cursedbelt-server 4.9.0 → 4.11.1

package/dist/server/analytics/webAnalytics.d.ts

@@ -48,7 +48,29 @@ export declare const WEB_ANALYTICS_SITE_TAG = "d1bea8562544421fbd2db5f11b74d1cc"
 /** The `cursedalchemy.com` site's `data-cf-beacon` token. This is what the tag carries. */
 export declare const WEB_ANALYTICS_SITE_TOKEN = "bd88d63678b64bc89f9702f48846bc88";
 /**
- * The snippet, exactly as Cloudflare's own `site_info` endpoint spells it.
+ * 🔴 The `version` the beacon's config must carry, or NOTHING is recorded.
+ *
+ * Measured 2026-09-22, after the RUM API showed every manual-snippet shell recording ZERO
+ * pageviews from 2026-09-19 on — collections, music, roms, flix, station and desk, which had
+ * been 130–290 a day between them — while the hosts still on the edge's injection kept
+ * recording. The beacon copies this value into its payload as `versions.fl`, and
+ * `cloudflareinsights.com/cdn-cgi/rum` answers a payload without `fl` with a **404 that carries
+ * no CORS header**, which a browser prints as a CORS refusal and nobody reads as "recorded
+ * nothing". Same token, same src, driven in a real browser from a `*.cursedalchemy.com` origin:
+ * `{"token": …}` → 404 every time; `{"version": "2024.11.0", "token": …}` → 204 every time,
+ * whether the script path was pinned or not. Any value was accepted; this one is what the
+ * edge's own injection carries, so it is the value Cloudflare is known to send.
+ *
+ * Cloudflare's own `site_info` snippet OMITS it, so "exactly the vendor's text" was the
+ * defect, not the safety it looked like. `tools/check-web-analytics.ts` reds a hand copy
+ * without it.
+ */
+export declare const WEB_ANALYTICS_BEACON_VERSION = "2024.11.0";
+/** The `data-cf-beacon` value — one spelling for the tag, the bootstrap and every hand copy. */
+export declare function webAnalyticsBeaconConfig(token?: string): string;
+/**
+ * The snippet as Cloudflare's own `site_info` endpoint spells it — plus the `version` key it
+ * leaves out, without which nothing is recorded (see {@link WEB_ANALYTICS_BEACON_VERSION}).
  *
  * 🔴 The single-quoted attributes and the space after `"token":` are Cloudflare's, not a
  * style choice, and they are kept because this string is COMPARED against what an app's
@@ -104,7 +126,14 @@ export declare function webAnalyticsBootstrap(token?: string): string;
  *
  * Deliberately NOT a substring test against {@link WEB_ANALYTICS_TAG}: a shell is authored by
  * hand and a formatter is allowed to re-wrap the tag across lines or re-order its attributes.
- * What must be true is that the beacon's source is there AND that it is carrying the right
- * token — the two halves that decide whether a pageview is recorded at all.
+ * What must be true is that the beacon's source is there, that it is carrying the right
+ * token, and that its config carries a `version` — the three things that decide whether a
+ * pageview is recorded at all. The third was missed until 2026-09-22 and cost four days of
+ * every manual shell's data; see {@link WEB_ANALYTICS_BEACON_VERSION}.
  */
 export declare function htmlCarriesWebAnalytics(html: string, token?: string): boolean;
+/**
+ * Every `data-cf-beacon` config in `html` names a `version` — and there is at least one.
+ * Read up to the config's closing brace, so key order and a formatter's spacing do not matter.
+ */
+export declare function beaconConfigsCarryVersion(html: string): boolean;

package/dist/server/analytics/webAnalytics.js

@@ -48,7 +48,31 @@ export const WEB_ANALYTICS_SITE_TAG = "d1bea8562544421fbd2db5f11b74d1cc";
 /** The `cursedalchemy.com` site's `data-cf-beacon` token. This is what the tag carries. */
 export const WEB_ANALYTICS_SITE_TOKEN = "bd88d63678b64bc89f9702f48846bc88";
 /**
- * The snippet, exactly as Cloudflare's own `site_info` endpoint spells it.
