toiljs 0.0.87 → 0.0.89

package/src/devserver/runtime/host.ts

@@ -21,7 +21,7 @@ import { devEnvGet, devEnvGetSecure } from '../config/env.js';
 import { ratelimitCheck } from '../config/ratelimit.js';
 import { buildAnalyticsImports } from '../analytics/index.js';
 import { buildDatabaseImports, type DbDevState, freshDbState } from '../db/index.js';
-import { EmailStatus, getEmailService } from '../email/index.js';
+import { EmailStatus, getEmailService, recordSentEmail } from '../email/index.js';
 import { parseEmailBlob } from '../email/wire.js';
 import { buildCryptoImports, type CryptoState, freshCryptoState } from './crypto.js';
 
@@ -190,6 +190,48 @@ function envLookup(
     return bytes.length;
 }
 
+/**
+ * `env::email_send` / `env::email_send_detached` in dev: the FULL email pipeline
+ * (./email) — parse + recipient validation + dedup + per-min/day budget +
+ * per-recipient cap run SYNCHRONOUSLY (exact status: BadRecipient/Deduped/Budget/
+ * RecipientCapped), then the real provider send is FIRE-AND-FORGET (a sync wasm
+ * import can't await it), so the guest gets `Sent` optimistically and the true
+ * outcome is logged. Unconfigured email stays a log-only mock returning `Sent`.
+ *
+ * The dev path already fires-and-forgets, so the SUSPENDING `email_send` and the
+ * NON-SUSPENDING `email_send_detached` map to the exact same behaviour here (both
+ * return immediately). BOTH feed the `__sentEmails` capture seam, so the email
+ * confirm/reset tests find their tokens whichever import the guest used. Mirrors
+ * the edge's `email_send_import.rs`.
+ */
+function devEmailSend(ref: MemoryRef, reqPtr: number, reqLen: number): number {
+    const raw = readBytes(ref, reqPtr, reqLen);
+    const svc = getEmailService();
+    if (svc === null) {
+        const parsed = parseEmailBlob(raw);
+        if (parsed !== null) recordSentEmail(parsed); // dev test seam
+        const to = parsed?.to ?? '<unparsed>';
+        process.stdout.write(`  ✉ dev email_send -> ${to} (no email config; not sent)\n`);
+        return EmailStatus.Sent;
+    }
+    const { status, parsed } = svc.prepare(raw);
+    if (parsed === null) {
+        process.stdout.write(`  ✉ dev email_send -> ${EmailStatus[status]}\n`);
+        return status;
+    }
+    recordSentEmail(parsed); // dev test seam
+    void svc
+        .deliver(parsed)
+        .then((s) => {
+            const label = s === EmailStatus.Sent ? 'sent' : EmailStatus[s];
+            process.stdout.write(`  ✉ dev email_send -> ${parsed.to} (${label})\n`);
+        })
+        .catch((e: unknown) => {
+            process.stdout.write(`  ✉ dev email_send -> ${parsed.to} (error: ${String(e)})\n`);
+        });
+    return EmailStatus.Sent; // optimistic; sync wasm can't await the send
+}
+
 /**
  * The portion of the `env.*` request surface that is SHARED by the daemon (cold)
  * box: panic hook, `Environment.get`/`getSecure`, `email_send`, `thread_spawn`,
@@ -226,34 +268,13 @@ export function buildEnvImports(
         // `Date.now()` -> wall-clock milliseconds, matching the edge host.
         'Date.now': (): bigint => BigInt(Date.now()),
 
