cursedops 0.10.9 → 0.10.10

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedops",
-	"version": "0.10.9",
+	"version": "0.10.10",
 	"description": "The build-and-ops answers this generation's apps wrote independently and identically: finding a generation's roots — and printing a command that runs when pasted — without knowing a path, the generation's whole-tree laws run over one repo from a checkout or a worktree, macOS launchd agent install/replace/remove and the live port a job serves, the scaffolding and verdicts of a deployed smoke (origin probe, the smoke's own environment, a network that lies about DNS, a settled version), the static-serving helpers eight apps copied — the path-traversal guard among them — the API floor that keeps an unmatched /api/... from ever being answered with the app shell, the commit and dirty flag a checkout-served process reports, the Cloudflare Worker deploy toolkit four apps copied (the deploy sequence, exact-set secrets over a pipe, origin-first rollback, the curl edge fetch, the row-for-row D1 import proof, the billed-CPU tail check around a deploy's walk and smoke, and each app's worker:secrets and worker:smoke main as one function of its data), the relay a Worker fronts a Mac-bound app with (the Durable Object, the frames, the Mac's dialer and key rotation — lifted from station for roms — and the signed-in stage walk's skeleton and the relay app's whole worker:deploy), the Worker import-graph and await-port checks every Worker app's suite runs over its own source, and the public-surface ratchet three published libraries each carried a forked copy of. Mechanism only — no app knows its name from here. Bun, zero runtime dependencies (typescript is an optional peer, for public-surface only), ships source.",
 	"type": "module",
 	"scripts": {

package/src/d1Schema.ts

@@ -13,8 +13,9 @@
  * A Worker has no boot. An app's `migrate()` issues dozens of statements and inspects
  * `PRAGMA table_info` as it goes; running that on every invocation would spend a D1 invocation's
  * query budget before the request started, and D1 has no `PRAGMA table_info` to inspect with. So
- * D1's schema is applied ONCE, by hand — `bunx wrangler d1 execute <name> --remote --file
- * db/schema.sql` — and there are two descriptions of the app's tables. Each app's own
+ * D1's schema is applied ahead of the Worker, by every `worker:deploy` — ordinary `--command`
+ * queries, never D1's blocking `--file` import (`schemaApplyArgv` in `cursedops/worker-deploy`) —
+ * and there are two descriptions of the app's tables. Each app's own
  * schema-matches test fails its gate when they disagree, so the file is a build product with a
  * checker rather than a document with a convention. {@link d1SchemaText} writes it, and refuses a
  * statement that spans lines, because D1's `exec` splits on newlines.

package/src/publicClient.ts

@@ -26,10 +26,11 @@
  * anonymous `/` there is a 302 to the Access issuer, which names no built asset and never matches.
  */
 import { spawnSync } from "node:child_process";
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { dirname, join, relative, resolve } from "node:path";
 import { builtAssetsIn, type Smoke } from "cursedops/smoke";
 import { stagedClientDir } from "cursedops/staged-client";
+import { valueImports } from "cursedops/worker-safety";
 
 /** The smoke row's name — one spelling for every relay app. */
 export const PUBLIC_CLIENT_CHECK = "public-client";
@@ -123,6 +124,56 @@ export async function recordPublicClient(smoke: Smoke, staged: string | null, op
 	return verdict.matched;
 }
 
