@mccaskie-labs/workbench-config 0.1.10 → 0.1.12

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @mccaskie-labs/workbench-config
 
+## 0.1.12
+
+### Patch Changes
+
+- Capabilities: analytics lists cf_web_analytics_site_delete and the WEB_ANALYTICS_TOKEN config written by cf_worker_secret_put source=web_analytics; manifests may say a tool ships in phase 5.
+
+## 0.1.11
+
+### Patch Changes
+
+- The Gateway's error list gains `content_refused` (422) and `content_check_unavailable` (503) for the Workbench content rules (`docs/spec.md` §2.7).
+
 ## 0.1.10
 
 ### Patch Changes

package/capabilities/analytics.json

@@ -12,21 +12,40 @@
       "eventsMigration"
     ],
     "tools": [
-      "cf_web_analytics_site_create"
+      "cf_web_analytics_site_create",
+      "cf_web_analytics_site_delete",
+      "cf_worker_secret_put"
     ]
   },
+  "config": [
+    {
+      "name": "WEB_ANALYTICS_TOKEN",
+      "required": false,
+      "secret": false,
+      "environments": [
+        "staging",
+        "production"
+      ],
+      "description": "The public beacon token of the Web Analytics site for the Worker's own hostname, for beaconScript(); written by cf_worker_secret_put source=web_analytics (free, new or replacing). Unset in development and CI, where beaconScript returns ''"
+    }
+  ],
   "actions": [
     {
       "tool": "cf_web_analytics_site_create",
       "gate": "free",
       "ships": "4"
+    },
+    {
+      "tool": "cf_web_analytics_site_delete",
+      "gate": "two_step",
+      "ships": "5"
     }
   ],
   "rules": [
     {
       "id": "analytics.beacon-on-pages",
       "kind": "must",
-      "text": "Put beaconScript(token) on every page, with the site's public beacon token from cf_web_analytics_site_create.",
+      "text": "Put beaconScript(env.WEB_ANALYTICS_TOKEN) on every page; Control writes the site's public beacon token onto each Worker with cf_worker_secret_put source=web_analytics.",
       "enforced_by": "review",
       "probe": "analytics.beacon"
     },

package/capabilities/gateway.json

@@ -55,6 +55,8 @@
     { "code": "forbidden_scope", "http": 403, "retryable": false, "meaning": "The key doesn't carry the scope this endpoint needs" },
     { "code": "invalid_request", "http": 400, "retryable": false, "meaning": "The body or a required header is missing or malformed" },
     { "code": "budget_exceeded", "http": 402, "retryable": false, "meaning": "The environment's enforced monthly budget, or the global ceiling, is reached" },
+    { "code": "content_refused", "http": 422, "retryable": false, "meaning": "The Workbench content rules refuse what was sent (stage input) or what the vendor made (stage output). The error names the rule, the stage and the rules version, never the content. A vendor's own safety block is reported the same way, with rule vendor" },
+    { "code": "content_check_unavailable", "http": 503, "retryable": true, "meaning": "The content check couldn't be run, so nothing was returned. Nothing passes unchecked" },
     { "code": "rate_limited", "http": 429, "retryable": true, "meaning": "Per-key rate limit; it stops runaway loops, budgets limit spend" },
     { "code": "not_available", "http": 501, "retryable": false, "meaning": "Not built yet, e.g. bulk email" },
     { "code": "upstream_error", "http": 502, "retryable": true, "meaning": "The vendor failed after the Gateway's retries" },

package/capabilities/schema.json

@@ -211,6 +211,7 @@
             "enum": [
               "3",
               "4",
+              "5",
               "later"
             ]
           }

package/dist/capabilities.gen.d.ts

@@ -1,4 +1,4 @@
-export declare const MANIFEST_VERSION: "cf96a8fa8ff2";
+export declare const MANIFEST_VERSION: "f3d5b55e579d";
 export declare const capabilities: {
     readonly ai: {
         readonly $schema: "./schema.json";
@@ -145,18 +145,29 @@ export declare const capabilities: {
         readonly summary: "Cloudflare Web Analytics counts page views through a beacon on every page; product events go into the app's own database through workbench-analytics. Apps hold no Cloudflare token: Claude reads page views through Control.";
         readonly status: "built";
         readonly surfaces: {
-            readonly tools: readonly ["cf_web_analytics_site_create"];
+            readonly tools: readonly ["cf_web_analytics_site_create", "cf_web_analytics_site_delete", "cf_worker_secret_put"];
             readonly package: readonly ["beaconScript", "createEvents", "eventsMigration"];
         };
+        readonly config: readonly [{
+            readonly name: "WEB_ANALYTICS_TOKEN";
+            readonly required: false;
+            readonly secret: false;
+            readonly environments: readonly ["staging", "production"];
+            readonly description: "The public beacon token of the Web Analytics site for the Worker's own hostname, for beaconScript(); written by cf_worker_secret_put source=web_analytics (free, new or replacing). Unset in development and CI, where beaconScript returns ''";
+        }];
         readonly actions: readonly [{
             readonly tool: "cf_web_analytics_site_create";
             readonly gate: "free";
             readonly ships: "4";
+        }, {
+            readonly tool: "cf_web_analytics_site_delete";
+            readonly gate: "two_step";
+            readonly ships: "5";
         }];
         readonly rules: readonly [{
             readonly id: "analytics.beacon-on-pages";
             readonly kind: "must";
-            readonly text: "Put beaconScript(token) on every page, with the site's public beacon token from cf_web_analytics_site_create.";
+            readonly text: "Put beaconScript(env.WEB_ANALYTICS_TOKEN) on every page; Control writes the site's public beacon token onto each Worker with cf_worker_secret_put source=web_analytics.";
             readonly enforced_by: "review";
             readonly probe: "analytics.beacon";
         }, {
@@ -935,6 +946,16 @@ export declare const capabilities: {
             readonly http: 402;
             readonly retryable: false;
             readonly meaning: "The environment's enforced monthly budget, or the global ceiling, is reached";
+        }, {
+            readonly code: "content_refused";
+            readonly http: 422;
+            readonly retryable: false;
+            readonly meaning: "The Workbench content rules refuse what was sent (stage input) or what the vendor made (stage output). The error names the rule, the stage and the rules version, never the content. A vendor's own safety block is reported the same way, with rule vendor";
+        }, {
+            readonly code: "content_check_unavailable";
+            readonly http: 503;
+            readonly retryable: true;
+            readonly meaning: "The content check couldn't be run, so nothing was returned. Nothing passes unchecked";
         }, {
             readonly code: "rate_limited";
             readonly http: 429;