+ * 🔴 The `version` the beacon's config must carry, or NOTHING is recorded.
+ *
+ * Measured 2026-09-22, after the RUM API showed every manual-snippet shell recording ZERO
+ * pageviews from 2026-09-19 on — collections, music, roms, flix, station and desk, which had
+ * been 130–290 a day between them — while the hosts still on the edge's injection kept
+ * recording. The beacon copies this value into its payload as `versions.fl`, and
+ * `cloudflareinsights.com/cdn-cgi/rum` answers a payload without `fl` with a **404 that carries
+ * no CORS header**, which a browser prints as a CORS refusal and nobody reads as "recorded
+ * nothing". Same token, same src, driven in a real browser from a `*.cursedalchemy.com` origin:
+ * `{"token": …}` → 404 every time; `{"version": "2024.11.0", "token": …}` → 204 every time,
+ * whether the script path was pinned or not. Any value was accepted; this one is what the
+ * edge's own injection carries, so it is the value Cloudflare is known to send.
+ *
+ * Cloudflare's own `site_info` snippet OMITS it, so "exactly the vendor's text" was the
+ * defect, not the safety it looked like. `tools/check-web-analytics.ts` reds a hand copy
+ * without it.
+ */
+export const WEB_ANALYTICS_BEACON_VERSION = "2024.11.0";
+/** The `data-cf-beacon` value — one spelling for the tag, the bootstrap and every hand copy. */
+export function webAnalyticsBeaconConfig(token = WEB_ANALYTICS_SITE_TOKEN) {
+    return `{"version": "${WEB_ANALYTICS_BEACON_VERSION}", "token": "${token}"}`;
+}
+/**
+ * The snippet as Cloudflare's own `site_info` endpoint spells it — plus the `version` key it
+ * leaves out, without which nothing is recorded (see {@link WEB_ANALYTICS_BEACON_VERSION}).
  *
  * 🔴 The single-quoted attributes and the space after `"token":` are Cloudflare's, not a
  * style choice, and they are kept because this string is COMPARED against what an app's
@@ -62,7 +86,7 @@ export const WEB_ANALYTICS_SITE_TOKEN = "bd88d63678b64bc89f9702f48846bc88";
 export function webAnalyticsTag(token = WEB_ANALYTICS_SITE_TOKEN) {
     return ("<!-- Cloudflare Web Analytics -->" +
         `<script type='module' src='${WEB_ANALYTICS_BEACON_SRC}' ` +
-        `data-cf-beacon='{"token": "${token}"}'></script>` +
+        `data-cf-beacon='${webAnalyticsBeaconConfig(token)}'></script>` +
         "<!-- End Cloudflare Web Analytics -->");
 }
 /** The fleet's tag, for the one site this generation serves. */
@@ -111,7 +135,7 @@ export function webAnalyticsBootstrap(token = WEB_ANALYTICS_SITE_TOKEN) {
         `\t\tvar beacon = document.createElement("script");`,
         `\t\tbeacon.type = "module";`,
         `\t\tbeacon.src = "${WEB_ANALYTICS_BEACON_SRC}";`,
-        `\t\tbeacon.setAttribute("data-cf-beacon", '{"token": "${token}"}');`,
+        `\t\tbeacon.setAttribute("data-cf-beacon", '${webAnalyticsBeaconConfig(token)}');`,
         `\t\tdocument.head.appendChild(beacon);`,
         "\t}",
         "</script>",
@@ -122,9 +146,19 @@ export function webAnalyticsBootstrap(token = WEB_ANALYTICS_SITE_TOKEN) {
  *
  * Deliberately NOT a substring test against {@link WEB_ANALYTICS_TAG}: a shell is authored by
  * hand and a formatter is allowed to re-wrap the tag across lines or re-order its attributes.
