cursedops 0.7.1 → 0.8.1

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "cursedops",
-	"version": "0.7.1",
-	"description": "The build-and-ops answers this generation's apps wrote independently and identically: finding a generation's roots — and printing a command that runs when pasted — without knowing a path, the generation's whole-tree laws run over one repo from a checkout or a worktree, macOS launchd agent install/replace/remove and the live port a job serves, the scaffolding and verdicts of a deployed smoke (origin probe, the smoke's own environment, a network that lies about DNS, a settled version), the static-serving helpers eight apps copied — the path-traversal guard among them — the API floor that keeps an unmatched /api/... from ever being answered with the app shell, the commit and dirty flag a checkout-served process reports, the Cloudflare Worker deploy toolkit four apps copied (the deploy sequence, exact-set secrets over a pipe, origin-first rollback, the curl edge fetch, the row-for-row D1 import proof, the billed-CPU tail check around a deploy's walk and smoke), and the public-surface ratchet three published libraries each carried a forked copy of. Mechanism only — no app knows its name from here. Bun, zero runtime dependencies (typescript is an optional peer, for public-surface only), ships source.",
+	"version": "0.8.1",
+	"description": "The build-and-ops answers this generation's apps wrote independently and identically: finding a generation's roots — and printing a command that runs when pasted — without knowing a path, the generation's whole-tree laws run over one repo from a checkout or a worktree, macOS launchd agent install/replace/remove and the live port a job serves, the scaffolding and verdicts of a deployed smoke (origin probe, the smoke's own environment, a network that lies about DNS, a settled version), the static-serving helpers eight apps copied — the path-traversal guard among them — the API floor that keeps an unmatched /api/... from ever being answered with the app shell, the commit and dirty flag a checkout-served process reports, the Cloudflare Worker deploy toolkit four apps copied (the deploy sequence, exact-set secrets over a pipe, origin-first rollback, the curl edge fetch, the row-for-row D1 import proof, the billed-CPU tail check around a deploy's walk and smoke, and each app's worker:secrets and worker:smoke main as one function of its data), the Worker import-graph and await-port checks every Worker app's suite runs over its own source, and the public-surface ratchet three published libraries each carried a forked copy of. Mechanism only — no app knows its name from here. Bun, zero runtime dependencies (typescript is an optional peer, for public-surface only), ships source.",
 	"type": "module",
 	"scripts": {
 		"typecheck": "tsc -p tsconfig.json --noEmit",
@@ -37,6 +37,12 @@
 			"source": "./src/serve.ts",
 			"import": "./src/serve.ts"
 		},
+		"./worker-safety": {
+			"types": "./src/workerSafety.ts",
+			"bun": "./src/workerSafety.ts",
+			"source": "./src/workerSafety.ts",
+			"import": "./src/workerSafety.ts"
+		},
 		"./smoke": {
 			"types": "./src/smoke.ts",
 			"bun": "./src/smoke.ts",

package/src/edgeFetch.ts

@@ -29,9 +29,11 @@
  * the response body after the LAST header block is bytes — an interim `1xx` block precedes it.
  */
 import { spawnSync } from "node:child_process";
-import { rmSync, writeFileSync } from "node:fs";
+import { readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+// The package's own subpath, never `./roots.ts` — see `publishShape.test.ts`.
+import { forgeState } from "cursedops/roots";
 
