cursedops 0.10.8 → 0.10.10

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedops",
-	"version": "0.10.8",
+	"version": "0.10.10",
 	"description": "The build-and-ops answers this generation's apps wrote independently and identically: finding a generation's roots — and printing a command that runs when pasted — without knowing a path, the generation's whole-tree laws run over one repo from a checkout or a worktree, macOS launchd agent install/replace/remove and the live port a job serves, the scaffolding and verdicts of a deployed smoke (origin probe, the smoke's own environment, a network that lies about DNS, a settled version), the static-serving helpers eight apps copied — the path-traversal guard among them — the API floor that keeps an unmatched /api/... from ever being answered with the app shell, the commit and dirty flag a checkout-served process reports, the Cloudflare Worker deploy toolkit four apps copied (the deploy sequence, exact-set secrets over a pipe, origin-first rollback, the curl edge fetch, the row-for-row D1 import proof, the billed-CPU tail check around a deploy's walk and smoke, and each app's worker:secrets and worker:smoke main as one function of its data), the relay a Worker fronts a Mac-bound app with (the Durable Object, the frames, the Mac's dialer and key rotation — lifted from station for roms — and the signed-in stage walk's skeleton and the relay app's whole worker:deploy), the Worker import-graph and await-port checks every Worker app's suite runs over its own source, and the public-surface ratchet three published libraries each carried a forked copy of. Mechanism only — no app knows its name from here. Bun, zero runtime dependencies (typescript is an optional peer, for public-surface only), ships source.",
 	"type": "module",
 	"scripts": {

package/src/d1Schema.ts

@@ -13,8 +13,9 @@
  * A Worker has no boot. An app's `migrate()` issues dozens of statements and inspects
  * `PRAGMA table_info` as it goes; running that on every invocation would spend a D1 invocation's
  * query budget before the request started, and D1 has no `PRAGMA table_info` to inspect with. So
- * D1's schema is applied ONCE, by hand — `bunx wrangler d1 execute <name> --remote --file
- * db/schema.sql` — and there are two descriptions of the app's tables. Each app's own
+ * D1's schema is applied ahead of the Worker, by every `worker:deploy` — ordinary `--command`
+ * queries, never D1's blocking `--file` import (`schemaApplyArgv` in `cursedops/worker-deploy`) —
+ * and there are two descriptions of the app's tables. Each app's own
  * schema-matches test fails its gate when they disagree, so the file is a build product with a
  * checker rather than a document with a convention. {@link d1SchemaText} writes it, and refuses a
  * statement that spans lines, because D1's `exec` splits on newlines.

package/src/edgeFetch.ts

@@ -242,3 +242,35 @@ export function fleetEdgeFetch(
 	if (!state) throw new Error(`no generation state root above ${from}: set $FORGE_STATE or run inside a checkout with forge.env`);
 	return createStageEdgeFetch(join(state, "secrets", "cloudflare-access.env"), options);
 }
+
+/** The status {@link settledFetch} answers when the fetch THREW — outside HTTP's range on purpose, so no leg can mistake it for an answer. */
+export const NO_ANSWER_STATUS = 599;
+
+/**
+ * A fetch that never throws: a rejection (curl's timeout, DNS, a reset) becomes a
+ * {@link NO_ANSWER_STATUS} `Response` whose body and `x-edge-error` header carry the reason, and
+ * `onThrow` hears it first so the smoke's ledger can name it.
+ *
+ * 🔴 Why (2026-09-25): roms' `worker:smoke` asked a relayed path while the Mac's link redialled,
+ * `edgeFetch` threw on curl exit 28, and the process died with a stack trace and no ledger — so a
+ * healthy release exited 1. Every leg of a smoke is supposed to be RECORDED: a throw is a failed
+ * leg naming its path, never the end of the run.
+ */
+export function settledFetch(
+	fetcher: (url: string, init?: RequestInit) => Promise<Response>,
+	onThrow: (url: string, error: Error) => void = () => {},
+): (url: string, init?: RequestInit) => Promise<Response> {
+	return async (url, init) => {
+		try {
+			return await fetcher(url, init);
+		} catch (thrown) {
+			const error = thrown instanceof Error ? thrown : new Error(String(thrown));
+			onThrow(url, error);
+			const reason = error.message.replace(/[^\x20-\x7e]+/g, " ").slice(0, 300);
+			return new Response(`no answer: ${reason}`, {
+				status: NO_ANSWER_STATUS,
+				headers: { "content-type": "text/plain", "x-edge-error": reason },
+			});
+		}
+	};
+}