- * What must be true is that the beacon's source is there AND that it is carrying the right
- * token — the two halves that decide whether a pageview is recorded at all.
+ * What must be true is that the beacon's source is there, that it is carrying the right
+ * token, and that its config carries a `version` — the three things that decide whether a
+ * pageview is recorded at all. The third was missed until 2026-09-22 and cost four days of
+ * every manual shell's data; see {@link WEB_ANALYTICS_BEACON_VERSION}.
  */
 export function htmlCarriesWebAnalytics(html, token = WEB_ANALYTICS_SITE_TOKEN) {
-    return html.includes(WEB_ANALYTICS_BEACON_SRC) && html.includes(token);
+    return html.includes(WEB_ANALYTICS_BEACON_SRC) && html.includes(token) && beaconConfigsCarryVersion(html);
+}
+/**
+ * Every `data-cf-beacon` config in `html` names a `version` — and there is at least one.
+ * Read up to the config's closing brace, so key order and a formatter's spacing do not matter.
+ */
+export function beaconConfigsCarryVersion(html) {
+    const configs = [...html.matchAll(/data-cf-beacon[^{]{0,24}(\{[^}]*\})/g)].map((m) => m[1] ?? "");
+    return configs.length > 0 && configs.every((c) => /"version"\s*:\s*"[^"]+"/.test(c));
 }

package/dist/server/bench/cpuClock.d.ts

@@ -40,6 +40,10 @@ export interface CpuClock {
  * That is why {@link runCpuBench} drives its cases SERIALLY — a serial driver is what
  * makes this proxy sound enough to gate on. Mounted in production it is advisory: useful
  * for ranking routes, not for a billing claim.
+ *
+ * Where the runtime has no such reading, this returns {@link unavailableCpuClock} — a
+ * clock, never a throw. {@link probeProcessCpuUsage} is what decides, and it decides by
+ * CALLING.
  */
 export declare function processCpuClock(): CpuClock;
 /**

package/dist/server/bench/cpuClock.js

@@ -26,11 +26,15 @@
  * That is why {@link runCpuBench} drives its cases SERIALLY — a serial driver is what
  * makes this proxy sound enough to gate on. Mounted in production it is advisory: useful
  * for ranking routes, not for a billing claim.
+ *
+ * Where the runtime has no such reading, this returns {@link unavailableCpuClock} — a
+ * clock, never a throw. {@link probeProcessCpuUsage} is what decides, and it decides by
+ * CALLING.
  */
 export function processCpuClock() {
-    const usable = typeof process !== 'undefined' && typeof process.cpuUsage === 'function';
-    if (!usable)
-        return unavailableCpuClock('process.cpuUsage (absent)');
+    const probe = probeProcessCpuUsage();
+    if (!probe.ok)
+        return unavailableCpuClock(`process.cpuUsage (${probe.why})`);
     return {
         source: 'process.cpuUsage',
         proxy: true,
@@ -44,6 +48,56 @@ export function processCpuClock() {
         },
     };
 }
+/**
+ * 🔴 **Is `process.cpuUsage()` a clock here? Answered by CALLING it, never by `typeof`.**
+ *
+ * Measured 2026-09-19 on the first real deploy of a Worker mounting `cpuBudget()`: under
+ * `nodejs_compat`, workerd's strategy for the parts of `node:process` it does not implement
+ * is to PROVIDE the method and throw when it is called —
+ *
+ * ```
+ * Error [ERR_METHOD_NOT_IMPLEMENTED]: The process.cpuUsage method is not implemented
+ *     at process.cpuUsage (node-internal:public_process:235:11)
+ * ```
+ *
+ * — so `typeof process.cpuUsage === 'function'` answers *yes* about the one runtime the
+ * probe exists to answer *no* about. The clock that came back threw on first use, and
+ * because `cpuBudget()` is mounted FIRST by design, the throw landed in front of the whole
+ * app: every path 500, with 843 green tests behind it, because `bun test` runs where the
+ * method works.
