@penvhq/provider-github 0.5.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Itzfeminisce
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.cjs

@@ -0,0 +1,369 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  GhInvocationError: () => GhInvocationError,
+  GithubNameError: () => GithubNameError,
+  GithubProvider: () => GithubProvider,
+  GithubUnavailableError: () => GithubUnavailableError,
+  checkGithubNames: () => checkGithubNames,
+  createGithubProvider: () => createGithubProvider,
+  defaultGhRunner: () => defaultGhRunner,
+  penvProviderFactory: () => penvProviderFactory
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/errors.ts
+var import_core = require("@penvhq/core");
+var GithubNameError = class extends import_core.PenvError {
+  name = "GithubNameError";
+  reason;
+  variable;
+  /** The dotted parameter ids generating this variable — two for a case collision, one otherwise. */
+  parameters;
+  constructor(reason, variable, parameters, message, remedy) {
+    super("GITHUB_NAME", message, remedy);
+    this.reason = reason;
+    this.variable = variable;
+    this.parameters = parameters;
+  }
+};
+var GithubUnavailableError = class extends import_core.PenvError {
+  name = "GithubUnavailableError";
+  reason;
+  constructor(reason, message, remedy) {
+    super("GITHUB_UNAVAILABLE", message, remedy);
+    this.reason = reason;
+  }
+};
+
+// src/github.ts
+var import_node_child_process = require("child_process");
+
+// src/names.ts
+var import_core2 = require("@penvhq/core");
+var RESERVED_PREFIX = "GITHUB_";
+var LEADING_DIGIT = /^[0-9]/;
+var LEGAL_NAME = /^[A-Za-z0-9_]+$/;
+function reservedPrefix(variable, parameter) {
+  return new GithubNameError(
+    "reserved-prefix",
+    variable,
+    [parameter],
+    `The parameter \`${parameter}\` generates the variable \`${variable}\`, which GitHub reserves \u2014 a secret name may not begin with \`${RESERVED_PREFIX}\``,
+    "GitHub keeps the `GITHUB_` prefix for its own secrets. Rename the parameter, or map it to an allowed name in the `override` block of penv.config.ts."
+  );
+}
+function leadingDigit(variable, parameter) {
+  return new GithubNameError(
+    "leading-digit",
+    variable,
+    [parameter],
+    `The parameter \`${parameter}\` generates the variable \`${variable}\`, which GitHub rejects \u2014 a secret name may not begin with a digit`,
+    "Rename the parameter, or map it to a name that starts with a letter or `_` in the `override` block of penv.config.ts."
+  );
+}
+function charset(variable, parameter) {
+  return new GithubNameError(
+    "charset",
+    variable,
+    [parameter],
+    `The parameter \`${parameter}\` generates the variable \`${variable}\`, which GitHub rejects \u2014 a secret name may contain only letters, digits, and \`_\``,
+    "Rename the parameter, or map it to a name matching `[A-Za-z0-9_]` in the `override` block of penv.config.ts."
+  );
+}
+function caseCollision(upper, parameters) {
+  return new GithubNameError(
+    "case-collision",
+    upper,
+    parameters,
+    `Parameters ${parameters.map((p) => `\`${p}\``).join(" and ")} generate variables that differ only in case, and GitHub secret names are case-insensitive \u2014 they would overwrite one another`,
+    "Give one of them a distinct name \u2014 not just a different case \u2014 in the `override` block of penv.config.ts."