package/src/publicClient.ts

@@ -26,10 +26,11 @@
  * anonymous `/` there is a 302 to the Access issuer, which names no built asset and never matches.
  */
 import { spawnSync } from "node:child_process";
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { dirname, join, relative, resolve } from "node:path";
 import { builtAssetsIn, type Smoke } from "cursedops/smoke";
 import { stagedClientDir } from "cursedops/staged-client";
+import { valueImports } from "cursedops/worker-safety";
 
 /** The smoke row's name — one spelling for every relay app. */
 export const PUBLIC_CLIENT_CHECK = "public-client";
@@ -123,6 +124,56 @@ export async function recordPublicClient(smoke: Smoke, staged: string | null, op
 	return verdict.matched;
 }
 
+/**
+ * What the relay Worker is BUILT from, relative to the app's checkout: every file reachable by
+ * relative import from wrangler's `main` (the Worker reaches into `src/` — roms'
+ * `../src/server/limits`, station's `../scripts/link`), plus the config and the lockfile that pin
+ * what it bundles from `node_modules`. Test files are never reachable, so a test-only change
+ * does not re-ship. Unresolvable edges are skipped; esbuild would refuse them anyway.
+ */
+export function workerInputs(root: string, main = "worker/index.ts"): string[] {
+	const seen = new Set<string>();
+	const queue = [resolve(root, main)];
+	while (queue.length > 0) {
+		const file = queue.shift() as string;
+		if (seen.has(file)) continue;
+		seen.add(file);
+		let code: string;
+		try {
+			code = readFileSync(file, "utf8").replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:"'`])\/\/.*$/gm, "$1");
+		} catch {
+			continue;
+		}
+		for (const spec of valueImports(code)) {
+			if (!spec.startsWith(".")) continue;
+			const base = resolve(dirname(file), spec);
+			const hit = [base, `${base}.ts`, `${base}.tsx`, `${base}.js`, join(base, "index.ts")].find(
+				(candidate) => existsSync(candidate) && statSync(candidate).isFile(),
+			);
+			if (hit) queue.push(hit);
+		}
+	}
+	const files = [...seen].map((file) => relative(root, file)).sort();
+	return [...files, "wrangler.jsonc", "package.json", "bun.lock"];
+}
+
+/**
+ * Pure: does the served Worker need re-uploading? `served` is `/healthz`'s `worker` object;
+ * `diffStatus` is `git diff --quiet <served.commit> HEAD -- <inputs>`'s exit status (0 same,
+ * 1 changed, anything else — an unknown or unreachable commit — unknowable). Null when it is
+ * current; otherwise the sentence saying why it is not. Unknown is behind: shipping is
+ * idempotent, and believing a fix is live when it is not is the failure this exists for.
+ */
+export function workerCodeBehind(served: { commit?: unknown; dirty?: unknown } | null, head: string, diffStatus: number | null): string | null {
+	const commit = typeof served?.commit === "string" ? served.commit : "";
+	if (!commit) return "/healthz names no `worker.commit` — nothing says which Worker is serving";
+	if (served?.dirty === true) return `the served Worker (${commit}) was deployed from a dirty tree`;
+	if (head.startsWith(commit) || commit.startsWith(head)) return null;
+	if (diffStatus === 0) return null;
+	if (diffStatus === 1) return `the Worker's code changed since the served Worker (${commit} → ${head.slice(0, 8)})`;
+	return `the served Worker's commit ${commit} is not readable in this checkout — cannot prove it is current`;
+}
+
 export interface ShipClientOptions extends PublicShellOptions {
 	/** The public origin, e.g. `https://roms.cursedalchemy.com`. */
 	base: string;
@@ -132,23 +183,52 @@ export interface ShipClientOptions extends PublicShellOptions {
 	root: string;
 	/** Runs `bun run worker:deploy` in `root`; returns its exit status. Injected for tests. */
 	runWorkerDeploy?: (root: string) => number | null;
+	/** `git <args>` in `root` → exit status and trimmed stdout. Injected for tests. */
+	git?: (root: string, args: readonly string[]) => { status: number | null; stdout: string };
+	/** What the Worker is built from ({@link workerInputs}); default computed from `root`. */
+	workerInputs?: readonly string[];
 	log?: (line: string) => void;
 }
 
