cursedops 0.10.7 → 0.10.8

package/README.md

@@ -28,6 +28,7 @@ bun add cursedops
 | `cursedops/relay` | the WORKER half of a relay — a Worker in front of a Mac-bound app over ONE outbound WebSocket: the frames (station's wire, byte for byte), the key-digest door (`acceptLink`), and `RelayLink`, the Durable Object an app subclasses with its name, body ceiling, timeout and (optionally) station's per-cookie offline cache. No `node:` import (0.10.0, lifted from station for roms, task 065) |
 | `cursedops/relay-link` | the MAC half — `dialLink` (answer each frame with the app's own `fetch`, redial 1 s → 60 s on close, no timer otherwise), `readLinkSettings` for `<APP>_LINK_URL`/`<APP>_LINK_KEY`, and `rotateLinkKey` (digest to the Worker FIRST, the key to the 0600 file only if it took) (0.10.0) |
 | `cursedops/relay-stage` | the signed-in STAGE WALK's skeleton both relay apps shared — `stageByteCheck` (SHA-256 of every built file, a stale byte re-asked 4 × 10 s), `putStageLinkDigest` (`--env stage` only), `grantStageOwner` (auth-stage's 2FA grant, never production's), `oldKeyRefused` (the rotation leg: 20 s refused window, 3 min ceiling), `awaitSystemResolver`, `servedPath`, `STAGE_AUTH_URL`. With `relayWorkerDeployCli` in `cursedops/worker-deploy`, a relay app's whole `worker:deploy` as data (0.10.6) |
+| `cursedops/public-client` | does a relay app's PUBLIC hostname serve the client this release built? `comparePublicClient` (built assets the shells name, never bodies), `stagedShell`, `publicShell` (cache-busted, Access headers as an option), `recordPublicClient` — the smoke's `public-client` row, an EDGE fault (exit 2, never a rollback) — and `shipClientIfBehind`, the deploy step that runs `worker:deploy` when the public shell is behind. Lifted from roms for station (0.10.8) |
 | `cursedops/public-surface` | the ratchet on a LIBRARY's public surface — a symbol count per export subpath against a committed baseline that may only fall — and its `public-surface` bin. Not an app's: the one entry here admitted for three published libraries, see below |
 
 Bun, zero runtime dependencies, ships TypeScript source. Nothing here knows an app's

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedops",
-	"version": "0.10.7",
+	"version": "0.10.8",
 	"description": "The build-and-ops answers this generation's apps wrote independently and identically: finding a generation's roots — and printing a command that runs when pasted — without knowing a path, the generation's whole-tree laws run over one repo from a checkout or a worktree, macOS launchd agent install/replace/remove and the live port a job serves, the scaffolding and verdicts of a deployed smoke (origin probe, the smoke's own environment, a network that lies about DNS, a settled version), the static-serving helpers eight apps copied — the path-traversal guard among them — the API floor that keeps an unmatched /api/... from ever being answered with the app shell, the commit and dirty flag a checkout-served process reports, the Cloudflare Worker deploy toolkit four apps copied (the deploy sequence, exact-set secrets over a pipe, origin-first rollback, the curl edge fetch, the row-for-row D1 import proof, the billed-CPU tail check around a deploy's walk and smoke, and each app's worker:secrets and worker:smoke main as one function of its data), the relay a Worker fronts a Mac-bound app with (the Durable Object, the frames, the Mac's dialer and key rotation — lifted from station for roms — and the signed-in stage walk's skeleton and the relay app's whole worker:deploy), the Worker import-graph and await-port checks every Worker app's suite runs over its own source, and the public-surface ratchet three published libraries each carried a forked copy of. Mechanism only — no app knows its name from here. Bun, zero runtime dependencies (typescript is an optional peer, for public-surface only), ships source.",
 	"type": "module",
 	"scripts": {
@@ -139,6 +139,12 @@
 			"bun": "./src/relayStage.ts",
 			"source": "./src/relayStage.ts",
 			"import": "./src/relayStage.ts"
+		},
+		"./public-client": {
+			"types": "./src/publicClient.ts",
+			"bun": "./src/publicClient.ts",
+			"source": "./src/publicClient.ts",
+			"import": "./src/publicClient.ts"
 		}
 	},
 	"bin": {