+  );
+}
+function checkGithubNames(refs, config) {
+  const named = refs.map((ref) => ({
+    variable: (0, import_core2.variableName)(ref, config),
+    parameter: (0, import_core2.parameterId)(ref)
+  }));
+  const errors = [];
+  const perName = [...named].sort(
+    (a, b) => a.variable < b.variable ? -1 : a.variable > b.variable ? 1 : a.parameter < b.parameter ? -1 : a.parameter > b.parameter ? 1 : 0
+  );
+  for (const { variable, parameter } of perName) {
+    if (variable.toUpperCase().startsWith(RESERVED_PREFIX)) {
+      errors.push(reservedPrefix(variable, parameter));
+    } else if (LEADING_DIGIT.test(variable)) {
+      errors.push(leadingDigit(variable, parameter));
+    } else if (!LEGAL_NAME.test(variable)) {
+      errors.push(charset(variable, parameter));
+    }
+  }
+  const byUpper = /* @__PURE__ */ new Map();
+  for (const { variable, parameter } of named) {
+    const key = variable.toUpperCase();
+    const list = byUpper.get(key);
+    if (list === void 0) {
+      byUpper.set(key, [parameter]);
+    } else {
+      list.push(parameter);
+    }
+  }
+  for (const key of [...byUpper.keys()].sort()) {
+    const parameters = byUpper.get(key);
+    if (parameters === void 0 || parameters.length < 2) {
+      continue;
+    }
+    errors.push(caseCollision(key, [...parameters].sort()));
+  }
+  return errors;
+}
+
+// src/github.ts
+var GhInvocationError = class extends Error {
+  name = "GhInvocationError";
+  /** True when `gh` is not on PATH (spawn `ENOENT`). */
+  notFound;
+  status;
+  stderr;
+  args;
+  constructor(notFound, status, stderr, args) {
+    super(`gh ${args.join(" ")} exited ${notFound ? "not found" : String(status)}`);
+    this.notFound = notFound;
+    this.status = status;
+    this.stderr = stderr;
+    this.args = args;
+  }
+};
+function toText(value) {
+  if (value === void 0) return "";
+  return typeof value === "string" ? value : value.toString("utf8");
+}
+var defaultGhRunner = (args, input) => {
+  try {
+    return (0, import_node_child_process.execFileSync)("gh", [...args], {
+      ...input === void 0 ? {} : { input },
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"],
+      env: { ...process.env, GH_PROMPT_DISABLED: "1", NO_COLOR: "1" }
+    });
+  } catch (error) {
+    const e = error;
+    const status = typeof e.status === "number" ? e.status : null;
+    throw new GhInvocationError(e.code === "ENOENT", status, toText(e.stderr), args);
+  }
+};
+var AUTH_HINT = /not logged in|authentication|gh auth login|no accounts/i;
+function notInstalled() {
+  return new GithubUnavailableError(
+    "not-installed",
+    "The `gh` CLI is not installed or not on your PATH",
+    "penv reaches GitHub Actions through `gh` and holds no GitHub credential itself. Install it from https://cli.github.com and run `gh auth login`, then try again."
+  );
+}
+function notAuthenticated(stderr) {
+  return new GithubUnavailableError(
+    "not-authenticated",
+    "penv could not authenticate to GitHub through `gh`",
+    `Run \`gh auth login\` (with a token that can write repository and environment secrets), then try again.${stderr.trim() === "" ? "" : `
+  gh said: ${stderr.trim()}`}`
+  );
+}
+function commandFailed(action, stderr) {
+  return new GithubUnavailableError(
+    "command-failed",
+    `gh could not ${action}`,
+    `Check that \`gh\` is authenticated with a token scoped to write this repository's secrets, and that the repository and environment exist.${stderr.trim() === "" ? "" : `
+  gh said: ${stderr.trim()}`}`
+  );
+}
+function mapFailure(error, action) {
+  if (error instanceof GhInvocationError) {
+    if (error.notFound) return notInstalled();
+    if (AUTH_HINT.test(error.stderr)) return notAuthenticated(error.stderr);
+    return commandFailed(action, error.stderr);
+  }
+  return commandFailed(action, error instanceof Error ? error.message : String(error));
+}
+function scopeArgs(scope, repo) {
+  const repoArgs = repo === void 0 ? [] : ["--repo", repo];
+  return scope.kind === "environment" ? ["--env", scope.environment, ...repoArgs] : [...repoArgs];
+}
+function parseSecretList(stdout, action) {
+  let parsed;
+  try {
+    parsed = JSON.parse(stdout);
+  } catch (cause) {
+    throw commandFailed(action, `gh returned output that is not JSON: ${toText(String(cause))}`);
+  }
+  if (!Array.isArray(parsed)) {
+    throw commandFailed(action, "gh returned JSON that is not an array of secrets");
+  }
+  const secrets = [];
+  for (const entry of parsed) {
+    if (typeof entry?.name !== "string" || typeof entry.updatedAt !== "string") {
+      continue;
+    }
+    secrets.push({ name: entry.name, updatedAt: entry.updatedAt });
+  }
+  return secrets;
+}
+var GithubProvider = class {
+  type = "@penvhq/provider-github";
+  /**
+   * Both limits, declared: the store holds a resolved projection, and values
+   * never come back — GitHub's own reference says a get "without revealing its
+   * encrypted value" is all there is. The declaration is what lets `push`,
+   * `pull`, and `doctor` treat this store honestly without a separate concept.
