cursedops 0.10.21 → 0.10.22

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedops",
-	"version": "0.10.21",
+	"version": "0.10.22",
 	"description": "The build-and-ops answers this generation's apps wrote independently and identically: finding a generation's roots — and printing a command that runs when pasted — without knowing a path, the generation's whole-tree laws run over one repo from a checkout or a worktree, macOS launchd agent install/replace/remove and the live port a job serves, the scaffolding and verdicts of a deployed smoke (origin probe, the smoke's own environment, a network that lies about DNS, a settled version), the static-serving helpers eight apps copied — the path-traversal guard among them — the API floor that keeps an unmatched /api/... from ever being answered with the app shell, the commit and dirty flag a checkout-served process reports, the Cloudflare Worker deploy toolkit four apps copied (the deploy sequence, exact-set secrets over a pipe, origin-first rollback, the curl edge fetch, the row-for-row D1 import proof, the billed-CPU tail check around a deploy's walk and smoke, and each app's worker:secrets and worker:smoke main as one function of its data), the relay a Worker fronts a Mac-bound app with (the Durable Object, the frames, the Mac's dialer and key rotation — lifted from station for roms — and the signed-in stage walk's skeleton and the relay app's whole worker:deploy), the Worker import-graph and await-port checks every Worker app's suite runs over its own source, and the public-surface ratchet three published libraries each carried a forked copy of. Mechanism only — no app knows its name from here. Bun, zero runtime dependencies (typescript is an optional peer, for public-surface only), ships source.",
 	"type": "module",
 	"scripts": {

package/src/workerDeploy.ts

@@ -33,7 +33,9 @@
  *   1. **a readable HEAD** — nothing to stamp is nothing that could prove the deploy;
  *   2. **a clean tree for production** — a dirty one would report one commit and run another;
  *   3. **the app's own refusals** (data) — e.g. its Mac host still loaded while the config routes
- *      the hostname to the Worker: two writers, two databases;
+ *      the hostname to the Worker: two writers, two databases; then **`node_modules` made to
+ *      match `bun.lock`** ({@link INSTALL}) — a bundle built from stale modules runs code the
+ *      stamped commit does not name;
  *   4. **the STAGE first, for production** — `collections` went live 2026-09-22 with every anonymous
  *      check green and its owner unable to sign in; the stage walk is what found why, and a step
  *      in the sequence is one a person in a hurry cannot skip;
@@ -490,6 +492,9 @@ export function judgeSchemaApply(code: number, stdout: string): { applied: boole
  * Run the sequence in the header's order, stopping at the first red with a sentence. Never
  * exits — the caller does, with {@link DeployResult.code}.
  */
+/** What {@link runWorkerDeploy} runs first: `node_modules` exactly as `bun.lock` says. */
+export const INSTALL: readonly string[] = ["bun", "install", "--frozen-lockfile"];
+
 export function runWorkerDeploy(spec: WorkerDeploySpec, deps: DeployDeps): DeployResult {
 	const log = deps.log ?? ((line: string) => console.log(line));
 	const error = deps.error ?? ((line: string) => console.error(line));
@@ -523,6 +528,19 @@ export function runWorkerDeploy(spec: WorkerDeploySpec, deps: DeployDeps): Deplo
 		const why = wrangler ? sameZoneFetchRefusal(wrangler, env) : null;
 		if (why) return stop("same-zone", `${why} Nothing was deployed.`);
 	}
+	/*
+	 * 🔴 Built in, never an app's to remember: `node_modules` is made to match `bun.lock` before
+	 * anything builds or bundles (wrangler bundles `worker/` from it too, so `--no-build` needs it
+	 * as much as a build does). A fast-forward that moves `bun.lock` does not touch
+	 * `node_modules`, and on 2026-09-28 vault's deploy of a commit locking cursedbelt 5.15.2 built
+	 * and shipped 5.14.0 from disk — the `/healthz` commit said one thing and the bundle ran
+	 * another, the exact lie the clean-tree refusal exists to prevent. `--frozen-lockfile` is a
+	 * no-op when they already agree, and refuses, rather than rewriting the lock, when they cannot.
+	 */
+	step("make node_modules match bun.lock");
+	if (deps.run(INSTALL, {}) !== 0) {
+		return stop("install", `\`${INSTALL.join(" ")}\` failed — node_modules cannot be made to match bun.lock, so nothing was built or deployed.`);
+	}
 	if (spec.env === "production") {
 		for (const command of spec.stageFirst ?? []) {
 			step(`the stage first — production waits on it: ${command.join(" ")}`);