package/src/publicClient.ts

@@ -0,0 +1,175 @@
+/**
+ * `cursedops/public-client` — does the PUBLIC hostname of a relay app hand people the client this
+ * release built? Lifted from roms for station (0.10.8); both are relay apps.
+ *
+ * ## Why this is its own question (2026-09-24, measured on roms)
+ *
+ * A relay app's shell — `/`, `/assets/*` — is the relay WORKER's static assets, uploaded only by
+ * `worker:deploy`. The Mac end still stages a client and reports it on `/healthz`, so a smoke's
+ * `client-commit` row went green for roms `7e13f8b5` (the 30 Hz fix) while the public `/` kept
+ * naming `/assets/index-BgukLK5o.js` — the build before it — even cache-busted. Nothing that asks
+ * the ORIGIN can see that; only the public shell can. station had the same gap, hidden only
+ * because `worker:deploy` was run by hand first.
+ *
+ * The comparison is by the built assets the shell NAMES (`cursedops/smoke` `builtAssetsIn`), never
+ * by body: the zone injects a beacon at the edge that loopback never carries.
+ *
+ * ```ts
+ * import { recordPublicClient, shipClientIfBehind, stagedShell } from "cursedops/public-client";
+ * // deploy.ts, between the origin probe and the public smoke:
+ * const shipped = await shipClientIfBehind({ base, staged: stagedShell(dataDir), root, headers });
+ * // smoke-deployed.ts — a mismatch is an EDGE fault (exit 2), never a rollback:
+ * await guarded(smoke, PUBLIC_CLIENT_CHECK, () => recordPublicClient(smoke, staged, { root, headers }));
+ * ```
+ *
+ * `headers` is how an app behind Cloudflare Access (station) passes the fleet's service token; an
+ * anonymous `/` there is a 302 to the Access issuer, which names no built asset and never matches.
+ */
+import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { builtAssetsIn, type Smoke } from "cursedops/smoke";
+import { stagedClientDir } from "cursedops/staged-client";
+
+/** The smoke row's name — one spelling for every relay app. */
+export const PUBLIC_CLIENT_CHECK = "public-client";
+
+export interface PublicClientVerdict {
+	matched: boolean;
+	/** The built files the public shell names. */
+	served: string[];
+	/** The built files this release's staged shell names. */
+	built: string[];
+}
+
+/** Pure: the two shells' built assets, compared. An empty list on either side never matches. */
+export function comparePublicClient(publicHtml: string, stagedHtml: string, base: string): PublicClientVerdict {
+	const served = builtAssetsIn(publicHtml, base);
+	const built = builtAssetsIn(stagedHtml, base);
+	return { matched: built.length > 0 && served.join(",") === built.join(","), served, built };
+}
+
+/** The staged client's `index.html` under an app's data dir — the shell this release built — or `null` when nothing is staged. */
+export function stagedShell(dataDir: string): string | null {
+	const dir = stagedClientDir(dataDir);
+	if (!dir) return null;
+	try {
+		return readFileSync(join(dir, "index.html"), "utf8");
+	} catch {
+		return null;
+	}
+}
+
+export interface PublicShellOptions {
+	/** Sent with the request — Cloudflare Access service-token headers for an app behind Access. */
+	headers?: Record<string, string>;
+	timeoutMs?: number;
+	/** Injected for tests. */
+	fetch?: (url: string, init: RequestInit) => Promise<Response>;
+}
+
+/** Fetch the public `/`, cache-busted — the question is what the hostname HAS, not what a repeat visitor gets. */
+export async function publicShell(base: string, options: PublicShellOptions = {}): Promise<{ status: number; html: string }> {
+	const url = new URL("/", base);
+	url.searchParams.set("cb", Math.random().toString(36).slice(2));
+	const ask = options.fetch ?? ((u: string, init: RequestInit) => fetch(u, init));
+	const response = await ask(url.toString(), {
+		redirect: "manual",
+		signal: AbortSignal.timeout(options.timeoutMs ?? 20_000),
+		headers: { accept: "text/html", ...(options.headers ?? {}) },
+	});
+	return { status: response.status, html: await response.text().catch(() => "") };
+}
+
+/** The sentence both the smoke and the deploy print when the halves disagree. `root` is the app's checkout. */