+   */
+  capabilities = { holds: "projection", readsValues: false };
+  #repo;
+  #run;
+  /** The `owner/repo` actually targeted, resolved once when no option named it. */
+  #resolvedRepo;
+  constructor(options = {}) {
+    this.#repo = options.repo;
+    this.#run = options.run ?? defaultGhRunner;
+  }
+  async verify() {
+    try {
+      this.#run(["auth", "status"]);
+    } catch (error) {
+      if (error instanceof GhInvocationError && error.notFound) {
+        throw notInstalled();
+      }
+      throw notAuthenticated(error instanceof GhInvocationError ? error.stderr : String(error));
+    }
+    try {
+      this.#run([
+        "secret",
+        "list",
+        ...scopeArgs({ kind: "repository" }, this.#repo),
+        "--json",
+        "name"
+      ]);
+    } catch (error) {
+      throw mapFailure(error, "reach this repository's secrets");
+    }
+  }
+  async push(name, value, scope) {
+    const args = ["secret", "set", name, ...scopeArgs(scope, this.#repo)];
+    try {
+      this.#run(args, value);
+    } catch (error) {
+      throw mapFailure(error, `set the secret \`${name}\``);
+    }
+  }
+  async list(scope) {
+    const args = ["secret", "list", ...scopeArgs(scope, this.#repo), "--json", "name,updatedAt"];
+    let stdout;
+    try {
+      stdout = this.#run(args);
+    } catch (error) {
+      throw mapFailure(error, "list secrets");
+    }
+    return parseSecretList(stdout, "list secrets");
+  }
+  /** GitHub's name grammar, judged before the first PUT — the provider owns its own rules. */
+  checkNames(refs, config) {
+    return checkGithubNames(refs, config);
+  }
+  /**
+   * The `owner/repo` the API paths below need. `gh secret` resolves the repo
+   * from the working directory on its own, but `gh api` takes a literal path —
+   * so when no `location` named one, ask `gh` once and keep the answer.
+   */
+  #targetRepo() {
+    if (this.#repo !== void 0) {
+      return this.#repo;
+    }
+    if (this.#resolvedRepo === void 0) {
+      let stdout;
+      try {
+        stdout = this.#run(["repo", "view", "--json", "nameWithOwner", "--jq", ".nameWithOwner"]);
+      } catch (error) {
+        throw mapFailure(error, "resolve the repository this directory belongs to");
+      }
+      const repo = stdout.trim();
+      if (repo === "") {
+        throw commandFailed(
+          "resolve the repository this directory belongs to",
+          "gh reported no repository. Set `location` to `owner/repo` in the provider entry."
+        );
+      }
+      this.#resolvedRepo = repo;
+    }
+    return this.#resolvedRepo;
+  }
+  /**
+   * Whether the GitHub deployment environment exists. A 404 is an ordinary
+   * answer — the very one `ensureTarget` exists to fix — never an error.
+   */
+  async targetExists(environment) {
+    try {
+      this.#run(["api", `repos/${this.#targetRepo()}/environments/${environment}`]);
+      return true;
+    } catch (error) {
+      if (error instanceof GhInvocationError && /HTTP 404|Not Found/i.test(error.stderr)) {
+        return false;
+      }
+      throw mapFailure(error, `check whether the environment \`${environment}\` exists`);
+    }
+  }
+  /**
+   * Creates the deployment environment. Idempotent on GitHub's side (PUT), and
+   * only ever called after the CLI has an explicit go-ahead — the provider
+   * itself never asks, never guesses.
+   */
+  async ensureTarget(environment) {
+    try {
+      this.#run([
+        "api",
+        "--method",
+        "PUT",
+        `repos/${this.#targetRepo()}/environments/${environment}`
+      ]);
+    } catch (error) {
+      throw mapFailure(error, `create the environment \`${environment}\``);
+    }
+  }
+};
+function createGithubProvider(options = {}) {
+  return new GithubProvider(options);
+}
+
+// src/factory.ts
+function penvProviderFactory(context) {
+  const location = context.providerConfig?.location;
+  return createGithubProvider(location === void 0 ? {} : { repo: location });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  GhInvocationError,
+  GithubNameError,
+  GithubProvider,
+  GithubUnavailableError,
+  checkGithubNames,
+  createGithubProvider,
+  defaultGhRunner,
+  penvProviderFactory