 export interface ShipClientResult {
-	/** `already` — the public shell named this build; `shipped` — worker:deploy ran and exited 0; `failed` — it did not. */
+	/** `already` — the public shell named this build AND the served Worker is current; `shipped` — worker:deploy ran and exited 0; `failed` — it did not. */
 	outcome: "already" | "shipped" | "failed";
 	/** worker:deploy's exit status when it ran. */
 	status?: number | null;
 	before: PublicClientVerdict | null;
+	/** Why the Worker itself was behind ({@link workerCodeBehind}), when the client was not the reason. */
+	workerBehind?: string;
+}
+
+const spawnGit = (root: string, args: readonly string[]): { status: number | null; stdout: string } => {
+	const run = spawnSync("git", [...args], { cwd: root, encoding: "utf8" });
+	return { status: run.status, stdout: (run.stdout ?? "").trim() };
+};
+
+/** `/healthz`'s `worker` object, or null when it cannot be read. */
+async function servedWorker(options: ShipClientOptions): Promise<{ commit?: unknown; dirty?: unknown } | null> {
+	try {
+		const ask = options.fetch ?? ((u: string, init: RequestInit) => fetch(u, init));
+		const response = await ask(new URL("/healthz", options.base).toString(), {
+			redirect: "manual",
+			signal: AbortSignal.timeout(options.timeoutMs ?? 20_000),
+			headers: { accept: "application/json", ...(options.headers ?? {}) },
+		});
+		const body = (await response.json()) as { worker?: { commit?: unknown; dirty?: unknown } };
+		return body?.worker ?? null;
+	} catch {
+		return null;
+	}
 }
 
 const spawnWorkerDeploy = (root: string): number | null =>
 	spawnSync("bun", ["run", "worker:deploy"], { cwd: root, stdio: ["ignore", "inherit", "inherit"] }).status;
 
 /**
- * The deploy step: when the public shell does not name this build, run `worker:deploy` (its own
- * stage walk first) so ONE command ships the release. Never throws for a fetch that fails — an
+ * The deploy step: when the public shell does not name this build — or it does but the served
+ * Worker (`/healthz` `worker.commit`) predates a change to what the Worker is built from
+ * ({@link workerInputs}) — run `worker:deploy` (its own stage walk first) so ONE command ships the
+ * release. Never throws for a fetch that fails — an
  * unreadable public shell is "behind", because shipping the Worker is idempotent and the smoke's
  * `public-client` row is what proves it took.
  */
@@ -162,8 +242,25 @@ export async function shipClientIfBehind(options: ShipClientOptions): Promise<Sh
 		);
 		before = comparePublicClient(html, options.staged, options.base);
 		if (before.matched) {
-			log(`  already serving it — ${before.built.join(", ")}`);
-			return { outcome: "already", before };
+			// 🔴 The client matching is not the Worker matching: roms 86e5e522 changed only
+			// worker/index.ts, this said "already serving it", and /healthz kept answering the
+			// previous Worker until worker:deploy was run by hand (2026-09-25).
+			const git = options.git ?? spawnGit;
+			const head = git(options.root, ["rev-parse", "HEAD"]).stdout;
+			const served = await servedWorker(options);
+			const commit = typeof served?.commit === "string" ? served.commit : "";
+			const inputs = options.workerInputs ?? (commit ? workerInputs(options.root) : []);
+			const atHead = commit !== "" && head !== "" && (head.startsWith(commit) || commit.startsWith(head));
+			const diff = commit && head && !atHead ? git(options.root, ["diff", "--quiet", commit, "HEAD", "--", ...inputs]).status : null;
+			const behind = workerCodeBehind(served, head, diff);
+			if (behind === null) {
+				log(`  already serving it — ${before.built.join(", ")}, Worker ${commit}`);
+				return { outcome: "already", before };
+			}
+			log(`  the client is current but ${behind} — shipping the Worker`);
+			log("  running `bun run worker:deploy` — the stage walk, then production");
+			const status = (options.runWorkerDeploy ?? spawnWorkerDeploy)(options.root);
+			return { outcome: status === 0 ? "shipped" : "failed", status, before, workerBehind: behind };
 		}
 		log(`  ${workerBehind(before, options.base, options.root)}`);
 	} else {