 export interface CurlRun {
 	status: number | null;
@@ -150,3 +152,43 @@ export function cloudflareAccessHeaders(envText: string): Record<string, string>
 	if (missing.length > 0) throw new Error(`the Access service token is incomplete: no ${missing.join(" and no ")}`);
 	return { "CF-Access-Client-Id": id, "CF-Access-Client-Secret": secret };
 }
+
+/** Is `host` a stage — i.e. behind the fleet's Access application for every `*-stage` host? */
+export const behindAccess = (host: string): boolean => /-stage\./.test(host);
+
+/**
+ * The fleet's edge fetch, configured the one way every Worker app configured it (task 2145, out
+ * of `apps/family` and `apps/music`): on a `*-stage` host, the Access service token read from
+ * `accessFile` (`$FORGE_STATE/secrets/cloudflare-access.env`); elsewhere, nothing.
+ *
+ * `accessHeadersFor` is returned too, because a smoke asks it FIRST — an incomplete token is the
+ * smoke's own environment, refused as exit 2, never charged to the app as a wall of 403s.
+ */
+export function createStageEdgeFetch(
+	accessFile: string,
+	options: Omit<EdgeFetchOptions, "headersFor"> & { read?: (path: string) => string } = {},
+): { edgeFetch: (url: string, init?: RequestInit) => Promise<Response>; accessHeadersFor: (host: string) => Record<string, string> } {
+	const read = options.read ?? ((path: string) => readFileSync(path, "utf8"));
+	const accessHeadersFor = (host: string): Record<string, string> =>
+		behindAccess(host) ? cloudflareAccessHeaders(read(accessFile)) : {};
+	const { read: _read, ...rest } = options;
+	return { edgeFetch: createEdgeFetch({ ...rest, headersFor: accessHeadersFor }), accessHeadersFor };
+}
+
+/**
+ * THE fleet's edge fetch — {@link createStageEdgeFetch} over `$FORGE_STATE/secrets/cloudflare-access.env`,
+ * the one file every Worker app's smoke, stage walk and CPU tail read the Access token from. Two apps
+ * carried this as a one-line edge-fetch module of their own until task 2145.
+ *
+ * `$FORGE_STATE` comes from the environment or the `forge.env` above `from` (default: wherever this
+ * package is installed, which is inside the generation's checkout). THROWS when neither answers —
+ * a smoke with no idea where its token lives must not guess one.
+ */
+export function fleetEdgeFetch(
+	from: string = import.meta.dir,
+	options: Omit<EdgeFetchOptions, "headersFor"> & { read?: (path: string) => string } = {},
+): ReturnType<typeof createStageEdgeFetch> {
+	const state = forgeState(from);
+	if (!state) throw new Error(`no generation state root above ${from}: set $FORGE_STATE or run inside a checkout with forge.env`);
+	return createStageEdgeFetch(join(state, "secrets", "cloudflare-access.env"), options);
+}