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/github.ts","../src/names.ts","../src/factory.ts"],"sourcesContent":["/**\n * The public surface of `@penvhq/provider-github`.\n *\n * The GitHub Actions Secrets provider — a projection-holding, value-withholding\n * store — and the name pre-flight a push runs before it. Everything\n * GitHub-specific lives here; core stays destination-agnostic.\n */\n\nexport type { GithubNameReason, GithubUnavailableReason } from \"./errors.js\";\nexport { GithubNameError, GithubUnavailableError } from \"./errors.js\";\nexport { penvProviderFactory } from \"./factory.js\";\nexport type { GhRunner, GithubProviderOptions } from \"./github.js\";\nexport {\n  createGithubProvider,\n  defaultGhRunner,\n  GhInvocationError,\n  GithubProvider,\n} from \"./github.js\";\nexport { checkGithubNames } from \"./names.js\";\n","/**\n * The provider's own errors, extending penv's base so they print with a remedy and\n * carry a stable code, exactly as core's do. They live here rather than in core\n * because they encode GitHub's grammar and GitHub's plumbing — the reserved\n * `GITHUB_` prefix, the `gh` CLI — which are someone else's product, not penv's.\n * Core stays destination-agnostic; the destination's rules live with the provider.\n */\n\nimport { PenvError } from \"@penvhq/core\";\n\n/** Which of GitHub's name rules a generated variable breaks. */\nexport type GithubNameReason = \"reserved-prefix\" | \"leading-digit\" | \"charset\" | \"case-collision\";\n\n/**\n * A generated variable the destination will not accept. Mirrors core's\n * `NameCollisionError`: the offending variable and the parameters that produce\n * it are public fields, the message names them, and the remedy points at the\n * `override` block — the one place any of these can be repaired.\n */\nexport class GithubNameError extends PenvError {\n  override readonly name = \"GithubNameError\";\n  readonly reason: GithubNameReason;\n  readonly variable: string;\n  /** The dotted parameter ids generating this variable — two for a case collision, one otherwise. */\n  readonly parameters: readonly string[];\n\n  constructor(\n    reason: GithubNameReason,\n    variable: string,\n    parameters: readonly string[],\n    message: string,\n    remedy: string,\n  ) {\n    super(\"GITHUB_NAME\", message, remedy);\n    this.reason = reason;\n    this.variable = variable;\n    this.parameters = parameters;\n  }\n}\n\n/** Why penv cannot reach GitHub. Never fallen back from — see the RFC's provider-unification decision. */\nexport type GithubUnavailableReason = \"not-installed\" | \"not-authenticated\" | \"command-failed\";\n\n/**\n * The destination could not be reached or refused an operation. penv holds no\n * GitHub credential of its own and never falls back to a weaker path, so it names\n * which of \"not installed\", \"not authenticated\", or \"the command failed\" is true\n * and stops.\n */\nexport class GithubUnavailableError extends PenvError {\n  override readonly name = \"GithubUnavailableError\";\n  readonly reason: GithubUnavailableReason;\n\n  constructor(reason: GithubUnavailableReason, message: string, remedy: string) {\n    super(\"GITHUB_UNAVAILABLE\", message, remedy);\n    this.reason = reason;\n  }\n}\n","/**\n * The GitHub Actions Secrets provider — the first to declare both capability\n * limits: it holds a *projection* (resolved variable names, `.local` scopes\n * skipped, plaintext GitHub re-seals) and it cannot read values back, because\n * GitHub's API never returns one at any scope through any endpoint.\n *\n * penv reaches GitHub through the `gh` CLI and holds no GitHub credential of its\n * own: `gh auth login` has already happened, the token is `gh`'s to keep, and\n * penv's config gains no field for it. Values cross on **stdin**, never `--body`\n * (argv is readable by other processes) and never `--env-file` (a plaintext temp\n * file is the arrangement penv exists to delete) — one `gh` process per\n * parameter, which is slow and correct on a command that runs at deploy prep.\n */\n\nimport { execFileSync } from \"node:child_process\";\nimport type {\n  ParameterRef,\n  PenvConfig,\n  PenvErrorLike,\n  ProjectionProvider,\n  ProjectionSecret,\n  SecretScope,\n} from \"@penvhq/core\";\nimport { GithubUnavailableError } from \"./errors.js\";\nimport { checkGithubNames } from \"./names.js\";\n\n/** A `gh` invocation failed. Normalized so the provider maps it without touching Node's error shape. */\nexport class GhInvocationError extends Error {\n  override readonly name = \"GhInvocationError\";\n  /** True when `gh` is not on PATH (spawn `ENOENT`). */\n  readonly notFound: boolean;\n  readonly status: number | null;\n  readonly stderr: string;\n  readonly args: readonly string[];\n\n  constructor(notFound: boolean, status: number | null, stderr: string, args: readonly string[]) {\n    super(`gh ${args.join(\" \")} exited ${notFound ? \"not found\" : String(status)}`);\n    this.notFound = notFound;\n    this.status = status;\n    this.stderr = stderr;\n    this.args = args;\n  }\n}\n\n/**\n * Runs `gh` with an argument array (never a shell string, so values with spaces\n * or special characters are never re-parsed) and optional stdin, returning\n * stdout. Injectable so the provider is testable without the binary; throws\n * {@link GhInvocationError} on failure.