cursedops 0.19.5 → 0.20.0

package/README.md

@@ -15,6 +15,7 @@ import shape, worked example, and the incident each one is pinned to.
 | `cursedops/roots` | finding a generation's roots and a checkout's package root without knowing a path, and `repoCd`/`repoCommand`, the `cd` prefix of a printed command that RUNS when pasted |
 | `cursedops/paths` | the generation's whole-tree laws (`check-paths`, `check-doc-citations`, plus any `--also`) run over ONE repo, from a checkout or a worktree — and its `forge-paths` bin |
 | `cursedops/launchd` | installing, replacing and removing a macOS launchd user agent, and the port a LIVE job serves on (`livePort`) |
+| `cursedops/launchd-imports` | the check that every launchd job — run straight out of an app's main checkout — imports only what the LOCKED versions of its packages export, so a lib-preview overlay's extra subpath or name cannot kill it at the next `bun install --force` (`launchdImportFaults`) |
 | `cursedops/smoke` | the scaffolding of a deployed smoke (ledger, fetch, DNS hint, exit code) — the one check no app owns — plus its VERDICTS: the origin asked on loopback, the smoke's own environment, a network that lies about DNS, and a version that has settled |
 | `cursedops/worker-deploy` | the sequence that ships a Cloudflare Worker — clean tree, stage first, schema, `--var` stamp, secrets, smoke — plus a billed-CPU tail wrapped around the walk and the smoke, and a ledger line per run |
 | `cursedops/worker-secrets` | a Worker holding EXACTLY its deployment's secrets, uploaded over a pipe, read back up to five times before an inexact set is believed |

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "cursedops",
-	"version": "0.19.5",
-	"description": "The build-and-ops answers this generation's apps wrote independently and identically: finding a generation's roots — and printing a command that runs when pasted — without knowing a path, the generation's whole-tree laws run over one repo from a checkout or a worktree, macOS launchd agent install/replace/remove and the live port a job serves, the scaffolding and verdicts of a deployed smoke (origin probe, the smoke's own environment, a network that lies about DNS, a settled version), the static-serving helpers eight apps copied — the path-traversal guard among them — the API floor that keeps an unmatched /api/... from ever being answered with the app shell, the commit and dirty flag a checkout-served process reports, the Cloudflare Worker deploy toolkit four apps copied (the deploy sequence, exact-set secrets over a pipe, origin-first rollback, the curl edge fetch, the row-for-row D1 import proof, the billed-CPU tail check around a deploy's walk and smoke, and each app's worker:secrets and worker:smoke main as one function of its data), the relay a Worker fronts a Mac-bound app with (the Durable Object, the frames, the Mac's dialer and key rotation — lifted from station for roms — and the signed-in stage walk's skeleton and the relay app's whole worker:deploy), the Worker import-graph and await-port checks every Worker app's suite runs over its own source, and the public-surface ratchet three published libraries each carried a forked copy of. Mechanism only — no app knows its name from here. Bun, zero runtime dependencies (typescript is an optional peer, for public-surface only), ships source.",
+	"version": "0.20.0",
+	"description": "The build-and-ops answers this generation's apps wrote independently and identically: finding a generation's roots — and printing a command that runs when pasted — without knowing a path, the generation's whole-tree laws run over one repo from a checkout or a worktree, macOS launchd agent install/replace/remove and the live port a job serves, the check that a launchd job imports only what the LOCKED versions of its packages export (a lib-preview overlay's extra subpath or name is a job that dies at the next forced reinstall), the scaffolding and verdicts of a deployed smoke (origin probe, the smoke's own environment, a network that lies about DNS, a settled version), the static-serving helpers eight apps copied — the path-traversal guard among them — the API floor that