package/src/smoke.ts

@@ -893,3 +893,136 @@ export async function steadyHealth<T = Record<string, unknown>>(
 		await sleep(steady > 0 ? (options.pauseMs ?? 2_000) : (options.retryMs ?? 5_000));
 	}
 }
+
+/** One census entry — a private route and the method it is asked with. */
+export interface CensusRoute {
+	method: string;
+	path: string;
+}
+
+/** What {@link runWorkerSmoke} needs to know about one deployment — data, and one hook. */
+export interface WorkerSmokeSpec {
+	deployment: { env: string; workerName: string; publicUrl: string; previewUrl: string | null };
+	/** Addresses given on the command line. Empty: the preview (no cache in front) and the public URL. */
+	urls?: readonly string[];
+	/** The checkout's HEAD, as `/healthz` reports a commit (`git rev-parse --short=8 HEAD`). */
+	head: string;
+	/** Every private route; each must refuse an anonymous caller with 401. Empty is a FAILURE. */
+	census: readonly CensusRoute[];
+	/** Client routes that must get the HTML shell THROUGH the Worker. */
+	shellPaths: readonly string[];
+	/** The edge fetch (`createStageEdgeFetch`) and its Access half, asked first. */
+	fetch: (url: string, init?: RequestInit) => Promise<Response>;
+	accessHeadersFor: (host: string) => Record<string, string>;
+	/** Where to fix the Access token, for the environment refusal. */
+	accessFileHint: string;
+	/** The app's own checks, per address, after the census — `family`'s `/ws/tree`, say. */
+	extraChecks?: (context: {
+		tag: string;
+		ask: (path: string, init?: RequestInit) => Promise<Response>;
+		health: Record<string, unknown>;
+		record: Smoke["record"];
+	}) => Promise<void>;
+	/** Test seams. */
+	smokeOptions?: Partial<SmokeOptions>;
+	steady?: SteadyOptions;
+	log?: (line: string) => void;
+}
+
+/**
+ * The whole anonymous `worker:smoke` of a deployed Worker, lifted out of `apps/family` and
+ * `apps/music` (task 2145). Per address: `/healthz` settles on THIS commit with the door mounted
+ * (`steadyHealth`), the credential goes back to THIS deployment's own origin, every census route
+ * answers 401, the app's `extraChecks`, the shell through the Worker, and a missing hashed bundle
+ * is a 404 rather than HTML. The ledger and what a red MEANS are {@link createSmoke}'s: an
+ * incomplete Access token is the smoke's own environment (exit 2), never charged to the app.
+ *
+ * The signed-in half is the stage walk's — `collections` went live with this half green and its
+ * owner locked out. Answers the exit code; `process.exit(await runWorkerSmoke(...))`.
+ */
+export async function runWorkerSmoke(spec: WorkerSmokeSpec): Promise<number> {
+	const log = spec.log ?? ((line: string) => console.log(line));
+	const { deployment } = spec;
+	const urls =
+		spec.urls && spec.urls.length > 0
+			? [...spec.urls]
+			: [...new Set([deployment.previewUrl, deployment.publicUrl].filter((u): u is string => Boolean(u)))];
+	const smoke = createSmoke({ base: deployment.publicUrl || (urls[0] as string), ...spec.smokeOptions });
+
+	for (const base of urls) {
+		const host = new URL(base).hostname;
+		try {
+			spec.accessHeadersFor(host);
+		} catch (error) {
+			smoke.refuseEnvironment(
+				`the Access service token for ${host}`,
+				`${(error as Error).message} — fix ${spec.accessFileHint}; nothing about the app was measured`,
+			);
+		}
+	}
+	if (smoke.refusals.length > 0) return smoke.report();
+
+	for (const base of urls) {
+		const tag = new URL(base).hostname;
+		log(`\n▸ ${base}   (the ${deployment.env} deployment: ${deployment.workerName})`);
+		const ask = (path: string, init: RequestInit = {}) => spec.fetch(new URL(path, base).toString(), init);
+
+		let health: Record<string, unknown>;
+		let status: number;
+		try {
+			const read = await steadyHealth<Record<string, unknown>>(
+				() => ask("/healthz"),
+				(body) => body.commit === spec.head && body.apiServed === true,
+				spec.steady,
+			);
+			health = read.body;
+			status = read.response.status;
+		} catch (error) {
+			smoke.markEdgeFault();
+			smoke.record(`${tag} healthz`, false, `${(error as Error).message}${smoke.dnsHint(error as Error)}`);
+			continue;
+		}
+		smoke.record(`${tag} healthz`, status === 200 && health.runtime === "worker", `${status}, runtime ${JSON.stringify(health.runtime)}`);
+		smoke.record(
+			`${tag} door`,
+			health.apiServed === true,
+			`apiServed ${JSON.stringify(health.apiServed)}${health.apiRefusal ? ` (${health.apiRefusal})` : ""}`,
+		);
+		smoke.record(`${tag} commit`, health.commit === spec.head, `serving ${JSON.stringify(health.commit)}, HEAD ${spec.head}`);
+		smoke.record(
+			`${tag} publicUrl`,
+			health.publicUrl === deployment.publicUrl,
+			`credentials go back to ${JSON.stringify(health.publicUrl)} — this deployment's ${deployment.publicUrl}`,
+		);
+
+		const open: string[] = [];
+		for (const route of spec.census) {
+			const answered = (await ask(route.path, { method: route.method })).status;
+			if (answered !== 401) open.push(`${route.method} ${route.path} → ${answered}`);
+		}
+		smoke.record(
+			`${tag} origin-gate`,
+			spec.census.length > 0 && open.length === 0,
+			spec.census.length === 0
+				? "🔴 the route census is EMPTY, so this proves nothing"
+				: open.length === 0
+					? `all ${spec.census.length} private routes refuse an anonymous caller`
+					: `🔴 ${open.join(", ")}`,
+		);
+
+		await spec.extraChecks?.({ tag, ask, health, record: (check, ok, detail) => smoke.record(check, ok, detail) });
+
+		for (const path of spec.shellPaths) {
+			const res = await ask(path, { headers: { accept: "text/html" } });
+			const type = res.headers.get("content-type") ?? "";
+			smoke.record(`${tag} shell ${path}`, res.status === 200 && type.includes("text/html"), `${res.status} ${type}`);
+		}
+		const miss = await ask("/assets/index-no-such-bundle.js");
+		smoke.record(
+			`${tag} missing-bundle`,
+			miss.status === 404 && !(miss.headers.get("content-type") ?? "").includes("text/html"),
+			`a missing bundle is a miss — ${miss.status}`,
+		);
+	}
+	return await smoke.settle();
+}