\n */\nexport type GhRunner = (args: readonly string[], input?: string) => string;\n\nfunction toText(value: string | Buffer | undefined): string {\n  if (value === undefined) return \"\";\n  return typeof value === \"string\" ? value : value.toString(\"utf8\");\n}\n\n/** The real runner. Keeps `gh` non-interactive so it fails loudly rather than prompting. */\nexport const defaultGhRunner: GhRunner = (args, input) => {\n  try {\n    return execFileSync(\"gh\", [...args], {\n      ...(input === undefined ? {} : { input }),\n      encoding: \"utf8\",\n      stdio: [\"pipe\", \"pipe\", \"pipe\"],\n      env: { ...process.env, GH_PROMPT_DISABLED: \"1\", NO_COLOR: \"1\" },\n    });\n  } catch (error) {\n    const e = error as NodeJS.ErrnoException & {\n      status?: number | null;\n      stderr?: string | Buffer;\n    };\n    const status = typeof e.status === \"number\" ? e.status : null;\n    throw new GhInvocationError(e.code === \"ENOENT\", status, toText(e.stderr), args);\n  }\n};\n\nconst AUTH_HINT = /not logged in|authentication|gh auth login|no accounts/i;\n\nfunction notInstalled(): GithubUnavailableError {\n  return new GithubUnavailableError(\n    \"not-installed\",\n    \"The `gh` CLI is not installed or not on your PATH\",\n    \"penv reaches GitHub Actions through `gh` and holds no GitHub credential itself. Install it \" +\n      \"from https://cli.github.com and run `gh auth login`, then try again.\",\n  );\n}\n\nfunction notAuthenticated(stderr: string): GithubUnavailableError {\n  return new GithubUnavailableError(\n    \"not-authenticated\",\n    \"penv could not authenticate to GitHub through `gh`\",\n    `Run \\`gh auth login\\` (with a token that can write repository and environment secrets), then ` +\n      `try again.${stderr.trim() === \"\" ? \"\" : `\\n  gh said: ${stderr.trim()}`}`,\n  );\n}\n\nfunction commandFailed(action: string, stderr: string): GithubUnavailableError {\n  return new GithubUnavailableError(\n    \"command-failed\",\n    `gh could not ${action}`,\n    `Check that \\`gh\\` is authenticated with a token scoped to write this repository's secrets, and ` +\n      `that the repository and environment exist.${stderr.trim() === \"\" ? \"\" : `\\n  gh said: ${stderr.trim()}`}`,\n  );\n}\n\n/** Maps a failed invocation to the loud, specific refusal penv owes the user. */\nfunction mapFailure(error: unknown, action: string): GithubUnavailableError {\n  if (error instanceof GhInvocationError) {\n    if (error.notFound) return notInstalled();\n    if (AUTH_HINT.test(error.stderr)) return notAuthenticated(error.stderr);\n    return commandFailed(action, error.stderr);\n  }\n  return commandFailed(action, error instanceof Error ? error.message : String(error));\n}\n\n/** `--env <name>` for an environment secret, nothing for a repository secret; `--repo` when declared. */\nfunction scopeArgs(scope: SecretScope, repo: string | undefined): string[] {\n  const repoArgs = repo === undefined ? [] : [\"--repo\", repo];\n  return scope.kind === \"environment\" ? [\"--env\", scope.environment, ...repoArgs] : [...repoArgs];\n}\n\ninterface RawSecret {\n  readonly name: unknown;\n  readonly updatedAt: unknown;\n}\n\nfunction parseSecretList(stdout: string, action: string): ProjectionSecret[] {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(stdout);\n  } catch (cause) {\n    throw commandFailed(action, `gh returned output that is not JSON: ${toText(String(cause))}`);\n  }\n  if (!Array.isArray(parsed)) {\n    throw commandFailed(action, \"gh returned JSON that is not an array of secrets\");\n  }\n  const secrets: ProjectionSecret[] = [];\n  for (const entry of parsed as RawSecret[]) {\n    if (typeof entry?.name !== \"string\" || typeof entry.updatedAt !