+/**
+ * What the relay Worker is BUILT from, relative to the app's checkout: every file reachable by
+ * relative import from wrangler's `main` (the Worker reaches into `src/` — roms'
+ * `../src/server/limits`, station's `../scripts/link`), plus the config and the lockfile that pin
+ * what it bundles from `node_modules`. Test files are never reachable, so a test-only change
+ * does not re-ship. Unresolvable edges are skipped; esbuild would refuse them anyway.
+ */
+export function workerInputs(root: string, main = "worker/index.ts"): string[] {
+	const seen = new Set<string>();
+	const queue = [resolve(root, main)];
+	while (queue.length > 0) {
+		const file = queue.shift() as string;
+		if (seen.has(file)) continue;
+		seen.add(file);
+		let code: string;
+		try {
+			code = readFileSync(file, "utf8").replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:"'`])\/\/.*$/gm, "$1");
+		} catch {
+			continue;
+		}
+		for (const spec of valueImports(code)) {
+			if (!spec.startsWith(".")) continue;
+			const base = resolve(dirname(file), spec);
+			const hit = [base, `${base}.ts`, `${base}.tsx`, `${base}.js`, join(base, "index.ts")].find(
+				(candidate) => existsSync(candidate) && statSync(candidate).isFile(),
+			);
+			if (hit) queue.push(hit);
+		}
+	}
+	const files = [...seen].map((file) => relative(root, file)).sort();
+	return [...files, "wrangler.jsonc", "package.json", "bun.lock"];
+}
+
+/**
+ * Pure: does the served Worker need re-uploading? `served` is `/healthz`'s `worker` object;
+ * `diffStatus` is `git diff --quiet <served.commit> HEAD -- <inputs>`'s exit status (0 same,
+ * 1 changed, anything else — an unknown or unreachable commit — unknowable). Null when it is
+ * current; otherwise the sentence saying why it is not. Unknown is behind: shipping is
+ * idempotent, and believing a fix is live when it is not is the failure this exists for.
+ */
+export function workerCodeBehind(served: { commit?: unknown; dirty?: unknown } | null, head: string, diffStatus: number | null): string | null {
+	const commit = typeof served?.commit === "string" ? served.commit : "";
+	if (!commit) return "/healthz names no `worker.commit` — nothing says which Worker is serving";
+	if (served?.dirty === true) return `the served Worker (${commit}) was deployed from a dirty tree`;
+	if (head.startsWith(commit) || commit.startsWith(head)) return null;
+	if (diffStatus === 0) return null;
+	if (diffStatus === 1) return `the Worker's code changed since the served Worker (${commit} → ${head.slice(0, 8)})`;
+	return `the served Worker's commit ${commit} is not readable in this checkout — cannot prove it is current`;
+}
+
 export interface ShipClientOptions extends PublicShellOptions {
 	/** The public origin, e.g. `https://roms.cursedalchemy.com`. */
 	base: string;
@@ -132,23 +183,52 @@ export interface ShipClientOptions extends PublicShellOptions {
 	root: string;
 	/** Runs `bun run worker:deploy` in `root`; returns its exit status. Injected for tests. */
 	runWorkerDeploy?: (root: string) => number | null;
+	/** `git <args>` in `root` → exit status and trimmed stdout. Injected for tests. */
+	git?: (root: string, args: readonly string[]) => { status: number | null; stdout: string };
+	/** What the Worker is built from ({@link workerInputs}); default computed from `root`. */
+	workerInputs?: readonly string[];
 	log?: (line: string) => void;
 }
 
 export interface ShipClientResult {
-	/** `already` — the public shell named this build; `shipped` — worker:deploy ran and exited 0; `failed` — it did not. */
+	/** `already` — the public shell named this build AND the served Worker is current; `shipped` — worker:deploy ran and exited 0; `failed` — it did not. */
 	outcome: "already" | "shipped" | "failed";
 	/** worker:deploy's exit status when it ran. */
 	status?: number | null;
 	before: PublicClientVerdict | null;
+	/** Why the Worker itself was behind ({@link workerCodeBehind}), when the client was not the reason. */
+	workerBehind?: string;
+}
+
+const spawnGit = (root: string, args: readonly string[]): { status: number | null; stdout: string } => {
+	const run = spawnSync("git", [...args], { cwd: root, encoding: "utf8" });
+	return { status: run.status, stdout: (run.stdout ?? "").trim() };
+};
+
+/** `/healthz`'s `worker` object, or null when it cannot be read. */
+async function servedWorker(options: ShipClientOptions): Promise<{ commit?: unknown; dirty?: unknown } | null> {
+	try {
+		const ask = options.fetch ?? ((u: string, init: RequestInit) => fetch(u, init));
+		const response = await ask(new URL("/healthz", options.base).toString(), {
+			redirect: "manual",
+			signal: AbortSignal.timeout(options.timeoutMs ?? 20_000),
+			headers: { accept: "application/json", ...(options.headers ?? {}) },
+		});
+		const body = (await response.json()) as { worker?: { commit?: unknown; dirty?: unknown } };
+		return body?.worker ?? null;
+	} catch {
+		return null;
+	}
 }
 
 const spawnWorkerDeploy = (root: string): number | null =>
 	spawnSync("bun", ["run", "worker:deploy"], { cwd: root, stdio: ["ignore", "inherit", "inherit"] }).status;
 
 /**
- * The deploy step: when the public shell does not name this build, run `worker:deploy` (its own
- * stage walk first) so ONE command ships the release. Never throws for a fetch that fails — an
+ * The deploy step: when the public shell does not name this build — or it does but the served
+ * Worker (`/healthz` `worker.commit`) predates a change to what the Worker is built from
+ * ({@link workerInputs}) — run `worker:deploy` (its own stage walk first) so ONE command ships the
+ * release. Never throws for a fetch that fails — an
  * unreadable public shell is "behind", because shipping the Worker is idempotent and the smoke's
  * `public-client` row is what proves it took.
  */
@@ -162,8 +242,25 @@ export async function shipClientIfBehind(options: ShipClientOptions): Promise<Sh
 		);
 		before = comparePublicClient(html, options.staged, options.base);
 		if (before.matched) {
-			log(`  already serving it — ${before.built.join(", ")}`);
-			return { outcome: "already", before };
+			// 🔴 The client matching is not the Worker matching: roms 86e5e522 changed only
+			// worker/index.ts, this said "already serving it", and /healthz kept answering the
+			// previous Worker until worker:deploy was run by hand (2026-09-25).
+			const git = options.git ?? spawnGit;
+			const head = git(options.root, ["rev-parse", "HEAD"]).stdout;
+			const served = await servedWorker(options);
+			const commit = typeof served?.commit === "string" ? served.commit : "";
+			const inputs = options.workerInputs ?? (commit ? workerInputs(options.root) : []);
+			const atHead = commit !== "" && head !== "" && (head.startsWith(commit) || commit.startsWith(head));
+			const diff = commit && head && !atHead ? git(options.root, ["diff", "--quiet", commit, "HEAD", "--", ...inputs]).status : null;
+			const behind = workerCodeBehind(served, head, diff);
+			if (behind === null) {
+				log(`  already serving it — ${before.built.join(", ")}, Worker ${commit}`);
+				return { outcome: "already", before };
+			}
+			log(`  the client is current but ${behind} — shipping the Worker`);
+			log("  running `bun run worker:deploy` — the stage walk, then production");
+			const status = (options.runWorkerDeploy ?? spawnWorkerDeploy)(options.root);
+			return { outcome: status === 0 ? "shipped" : "failed", status, before, workerBehind: behind };
 		}
 		log(`  ${workerBehind(before, options.base, options.root)}`);
 	} else {

package/src/workerDeploy.ts

@@ -38,7 +38,8 @@
  *      check green and its owner unable to sign in; the stage walk is what found why, and a step
  *      in the sequence is one a person in a hurry cannot skip;
  *   5. build → 6. **schema** (`IF NOT EXISTS`, the database named explicitly, never the binding a
- *      forgotten `--env` would resolve) → 7. **deploy with the `--var` stamp** (commit AND dirty
+ *      forgotten `--env` would resolve; ordinary `--command` queries, never the blocking
+ *      `--file` import — {@link schemaApplyArgv}) → 7. **deploy with the `--var` stamp** (commit AND dirty
  *      flag, so `/healthz` publishes what is running) → 8. **secrets** (after the deploy: a secret
  *      needs a script to attach to) → 9. **smoke**.
  *
@@ -238,6 +239,8 @@ export interface DeployDeps {
 	run: (argv: readonly string[], env: Record<string, string>) => number;
 	/** `git <args>` in the checkout; trimmed stdout, `""` on failure. */
 	git: (args: readonly string[]) => string;
+	/** A file in the checkout, as text — the schema. Default: `readFileSync` against the process's cwd. */
+	read?: (path: string) => string;
 	log?: (line: string) => void;
 	error?: (line: string) => void;
 }
@@ -260,13 +263,124 @@ export interface DeployResult {
 export function workerDeployDeps(cwd: string): DeployDeps {
 	return {
 		run: (argv, env) => {
-			console.log(`  $ ${argv.join(" ")}`);
+			// a schema `--command` is kilobytes of DDL — the echo names it, it does not reprint it
+			console.log(`  $ ${argv.map((arg) => (arg.length > 160 ? `${arg.slice(0, 120)}… (${arg.length} chars)` : arg)).join(" ")}`);
 			return spawnSync(argv[0] as string, argv.slice(1), { cwd, stdio: "inherit", env: { ...process.env, ...env } }).status ?? 1;
 		},
 		git: (args) => (spawnSync("git", [...args], { cwd, encoding: "utf8" }).stdout ?? "").trim(),
+		read: (path) => readFileSync(join(cwd, path), "utf8"),
 	};
 }
 
+/**
+ * The statements of a schema file, each on one line with its comments gone — split on the `;`s
+ * that end a statement, never on one inside a string, a quoted name, a comment, or a trigger's
+ * `BEGIN … END` / an expression's `CASE … END`. Hand-written schemas (patterns') format a
+ * CREATE TABLE across lines; generated ones (`d1SchemaText`) are already one per line.
+ */
+export function sqlStatements(text: string): string[] {
+	const statements: string[] = [];
+	let current = "";
+	let depth = 0;
+	let word = "";
+	const endWord = (): void => {
+		const w = word.toUpperCase();
+		word = "";
+		if (w === "CASE") depth++;
+		else if (w === "BEGIN" && /^\s*CREATE\s+(TEMP\s+|TEMPORARY\s+)?TRIGGER\b/i.test(current)) depth++;
+		else if (w === "END" && depth > 0) depth--;
+	};
+	for (let i = 0; i < text.length; i++) {
+		const c = text[i] as string;
+		if (/[A-Za-z_]/.test(c)) {
+			word += c;
+			current += c;
+			continue;
+		}
+		if (word) endWord();
+		if (c === "-" && text[i + 1] === "-") {
+			while (i < text.length && text[i] !== "\n") i++;
+			current += " ";
+			continue;
+		}
+		if (c === "/" && text[i + 1] === "*") {
+			const close = text.indexOf("*/", i + 2);
+			if (close < 0) throw new Error("an unterminated /* comment");
+			i = close + 1;
+			current += " ";
+			continue;
+		}
+		if (c === "'" || c === '"' || c === "`" || c === "[") {
+			const closer = c === "[" ? "]" : c;
+			let j = i + 1;
+			for (;;) {
+				const at = text.indexOf(closer, j);
+				if (at < 0) throw new Error(`an unterminated ${c} quote`);
+				// SQL escapes a quote by doubling it: 'it''s'
+				if (closer !== "]" && text[at + 1] === closer) {
+					j = at + 2;
+					continue;
+				}
+				j = at;
+				break;
+			}
+			current += text.slice(i, j + 1);
+			i = j;
+			continue;
+		}
+		if (c === ";" && depth === 0) {
+			const statement = current.replace(/\s+/g, " ").trim();
+			if (statement) statements.push(statement);
+			current = "";
+			continue;
+		}
+		current += /\s/.test(c) ? " " : c;
+	}
+	if (word) endWord();
+	const tail = current.replace(/\s+/g, " ").trim();
+	if (tail) statements.push(tail);
+	return statements;
+}
+
+/**
+ * D1's limit on one SQL statement is 100 KB; a command is kept well under it (and under any argv
+ * ceiling) by starting a new one before it would cross this many bytes.
+ */
+export const SCHEMA_COMMAND_BYTES = 90_000;
+
+/** {@link sqlStatements}, packed into as few `--command` strings as {@link SCHEMA_COMMAND_BYTES} allows. */
+export function schemaCommands(text: string, maxBytes: number = SCHEMA_COMMAND_BYTES): string[] {
+	const commands: string[] = [];
+	let current = "";
+	for (const statement of sqlStatements(text)) {
+		const next = current ? `${current}; ${statement}` : statement;
+		if (current && Buffer.byteLength(`${next};`) > maxBytes) {
+			commands.push(`${current};`);
+			current = statement;
+		} else current = next;
+	}
+	if (current) commands.push(`${current};`);
+	const over = commands.find((command) => Buffer.byteLength(command) > maxBytes);
+	if (over) throw new Error(`one statement is over ${maxBytes} bytes, past what D1 takes in a query: ${over.slice(0, 80)}…`);
+	return commands;
+}
+
+/**
+ * The schema step's argv — ordinary queries, `wrangler d1 execute --remote --command`, one per
+ * {@link schemaCommands} chunk.
+ *
+ * 🔴 NEVER `--file`. With `--remote`, `--file` goes through D1's IMPORT API, and wrangler says what
+ * that costs: "your D1 database will be unavailable to serve queries" for the length of it — the
+ * same blocking class as `wrangler d1 export`, which failed 72 of 198 concurrent family reads on
+ * 2026-09-24 (`pullD1ToSqlite`'s header). This step runs on every production deploy of every
+ * Worker app with a schema, and the schema is idempotent, so the import blocked production to
+ * change nothing. `--command` runs through the query API like any request the Worker makes.
+ * `workerDeploy.test.ts` pins that no argv here ever carries `--file`.
+ */
+export function schemaApplyArgv(databaseName: string, commands: readonly string[], envArgs: readonly string[]): string[][] {
+	return commands.map((command) => ["bunx", "wrangler", "d1", "execute", databaseName, "--remote", "--command", command, "-y", ...envArgs]);
+}
+
 /**
  * Run the sequence in the header's order, stopping at the first red with a sentence. Never
  * exits — the caller does, with {@link DeployResult.code}.
@@ -319,8 +433,15 @@ export function runWorkerDeploy(spec: WorkerDeploySpec, deps: DeployDeps): Deplo
 	if (spec.databaseName) {
 		const schema = spec.schemaFile ?? "db/schema.sql";
 		step(`apply ${schema} to D1 \`${spec.databaseName}\``);
-		const applied = deps.run(["bunx", "wrangler", "d1", "execute", spec.databaseName, "--remote", "--file", schema, "-y", ...envArgs], spec.credential);
-		if (applied !== 0) return stop("schema", "the schema did not apply — nothing was deployed.");
+		let commands: string[];
+		try {
+			commands = schemaCommands((deps.read ?? ((path: string) => readFileSync(path, "utf8")))(schema));
+		} catch (cause) {
+			return stop("schema", `${schema} could not be read as statements (${(cause as Error).message}) — nothing was deployed.`);
+		}
+		for (const argv of schemaApplyArgv(spec.databaseName, commands, envArgs)) {
+			if (deps.run(argv, spec.credential) !== 0) return stop("schema", "the schema did not apply — nothing was deployed.");
+		}
 	}
 	step(`deploy ${spec.workerName} @ ${commit.slice(0, 8)}${dirty ? " (dirty — stage only)" : ""}`);
 	const stamp = spec.stampVars