package/src/workerDeploy.ts

@@ -136,6 +136,39 @@ function readIfThere(path: string): string | null {
 	return existsSync(path) ? readFileSync(path, "utf8") : null;
 }
 
+/**
+ * {@link cloudflareCredential} as the account a REST call needs — both halves, or a throw naming
+ * the file. `createHttpD1` and the secrets API take this shape (task 2145 — `family` and `music`
+ * each carried a copy of this in their Cloudflare credential module).
+ */
+export function cloudflareAccount(
+	file: string,
+	read: (path: string) => string | null = readIfThere,
+): { accountId: string; apiToken: string } {
+	const found = cloudflareCredential(file, read);
+	const accountId = found.CLOUDFLARE_ACCOUNT_ID ?? "";
+	if (!accountId) throw new Error(`${file} has no CLOUDFLARE_ACCOUNT_ID`);
+	return { accountId, apiToken: found.CLOUDFLARE_API_TOKEN as string };
+}
+
+/**
+ * The refusal every app with a Mac host carries into its Worker deploy (task 2145): a PRODUCTION
+ * deploy of an app whose config routes the household's hostname to the Worker, while the Mac's
+ * host job `label` is still loaded — two hosts writing two databases. The cutover stops the Mac
+ * first. Stage deploys and a not-yet-routed production are never refused by it.
+ */
+export function macHostStillLoaded(
+	spec: { env: WorkerEnv; cutOver: boolean; label: string },
+	loaded: (label: string) => boolean = (label) =>
+		spawnSync("launchctl", ["print", `gui/${process.getuid?.() ?? 501}/${label}`], { stdio: "ignore" }).status === 0,
+): Refusal {
+	return () =>
+		spec.env === "production" && spec.cutOver && loaded(spec.label)
+			? `${spec.label} is loaded on this Mac, and this deploy claims the household's hostname for the Worker —\n` +
+				"   two writers, two databases. The cutover stops the Mac and imports its rows FIRST."
+			: null;
+}
+
 /**
  * `command` under the app's Worker CPU wrapper, in the argv {@link parseWorkerCpuArgv} reads.
  *

