cursedops 0.17.0 → 0.18.0

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedops",
-	"version": "0.17.0",
+	"version": "0.18.0",
 	"description": "The build-and-ops answers this generation's apps wrote independently and identically: finding a generation's roots — and printing a command that runs when pasted — without knowing a path, the generation's whole-tree laws run over one repo from a checkout or a worktree, macOS launchd agent install/replace/remove and the live port a job serves, the scaffolding and verdicts of a deployed smoke (origin probe, the smoke's own environment, a network that lies about DNS, a settled version), the static-serving helpers eight apps copied — the path-traversal guard among them — the API floor that keeps an unmatched /api/... from ever being answered with the app shell, the commit and dirty flag a checkout-served process reports, the Cloudflare Worker deploy toolkit four apps copied (the deploy sequence, exact-set secrets over a pipe, origin-first rollback, the curl edge fetch, the row-for-row D1 import proof, the billed-CPU tail check around a deploy's walk and smoke, and each app's worker:secrets and worker:smoke main as one function of its data), the relay a Worker fronts a Mac-bound app with (the Durable Object, the frames, the Mac's dialer and key rotation — lifted from station for roms — and the signed-in stage walk's skeleton and the relay app's whole worker:deploy), the Worker import-graph and await-port checks every Worker app's suite runs over its own source, and the public-surface ratchet three published libraries each carried a forked copy of. Mechanism only — no app knows its name from here. Bun, zero runtime dependencies (typescript is an optional peer, for public-surface only), ships source.",
 	"type": "module",
 	"scripts": {

package/src/relayStage.ts

@@ -220,13 +220,14 @@ export async function putStageLinkDigest(put: DigestPut): Promise<{ ok: boolean;
 	return { ok: held.converged, stderr: done.stderr, detail: `every answer holds it — ${held.detail}` };
 }
 
-/**
- * Sign the stage owner in through auth-stage's emailed second factor and grant `app`'s stage —
- * `apps/auth-stage/scripts/inbox.ts` `grant <app>`, whose last stdout line is the grant.
- * Never production's accounts service: nothing under test signs in there (`tools/check-prod-auth.ts`).
- */
-export function grantStageOwner(spec: { forge: string; app: string; run?: Run; stderr?: (text: string) => void }): { ok: boolean; grant: string } {
-	const done = (spec.run ?? realRun)(["bun", "run", "scripts/inbox.ts", "grant", spec.app], {
+/** Which stage account a grant signs in as — `inbox.ts`'s `StageAccount`. */
+type StageAccount = "owner" | "member";
+
+type GrantSpec = { forge: string; app: string; run?: Run; stderr?: (text: string) => void };
+
+/** `apps/auth-stage/scripts/inbox.ts` `grant <app> [--member]`, whose last stdout line is the grant. */
+function grantStage(spec: GrantSpec, account: StageAccount): { ok: boolean; grant: string } {
+	const done = (spec.run ?? realRun)(["bun", "run", "scripts/inbox.ts", "grant", spec.app, ...(account === "member" ? ["--member"] : [])], {
 		cwd: join(spec.forge, "apps", "auth-stage"),
 		timeout: 300_000,
 	});
@@ -235,6 +236,23 @@ export function grantStageOwner(spec: { forge: string; app: string; run?: Run; s
 	return { ok: done.status === 0 && grant.length > 100, grant };
 }
 
+/**
+ * Sign the stage owner in through auth-stage's emailed second factor and grant `app`'s stage.
+ * Never production's accounts service: nothing under test signs in there (`tools/check-prod-auth.ts`).
+ */
+export function grantStageOwner(spec: GrantSpec): { ok: boolean; grant: string } {
+	return grantStage(spec, "owner");
+}
+
+/**
+ * The same grant for the stage's seeded household MEMBER — an ordinary account, never the owner —
+ * so a walk can prove on the real edge what an app keeps from everyone but its owner (roms' closed
+ * consoles, forge task 3288). Same door, same rules: never production's accounts service.
+ */
+export function grantStageMember(spec: GrantSpec): { ok: boolean; grant: string } {
+	return grantStage(spec, "member");
+}
+
 export interface RotationSpec {
 	/** Stop the Mac end, resolving once it has exited. */
 	stop: () => Promise<void>;