSurfaceFiles(tmp, surfacesOnly))).toThrow(
+            /@stream class would be compiled into the REQUEST tier/,
+        );
+    });
 });
 
 // Needs the local toilscript dev build (with --targetMode) linked as a sibling

package/test/daemon-catalog.test.ts

@@ -158,15 +158,17 @@ describe('parseDaemonCatalog (Part 5)', () => {
 // --- toil.surface (Part 5) -------------------------------------------------
 
 function buildSurfaceBytes(opts: {
-    mode: 0 | 1;
+    mode: number;
     flags: number;
+    version?: number;
+    reserved0?: number;
     abi?: number;
     buildId?: string;
 }): Uint8Array {
     const w = new DataWriter();
-    w.writeU16(1); // format_version
+    w.writeU16(opts.version ?? 1); // format_version
     w.writeU8(opts.mode); // target_mode
-    w.writeU8(0); // reserved0
+    w.writeU8(opts.reserved0 ?? 0); // reserved0
     w.writeU32(opts.flags); // surface_flags
     w.writeU16(opts.abi ?? 1); // abi_version
     w.writeString(opts.buildId ?? ''); // build_id
@@ -188,6 +190,7 @@ describe('parseSurface (Part 5)', () => {
             expect(s.flags.daemon).toBe(true);
             expect(s.flags.scheduled).toBe(true);
             expect(s.flags.rest).toBe(false);
+            expect(s.abiVersion).toBe(1);
             expect(s.fingerprint).toBe(0xdeadbeef);
             expect(s.dataCoherenceHash).toBe(0x11111111);
             expect(s.pairCoherenceHash).toBe(0x22222222);
@@ -211,6 +214,78 @@ describe('parseSurface (Part 5)', () => {
         const truncated = full.subarray(0, full.length - 3); // chop a trailing hash
         expect(parseSurface(wasmWithSection('toil.surface', truncated))).toBe('invalid');
     });
+
+    it("fails closed: trailing bytes after toil.surface are 'invalid'", () => {
+        const full = Buffer.from(buildSurfaceBytes({ mode: 0, flags: 1 }));
+        const withGarbage = Buffer.concat([full, Buffer.from([0xff])]);
+        expect(parseSurface(wasmWithSection('toil.surface', withGarbage))).toBe('invalid');
+    });
+
+    it("fails closed: unsupported format version is 'invalid'", () => {
+        expect(
+            parseSurface(
+                wasmWithSection(
+                    'toil.surface',
+                    buildSurfaceBytes({ version: 2, mode: 0, flags: 1 }),
+                ),
+            ),
+        ).toBe('invalid');
+    });
+
+    it("fails closed: unsupported abi_version is 'invalid'", () => {
+        expect(
+            parseSurface(
+                wasmWithSection('toil.surface', buildSurfaceBytes({ mode: 0, flags: 1, abi: 2 })),
+            ),
+        ).toBe('invalid');
+    });
+
+    it('fails closed: target_mode 2 is not silently treated as hot', () => {
+        expect(
+            parseSurface(wasmWithSection('toil.surface', buildSurfaceBytes({ mode: 2, flags: 1 }))),
+        ).toBe('invalid');
+    });
+
+    it("fails closed: nonzero reserved byte is 'invalid'", () => {
+        expect(
+            parseSurface(
+                wasmWithSection(
+                    'toil.surface',
+                    buildSurfaceBytes({ mode: 0, flags: 1, reserved0: 1 }),
+                ),
+            ),
+        ).toBe('invalid');
+    });
+
+    it("fails closed: reserved surface flag bits are 'invalid'", () => {
+        expect(
+            parseSurface(
+                wasmWithSection('toil.surface', buildSurfaceBytes({ mode: 0, flags: 1 << 6 })),
+            ),
+        ).toBe('invalid');
+    });
+
+    it('fails closed: daemon flags are illegal on hot artifacts', () => {
+        expect(
+            parseSurface(
+                wasmWithSection('toil.surface', buildSurfaceBytes({ mode: 0, flags: 1 | 4 })),
+            ),
+        ).toBe('invalid');
+    });
+
+    it('fails closed: stream flags are illegal on cold artifacts', () => {
+        expect(
+            parseSurface(
+                wasmWithSection('toil.surface', buildSurfaceBytes({ mode: 1, flags: 4 | 2 })),
+            ),
+        ).toBe('invalid');
+    });
+
+    it('fails closed: scheduled requires daemon', () => {
+        expect(
+            parseSurface(wasmWithSection('toil.surface', buildSurfaceBytes({ mode: 1, flags: 8 }))),
+        ).toBe('invalid');
+    });
 });
 