== \"string\") {\n      continue;\n    }\n    secrets.push({ name: entry.name, updatedAt: entry.updatedAt });\n  }\n  return secrets;\n}\n\nexport interface GithubProviderOptions {\n  /** The `owner/repo` `gh` targets. Left unset, `gh` resolves it from the working directory. */\n  readonly repo?: string;\n  /** The `gh` runner. Defaults to invoking the real binary; injected in tests. */\n  readonly run?: GhRunner;\n}\n\nexport class GithubProvider implements ProjectionProvider {\n  readonly type = \"@penvhq/provider-github\";\n  /**\n   * Both limits, declared: the store holds a resolved projection, and values\n   * never come back — GitHub's own reference says a get \"without revealing its\n   * encrypted value\" is all there is. The declaration is what lets `push`,\n   * `pull`, and `doctor` treat this store honestly without a separate concept.\n   */\n  readonly capabilities = { holds: \"projection\", readsValues: false } as const;\n\n  readonly #repo: string | undefined;\n  readonly #run: GhRunner;\n  /** The `owner/repo` actually targeted, resolved once when no option named it. */\n  #resolvedRepo: string | undefined;\n\n  constructor(options: GithubProviderOptions = {}) {\n    this.#repo = options.repo;\n    this.#run = options.run ?? defaultGhRunner;\n  }\n\n  async verify(): Promise<void> {\n    try {\n      this.#run([\"auth\", \"status\"]);\n    } catch (error) {\n      if (error instanceof GhInvocationError && error.notFound) {\n        throw notInstalled();\n      }\n      throw notAuthenticated(error instanceof GhInvocationError ? error.stderr : String(error));\n    }\n    // Authenticated is not the same as able to write here. Listing the\n    // repository's secrets is a live probe that the token can reach *this*\n    // repository's secrets API — catching a wrong or inaccessible repo and a\n    // grossly under-scoped token before the first PUT rather than mid-push. It\n    // cannot prove per-environment write permission without writing, so that\n    // narrower failure can still surface at push time as a loud refusal.\n    try {\n      this.#run([\n        \"secret\",\n        \"list\",\n        ...scopeArgs({ kind: \"repository\" }, this.#repo),\n        \"--json\",\n        \"name\",\n      ]);\n    } catch (error) {\n      throw mapFailure(error, \"reach this repository's secrets\");\n    }\n  }\n\n  async push(name: string, value: string, scope: SecretScope): Promise<void> {\n    const args = [\"secret\", \"set\", name, ...scopeArgs(scope, this.#repo)];\n    try {\n      this.#run(args, value);\n    } catch (error) {\n      throw mapFailure(error, `set the secret \\`${name}\\``);\n    }\n  }\n\n  async list(scope: SecretScope): Promise<ProjectionSecret[]> {\n    const args = [\"secret\", \"list\", ...scopeArgs(scope, this.#repo), \"--json\", \"name,updatedAt\"];\n    let stdout: string;\n    try {\n      stdout = this.#run(args);\n    } catch (error) {\n      throw mapFailure(error, \"list secrets\");\n    }\n    return parseSecretList(stdout, \"list secrets\");\n  }\n\n  /** GitHub's name grammar, judged before the first PUT — the provider owns its own rules. */\n  checkNames(refs: readonly ParameterRef[], config: PenvConfig): PenvErrorLike[] {\n    return checkGithubNames(refs, config);\n  }\n\n  /**\n   * The `owner/repo` the API paths below need. `gh secret` resolves the repo\n   * from the working directory on its own, but `gh api` takes a literal path —\n   * so when no `location` named one, ask `gh` once and keep the answer.\n   */\n  #targetRepo(): string {\n    if (this.#repo !== undefined) {\n      return this.#repo;\n    }\n    if (this.#resolvedRepo === undefined) {\n      let stdout: string;\n      try {\n        stdout = this.#run([\"repo\", \"view\", \"--json\", \"nameWithOwner\", \"--jq\", \".nameWithOwner\"]);\n      } catch (error) {\n        throw mapFailure(error, \"resolve the repository this directory belongs to\");\n      }\n      const repo = stdout.trim();\n      if (repo === \"\") {\n        throw commandFailed(\n          \"resolve the repository this directory belongs to\",\n          \"gh reported no repository. Set `location` to `owner/repo` in the provider entry.\",\n        );\n      }\n      this.#resolvedRepo = repo;\n    }\n    return this.#resolvedRepo;\n  }\n\n  /**\n   * Whether the GitHub deployment environment exists. A 404 is an ordinary\n   * answer — the very one `ensureTarget` exists to fix — never an error.\n   */\n  async targetExists(environment: string): Promise<boolean> {\n    try {\n      this.#run([\"api\", `repos/${this.