cursedops 0.10.12 → 0.10.13

package/README.md

@@ -419,8 +419,8 @@ most fragile part (a hand-rolled HTTP parser) in two places.
 |---|---|
 | the deploy SEQUENCE (HEAD, clean tree, app refusals, stage first, build, schema, `--var` stamp, secrets, smoke) | **moved** — `runWorkerDeploy(spec, deps)`; the commands are data |
 | `parseWorkerEnv`, `wranglerEnvArgs`, `readWranglerJsonc`, `readEnvFile`, `cloudflareCredential` | **moved** — identical or converged in all four |
-| exact-set secrets over a pipe, read back | **moved** — `planSecrets` + `syncSecrets` + `wranglerSecretPut`; `envFileLines` carries `collections`' pre-quoted-seed fix |
-| origin-first rollback, route found by pattern | **moved** — `rollbackToOrigin`, `findWorkerRoute`, `deleteWorkerRoute` |
+| exact-set secrets over a pipe, read back | **moved** — `planSecrets` + `syncSecrets` + `wranglerSecretPut`; `envFileLines` carries `collections`' pre-quoted-seed fix; `--mint` carries the keys `mintCarries` names (0.10.13; default `FILE_TOKEN_PRIVATE_KEY`, flix's is `PLEX_ACCOUNT_TOKEN`) |
+| origin-first rollback, route found by pattern | **moved** — `rollbackToOrigin`, `findWorkerRoute`, `deleteWorkerRoute`; the whole `worker:rollback` main is `runWorkerRollback(spec, argv)` (0.10.13 — flix and music were one copied file) |
 | `edgeFetch` (curl `--resolve` past the negative DNS cache) | **moved** — `createEdgeFetch`; the Access header now THROWS on an incomplete token instead of sending empty headers |
 | the import's literal and row-for-row proof | **moved** — `sqlLiteral`, `rowDigest`, `sameRows`, `rowDifferences`, `wranglerRows` |
 | the steady `/healthz` wait | **moved**, into `cursedops/smoke` as `steadyHealth` |

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedops",
-	"version": "0.10.12",
+	"version": "0.10.13",
 	"description": "The build-and-ops answers this generation's apps wrote independently and identically: finding a generation's roots — and printing a command that runs when pasted — without knowing a path, the generation's whole-tree laws run over one repo from a checkout or a worktree, macOS launchd agent install/replace/remove and the live port a job serves, the scaffolding and verdicts of a deployed smoke (origin probe, the smoke's own environment, a network that lies about DNS, a settled version), the static-serving helpers eight apps copied — the path-traversal guard among them — the API floor that keeps an unmatched /api/... from ever being answered with the app shell, the commit and dirty flag a checkout-served process reports, the Cloudflare Worker deploy toolkit four apps copied (the deploy sequence, exact-set secrets over a pipe, origin-first rollback, the curl edge fetch, the row-for-row D1 import proof, the billed-CPU tail check around a deploy's walk and smoke, and each app's worker:secrets and worker:smoke main as one function of its data), the relay a Worker fronts a Mac-bound app with (the Durable Object, the frames, the Mac's dialer and key rotation — lifted from station for roms — and the signed-in stage walk's skeleton and the relay app's whole worker:deploy), the Worker import-graph and await-port checks every Worker app's suite runs over its own source, and the public-surface ratchet three published libraries each carried a forked copy of. Mechanism only — no app knows its name from here. Bun, zero runtime dependencies (typescript is an optional peer, for public-surface only), ships source.",
 	"type": "module",
 	"scripts": {

