cursedops 0.13.0 → 0.13.2

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedops",
-	"version": "0.13.0",
+	"version": "0.13.2",
 	"description": "The build-and-ops answers this generation's apps wrote independently and identically: finding a generation's roots — and printing a command that runs when pasted — without knowing a path, the generation's whole-tree laws run over one repo from a checkout or a worktree, macOS launchd agent install/replace/remove and the live port a job serves, the scaffolding and verdicts of a deployed smoke (origin probe, the smoke's own environment, a network that lies about DNS, a settled version), the static-serving helpers eight apps copied — the path-traversal guard among them — the API floor that keeps an unmatched /api/... from ever being answered with the app shell, the commit and dirty flag a checkout-served process reports, the Cloudflare Worker deploy toolkit four apps copied (the deploy sequence, exact-set secrets over a pipe, origin-first rollback, the curl edge fetch, the row-for-row D1 import proof, the billed-CPU tail check around a deploy's walk and smoke, and each app's worker:secrets and worker:smoke main as one function of its data), the relay a Worker fronts a Mac-bound app with (the Durable Object, the frames, the Mac's dialer and key rotation — lifted from station for roms — and the signed-in stage walk's skeleton and the relay app's whole worker:deploy), the Worker import-graph and await-port checks every Worker app's suite runs over its own source, and the public-surface ratchet three published libraries each carried a forked copy of. Mechanism only — no app knows its name from here. Bun, zero runtime dependencies (typescript is an optional peer, for public-surface only), ships source.",
 	"type": "module",
 	"scripts": {

package/src/d1Columns.ts

@@ -58,21 +58,26 @@ export function schemaTables(schemaSql: string): SchemaTable[] {
 }
 
 /**
- * The read: `SELECT '<t>' AS t, name FROM pragma_table_info('<t>') UNION ALL …`, packed into as few
- * queries as `maxBytes` allows — one wrangler call for a whole schema, not one per table.
+ * The read: `SELECT m.name AS t, p.name AS name FROM sqlite_master m JOIN pragma_table_info(m.name) p
+ * WHERE m.type = 'table' AND m.name IN ('<t>', …)`, packed into as few queries as `maxBytes` allows —
+ * one wrangler call for a whole schema, not one per table.
+ *
+ * 🔴 Never a `… UNION ALL …` with a term per table: D1 refuses a compound SELECT with many terms
+ * (`too many terms in compound SELECT`, 2026-10-01 — 0.13.0's read stopped six apps' ships).
  */
 export function liveColumnsQueries(tables: readonly SchemaTable[], maxBytes: number): string[] {
+	const head = "SELECT m.name AS t, p.name AS name FROM sqlite_master m JOIN pragma_table_info(m.name) p WHERE m.type = 'table' AND m.name IN (";
+	const query = (names: string[]) => `${head}${names.join(", ")});`;
 	const queries: string[] = [];
-	let current = "";
+	let current: string[] = [];
 	for (const { table } of tables) {
-		const part = `SELECT '${table}' AS t, name FROM pragma_table_info('${table}')`;
-		const next = current ? `${current} UNION ALL ${part}` : part;
-		if (current && Buffer.byteLength(`${next};`) > maxBytes) {
-			queries.push(`${current};`);
-			current = part;
-		} else current = next;
+		const name = `'${table}'`;
+		if (current.length > 0 && Buffer.byteLength(query([...current, name])) > maxBytes) {
+			queries.push(query(current));
+			current = [name];
+		} else current.push(name);
 	}
-	if (current) queries.push(`${current};`);
+	if (current.length > 0) queries.push(query(current));
 	return queries;
 }
 

package/src/workerSecrets.ts

@@ -168,14 +168,40 @@ export interface ApiResult {
 
 export type CloudflareApi = (path: string, init?: RequestInit) => Promise<ApiResult>;
 
-/** A Cloudflare v4 API caller for `token`. `fetch` injectable for tests. */
-export function cloudflareApi(token: string, send: typeof fetch = fetch): CloudflareApi {
+/** Tries per idempotent (GET/DELETE) call whose fetch THROWS — see {@link cloudflareApi}. */
+export const API_IDEMPOTENT_ATTEMPTS = 3;
+
+/**
+ * A Cloudflare v4 API caller for `token`. `fetch` and the backoff `pause` injectable for tests.
+ *
+ * 🔴 **A GET or DELETE whose fetch throws is tried again, up to {@link API_IDEMPOTENT_ATTEMPTS}
+ * times.** On 2026-10-04 (ship run 16-39-21) desk-stage and collections-stage both died in the
+ * same second on the first secrets list — `The socket connection was closed unexpectedly` — and
+ * were left uploaded with no secrets, serving nothing. Asking again changes nothing a GET or DELETE
+ * did not already change. An HTTP status is an ANSWER and is returned as-is; a thrown POST/PUT/PATCH
+ * is never retried, because it may have landed.
+ */
+export function cloudflareApi(
+	token: string,
+	send: typeof fetch = fetch,
+	pause: (ms: number) => Promise<void> = (ms) => new Promise<void>((resolve) => setTimeout(resolve, ms)),
+): CloudflareApi {
 	return async (path, init = {}) => {
-		const response = await send(`https://api.cloudflare.com/client/v4${path}`, {
-			...init,
-			headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
-			signal: init.signal ?? AbortSignal.timeout(30_000),
-		});
+		const method = (init.method ?? "GET").toUpperCase();
+		const attempts = method === "GET" || method === "DELETE" ? API_IDEMPOTENT_ATTEMPTS : 1;
+		let response: Response | undefined;
+		for (let tries = 1; !response; tries++) {
+			try {
+				response = await send(`https://api.cloudflare.com/client/v4${path}`, {
+					...init,
+					headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+					signal: init.signal ?? AbortSignal.timeout(30_000),
+				});
+			} catch (error) {
+				if (tries >= attempts || init.signal?.aborted) throw error;
+				await pause(1_000 * tries);
+			}
+		}
 		return (await response.json().catch(() => ({ success: false, errors: [`HTTP ${response.status}, not JSON`] }))) as ApiResult;
 	};
 }