cursedops 0.8.0 → 0.9.0

package/README.md

@@ -12,12 +12,13 @@ bun add cursedops
 | `cursedops/paths` | the generation's whole-tree laws (`check-paths`, `check-doc-citations`, plus any `--also`) run over ONE repo, from a checkout or a worktree — and its `forge-paths` bin (0.5.0) |
 | `cursedops/launchd` | installing, replacing and removing a macOS launchd user agent, and the port a LIVE job serves on (`livePort`, 0.5.0) |
 | `cursedops/smoke` | the scaffolding of a deployed smoke — the ledger, the fetch, the DNS hint, the exit code — the one check no app owns (every address of a deployment serving the same built client), and since 0.5.0 its VERDICTS: the origin asked on loopback, the smoke's own environment, a network that lies about DNS, and a version that has settled |
-| `cursedops/worker-deploy` | the sequence that ships a Cloudflare Worker — clean tree, stage first, schema, `--var` stamp, secrets, smoke — and the readers it needs (0.5.0) |
+| `cursedops/worker-deploy` | the sequence that ships a Cloudflare Worker — clean tree, stage first, schema, `--var` stamp, secrets, smoke — and the readers it needs (0.5.0); `readWranglerFile(root)` since 0.9.0, lifted from four apps' `readWrangler` (task 2153) |
 | `cursedops/worker-deploy` (CPU) | a `wrangler tail` around the traffic a deploy already sends, each request's BILLED CPU charged to its declared route, red on an undeclared, over-budget or uncapped route — and `runWorkerDeploy`'s `stageWalk` + `cpuTail` that wrap the walk and the smoke in it (0.7.0, task 2134, lifted from collections) |
 | `cursedops/worker-secrets` | a Worker holding EXACTLY its deployment's secrets, uploaded over a pipe, read back (0.5.0) |
 | `cursedops/worker-rollback` | a hostname back on its Mac origin: origin first, route second, the route found rather than typed (0.5.0) |
 | `cursedops/edge-fetch` | a request to a deployed Worker as a script must make it — curl pinned past the Mac's negative DNS cache (0.5.0) |
-| `cursedops/d1-import` | a cutover's data proof — SQL literals and the row-for-row comparison, never a count (0.5.0) |
+| `cursedops/d1-import` | a cutover's data proof — SQL literals and the row-for-row comparison, never a count (0.5.0); and `d1SchemaText`, the generated `db/schema.sql` that refuses a statement spanning lines, because D1's exec splits on newlines (0.9.0, lifted from five apps, task 2153) |
+| `cursedops/backups` | `BACKUP_KEEP`, the fleet's one retention for dated snapshots — six apps each exported `KEEP = 14` (0.9.0, task 2153) |
 | `cursedops/serve` | the static tier's four helpers — the path-traversal guard, the MIME table, the hashed-asset test, the crash handlers |
 | `cursedops/api-floor` | the rule that an unmatched `/api/...` is a phrase and never the app shell — the namespace predicates, the trailing-slash normaliser and the default 404 body. No `node:` import, so it mounts inside a Worker |
 | `cursedops/build-info` | which commit a checkout-served process is running and whether its tree was dirty — read once at load, and a `null` retried in the background rather than cached for the life of the process. `node:child_process`, so never in a Worker |

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedops",
-	"version": "0.8.0",
+	"version": "0.9.0",
 	"description": "The build-and-ops answers this generation's apps wrote independently and identically: finding a generation's roots — and printing a command that runs when pasted — without knowing a path, the generation's whole-tree laws run over one repo from a checkout or a worktree, macOS launchd agent install/replace/remove and the live port a job serves, the scaffolding and verdicts of a deployed smoke (origin probe, the smoke's own environment, a network that lies about DNS, a settled version), the static-serving helpers eight apps copied — the path-traversal guard among them — the API floor that keeps an unmatched /api/... from ever being answered with the app shell, the commit and dirty flag a checkout-served process reports, the Cloudflare Worker deploy toolkit four apps copied (the deploy sequence, exact-set secrets over a pipe, origin-first rollback, the curl edge fetch, the row-for-row D1 import proof, the billed-CPU tail check around a deploy's walk and smoke, and each app's worker:secrets and worker:smoke main as one function of its data), the Worker import-graph and await-port checks every Worker app's suite runs over its own source, and the public-surface ratchet three published libraries each carried a forked copy of. Mechanism only — no app knows its name from here. Bun, zero runtime dependencies (typescript is an optional peer, for public-surface only), ships source.",
 	"type": "module",
 	"scripts": {
@@ -110,6 +110,12 @@
 			"source": "./src/stagedClient.ts",
 			"import": "./src/stagedClient.ts"
 		},
+		"./backups": {
+			"types": "./src/backups.ts",
+			"bun": "./src/backups.ts",
+			"source": "./src/backups.ts",
+			"import": "./src/backups.ts"
+		},
 		"./deploy-tree": {
 			"types": "./src/deployTree.ts",
 			"bun": "./src/deployTree.ts",

package/src/backups.ts

@@ -0,0 +1,9 @@
+/**
+ * The fleet's backup retention: how many dated snapshots each app's backup script keeps.
+ *
+ * Six apps (auth, collections, family, music, roms, station) each exported `KEEP = 14` until
+ * task 2153 (2026-09-24). A retention is a POLICY, and a policy held as six constants is six
+ * places a change has to reach — the one that is missed keeps a fortnight while the rest keep
+ * whatever was decided. So it is one number here, and each app's prune takes it.
+ */
+export const BACKUP_KEEP = 14;