package/src/smoke.ts

@@ -902,12 +902,30 @@ export interface CensusRoute {
 
 /** What {@link runWorkerSmoke} needs to know about one deployment — data, and one hook. */
 export interface WorkerSmokeSpec {
+	/**
+	 * Which door the Worker keeps. `"sso"` (the default): an anonymous caller gets **401** from
+	 * every census route, and `/healthz` says `apiServed` and names `publicUrl`. `"access"`
+	 * (desk, 2026-09-25): Cloudflare Access is the door and the Worker re-checks Access's
+	 * assertion itself — so on the PREVIEW (no Access in front) every census route and shell path
+	 * is **403** and `/healthz` says `access: true`; on the PUBLIC host a caller without the
+	 * token is turned away, and THROUGH the token every census route answers **200** and every
+	 * shell path is the HTML shell.
+	 */
+	door?: "sso" | "access";
+	/**
+	 * `door: "access"` only — the fetch that carries NO Access token, for the preview and for
+	 * the no-token half of the public door. `fetch` is the one that carries it.
+	 */
+	anonymousFetch?: (url: string, init?: RequestInit) => Promise<Response>;
 	deployment: { env: string; workerName: string; publicUrl: string; previewUrl: string | null };
 	/** Addresses given on the command line. Empty: the preview (no cache in front) and the public URL. */
 	urls?: readonly string[];
 	/** The checkout's HEAD, as `/healthz` reports a commit (`git rev-parse --short=8 HEAD`). */
 	head: string;
-	/** Every private route; each must refuse an anonymous caller with 401. Empty is a FAILURE. */
+	/**
+	 * Every private route; each must refuse an anonymous caller with 401 (`door: "access"`: 403 on
+	 * the preview, 200 through the token on the public host). Empty is a FAILURE.
+	 */
 	census: readonly CensusRoute[];
 	/** Client routes that must get the HTML shell THROUGH the Worker. */
 	shellPaths: readonly string[];
@@ -919,6 +937,8 @@ export interface WorkerSmokeSpec {
 	/** The app's own checks, per address, after the census — `family`'s `/ws/tree`, say. */
 	extraChecks?: (context: {
 		tag: string;
+		/** `door: "access"`: which half this address is — the preview is asked with no token. */
+		address: "preview" | "public";
 		ask: (path: string, init?: RequestInit) => Promise<Response>;
 		health: Record<string, unknown>;
 		record: Smoke["record"];
@@ -962,6 +982,8 @@ export async function runWorkerSmoke(spec: WorkerSmokeSpec): Promise<number> {
 	}
 	if (smoke.refusals.length > 0) return smoke.report();
 
+	if (spec.door === "access") return await accessDoorSmoke(spec, urls, smoke, log);
+
 	for (const base of urls) {
 		const tag = new URL(base).hostname;
 		log(`\n▸ ${base}   (the ${deployment.env} deployment: ${deployment.workerName})`);
@@ -1010,7 +1032,8 @@ export async function runWorkerSmoke(spec: WorkerSmokeSpec): Promise<number> {
 					: `🔴 ${open.join(", ")}`,
 		);
 
-		await spec.extraChecks?.({ tag, ask, health, record: (check, ok, detail) => smoke.record(check, ok, detail) });
+		const address = base === deployment.previewUrl ? "preview" : "public";
+		await spec.extraChecks?.({ tag, address, ask, health, record: (check, ok, detail) => smoke.record(check, ok, detail) });
 