keeps an unmatched /api/... from ever being answered with the app shell, the commit and dirty flag a checkout-served process reports, the Cloudflare Worker deploy toolkit four apps copied (the deploy sequence, exact-set secrets over a pipe, origin-first rollback, the curl edge fetch, the row-for-row D1 import proof, the billed-CPU tail check around a deploy's walk and smoke, and each app's worker:secrets and worker:smoke main as one function of its data), the relay a Worker fronts a Mac-bound app with (the Durable Object, the frames, the Mac's dialer and key rotation — lifted from station for roms — and the signed-in stage walk's skeleton and the relay app's whole worker:deploy), the Worker import-graph and await-port checks every Worker app's suite runs over its own source, and the public-surface ratchet three published libraries each carried a forked copy of. Mechanism only — no app knows its name from here. Bun, zero runtime dependencies (typescript is an optional peer, for public-surface only), ships source.",
 	"type": "module",
 	"scripts": {
 		"typecheck": "tsc -p tsconfig.json --noEmit",
@@ -25,6 +25,12 @@
 			"source": "./src/launchd.ts",
 			"import": "./src/launchd.ts"
 		},
+		"./launchd-imports": {
+			"types": "./src/launchdImports.ts",
+			"bun": "./src/launchdImports.ts",
+			"source": "./src/launchdImports.ts",
+			"import": "./src/launchdImports.ts"
+		},
 		"./api-floor": {
 			"types": "./src/apiFloor.ts",
 			"bun": "./src/apiFloor.ts",

package/src/launchdImports.ts

@@ -0,0 +1,243 @@
+/**
+ * 🔴 A launchd job imports, AT RUNTIME, only what the LOCKED versions of its packages provide.
+ *
+ * Found building forge task 3579 (2026-10-22) in collections, lifted here by forge task 3756 so
+ * every app with a launchd job runs it. A job — a scheduled script, a backup, a server — runs
+ * `bun run <entry>` straight out of an app's MAIN checkout. An unpublished library is tried with
+ * the generation's `tools/lib-preview.ts`, which overlays its build into `node_modules` under the
+ * locked version's name; `bun install --force` (the generation's standing advice before hunting a
+ * phantom bug) puts the locked bytes back. A job that imports a subpath only the overlay has then
+ * dies on its first import, every run, until the publish — and the gate, the typecheck and every
+ * test stay green, because they all read the overlay.
+ *
+ * So {@link launchdImportFaults} walks each entry's import graph (type-only imports are erased and
+ * skipped, as Bun skips them) and, for every package carrying a `lib-preview` mark, requires the
+ * subpath to be an export of the version `bun.lock` names, read from bun's own cache — and every
+ * NAME imported from it to be one that version's module exports. A subpath alone was not enough
+ * (forge task 3752): a new function added to `cursedbelt-server/dropzone` imports from a subpath the
+ * locked version already has, and the job dies on that one missing binding just the same.
+ *
+ * The fix when it reds is to import that thing by TYPE only, move what the job needs into a leaf
+ * with no such import, or wait for the publish.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+
+/** A runtime import of a package: who imports it, the `pkg` / `./subpath` it names, and the bindings it takes. */
+export interface PackageImport {
+	from: string;
+	pkg: string;
+	subpath: string;
+	/** Each named binding (`default` for a default import). Empty for `* as`, which cannot miss one. */
+	names: string[];
+}
+
+/** An import a forced reinstall would break, and why. */
+export interface PreviewOnlyImport {
+	import: PackageImport;
+	locked: string;
+	why: string;
+}
+
+const transpilers = {
+	ts: new Bun.Transpiler({ loader: "ts" }),
+	tsx: new Bun.Transpiler({ loader: "tsx" }),
+};
+
+/** The transpiler a file is read with — a `.ts` file's `<T>x` cast is not JSX. */
+function transpilerFor(file: string): Bun.Transpiler {
+	return file.endsWith(".tsx") ? transpilers.tsx : transpilers.ts;
+}
+
+/**
+ * The bindings each runtime `import … from` and `export { … } from` statement in `source` takes,
+ * by specifier — after types are erased, as Bun erases them.
