cursedops 0.8.0 → 0.8.1

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedops",
-	"version": "0.8.0",
+	"version": "0.8.1",
 	"description": "The build-and-ops answers this generation's apps wrote independently and identically: finding a generation's roots — and printing a command that runs when pasted — without knowing a path, the generation's whole-tree laws run over one repo from a checkout or a worktree, macOS launchd agent install/replace/remove and the live port a job serves, the scaffolding and verdicts of a deployed smoke (origin probe, the smoke's own environment, a network that lies about DNS, a settled version), the static-serving helpers eight apps copied — the path-traversal guard among them — the API floor that keeps an unmatched /api/... from ever being answered with the app shell, the commit and dirty flag a checkout-served process reports, the Cloudflare Worker deploy toolkit four apps copied (the deploy sequence, exact-set secrets over a pipe, origin-first rollback, the curl edge fetch, the row-for-row D1 import proof, the billed-CPU tail check around a deploy's walk and smoke, and each app's worker:secrets and worker:smoke main as one function of its data), the Worker import-graph and await-port checks every Worker app's suite runs over its own source, and the public-surface ratchet three published libraries each carried a forked copy of. Mechanism only — no app knows its name from here. Bun, zero runtime dependencies (typescript is an optional peer, for public-surface only), ships source.",
 	"type": "module",
 	"scripts": {

package/src/edgeFetch.ts

@@ -32,6 +32,8 @@ import { spawnSync } from "node:child_process";
 import { readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+// The package's own subpath, never `./roots.ts` — see `publishShape.test.ts`.
+import { forgeState } from "cursedops/roots";
 
 export interface CurlRun {
 	status: number | null;
@@ -172,3 +174,21 @@ export function createStageEdgeFetch(
 	const { read: _read, ...rest } = options;
 	return { edgeFetch: createEdgeFetch({ ...rest, headersFor: accessHeadersFor }), accessHeadersFor };
 }
+
+/**
+ * THE fleet's edge fetch — {@link createStageEdgeFetch} over `$FORGE_STATE/secrets/cloudflare-access.env`,
+ * the one file every Worker app's smoke, stage walk and CPU tail read the Access token from. Two apps
+ * carried this as a one-line edge-fetch module of their own until task 2145.
+ *
+ * `$FORGE_STATE` comes from the environment or the `forge.env` above `from` (default: wherever this
+ * package is installed, which is inside the generation's checkout). THROWS when neither answers —
+ * a smoke with no idea where its token lives must not guess one.
+ */
+export function fleetEdgeFetch(
+	from: string = import.meta.dir,
+	options: Omit<EdgeFetchOptions, "headersFor"> & { read?: (path: string) => string } = {},
+): ReturnType<typeof createStageEdgeFetch> {
+	const state = forgeState(from);
+	if (!state) throw new Error(`no generation state root above ${from}: set $FORGE_STATE or run inside a checkout with forge.env`);
+	return createStageEdgeFetch(join(state, "secrets", "cloudflare-access.env"), options);
+}