cursedops 0.10.23 → 0.10.24

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedops",
-	"version": "0.10.23",
+	"version": "0.10.24",
 	"description": "The build-and-ops answers this generation's apps wrote independently and identically: finding a generation's roots — and printing a command that runs when pasted — without knowing a path, the generation's whole-tree laws run over one repo from a checkout or a worktree, macOS launchd agent install/replace/remove and the live port a job serves, the scaffolding and verdicts of a deployed smoke (origin probe, the smoke's own environment, a network that lies about DNS, a settled version), the static-serving helpers eight apps copied — the path-traversal guard among them — the API floor that keeps an unmatched /api/... from ever being answered with the app shell, the commit and dirty flag a checkout-served process reports, the Cloudflare Worker deploy toolkit four apps copied (the deploy sequence, exact-set secrets over a pipe, origin-first rollback, the curl edge fetch, the row-for-row D1 import proof, the billed-CPU tail check around a deploy's walk and smoke, and each app's worker:secrets and worker:smoke main as one function of its data), the relay a Worker fronts a Mac-bound app with (the Durable Object, the frames, the Mac's dialer and key rotation — lifted from station for roms — and the signed-in stage walk's skeleton and the relay app's whole worker:deploy), the Worker import-graph and await-port checks every Worker app's suite runs over its own source, and the public-surface ratchet three published libraries each carried a forked copy of. Mechanism only — no app knows its name from here. Bun, zero runtime dependencies (typescript is an optional peer, for public-surface only), ships source.",
 	"type": "module",
 	"scripts": {

package/src/workerSecrets.ts

@@ -89,19 +89,40 @@ export interface SecretSync {
 	after: string[];
 }
 
+/** Tries per put. A put is idempotent, so a retry can only turn a network blip into a success. */
+export const SECRET_PUT_ATTEMPTS = 3;
+
 /**
  * Apply `plan`: put every value, delete every extra, then READ THE ACCOUNT BACK and fail unless it
  * holds exactly the set. Refuses without touching anything when the plan has `absent` keys.
+ *
+ * 🔴 **A failed put is tried again, up to {@link SECRET_PUT_ATTEMPTS} times.** On 2026-09-28 one
+ * `wrangler secret put` of three hit `fetch failed` and the whole deploy stopped with
+ * collections-stage holding a Worker and no secrets — serving nothing — for a blip the next
+ * attempt would have cleared. The read-back is still the verdict.
  */
-export async function syncSecrets(plan: SecretPlan, ops: SecretOps): Promise<SecretSync> {
+export async function syncSecrets(
+	plan: SecretPlan,
+	ops: SecretOps,
+	options: { attempts?: number; pause?: (ms: number) => Promise<void> } = {},
+): Promise<SecretSync> {
+	const attempts = Math.max(1, options.attempts ?? SECRET_PUT_ATTEMPTS);
+	const pause = options.pause ?? ((ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms)));
 	const lines: string[] = [];
 	if (plan.absent.length > 0) {
 		return { ok: false, lines: [`the secrets file has no ${plan.absent.join(" and no ")} — nothing was changed`], after: await ops.held() };
 	}
 	let bad = 0;
 	for (const { name, from, value } of plan.put) {
-		const ok = await ops.put(name, value);
-		lines.push(`put ${name}${from === name ? "" : ` (from ${from})`} (${value.length} bytes) — ${ok ? "ok" : "FAILED"}`);
+		let ok = false;
+		let tries = 0;
+		while (!ok && tries < attempts) {
+			if (tries > 0) await pause(2_000 * tries);
+			ok = await ops.put(name, value);
+			tries++;
+		}
+		const retried = tries > 1 ? ` after ${tries} attempts` : "";
+		lines.push(`put ${name}${from === name ? "" : ` (from ${from})`} (${value.length} bytes) — ${ok ? "ok" : "FAILED"}${retried}`);
 		if (!ok) bad++;
 	}
 	for (const name of plan.remove) {