#targetRepo()}/environments/${environment}`]);\n      return true;\n    } catch (error) {\n      if (error instanceof GhInvocationError && /HTTP 404|Not Found/i.test(error.stderr)) {\n        return false;\n      }\n      throw mapFailure(error, `check whether the environment \\`${environment}\\` exists`);\n    }\n  }\n\n  /**\n   * Creates the deployment environment. Idempotent on GitHub's side (PUT), and\n   * only ever called after the CLI has an explicit go-ahead — the provider\n   * itself never asks, never guesses.\n   */\n  async ensureTarget(environment: string): Promise<void> {\n    try {\n      this.#run([\n        \"api\",\n        \"--method\",\n        \"PUT\",\n        `repos/${this.#targetRepo()}/environments/${environment}`,\n      ]);\n    } catch (error) {\n      throw mapFailure(error, `create the environment \\`${environment}\\``);\n    }\n  }\n}\n\nexport function createGithubProvider(options: GithubProviderOptions = {}): GithubProvider {\n  return new GithubProvider(options);\n}\n","/**\n * The GitHub name pre-flight: judge every generated variable against GitHub's\n * secret grammar *before* anything is pushed, so a push is all or nothing and a\n * reserved name is never discovered after sixty secrets are already placed.\n *\n * The rule that matters most: validate the variable `penv generate` actually\n * emits, never the parameter name. `config.names` values reach the destination\n * verbatim with no charset or case validation in core, so a parameter named\n * `githubToken` — a perfectly good name — transforms to `GITHUB_TOKEN`, which\n * GitHub reserves. Composed from the real transform (`variableName`) rather than\n * re-deriving it, so it cannot drift from what a push actually sends.\n */\n\nimport type { ParameterRef, PenvConfig } from \"@penvhq/core\";\nimport { parameterId, variableName } from \"@penvhq/core\";\nimport { GithubNameError } from \"./errors.js\";\n\n/** GitHub reserves this prefix for its own secrets. */\nconst RESERVED_PREFIX = \"GITHUB_\";\n/** A secret name may not begin with a digit. */\nconst LEADING_DIGIT = /^[0-9]/;\n/** A secret name is letters, digits, and underscores only. */\nconst LEGAL_NAME = /^[A-Za-z0-9_]+$/;\n\nfunction reservedPrefix(variable: string, parameter: string): GithubNameError {\n  return new GithubNameError(\n    \"reserved-prefix\",\n    variable,\n    [parameter],\n    `The parameter \\`${parameter}\\` generates the variable \\`${variable}\\`, which GitHub reserves — a secret name may not begin with \\`${RESERVED_PREFIX}\\``,\n    \"GitHub keeps the `GITHUB_` prefix for its own secrets. Rename the parameter, or map it to an \" +\n      \"allowed name in the `override` block of penv.config.ts.\",\n  );\n}\n\nfunction leadingDigit(variable: string, parameter: string): GithubNameError {\n  return new GithubNameError(\n    \"leading-digit\",\n    variable,\n    [parameter],\n    `The parameter \\`${parameter}\\` generates the variable \\`${variable}\\`, which GitHub rejects — a secret name may not begin with a digit`,\n    \"Rename the parameter, or map it to a name that starts with a letter or `_` in the `override` \" +\n      \"block of penv.config.ts.\",\n  );\n}\n\nfunction charset(variable: string, parameter: string): GithubNameError {\n  return new GithubNameError(\n    \"charset\",\n    variable,\n    [parameter],\n    `The parameter \\`${parameter}\\` generates the variable \\`${variable}\\`, which GitHub rejects — a secret name may contain only letters, digits, and \\`_\\``,\n    \"Rename the parameter, or map it to a name matching `[A-Za-z0-9_]` in the `override` block of \" +\n      \"penv.config.ts.\",\n  );\n}\n\nfunction caseCollision(upper: string, parameters: readonly string[]): GithubNameError {\n  return new GithubNameError(\n    \"case-collision\",\n    upper,\n    parameters,\n    `Parameters ${parameters.map((p) => `\\`${p}\\``).join(\" and \")} generate variables that differ only in case, and GitHub secret names are case-insensitive — they would overwrite one another`,\n    \"Give one of them a distinct name — not just a different case — in the `override` block of \" +\n      \"penv.config.ts.\",\n  );\n}\n\n/**\n * Every generated variable that violates GitHub's grammar, collected rather than\n * thrown so a push reports every bad name at once and refuses before the first\n * PUT. Deterministic: per-name violations in variable order, then case\n * collisions in uppercased-key order, each parameter list sorted.\n *\n * Exact-string collisions (two parameters producing the identical variable) are\n * core's `checkNameCollisions`, run before this. Here the concern is GitHub's\n * *case-insensitivity*, which core's exact-string map cannot see.