+ */
+export function importedNames(source: string, transpiler: Bun.Transpiler = transpilers.tsx): Map<string, string[]> {
+	const out = new Map<string, string[]>();
+	const code = transpiler.transformSync(source);
+	const add = (specifier: string, name: string): void => {
+		const names = out.get(specifier) ?? [];
+		if (name) names.push(name);
+		out.set(specifier, names);
+	};
+	for (const [, clause = "", specifier = ""] of code.matchAll(/^import\s+([^"';]+?)\s+from\s*["']([^"']+)["']/gm)) {
+		add(specifier, "");
+		const braces = clause.match(/\{([^}]*)\}/)?.[1];
+		const head = clause.replace(/\{[^}]*\}/, "").replace(/,/g, " ").trim();
+		if (head && !head.startsWith("*")) add(specifier, "default");
+		for (const part of braces?.split(",") ?? []) add(specifier, part.trim().split(/\s+as\s+/)[0]?.trim() ?? "");
+	}
+	for (const [, braces = "", specifier = ""] of code.matchAll(/^export\s*\{([^}]*)\}\s*from\s*["']([^"']+)["']/gm))
+		for (const part of braces.split(",")) add(specifier, part.trim().split(/\s+as\s+/)[0]?.trim() ?? "");
+	return out;
+}
+
+const EXTENSIONS = ["", ".ts", ".tsx", "/index.ts", "/index.tsx"];
+
+/** The repo file a relative specifier lands on, `.js` spelling included — null outside TypeScript. */
+function resolveLocal(file: string, specifier: string): string | null {
+	const base = resolve(dirname(file), specifier);
+	const bases = /\.[cm]?js$/.test(base) ? [base, base.replace(/\.([cm]?)js$/, ".$1ts")] : [base];
+	for (const candidate of bases.flatMap((stem) => EXTENSIONS.map((ext) => `${stem}${ext}`)))
+		if (existsSync(candidate) && /\.tsx?$/.test(candidate)) return candidate;
+	return null;
+}
+
+/** Every runtime package import reachable from `entry` through the repo's own files. */
+export function runtimeImports(entry: string): PackageImport[] {
+	const seen = new Set<string>();
+	const out: PackageImport[] = [];
+	const visit = (file: string): void => {
+		if (seen.has(file)) return;
+		seen.add(file);
+		// A shebang is not TypeScript; the transpiler refuses the whole file over one.
+		const source = readFileSync(file, "utf8").replace(/^#!.*/, "");
+		const transpiler = transpilerFor(file);
+		const names = importedNames(source, transpiler);
+		for (const { path } of transpiler.scanImports(source)) {
+			if (path.startsWith(".") || path.startsWith("/")) {
+				const hit = resolveLocal(file, path);
+				if (hit) visit(hit);
+				continue;
+			}
+			if (path.startsWith("node:") || path.startsWith("bun:") || path === "bun") continue;
+			const parts = path.split("/");
+			const pkg = path.startsWith("@") ? parts.slice(0, 2).join("/") : (parts[0] as string);
+			const rest = path.slice(pkg.length);
+			out.push({ from: file, pkg, subpath: rest ? `.${rest}` : ".", names: names.get(path) ?? [] });
+		}
+	};
+	visit(entry);
+	return out;
+}
+
+/** Does this `exports` map name the subpath, directly or through a `*` pattern? */
+export function exported(exportsMap: unknown, subpath: string): boolean {