+ *
+ * This is a capability CLASS, not one method: `nodejs_compat` stubs a great deal of
+ * `node:process`, `node:os` and `node:v8` the same way. `src/nodeBuiltinsAreProbedByCalling.spec.ts`
+ * is the check that keeps a `typeof` gate from coming back anywhere in this library.
+ *
+ * Both call shapes are exercised, because the span uses both and only one of them is
+ * probed by the first: `cpuUsage()` for the baseline and `cpuUsage(before)` for the delta.
+ * That costs two calls at wiring time — the same trade {@link workerCpuClock} argues for on
+ * the other side, and the alternative is a gate that reads zero for ever.
+ */
+function probeProcessCpuUsage() {
+    // Present-but-throwing and absent are both unavailable; the distinction only LABELS the
+    // clock, and is never the decision — which is why this line may carry the excuse that
+    // `src/nodeBuiltinsAreProbedByCalling.spec.ts` refuses everywhere else.
+    // probe-by-calling:ignore — label only; the call below is what decides.
+    const present = typeof process !== 'undefined' && typeof process.cpuUsage === 'function';
+    let reading;
+    try {
+        // A bare `process` that does not exist throws a ReferenceError in here, which is the
+        // same answer as a method that throws: not a clock.
+        const before = process.cpuUsage();
+        const delta = process.cpuUsage(before);
+        reading = before.user + before.system + delta.user + delta.system;
+    }
+    catch {
+        return { ok: false, why: present ? 'throws' : 'absent' };
+    }
+    // A stub that returns something non-numeric is no more usable than one that throws, and
+    // would otherwise reach the recorder as a confident 0.00 for every route.
+    if (!Number.isFinite(reading))
+        return { ok: false, why: 'non-numeric' };
+    return { ok: true };
+}
 /**
  * A clock over a CPU-ms reader the runtime supplies. `proxy: false` — this is the real
  * quantity Cloudflare bills, so a report built on it may be quoted as one.

package/dist/server/bench/runBench.d.ts

@@ -31,6 +31,33 @@ export interface BenchCase {
      * that never ran — a green budget over a broken route.
      */
     expectStatus?: number | number[] | ((status: number) => boolean);
+    /**
+     * Called before EVERY iteration of this case — warm-up included. For a **destructive**
+     * route, rebuild the fixture here; without it the second call measures an empty database.
+     *
+     * 🔴 This is the hook a destructive route cannot be benched without. `runCpuBench` fires a
+     * case `warmup + iterations` times against ONE app instance, which is exactly right for a
+     * read and a lie for a purge: the first call runs against a populated library and the next
+     * twenty-nine against an empty one, so the p99 is a small number for the wrong reason and
+     * the budget it satisfies means nothing. `expectStatus` cannot catch it either — the second
+     * call legitimately answers 200 with `{ deleted: 0 }`.
+     *
+     * It is **per case**, not run-wide, so the cheap read cases pay nothing for it — neither
+     * the rebuild nor the accounting {@link runCpuBench} does around it.
+     *
+     * 🔴 **Its cost is not measured, and that is checked rather than assumed.** The recorder is
+     * written through by the `cpuBudget()` middleware inside `app.fetch`, so a hook that runs
+     * outside that call is already excluded by ordering — but ordering is an accident, and a
+     * fixture rebuild that cost 200 ms and got attributed to the route would make this feature
+     * a worse lie than the hole it closes. So {@link runCpuBench} refuses a hook that drives
+     * the app under bench (see the error it throws), and `cpuBudget.spec.ts` proves a hook that
+     * burns real CPU leaves the route's number alone.
+     *
+     * `iteration` is 0-based and monotonic across the WHOLE case, warm-up first: warm-up gets
+     * `0 … warmup-1` and the measured pass continues from `warmup`. A hook that seeds ids from
+     * it therefore never collides between the two passes.
