@mccaskie-labs/workbench-config 0.0.0-stage → 0.1.1

package/dist/secrets.js

@@ -0,0 +1,44 @@
+import { missing } from "./errors.js";
+/**
+ * Reads a Secrets Store binding (a secret shared between Workers). Throws if
+ * the value is empty. `name` is only used to name the binding in the error.
+ */
+export async function sharedSecret(binding, name = "Secrets Store binding") {
+    if (!binding || typeof binding.get !== "function")
+        throw missing(name, "no Secrets Store binding");
+    let value;
+    try {
+        value = await binding.get();
+    }
+    catch {
+        // The binding's own error can say why; it can't hold the value, which was never read.
+        throw missing(name, "the Secrets Store could not return it");
+    }
+    if (typeof value !== "string" || value === "")
+        throw missing(name);
+    return value;
+}
+/** Reads a Worker secret or variable by name. Throws, naming it, if it is missing or empty. */
+export function workerSecret(env, name) {
+    const value = env[name];
+    if (typeof value !== "string" || value === "")
+        throw missing(name);
+    return value;
+}
+/**
+ * Replaces a secret for logs. Always `[redacted]`, whatever the value: no
+ * prefix, suffix or length is kept, so a log line can never carry part of it.
+ * `redactAll` does the same for every occurrence inside a longer string.
+ */
+export function redact(_value) {
+    return "[redacted]";
+}
+/** Replaces every occurrence of each secret in `text` with `[redacted]`. Empty secrets are ignored. */
+export function redactAll(text, secrets) {
+    let out = text;
+    for (const secret of secrets) {
+        if (typeof secret === "string" && secret !== "")
+            out = out.split(secret).join("[redacted]");
+    }
+    return out;
+}

package/package.json

@@ -1,6 +1,50 @@
 {
   "name": "@mccaskie-labs/workbench-config",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.1",
+  "description": "Workbench app configuration: WORKBENCH_ENV, typed variables that fail by name, secrets that are never printed, and the capabilities manifest.",
+  "license": "UNLICENSED",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/mccaskie-labs/workbench.git",
+    "directory": "packages/config"
+  },
+  "engines": {
+    "node": ">=24"
+  },
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./capabilities/*.json": "./capabilities/*.json",
+    "./package.json": "./package.json"
+  },
+  "bin": {
+    "workbench-config": "./dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "capabilities",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p test/tsconfig.json",
+    "test": "vitest run",
+    "build": "node scripts/build.mjs",
+    "prepack": "node scripts/build.mjs"
+  },
+  "peerDependencies": {
+    "zod": "^4.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "24.19.2",
+    "vitest": "^5.1.0",
+    "zod": "4.6.7"
+  }
+}