package/src/relay.ts

@@ -316,6 +316,20 @@ const json = (status: number, body: unknown) =>
  * the edge has noticed its old socket died, and a relay that sent to the dead one would time every
  * request out for as long as that took.
  *
+ * 🔴 **Never a hang across a redial (2026-09-25).** roms' post-deploy smoke died on curl's timeout
+ * asking a relayed path while the Mac's link reconnected twice in one minute. Two holes, both shut:
+ *
+ *  · a replaced socket is closed by US, so no `webSocketClose` ever fires for it — its pending
+ *    requests waited out {@link DEFAULT_RELAY_TIMEOUT_MS}. `accept` now answers each the link-down
+ *    503 before closing it;
+ *  · workerd keeps listing a closed socket until its close handshake completes, which a dead Mac
+ *    never finishes — and it was `getWebSockets()[0]`, ahead of the new one. {@link RelayLink.live}
+ *    picks the NEWEST link not marked replaced.
+ *
+ * A request caught by either answers the same JSON 503 (`link: "down"`) as a Mac away, which is
+ * what every smoke already accepts. `relay.test.ts` holds both paths against a state that lists
+ * closed sockets the way workerd does.
+ *
  * 🔴 A plain class with a `fetch` method, NOT `extends DurableObject`: importing
  * `cloudflare:workers` leaks Worker globals over a Bun host's type graph. The hibernation handlers
  * are found by name.
@@ -344,14 +358,43 @@ export class RelayLink {
 		return this.relay(request);
 	}
 
+	/**
+	 * The link requests go to: the newest by `since` that `accept` has not marked replaced. Never
+	 * `getWebSockets()[0]` — see the class header.
+	 */
+	protected live(): LinkSocket | undefined {
+		let best: LinkSocket | undefined;
+		let bestSince = "";
+		for (const socket of this.state.getWebSockets()) {
+			const attachment = socket.deserializeAttachment() as { since?: string; replaced?: boolean } | null | undefined;
+			if (attachment?.replaced) continue;
+			const since = attachment?.since ?? "";
+			if (best === undefined || since >= bestSince) {
+				best = socket;
+				bestSince = since;
+			}
+		}
+		return best;
+	}
+
 	status(): LinkStatus {
-		const socket = this.state.getWebSockets()[0];
+		const socket = this.live();
 		const attachment = socket?.deserializeAttachment() as { since?: string } | null | undefined;
 		return { connected: socket !== undefined, since: attachment?.since ?? null };
 	}
 
 	private accept(): Response {
-		for (const old of this.state.getWebSockets()) old.close(4000, "replaced by a newer link");
+		for (const old of this.state.getWebSockets()) {
+			// Closed by us, so no `webSocketClose` fires for it: fail what it holds NOW, or each waits
+			// out the timeout. Marked first, because workerd goes on listing it until the handshake ends.
+			try {
+				old.serializeAttachment({ ...((old.deserializeAttachment() as object | null) ?? {}), replaced: true });
+			} catch {}
+			this.failPending(old, "replaced by a newer link");
+			try {
+				old.close(4000, "replaced by a newer link");
+			} catch {}
+		}
 		const { client, server } = this.makePair();
 		this.state.acceptWebSocket(server);
 		server.serializeAttachment({ since: new Date().toISOString() });
@@ -362,17 +405,27 @@ export class RelayLink {
 		return json(503, { error: this.options.offlineMessage, link: "down" });
 	}
 