+     */
+    beforeEach?: (c: BenchCase, iteration: number) => void | Promise<void>;
 }
 export interface RunCpuBenchOpts {
     /** Anything with Hono's `fetch` shape. */

package/dist/server/bench/runBench.js

@@ -25,6 +25,39 @@ function statusAllowed(c, status) {
 function describe(c) {
     return `${(c.method ?? 'GET').toUpperCase()} ${c.path}`;
 }
+/**
+ * Every request the recorder has attributed to any route so far. `samples` counts what was
+ * SEEN rather than what the reservoir retained, so this only ever goes up within a phase.
+ */
+function totalSamples(recorder) {
+    let n = 0;
+    for (const r of recorder.report().routes)
+        n += r.samples;
+    return n;
+}
+/**
+ * Run a case's {@link BenchCase.beforeEach}, and prove it stayed out of the histogram.
+ *
+ * 🔴 The obvious way to rebuild a fixture is to drive the app that already has the routes —
+ * `POST /api/upload` thirty times to re-seed a library. Those requests go through
+ * `cpuBudget()` like any other, so the rebuild lands in the report as real samples on real
+ * routes, and the destructive route this hook exists to measure honestly is now benched
+ * beside rows nobody asked for. Refusing it here is cheap and only costs a case that has a
+ * hook at all.
+ */
+async function prepare(opts, c, iteration) {
+    if (!c.beforeEach)
+        return;
+    const before = totalSamples(opts.recorder);
+    await c.beforeEach(c, iteration);
+    const after = totalSamples(opts.recorder);
+    if (after !== before) {
+        throw new Error(`cpu-bench: ${describe(c)}'s beforeEach drove ${after - before} request(s) through the ` +
+            'app under bench, so the fixture rebuild is now IN the measurement it exists to keep ' +
+            'out of it. Rebuild the fixture directly — against the database, the store, the ' +
+            'seed helper — never through app.fetch.');
+    }
+}
 async function fire(opts, c) {
     const method = (c.method ?? c.init?.method ?? 'GET').toUpperCase();
     const req = new Request(`${opts.origin ?? BENCH_ORIGIN}${c.path}`, { ...c.init, method });
@@ -46,16 +79,23 @@ export async function runCpuBench(opts) {
     const warmup = opts.warmup ?? 5;
     if (!(iterations > 0))
         throw new Error('runCpuBench: iterations must be > 0');
+    // `beforeEach` runs over the warm-up too, deliberately. Warm-up exists to reach a handler's
+    // steady state, and a destructive route warmed against the empty database it emptied warms
+    // the wrong branch — the loop the p99 is about never runs.
     for (const c of opts.cases) {
-        for (let i = 0; i < warmup; i += 1)
+        for (let i = 0; i < warmup; i += 1) {
+            await prepare(opts, c, i);
             await fire(opts, c);
+        }
     }
     // 🔴 Everything above was warm-up. Discard it — measuring it is the bug this guards.
     opts.recorder.reset();
     for (const c of opts.cases) {
         const n = c.iterations ?? iterations;
-        for (let i = 0; i < n; i += 1)
+        for (let i = 0; i < n; i += 1) {
+            await prepare(opts, c, warmup + i);
             await fire(opts, c);
+        }
     }
     return opts.recorder.report();
 }

package/dist/server/d1/index.d.ts

@@ -15,7 +15,7 @@
  * ```
  */
 export { type BackupPoint, createTimeTravelBackup, type DatabaseBackup, type TimeTravelOpts, } from './backup';
-export { type InvocationD1, perInvocation } from './invocation';
+export { createPendingWrites, type InvocationD1, type PendingWrites, perInvocation, type WriteCollector } from './invocation';
 export { assertBatchSize, assertWithinLimits, chunkForBind, LIMITS } from './limits';
 export { createLocalD1, refuseInteractiveTransaction } from './local';
 export { createRemoteD1, type D1BindingLike, type D1BindingMeta, type D1BindingResult, type D1BindingStatement, } from './remote';

package/dist/server/d1/index.js

@@ -33,7 +33,7 @@ export { createTimeTravelBackup, } from './backup';
 // that does not use the query builder — which per `../db/kysely.ts`'s own header is most
 // of them, since business tables stay on raw statements. Measured 2026-09-18 against the
 // published 4.3.0 tarball. `barrelsReachNoOptionalPeer.spec.ts` is what keeps it out.
