@heyditto/cli 2.5.2 → 2.7.0

package/dist/secret-stores/types.d.ts

@@ -0,0 +1,108 @@
+/**
+ * Shared shape for every secret store the CLI can hand a freshly minted key to.
+ *
+ * The contract every store must honour: the plaintext key travels to the
+ * platform CLI over stdin (directly, or through a path the CLI reads such as
+ * `/dev/stdin`), never through argv. Anything in argv is visible to every
+ * process on the machine via `ps`, and lands in shell history when a human
+ * copies the command.
+ */
+/** Stable ids, also the values accepted by `--store`. */
+export declare const STORE_IDS: readonly ["github", "gitlab", "aws", "gcloud", "azure", "1password", "vault", "doppler", "cloudflare", "vercel", "kubernetes", "fly"];
+export type StoreId = (typeof STORE_IDS)[number];
+/** Flags that scope where a secret lands. Each store reads the ones it supports. */
+export interface StoreOptions {
+    /** Secret / variable / item name, from --secret or a store shorthand. */
+    secret?: string;
+    repo?: string;
+    env?: string;
+    org?: string;
+    region?: string;
+    project?: string;
+    keyVault?: string;
+    opVault?: string;
+    mount?: string;
+    field?: string;
+    dopplerConfig?: string;
+    worker?: string;
+    vercelTarget?: string;
+    namespace?: string;
+    k8sKey?: string;
+    app?: string;
+}
+/** Every option name a store may claim, for the "unsupported flag" check. */
+export type StoreOptionKey = Exclude<keyof StoreOptions, "secret">;
+/**
+ * Where the secret lands, resolved from the flags (and sometimes the current
+ * directory). `fields` are echoed into `--output json`; `describe` is the human
+ * sentence in the confirmation prompt and the success line.
+ */
+export interface StoreTarget {
+    describe: string;
+    fields: Record<string, string>;
+}
+/**
+ * How the plaintext reaches the platform CLI.
+ *
+ * - `stdin`: the value (or a rendered `payload`) is written to the child's stdin.
+ * - `path`: argv names a file the CLI reads. On POSIX that is `/dev/stdin` with
+ *   the value piped in; on Windows the runner writes a 0600 temp file and
+ *   substitutes its path for the `{}` placeholder.
+ *
+ * `note` explains what the attempt does, for the error message when every
+ * attempt fails.
+ */
+export type Delivery = {
+    note: string;
+    /** Wraps the plaintext (a JSON template, a KEY=VALUE line) before it is sent. */
+    payload?: (value: string) => string;
+} & ({
+    kind: "stdin";
+    args: string[];
+} | {
+    kind: "path";
+    args: string[];
+});
+export interface Gateway {
+    /** OpenAI-compatible base, e.g. https://inference.heyditto.ai/v1 */
+    openaiBaseUrl: string;
+    /** Anthropic base (no /v1), e.g. https://inference.heyditto.ai */
+    anthropicBaseUrl: string;
+}
+export interface SecretStore {
+    id: StoreId;
+    /** Human label, e.g. "GitHub Actions". */
+    label: string;
+    /** Executable the CLI delegates to. */
+    bin: string;
+    /** Other names the same CLI ships under, e.g. flyctl for fly. */
+    altBins?: readonly string[];
+    /** How this CLI reports its version (az and vault do not take --version). */
+    versionArgs?: readonly string[];
+    /** Shorthand flag that both selects this store and names the secret. */
+    shorthand: string;
+    /** What the shorthand's value is called in help text, e.g. "NAME" or "TITLE". */
+    nameLabel: string;
+    /** How to get the CLI and sign in, quoted in errors when it is missing. */
+    installHint: string;
+    /** Scoping options this store understands; anything else is rejected. */
+    options: readonly StoreOptionKey[];
+    /** Rejects names the platform will not accept. Returns the trimmed name. */
+    validateName(name: string): string;
+    /** Cheap failure before anything is minted: binary present and signed in. */
+    preflight(): void;
+    /** Reads the scoping flags; may infer from the cwd the way `gh` does. */
+    resolveTarget(options: StoreOptions): StoreTarget;
+    /**
+     * Attempts, in order, for storing `name` at `target`. Several platforms
+     * separate "create" from "add a new version", so the second attempt runs
+     * only when the first fails (e.g. the secret already exists).
+     */
+    deliveries(name: string, target: StoreTarget): Delivery[];
+    /** How to read the secret back / wire it into a runtime. */
+    usage(name: string, target: StoreTarget, gateway: Gateway): string[];
+    /** Key label in the Ditto app. Defaults to `<store>:<target>:<name>`. */
+    keyName?(name: string, target: StoreTarget): string;
+    /** Platform reference for the stored value, echoed in `--output json`. */
+    snippet?(name: string, target: StoreTarget): string;
+}