package/src/workerSafety.ts

@@ -0,0 +1,89 @@
+/**
+ * The two static checks every Worker app's suite runs over its own source — lifted out of
+ * `apps/family` and `apps/music`, which carried them verbatim (task 2145).
+ *
+ *  · {@link valueImports} and {@link isBunOnlySubpath} — the import-graph walk a
+ *    `workerSafe.test.ts` does from `worker/index.ts`, the edges esbuild walks. A value import
+ *    of `bun:sqlite`, or of a library subpath whose export map sends every non-Bun runtime to a
+ *    throwing stub, is a deploy that goes green and a Worker that never starts.
+ *  · {@link asyncShapeHits} and {@link asyncExpectHits} — the await port's silent shapes. A
+ *    sync-to-async port leaves code that typechecks and does nothing: `rows.filter(async …)`
+ *    keeps every row (a Promise is truthy), `flatMap(async …)` flattens Promises, `forEach(async …)`
+ *    starts every write and waits for none, and `expect(async () => …).not.toThrow()` asserts
+ *    nothing for ever.
+ *
+ * Pure over strings, so each rule's failure path is driven against a fixture in this package's
+ * own suite; the apps keep only the walking (which files, which island is allowed).
+ */
+
+/**
+ * Every module specifier `code` imports or re-exports as a VALUE. Type-only edges are erased by
+ * esbuild and cannot pull anything into a bundle, so they are not returned. Pass code with its
+ * comments blanked, so prose that NAMES a module is not an import of it.
+ */
+export function valueImports(code: string): string[] {
+	const out: string[] = [];
+	const pattern =
+		/(?:^|[;\n])\s*(import|export)\s+(type\s+)?(?:[\s\S]*?\sfrom\s+)?["']([^"']+)["']|import\(\s*["']([^"']+)["']\s*\)/g;
+	for (const m of code.matchAll(pattern)) {
+		if (m[2]) continue;
+		const spec = m[3] ?? m[4];
+		if (spec) out.push(spec);
+	}
+	return out;
+}
+
+/**
+ * Is `spec` a package subpath whose export map sends every non-Bun runtime to a stub that
+ * throws? `cursedbelt-server` routes its Bun-only entries to `_bunOnly.js` under `import`:
+ * wrangler bundles it without complaint and the isolate throws at module evaluation. Read off
+ * the INSTALLED package's own `exports` (`readManifest`), so a subpath the library later makes
+ * Bun-only is caught with no edit in the app.
+ */
+export function isBunOnlySubpath(spec: string, readManifest: (pkg: string) => unknown): boolean {
+	if (spec.startsWith(".") || spec.startsWith("node:") || spec.startsWith("bun:")) return false;
+	const parts = spec.split("/");
+	const pkg = spec.startsWith("@") ? parts.slice(0, 2).join("/") : (parts[0] as string);
+	const subpath = `.${spec.slice(pkg.length)}` || ".";
+	const manifest = readManifest(pkg) as { exports?: Record<string, unknown> } | null;
+	const entry = manifest?.exports?.[subpath === "." ? "." : subpath];
+	if (!entry || typeof entry !== "object") return false;
+	const conditions = entry as Record<string, unknown>;
+	const nonBun = conditions.workerd ?? conditions.worker ?? conditions.import ?? conditions.default;
+	return typeof nonBun === "string" && /_bunOnly\b/.test(nonBun);
+}
+
+/**
+ * The await port's silent shapes in `code`, one hit per offending line. `.map(async …)` is a
+ * hit only when no `Promise.all(`/`Promise.allSettled(` opens within the three lines before it,
+ * since the idiomatic spelling breaks across lines. A line carrying `async-shape:ignore` is
+ * excused — on the LINE, never by deleting the rule.
+ */
+export function asyncShapeHits(code: string): { rule: string; line: number }[] {
+	const hits: { rule: string; line: number }[] = [];
+	const lines = code.split("\n");
+	lines.forEach((line, index) => {
+		if (line.includes("async-shape:ignore")) return;
+		const predicate = /\.(filter|some|every|find|findIndex|sort|forEach)\(\s*async\b/.exec(line);
+		if (predicate) hits.push({ rule: `${predicate[1]}-async-predicate`, line: index + 1 });
+		if (/\.flatMap\(\s*async\b/.test(line)) hits.push({ rule: "flatMap-async", line: index + 1 });
+		if (/\.map\(\s*async\b/.test(line)) {
+			const window = lines.slice(Math.max(0, index - 3), index + 1).join(" ");
+			if (!/Promise\.(all|allSettled)\s*\(/.test(window)) hits.push({ rule: "map-async-unawaited", line: index + 1 });
+		}
+	});
+	return hits;
+}
+
+/**
+ * Lines holding `expect(async () => …)` or `expect(() => await …)` — an async function never
+ * throws when CALLED, so `.not.toThrow()` over one passes for ever. The correct spelling is
+ * `await expect(p).rejects…`, or `await p;` for "does not throw".
+ */
+export function asyncExpectHits(code: string): number[] {
+	return code
+		.split("\n")
+		.flatMap((line, index) =>
+			/expect\(\s*(async\s*\(|\(\)\s*=>\s*await\b)/.test(line) && !line.includes("async-shape:ignore") ? [index + 1] : [],
+		);
+}

