cursedops 0.9.0 → 0.9.2

package/README.md

@@ -17,7 +17,7 @@ bun add cursedops
 | `cursedops/worker-secrets` | a Worker holding EXACTLY its deployment's secrets, uploaded over a pipe, read back (0.5.0) |
 | `cursedops/worker-rollback` | a hostname back on its Mac origin: origin first, route second, the route found rather than typed (0.5.0) |
 | `cursedops/edge-fetch` | a request to a deployed Worker as a script must make it — curl pinned past the Mac's negative DNS cache (0.5.0) |
-| `cursedops/d1-import` | a cutover's data proof — SQL literals and the row-for-row comparison, never a count (0.5.0); and `d1SchemaText`, the generated `db/schema.sql` that refuses a statement spanning lines, because D1's exec splits on newlines (0.9.0, lifted from five apps, task 2153) |
+| `cursedops/d1-import` | a cutover's data proof — SQL literals and the row-for-row comparison, never a count (0.5.0); and `d1SchemaText`, the generated `db/schema.sql` that refuses a statement spanning lines, because D1's exec splits on newlines (0.9.0, lifted from five apps, task 2153) — and its `forge-d1-schema` bin (0.9.1), so no app carries its own schema script at all |
 | `cursedops/backups` | `BACKUP_KEEP`, the fleet's one retention for dated snapshots — six apps each exported `KEEP = 14` (0.9.0, task 2153) |
 | `cursedops/serve` | the static tier's four helpers — the path-traversal guard, the MIME table, the hashed-asset test, the crash handlers |
 | `cursedops/api-floor` | the rule that an unmatched `/api/...` is a phrase and never the app shell — the namespace predicates, the trailing-slash normaliser and the default 404 body. No `node:` import, so it mounts inside a Worker |

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedops",
-	"version": "0.9.0",
+	"version": "0.9.2",
 	"description": "The build-and-ops answers this generation's apps wrote independently and identically: finding a generation's roots — and printing a command that runs when pasted — without knowing a path, the generation's whole-tree laws run over one repo from a checkout or a worktree, macOS launchd agent install/replace/remove and the live port a job serves, the scaffolding and verdicts of a deployed smoke (origin probe, the smoke's own environment, a network that lies about DNS, a settled version), the static-serving helpers eight apps copied — the path-traversal guard among them — the API floor that keeps an unmatched /api/... from ever being answered with the app shell, the commit and dirty flag a checkout-served process reports, the Cloudflare Worker deploy toolkit four apps copied (the deploy sequence, exact-set secrets over a pipe, origin-first rollback, the curl edge fetch, the row-for-row D1 import proof, the billed-CPU tail check around a deploy's walk and smoke, and each app's worker:secrets and worker:smoke main as one function of its data), the Worker import-graph and await-port checks every Worker app's suite runs over its own source, and the public-surface ratchet three published libraries each carried a forked copy of. Mechanism only — no app knows its name from here. Bun, zero runtime dependencies (typescript is an optional peer, for public-surface only), ships source.",
 	"type": "module",
 	"scripts": {
@@ -126,7 +126,8 @@
 	"bin": {
 		"public-surface": "./src/publicSurface.ts",
 		"forge-paths": "./src/paths.ts",
-		"forge-client": "./src/stagedClient.ts"
+		"forge-client": "./src/stagedClient.ts",
+		"forge-d1-schema": "./src/d1Schema.ts"
 	},
 	"files": [
 		"src",