-export { perInvocation } from './invocation';
+export { createPendingWrites, perInvocation } from './invocation';
 export { assertBatchSize, assertWithinLimits, chunkForBind, LIMITS } from './limits';
 export { createLocalD1, refuseInteractiveTransaction } from './local';
 export { createRemoteD1, } from './remote';

package/dist/server/d1/invocation.d.ts

@@ -39,6 +39,14 @@
  * It wraps either driver, because it sits ABOVE the seam and only counts. That is what
  * makes the local gate able to prove a production-only limit: wrap a local database in a
  * test, run the loop, and the laptop fails exactly where the Worker would.
+ *
+ * ## The other thing that is true for the span of one request: {@link createPendingWrites}
+ *
+ * A Worker port's synchronous stores answer from a snapshot and queue their durable writes
+ * as promises, which the entry point awaits BEFORE the response leaves. That collector has
+ * the same lifetime as the budget above — one per invocation, constructed by the caller in
+ * the same breath — so it lives in the same file. See its own header for why it was moved
+ * here on 2026-09-19.
  */
 import { type D1LikeDatabase } from './types';
 /**
@@ -70,3 +78,67 @@ export interface InvocationD1 extends D1LikeDatabase {
 export declare function perInvocation(db: D1LikeDatabase, opts?: {
     max?: number;
 }): InvocationD1;
+/**
+ * Where a durable write goes on its way out of one invocation.
+ *
+ * Deliberately two members, and the narrower `add`-only half is what a STORE takes. A store
+ * that also held `settle` could end the request's writes from inside the request, which is
+ * the entry point's job and nobody else's. `cursedauth/d1-stores` declares exactly this
+ * two-method shape under its own name (`WriteCollector`) because that package sits UNDER
+ * this one and may not import it — structural typing means an object made here satisfies it
+ * verbatim, with no dependency edge in either direction.
+ */
+export interface WriteCollector {
+    add(promise: Promise<unknown>): void;
+}
+/** A write that must land before the response is returned. See {@link createPendingWrites}. */
+export interface PendingWrites extends WriteCollector {
+    /** Await every collected write. Called BEFORE the response is returned, never after. */
+    settle(): Promise<void>;
+}
+/**
+ * Collect the durable writes of ONE invocation, to be awaited before the response leaves.
+ *
+ * ## Why this is the Worker-write primitive and not a convenience
+ *
+ * A ported app's synchronous stores cannot await — their signatures are somebody else's
+ * published contract — so the shape every port lands on is: one read fills a snapshot, every
+ * sync call answers from it, and every mutation both updates the snapshot and pushes its
+ * statement's promise in here. The entry point then does the awaiting:
+ *
+ * ```ts
+ * export default {
+ *   async fetch(req: Request, env: Env) {
+ *     const db     = perInvocation(createRemoteD1(env.DB));
+ *     const writes = createPendingWrites();
+ *     const res    = await app.fetch(req, { db, writes });
+ *     await writes.settle();          // 🔴 BEFORE the response, never after
+ *     return res;
+ *   },
+ * };
+ * ```
+ *
+ * 🔴 **`settle()` before the response, never `ctx.waitUntil`.** A Worker isolate is per-colo
+ * and short-lived; a write acknowledged by a 200 and then dropped means "sign out" reported
+ * success and left the credential live — a failure invisible to any single-process test and
+ * indistinguishable, to the person, from the feature being broken.