 		for (const path of spec.shellPaths) {
 			const res = await ask(path, { headers: { accept: "text/html" } });
@@ -1026,3 +1049,101 @@ export async function runWorkerSmoke(spec: WorkerSmokeSpec): Promise<number> {
 	}
 	return await smoke.settle();
 }
+
+/**
+ * `runWorkerSmoke` for a Worker behind Cloudflare ACCESS (`door: "access"`). An address is the
+ * PREVIEW when it is `deployment.previewUrl` (no Access in front: the Worker's own check is the
+ * whole door, so everything private must be 403), and otherwise the PUBLIC host (Access turns a
+ * tokenless caller away; with the token the app must work). 🔴 A preview that answers 200 is
+ * the Worker's own Access check switched off — the address no cache can lie on.
+ */
+async function accessDoorSmoke(
+	spec: WorkerSmokeSpec,
+	urls: readonly string[],
+	smoke: Smoke,
+	log: (line: string) => void,
+): Promise<number> {
+	const { deployment } = spec;
+	const anonymous = spec.anonymousFetch;
+	if (!anonymous) {
+		smoke.refuseEnvironment("the anonymous fetch", 'door: "access" needs `anonymousFetch` — a fetch that carries NO Access token');
+		return smoke.report();
+	}
+	for (const base of urls) {
+		const tag = new URL(base).hostname;
+		const address = base === deployment.previewUrl ? "preview" : "public";
+		const fetcher = address === "preview" ? anonymous : spec.fetch;
+		log(
+			address === "preview"
+				? `\n▸ ${base}   (the ${deployment.env} preview — no Access in front; everything private must be refused)`
+				: `\n▸ ${base}   (the ${deployment.env} deployment through Access, with the service token)`,
+		);
+		const ask = (path: string, init: RequestInit = {}) => fetcher(new URL(path, base).toString(), init);
+
+		let health: Record<string, unknown>;
+		let status: number;
+		try {
+			const read = await steadyHealth<Record<string, unknown>>(() => ask("/healthz"), (body) => body.commit === spec.head, spec.steady);
+			health = read.body;
+			status = read.response.status;
+		} catch (error) {
+			smoke.markEdgeFault();
+			smoke.record(`${tag} healthz`, false, `${(error as Error).message}${smoke.dnsHint(error as Error)}`);
+			continue;
+		}
+		smoke.record(`${tag} healthz`, status === 200 && health.runtime === "worker", `${status}, runtime ${JSON.stringify(health.runtime)}`);
+		smoke.record(`${tag} commit`, health.commit === spec.head, `serving ${JSON.stringify(health.commit)}, HEAD ${spec.head}`);
+		smoke.record(
+			`${tag} access`,
+			health.access === true,
+			`the Worker's own Access check is ${health.access === true ? "configured" : "🔴 UNCONFIGURED — it refuses everything"}`,
+		);
+
+		if (spec.census.length === 0) {
+			smoke.record(`${tag} census`, false, "🔴 the route census is EMPTY, so this proves nothing");
+		} else if (address === "preview") {
+			const open: string[] = [];
+			for (const route of spec.census) {
+				const answered = (await ask(route.path, { method: route.method })).status;
+				if (answered !== 403) open.push(`${route.method} ${route.path} → ${answered}`);
+			}
+			for (const path of spec.shellPaths) {
+				const answered = (await ask(path, { headers: { accept: "text/html" } })).status;
+				if (answered !== 403) open.push(`GET ${path} → ${answered}`);
+			}
+			const asked = spec.census.length + spec.shellPaths.length;
+			smoke.record(`${tag} refuses`, open.length === 0, open.length === 0 ? `all ${asked} private paths → 403` : `🔴 ${open.join(", ")}`);
+		} else {
+			const first = spec.census[0] as CensusRoute;
+			const turnedAway = (await anonymous(new URL(first.path, base).toString(), { method: first.method })).status;
+			smoke.record(`${tag} access-door`, turnedAway !== 200, `no token → ${turnedAway} (Access)`);
+			const refused: string[] = [];
+			for (const route of spec.census) {
+				const answered = (await ask(route.path, { method: route.method })).status;
+				if (answered !== 200) refused.push(`${route.method} ${route.path} → ${answered}`);
+			}
+			smoke.record(
+				`${tag} census`,
+				refused.length === 0,
+				refused.length === 0 ? `all ${spec.census.length} routes answer through the token` : `🔴 ${refused.join(", ")}`,
+			);
+		}
+
+		await spec.extraChecks?.({ tag, address, ask, health, record: (check, ok, detail) => smoke.record(check, ok, detail) });
+
+		if (address === "public") {
+			for (const path of spec.shellPaths) {
+				const res = await ask(path, { headers: { accept: "text/html" } });
+				const type = res.headers.get("content-type") ?? "";
+				smoke.record(`${tag} shell ${path}`, res.status === 200 && type.includes("text/html"), `${res.status} ${type}`);
+			}
+			const miss = await ask("/assets/index-no-such-bundle.js");
+			smoke.record(
+				`${tag} missing-bundle`,
+				miss.status === 404 && !(miss.headers.get("content-type") ?? "").includes("text/html"),
+				`a missing bundle is a miss — ${miss.status}`,
+			);
+		}
+	}
+	return await smoke.settle();
+}