+	/** Answer every request waiting on `socket` with the link-down 503 — it will never be answered. */
+	private failPending(socket: LinkSocket, why: string): void {
+		for (const [id, waiting] of this.pending) {
+			if (waiting.socket !== socket) continue;
+			clearTimeout(waiting.timer);
+			this.pending.delete(id);
+			waiting.resolve(json(503, { error: `${this.options.app}'s link went down mid-request (${why}) — ask again`, link: "down" }));
+		}
+	}
+
 	/** Relay, and keep or drop what the answer says about the cookie that asked — see {@link OfflineCache}. */
 	private async relay(request: Request): Promise<Response> {
 		const cache = this.options.offline;
-		if (!cache) return this.state.getWebSockets()[0] ? this.send(request) : this.offline();
+		if (!cache) return this.live() ? this.send(request) : this.offline();
 		const url = new URL(request.url);
 		const cookie = cookieValue(request.headers.get("cookie"), cache.cookie);
 		const owner = cookie ? await sha256Hex(cookie) : null;
 		const keyed = `${url.pathname}${url.search}`;
 		const cacheable = owner !== null && request.method === "GET" && url.pathname.startsWith("/api/");
 		if (owner && cache.signOut.includes(url.pathname)) await this.forget(owner);
-		if (!this.state.getWebSockets()[0]) {
+		if (!this.live()) {
 			if (cacheable) {
 				const kept = await this.state.storage.get<Kept>(`c:${owner}:${keyed}`);
 				if (kept && this.now() - kept.at < cache.ttlMs) {
@@ -413,13 +466,13 @@ export class RelayLink {
 		const warm = await this.state.storage.get<{ cookie: string; at: number }>("warm");
 		if (!warm || this.now() - warm.at >= cache.ttlMs) return;
 		for (const path of paths) {
-			if (!this.state.getWebSockets()[0]) return;
+			if (!this.live()) return;
 			await this.relay(new Request(`https://relay.link${path}`, { headers: { cookie: `${cache.cookie}=${warm.cookie}` } }));
 		}
 	}
 
 	private async send(request: Request): Promise<Response> {
-		const socket = this.state.getWebSockets()[0];
+		const socket = this.live();
 		if (!socket) return this.offline();
 		const tooBig = () => json(413, { error: `request body over the link's ${this.maxBodyBytes} bytes` });
 		const declared = Number(request.headers.get("content-length") ?? 0);
@@ -460,12 +513,7 @@ export class RelayLink {
 	}
 
 	webSocketClose(socket: LinkSocket, code: number, reason: string): void {
-		for (const [id, waiting] of this.pending) {
-			if (waiting.socket !== socket) continue;
-			clearTimeout(waiting.timer);
-			this.pending.delete(id);
-			waiting.resolve(json(502, { error: `${this.options.app}'s link closed mid-request (${code}${reason ? ` ${reason}` : ""})` }));
-		}
+		this.failPending(socket, `closed ${code}${reason ? ` ${reason}` : ""}`);
 		try {
 			socket.close(code, reason);
 		} catch {}
@@ -492,3 +540,23 @@ export async function acceptLink(
 	if (!(await linkKeyMatches(request.headers.get("authorization"), digest))) return json(401, { error: `not ${names.app}'s Mac` });
 	return link.fetch(new Request(`${new URL(request.url).origin}/__link`, request));
 }
+
+/**
+ * The Worker's call into the link object, with a THROW turned into the link-down 503.
+ *
+ * A Worker upload resets every Durable Object, and a request in flight in the old one rejects
+ * ("Durable Object reset because its code was updated"). Unhandled, that is Cloudflare's HTML
+ * error page — not JSON, not a 503, and a smoke's leg reads it as a broken release. The same
+ * answer as a Mac away is the honest one: ask again in a second.
+ */
+export async function askLink(
+	link: { fetch(request: Request): Promise<Response> },
+	request: Request,
+	app: string,
+): Promise<Response> {
+	try {
+		return await link.fetch(request);
+	} catch (error) {
+		return json(503, { error: `${app}'s link object restarted mid-request (${(error as Error).message}) — ask again`, link: "down" });
+	}
+}