-        // `env::email_send`: the FULL email pipeline in dev. A daemon may send
-        // mail, so this stays in the shared subset (00 B2 / doc 08 AN-8).
-        email_send: (reqPtr: number, reqLen: number): number => {
-            const raw = readBytes(ref, reqPtr, reqLen);
-            const svc = getEmailService();
-            if (svc === null) {
-                const to = parseEmailBlob(raw)?.to ?? '<unparsed>';
-                process.stdout.write(`  ✉ dev email_send -> ${to} (no email config; not sent)\n`);
-                return EmailStatus.Sent;
-            }
-            const { status, parsed } = svc.prepare(raw);
-            if (parsed === null) {
-                process.stdout.write(`  ✉ dev email_send -> ${EmailStatus[status]}\n`);
-                return status;
-            }
-            void svc
-                .deliver(parsed)
-                .then((s) => {
-                    const label = s === EmailStatus.Sent ? 'sent' : EmailStatus[s];
-                    process.stdout.write(`  ✉ dev email_send -> ${parsed.to} (${label})\n`);
-                })
-                .catch((e: unknown) => {
-                    process.stdout.write(
-                        `  ✉ dev email_send -> ${parsed.to} (error: ${String(e)})\n`,
-                    );
-                });
-            return EmailStatus.Sent; // optimistic; sync wasm can't await the send
-        },
+        // `env::email_send` / `email_send_detached`: the FULL email pipeline in
+        // dev. A daemon may send mail, so this stays in the shared subset (00 B2 /
+        // doc 08 AN-8). Both map to the same fire-and-forget dev path.
+        email_send: (reqPtr: number, reqLen: number): number =>
+            devEmailSend(ref, reqPtr, reqLen),
+        email_send_detached: (reqPtr: number, reqLen: number): number =>
+            devEmailSend(ref, reqPtr, reqLen),
     };
 }
 
@@ -340,41 +361,14 @@ export function buildHostImports(ref: MemoryRef, state: DispatchState): WebAssem
                 return d.allowed ? 1 : -Math.max(1, d.retryAfterSecs);
             },
 
-            // `env::email_send`: the FULL email pipeline in dev (./email): parse +
-            // recipient validation + dedup + per-min/day budget + per-recipient cap
-            // run SYNCHRONOUSLY (exact status — BadRecipient/Deduped/Budget/
-            // RecipientCapped), then the real provider send is FIRE-AND-FORGET (a
-            // sync wasm import can't await it), so the guest gets Sent optimistically
-            // and the true outcome is logged. Unconfigured email stays a log-only
-            // mock returning Sent. Mirrors the edge's `email_send_import.rs`.
-            email_send: (reqPtr: number, reqLen: number): number => {
-                const raw = readBytes(ref, reqPtr, reqLen);
-                const svc = getEmailService();
-                if (svc === null) {
-                    const to = parseEmailBlob(raw)?.to ?? '<unparsed>';
-                    process.stdout.write(
-                        `  ✉ dev email_send -> ${to} (no email config; not sent)\n`,
-                    );
-                    return EmailStatus.Sent;
-                }
-                const { status, parsed } = svc.prepare(raw);
-                if (parsed === null) {
-                    process.stdout.write(`  ✉ dev email_send -> ${EmailStatus[status]}\n`);
-                    return status;
-                }
-                void svc
-                    .deliver(parsed)
-                    .then((s) => {
-                        const label = s === EmailStatus.Sent ? 'sent' : EmailStatus[s];
-                        process.stdout.write(`  ✉ dev email_send -> ${parsed.to} (${label})\n`);
-                    })
-                    .catch((e: unknown) => {
-                        process.stdout.write(
-                            `  ✉ dev email_send -> ${parsed.to} (error: ${String(e)})\n`,
-                        );
-                    });
-                return EmailStatus.Sent; // optimistic; sync wasm can't await the send
-            },
+            // `env::email_send` (suspending on the edge) / `email_send_detached`
+            // (non-suspending on the edge): the FULL dev email pipeline. Both map
+            // to the same fire-and-forget dev path (a sync wasm import can't await
+            // the provider send), and BOTH feed `__sentEmails`. See devEmailSend.
+            email_send: (reqPtr: number, reqLen: number): number =>
+                devEmailSend(ref, reqPtr, reqLen),
+            email_send_detached: (reqPtr: number, reqLen: number): number =>
+                devEmailSend(ref, reqPtr, reqLen),
 
             // `Environment.get` / `getSecure`: copy one tenant env value into the
             // guest buffer. Returns the byte length (0 = present-but-empty), -1 if

package/src/devserver/runtime/module.ts

@@ -109,6 +109,7 @@ const PROVIDED_IMPORTS = new Set([
     'client_ip',
     'ratelimit_check',
     'email_send',
+    'email_send_detached',
     'env_get',
     'env_get_secure',
     // Per-domain analytics (see ./analytics/index.ts).

