cursedbelt-server 4.9.0 → 4.11.1

package/src/server/d1/invocation.ts

@@ -39,6 +39,14 @@
  * It wraps either driver, because it sits ABOVE the seam and only counts. That is what
  * makes the local gate able to prove a production-only limit: wrap a local database in a
  * test, run the loop, and the laptop fails exactly where the Worker would.
+ *
+ * ## The other thing that is true for the span of one request: {@link createPendingWrites}
+ *
+ * A Worker port's synchronous stores answer from a snapshot and queue their durable writes
+ * as promises, which the entry point awaits BEFORE the response leaves. That collector has
+ * the same lifetime as the budget above — one per invocation, constructed by the caller in
+ * the same breath — so it lives in the same file. See its own header for why it was moved
+ * here on 2026-09-19.
  */
 
 import { LIMITS } from './limits';
@@ -205,3 +213,81 @@ export function perInvocation(db: D1LikeDatabase, opts: { max?: number } = {}):
 		},
 	};
 }
+
+/**
+ * Where a durable write goes on its way out of one invocation.
+ *
+ * Deliberately two members, and the narrower `add`-only half is what a STORE takes. A store
+ * that also held `settle` could end the request's writes from inside the request, which is
+ * the entry point's job and nobody else's. `cursedauth/d1-stores` declares exactly this
+ * two-method shape under its own name (`WriteCollector`) because that package sits UNDER
+ * this one and may not import it — structural typing means an object made here satisfies it
+ * verbatim, with no dependency edge in either direction.
+ */
+export interface WriteCollector {
+	add(promise: Promise<unknown>): void;
+}
+
+/** A write that must land before the response is returned. See {@link createPendingWrites}. */
+export interface PendingWrites extends WriteCollector {
+	/** Await every collected write. Called BEFORE the response is returned, never after. */
+	settle(): Promise<void>;
+}
+
+/**
+ * Collect the durable writes of ONE invocation, to be awaited before the response leaves.
+ *
+ * ## Why this is the Worker-write primitive and not a convenience
+ *
+ * A ported app's synchronous stores cannot await — their signatures are somebody else's
+ * published contract — so the shape every port lands on is: one read fills a snapshot, every
+ * sync call answers from it, and every mutation both updates the snapshot and pushes its
+ * statement's promise in here. The entry point then does the awaiting:
+ *
+ * ```ts
+ * export default {
+ *   async fetch(req: Request, env: Env) {
+ *     const db     = perInvocation(createRemoteD1(env.DB));
+ *     const writes = createPendingWrites();
+ *     const res    = await app.fetch(req, { db, writes });
+ *     await writes.settle();          // 🔴 BEFORE the response, never after
+ *     return res;
+ *   },
+ * };
+ * ```
+ *
+ * 🔴 **`settle()` before the response, never `ctx.waitUntil`.** A Worker isolate is per-colo
+ * and short-lived; a write acknowledged by a 200 and then dropped means "sign out" reported
+ * success and left the credential live — a failure invisible to any single-process test and
+ * indistinguishable, to the person, from the feature being broken.
+ *
+ * 🔴 **`Promise.all`, not `allSettled`.** A failed durable write must not be reported as a
+ * success. It surfaces as a 500 from the entry point, which is the honest answer to "did my
+ * sign-out take". `allSettled` here would convert every lost write into a silent 200 — the
+ * same outcome as not collecting them at all, reached by a road that looks careful.
+ *
+ * ## Why it lives here
+ *
+ * It was written three times before it was published once — `apps/patterns/worker/stores.ts`,
+ * `apps/collections/worker/stores.ts` and `libs/cursedauth/src/d1Stores.ts`, byte-identical
+ * but for a comment, with six more ports queued behind them. It is a D1-INVOCATION primitive
+ * rather than an auth one, so it belongs beside {@link perInvocation}: both are constructed
+ * per request, both describe what is true for the span of one, and neither knows anything
+ * about who is signed in.
+ *
+ * Ordering is NOT what this gives you. Everything added is already in flight, so two writes
+ * that must land in order go in one `batch()`, never in two `add`s — a DELETE that must
+ * precede its INSERT will otherwise race and trip a unique index.
+ */
+export function createPendingWrites(): PendingWrites {
+	const pending: Promise<unknown>[] = [];
+	return {
+		add: (promise) => void pending.push(promise),
+		async settle() {
+			// `all`, not `allSettled`: a failed durable write must not be reported as a
+			// success. It surfaces as a 500 from the entry point, which is the honest answer
+			// to "did my sign-out take".
+			await Promise.all(pending);
+		},
+	};
+}

package/src/server/incidents/incidents.spec.ts

@@ -30,7 +30,11 @@ const stuckIngest = (failed = 42): IncidentReport => ({
 	title: "collections: every queued upload is failing",
 	whatBroke: "The scheduled ingest ran and every one of its items failed.",
 	whatItBlocks: "Nothing new reaches the collections app, and the queue keeps growing.",
-	whatToDo: "cd ~/code/local/binary-server && bun run storage-drift",
+	// 🔴 Not a `cd ~/…`. This is a PUBLISHED library: a fixture here is read by whoever
+	// installs it, and the string that stood until 2026-09-22 named a directory on one
+	// machine that had not existed for days. `check-paths`'s `deadCd` rule is what found
+	// it, and a fixture is the one kind of violation that can simply be reworded.
+	whatToDo: "Run the storage-drift sweep for this tenant and clear the failed uploads.",
 	facts: { failed, pending: failed },
 });
 

package/src/server/master-lock/guard.ts

@@ -80,9 +80,14 @@ const noStore = { "cache-control": "no-store, no-cache, must-revalidate", pragma
  * loosening it: nothing loads from anywhere but this origin, the form posts nowhere (the
  * script does the POST), and the page cannot be framed.
  *
- * 🔴 **EXPORTED so that nothing has to copy it.** `apps/collections` had a hand-typed
- * duplicate of this string in a test until 2026-09-18, which is a policy that can drift
- * without anything going red. It is also what
+ * 🔴 **EXPORTED so that nothing has to copy it** — and exporting it is not the same as nothing
+ * copying it. This sentence used to read *"`apps/collections` had a hand-typed duplicate … until
+ * 2026-09-18"*, and it was false the day it was written: the export landed, and BOTH re-typed
+ * copies stayed — one in `apps/collections/scripts/injectedScripts.test.ts` and one three
+ * directories from here in `../analytics/injectedScripts.spec.ts`. They were collapsed onto this
+ * constant on 2026-09-21. A policy that is typed twice can be loosened in one place and stay
+ * green in the other, which is a wall that no longer refuses what its own test says it does.
+ * It is also what
  * `beaconNeverReachesTheWall.spec.ts` measures the beacon against: the wall refuses
  * `static.cloudflareinsights.com`, so the analytics tag and this response are mutually
  * exclusive BY CONSTRUCTION rather than by anyone remembering. The owner's reason, 2026-09-18: