cursedops 0.10.9 → 0.10.11

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedops",
-	"version": "0.10.9",
+	"version": "0.10.11",
 	"description": "The build-and-ops answers this generation's apps wrote independently and identically: finding a generation's roots — and printing a command that runs when pasted — without knowing a path, the generation's whole-tree laws run over one repo from a checkout or a worktree, macOS launchd agent install/replace/remove and the live port a job serves, the scaffolding and verdicts of a deployed smoke (origin probe, the smoke's own environment, a network that lies about DNS, a settled version), the static-serving helpers eight apps copied — the path-traversal guard among them — the API floor that keeps an unmatched /api/... from ever being answered with the app shell, the commit and dirty flag a checkout-served process reports, the Cloudflare Worker deploy toolkit four apps copied (the deploy sequence, exact-set secrets over a pipe, origin-first rollback, the curl edge fetch, the row-for-row D1 import proof, the billed-CPU tail check around a deploy's walk and smoke, and each app's worker:secrets and worker:smoke main as one function of its data), the relay a Worker fronts a Mac-bound app with (the Durable Object, the frames, the Mac's dialer and key rotation — lifted from station for roms — and the signed-in stage walk's skeleton and the relay app's whole worker:deploy), the Worker import-graph and await-port checks every Worker app's suite runs over its own source, and the public-surface ratchet three published libraries each carried a forked copy of. Mechanism only — no app knows its name from here. Bun, zero runtime dependencies (typescript is an optional peer, for public-surface only), ships source.",
 	"type": "module",
 	"scripts": {

package/src/d1Schema.ts

@@ -13,8 +13,9 @@
  * A Worker has no boot. An app's `migrate()` issues dozens of statements and inspects
  * `PRAGMA table_info` as it goes; running that on every invocation would spend a D1 invocation's
  * query budget before the request started, and D1 has no `PRAGMA table_info` to inspect with. So
- * D1's schema is applied ONCE, by hand — `bunx wrangler d1 execute <name> --remote --file
- * db/schema.sql` — and there are two descriptions of the app's tables. Each app's own
+ * D1's schema is applied ahead of the Worker, by every `worker:deploy` — ordinary `--command`
+ * queries, never D1's blocking `--file` import (`schemaApplyArgv` in `cursedops/worker-deploy`) —
+ * and there are two descriptions of the app's tables. Each app's own
  * schema-matches test fails its gate when they disagree, so the file is a build product with a
  * checker rather than a document with a convention. {@link d1SchemaText} writes it, and refuses a
  * statement that spans lines, because D1's `exec` splits on newlines.

package/src/publicClient.ts

@@ -26,10 +26,11 @@
  * anonymous `/` there is a 302 to the Access issuer, which names no built asset and never matches.
  */
 import { spawnSync } from "node:child_process";
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { dirname, join, relative, resolve } from "node:path";
 import { builtAssetsIn, type Smoke } from "cursedops/smoke";
 import { stagedClientDir } from "cursedops/staged-client";
+import { valueImports } from "cursedops/worker-safety";
 
 /** The smoke row's name — one spelling for every relay app. */
 export const PUBLIC_CLIENT_CHECK = "public-client";
@@ -123,6 +124,56 @@ export async function recordPublicClient(smoke: Smoke, staged: string | null, op
 	return verdict.matched;
 }
 
+/**
+ * What the relay Worker is BUILT from, relative to the app's checkout: every file reachable by
+ * relative import from wrangler's `main` (the Worker reaches into `src/` — roms'
+ * `../src/server/limits`, station's `../scripts/link`), plus the config and the lockfile that pin
+ * what it bundles from `node_modules`. Test files are never reachable, so a test-only change
+ * does not re-ship. Unresolvable edges are skipped; esbuild would refuse them anyway.
+ */
+export function workerInputs(root: string, main = "worker/index.ts"): string[] {
+	const seen = new Set<string>();
+	const queue = [resolve(root, main)];
+	while (queue.length > 0) {
+		const file = queue.shift() as string;
+		if (seen.has(file)) continue;
+		seen.add(file);
+		let code: string;
+		try {
+			code = readFileSync(file, "utf8").replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:"'`])\/\/.*$/gm, "$1");
+		} catch {
+			continue;
+		}
+		for (const spec of valueImports(code)) {
+			if (!spec.startsWith(".")) continue;
+			const base = resolve(dirname(file), spec);
+			const hit = [base, `${base}.ts`, `${base}.tsx`, `${base}.js`, join(base, "index.ts")].find(
+				(candidate) => existsSync(candidate) && statSync(candidate).isFile(),
+			);
+			if (hit) queue.push(hit);
+		}
+	}
+	const files = [...seen].map((file) => relative(root, file)).sort();
+	return [...files, "wrangler.jsonc", "package.json", "bun.lock"];
+}
+
+/**
+ * Pure: does the served Worker need re-uploading? `served` is `/healthz`'s `worker` object;
+ * `diffStatus` is `git diff --quiet <served.commit> HEAD -- <inputs>`'s exit status (0 same,
+ * 1 changed, anything else — an unknown or unreachable commit — unknowable). Null when it is
+ * current; otherwise the sentence saying why it is not. Unknown is behind: shipping is
+ * idempotent, and believing a fix is live when it is not is the failure this exists for.
+ */
+export function workerCodeBehind(served: { commit?: unknown; dirty?: unknown } | null, head: string, diffStatus: number | null): string | null {
+	const commit = typeof served?.commit === "string" ? served.commit : "";
+	if (!commit) return "/healthz names no `worker.commit` — nothing says which Worker is serving";
+	if (served?.dirty === true) return `the served Worker (${commit}) was deployed from a dirty tree`;
+	if (head.startsWith(commit) || commit.startsWith(head)) return null;
+	if (diffStatus === 0) return null;
+	if (diffStatus === 1) return `the Worker's code changed since the served Worker (${commit} → ${head.slice(0, 8)})`;
+	return `the served Worker's commit ${commit} is not readable in this checkout — cannot prove it is current`;
+}
+
 export interface ShipClientOptions extends PublicShellOptions {
 	/** The public origin, e.g. `https://roms.cursedalchemy.com`. */
 	base: string;
@@ -132,23 +183,52 @@ export interface ShipClientOptions extends PublicShellOptions {
 	root: string;
 	/** Runs `bun run worker:deploy` in `root`; returns its exit status. Injected for tests. */
 	runWorkerDeploy?: (root: string) => number | null;
+	/** `git <args>` in `root` → exit status and trimmed stdout. Injected for tests. */
+	git?: (root: string, args: readonly string[]) => { status: number | null; stdout: string };
+	/** What the Worker is built from ({@link workerInputs}); default computed from `root`. */
+	workerInputs?: readonly string[];
 	log?: (line: string) => void;
 }
 
 export interface ShipClientResult {
-	/** `already` — the public shell named this build; `shipped` — worker:deploy ran and exited 0; `failed` — it did not. */
+	/** `already` — the public shell named this build AND the served Worker is current; `shipped` — worker:deploy ran and exited 0; `failed` — it did not. */
 	outcome: "already" | "shipped" | "failed";
 	/** worker:deploy's exit status when it ran. */
 	status?: number | null;
 	before: PublicClientVerdict | null;
+	/** Why the Worker itself was behind ({@link workerCodeBehind}), when the client was not the reason. */
+	workerBehind?: string;
+}
+
+const spawnGit = (root: string, args: readonly string[]): { status: number | null; stdout: string } => {
+	const run = spawnSync("git", [...args], { cwd: root, encoding: "utf8" });
+	return { status: run.status, stdout: (run.stdout ?? "").trim() };
+};
+
+/** `/healthz`'s `worker` object, or null when it cannot be read. */
+async function servedWorker(options: ShipClientOptions): Promise<{ commit?: unknown; dirty?: unknown } | null> {
+	try {
+		const ask = options.fetch ?? ((u: string, init: RequestInit) => fetch(u, init));
+		const response = await ask(new URL("/healthz", options.base).toString(), {
+			redirect: "manual",
+			signal: AbortSignal.timeout(options.timeoutMs ?? 20_000),
+			headers: { accept: "application/json", ...(options.headers ?? {}) },
+		});
+		const body = (await response.json()) as { worker?: { commit?: unknown; dirty?: unknown } };
+		return body?.worker ?? null;
+	} catch {
+		return null;
+	}
 }
 
 const spawnWorkerDeploy = (root: string): number | null =>
 	spawnSync("bun", ["run", "worker:deploy"], { cwd: root, stdio: ["ignore", "inherit", "inherit"] }).status;
 
 /**
- * The deploy step: when the public shell does not name this build, run `worker:deploy` (its own
- * stage walk first) so ONE command ships the release. Never throws for a fetch that fails — an
+ * The deploy step: when the public shell does not name this build — or it does but the served
+ * Worker (`/healthz` `worker.commit`) predates a change to what the Worker is built from
+ * ({@link workerInputs}) — run `worker:deploy` (its own stage walk first) so ONE command ships the
+ * release. Never throws for a fetch that fails — an
  * unreadable public shell is "behind", because shipping the Worker is idempotent and the smoke's
  * `public-client` row is what proves it took.
  */
@@ -162,8 +242,25 @@ export async function shipClientIfBehind(options: ShipClientOptions): Promise<Sh
 		);
 		before = comparePublicClient(html, options.staged, options.base);
 		if (before.matched) {
-			log(`  already serving it — ${before.built.join(", ")}`);
-			return { outcome: "already", before };
+			// 🔴 The client matching is not the Worker matching: roms 86e5e522 changed only
+			// worker/index.ts, this said "already serving it", and /healthz kept answering the
+			// previous Worker until worker:deploy was run by hand (2026-09-25).
+			const git = options.git ?? spawnGit;
+			const head = git(options.root, ["rev-parse", "HEAD"]).stdout;
+			const served = await servedWorker(options);
+			const commit = typeof served?.commit === "string" ? served.commit : "";
+			const inputs = options.workerInputs ?? (commit ? workerInputs(options.root) : []);
+			const atHead = commit !== "" && head !== "" && (head.startsWith(commit) || commit.startsWith(head));
+			const diff = commit && head && !atHead ? git(options.root, ["diff", "--quiet", commit, "HEAD", "--", ...inputs]).status : null;
+			const behind = workerCodeBehind(served, head, diff);
+			if (behind === null) {
+				log(`  already serving it — ${before.built.join(", ")}, Worker ${commit}`);
+				return { outcome: "already", before };
+			}
+			log(`  the client is current but ${behind} — shipping the Worker`);
+			log("  running `bun run worker:deploy` — the stage walk, then production");
+			const status = (options.runWorkerDeploy ?? spawnWorkerDeploy)(options.root);
+			return { outcome: status === 0 ? "shipped" : "failed", status, before, workerBehind: behind };
 		}
 		log(`  ${workerBehind(before, options.base, options.root)}`);
 	} else {

package/src/relay.ts

@@ -59,6 +59,16 @@ export interface ResponseFrame {
 
 export type LinkFrame = RequestFrame | ResponseFrame;
 
+/**
+ * The link's keepalive, as bare text (never JSON, so neither {@link parseFrame} nor
+ * {@link parseWarmFrame} can mistake one for a frame). The Mac sends {@link LINK_PING}; the
+ * object answers {@link LINK_PONG} through `setWebSocketAutoResponse`, which the runtime does
+ * WITHOUT waking a hibernated object — so the heartbeat bills nothing. `cursedops/relay-link`
+ * has why it exists: a half-open socket after the Mac slept.
+ */
+export const LINK_PING = "ping";
+export const LINK_PONG = "pong";
+
 /**
  * Sent UP by the Mac once, right after it connects (station, task 089): the GETs every page
  * performs, so a {@link RelayLink} with an offline cache can refresh it while the Mac is awake.
@@ -223,6 +233,8 @@ export interface LinkState {
 	acceptWebSocket(socket: LinkSocket, tags?: string[]): void;
 	getWebSockets(tag?: string): LinkSocket[];
 	storage: LinkStorage;
+	/** workerd's — answers {@link LINK_PING} without waking the object. Optional: a test has none. */
+	setWebSocketAutoResponse?(pair: unknown): void;
 }
 
 /** What `/healthz` and a smoke may know about the link. No content — the body is public. */
@@ -349,6 +361,9 @@ export class RelayLink {
 		this.timeoutMs = options.timeoutMs ?? DEFAULT_RELAY_TIMEOUT_MS;
 		this.maxBodyBytes = options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
 		this.now = options.now ?? Date.now;
+		// The heartbeat's answer, given by the runtime while the object sleeps (see LINK_PING).
+		const Pair = (globalThis as { WebSocketRequestResponsePair?: new (request: string, response: string) => unknown }).WebSocketRequestResponsePair;
+		if (Pair && state.setWebSocketAutoResponse) state.setWebSocketAutoResponse(new Pair(LINK_PING, LINK_PONG));
 	}
 
 	async fetch(request: Request): Promise<Response> {
@@ -499,8 +514,16 @@ export class RelayLink {
 		});
 	}
 
-	webSocketMessage(_socket: LinkSocket, message: string | ArrayBuffer): void | Promise<void> {
+	webSocketMessage(socket: LinkSocket, message: string | ArrayBuffer): void | Promise<void> {
 		if (typeof message !== "string") return;
+		// Only reached where the runtime's auto-response is not armed (a test, an old runtime): a
+		// Mac whose pings went unanswered would redial every minute.
+		if (message === LINK_PING) {
+			try {
+				socket.send(LINK_PONG);
+			} catch {}
+			return;
+		}
 		const warm = parseWarmFrame(message);
 		if (warm) return this.warm(warm.paths);
 		const frame = parseFrame(message);

package/src/relayLink.ts

@@ -10,13 +10,26 @@
  * 🔴 **The Mac listens on nothing for the relay.** What reaches the app arrives down a socket this
  * process opened to a hostname it verified over TLS, holding a key only the Worker's digest matches.
  *
- * 🔴 **No timer asks anything** (owner, 2026-09-15: *"There should be no polling"*). The one
- * `setTimeout` is the reconnect after the socket CLOSES — a sleeping Mac's socket dies, and the link
- * is back within seconds of waking, backing off to a minute while the Worker is unreachable.
+ * 🔴 **No timer asks for DATA** (owner, 2026-09-15: *"There should be no polling"*). One timer
+ * exists, and it is a keepalive on the idle socket, not a request for anything: {@link dialLink}'s
+ * heartbeat. It used to say "a sleeping Mac's socket dies, and the link is back within seconds of
+ * waking" — measured FALSE on 2026-09-25. The owner powered the Mac off and on; both `com.roms.link`
+ * and `com.station.link` came back up holding a socket the Worker had long since dropped. No `close`
+ * event ever fired on the Mac for a half-open TCP connection, so nothing redialed, and roms and
+ * station answered "the Mac is not connected" for every API call with the Mac awake, logging
+ * `✓ linked` the whole time. A `ping` every {@link LINK_HEARTBEAT_MS} that the Worker's object
+ * answers `pong` WITHOUT waking (`setWebSocketAutoResponse`, `cursedops/relay`) is what notices, and
+ * a tick that arrives far later than it was scheduled is the Mac having slept — redialed at once.
  */
 import { spawnSync } from "node:child_process";
 import { chmodSync, existsSync, readFileSync, writeFileSync } from "node:fs";
-import { frameToRequest, parseFrame, type ResponseFrame, responseFrame, sha256Hex, toBase64 } from "cursedops/relay";
+import { frameToRequest, LINK_PING, LINK_PONG, parseFrame, type ResponseFrame, responseFrame, sha256Hex, toBase64 } from "cursedops/relay";
+
+/**
+ * How often an idle link proves the Worker still holds its other end. A dead socket is noticed
+ * within two of these (one ping unanswered), and a slept Mac on its first tick after waking.
+ */
+export const LINK_HEARTBEAT_MS = 30_000;
 import { readEnvFile } from "cursedops/worker-deploy";
 
 export interface LinkSettings {
@@ -129,11 +142,24 @@ export interface DialOptions {
 	/** Sent right after each connect — station's `warm` frame. */
 	onOpen?: (socket: DialSocket) => void;
 	log?: (line: string) => void;
+	/** Default {@link LINK_HEARTBEAT_MS}; 0 turns the heartbeat off (a test of the redial alone). */
+	heartbeatMs?: number;
 	/** Tests only. */
 	openSocket?: (url: string, headers: Record<string, string>) => DialSocket;
 	setTimer?: (fn: () => void, ms: number) => unknown;
+	/** Tests only — a repeating timer; returns its cancel. */
+	every?: (fn: () => void, ms: number) => () => void;
+	/** Tests only — the wall clock the sleep detector reads. */
+	now?: () => number;
 }
 
+const repeat = (fn: () => void, ms: number): (() => void) => {
+	const timer = setInterval(fn, ms);
+	// Never the reason the process stays up — the socket is.
+	(timer as { unref?: () => void }).unref?.();
+	return () => clearInterval(timer);
+};
+
 export interface DialedLink {
 	/** Stop reconnecting and close the socket. */
 	close(): void;
@@ -158,25 +184,75 @@ export function dialLink(options: DialOptions): DialedLink {
 	const log = options.log ?? ((line: string) => console.log(line));
 	const open = options.openSocket ?? bunSocket;
 	const later = options.setTimer ?? ((fn: () => void, ms: number) => setTimeout(fn, ms));
+	const every = options.every ?? repeat;
+	const now = options.now ?? Date.now;
+	const heartbeatMs = options.heartbeatMs ?? LINK_HEARTBEAT_MS;
 	let backoff = 1_000;
 	let stopped = false;
 	let current: DialSocket | null = null;
 	let isOpen = false;
+	let stopHeartbeat: (() => void) | null = null;
 	const connect = () => {
 		if (stopped) return;
 		const socket = open(options.settings.url, { ...(options.headers ?? {}), authorization: `Bearer ${options.settings.key}` });
 		current = socket;
+		/**
+		 * Give up on THIS socket and dial a new one now. 🔴 Never by waiting for its `close`: a
+		 * half-open socket's close handshake waits on a peer that is gone, which is the whole
+		 * failure. Its late events are ignored because it is no longer `current`.
+		 */
+		const abandon = (why: string) => {
+			if (current !== socket) return;
+			stopHeartbeat?.();
+			stopHeartbeat = null;
+			isOpen = false;
+			current = null;
+			log(`[${options.app}-link] ✗ ${why}; redialing now`);
+			try {
+				socket.close(4001, why.slice(0, 120));
+			} catch {}
+			backoff = 1_000;
+			connect();
+		};
+		let awaitingPong = false;
 		socket.addEventListener("open", () => {
+			if (current !== socket) return;
 			backoff = 1_000;
 			isOpen = true;
 			log(`[${options.app}-link] ✓ linked to ${origin} — answering its requests`);
 			options.onOpen?.(socket);
+			if (heartbeatMs > 0) {
+				let lastTick = now();
+				stopHeartbeat = every(() => {
+					const at = now();
+					const late = at - lastTick;
+					lastTick = at;
+					// The timer could not fire because the machine was asleep — whatever the socket
+					// says, the Worker dropped its end long ago (the owner's power cycle, 2026-09-25).
+					if (late > heartbeatMs * 3) return abandon(`no tick for ${Math.round(late / 1000)}s — this Mac slept`);
+					if (awaitingPong) return abandon(`the Worker did not answer a ping within ${heartbeatMs / 1000}s — the socket is half-open`);
+					awaitingPong = true;
+					try {
+						socket.send(LINK_PING);
+					} catch (error) {
+						abandon(`a ping could not be sent (${(error as Error).message})`);
+					}
+				}, heartbeatMs);
+			}
 		});
 		socket.addEventListener("message", async (event) => {
-			const reply = await answerFrame(options.fetch, String(event.data), origin, options.app);
+			if (current !== socket) return;
+			// ANY frame proves the far end is there; a pong carries nothing else.
+			awaitingPong = false;
+			const text = String(event.data);
+			if (text === LINK_PONG) return;
+			const reply = await answerFrame(options.fetch, text, origin, options.app);
 			if (reply) socket.send(JSON.stringify(reply));
 		});
 		socket.addEventListener("close", (event) => {
+			if (current !== socket) return;
+			stopHeartbeat?.();
+			stopHeartbeat = null;
 			isOpen = false;
 			if (stopped) return;
 			log(`[${options.app}-link] link closed (${event.code}${event.reason ? ` ${event.reason}` : ""}); reconnecting in ${backoff / 1000}s`);
@@ -191,6 +267,8 @@ export function dialLink(options: DialOptions): DialedLink {
 	return {
 		close() {
 			stopped = true;
+			stopHeartbeat?.();
+			stopHeartbeat = null;
 			current?.close(1000, "closed by the Mac");
 		},
 		connected: () => isOpen,

package/src/workerDeploy.ts

@@ -38,7 +38,8 @@
  *      check green and its owner unable to sign in; the stage walk is what found why, and a step
  *      in the sequence is one a person in a hurry cannot skip;
  *   5. build → 6. **schema** (`IF NOT EXISTS`, the database named explicitly, never the binding a
- *      forgotten `--env` would resolve) → 7. **deploy with the `--var` stamp** (commit AND dirty
+ *      forgotten `--env` would resolve; ordinary `--command` queries, never the blocking
+ *      `--file` import — {@link schemaApplyArgv}) → 7. **deploy with the `--var` stamp** (commit AND dirty
  *      flag, so `/healthz` publishes what is running) → 8. **secrets** (after the deploy: a secret
  *      needs a script to attach to) → 9. **smoke**.
  *
@@ -238,6 +239,8 @@ export interface DeployDeps {
 	run: (argv: readonly string[], env: Record<string, string>) => number;
 	/** `git <args>` in the checkout; trimmed stdout, `""` on failure. */
 	git: (args: readonly string[]) => string;
+	/** A file in the checkout, as text — the schema. Default: `readFileSync` against the process's cwd. */
+	read?: (path: string) => string;
 	log?: (line: string) => void;
 	error?: (line: string) => void;
 }
@@ -260,13 +263,124 @@ export interface DeployResult {
 export function workerDeployDeps(cwd: string): DeployDeps {
 	return {
 		run: (argv, env) => {
-			console.log(`  $ ${argv.join(" ")}`);
+			// a schema `--command` is kilobytes of DDL — the echo names it, it does not reprint it
+			console.log(`  $ ${argv.map((arg) => (arg.length > 160 ? `${arg.slice(0, 120)}… (${arg.length} chars)` : arg)).join(" ")}`);
 			return spawnSync(argv[0] as string, argv.slice(1), { cwd, stdio: "inherit", env: { ...process.env, ...env } }).status ?? 1;
 		},
 		git: (args) => (spawnSync("git", [...args], { cwd, encoding: "utf8" }).stdout ?? "").trim(),
+		read: (path) => readFileSync(join(cwd, path), "utf8"),
 	};
 }
 
+/**
+ * The statements of a schema file, each on one line with its comments gone — split on the `;`s
+ * that end a statement, never on one inside a string, a quoted name, a comment, or a trigger's
+ * `BEGIN … END` / an expression's `CASE … END`. Hand-written schemas (patterns') format a
+ * CREATE TABLE across lines; generated ones (`d1SchemaText`) are already one per line.
+ */
+export function sqlStatements(text: string): string[] {
+	const statements: string[] = [];
+	let current = "";
+	let depth = 0;
+	let word = "";
+	const endWord = (): void => {
+		const w = word.toUpperCase();
+		word = "";
+		if (w === "CASE") depth++;
+		else if (w === "BEGIN" && /^\s*CREATE\s+(TEMP\s+|TEMPORARY\s+)?TRIGGER\b/i.test(current)) depth++;
+		else if (w === "END" && depth > 0) depth--;
+	};
+	for (let i = 0; i < text.length; i++) {
+		const c = text[i] as string;
+		if (/[A-Za-z_]/.test(c)) {
+			word += c;
+			current += c;
+			continue;
+		}
+		if (word) endWord();
+		if (c === "-" && text[i + 1] === "-") {
+			while (i < text.length && text[i] !== "\n") i++;
+			current += " ";
+			continue;
+		}
+		if (c === "/" && text[i + 1] === "*") {
+			const close = text.indexOf("*/", i + 2);
+			if (close < 0) throw new Error("an unterminated /* comment");
+			i = close + 1;
+			current += " ";
+			continue;
+		}
+		if (c === "'" || c === '"' || c === "`" || c === "[") {
+			const closer = c === "[" ? "]" : c;
+			let j = i + 1;
+			for (;;) {
+				const at = text.indexOf(closer, j);
+				if (at < 0) throw new Error(`an unterminated ${c} quote`);
+				// SQL escapes a quote by doubling it: 'it''s'
+				if (closer !== "]" && text[at + 1] === closer) {
+					j = at + 2;
+					continue;
+				}
+				j = at;
+				break;
+			}
+			current += text.slice(i, j + 1);
+			i = j;
+			continue;
+		}
+		if (c === ";" && depth === 0) {
+			const statement = current.replace(/\s+/g, " ").trim();
+			if (statement) statements.push(statement);
+			current = "";
+			continue;
+		}
+		current += /\s/.test(c) ? " " : c;
+	}
+	if (word) endWord();
+	const tail = current.replace(/\s+/g, " ").trim();
+	if (tail) statements.push(tail);
+	return statements;
+}
+
+/**
+ * D1's limit on one SQL statement is 100 KB; a command is kept well under it (and under any argv
+ * ceiling) by starting a new one before it would cross this many bytes.
+ */
+export const SCHEMA_COMMAND_BYTES = 90_000;
+
+/** {@link sqlStatements}, packed into as few `--command` strings as {@link SCHEMA_COMMAND_BYTES} allows. */
+export function schemaCommands(text: string, maxBytes: number = SCHEMA_COMMAND_BYTES): string[] {
+	const commands: string[] = [];
+	let current = "";
+	for (const statement of sqlStatements(text)) {
+		const next = current ? `${current}; ${statement}` : statement;
+		if (current && Buffer.byteLength(`${next};`) > maxBytes) {
+			commands.push(`${current};`);
+			current = statement;
+		} else current = next;
+	}
+	if (current) commands.push(`${current};`);
+	const over = commands.find((command) => Buffer.byteLength(command) > maxBytes);
+	if (over) throw new Error(`one statement is over ${maxBytes} bytes, past what D1 takes in a query: ${over.slice(0, 80)}…`);
+	return commands;
+}
+
+/**
+ * The schema step's argv — ordinary queries, `wrangler d1 execute --remote --command`, one per
+ * {@link schemaCommands} chunk.
+ *
+ * 🔴 NEVER `--file`. With `--remote`, `--file` goes through D1's IMPORT API, and wrangler says what
+ * that costs: "your D1 database will be unavailable to serve queries" for the length of it — the
+ * same blocking class as `wrangler d1 export`, which failed 72 of 198 concurrent family reads on
+ * 2026-09-24 (`pullD1ToSqlite`'s header). This step runs on every production deploy of every
+ * Worker app with a schema, and the schema is idempotent, so the import blocked production to
+ * change nothing. `--command` runs through the query API like any request the Worker makes.
+ * `workerDeploy.test.ts` pins that no argv here ever carries `--file`.
+ */
+export function schemaApplyArgv(databaseName: string, commands: readonly string[], envArgs: readonly string[]): string[][] {
+	return commands.map((command) => ["bunx", "wrangler", "d1", "execute", databaseName, "--remote", "--command", command, "-y", ...envArgs]);
+}
+
 /**
  * Run the sequence in the header's order, stopping at the first red with a sentence. Never
  * exits — the caller does, with {@link DeployResult.code}.
@@ -319,8 +433,15 @@ export function runWorkerDeploy(spec: WorkerDeploySpec, deps: DeployDeps): Deplo
 	if (spec.databaseName) {
 		const schema = spec.schemaFile ?? "db/schema.sql";
 		step(`apply ${schema} to D1 \`${spec.databaseName}\``);
-		const applied = deps.run(["bunx", "wrangler", "d1", "execute", spec.databaseName, "--remote", "--file", schema, "-y", ...envArgs], spec.credential);
-		if (applied !== 0) return stop("schema", "the schema did not apply — nothing was deployed.");
+		let commands: string[];
+		try {
+			commands = schemaCommands((deps.read ?? ((path: string) => readFileSync(path, "utf8")))(schema));
+		} catch (cause) {
+			return stop("schema", `${schema} could not be read as statements (${(cause as Error).message}) — nothing was deployed.`);
+		}
+		for (const argv of schemaApplyArgv(spec.databaseName, commands, envArgs)) {
+			if (deps.run(argv, spec.credential) !== 0) return stop("schema", "the schema did not apply — nothing was deployed.");
+		}
 	}
 	step(`deploy ${spec.workerName} @ ${commit.slice(0, 8)}${dirty ? " (dirty — stage only)" : ""}`);
 	const stamp = spec.stampVars