package/src/workerDeploy.ts

@@ -38,7 +38,8 @@
  *      check green and its owner unable to sign in; the stage walk is what found why, and a step
  *      in the sequence is one a person in a hurry cannot skip;
  *   5. build → 6. **schema** (`IF NOT EXISTS`, the database named explicitly, never the binding a
- *      forgotten `--env` would resolve) → 7. **deploy with the `--var` stamp** (commit AND dirty
+ *      forgotten `--env` would resolve; ordinary `--command` queries, never the blocking
+ *      `--file` import — {@link schemaApplyArgv}) → 7. **deploy with the `--var` stamp** (commit AND dirty
  *      flag, so `/healthz` publishes what is running) → 8. **secrets** (after the deploy: a secret
  *      needs a script to attach to) → 9. **smoke**.
  *
@@ -238,6 +239,8 @@ export interface DeployDeps {
 	run: (argv: readonly string[], env: Record<string, string>) => number;
 	/** `git <args>` in the checkout; trimmed stdout, `""` on failure. */
 	git: (args: readonly string[]) => string;
+	/** A file in the checkout, as text — the schema. Default: `readFileSync` against the process's cwd. */
+	read?: (path: string) => string;
 	log?: (line: string) => void;
 	error?: (line: string) => void;
 }
@@ -260,13 +263,124 @@ export interface DeployResult {
 export function workerDeployDeps(cwd: string): DeployDeps {
 	return {
 		run: (argv, env) => {
-			console.log(`  $ ${argv.join(" ")}`);
+			// a schema `--command` is kilobytes of DDL — the echo names it, it does not reprint it
+			console.log(`  $ ${argv.map((arg) => (arg.length > 160 ? `${arg.slice(0, 120)}… (${arg.length} chars)` : arg)).join(" ")}`);
 			return spawnSync(argv[0] as string, argv.slice(1), { cwd, stdio: "inherit", env: { ...process.env, ...env } }).status ?? 1;
 		},
 		git: (args) => (spawnSync("git", [...args], { cwd, encoding: "utf8" }).stdout ?? "").trim(),
+		read: (path) => readFileSync(join(cwd, path), "utf8"),
 	};
 }
 