package/dist/capabilities.gen.js

@@ -1,6 +1,6 @@
 // Generated by `npm run capabilities:build` from capabilities/*.json. Do not edit.
 // check:capabilities fails in Checks when this file is stale.
-export const MANIFEST_VERSION = "cf96a8fa8ff2";
+export const MANIFEST_VERSION = "f3d5b55e579d";
 export const capabilities = {
     "ai": {
         "$schema": "./schema.json",
@@ -203,7 +203,9 @@ export const capabilities = {
         "status": "built",
         "surfaces": {
             "tools": [
-                "cf_web_analytics_site_create"
+                "cf_web_analytics_site_create",
+                "cf_web_analytics_site_delete",
+                "cf_worker_secret_put"
             ],
             "package": [
                 "beaconScript",
@@ -211,18 +213,35 @@ export const capabilities = {
                 "eventsMigration"
             ]
         },
+        "config": [
+            {
+                "name": "WEB_ANALYTICS_TOKEN",
+                "required": false,
+                "secret": false,
+                "environments": [
+                    "staging",
+                    "production"
+                ],
+                "description": "The public beacon token of the Web Analytics site for the Worker's own hostname, for beaconScript(); written by cf_worker_secret_put source=web_analytics (free, new or replacing). Unset in development and CI, where beaconScript returns ''"
+            }
+        ],
         "actions": [
             {
                 "tool": "cf_web_analytics_site_create",
                 "gate": "free",
                 "ships": "4"
+            },
+            {
+                "tool": "cf_web_analytics_site_delete",
+                "gate": "two_step",
+                "ships": "5"
             }
         ],
         "rules": [
             {
                 "id": "analytics.beacon-on-pages",
                 "kind": "must",
-                "text": "Put beaconScript(token) on every page, with the site's public beacon token from cf_web_analytics_site_create.",
+                "text": "Put beaconScript(env.WEB_ANALYTICS_TOKEN) on every page; Control writes the site's public beacon token onto each Worker with cf_worker_secret_put source=web_analytics.",
                 "enforced_by": "review",
                 "probe": "analytics.beacon"
             },
@@ -1253,6 +1272,18 @@ export const capabilities = {
                 "retryable": false,
                 "meaning": "The environment's enforced monthly budget, or the global ceiling, is reached"
             },
+            {
+                "code": "content_refused",
+                "http": 422,
+                "retryable": false,
+                "meaning": "The Workbench content rules refuse what was sent (stage input) or what the vendor made (stage output). The error names the rule, the stage and the rules version, never the content. A vendor's own safety block is reported the same way, with rule vendor"
+            },
+            {
+                "code": "content_check_unavailable",
+                "http": 503,
+                "retryable": true,
+                "meaning": "The content check couldn't be run, so nothing was returned. Nothing passes unchecked"
+            },
             {
                 "code": "rate_limited",
                 "http": 429,

package/dist/capability-schema.d.ts

@@ -146,6 +146,7 @@ export declare const capabilitySchema: z.ZodObject<{
         ships: z.ZodEnum<{
             3: "3";
             4: "4";
+            5: "5";
             later: "later";
         }>;
     }, z.core.$strict>>>;

package/dist/capability-schema.js

@@ -45,7 +45,7 @@ const action = z.strictObject({
     tool: z.string().regex(/^[a-z]+_[a-z0-9_]+$/),
     gate: z.enum(["free", "two_step", "two_step_on_production", "two_step_when"]),
     when: z.string().min(1).optional(),
-    ships: z.enum(["3", "4", "later"]),
+    ships: z.enum(["3", "4", "5", "later"]),
 });
 const errorEntry = z.strictObject({
     code,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mccaskie-labs/workbench-config",
-  "version": "0.1.10",
+  "version": "0.1.12",
   "description": "Workbench app configuration: WORKBENCH_ENV, typed variables that fail by name, secrets that are never printed, and the capabilities manifest.",
   "license": "UNLICENSED",
   "type": "module",