cursedops 0.10.11 → 0.10.12

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedops",
-	"version": "0.10.11",
+	"version": "0.10.12",
 	"description": "The build-and-ops answers this generation's apps wrote independently and identically: finding a generation's roots — and printing a command that runs when pasted — without knowing a path, the generation's whole-tree laws run over one repo from a checkout or a worktree, macOS launchd agent install/replace/remove and the live port a job serves, the scaffolding and verdicts of a deployed smoke (origin probe, the smoke's own environment, a network that lies about DNS, a settled version), the static-serving helpers eight apps copied — the path-traversal guard among them — the API floor that keeps an unmatched /api/... from ever being answered with the app shell, the commit and dirty flag a checkout-served process reports, the Cloudflare Worker deploy toolkit four apps copied (the deploy sequence, exact-set secrets over a pipe, origin-first rollback, the curl edge fetch, the row-for-row D1 import proof, the billed-CPU tail check around a deploy's walk and smoke, and each app's worker:secrets and worker:smoke main as one function of its data), the relay a Worker fronts a Mac-bound app with (the Durable Object, the frames, the Mac's dialer and key rotation — lifted from station for roms — and the signed-in stage walk's skeleton and the relay app's whole worker:deploy), the Worker import-graph and await-port checks every Worker app's suite runs over its own source, and the public-surface ratchet three published libraries each carried a forked copy of. Mechanism only — no app knows its name from here. Bun, zero runtime dependencies (typescript is an optional peer, for public-surface only), ships source.",
 	"type": "module",
 	"scripts": {

package/src/workerDeploy.ts

@@ -193,6 +193,61 @@ export function underCpuTail(wrapper: readonly string[], env: WorkerEnv, command
 	return [...wrapper, "--env", env, "--", ...command];
 }
 
+/** A zone name off a route: its `zone_name`, or the last two labels of a custom domain's host. */
+const routeZones = (routes: unknown): { zones: Set<string>; hosts: Set<string> } => {
+	const zones = new Set<string>();
+	const hosts = new Set<string>();
+	for (const route of Array.isArray(routes) ? routes : []) {
+		const r = (typeof route === "string" ? { pattern: route } : route) as { pattern?: string; zone_name?: string };
+		const host = (r.pattern ?? "").replace(/^https?:\/\//, "").split("/")[0]?.replace(/^\*\.?/, "") ?? "";
+		if (host) hosts.add(host);
+		const zone = r.zone_name ?? host.split(".").slice(-2).join(".");
+		if (zone) zones.add(zone);
+	}
+	return { zones, hosts };
+};
+
+/**
+ * 🔴 Why a Worker must not `fetch` another hostname on its own zone — refused at deploy, for every
+ * Worker app and every relay, because this is the one seam all of them pass through.
+ *
+ * A subrequest from a Worker to a hostname on the SAME zone skips every other Worker's route and
+ * goes straight to the zone's ORIGIN. On `cursedalchemy.com` the origin of `auth.` and
+ * `binary-server.` is a tunnel into the owner's Mac, so the call works while the Mac is on and
+ * dies the moment it is off, with nothing in any suite able to tell. Met twice: auth's JWKS
+ * refresh (task 2150, fixed with an `AUTH` binding), then every server-side byte read — the owner
+ * turned the Mac off on 2026-09-25 and family's tree lost every face, although its bytes rest in
+ * R2. The cure is a service binding, which reaches the Worker itself.
+ *
+ * The rule, over the config wrangler deploys for `env` (a named env inherits none of `vars`,
+ * `routes` or `services`): every `vars` entry named `*_URL` whose https host is a DIFFERENT host on
+ * a zone this Worker is routed on needs a `services` binding named the var's stem or its last
+ * words — `BINARY_SERVER_URL` → `BINARY_SERVER`, `FAMILY_AUTH_URL` → `AUTH`. The Worker's own
+ * hostname is exempt; so is a Worker with no route on the zone (a `workers.dev`-only preview's
+ * subrequests DO run the target's route). Returns the refusal, or `null`.
+ */
+export function sameZoneFetchRefusal(config: Record<string, unknown>, env: WorkerEnv): string | null {
+	const scope = (env === "stage" ? ((config.env as Record<string, Record<string, unknown>> | undefined)?.stage ?? {}) : config) as Record<string, unknown>;
+	const { zones, hosts } = routeZones(scope.routes);
+	if (zones.size === 0) return null;
+	const bindings = (Array.isArray(scope.services) ? scope.services : []).map((s) => String((s as { binding?: string }).binding ?? ""));
+	const missing: string[] = [];
+	for (const [name, value] of Object.entries((scope.vars as Record<string, unknown> | undefined) ?? {})) {
+		if (!name.endsWith("_URL") || typeof value !== "string") continue;
+		const host = /^https:\/\/([^/:]+)/.exec(value)?.[1];
+		if (!host || hosts.has(host)) continue;
+		if (![...zones].some((zone) => host === zone || host.endsWith(`.${zone}`))) continue;
+		const stem = name.slice(0, -"_URL".length);
+		if (bindings.some((b) => b && (stem === b || stem.endsWith(`_${b}`)))) continue;
+		missing.push(`${name} (${host}) → a \`services\` binding named ${stem}`);
+	}
+	if (missing.length === 0) return null;
+	return (
+		`${env} would fetch another hostname on its own zone without a service binding, and a same-zone subrequest skips that hostname's Worker and lands on the zone's origin — the Mac's tunnel, so it fails whenever the Mac is off: ${missing.join("; ")}. ` +
+		"Add the binding to wrangler.jsonc (for THIS env — named envs inherit none) and send the calls through it (`cursedbelt-server/binary-store`'s `fetch` option, or `env.<BINDING>.fetch`)."
+	);
+}
+
 /** A refusal an app adds to the sequence: a sentence saying why not, or `null` to proceed. */
 export type Refusal = () => string | null;
 
@@ -408,6 +463,16 @@ export function runWorkerDeploy(spec: WorkerDeploySpec, deps: DeployDeps): Deplo
 		const why = refusal();
 		if (why) return stop("refusal", why);
 	}
+	// Built in, never an app's to remember: see `sameZoneFetchRefusal`. A deploy with no readable
+	// config would fail at wrangler anyway, so an unreadable file is not a pass we invent here.
+	let wrangler: Record<string, unknown> | null = null;
+	try {
+		wrangler = readWranglerJsonc((deps.read ?? ((path: string) => readFileSync(path, "utf8")))("wrangler.jsonc"));
+	} catch {}
+	for (const env of spec.env === "production" ? (["stage", "production"] as const) : (["stage"] as const)) {
+		const why = wrangler ? sameZoneFetchRefusal(wrangler, env) : null;
+		if (why) return stop("same-zone", `${why} Nothing was deployed.`);
+	}
 	if (spec.env === "production") {
 		for (const command of spec.stageFirst ?? []) {
 			step(`the stage first — production waits on it: ${command.join(" ")}`);