package/test/analytics-dev.test.ts

@@ -26,25 +26,36 @@ describe('dev analytics stub v2 frame parity', () => {
         let p = 0;
         const u16 = () => { const v = buf.readUInt16LE(p); p += 2; return v; };
         const u32 = () => { const v = buf.readUInt32LE(p); p += 4; return v; };
-        const i64 = () => { const v = buf.readBigInt64LE(p); p += 8; return v; };
         const u64 = () => { const v = buf.readBigUInt64LE(p); p += 8; return v; };
+        const f64 = () => { const v = buf.readDoubleLE(p); p += 8; return v; };
 
         expect(u16()).toBe(2); // FRAME_VERSION
         u64(); // now_ms
         const count = u32();
-        expect(count).toBe(43); // METRIC_COUNTERS
+        expect(count).toBe(42); // METRIC_COUNTERS (edge N_COUNTERS; no WasmDispatches)
         const life: bigint[] = [];
-        for (let i = 0; i < count; i++) life.push(i64());
-        expect(life[0]).toBe(42n); // Requests
-        expect(life[1]).toBe(12345n); // BytesOutL1
-        expect(life[12]).toBe(1_000_000n); // GasUsed
-        expect(life[41]).toBe(900n); // CacheHits
-        expect(i64()).toBe(3n); // connectedStreams
-        expect(i64()).toBe(65536n); // committedMemory
-        expect(i64()).toBe(5n); // reqMinuteUsed
+        for (let i = 0; i < count; i++) life.push(u64()); // counters are u64 LE now
+        // Indices are the AUTHORITATIVE edge MetricId ids (metric_id.rs): a mislabel here means the dev
+        // dashboard shows the wrong metric for every id past StaticHits.
+        expect(life[0]).toBe(42n); // Requests (id 0)
+        expect(life[1]).toBe(12345n); // BytesOutL1 (id 1)
+        expect(life[11]).toBe(1_000_000n); // GasUsed (id 11, was 12 in the stale layout)
+        expect(life[40]).toBe(900n); // CacheHits (id 40, was 41)
+        expect(life[41]).toBe(100n); // CacheMisses (id 41, was 42)
+        expect(u64()).toBe(3n); // connectedStreams
+        expect(u64()).toBe(65536n); // committedMemory
+        expect(u64()).toBe(5n); // reqMinuteUsed
         expect(u64()).toBe(100n); // reqMinuteCap
-        expect(i64()).toBe(42n); // reqDayUsed
+        expect(u64()).toBe(42n); // reqDayUsed
         expect(u64()).toBe(5000n); // reqDayCap
+        // 7 LIVE per-second rates (f64 LE), appended after the windows.
+        expect(f64()).toBeCloseTo(0.7); // rps
+        expect(f64()).toBeCloseTo(68.2); // bytesInPerSec
+        expect(f64()).toBeCloseTo(205.75); // bytesOutPerSec
+        expect(f64()).toBeCloseTo(34.1); // streamBytesInPerSec
+        expect(f64()).toBeCloseTo(136.5); // streamBytesOutPerSec
+        expect(f64()).toBeCloseTo(0.28); // dbOpsPerSec
+        expect(f64()).toBeCloseTo(16_666.67); // gasPerSec
         expect(p).toBe(buf.length); // no trailing bytes
     });
 
@@ -69,8 +80,19 @@ describe('dev analytics stub v2 frame parity', () => {
         expect(b2.readUInt32LE(4)).toBe(60); // bucketSecs
         expect(b2.readUInt32LE(16)).toBe(60); // count
 