+ *
+ * 🔴 **`Promise.all`, not `allSettled`.** A failed durable write must not be reported as a
+ * success. It surfaces as a 500 from the entry point, which is the honest answer to "did my
+ * sign-out take". `allSettled` here would convert every lost write into a silent 200 — the
+ * same outcome as not collecting them at all, reached by a road that looks careful.
+ *
+ * ## Why it lives here
+ *
+ * It was written three times before it was published once — `apps/patterns/worker/stores.ts`,
+ * `apps/collections/worker/stores.ts` and `libs/cursedauth/src/d1Stores.ts`, byte-identical
+ * but for a comment, with six more ports queued behind them. It is a D1-INVOCATION primitive
+ * rather than an auth one, so it belongs beside {@link perInvocation}: both are constructed
+ * per request, both describe what is true for the span of one, and neither knows anything
+ * about who is signed in.
+ *
+ * Ordering is NOT what this gives you. Everything added is already in flight, so two writes
+ * that must land in order go in one `batch()`, never in two `add`s — a DELETE that must
+ * precede its INSERT will otherwise race and trip a unique index.
+ */
+export declare function createPendingWrites(): PendingWrites;

package/dist/server/d1/invocation.js

@@ -39,6 +39,14 @@
  * It wraps either driver, because it sits ABOVE the seam and only counts. That is what
  * makes the local gate able to prove a production-only limit: wrap a local database in a
  * test, run the loop, and the laptop fails exactly where the Worker would.
+ *
+ * ## The other thing that is true for the span of one request: {@link createPendingWrites}
+ *
+ * A Worker port's synchronous stores answer from a snapshot and queue their durable writes
+ * as promises, which the entry point awaits BEFORE the response leaves. That collector has
+ * the same lifetime as the budget above — one per invocation, constructed by the caller in
+ * the same breath — so it lives in the same file. See its own header for why it was moved
+ * here on 2026-09-19.
  */
 import { LIMITS } from './limits';
 import { D1LimitError } from './types';
@@ -164,3 +172,60 @@ export function perInvocation(db, opts = {}) {
         },
     };
 }
+/**
+ * Collect the durable writes of ONE invocation, to be awaited before the response leaves.
+ *
+ * ## Why this is the Worker-write primitive and not a convenience
+ *
+ * A ported app's synchronous stores cannot await — their signatures are somebody else's
+ * published contract — so the shape every port lands on is: one read fills a snapshot, every
+ * sync call answers from it, and every mutation both updates the snapshot and pushes its
+ * statement's promise in here. The entry point then does the awaiting:
+ *
+ * ```ts
+ * export default {
+ *   async fetch(req: Request, env: Env) {
+ *     const db     = perInvocation(createRemoteD1(env.DB));
+ *     const writes = createPendingWrites();
+ *     const res    = await app.fetch(req, { db, writes });
+ *     await writes.settle();          // 🔴 BEFORE the response, never after
+ *     return res;
+ *   },
+ * };
+ * ```
+ *
+ * 🔴 **`settle()` before the response, never `ctx.waitUntil`.** A Worker isolate is per-colo
+ * and short-lived; a write acknowledged by a 200 and then dropped means "sign out" reported
+ * success and left the credential live — a failure invisible to any single-process test and
+ * indistinguishable, to the person, from the feature being broken.
+ *
+ * 🔴 **`Promise.all`, not `allSettled`.** A failed durable write must not be reported as a
+ * success. It surfaces as a 500 from the entry point, which is the honest answer to "did my
+ * sign-out take". `allSettled` here would convert every lost write into a silent 200 — the
+ * same outcome as not collecting them at all, reached by a road that looks careful.
+ *
+ * ## Why it lives here
+ *
+ * It was written three times before it was published once — `apps/patterns/worker/stores.ts`,
+ * `apps/collections/worker/stores.ts` and `libs/cursedauth/src/d1Stores.ts`, byte-identical
+ * but for a comment, with six more ports queued behind them. It is a D1-INVOCATION primitive
+ * rather than an auth one, so it belongs beside {@link perInvocation}: both are constructed
+ * per request, both describe what is true for the span of one, and neither knows anything
+ * about who is signed in.