package/src/workerSecrets.ts

@@ -35,7 +35,11 @@
  * ENROLL a new password (found 2026-09-22 by the stage walk, one step past sign-in).
  */
 import { spawnSync } from "node:child_process";
-import { chmodSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, readFileSync, writeFileSync } from "node:fs";
+// The package's own subpath, never `./workerDeploy.ts`: shipped source may not import a sibling
+// by relative path (`publishShape.test.ts` says why), and a self-reference resolves through the
+// same `exports` map every consumer's does.
+import { readEnvFile, type WorkerEnv, wranglerEnvArgs } from "cursedops/worker-deploy";
 
 /** Worker secret name → the key it is read from in the secrets file. A list means "same name". */
 export type SecretMap = Readonly<Record<string, string>> | readonly string[];
@@ -193,3 +197,120 @@ export function writeSecretsFile(path: string, header: readonly string[], values
 export function throwawaySecret(): string {
 	return Buffer.from(crypto.getRandomValues(new Uint8Array(32))).toString("hex");
 }
+
+/** A deployment before its cutover, and every stage: a throwaway session key and the app's signing key. */
+export const THROWAWAY_SECRETS = {
+	SESSION_SECRET: "SESSION_SECRET",
+	FILE_TOKEN_PRIVATE_KEY: "FILE_TOKEN_PRIVATE_KEY",
+} as const;
+
+/** What {@link runWorkerSecrets} needs to know about ONE app's ONE deployment — data, no logic. */
+export interface WorkerSecretsSpec {
+	/** `family`, `music` — prefixes every message and names the Mac's `<app>.env`. */
+	app: string;
+	env: WorkerEnv;
+	/** Where `wrangler secret put` runs — the app's checkout. */
+	root: string;
+	workerName: string;
+	/** Worker secret name → the key it is read from in {@link secretsFile}. */
+	secrets: SecretMap;
+	/** The file this deployment's values come from. */
+	secretsFile: string;
+	/** Routed to the household's hostname — production uploads the Mac's own file, never a mint. */
+	cutOver: boolean;
+	/** The Mac's `<app>.env` — where a mint reads the app's signing key from. */
+	macSecretsFile: string;
+	/** What a deployment without a signing key cannot do — "signs no portrait URL". */
+	withoutSigningKey: string;
+	/** The app's own sentence about its signing key, for the minted file's header. */
+	signingKeyNote: string;
+	/** The Cloudflare credential (`cloudflare.env`, read by the app). */
+	cloudflare: Record<string, string>;
+}
+
+/**
+ * The whole `worker:secrets` main, lifted out of `apps/family` and `apps/music` (task 2145):
+ *
+ *     --mint    write this deployment's THROWAWAY file (refused after the cutover)
+ *     --check   say what the account holds against the set, change nothing
+ *     (none)    upload EXACTLY the set over a pipe, delete every other name, read it back
+ *
+ * Answers the exit code: 0 done, 1 the account does not hold exactly the set, 2 this machine's
+ * own files are wrong (nothing about the Worker was measured).
+ */
+export async function runWorkerSecrets(
+	spec: WorkerSecretsSpec,
+	argv: readonly string[],