 describe('customSection bounds-checking', () => {

package/test/daemon-emulation.test.ts

@@ -10,9 +10,9 @@
  *   - `daemon.is_leader()` / `current_epoch()` / `task_count()` stubs answer.
  *   - the epoch bumps on a cold-artifact reload (the fencing token).
  *
- * The fixture records its activity into the shared dev MemoryStore (the real
- * `mstore.*` host import path), which the test reads back through
- * `devMemoryStore`. Interval ticks are driven with vitest fake timers.
+ * The fixture records its activity into resident daemon wasm memory and exports
+ * scalar accessors for the test. Interval ticks are driven with vitest fake
+ * timers.
  */
 
 import { spawnSync } from 'node:child_process';
@@ -25,7 +25,6 @@ import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from 'vitest
 
 import { DaemonHost } from '../src/devserver/daemon/index.js';
 import type { ResolvedDaemonConfig } from '../src/devserver/daemon/host.js';
-import { devMemoryStore } from '../src/devserver/mstore/store.js';
 
 const here = dirname(fileURLToPath(import.meta.url));
 const FIXTURE = join(here, 'fixtures', 'daemon-app.ts');
@@ -50,7 +49,10 @@ function compileCold(src: string, outWasm: string): { ok: boolean; output: strin
         [LOCAL_TOILSCRIPT_BIN, src, '-o', outWasm, '--runtime', 'stub', '--targetMode', 'cold'],
         { encoding: 'utf8' },
     );
-    return { ok: r.status === 0 && existsSync(outWasm), output: (r.stdout ?? '') + (r.stderr ?? '') };
+    return {
+        ok: r.status === 0 && existsSync(outWasm),
+        output: (r.stdout ?? '') + (r.stderr ?? ''),
+    };
 }
 
 let tmp: string;
@@ -72,13 +74,9 @@ afterAll(() => {
 
 afterEach(() => {
     vi.useRealTimers();
-    devMemoryStore.__reset();
 });
 
-const counter = (key: string): number => {
-    const v = devMemoryStore.get(key);
-    return v === null ? 0 : Number(v.toString('utf8'));
-};
+const counter = (host: DaemonHost, name: string): number => host.callI32Export(`${name}Count`) ?? 0;
 
 // Needs the local toilscript dev build (with --targetMode); skip where the
 // sibling repo is absent (e.g. CI, which has only the published dep).
@@ -86,9 +84,10 @@ describe.skipIf(!existsSync(LOCAL_TOILSCRIPT_BIN))('dev daemon emulation', () =>
     it('compiles the @daemon fixture to a cold artifact', () => {
         // Guard: every assertion below depends on the local toilscript link. A hard
         // failure here (rather than a silent skip) surfaces the cross-repo break.
-        expect(existsSync(LOCAL_TOILSCRIPT_BIN), `local toilscript not found at ${LOCAL_TOILSCRIPT_BIN}`).toBe(
-            true,
-        );
+        expect(
+            existsSync(LOCAL_TOILSCRIPT_BIN),
+            `local toilscript not found at ${LOCAL_TOILSCRIPT_BIN}`,
+        ).toBe(true);
         expect(toilscriptAvailable, 'cold compile of the @daemon fixture failed').toBe(true);
     });
 
