ugly-app 0.1.933 → 0.1.934

package/dist/cli/publish/staticDomain.d.ts

@@ -75,6 +75,16 @@ export declare function ensureR2CustomDomain(args: StaticDomainArgs): Promise<vo
  * this, COEP `require-corp` blocks every `fetch()` of a static asset.
  */
 export declare function putR2BucketCors(args: StaticDomainArgs): Promise<void>;
+/**
+ * Rule ref — stable per HOST, so re-running updates in place instead of
+ * stacking.
+ *
+ * It must be per-host, not a constant: a zone is SHARED by every app on it
+ * (~22 live on `ugly.bot`). With one fixed ref, the second app to provision
+ * would filter out the first app's rule and replace it with its own, silently
+ * un-CORP-ing that app and breaking its no-CORS assets.
+ */
+export declare function corpRuleRef(domain: string): string;
 /**
  * Add `Cross-Origin-Resource-Policy: cross-origin` to responses on the static
  * host, so plain no-CORS subresources (`<img src>`, `<audio src>`) are not

package/dist/cli/publish/staticDomain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"staticDomain.d.ts","sourceRoot":"","sources":["../../../src/cli/publish/staticDomain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAMH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,gCAAgC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAWzE;AAgCD;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAcjB;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,IAAI,CAAC,CAmCf;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4B3E;AAKD;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,IAAI,CAAC,CA8Cf;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,gBAAgB,EACtB,GAAG,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAGrB,GACA,OAAO,CAAC,IAAI,CAAC,CAgBf"}
+{"version":3,"file":"staticDomain.d.ts","sourceRoot":"","sources":["../../../src/cli/publish/staticDomain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAMH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,gCAAgC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAWzE;AAgCD;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAcjB;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,IAAI,CAAC,CAmCf;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4B3E;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAElD;AAWD;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,IAAI,CAAC,CAuDf;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,gBAAgB,EACtB,GAAG,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAGrB,GACA,OAAO,CAAC,IAAI,CAAC,CAgBf"}

package/dist/cli/publish/staticDomain.js

@@ -147,8 +147,26 @@ export async function putR2BucketCors(args) {
         }),
     }, 'putR2BucketCors');
 }
-/** Rule name — stable so re-running updates in place instead of stacking. */
-const CORP_RULE_REF = 'ugly_app_static_corp';
+/**
+ * Rule ref — stable per HOST, so re-running updates in place instead of
+ * stacking.
+ *
+ * It must be per-host, not a constant: a zone is SHARED by every app on it
+ * (~22 live on `ugly.bot`). With one fixed ref, the second app to provision
+ * would filter out the first app's rule and replace it with its own, silently
+ * un-CORP-ing that app and breaking its no-CORS assets.
+ */
+export function corpRuleRef(domain) {
+    return `ugly_app_static_corp__${domain.toLowerCase().replace(/[^a-z0-9]+/g, '_')}`;
+}
+/**
+ * The ref used before refs were per-host. Rules written under it are still out
+ * there (world3, ugly.chat), so provisioning drops the legacy rule when it
+ * targets the host we're about to write — otherwise the old and new rules sit
+ * side by side forever and nothing ever cleans the old one up. A legacy rule
+ * pointing at a DIFFERENT host belongs to another app and is left alone.
+ */
+const LEGACY_CORP_RULE_REF = 'ugly_app_static_corp';
 /**
  * Add `Cross-Origin-Resource-Policy: cross-origin` to responses on the static
  * host, so plain no-CORS subresources (`<img src>`, `<audio src>`) are not
@@ -160,6 +178,7 @@ const CORP_RULE_REF = 'ugly_app_static_corp';
  */
 export async function ensureCorpHeaderRule(args) {
     const { token, rulesetToken, zoneId, domain } = args;
+    const ruleRef = corpRuleRef(domain);
     const headers = {
         'Authorization': `Bearer ${rulesetToken ?? token}`,
         'Content-Type': 'application/json',
@@ -170,7 +189,7 @@ export async function ensureCorpHeaderRule(args) {
     const existing = listed?.result
         ?.rules ?? [];
     const corpRule = {
-        ref: CORP_RULE_REF,
+        ref: ruleRef,
         action: 'rewrite',
         description: 'ugly-app: CORP for static assets (COEP require-corp)',
         expression: `http.host eq "${domain}"`,
@@ -184,7 +203,12 @@ export async function ensureCorpHeaderRule(args) {
         },
     };
     // Keep every rule that isn't ours, then append the current definition.
-    const rules = [...existing.filter((r) => r.ref !== CORP_RULE_REF), corpRule];
+    const expression = corpRule.expression;
+    const rules = [
+        ...existing.filter((r) => r.ref !== ruleRef &&
+            !(r.ref === LEGACY_CORP_RULE_REF && r.expression === expression)),
+        corpRule,
+    ];
     await cf(`${base}/phases/http_response_headers_transform/entrypoint`, {
         method: 'PUT',
         headers,

