@modootoday/envs-wrangler
v0.5.2
Published
Mirrors the wrangler command surface, projects envs-config declarations into wrangler.toml, and puts a worker its secrets.
Readme
@modootoday/envs-wrangler
Mirrors the wrangler command surface and projects the values
@modootoday/envs and
@modootoday/envs-config manage,
instead of asking for them at a prompt.
The mirror is pass-through
Measured against wrangler 4.90.1: 45 top-level namespaces, 392 commands including subcommands. Writing those out would be a copy, and a copy is stale the day wrangler releases. So anything this package does not intercept is forwarded verbatim — argv, stdio, exit code. A wrangler command added tomorrow works here tomorrow, with no release of this package.
Every command gets the values
Whatever you run, the declaration is resolved and its values are in the child's
environment. envs-wrangler pages deploy and envs-wrangler secret put are the
same shape, which is the point of putting a different name in front of wrangler
at all.
Values reach wrangler through the child environment, never through argv, so they do not land in a process listing or a shell history.
What is intercepted
Interception is a smaller question: which commands must not run at all when the declaration resolved nothing.
secret put | bulk | delete | list
pages secret put | bulk | delete | list
versions secret put | bulk | delete | list
secrets-store create | update | duplicate | get | delete | list
deploy · dev · typesThese never prompt. If nothing resolved they fail and send nothing, because a prompt turns a projection into manual entry that nothing downstream can detect.
Everything else forwards even with nothing resolved. pages deploy is the
reason the two are separate: it wants the account credential in its environment,
not a secret put into a deployed artifact, and a project that authenticates from
its ambient environment must still be able to deploy.
Two entry points
@modootoday/envs-wrangler writes files and talks to nobody. It contains no
fetch(, no CLOUDFLARE_API_TOKEN and no Authorization — asserted by a test
over the source, so it holds rather than being claimed here.
@modootoday/envs-wrangler/api is the half that reaches a live Cloudflare
account. Importing it is the decision to need credentials.
Design
plan/20260908062202-envs-config-package-design.md in tools.datalab.