package/src/workerRollback.ts

@@ -32,6 +32,9 @@
  * prints the size of that loss before anybody decides.
  */
 
+import { spawnSync } from "node:child_process";
+import { livePort } from "cursedops/launchd";
+
 /** The Cloudflare v4 API's envelope — only what is read here. Structural, so any caller fits. */
 export interface ApiResult {
 	success?: boolean;
@@ -131,3 +134,82 @@ export async function rollbackToOrigin(steps: RollbackSteps): Promise<RollbackRe
 	}
 	return { ok: true, stage: "done", detail: "the origin answers and the route is gone — prove it with a cache-busted /healthz, because a cached 200 is not a working origin." };
 }
+
+/** What {@link runWorkerRollback} needs to know about ONE app's production hostname. */
+export interface WorkerRollbackSpec {
+	/** `flix`, `music` — prefixes a refusal. */
+	app: string;
+	/** The app's checkout — where the origin is started and the comparison runs. */
+	root: string;
+	/** The production deployment's public URL — its hostname is the route that is found. */
+	publicUrl: string;
+	/** The Mac host's launchd label (`com.<app>.host`) and the port its file declares. */
+	label: string;
+	deployPort: number;
+	/** The Cloudflare API, authenticated (`cursedops/worker-secrets`' `cloudflareApi`). */
+	api: CloudflareApi;
+	/** Words appended to step 1 of `--check` — music's "com.music.downloads removed …". */
+	startNote?: string;
+	/** What makes the rollback STICK, printed after it succeeds — each app's own configuration. */
+	stickNotes: readonly string[];
+}
+
+export interface WorkerRollbackDeps {
+	/** Run `bun <args>` in the app's checkout, inheriting stdio. Answers the exit code. */
+	bun?: (args: readonly string[], cwd: string) => number;
+	/** The port the LOADED job declares (`cursedops/launchd`'s `livePort`). */
+	livePort?: (label: string) => number | null;
+	originUp?: (port: number) => Promise<boolean>;
+	sleep?: RollbackSteps["sleep"];
+	log?: (line: string) => void;
+	error?: (line: string) => void;
+}
+
+/**
+ * The whole `worker:rollback` main, lifted out of `apps/music` and `apps/flix` (they were one
+ * 78-line file with the names changed). `--check` says what would happen and changes nothing;
+ * without it: print the route (FOUND on the account), print the D1-vs-Mac row comparison (the
+ * writes a rollback loses — the app's `scripts/worker-import.ts --verify-only`), start the origin, and only check-doc-citations:ignore app-relative, in the consuming app's tree
+ * once it answers delete the route ({@link rollbackToOrigin}). Answers the exit code.
+ */
+export async function runWorkerRollback(spec: WorkerRollbackSpec, argv: readonly string[], deps: WorkerRollbackDeps = {}): Promise<number> {
+	const log = deps.log ?? ((line: string) => console.log(line));
+	const error = deps.error ?? ((line: string) => console.error(line));
+	const bun =
+		deps.bun ??
+		((args: readonly string[], cwd: string) => spawnSync("bun", [...args], { cwd, stdio: "inherit" }).status ?? 1);
+	const port = () => (deps.livePort ?? livePort)(spec.label) ?? spec.deployPort;
+	const host = new URL(spec.publicUrl).hostname;
+
+	const found = await findWorkerRoute(spec.api, host);
+	log(`route   ${found.pattern} → ${found.route ? `${found.script} (${found.route})` : "(none — the hostname already falls through to the Mac)"}`);
+
+	log("\n▸ what D1 holds against the Mac's frozen catalogue (the writes a rollback loses):");
+	bun(["run", "scripts/worker-import.ts", "--verify-only"], spec.root);
+
+	if (argv.includes("--check")) {
+		log("\nwould, in this order:");
+		log(`  1. bun run service install --rollback   (${spec.label} back on :${spec.deployPort}${spec.startNote ? `; ${spec.startNote}` : ""})`);
+		log(`  2. wait for http://127.0.0.1:${spec.deployPort}/healthz to answer`);
+		log(`  3. DELETE the route ${found.pattern} (the hostname falls through to the tunnel and the Mac)`);
+		log("\n(--check — nothing was changed)");
+		return 0;
+	}
+
+	log(`\n▸ starting ${spec.label}, then — only once it answers — deleting the route`);
+	const result = await rollbackToOrigin({
+		startOrigin: () => bun(["run", "scripts/service.ts", "install", "--rollback"], spec.root),
+		// The port the LOADED job declares, never the app's constant — the two have diverged before.
+		originUp: () => (deps.originUp ?? loopbackHealthy)(port()),
+		removeRoute: () => deleteWorkerRoute(spec.api, found),
+		sleep: deps.sleep,
+	});
+	if (!result.ok) {
+		error(`\n🔴 [${spec.app}] ${result.detail}`);
+		return 1;
+	}
+	log(`\n✅ rolled back — ${result.detail}`);
+	log(`   curl -s "${spec.publicUrl}/healthz?cb=$RANDOM"    # must say runtime:"bun"`);
+	for (const line of spec.stickNotes) log(line);
+	return 0;
+}