package/src/d1Import.ts

@@ -122,3 +122,44 @@ export function wranglerRows(stdout: string): Array<Record<string, unknown>> {
 	const parsed = JSON.parse(stdout.slice(start)) as Array<{ results?: Array<Record<string, unknown>> }>;
 	return parsed.flatMap((result) => result.results ?? []);
 }
+
+/**
+ * `db/schema.sql`'s text: the header every cut-over app wrote by hand, then one statement per line.
+ *
+ * 🔴 **Every statement is ONE LINE, and that is not formatting.** D1's `exec` splits its input on
+ * newlines and treats each line as a statement, so a pretty-printed `CREATE TABLE` fails there with
+ * `D1_EXEC_ERROR: … incomplete input` — and is green on `bun:sqlite` for ever, because that parses
+ * the whole string. So a statement carrying a newline THROWS here rather than being written into a
+ * file that only fails once a person applies it to production. Five apps (auth, collections,
+ * family, music, vault) carried this script as a copy until task 2153.
+ */
+export function d1SchemaText(options: {
+	/** The D1 database's name, as `wrangler d1 execute` takes it. */
+	database: string;
+	/** What the statements were generated from, e.g. `src/server/localDb.ts's migrate()`. */
+	source: string;
+	statements: readonly string[];
+	/** App-specific lines for the header, each written as a `-- ` comment. */
+	notes?: readonly string[];
+}): string {
+	const multiline = options.statements.filter((statement) => /[\r\n]/.test(statement));
+	if (multiline.length > 0) {
+		throw new Error(
+			`${multiline.length} statement(s) span more than one line, and D1's exec splits on newlines: ${multiline[0]?.slice(0, 120)}`,
+		);
+	}
+	const header = [
+		`-- GENERATED by \`bun run schema\` from ${options.source}. Do not edit.`,
+		"--",
+		"-- 🔴 Applied to D1 ONCE, by hand, because a Worker has no boot:",
+		`--   bunx wrangler d1 execute ${options.database} --remote --file db/schema.sql`,
+		"--",
+		"-- Every statement is on ONE LINE: D1's `exec` splits on newlines and treats each line as",
+		"-- a statement, so a formatted CREATE TABLE fails with `incomplete input` there and is",
+		"-- green on bun:sqlite for ever. src/server/schemaMatches.test.ts fails if this file and",
+		"-- migrate() ever disagree.",
+		...(options.notes ?? []).map((line) => `-- ${line}`),
+		"",
+	];
+	return `${header.join("\n")}${options.statements.join("\n")}\n`;
+}

package/src/edgeFetch.ts

@@ -32,6 +32,8 @@ import { spawnSync } from "node:child_process";
 import { readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+// The package's own subpath, never `./roots.ts` — see `publishShape.test.ts`.
+import { forgeState } from "cursedops/roots";
 
 export interface CurlRun {
 	status: number | null;
@@ -172,3 +174,21 @@ export function createStageEdgeFetch(
 	const { read: _read, ...rest } = options;
 	return { edgeFetch: createEdgeFetch({ ...rest, headersFor: accessHeadersFor }), accessHeadersFor };
 }
+
+/**
+ * THE fleet's edge fetch — {@link createStageEdgeFetch} over `$FORGE_STATE/secrets/cloudflare-access.env`,
+ * the one file every Worker app's smoke, stage walk and CPU tail read the Access token from. Two apps
+ * carried this as a one-line edge-fetch module of their own until task 2145.
+ *
+ * `$FORGE_STATE` comes from the environment or the `forge.env` above `from` (default: wherever this
+ * package is installed, which is inside the generation's checkout). THROWS when neither answers —
+ * a smoke with no idea where its token lives must not guess one.
+ */
+export function fleetEdgeFetch(
+	from: string = import.meta.dir,
+	options: Omit<EdgeFetchOptions, "headersFor"> & { read?: (path: string) => string } = {},
+): ReturnType<typeof createStageEdgeFetch> {
+	const state = forgeState(from);
+	if (!state) throw new Error(`no generation state root above ${from}: set $FORGE_STATE or run inside a checkout with forge.env`);
+	return createStageEdgeFetch(join(state, "secrets", "cloudflare-access.env"), options);
+}

package/src/workerDeploy.ts

@@ -51,6 +51,7 @@
  */
 import { spawn, spawnSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
 
 /** The two deployments every Worker app here has. */
 export type WorkerEnv = "production" | "stage";
@@ -89,6 +90,16 @@ export function readWranglerJsonc(text: string): Record<string, unknown> {
 	return JSON.parse(stripped) as Record<string, unknown>;
 }
 
+/**
+ * `<root>/wrangler.jsonc`, read and parsed. Four apps (auth, family, music, vault) each carried
+ * this as its own `readWrangler` until task 2153. It is what tells every CLI
+ * script whether production is the Worker or the Mac (`servedByWorker`), so a copy that drifts
+ * sends a script's writes to a frozen registry.
+ */
+export function readWranglerFile(root: string): Record<string, unknown> {
+	return readWranglerJsonc(readFileSync(join(root, "wrangler.jsonc"), "utf8"));
+}
+
 /**
  * `KEY=value` lines — `export ` tolerated, one layer of surrounding quotes removed (and a POSIX
  * `'\''` inside single quotes read back as `'`), `#` lines and blanks skipped. The reader every