Publish Bearfire environment validation

.github/workflows/ci.yml

@@ -0,0 +1,22 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    steps:
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v6
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm check

.github/workflows/publish.yml

@@ -0,0 +1,29 @@
+name: publish
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  publish:
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@v6
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          cache: pnpm
+          registry-url: https://npm.pkg.github.com
+          scope: "@bearfire-dev"
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm check
+      - run: pnpm publish --no-git-checks
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -0,0 +1,3 @@
+dist/
+node_modules/
+*.tgz

.npmrc

@@ -0,0 +1 @@
+@bearfire-dev:registry=https://npm.pkg.github.com

AGENTS.md

@@ -0,0 +1,7 @@
+# Agent instructions
+
+- Use pnpm.
+- Run `pnpm check` after each code change.
+- Keep `@t3-oss/env-core` and `zod` as peer dependencies.
+- Do not add runtime dependencies.
+- Use tabs and semicolons in TypeScript.

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Bearfire
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,61 @@
+# @bearfire-dev/env
+
+Use T3 Env and Zod 4 with Bearfire defaults. The package has no bundled runtime dependencies.
+
+## Install
+
+Authenticate to GitHub Packages with `read:packages`, then install the package.
+
+Add the GitHub Packages registry to `.npmrc`:
+
+```ini
+@bearfire-dev:registry=https://npm.pkg.github.com
+```
+
+```bash
+pnpm add @bearfire-dev/env @t3-oss/env-core zod
+```
+
+## Node
+
+```ts
+import { createBearfireEnv, secret } from "@bearfire-dev/env";
+import { z } from "zod";
+
+export const env = createBearfireEnv({
+	server: {
+		DATABASE_URL: z.url(),
+		BETTER_AUTH_SECRET: secret("BETTER_AUTH_SECRET"),
+	},
+	runtimeEnv: process.env,
+});
+```
+
+## Cloudflare Workers
+
+Workers receive variables through request bindings. Supply those bindings as `runtimeEnv` during request handling.
+
+```ts
+import { createRequestEnv, secret } from "@bearfire-dev/env";
+
+const getEnv = createRequestEnv({
+	server: { SHARED_KEY: secret("SHARED_KEY") },
+});
+
+export default {
+	fetch(_request: Request, bindings: Env) {
+		const env = getEnv(bindings);
+		return new Response(env.SHARED_KEY.length.toString());
+	},
+};
+```
+
+The helper validates one time for each Worker bindings object.
+
+## Guard only
+
+```ts
+import { isDefaultKey, throwIfDefaultKey } from "@bearfire-dev/env/guard";
+```
+
+The guard rejects `replace_default_key_` values and the legacy Infisical placeholder.

package.json

@@ -0,0 +1,48 @@
+{
+	"name": "@bearfire-dev/env",
+	"version": "0.1.0",
+	"description": "Bearfire environment validation with T3 Env and Zod",
+	"type": "module",
+	"license": "MIT",
+	"repository": {
+		"type": "git",
+		"url": "https://github.com/bearfire-dev/env.git"
+	},
+	"files": [
+		"dist"
+	],
+	"exports": {
+		".": {
+			"types": "./dist/index.d.ts",
+			"import": "./dist/index.js"
+		},
+		"./guard": {
+			"types": "./dist/guard.d.ts",
+			"import": "./dist/guard.js"
+		}
+	},
+	"scripts": {
+		"build": "tsc -p tsconfig.json",
+		"test": "vitest run",
+		"check": "pnpm build && pnpm test",
+		"prepublishOnly": "pnpm check"
+	},
+	"peerDependencies": {
+		"@t3-oss/env-core": "^0.13.11",
+		"zod": "^4.0.0"
+	},
+	"devDependencies": {
+		"@t3-oss/env-core": "^0.13.11",
+		"typescript": "^6.0.0",
+		"vitest": "^4.0.0",
+		"zod": "^4.0.0"
+	},
+	"publishConfig": {
+		"access": "public",
+		"registry": "https://npm.pkg.github.com"
+	},
+	"packageManager": "pnpm@10.33.4",
+	"engines": {
+		"node": ">=20"
+	}
+}