@@ -98,14 +97,14 @@ describe.skipIf(!existsSync(LOCAL_TOILSCRIPT_BIN))('dev daemon emulation', () =>
         try {
             expect(host.active).toBe(true);
             // onStart ran once -> "started" counter is exactly 1.
-            expect(counter('started')).toBe(1);
+            expect(counter(host, 'started')).toBe(1);
             // The leader / epoch / task_count stubs all answered during onStart.
-            expect(counter('leader')).toBe(1);
-            expect(counter('epoch:nonneg')).toBe(1);
-            expect(counter('taskcount:2')).toBe(1);
+            expect(counter(host, 'leader')).toBe(1);
+            expect(counter(host, 'epochNonneg')).toBe(1);
+            expect(counter(host, 'taskcount2')).toBe(1);
             // refresh() with no mtime change is a no-op -> daemon_start does NOT re-run.
             expect(host.refresh()).toBe(false);
-            expect(counter('started')).toBe(1);
+            expect(counter(host, 'started')).toBe(1);
         } finally {
             host.close();
         }
@@ -116,13 +115,13 @@ describe.skipIf(!existsSync(LOCAL_TOILSCRIPT_BIN))('dev daemon emulation', () =>
         const host = new DaemonHost(coldWasm, DAEMON_CFG, 'all', () => {});
         host.refresh();
         try {
-            expect(counter('tick:fast')).toBe(0); // not fired yet
+            expect(counter(host, 'tickFast')).toBe(0); // not fired yet
             vi.advanceTimersByTime(1000);
-            expect(counter('tick:fast')).toBe(1); // one interval elapsed -> one tick
+            expect(counter(host, 'tickFast')).toBe(1); // one interval elapsed -> one tick
             vi.advanceTimersByTime(3000);
-            expect(counter('tick:fast')).toBe(4); // three more ticks
+            expect(counter(host, 'tickFast')).toBe(4); // three more ticks
             // The cron task ("0 */6 * * *") must NOT have fired in 4 simulated seconds.
-            expect(counter('tick:cron')).toBe(0);
+            expect(counter(host, 'tickCron')).toBe(0);
         } finally {
             host.close();
         }
@@ -135,13 +134,13 @@ describe.skipIf(!existsSync(LOCAL_TOILSCRIPT_BIN))('dev daemon emulation', () =>
         const host = new DaemonHost(coldWasm, DAEMON_CFG, 'all', () => {});
         host.refresh();
         try {
-            expect(counter('tick:cron')).toBe(0);
+            expect(counter(host, 'tickCron')).toBe(0);
             // Advance to 06:00:00 (30s) -> the cron one-shot fires exactly once.
             vi.advanceTimersByTime(30_000);
-            expect(counter('tick:cron')).toBe(1);
+            expect(counter(host, 'tickCron')).toBe(1);
             // It dispatched task_index 1 (sixHourly), NOT the interval task body.
             // (tick:fast also advanced on its own 1s timer; assert cron fired once.)
-            expect(counter('tick:cron')).toBe(1);
+            expect(counter(host, 'tickCron')).toBe(1);
         } finally {
             host.close();
         }
@@ -152,7 +151,7 @@ describe.skipIf(!existsSync(LOCAL_TOILSCRIPT_BIN))('dev daemon emulation', () =>
         host.refresh();
         try {
             expect(host.active).toBe(false);
-            expect(counter('started')).toBe(0);
+            expect(counter(host, 'started')).toBe(0);
         } finally {
             host.close();
         }
@@ -170,9 +169,8 @@ describe.skipIf(!existsSync(LOCAL_TOILSCRIPT_BIN))('dev daemon emulation', () =>
             const reloaded = host.refresh();
             expect(reloaded).toBe(true);
             expect(host.epoch()).toBe(e1 + 1n);
-            // A reload is a full restart -> daemon_start ran again on fresh memory.
-            // (devMemoryStore is shared/persistent, so "started" accumulates.)
-            expect(counter('started')).toBe(2);
+            // A reload is a full restart -> the new resident daemon memory starts fresh.
+            expect(counter(host, 'started')).toBe(1);
         } finally {
             host.close();
         }

package/test/devserver-database.test.ts

@@ -11,7 +11,9 @@ import {
     __setDbCatalogForTests,
     buildDatabaseImports,
     configureDbPersistence,
+    derivesForWrites,
     freshDbState,
+    parseDerives,
     persistDb,
     setDbCatalog,
 } from '../src/devserver/db/index.js';
@@ -92,6 +94,24 @@ function routeKindsSection(routes: readonly (readonly [number, number, string])[
     return Buffer.concat(chunks);
 }
 
+function derivesSection(entries: readonly (readonly [number, string, string])[]): Buffer {
+    const chunks: Buffer[] = [Buffer.alloc(4)];
+    chunks[0].writeUInt16LE(1, 0); // format_version
+    chunks[0].writeUInt16LE(entries.length, 2); // n_derives
+    for (const [id, db, method] of entries) {
+        const head = Buffer.alloc(2);
+        head.writeUInt16LE(id, 0);
+        chunks.push(head);
+        for (const s of [db, method]) {
+            const b = Buffer.from(s, 'utf8');
+            const len = Buffer.alloc(4);
+            len.writeUInt32LE(b.length, 0);
+            chunks.push(len, b);
+        }
+    }
+    return Buffer.concat(chunks);
+}
+
 function catalogSectionV1(fillMaxWaitMs: number, fillAllowStale: number, replication = 5): Buffer {
     const chunks: Buffer[] = [];
     const u8 = (v: number) => chunks.push(Buffer.from([v & 0xff]));
@@ -761,6 +781,20 @@ describe('toildb dev emulator (migration + persistence)', () => {
         expect(rsv(imports)).toBe(0x1234n); // the woven decoder dispatches on this
     });
 