+	if (exportsMap === undefined || typeof exportsMap === "string") return subpath === ".";
+	const keys = Object.keys(exportsMap as object);
+	if (!keys.some((key) => key.startsWith("."))) return subpath === ".";
+	return keys.some((key) => {
+		if (key === subpath) return true;
+		const star = key.indexOf("*");
+		return star >= 0 && subpath.startsWith(key.slice(0, star)) && subpath.endsWith(key.slice(star + 1));
+	});
+}
+
+/** The file an `exports` entry sends Bun to — its `bun` condition first, as Bun resolves it, and a `*` pattern filled in. */
+export function exportTarget(exportsMap: unknown, subpath: string): string | null {
+	let entry: unknown;
+	let fill = "";
+	if (exportsMap === undefined || typeof exportsMap === "string") entry = subpath === "." ? exportsMap : undefined;
+	else {
+		const map = exportsMap as Record<string, unknown>;
+		entry = map[subpath];
+		if (entry === undefined)
+			for (const key of Object.keys(map)) {
+				const star = key.indexOf("*");
+				const [head, tail] = [key.slice(0, star), key.slice(star + 1)];
+				if (star >= 0 && subpath.startsWith(head) && subpath.endsWith(tail) && subpath.length >= head.length + tail.length) {
+					entry = map[key];
+					fill = subpath.slice(head.length, subpath.length - tail.length);
+					break;
+				}
+			}
+	}
+	const pick = (target: string): string => target.replace("*", fill);
+	if (typeof entry === "string") return pick(entry);
+	if (!entry || typeof entry !== "object") return null;
+	const conditions = entry as Record<string, unknown>;
+	for (const condition of ["bun", "import", "default"]) if (typeof conditions[condition] === "string") return pick(conditions[condition] as string);
+	return null;
+}
+
+/** Every runtime name a module exports, through its `export * from "./…"` re-exports; `null` when one cannot be read. */
+export function moduleExports(file: string, seen = new Set<string>()): Set<string> | null {
+	if (seen.has(file)) return new Set();
+	seen.add(file);
+	if (!existsSync(file)) return null;
+	const source = readFileSync(file, "utf8");
+	const names = new Set(new Bun.Transpiler({ loader: file.endsWith(".tsx") ? "tsx" : "ts" }).scan(source).exports);
+	for (const [, from = ""] of source.matchAll(/^export\s+\*\s+from\s*["'](\.[^"']+)["']/gm)) {
+		const base = resolve(dirname(file), from.replace(/\.js$/, ""));
+		const hit = EXTENSIONS.map((ext) => `${base}${ext}`).find((candidate) => existsSync(candidate) && /\.[jt]sx?$/.test(candidate));
+		const inner = hit ? moduleExports(hit, seen) : null;
+		if (!inner) return null;
+		for (const name of inner) names.add(name);
+	}
+	return names;
+}
+
+/**
+ * The imports a forced reinstall would break: each `pkg/subpath` whose installed copy is a
+ * lib-preview overlay and whose LOCKED version does not export it, or not every name taken from it.
+ * A locked version missing from the cache cannot be proven either way, so it is reported too —
+ * fail closed for a live job.