+	deps: { ops?: SecretOps; read?: (path: string) => string | null; write?: typeof writeSecretsFile } = {},
+): Promise<number> {
+	const tag = `[${spec.app}]`;
+	const read = deps.read ?? ((path: string) => (existsSync(path) ? readFileSync(path, "utf8") : null));
+
+	if (argv.includes("--mint")) {
+		if (spec.cutOver) {
+			console.error(`${tag} --mint makes a THROWAWAY set. Production after the cutover uploads the Mac's own ${spec.app}.env.`);
+			return 2;
+		}
+		const signing = readEnvFile(read(spec.macSecretsFile) ?? "").FILE_TOKEN_PRIVATE_KEY;
+		if (!signing) {
+			console.error(`${tag} ${spec.app}.env carries no FILE_TOKEN_PRIVATE_KEY — without it this deployment ${spec.withoutSigningKey}.`);
+			return 2;
+		}
+		const who = spec.env === "stage" ? "the STAGE" : "the PREVIEW";
+		(deps.write ?? writeSecretsFile)(
+			spec.secretsFile,
+			[
+				`${spec.workerName} — ${who}'s Worker secrets. 0600, never committed.`,
+				`Minted by \`bun run worker:secrets -- ${spec.env === "stage" ? "--env stage " : ""}--mint\`. The session key is a`,
+				"throwaway and opens nothing the owner owns.",
+				spec.signingKeyNote,
+			],
+			{ SESSION_SECRET: throwawaySecret(), FILE_TOKEN_PRIVATE_KEY: signing },
+		);
+		console.log(`✅ minted ${who}'s secrets into ${spec.secretsFile} (0600)`);
+		return 0;
+	}
+
+	const account = spec.cloudflare.CLOUDFLARE_ACCOUNT_ID ?? "";
+	if (!deps.ops && !account) {
+		console.error(`${tag} cloudflare.env has no CLOUDFLARE_ACCOUNT_ID`);
+		return 2;
+	}
+	const ops =
+		deps.ops ??
+		restSecretOps({
+			api: cloudflareApi(spec.cloudflare.CLOUDFLARE_API_TOKEN as string),
+			account,
+			script: spec.workerName,
+			put: (name, value) =>
+				wranglerSecretPut(name, value, { cwd: spec.root, envArgs: wranglerEnvArgs(spec.env), env: spec.cloudflare }),
+		});
+	const before = await ops.held();
+	console.log(`${spec.workerName} holds: ${before.join(", ") || "(nothing)"}`);
+
+	if (argv.includes("--check")) {
+		const plan = planSecrets(spec.secrets, before, {});
+		const missing = plan.wanted.filter((name) => !before.includes(name));
+		if (missing.length > 0) console.error(`🔴 missing: ${missing.join(", ")}`);
+		if (plan.remove.length > 0) console.error(`🔴 not in the ${spec.env} set: ${plan.remove.join(", ")}`);
+		return missing.length + plan.remove.length > 0 ? 1 : 0;
+	}
+	const text = read(spec.secretsFile);
+	if (text === null) {
+		console.error(`${tag} no secrets file at ${spec.secretsFile}${spec.cutOver ? "" : " — make it: bun run worker:secrets -- --mint"}`);
+		return 2;
+	}
+	const plan = planSecrets(spec.secrets, before, readEnvFile(text));
+	if (plan.absent.length > 0) {
+		console.error(`${tag} ${spec.secretsFile} has no ${plan.absent.join(" and no ")}`);
+		return 2;
+	}
+	const synced = await syncSecrets(plan, ops);
+	for (const line of synced.lines) console.log(`▸ ${line}`);
+	console.log(
+		synced.ok
+			? `✅ ${spec.workerName} holds exactly its ${spec.env} set`
+			: `🔴 ${spec.workerName} does not hold exactly its ${spec.env} set`,
+	);
+	return synced.ok ? 0 : 1;
+}