package/dist/cli/publish/staticDomain.js.map

@@ -1 +1 @@
-{"version":3,"file":"staticDomain.js","sourceRoot":"","sources":["../../../src/cli/publish/staticDomain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,mBAAmB,GAAG,sCAAsC,CAAC;AAyBnE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,QAAgB;IAC/D,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvD,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,UAAU,IAAI,EAAE,CAAC;IAC1C,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7C,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;IACtD,CAAC;IACD,2EAA2E;IAC3E,yEAAyE;IACzE,OAAO,UAAU,GAAG,EAAE,CAAC;AACzB,CAAC;AAQD,KAAK,UAAU,EAAE,CACf,GAAW,EACX,IAAiB,EACjB,IAAY;IAEZ,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC9C,IAAI,IAAI,GAAe,EAAE,CAAC;IAC1B,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAe,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;IAClE,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;aAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;aAClD,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,YAAY,CACpB,GAAG,IAAI,YAAY,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAC/D,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,CACpC,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAa,EACb,MAAc;IAEd,MAAM,IAAI,GAAG,MAAM,EAAE,CACnB,GAAG,mBAAmB,UAAU,MAAM,EAAE,EACxC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,EAChE,eAAe,CAChB,CAAC;IACF,MAAM,IAAI,GAAI,IAAI,CAAC,MAAwC,EAAE,IAAI,CAAC;IAClE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,YAAY,CAAC,QAAQ,MAAM,mBAAmB,EAAE;YACxD,QAAQ,EAAE,eAAe;YACzB,IAAI,EAAE,eAAe;SACtB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAsB;IAEtB,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC1D,MAAM,GAAG,GAAG,GAAG,mBAAmB,aAAa,SAAS,eAAe,MAAM,iBAAiB,CAAC;IAC/F,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE;QACtC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,eAAe,EAAE,UAAU,KAAK,EAAE;YAClC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;KACxD,CAAC,CAAC;IAEH,IAAI,GAAG,CAAC,EAAE;QAAE,OAAO;IAEnB,IAAI,IAAI,GAAe,EAAE,CAAC;IAC1B,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAe,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IACD,MAAM,eAAe,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAC9C,CAAC,CAAC,EAAE,EAAE,CACJ,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAC7B,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAC9C,CAAC;IACF,IAAI,eAAe;QAAE,OAAO;IAE5B,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;SAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;SAClD,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,IAAI,YAAY,CACpB,kCAAkC,MAAM,cAAc,MAAM,GAAG;QAC7D,IAAI,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAClD,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAC5D,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAsB;IAC1D,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAC1D,MAAM,EAAE,CACN,GAAG,mBAAmB,aAAa,SAAS,eAAe,MAAM,OAAO,EACxE;QACE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,eAAe,EAAE,UAAU,KAAK,EAAE;YAClC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,KAAK,EAAE;gBACL;oBACE,OAAO,EAAE;wBACP,OAAO,EAAE,cAAc;wBACvB,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;wBACxB,OAAO,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,UAAU,CAAC;qBAChD;oBACD,0DAA0D;oBAC1D,6DAA6D;oBAC7D,aAAa,EAAE,CAAC,MAAM,EAAE,gBAAgB,EAAE,eAAe,CAAC;oBAC1D,aAAa,EAAE,KAAK;iBACrB;aACF;SACF,CAAC;KACH,EACD,iBAAiB,CAClB,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