package/src/workerSecrets.ts

@@ -220,6 +220,12 @@ export interface WorkerSecretsSpec {
 	cutOver: boolean;
 	/** The Mac's `<app>.env` — where a mint reads the app's signing key from. */
 	macSecretsFile: string;
+	/**
+	 * The keys a `--mint` carries over from {@link macSecretsFile}, beside the throwaway
+	 * `SESSION_SECRET`. Default `["FILE_TOKEN_PRIVATE_KEY"]` — every port that signs binary-server
+	 * URLs. flix signs none; what its preview needs is `["PLEX_ACCOUNT_TOKEN"]`.
+	 */
+	mintCarries?: readonly string[];
 	/** What a deployment without a signing key cannot do — "signs no portrait URL". */
 	withoutSigningKey: string;
 	/** The app's own sentence about its signing key, for the minted file's header. */
@@ -251,10 +257,15 @@ export async function runWorkerSecrets(
 			console.error(`${tag} --mint makes a THROWAWAY set. Production after the cutover uploads the Mac's own ${spec.app}.env.`);
 			return 2;
 		}
-		const signing = readEnvFile(read(spec.macSecretsFile) ?? "").FILE_TOKEN_PRIVATE_KEY;
-		if (!signing) {
-			console.error(`${tag} ${spec.app}.env carries no FILE_TOKEN_PRIVATE_KEY — without it this deployment ${spec.withoutSigningKey}.`);
-			return 2;
+		const mac = readEnvFile(read(spec.macSecretsFile) ?? "");
+		const carried: Record<string, string> = {};
+		for (const key of spec.mintCarries ?? ["FILE_TOKEN_PRIVATE_KEY"]) {
+			const value = mac[key];
+			if (!value) {
+				console.error(`${tag} ${spec.app}.env carries no ${key} — without it this deployment ${spec.withoutSigningKey}.`);
+				return 2;
+			}
+			carried[key] = value;
 		}
 		const who = spec.env === "stage" ? "the STAGE" : "the PREVIEW";
 		(deps.write ?? writeSecretsFile)(
@@ -265,7 +276,7 @@ export async function runWorkerSecrets(
 				"throwaway and opens nothing the owner owns.",
 				spec.signingKeyNote,
 			],
-			{ SESSION_SECRET: throwawaySecret(), FILE_TOKEN_PRIVATE_KEY: signing },
+			{ SESSION_SECRET: throwawaySecret(), ...carried },
 		);
 		console.log(`✅ minted ${who}'s secrets into ${spec.secretsFile} (0600)`);
 		return 0;