+export function workerBehind(verdict: PublicClientVerdict, base: string, root: string): string {
+	return (
+		`🔴 ${base} serves a client naming ${verdict.served.join(", ") || "(no built assets)"}, but this release built ` +
+		`${verdict.built.join(", ") || "(nothing staged)"}. The public shell is the relay Worker's static assets, which only ` +
+		`\`worker:deploy\` uploads — people are still on the previous client. \`cd ${root} && bun run worker:deploy\``
+	);
+}
+
+export interface RecordPublicClientOptions extends PublicShellOptions {
+	/** The app's checkout, for the pasteable `worker:deploy` command. */
+	root: string;
+}
+
+/**
+ * The smoke's `public-client` row. A mismatch — or nothing staged to compare with — is recorded as
+ * a failure AND marked an edge fault, so the run settles to exit 2: the Mac end this deploy put up
+ * is correct, and reverting it cannot upload a Worker. Returns whether it matched.
+ */
+export async function recordPublicClient(smoke: Smoke, staged: string | null, options: RecordPublicClientOptions): Promise<boolean> {
+	if (staged === null) {
+		smoke.record(
+			PUBLIC_CLIENT_CHECK,
+			false,
+			"🔴 no staged client to compare with — `bun run deploy` stages one; nothing says which client people should have",
+		);
+		smoke.markEdgeFault();
+		return false;
+	}
+	const { html } = await publicShell(smoke.base, options);
+	const verdict = comparePublicClient(html, staged, smoke.base);
+	smoke.record(
+		PUBLIC_CLIENT_CHECK,
+		verdict.matched,
+		verdict.matched
+			? `the public shell names this release's build — ${verdict.built.join(", ")}`
+			: workerBehind(verdict, smoke.base, options.root),
+	);
+	if (!verdict.matched) smoke.markEdgeFault();
+	return verdict.matched;
+}
+
+export interface ShipClientOptions extends PublicShellOptions {
+	/** The public origin, e.g. `https://roms.cursedalchemy.com`. */
+	base: string;
+	/** The staged shell ({@link stagedShell}); `null` means nothing staged — the Worker is shipped anyway. */
+	staged: string | null;
+	/** The app's checkout — where `bun run worker:deploy` runs. */
+	root: string;
+	/** Runs `bun run worker:deploy` in `root`; returns its exit status. Injected for tests. */
+	runWorkerDeploy?: (root: string) => number | null;
+	log?: (line: string) => void;
+}
+
+export interface ShipClientResult {
+	/** `already` — the public shell named this build; `shipped` — worker:deploy ran and exited 0; `failed` — it did not. */
+	outcome: "already" | "shipped" | "failed";
+	/** worker:deploy's exit status when it ran. */
+	status?: number | null;
+	before: PublicClientVerdict | null;
+}
+
+const spawnWorkerDeploy = (root: string): number | null =>
+	spawnSync("bun", ["run", "worker:deploy"], { cwd: root, stdio: ["ignore", "inherit", "inherit"] }).status;
+
+/**
+ * The deploy step: when the public shell does not name this build, run `worker:deploy` (its own
+ * stage walk first) so ONE command ships the release. Never throws for a fetch that fails — an
+ * unreadable public shell is "behind", because shipping the Worker is idempotent and the smoke's
+ * `public-client` row is what proves it took.
+ */
+export async function shipClientIfBehind(options: ShipClientOptions): Promise<ShipClientResult> {
+	const log = options.log ?? console.log;
+	let before: PublicClientVerdict | null = null;
+	if (options.staged !== null) {
+		const html = await publicShell(options.base, options).then(
+			(shell) => shell.html,
+			() => "",
+		);
+		before = comparePublicClient(html, options.staged, options.base);
+		if (before.matched) {
+			log(`  already serving it — ${before.built.join(", ")}`);
+			return { outcome: "already", before };
+		}
+		log(`  ${workerBehind(before, options.base, options.root)}`);
+	} else {
+		log("  nothing staged to compare with — shipping the Worker's client anyway");
+	}
+	log("  running `bun run worker:deploy` — the stage walk, then production");
+	const status = (options.runWorkerDeploy ?? spawnWorkerDeploy)(options.root);
+	return { outcome: status === 0 ? "shipped" : "failed", status, before };
+}