+ *
+ * Ordering is NOT what this gives you. Everything added is already in flight, so two writes
+ * that must land in order go in one `batch()`, never in two `add`s — a DELETE that must
+ * precede its INSERT will otherwise race and trip a unique index.
+ */
+export function createPendingWrites() {
+    const pending = [];
+    return {
+        add: (promise) => void pending.push(promise),
+        async settle() {
+            // `all`, not `allSettled`: a failed durable write must not be reported as a
+            // success. It surfaces as a 500 from the entry point, which is the honest answer
+            // to "did my sign-out take".
+            await Promise.all(pending);
+        },
+    };
+}

package/dist/server/master-lock/guard.d.ts

@@ -51,9 +51,14 @@ export interface MasterLockGuardOptions extends LockPageOptions {
  * loosening it: nothing loads from anywhere but this origin, the form posts nowhere (the
  * script does the POST), and the page cannot be framed.
  *
- * 🔴 **EXPORTED so that nothing has to copy it.** `apps/collections` had a hand-typed
- * duplicate of this string in a test until 2026-09-18, which is a policy that can drift
- * without anything going red. It is also what
+ * 🔴 **EXPORTED so that nothing has to copy it** — and exporting it is not the same as nothing
+ * copying it. This sentence used to read *"`apps/collections` had a hand-typed duplicate … until
+ * 2026-09-18"*, and it was false the day it was written: the export landed, and BOTH re-typed
+ * copies stayed — one in `apps/collections/scripts/injectedScripts.test.ts` and one three
+ * directories from here in `../analytics/injectedScripts.spec.ts`. They were collapsed onto this
+ * constant on 2026-09-21. A policy that is typed twice can be loosened in one place and stay
+ * green in the other, which is a wall that no longer refuses what its own test says it does.
+ * It is also what
  * `beaconNeverReachesTheWall.spec.ts` measures the beacon against: the wall refuses
  * `static.cloudflareinsights.com`, so the analytics tag and this response are mutually
  * exclusive BY CONSTRUCTION rather than by anyone remembering. The owner's reason, 2026-09-18:

package/dist/server/master-lock/guard.js

@@ -20,9 +20,14 @@ const noStore = { "cache-control": "no-store, no-cache, must-revalidate", pragma
  * loosening it: nothing loads from anywhere but this origin, the form posts nowhere (the
  * script does the POST), and the page cannot be framed.
  *
- * 🔴 **EXPORTED so that nothing has to copy it.** `apps/collections` had a hand-typed
- * duplicate of this string in a test until 2026-09-18, which is a policy that can drift
- * without anything going red. It is also what
+ * 🔴 **EXPORTED so that nothing has to copy it** — and exporting it is not the same as nothing
+ * copying it. This sentence used to read *"`apps/collections` had a hand-typed duplicate … until
+ * 2026-09-18"*, and it was false the day it was written: the export landed, and BOTH re-typed
+ * copies stayed — one in `apps/collections/scripts/injectedScripts.test.ts` and one three
+ * directories from here in `../analytics/injectedScripts.spec.ts`. They were collapsed onto this
+ * constant on 2026-09-21. A policy that is typed twice can be loosened in one place and stay
+ * green in the other, which is a wall that no longer refuses what its own test says it does.
+ * It is also what
  * `beaconNeverReachesTheWall.spec.ts` measures the beacon against: the wall refuses
  * `static.cloudflareinsights.com`, so the analytics tag and this response are mutually
  * exclusive BY CONSTRUCTION rather than by anyone remembering. The owner's reason, 2026-09-18:

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-server",
-	"version": "4.9.0",
+	"version": "4.11.1",
 	"license": "ISC",
 	"type": "module",
 	"description": "The app-facing Bun/Hono server tier of the cursedbelt split \u2014 storage, sharing, activity, guard, sync. React-free; cursedbelt-core below it.",