+/**
+ * The statements of a schema file, each on one line with its comments gone — split on the `;`s
+ * that end a statement, never on one inside a string, a quoted name, a comment, or a trigger's
+ * `BEGIN … END` / an expression's `CASE … END`. Hand-written schemas (patterns') format a
+ * CREATE TABLE across lines; generated ones (`d1SchemaText`) are already one per line.
+ */
+export function sqlStatements(text: string): string[] {
+	const statements: string[] = [];
+	let current = "";
+	let depth = 0;
+	let word = "";
+	const endWord = (): void => {
+		const w = word.toUpperCase();
+		word = "";
+		if (w === "CASE") depth++;
+		else if (w === "BEGIN" && /^\s*CREATE\s+(TEMP\s+|TEMPORARY\s+)?TRIGGER\b/i.test(current)) depth++;
+		else if (w === "END" && depth > 0) depth--;
+	};
+	for (let i = 0; i < text.length; i++) {
+		const c = text[i] as string;
+		if (/[A-Za-z_]/.test(c)) {
+			word += c;
+			current += c;
+			continue;
+		}
+		if (word) endWord();
+		if (c === "-" && text[i + 1] === "-") {
+			while (i < text.length && text[i] !== "\n") i++;
+			current += " ";
+			continue;
+		}
+		if (c === "/" && text[i + 1] === "*") {
+			const close = text.indexOf("*/", i + 2);
+			if (close < 0) throw new Error("an unterminated /* comment");
+			i = close + 1;
+			current += " ";
+			continue;
+		}
+		if (c === "'" || c === '"' || c === "`" || c === "[") {
+			const closer = c === "[" ? "]" : c;
+			let j = i + 1;
+			for (;;) {
+				const at = text.indexOf(closer, j);
+				if (at < 0) throw new Error(`an unterminated ${c} quote`);
+				// SQL escapes a quote by doubling it: 'it''s'
+				if (closer !== "]" && text[at + 1] === closer) {
+					j = at + 2;
+					continue;
+				}
+				j = at;
+				break;
+			}
+			current += text.slice(i, j + 1);
+			i = j;
+			continue;
+		}
+		if (c === ";" && depth === 0) {
+			const statement = current.replace(/\s+/g, " ").trim();
+			if (statement) statements.push(statement);
+			current = "";
+			continue;
+		}
+		current += /\s/.test(c) ? " " : c;
+	}
+	if (word) endWord();
+	const tail = current.replace(/\s+/g, " ").trim();
+	if (tail) statements.push(tail);
+	return statements;
+}
+
+/**
+ * D1's limit on one SQL statement is 100 KB; a command is kept well under it (and under any argv
+ * ceiling) by starting a new one before it would cross this many bytes.
+ */
+export const SCHEMA_COMMAND_BYTES = 90_000;
+
+/** {@link sqlStatements}, packed into as few `--command` strings as {@link SCHEMA_COMMAND_BYTES} allows. */
+export function schemaCommands(text: string, maxBytes: number = SCHEMA_COMMAND_BYTES): string[] {
+	const commands: string[] = [];
+	let current = "";
+	for (const statement of sqlStatements(text)) {
+		const next = current ? `${current}; ${statement}` : statement;
+		if (current && Buffer.byteLength(`${next};`) > maxBytes) {
+			commands.push(`${current};`);
+			current = statement;
+		} else current = next;
+	}
+	if (current) commands.push(`${current};`);
+	const over = commands.find((command) => Buffer.byteLength(command) > maxBytes);
+	if (over) throw new Error(`one statement is over ${maxBytes} bytes, past what D1 takes in a query: ${over.slice(0, 80)}…`);
+	return commands;
+}
+
+/**
+ * The schema step's argv — ordinary queries, `wrangler d1 execute --remote --command`, one per
+ * {@link schemaCommands} chunk.
+ *
+ * 🔴 NEVER `--file`. With `--remote`, `--file` goes through D1's IMPORT API, and wrangler says what
+ * that costs: "your D1 database will be unavailable to serve queries" for the length of it — the
+ * same blocking class as `wrangler d1 export`, which failed 72 of 198 concurrent family reads on
+ * 2026-09-24 (`pullD1ToSqlite`'s header). This step runs on every production deploy of every
+ * Worker app with a schema, and the schema is idempotent, so the import blocked production to
+ * change nothing. `--command` runs through the query API like any request the Worker makes.
+ * `workerDeploy.test.ts` pins that no argv here ever carries `--file`.
+ */
+export function schemaApplyArgv(databaseName: string, commands: readonly string[], envArgs: readonly string[]): string[][] {
+	return commands.map((command) => ["bunx", "wrangler", "d1", "execute", databaseName, "--remote", "--command", command, "-y", ...envArgs]);
+}
+
 /**
  * Run the sequence in the header's order, stopping at the first red with a sentence. Never
  * exits — the caller does, with {@link DeployResult.code}.
@@ -319,8 +433,15 @@ export function runWorkerDeploy(spec: WorkerDeploySpec, deps: DeployDeps): Deplo
 	if (spec.databaseName) {
 		const schema = spec.schemaFile ?? "db/schema.sql";
 		step(`apply ${schema} to D1 \`${spec.databaseName}\``);
-		const applied = deps.run(["bunx", "wrangler", "d1", "execute", spec.databaseName, "--remote", "--file", schema, "-y", ...envArgs], spec.credential);
-		if (applied !== 0) return stop("schema", "the schema did not apply — nothing was deployed.");
+		let commands: string[];
+		try {
+			commands = schemaCommands((deps.read ?? ((path: string) => readFileSync(path, "utf8")))(schema));
+		} catch (cause) {
+			return stop("schema", `${schema} could not be read as statements (${(cause as Error).message}) — nothing was deployed.`);
+		}
+		for (const argv of schemaApplyArgv(spec.databaseName, commands, envArgs)) {
+			if (deps.run(argv, spec.credential) !== 0) return stop("schema", "the schema did not apply — nothing was deployed.");
+		}
 	}
 	step(`deploy ${spec.workerName} @ ${commit.slice(0, 8)}${dirty ? " (dirty — stage only)" : ""}`);
 	const stamp = spec.stampVars