package/dist/secret-stores/types.js

@@ -0,0 +1,25 @@
+/**
+ * Shared shape for every secret store the CLI can hand a freshly minted key to.
+ *
+ * The contract every store must honour: the plaintext key travels to the
+ * platform CLI over stdin (directly, or through a path the CLI reads such as
+ * `/dev/stdin`), never through argv. Anything in argv is visible to every
+ * process on the machine via `ps`, and lands in shell history when a human
+ * copies the command.
+ */
+/** Stable ids, also the values accepted by `--store`. */
+export const STORE_IDS = [
+    "github",
+    "gitlab",
+    "aws",
+    "gcloud",
+    "azure",
+    "1password",
+    "vault",
+    "doppler",
+    "cloudflare",
+    "vercel",
+    "kubernetes",
+    "fly",
+];
+//# sourceMappingURL=types.js.map

package/dist/secret-stores/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/secret-stores/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,yDAAyD;AACzD,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,QAAQ;IACR,QAAQ;IACR,KAAK;IACL,QAAQ;IACR,OAAO;IACP,WAAW;IACX,OAAO;IACP,SAAS;IACT,YAAY;IACZ,QAAQ;IACR,YAAY;IACZ,KAAK;CACG,CAAC"}

package/dist/secret-stores/vault.d.ts

@@ -0,0 +1,7 @@
+import type { SecretStore } from "./types.js";
+/**
+ * HashiCorp Vault kv. `FIELD=-` makes Vault read that single field's value
+ * from stdin. `kv patch` leaves the path's other fields alone but needs the
+ * path to exist, so `kv put` is the fallback that creates it.
+ */
+export declare const vault: SecretStore;

package/dist/secret-stores/vault.js

@@ -0,0 +1,47 @@
+import { preflight } from "./exec.js";
+import { secretPath, slug } from "./naming.js";
+const INSTALL_HINT = "install the Vault CLI from https://developer.hashicorp.com/vault/install (brew install hashicorp/tap/vault), then export VAULT_ADDR and run `vault login`";
+function target(options) {
+    const mount = options.mount ? slug("--mount", options.mount, /^[A-Za-z0-9_.\-/]+$/) : "secret";
+    const field = options.field ? slug("--field", options.field, /^[A-Za-z0-9_.-]+$/) : "token";
+    return { describe: `Vault ${mount}/ (field ${field})`, fields: { mount, field } };
+}
+/**
+ * HashiCorp Vault kv. `FIELD=-` makes Vault read that single field's value
+ * from stdin. `kv patch` leaves the path's other fields alone but needs the
+ * path to exist, so `kv put` is the fallback that creates it.
+ */
+export const vault = {
+    id: "vault",
+    label: "HashiCorp Vault",
+    bin: "vault",
+    shorthand: "--vault-secret",
+    nameLabel: "PATH",
+    installHint: INSTALL_HINT,
+    versionArgs: ["version"],
+    options: ["mount", "field"],
+    validateName: (name) => secretPath("Vault kv path", name),
+    preflight: () => preflight({
+        bin: "vault",
+        label: "HashiCorp Vault",
+        installHint: INSTALL_HINT,
+        versionArgs: vault.versionArgs,
+        authArgs: ["token", "lookup"],
+        authHint: "Set VAULT_ADDR and run `vault login` first.",
+    }),
+    resolveTarget: target,
+    deliveries: (path, t) => {
+        const args = (verb) => ["kv", verb, `-mount=${t.fields.mount}`, path, `${t.fields.field}=-`];
+        return [
+            { note: "vault kv patch", kind: "stdin", args: args("patch") },
+            { note: "vault kv put", kind: "stdin", args: args("put") },
+        ];
+    },
+    usage: (path, t, gateway) => [
+        "Read it back at runtime:",
+        `  vault kv get -mount=${t.fields.mount} -field=${t.fields.field} ${path}`,
+        `  # export OPENAI_API_KEY=$(…) with OPENAI_BASE_URL=${gateway.openaiBaseUrl}`,
+        `  # or ANTHROPIC_AUTH_TOKEN with ANTHROPIC_BASE_URL=${gateway.anthropicBaseUrl}`,
+    ],
+};
+//# sourceMappingURL=vault.js.map