+ */
+export function previewOnlyImports(imports: readonly PackageImport[], nodeModules: string, cacheDir: string): PreviewOnlyImport[] {
+	const out: PreviewOnlyImport[] = [];
+	for (const imported of imports) {
+		const markPath = join(nodeModules, imported.pkg, ".lib-preview.json");
+		if (!existsSync(markPath)) continue;
+		const { locked } = JSON.parse(readFileSync(markPath, "utf8")) as { locked: string };
+		const lockedPkg = join(cacheDir, `${imported.pkg}@${locked}@@@1`, "package.json");
+		if (!existsSync(lockedPkg)) {
+			out.push({ import: imported, locked, why: `the locked ${imported.pkg}@${locked} is not in bun's cache to check against` });
+			continue;
+		}
+		const { exports } = JSON.parse(readFileSync(lockedPkg, "utf8")) as { exports?: unknown };
+		if (!exported(exports, imported.subpath)) {
+			out.push({ import: imported, locked, why: `${imported.pkg}@${locked} (what bun.lock installs) has no export "${imported.subpath}"` });
+			continue;
+		}
+		if (imported.names.length === 0) continue;
+		const target = exportTarget(exports, imported.subpath);
+		const names = target ? moduleExports(join(dirname(lockedPkg), target)) : null;
+		const missing = names ? imported.names.filter((name) => !names.has(name)) : imported.names;
+		if (missing.length > 0)
+			out.push({
+				import: imported,
+				locked,
+				why: names
+					? `${imported.pkg}@${locked} (what bun.lock installs) exports "${imported.subpath}" but not ${missing.join(", ")}`
+					: `${imported.pkg}@${locked}'s "${imported.subpath}" module could not be read to check ${missing.join(", ")} against`,
+			});
+	}
+	return out;
+}
+
+/** Bun's install cache, where every locked version sits unpacked — `BUN_INSTALL_CACHE_DIR` first, as bun reads it. */
+export function bunCacheDir(env: Record<string, string | undefined> = process.env): string {
+	return env.BUN_INSTALL_CACHE_DIR ?? join(env.BUN_INSTALL ?? join(homedir(), ".bun"), "install", "cache");
+}
+
+/** Where {@link launchdImportFaults} looks, when an app's own test does not say. */
+export interface LaunchdImportOptions {
+	/** The `node_modules` the jobs resolve from. Default `<root>/node_modules`. */
+	nodeModules?: string;
+	/** Bun's install cache. Default {@link bunCacheDir}. */
+	cacheDir?: string;
+}
+
+/**
+ * The one call an app's test makes: every entry a launchd job runs (relative to `root`, such as
+ * `scripts/<job>.ts`), walked and checked — one line per import a forced reinstall would break,
+ * so `expect(launchdImportFaults(ROOT, entries)).toEqual([])` names each in its failure. An entry
+ * that is not there is a fault too: a renamed script would otherwise pass by checking nothing.
+ */
+export function launchdImportFaults(root: string, entries: readonly string[], options: LaunchdImportOptions = {}): string[] {
+	const nodeModules = options.nodeModules ?? join(root, "node_modules");
+	const cacheDir = options.cacheDir ?? bunCacheDir();
+	const faults: string[] = [];
+	for (const entry of entries) {
+		const file = join(root, entry);
+		if (!existsSync(file)) {
+			faults.push(`${entry} — a launchd job runs it, and it is not there`);
+			continue;
+		}
+		for (const { import: imported, why } of previewOnlyImports(runtimeImports(file), nodeModules, cacheDir))
+			faults.push(`${imported.from.slice(root.length + 1)} imports ${imported.pkg}${imported.subpath.slice(1)} — ${why}`);
+	}
+	return faults;
+}

package/src/workerSecrets.ts

@@ -97,7 +97,7 @@ export const SECRET_PUT_ATTEMPTS = 3;
  * Reads of the account after the puts before a set that is not exact is believed. A read changes
  * nothing, so asking again can only replace a stale answer with a current one — see {@link syncSecrets}.
  */
-export const SECRET_READBACK_ATTEMPTS = 5;
+export const SECRET_READBACK_ATTEMPTS = 8;
 
 /**
  * Apply `plan`: put every value, delete every extra, then READ THE ACCOUNT BACK and fail unless it
@@ -113,6 +113,9 @@ export const SECRET_READBACK_ATTEMPTS = 5;
  * listed both secrets, both puts said ok, and the list read straight after answered NOTHING — a
  * green deploy stopped as "secrets NOT attached". The same script run again a minute later read
  * both. The LAST read is the verdict, so a set that is really wrong is still a red.
+ * Eight reads, pausing 2 s more each time, wait 56 s: on 2026-10-24 (ship run 20-24-05) photos'
+ * FIRST put of FAMILY_PEOPLE_TOKEN said ok and five reads over 20 s never listed it, so the deploy
+ * stopped as "secrets NOT attached"; `--check` a few minutes later read it held.
  */
 export async function syncSecrets(
 	plan: SecretPlan,