package/src/d1Schema.ts

@@ -0,0 +1,80 @@
+#!/usr/bin/env bun
+/**
+ * `forge-d1-schema --database <name> --from <module> [--note "<line>"]…` — write `db/schema.sql`,
+ * the shape a Worker app's D1 is given, from the module's `schemaStatements()`.
+ *
+ * ```jsonc
+ * // an app's package.json — the script line IS the configuration
+ * "schema": "forge-d1-schema --database music --from src/server/localDb.ts"
+ * ```
+ *
+ * ## 🔴 Why the file is GENERATED and never hand-written
+ *
+ * A Worker has no boot. An app's `migrate()` issues dozens of statements and inspects
+ * `PRAGMA table_info` as it goes; running that on every invocation would spend a D1 invocation's
+ * query budget before the request started, and D1 has no `PRAGMA table_info` to inspect with. So
+ * D1's schema is applied ONCE, by hand — `bunx wrangler d1 execute <name> --remote --file
+ * db/schema.sql` — and there are two descriptions of the app's tables. Each app's own
+ * schema-matches test fails its gate when they disagree, so the file is a build product with a
+ * checker rather than a document with a convention. {@link d1SchemaText} writes it, and refuses a
+ * statement that spans lines, because D1's `exec` splits on newlines.
+ *
+ * ## Why this is a bin and not a function each app calls
+ *
+ * Five apps (auth, collections, family, music, vault) each carried its own schema script until task
+ * 2153 (2026-09-24). A thinner wrapper around {@link d1SchemaText} was still five files that agree
+ * line for line on everything but two strings, and `tools/check-copies.ts` rightly priced them as
+ * one file forked five ways. The only thing that differs per app is data — the database name, the
+ * module, a note — and data fits in the one line of `package.json` that already names the command.
+ */
+import { mkdirSync, writeFileSync } from "node:fs";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+import { d1SchemaText } from "cursedops/d1-import";
+
+export type D1SchemaArgs = { database: string; from: string; exportName: string; notes: string[]; out: string };
+
+/** The flags, or the sentence saying what is missing. */
+export function parseD1SchemaArgs(argv: readonly string[]): D1SchemaArgs | string {
+	const args: D1SchemaArgs = { database: "", from: "", exportName: "schemaStatements", notes: [], out: join("db", "schema.sql") };
+	for (let i = 0; i < argv.length; i++) {
+		const flag = argv[i];
+		const value = argv[i + 1];
+		if (value === undefined) return `${flag} needs a value`;
+		if (flag === "--database") args.database = value;
+		else if (flag === "--from") args.from = value;
+		else if (flag === "--export") args.exportName = value;
+		else if (flag === "--note") args.notes.push(value);
+		else if (flag === "--out") args.out = value;
+		else return `unknown flag ${flag}`;
+		i++;
+	}
+	if (!args.database) return "--database <name> is required — the D1 database, as `wrangler d1 execute` takes it";
+	if (!args.from) return "--from <module> is required — the module whose schemaStatements() is the schema";
+	return args;
+}
+
+/** Write the file under `cwd` (the app's root, where `bun run` starts a script). Exit code. */
+export async function runD1SchemaCli(argv: readonly string[], cwd: string = process.cwd()): Promise<number> {
+	const args = parseD1SchemaArgs(argv);
+	if (typeof args === "string") {
+		console.error(`✗ forge-d1-schema: ${args}\nusage: forge-d1-schema --database <name> --from <module> [--export <fn>] [--note "<line>"]… [--out <file>]`);
+		return 2;
+	}
+	const module = (await import(resolve(cwd, args.from))) as Record<string, unknown>;
+	const read = module[args.exportName];
+	if (typeof read !== "function") {
+		console.error(`✗ forge-d1-schema: ${args.from} exports no function ${args.exportName}()`);
+		return 2;
+	}
+	const statements = (await read()) as string[];
+	const out = isAbsolute(args.out) ? args.out : join(cwd, args.out);
+	const text = d1SchemaText({ database: args.database, source: `${args.from}'s ${args.exportName}()`, statements, notes: args.notes });
+	mkdirSync(dirname(out), { recursive: true });
+	writeFileSync(out, text);
+	console.log(`[${args.database}] wrote ${statements.length} statement(s) to ${args.out}`);
+	return 0;
+}
+
+if (import.meta.main) {
+	process.exit(await runD1SchemaCli(process.argv.slice(2)));
+}

package/src/workerDeploy.ts

@@ -243,8 +243,11 @@ export interface DeployDeps {
 }
 
 export interface DeployResult {
-	/** 0 shipped and smoked; 1 refused or failed — the step says where. */
-	code: 0 | 1;
+	/**
+	 * 0 shipped and smoked; 1 refused or failed — the step says where; {@link TAIL_UNATTACHED_EXIT}
+	 * shipped and smoked green with its Worker CPU UNMEASURED (step `cpu-unmeasured`).
+	 */
+	code: 0 | 1 | typeof TAIL_UNATTACHED_EXIT;
 	/** The step it stopped at, or `"done"`. */
 	step: string;
 	/** Why it stopped, or the success line. */
@@ -280,6 +283,8 @@ export function runWorkerDeploy(spec: WorkerDeploySpec, deps: DeployDeps): Deplo
 		return { code: 1, step, detail, commit, dirty };
 	};
 	const step = (message: string): void => log(`\n▸ ${message}`);
+	/** What passed under a CPU tail that never attached — decision 6 of the CPU check. */
+	const unmeasured: string[] = [];
 