,aAAa,GAAG,sBAAsB,CAAC;AAE7C;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAsB;IAEtB,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACrD,MAAM,OAAO,GAAG;QACd,eAAe,EAAE,UAAU,YAAY,IAAI,KAAK,EAAE;QAClD,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,MAAM,IAAI,GAAG,GAAG,mBAAmB,UAAU,MAAM,WAAW,CAAC;IAE/D,6DAA6D;IAC7D,MAAM,MAAM,GAAG,MAAM,EAAE,CACrB,GAAG,IAAI,oDAAoD,EAC3D,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAC1B,0BAA0B,CAC3B,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAEpB,MAAM,QAAQ,GACX,MAAM,EAAE,MAA4D;QACnE,EAAE,KAAK,IAAI,EAAE,CAAC;IAElB,MAAM,QAAQ,GAAG;QACf,GAAG,EAAE,aAAa;QAClB,MAAM,EAAE,SAAS;QACjB,WAAW,EAAE,sDAAsD;QACnE,UAAU,EAAE,iBAAiB,MAAM,GAAG;QACtC,iBAAiB,EAAE;YACjB,OAAO,EAAE;gBACP,8BAA8B,EAAE;oBAC9B,SAAS,EAAE,KAAK;oBAChB,KAAK,EAAE,cAAc;iBACtB;aACF;SACF;KACF,CAAC;IAEF,uEAAuE;IACvE,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,aAAa,CAAC,EAAE,QAAQ,CAAC,CAAC;IAE7E,MAAM,EAAE,CACN,GAAG,IAAI,oDAAoD,EAC3D;QACE,MAAM,EAAE,KAAK;QACb,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;KAChC,EACD,0BAA0B,CAC3B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAsB,EACtB,MAA6B,CAAC,CAAC,EAAE,EAAE;IACjC,sCAAsC;IACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;IAED,MAAM,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CACD,sDAAsD,IAAI,CAAC,MAAM,IAAI;YACnE,GAAI,GAAa,CAAC,OAAO,IAAI;YAC7B,wEAAwE;YACxE,oDAAoD;YACpD,8CAA8C,IAAI,CAAC,MAAM,WAAW;YACpE,kEAAkE;YAClE,6CAA6C,CAChD,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"staticDomain.js","sourceRoot":"","sources":["../../../src/cli/publish/staticDomain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,mBAAmB,GAAG,sCAAsC,CAAC;AAyBnE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,QAAgB;IAC/D,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvD,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,UAAU,IAAI,EAAE,CAAC;IAC1C,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7C,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;IACtD,CAAC;IACD,2EAA2E;IAC3E,yEAAyE;IACzE,OAAO,UAAU,GAAG,EAAE,CAAC;AACzB,CAAC;AAQD,KAAK,UAAU,EAAE,CACf,GAAW,EACX,IAAiB,EACjB,IAAY;IAEZ,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC9C,IAAI,IAAI,GAAe,EAAE,CAAC;IAC1B,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAe,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;IAClE,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;aAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;aAClD,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,YAAY,CACpB,GAAG,IAAI,YAAY,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAC/D,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,CACpC,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAa,EACb,MAAc;IAEd,MAAM,IAAI,GAAG,MAAM,EAAE,CACnB,GAAG,mBAAmB,UAAU,MAAM,EAAE,EACxC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,EAChE,eAAe,CAChB,CAAC;IACF,MAAM,IAAI,GAAI,IAAI,CAAC,MAAwC,EAAE,IAAI,CAAC;IAClE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,YAAY,CAAC,QAAQ,MAAM,mBAAmB,EAAE;YACxD,QAAQ,EAAE,eAAe;YACzB,IAAI,EAAE,eAAe;SACtB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAsB;IAEtB,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC1D,MAAM,GAAG,GAAG,GAAG,mBAAmB,aAAa,SAAS,eAAe,MAAM,iBAAiB,CAAC;IAC/F,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE;QACtC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,eAAe,EAAE,UAAU,KAAK,EAAE;YAClC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;KACxD,CAAC,CAAC;IAEH,IAAI,GAAG,CAAC,EAAE;QAAE,OAAO;IAEnB,IAAI,IAAI,GAAe,EAAE,CAAC;IAC1B,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAe,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IACD,MAAM,eAAe,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAC9C,CAAC,CAAC,EAAE,EAAE,CACJ,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAC7B,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAC9C,CAAC;IACF,IAAI,eAAe;QAAE,OAAO;IAE5B,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;SAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;SAClD,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,IAAI,YAAY,CACpB,kCAAkC,MAAM,cAAc,MAAM,GAAG;QAC7D,IAAI,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAClD,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAC5D,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAsB;IAC1D,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAC1D,MAAM,EAAE,CACN,GAAG,mBAAmB,aAAa,SAAS,eAAe,MAAM,OAAO,EACxE;QACE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,eAAe,EAAE,UAAU,KAAK,EAAE;YAClC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,KAAK,EAAE;gBACL;oBACE,OAAO,EAAE;wBACP,OAAO,EAAE,cAAc;wBACvB,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;wBACxB,OAAO,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,UAAU,CAAC;qBAChD;oBACD,0DAA0D;oBAC1D,6DAA6D;oBAC7D,aAAa,EAAE,CAAC,MAAM,EAAE,gBAAgB,EAAE,eAAe,CAAC;oBAC1D,aAAa,EAAE,KAAK;iBACrB;aACF;SACF,CAAC;KACH,EACD,iBAAiB,CAClB,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,OAAO,yBAAyB,MAAM,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,EAAE,CAAC;AACrF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAEpD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAsB;IAEtB,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACrD,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG;QACd,eAAe,EAAE,UAAU,YAAY,IAAI,KAAK,EAAE;QAClD,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,MAAM,IAAI,GAAG,GAAG,mBAAmB,UAAU,MAAM,WAAW,CAAC;IAE/D,6DAA6D;IAC7D,MAAM,MAAM,GAAG,MAAM,EAAE,CACrB,GAAG,IAAI,oDAAoD,EAC3D,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAC1B,0BAA0B,CAC3B,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAEpB,MAAM,QAAQ,GACX,MAAM,EAAE,MAA4D;QACnE,EAAE,KAAK,IAAI,EAAE,CAAC;IAElB,MAAM,QAAQ,GAAG;QACf,GAAG,EAAE,OAAO;QACZ,MAAM,EAAE,SAAS;QACjB,WAAW,EAAE,sDAAsD;QACnE,UAAU,EAAE,iBAAiB,MAAM,GAAG;QACtC,iBAAiB,EAAE;YACjB,OAAO,EAAE;gBACP,8BAA8B,EAAE;oBAC9B,SAAS,EAAE,KAAK;oBAChB,KAAK,EAAE,cAAc;iBACtB;aACF;SACF;KACF,CAAC;IAEF,uEAAuE;IACvE,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;IACvC,MAAM,KAAK,GAAG;QACZ,GAAG,QAAQ,CAAC,MAAM,CAChB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,GAAG,KAAK,OAAO;YACjB,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,oBAAoB,IAAI,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CACnE;QACD,QAAQ;KACT,CAAC;IAEF,MAAM,EAAE,CACN,GAAG,IAAI,oDAAoD,EAC3D;QACE,MAAM,EAAE,KAAK;QACb,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;KAChC,EACD,0BAA0B,CAC3B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAsB,EACtB,MAA6B,CAAC,CAAC,EAAE,EAAE;IACjC,sCAAsC;IACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;IAED,MAAM,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CACD,sDAAsD,IAAI,CAAC,MAAM,IAAI;YACnE,GAAI,GAAa,CAAC,OAAO,IAAI;YAC7B,wEAAwE;YACxE,oDAAoD;YACpD,8CAA8C,IAAI,CAAC,MAAM,WAAW;YACpE,kEAAkE;YAClE,6CAA6C,CAChD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/cli/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.1.933";
+export declare const CLI_VERSION = "0.1.934";
 //# sourceMappingURL=version.d.ts.map

package/dist/cli/version.js

@@ -1,3 +1,3 @@
 // Auto-generated by prebuild — do not edit manually
-export const CLI_VERSION = "0.1.933";
+export const CLI_VERSION = "0.1.934";
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ugly-app",
   "packageManager": "pnpm@10.34.5",
-  "version": "0.1.933",
+  "version": "0.1.934",
   "type": "module",
   "comment:files": "Allowlist what ships to npm. dist = runtime; src = sourcemap targets (dist/*.js.map reference ../../src/); templates = CLI scaffold. Everything else at repo root (.pgdata local Postgres, coverage, assets/icons sources, test/, test-results/) is excluded by omission. The !negations strip the scaffold's installed deps + cruft (templates/node_modules is 200MB+ and must never ship). package.json/README/LICENSE ship automatically.",
   "files": [

package/src/cli/publish/staticDomain.test.ts

@@ -1,5 +1,6 @@
 import { afterEach, describe, expect, it, vi } from 'vitest';
 import {
+  corpRuleRef,
   ensureCorpHeaderRule,
   ensureR2CustomDomain,
   ensureStaticDomain,
@@ -180,6 +181,7 @@ describe('ensureCorpHeaderRule', () => {
   });
 
   it('replaces its own prior rule instead of stacking duplicates', async () => {
+    const mine = corpRuleRef('static.myapp.com');
     const fetchMock = vi
       .fn()
       .mockResolvedValueOnce(
@@ -187,7 +189,7 @@ describe('ensureCorpHeaderRule', () => {
           success: true,
           result: {
             rules: [
-              { ref: 'ugly_app_static_corp', description: 'stale version' },
+              { ref: mine, description: 'stale version' },
               { ref: 'someone_elses_rule', description: 'keep me' },
             ],
           },
@@ -200,7 +202,59 @@ describe('ensureCorpHeaderRule', () => {
     const [, init] = fetchMock.mock.calls[1]!;
     const body = JSON.parse((init as RequestInit).body as string);
     const refs = body.rules.map((r: { ref: string }) => r.ref);
-    expect(refs).toEqual(['someone_elses_rule', 'ugly_app_static_corp']);
+    expect(refs).toEqual(['someone_elses_rule', mine]);
+    expect(body.rules).toHaveLength(2);
+  });
+
+  // Rules written before refs were per-host must be cleaned up, not doubled.
+  it('drops a legacy-ref rule that targets the same host', async () => {
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValueOnce(
+        ok({
+          success: true,
+          result: {
+            rules: [
+              {
+                ref: 'ugly_app_static_corp',
+                expression: 'http.host eq "static.myapp.com"',
+              },
+            ],
+          },
+        }),
+      )
+      .mockResolvedValueOnce(ok());
+    vi.stubGlobal('fetch', fetchMock);
+    await ensureCorpHeaderRule(ARGS);
+    const body = JSON.parse(
+      (fetchMock.mock.calls[1]![1] as RequestInit).body as string,
+    );
+    expect(body.rules).toHaveLength(1);
+    expect(body.rules[0].ref).toBe(corpRuleRef('static.myapp.com'));
+  });
+
+  it('leaves a legacy-ref rule that targets a DIFFERENT host', async () => {
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValueOnce(
+        ok({
+          success: true,
+          result: {
+            rules: [
+              {
+                ref: 'ugly_app_static_corp',
+                expression: 'http.host eq "other-static.ugly.bot"',
+              },
+            ],
+          },
+        }),
+      )
+      .mockResolvedValueOnce(ok());
+    vi.stubGlobal('fetch', fetchMock);
+    await ensureCorpHeaderRule(ARGS);
+    const body = JSON.parse(
+      (fetchMock.mock.calls[1]![1] as RequestInit).body as string,
+    );
     expect(body.rules).toHaveLength(2);
   });
 
@@ -323,3 +377,54 @@ describe('ensureCorpHeaderRule — credential selection', () => {
     );
   });
 });
+
+describe('corpRuleRef — a shared zone must not have one app clobber another', () => {
+  it('is distinct per host', () => {
+    expect(corpRuleRef('world3-static.ugly.bot')).not.toBe(
+      corpRuleRef('game-demo-static.ugly.bot'),
+    );
+  });
+
+  it('is stable for the same host so re-publishing updates in place', () => {
+    expect(corpRuleRef('world3-static.ugly.bot')).toBe(
+      corpRuleRef('world3-static.ugly.bot'),
+    );
+  });
+
+  it('contains only ref-safe characters', () => {
+    expect(corpRuleRef('world3-static.ugly.bot')).toMatch(/^[a-z0-9_]+$/);
+  });
+
+  // The bug this guards: ~22 apps share the ugly.bot zone. With a constant
+  // ref, app B's provisioning filtered out app A's rule and replaced it,
+  // silently un-CORP-ing app A.
+  it('preserves another app rule on the same zone', async () => {
+    const other = corpRuleRef('game-demo-static.ugly.bot');
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValueOnce(
+        ok({
+          success: true,
+          result: {
+            rules: [
+              {
+                ref: other,
+                expression: 'http.host eq "game-demo-static.ugly.bot"',
+              },
+            ],
+          },
+        }),
+      )
+      .mockResolvedValueOnce(ok());
+    vi.stubGlobal('fetch', fetchMock);
+    await ensureCorpHeaderRule({ ...ARGS, domain: 'world3-static.ugly.bot' });
+
+    const body = JSON.parse(
+      (fetchMock.mock.calls[1]![1] as RequestInit).body as string,
+    );
+    const refs = body.rules.map((r: { ref: string }) => r.ref);
+    expect(refs).toContain(other);
+    expect(refs).toContain(corpRuleRef('world3-static.ugly.bot'));
+    expect(body.rules).toHaveLength(2);
+  });
+});

package/src/cli/publish/staticDomain.ts

@@ -208,8 +208,27 @@ export async function putR2BucketCors(args: StaticDomainArgs): Promise<void> {
   );
 }
 
-/** Rule name — stable so re-running updates in place instead of stacking. */
-const CORP_RULE_REF = 'ugly_app_static_corp';
+/**
+ * Rule ref — stable per HOST, so re-running updates in place instead of
+ * stacking.
+ *
+ * It must be per-host, not a constant: a zone is SHARED by every app on it
+ * (~22 live on `ugly.bot`). With one fixed ref, the second app to provision
+ * would filter out the first app's rule and replace it with its own, silently
+ * un-CORP-ing that app and breaking its no-CORS assets.
+ */
+export function corpRuleRef(domain: string): string {
+  return `ugly_app_static_corp__${domain.toLowerCase().replace(/[^a-z0-9]+/g, '_')}`;
+}
+
+/**
+ * The ref used before refs were per-host. Rules written under it are still out
+ * there (world3, ugly.chat), so provisioning drops the legacy rule when it
+ * targets the host we're about to write — otherwise the old and new rules sit
+ * side by side forever and nothing ever cleans the old one up. A legacy rule
+ * pointing at a DIFFERENT host belongs to another app and is left alone.
+ */
+const LEGACY_CORP_RULE_REF = 'ugly_app_static_corp';
 
 /**
  * Add `Cross-Origin-Resource-Policy: cross-origin` to responses on the static
@@ -224,6 +243,7 @@ export async function ensureCorpHeaderRule(
   args: StaticDomainArgs,
 ): Promise<void> {
   const { token, rulesetToken, zoneId, domain } = args;
+  const ruleRef = corpRuleRef(domain);
   const headers = {
     'Authorization': `Bearer ${rulesetToken ?? token}`,
     'Content-Type': 'application/json',
@@ -242,7 +262,7 @@ export async function ensureCorpHeaderRule(
       ?.rules ?? [];
 
   const corpRule = {
-    ref: CORP_RULE_REF,
+    ref: ruleRef,
     action: 'rewrite',
     description: 'ugly-app: CORP for static assets (COEP require-corp)',
     expression: `http.host eq "${domain}"`,
@@ -257,7 +277,15 @@ export async function ensureCorpHeaderRule(
   };
 
   // Keep every rule that isn't ours, then append the current definition.
-  const rules = [...existing.filter((r) => r.ref !== CORP_RULE_REF), corpRule];
+  const expression = corpRule.expression;
+  const rules = [
+    ...existing.filter(
+      (r) =>
+        r.ref !== ruleRef &&
+        !(r.ref === LEGACY_CORP_RULE_REF && r.expression === expression),
+    ),
+    corpRule,
+  ];
 
   await cf(
     `${base}/phases/http_response_headers_transform/entrypoint`,

package/src/cli/version.ts

@@ -1,2 +1,2 @@
 // Auto-generated by prebuild — do not edit manually
-export const CLI_VERSION = "0.1.933";
+export const CLI_VERSION = "0.1.934";