package/dist/secret-stores/vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../../src/secret-stores/vault.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAG/C,MAAM,YAAY,GAChB,2JAA2J,CAAC;AAE9J,SAAS,MAAM,CAAC,OAAqB;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC/F,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC5F,OAAO,EAAE,QAAQ,EAAE,SAAS,KAAK,YAAY,KAAK,GAAG,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;AACpF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,KAAK,GAAgB;IAChC,EAAE,EAAE,OAAO;IACX,KAAK,EAAE,iBAAiB;IACxB,GAAG,EAAE,OAAO;IACZ,SAAS,EAAE,gBAAgB;IAC3B,SAAS,EAAE,MAAM;IACjB,WAAW,EAAE,YAAY;IACzB,WAAW,EAAE,CAAC,SAAS,CAAC;IACxB,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;IAC3B,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,eAAe,EAAE,IAAI,CAAC;IACzD,SAAS,EAAE,GAAG,EAAE,CACd,SAAS,CAAC;QACR,GAAG,EAAE,OAAO;QACZ,KAAK,EAAE,iBAAiB;QACxB,WAAW,EAAE,YAAY;QACzB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;QAC7B,QAAQ,EAAE,6CAA6C;KACxD,CAAC;IACJ,aAAa,EAAE,MAAM;IACrB,UAAU,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;QACrG,OAAO;YACL,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YAC9D,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;SAC3D,CAAC;IACJ,CAAC;IACD,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAC3B,0BAA0B;QAC1B,yBAAyB,CAAC,CAAC,MAAM,CAAC,KAAK,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI,EAAE;QAC1E,uDAAuD,OAAO,CAAC,aAAa,EAAE;QAC9E,uDAAuD,OAAO,CAAC,gBAAgB,EAAE;KAClF;CACF,CAAC"}

package/dist/secret-stores/vercel.d.ts

@@ -0,0 +1,9 @@
+import type { SecretStore } from "./types.js";
+/**
+ * Vercel environment variables. `vercel env add NAME <target>` takes the value
+ * from stdin (its `--value` flag is the argv-leaking alternative); `--force`
+ * replaces an existing variable and `--sensitive` hides it from the dashboard.
+ */
+export declare const vercel: SecretStore;
+/** Exported for the flag's help text and tests. */
+export declare const VERCEL_TARGETS: readonly ["production", "preview", "development"];

