cursedops 0.13.1 → 0.13.2

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedops",
-	"version": "0.13.1",
+	"version": "0.13.2",
 	"description": "The build-and-ops answers this generation's apps wrote independently and identically: finding a generation's roots — and printing a command that runs when pasted — without knowing a path, the generation's whole-tree laws run over one repo from a checkout or a worktree, macOS launchd agent install/replace/remove and the live port a job serves, the scaffolding and verdicts of a deployed smoke (origin probe, the smoke's own environment, a network that lies about DNS, a settled version), the static-serving helpers eight apps copied — the path-traversal guard among them — the API floor that keeps an unmatched /api/... from ever being answered with the app shell, the commit and dirty flag a checkout-served process reports, the Cloudflare Worker deploy toolkit four apps copied (the deploy sequence, exact-set secrets over a pipe, origin-first rollback, the curl edge fetch, the row-for-row D1 import proof, the billed-CPU tail check around a deploy's walk and smoke, and each app's worker:secrets and worker:smoke main as one function of its data), the relay a Worker fronts a Mac-bound app with (the Durable Object, the frames, the Mac's dialer and key rotation — lifted from station for roms — and the signed-in stage walk's skeleton and the relay app's whole worker:deploy), the Worker import-graph and await-port checks every Worker app's suite runs over its own source, and the public-surface ratchet three published libraries each carried a forked copy of. Mechanism only — no app knows its name from here. Bun, zero runtime dependencies (typescript is an optional peer, for public-surface only), ships source.",
 	"type": "module",
 	"scripts": {

package/src/workerSecrets.ts

@@ -168,14 +168,40 @@ export interface ApiResult {
 
 export type CloudflareApi = (path: string, init?: RequestInit) => Promise<ApiResult>;
 
-/** A Cloudflare v4 API caller for `token`. `fetch` injectable for tests. */
-export function cloudflareApi(token: string, send: typeof fetch = fetch): CloudflareApi {
+/** Tries per idempotent (GET/DELETE) call whose fetch THROWS — see {@link cloudflareApi}. */
+export const API_IDEMPOTENT_ATTEMPTS = 3;
+
+/**
+ * A Cloudflare v4 API caller for `token`. `fetch` and the backoff `pause` injectable for tests.
+ *
+ * 🔴 **A GET or DELETE whose fetch throws is tried again, up to {@link API_IDEMPOTENT_ATTEMPTS}
+ * times.** On 2026-10-04 (ship run 16-39-21) desk-stage and collections-stage both died in the
+ * same second on the first secrets list — `The socket connection was closed unexpectedly` — and
+ * were left uploaded with no secrets, serving nothing. Asking again changes nothing a GET or DELETE
+ * did not already change. An HTTP status is an ANSWER and is returned as-is; a thrown POST/PUT/PATCH
+ * is never retried, because it may have landed.
+ */
+export function cloudflareApi(
+	token: string,
+	send: typeof fetch = fetch,
+	pause: (ms: number) => Promise<void> = (ms) => new Promise<void>((resolve) => setTimeout(resolve, ms)),
+): CloudflareApi {
 	return async (path, init = {}) => {
-		const response = await send(`https://api.cloudflare.com/client/v4${path}`, {
-			...init,
-			headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
-			signal: init.signal ?? AbortSignal.timeout(30_000),
-		});
+		const method = (init.method ?? "GET").toUpperCase();
+		const attempts = method === "GET" || method === "DELETE" ? API_IDEMPOTENT_ATTEMPTS : 1;
+		let response: Response | undefined;
+		for (let tries = 1; !response; tries++) {
+			try {
+				response = await send(`https://api.cloudflare.com/client/v4${path}`, {
+					...init,
+					headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+					signal: init.signal ?? AbortSignal.timeout(30_000),
+				});
+			} catch (error) {
+				if (tries >= attempts || init.signal?.aborted) throw error;
+				await pause(1_000 * tries);
+			}
+		}
 		return (await response.json().catch(() => ({ success: false, errors: [`HTTP ${response.status}, not JSON`] }))) as ApiResult;
 	};
 }