-        // A bad metric / range -> ABSENT (negative), no frame.
+        // range 8 (D60) + 9 (D90) -> DAY ring: 60/90 buckets, bucketSecs 86400.
+        imports.analytics_series(0, 0, 0, 8);
+        const b60 = db.lastResult as unknown as Buffer;
+        expect(b60.readUInt32LE(4)).toBe(86_400); // bucketSecs
+        expect(b60.readUInt32LE(16)).toBe(60); // count
+        imports.analytics_series(0, 0, 0, 9);
+        const b90 = db.lastResult as unknown as Buffer;
+        expect(b90.readUInt32LE(4)).toBe(86_400); // bucketSecs
+        expect(b90.readUInt32LE(16)).toBe(90); // count
+
+        // A bad metric / range -> ABSENT (negative), no frame. Range 10 is past D90.
         expect(imports.analytics_series(0, 0, 999, 3)).toBeLessThan(0);
         expect(imports.analytics_series(0, 0, 0, 99)).toBeLessThan(0);
+        expect(imports.analytics_series(0, 0, 0, 10)).toBeLessThan(0);
     });
 });

package/test/devserver-email.test.ts

@@ -9,11 +9,17 @@ import { afterEach, describe, expect, it, vi } from 'vitest';
 
 import { EmailCaps } from '../src/devserver/email/caps.js';
 import { resolveEmailConfig, type ResolvedEmailConfig } from '../src/devserver/email/config.js';
-import { NodeEmailService } from '../src/devserver/email/index.js';
+import {
+    NodeEmailService,
+    __sentEmails,
+    __clearSentEmails,
+    resetEmailService,
+} from '../src/devserver/email/index.js';
 import { sendResend } from '../src/devserver/email/providers.js';
 import { EmailStatus } from '../src/devserver/email/status.js';
 import { validFrom, validRecipient } from '../src/devserver/email/validate.js';
 import { parseEmailBlob } from '../src/devserver/email/wire.js';
+import { buildHostImports, freshDispatchState, type MemoryRef } from '../src/devserver/runtime/host.js';
 
 /** Encode an `email_send` blob exactly like the guest (`server/globals/email.ts`). */
 function encodeBlob(to: string, subject: string, purpose: string, body: string, html: string): Buffer {
@@ -239,3 +245,44 @@ describe('NodeEmailService pipeline', () => {
         expect(fetchMock).toHaveBeenCalledTimes(1);
     });
 });
+
+describe('host imports: email_send_detached (the anti-enumeration fire-and-forget path)', () => {
+    afterEach(() => {
+        resetEmailService();
+        __clearSentEmails();
+    });
+
+    /** Build a dev host import table over a fresh wasm memory holding `blob` at offset 0. */
+    function wireHost(blob: Buffer): {
+        env: Record<string, (...a: number[]) => number>;
+        len: number;
+    } {
+        const memory = new WebAssembly.Memory({ initial: 1 });
+        Buffer.from(memory.buffer).set(blob, 0);
+        const ref: MemoryRef = { memory };
+        const imports = buildHostImports(ref, freshDispatchState());
+        return { env: imports.env as Record<string, (...a: number[]) => number>, len: blob.length };
+    }
+
+    it('is registered and returns a queue-accept status immediately (no provider round-trip)', () => {
+        resetEmailService(); // unconfigured: log-only stub, still constant-time
+        __clearSentEmails();
+        const { env, len } = wireHost(encodeBlob('someone@x.com', 'Subj', 'verify', 'tok', '<b>x</b>'));
+        // The detached import exists (mirrors the edge's env.email_send_detached).
+        expect(typeof env.email_send_detached).toBe('function');
+        // It returns synchronously with a queue-accept status (Sent == accepted/queued).
+        expect(env.email_send_detached(0, len)).toBe(EmailStatus.Sent);
+    });
+
+    it('feeds the __sentEmails capture seam so confirm/reset tests still find the token', () => {
+        resetEmailService();
+        __clearSentEmails();
+        const link = 'https://app.example.com/reset#token=deadbeef';
+        const { env, len } = wireHost(encodeBlob('user@x.com', 'Reset', 'reset', link, ''));
+        env.email_send_detached(0, len);
+        const captured = __sentEmails.find((e) => e.to === 'user@x.com');
+        expect(captured).toBeTruthy();
+        expect(captured!.purpose).toBe('reset');
+        expect(captured!.text).toContain('token=deadbeef'); // the emailed token survives to the seam
+    });
+});

package/test/pqauth-e2e.test.ts

@@ -21,6 +21,7 @@ import { ristretto255_oprf } from '@noble/curves/ed25519.js';
 
 import { WasmServerModule } from '../src/devserver/index.js';
 import { __resetDbForTests } from '../src/devserver/db/index.js';
+import { __resetRatelimitForTests } from '../src/devserver/config/ratelimit.js';
 import { Auth } from '../src/client/auth.js';
 import { DataReader, DataWriter } from '../src/io/codec.js';
 