package/dist/secret-stores/vercel.js

@@ -0,0 +1,49 @@
+import { preflight } from "./exec.js";
+import { envStyleName } from "./naming.js";
+const INSTALL_HINT = "install the Vercel CLI from https://vercel.com/docs/cli (npm i -g vercel), then run `vercel login` and `vercel link`";
+const TARGETS = ["production", "preview", "development"];
+function target(options) {
+    const raw = options.vercelTarget?.trim() ?? "production";
+    if (!TARGETS.includes(raw)) {
+        throw new Error(`--vercel-target must be one of: ${TARGETS.join(", ")}`);
+    }
+    return { describe: `Vercel ${raw} environment`, fields: { target: raw } };
+}
+/**
+ * Vercel environment variables. `vercel env add NAME <target>` takes the value
+ * from stdin (its `--value` flag is the argv-leaking alternative); `--force`
+ * replaces an existing variable and `--sensitive` hides it from the dashboard.
+ */
+export const vercel = {
+    id: "vercel",
+    label: "Vercel",
+    bin: "vercel",
+    shorthand: "--vercel-env",
+    nameLabel: "NAME",
+    installHint: INSTALL_HINT,
+    options: ["vercelTarget"],
+    validateName: (name) => envStyleName("Vercel environment variable", name),
+    preflight: () => preflight({
+        bin: "vercel",
+        label: "Vercel",
+        installHint: INSTALL_HINT,
+        authArgs: ["whoami"],
+        authHint: "Run `vercel login` first, or set VERCEL_TOKEN.",
+    }),
+    resolveTarget: target,
+    deliveries: (name, t) => [
+        {
+            note: "vercel env add",
+            kind: "stdin",
+            args: ["env", "add", name, t.fields.target, "--force", "--sensitive", "--yes", "--non-interactive"],
+        },
+    ],
+    usage: (name, t, gateway) => [
+        `Pull it into a local .env: vercel env pull --environment=${t.fields.target}`,
+        `  # ${name} is in the ${t.fields.target} environment of the linked project`,
+        `  # point clients at OPENAI_BASE_URL=${gateway.openaiBaseUrl}`,
+    ],
+};
+/** Exported for the flag's help text and tests. */
+export const VERCEL_TARGETS = TARGETS;
+//# sourceMappingURL=vercel.js.map

package/dist/secret-stores/vercel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vercel.js","sourceRoot":"","sources":["../../src/secret-stores/vercel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,MAAM,YAAY,GAChB,sHAAsH,CAAC;AAEzH,MAAM,OAAO,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAU,CAAC;AAElE,SAAS,MAAM,CAAC,OAAqB;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,YAAY,CAAC;IACzD,IAAI,CAAE,OAA6B,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,mCAAmC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,UAAU,GAAG,cAAc,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC;AAC5E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,MAAM,GAAgB;IACjC,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,QAAQ;IACf,GAAG,EAAE,QAAQ;IACb,SAAS,EAAE,cAAc;IACzB,SAAS,EAAE,MAAM;IACjB,WAAW,EAAE,YAAY;IACzB,OAAO,EAAE,CAAC,cAAc,CAAC;IACzB,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,6BAA6B,EAAE,IAAI,CAAC;IACzE,SAAS,EAAE,GAAG,EAAE,CACd,SAAS,CAAC;QACR,GAAG,EAAE,QAAQ;QACb,KAAK,EAAE,QAAQ;QACf,WAAW,EAAE,YAAY;QACzB,QAAQ,EAAE,CAAC,QAAQ,CAAC;QACpB,QAAQ,EAAE,gDAAgD;KAC3D,CAAC;IACJ,aAAa,EAAE,MAAM;IACrB,UAAU,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;QACvB;YACE,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,CAAC;SACpG;KACF;IACD,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAC3B,4DAA4D,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE;QAC7E,OAAO,IAAI,cAAc,CAAC,CAAC,MAAM,CAAC,MAAM,oCAAoC;QAC5E,wCAAwC,OAAO,CAAC,aAAa,EAAE;KAChE;CACF,CAAC;AAEF,mDAAmD;AACnD,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heyditto/cli",
-  "version": "2.5.2",
+  "version": "2.7.0",
   "description": "Ditto Memory CLI — save, search, fetch, and traverse the Ditto memory graph from the shell.",
   "type": "module",
   "bin": {