+    it('patch surfaces the current catalog schema_version (regression: was -1)', () => {
+        const { imports, buf } = setup();
+        __setDbCatalogForTests({ 'App/users': 0x1234 });
+        const h = resolve(imports, buf, 'App/users');
+        const [kPtr, kLen] = put(buf, 32, 'u1');
+        const [vPtr, vLen] = put(buf, 64, 'orig');
+        imports['data.create'](h, kPtr, kLen, vPtr, vLen, 0);
+        const [pPtr, pLen] = put(buf, 96, 'patched');
+        // patch stashes the patched record + its schema_version; the guest's woven
+        // decoder dispatches on that version, so it MUST be the current one, not -1.
+        imports['data.patch'](h, kPtr, kLen, pPtr, pLen, 0);
+        expect(rsv(imports)).toBe(0x1234n);
+    });
+
     it('an evolved @data type leaves old rows stamped with the OLD version', () => {
         const { imports, buf } = setup();
         __setDbCatalogForTests({ 'App/users': 100 }); // version A
@@ -894,3 +928,62 @@ describe('toildb dev emulator (migration + persistence)', () => {
         }
     });
 });
+
+describe('toildb dev derives (toildb.derives parser + write routing)', () => {
+    const id = (d: { deriveId: number }) => d.deriveId;
+
+    it('parses a valid toildb.derives section in declaration order', () => {
+        const wasm = wasmWithSection(
+            'toildb.derives',
+            derivesSection([
+                [0, 'App', 'rebuild'],
+                [1, 'App', 'refresh'],
+                [2, 'Other', 'rollup'],
+            ]),
+        );
+        expect(parseDerives(wasm).map((d) => `${d.deriveId}:${d.dbName}.${d.methodName}`)).toEqual([
+            '0:App.rebuild',
+            '1:App.refresh',
+            '2:Other.rollup',
+        ]);
+    });
+
+    it('returns [] when there is no toildb.derives section', () => {
+        expect(parseDerives(wasmWithSection('toildb.other', Buffer.from([1, 2, 3])))).toEqual([]);
+    });
+
+    it('fails closed on a bad version, trailing bytes, or an empty db name', () => {
+        const badVersion = derivesSection([[0, 'App', 'r']]);
+        badVersion.writeUInt16LE(2, 0); // unknown format_version
+        expect(parseDerives(wasmWithSection('toildb.derives', badVersion))).toEqual([]);
+
+        const trailing = Buffer.concat([derivesSection([[0, 'App', 'r']]), Buffer.from([0])]);
+        expect(parseDerives(wasmWithSection('toildb.derives', trailing))).toEqual([]);
+
+        const emptyDb = derivesSection([[0, '', 'r']]);
+        expect(parseDerives(wasmWithSection('toildb.derives', emptyDb))).toEqual([]);
+    });
+
+    it('routes a source-collection write to its database derives, coalesced', () => {
+        const derives = parseDerives(
+            wasmWithSection(
+                'toildb.derives',
+                derivesSection([
+                    [0, 'App', 'rebuild'],
+                    [1, 'App', 'refresh'],
+                    [2, 'Other', 'rollup'],
+                ]),
+            ),
+        );
+        // two App collections written in one dispatch -> App's two derives, once each
+        expect(derivesForWrites(derives, new Set(['App/users', 'App/posts'])).map(id)).toEqual([
+            0, 1,
+        ]);
+        // a write to the other database -> only its derive
+        expect(derivesForWrites(derives, new Set(['Other/log'])).map(id)).toEqual([2]);
+        // a write to an unrelated database -> nothing runs
+        expect(derivesForWrites(derives, new Set(['Nope/x'])).map(id)).toEqual([]);
+        // no writes -> nothing runs
+        expect(derivesForWrites(derives, new Set<string>()).map(id)).toEqual([]);
+    });
+});

package/test/fixtures/bignum-wire/spec.ts

@@ -20,8 +20,6 @@ class Account {
     ids: u256[] = [];
 }
 
-// A free @remote so buildServerModule emits a surface (it returns null otherwise).
-@remote
-function touch(n: i32): i32 {
-    return n;
-}
+// The two @data classes above ARE the surface: buildServerModule emits their codec + the bignum
+// helpers for any @data. (No @remote here - a @remote injects a server-side Rpc registration that
+// needs the full server runtime, which this `--runtime stub` fixture deliberately does not link.)