 	if (!commit) return stop("head", "this checkout has no readable HEAD — there is no commit to stamp, so nothing could prove the deploy.");
 	if (spec.env === "production" && dirty) {
@@ -297,7 +302,9 @@ export function runWorkerDeploy(spec: WorkerDeploySpec, deps: DeployDeps): Deplo
 		for (const walk of spec.stageWalk ?? []) {
 			const command = spec.cpuTail ? underCpuTail(spec.cpuTail, "stage", walk) : [...walk];
 			step(`walk the stage signed in${spec.cpuTail ? ", under a CPU tail" : ""}: ${command.join(" ")}`);
-			if (deps.run(command, {}) !== 0) return stop("stage", `\`${command.join(" ")}\` failed — production was NOT touched.`);
+			const walked = deps.run(command, {});
+			if (spec.cpuTail && walked === TAIL_UNATTACHED_EXIT) unmeasured.push("the stage walk");
+			else if (walked !== 0) return stop("stage", `\`${command.join(" ")}\` failed — production was NOT touched.`);
 		}
 	}
 	if (spec.build) {
@@ -329,7 +336,9 @@ export function runWorkerDeploy(spec: WorkerDeploySpec, deps: DeployDeps): Deplo
 	if (spec.smoke) {
 		step(`smoke every address this deployment answers on${spec.cpuTail ? ", under a CPU tail" : ""}`);
 		const smoke = spec.cpuTail ? underCpuTail(spec.cpuTail, spec.env, spec.smoke) : spec.smoke;
-		if (deps.run(smoke, {}) !== 0) {
+		const smoked = deps.run(smoke, {});
+		if (spec.cpuTail && smoked === TAIL_UNATTACHED_EXIT) unmeasured.push("the smoke");
+		else if (smoked !== 0) {
 			return stop(
 				"smoke",
 				"the Worker is deployed and its smoke FAILED. Nothing was rolled back: `bunx wrangler rollback` puts the previous version back in one command.",
@@ -337,6 +346,13 @@ export function runWorkerDeploy(spec: WorkerDeploySpec, deps: DeployDeps): Deplo
 		}
 	}
 	const detail = `${spec.workerName} deployed${spec.secrets ? ", attached" : ""}${spec.smoke ? " and smoked" : ""} @ ${commit.slice(0, 8)}.`;
+	if (unmeasured.length > 0) {
+		const why =
+			`${detail} Worker CPU UNMEASURED — the tail never attached around ${unmeasured.join(" and ")}, which PASSED. ` +
+			"Nothing is wrong with the deployment and nothing needs rolling back; rerun the smoke under the app's CPU wrapper to measure it.";
+		error(`\n🟡 ${tag} ${why}`);
+		return { code: TAIL_UNATTACHED_EXIT, step: "cpu-unmeasured", detail: why, commit, dirty };
+	}
 	log(`\n✅ ${detail}`);
 	return { code: 0, step: "done", detail, commit, dirty };
 }
@@ -400,6 +416,12 @@ export function runWorkerDeploy(spec: WorkerDeploySpec, deps: DeployDeps): Deplo
  *      excused by production's traffic on a shared tail, or the reverse.
  *   5. **A tail that never connects is a failure, never an empty pass**; neither is a runtime that
  *      stops reporting `cpuTime` (`recordTailTraces` skips it; the empty report is `no-samples`).
+ *   6. 🔴 **…but it is not the COMMAND failing (0.9.2, task 2157).** A tail that does not attach is
+ *      restarted ONCE with a fresh marker; if the second never attaches either, the command still
+ *      runs (unmeasured, so the deploy is still smoked) and the result is {@link TAIL_UNATTACHED_EXIT},
+ *      which {@link runWorkerDeploy} reports as "CPU unmeasured", never "smoke FAILED". Measured
+ *      2026-09-24: collections' production tail never delivered its marker within 60 s, the deploy
+ *      said the smoke failed, and the same smoke rerun two minutes later passed 30 checks.
  *
  * ## How it knows the tail is listening, and that it has heard everything
  *
@@ -682,11 +704,21 @@ export interface WorkerCpuTailSpec extends Omit<JudgeOpts, "scriptName"> {
 	markerWaitMs?: number;
 }
 