package/dist/gh-secret.d.ts

@@ -1,31 +0,0 @@
-/**
- * Thin wrapper over the GitHub CLI for storing a freshly minted endpoint key
- * as an Actions secret. The plaintext only ever travels over `gh`'s stdin:
- * `gh secret set` reads the value from stdin when `--body` is omitted, so the
- * key never appears in argv, `ps`, shell history or our own output.
- */
-export declare const GH_INSTALL_HINT = "install the GitHub CLI from https://cli.github.com (brew install gh / winget install GitHub.cli), then run `gh auth login`";
-/** Where the secret lands. Exactly one of repo (with optional env) or org. */
-export type SecretTarget = {
-    kind: "repo";
-    repo: string;
-} | {
-    kind: "env";
-    repo: string;
-    env: string;
-} | {
-    kind: "org";
-    org: string;
-};
-/** GitHub Actions secret names: letters, digits, underscores; not starting with a digit or GITHUB_. */
-export declare function validateSecretName(name: string): string;
-export declare function validateRepo(repo: string): string;
-/** Fails fast when `gh` is missing or not signed in; nothing has been minted at this point. */
-export declare function preflightGh(): void;
-/** Resolves owner/repo for the current directory the same way `gh` does (git remotes + gh config). */
-export declare function resolveRepoFromCwd(): string;
-export declare function describeTarget(target: SecretTarget): string;
-/** Argv for `gh secret set`; the value is deliberately absent (it goes on stdin). */
-export declare function secretSetArgs(name: string, target: SecretTarget): string[];
-/** Stores `value` as a GitHub Actions secret. Throws with gh's last stderr lines on failure. */
-export declare function setGitHubSecret(name: string, target: SecretTarget, value: string): void;

package/dist/gh-secret.js

@@ -1,94 +0,0 @@
-import { spawnSync } from "node:child_process";
-/**
- * Thin wrapper over the GitHub CLI for storing a freshly minted endpoint key
- * as an Actions secret. The plaintext only ever travels over `gh`'s stdin:
- * `gh secret set` reads the value from stdin when `--body` is omitted, so the
- * key never appears in argv, `ps`, shell history or our own output.
- */
-export const GH_INSTALL_HINT = "install the GitHub CLI from https://cli.github.com (brew install gh / winget install GitHub.cli), then run `gh auth login`";
-/** GitHub Actions secret names: letters, digits, underscores; not starting with a digit or GITHUB_. */
-export function validateSecretName(name) {
-    const trimmed = name.trim();
-    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(trimmed)) {
-        throw new Error(`--gh-secret "${name}" is not a valid secret name (letters, digits and underscores; cannot start with a digit)`);
-    }
-    if (/^GITHUB_/i.test(trimmed))
-        throw new Error(`--gh-secret "${name}" is reserved: secret names cannot start with GITHUB_`);
-    return trimmed;
-}
-export function validateRepo(repo) {
-    const trimmed = repo.trim();
-    if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(trimmed)) {
-        throw new Error(`--repo must be owner/repo, got "${repo}"`);
-    }
-    return trimmed;
-}
-function gh(args, input) {
-    const res = spawnSync("gh", args, {
-        encoding: "utf8",
-        input,
-        stdio: ["pipe", "pipe", "pipe"],
-        env: { ...process.env, GH_NO_UPDATE_NOTIFIER: "1", GH_PROMPT_DISABLED: "1" },
-    });
-    const missing = res.error !== undefined && res.error.code === "ENOENT";
-    return { status: res.status, stdout: res.stdout ?? "", stderr: res.stderr ?? "", missing };
-}
-function trimmedStderr(res) {
-    return (res.stderr || res.stdout).trim().split("\n").slice(-3).join(" ").slice(0, 300);
-}
-/** Fails fast when `gh` is missing or not signed in; nothing has been minted at this point. */
-export function preflightGh() {
-    const version = gh(["--version"]);
-    if (version.missing || version.status !== 0) {
-        throw new Error(`--gh-secret needs the GitHub CLI (gh) on PATH; ${GH_INSTALL_HINT}`);
-    }
-    const auth = gh(["auth", "status"]);
-    if (auth.status !== 0) {
-        throw new Error(`gh is not signed in (\`gh auth status\` failed${trimmedStderr(auth) ? `: ${trimmedStderr(auth)}` : ""}). Run \`gh auth login\` first.`);
-    }
-}
-/** Resolves owner/repo for the current directory the same way `gh` does (git remotes + gh config). */
-export function resolveRepoFromCwd() {
-    const res = gh(["repo", "view", "--json", "nameWithOwner", "-q", ".nameWithOwner"]);
-    const repo = res.stdout.trim();
-    if (res.status !== 0 || !repo) {
-        throw new Error(`could not determine the GitHub repository from the current directory${trimmedStderr(res) ? ` (${trimmedStderr(res)})` : ""}. Pass --repo owner/repo, or run from inside a clone with a GitHub remote.`);
-    }
-    return repo;
-}
-export function describeTarget(target) {
-    switch (target.kind) {
-        case "repo":
-            return `${target.repo} (repository secret)`;
-        case "env":
-            return `${target.repo}, environment ${target.env}`;
-        case "org":
-            return `organization ${target.org}`;
-    }
-}
-/** Argv for `gh secret set`; the value is deliberately absent (it goes on stdin). */
-export function secretSetArgs(name, target) {
-    const args = ["secret", "set", name];
-    switch (target.kind) {
-        case "repo":
-            args.push("--repo", target.repo);
-            break;
-        case "env":
-            args.push("--repo", target.repo, "--env", target.env);
-            break;
-        case "org":
-            args.push("--org", target.org);
-            break;
-    }
-    return args;
-}
-/** Stores `value` as a GitHub Actions secret. Throws with gh's last stderr lines on failure. */
-export function setGitHubSecret(name, target, value) {
-    const res = gh(secretSetArgs(name, target), value);
-    if (res.missing)
-        throw new Error(`gh disappeared from PATH while setting the secret; ${GH_INSTALL_HINT}`);
-    if (res.status !== 0) {
-        throw new Error(`gh secret set ${name} failed${trimmedStderr(res) ? `: ${trimmedStderr(res)}` : ` (exit ${res.status})`}`);
-    }
-}
-//# sourceMappingURL=gh-secret.js.map