@@ -85,6 +86,9 @@ describe.skipIf(!haveWasm)('post-quantum auth end-to-end (client <-> example was
 
     beforeEach(() => {
         __resetDbForTests();
+        // The built-in controller decorates every route with `@ratelimit`; the dev limiter is a
+        // module-level singleton, so reset it per case to keep the many dispatches in this file isolated.
+        __resetRatelimitForTests();
         mod = loadModule();
         restoreFetch = installFetchShim(mod);
     });
@@ -93,7 +97,7 @@ describe.skipIf(!haveWasm)('post-quantum auth end-to-end (client <-> example was
     it(
         'registers then logs in (full OPRF + ML-DSA + ML-KEM mutual-auth chain)',
         async () => {
-            await Auth.register('ada', 'correct horse battery staple');
+            await Auth.register('ada', 'correct horse battery staple', 'ada@example.com');
             // login resolves ONLY if the server's mutual-auth confirmation tag
             // verified against the client's own shared secret.
             const session = await Auth.login('ada', 'correct horse battery staple');
@@ -125,7 +129,7 @@ describe.skipIf(!haveWasm)('post-quantum auth end-to-end (client <-> example was
     it(
         'rejects a wrong password at login',
         async () => {
-            await Auth.register('bob', 'hunter2-correct');
+            await Auth.register('bob', 'hunter2-correct', 'bob@example.com');
             await expect(Auth.login('bob', 'hunter2-WRONG')).rejects.toThrow(/login failed|request failed/);
         },
         60_000,
@@ -142,12 +146,13 @@ describe.skipIf(!haveWasm)('post-quantum auth end-to-end (client <-> example was
     it(
         'rejects a duplicate registration with a clear (not generic) message',
         async () => {
-            await Auth.register('dupe', 'correct horse battery staple');
+            await Auth.register('dupe', 'correct horse battery staple', 'dupe@example.com');
             // Second registration of the same username must say so explicitly,
-            // not return the generic "request failed".
-            await expect(Auth.register('dupe', 'correct horse battery staple')).rejects.toThrow(
-                /already registered/,
-            );
+            // not return the generic "request failed". (The username-taken check fires
+            // before the email check, so it stays `already registered` even with the same email.)
+            await expect(
+                Auth.register('dupe', 'correct horse battery staple', 'dupe@example.com'),
+            ).rejects.toThrow(/already registered/);
         },
         60_000,
     );
@@ -155,7 +160,10 @@ describe.skipIf(!haveWasm)('post-quantum auth end-to-end (client <-> example was
 
 // Lower-level wire checks that don't need the heavy Argon2id derivation.
 describe.skipIf(!haveWasm)('post-quantum auth wire-level (anti-enumeration, replay)', () => {
-    beforeEach(() => __resetDbForTests());
+    beforeEach(() => {
+        __resetDbForTests();
+        __resetRatelimitForTests();
+    });
 
     const oprf = ristretto255_oprf.oprf;
     const loginStart = (m: WasmServerModule, username: string) => {
@@ -193,7 +201,8 @@ describe.skipIf(!haveWasm)('post-quantum auth wire-level (anti-enumeration, repl
         expect(a.salt.length).toBe(16);
         expect(a.nonce.length).toBe(32);
         expect(a.evaluated.length).toBe(32);
-        expect(a.aud).toBe('toil-demo');
+        // The built-in controller returns `TOIL_AUTH_AUDIENCE` or the literal `'toil'` (dev has no secret set).
+        expect(a.aud).toBe('toil');
         // The randomized fields DO differ (fresh challenge each call).
         expect(hex(a.cid)).not.toBe(hex(b.cid));
     });