+/**
+ * The exit code of a CPU tail that never attached, twice, around a command that PASSED (`EX_UNAVAILABLE`):
+ * nothing was measured, and nothing was wrong with the deployment. Distinct from the command's own
+ * codes so {@link runWorkerDeploy} can say which of the two happened — decision 6.
+ */
+export const TAIL_UNATTACHED_EXIT = 69;
+
 export interface WorkerCpuTailResult {
-	/** 0 green; the command's own code when it failed; 1 for any CPU or tail failure. */
+	/**
+	 * 0 green; the command's own code when it failed; {@link TAIL_UNATTACHED_EXIT} when the command
+	 * passed and the tail never attached; 1 for any other CPU or tail failure.
+	 */
 	code: number;
-	/** Where it stopped: `connect`, `command`, `drain`, `budget` or `done`. */
-	step: "connect" | "command" | "drain" | "budget" | "done";
+	/** Where it stopped: `unmeasured`, `command`, `drain`, `budget` or `done`. */
+	step: "unmeasured" | "command" | "drain" | "budget" | "done";
 	verdict: TailVerdict | null;
 }
 
@@ -700,7 +732,7 @@ export async function runWorkerCpuTail(spec: WorkerCpuTailSpec, deps: WorkerCpuD
 	const base = spec.base.replace(/\/$/, "");
 
 	deps.log(`\n▸ ${tag} Worker CPU: tailing ${spec.workerName} around \`${spec.command.join(" ")}\``);
-	const tail = deps.startTail(spec.workerName, spec.cwd, spec.credential);
+	let tail = deps.startTail(spec.workerName, spec.cwd, spec.credential);
 
 	/** Send the marker until the tail has carried it back, or give up. */
 	const awaitMarker = async (marker: string, withinMs: number): Promise<boolean> => {
@@ -718,16 +750,27 @@ export async function runWorkerCpuTail(spec: WorkerCpuTailSpec, deps: WorkerCpuD
 		return false;
 	};
 
-	if (!(await awaitMarker(nonce, connectMs))) {
+	// Decision 6: a tail that never attaches is restarted ONCE, with a fresh marker, before anything is judged.
+	let attached = await awaitMarker(nonce, connectMs);
+	let marker = nonce;
+	if (!attached) {
+		tail.stop();
+		deps.error(`🟡 ${tag} wrangler tail never delivered a request from ${base} within ${Math.round(connectMs / 1000)}s — restarting it once.\n${tail.errors()}`);
+		marker = `${nonce}r`;
+		tail = deps.startTail(spec.workerName, spec.cwd, spec.credential);
+		attached = await awaitMarker(marker, connectMs);
+	}
+	if (!attached) {
 		tail.stop();
 		deps.error(
-			`🔴 ${tag} wrangler tail never delivered a request from ${base} within ${Math.round(connectMs / 1000)}s — nothing could be measured.\n${tail.errors()}`,
+			`🔴 ${tag} wrangler tail never attached, twice, within ${Math.round(connectMs / 1000)}s each — the command runs UNMEASURED.\n${tail.errors()}`,
 		);
-		return { code: 1, step: "connect", verdict: null };
+		const ran = deps.run(spec.command, spec.cwd);
+		return { code: ran !== 0 ? ran : TAIL_UNATTACHED_EXIT, step: ran !== 0 ? "command" : "unmeasured", verdict: null };
 	}
 
 	const ran = deps.run(spec.command, spec.cwd);
-	const drained = await awaitMarker(`${nonce}-end`, drainMs);
+	const drained = await awaitMarker(`${marker}-end`, drainMs);
 	// Traces are not strictly ordered; a moment more lets a straggler behind the end marker land.
 	await deps.sleep(2_000);
 	tail.stop();