package/dist/gh-secret.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"gh-secret.js","sourceRoot":"","sources":["../src/gh-secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,eAAe,GAC1B,4HAA4H,CAAC;AAK/H,uGAAuG;AACvG,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,2FAA2F,CAAC,CAAC;IACnI,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,uDAAuD,CAAC,CAAC;IAC5H,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,GAAG,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AASD,SAAS,EAAE,CAAC,IAAc,EAAE,KAAc;IACxC,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE;QAChC,QAAQ,EAAE,MAAM;QAChB,KAAK;QACL,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;QAC/B,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,qBAAqB,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE;KAC7E,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,KAAK,SAAS,IAAK,GAAG,CAAC,KAA+B,CAAC,IAAI,KAAK,QAAQ,CAAC;IAClG,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC;AAC7F,CAAC;AAED,SAAS,aAAa,CAAC,GAAa;IAClC,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACzF,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,WAAW;IACzB,MAAM,OAAO,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IAClC,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,kDAAkD,eAAe,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,iDAAiD,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iCAAiC,CAAC,CAAC;IAC3J,CAAC;AACH,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACpF,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,uEAAuE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,4EAA4E,CACxM,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAoB;IACjD,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,MAAM;YACT,OAAO,GAAG,MAAM,CAAC,IAAI,sBAAsB,CAAC;QAC9C,KAAK,KAAK;YACR,OAAO,GAAG,MAAM,CAAC,IAAI,iBAAiB,MAAM,CAAC,GAAG,EAAE,CAAC;QACrD,KAAK,KAAK;YACR,OAAO,gBAAgB,MAAM,CAAC,GAAG,EAAE,CAAC;IACxC,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,MAAoB;IAC9D,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACrC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,MAAM;YACT,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM;QACR,KAAK,KAAK;YACR,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;YACtD,MAAM;QACR,KAAK,KAAK;YACR,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;YAC/B,MAAM;IACV,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,MAAoB,EAAE,KAAa;IAC/E,MAAM,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IACnD,IAAI,GAAG,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,eAAe,EAAE,CAAC,CAAC;IAC1G,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,UAAU,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC7H,CAAC;AACH,CAAC"}