\n */\nexport function checkGithubNames(\n  refs: readonly ParameterRef[],\n  config: PenvConfig,\n): GithubNameError[] {\n  const named = refs.map((ref) => ({\n    variable: variableName(ref, config),\n    parameter: parameterId(ref),\n  }));\n\n  const errors: GithubNameError[] = [];\n\n  const perName = [...named].sort((a, b) =>\n    a.variable < b.variable\n      ? -1\n      : a.variable > b.variable\n        ? 1\n        : a.parameter < b.parameter\n          ? -1\n          : a.parameter > b.parameter\n            ? 1\n            : 0,\n  );\n  for (const { variable, parameter } of perName) {\n    // Case-insensitively, because GitHub reserves the prefix case-insensitively:\n    // an `override` of `github_token` reaches GitHub verbatim and is refused\n    // there, so it must be refused here — the same case-folding the collision\n    // check below already applies.\n    if (variable.toUpperCase().startsWith(RESERVED_PREFIX)) {\n      errors.push(reservedPrefix(variable, parameter));\n    } else if (LEADING_DIGIT.test(variable)) {\n      errors.push(leadingDigit(variable, parameter));\n    } else if (!LEGAL_NAME.test(variable)) {\n      errors.push(charset(variable, parameter));\n    }\n  }\n\n  const byUpper = new Map<string, string[]>();\n  for (const { variable, parameter } of named) {\n    const key = variable.toUpperCase();\n    const list = byUpper.get(key);\n    if (list === undefined) {\n      byUpper.set(key, [parameter]);\n    } else {\n      list.push(parameter);\n    }\n  }\n  for (const key of [...byUpper.keys()].sort()) {\n    const parameters = byUpper.get(key);\n    if (parameters === undefined || parameters.length < 2) {\n      continue;\n    }\n    errors.push(caseCollision(key, [...parameters].sort()));\n  }\n\n  return errors;\n}\n","/**\n * The plugin seam: what the penv CLI calls when a `providers.*.type` names this\n * package. The factory owns the translation from the config's provider-agnostic\n * surface (`location`) to this provider's own options, so the config never\n * learns GitHub vocabulary and the provider never parses config.\n */\n\nimport type { ProjectionProvider, ProviderFactoryContext } from \"@penvhq/core\";\nimport { createGithubProvider } from \"./github.js\";\n\ndeclare module \"@penvhq/core\" {\n  interface ProviderConfigMap {\n    \"@penvhq/provider-github\": {\n      /**\n       * The repository penv maps the projection onto — `owner/repo`. Left\n       * unset, `gh` resolves it from the working directory.\n       */\n      readonly location?: string;\n    };\n  }\n}\n\n/** Builds the GitHub provider for one environment's declared destination. */\nexport function penvProviderFactory(context: ProviderFactoryContext): ProjectionProvider {\n  const location = context.providerConfig?.location;\n  return createGithubProvider(location === undefined ? {} : { repo: location });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACQA,kBAA0B;AAWnB,IAAM,kBAAN,cAA8B,sBAAU;AAAA,EAC3B,OAAO;AAAA,EAChB;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EAET,YACE,QACA,UACA,YACA,SACA,QACA;AACA,UAAM,eAAe,SAAS,MAAM;AACpC,SAAK,SAAS;AACd,SAAK,WAAW;AAChB,SAAK,aAAa;AAAA,EACpB;AACF;AAWO,IAAM,yBAAN,cAAqC,sBAAU;AAAA,EAClC,OAAO;AAAA,EAChB;AAAA,EAET,YAAY,QAAiC,SAAiB,QAAgB;AAC5E,UAAM,sBAAsB,SAAS,MAAM;AAC3C,SAAK,SAAS;AAAA,EAChB;AACF;;;AC3CA,gCAA6B;;;ACA7B,IAAAA,eAA0C;AAI1C,IAAM,kBAAkB;AAExB,IAAM,gBAAgB;AAEtB,IAAM,aAAa;AAEnB,SAAS,eAAe,UAAkB,WAAoC;AAC5E,SAAO,IAAI;AAAA,IACT;AAAA,IACA;AAAA,IACA,CAAC,SAAS;AAAA,IACV,mBAAmB,SAAS,+BAA+B,QAAQ,uEAAkE,eAAe;AAAA,IACpJ;AAAA,EAEF;AACF;AAEA,SAAS,aAAa,UAAkB,WAAoC;AAC1E,SAAO,IAAI;AAAA,IACT;AAAA,IACA;AAAA,IACA,CAAC,SAAS;AAAA,IACV,mBAAmB,SAAS,+BAA+B,QAAQ;AAAA,IACnE;AAAA,EAEF;AACF;AAEA,SAAS,QAAQ,UAAkB,WAAoC;AACrE,SAAO,IAAI;AAAA,IACT;AAAA,IACA;AAAA,IACA,CAAC,SAAS;AAAA,IACV,mBAAmB,SAAS,+BAA+B,QAAQ;AAAA,IACnE;AAAA,EAEF;AACF;AAEA,SAAS,cAAc,OAAe,YAAgD;AACpF,SAAO,IAAI;AAAA,IACT;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc,WAAW,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC;AAAA,IAC7D;AAAA,EAEF;AACF;AAYO,SAAS,iBACd,MACA,QACmB;AACnB,QAAM,QAAQ,KAAK,IAAI,CAAC,SAAS;AAAA,IAC/B,cAAU,2BAAa,KAAK,MAAM;AAAA,IAClC,eAAW,0BAAY,GAAG;AAAA,EAC5B,EAAE;AAEF,QAAM,SAA4B,CAAC;AAEnC,QAAM,UAAU,CAAC,GAAG,KAAK,EAAE;AAAA,IAAK,CAAC,GAAG,MAClC,EAAE,WAAW,EAAE,WACX,KACA,EAAE,WAAW,EAAE,WACb,IACA,EAAE,YAAY,EAAE,YACd,KACA,EAAE,YAAY,EAAE,YACd,IACA;AAAA,EACZ;AACA,aAAW,EAAE,UAAU,UAAU,KAAK,SAAS;AAK7C,QAAI,SAAS,YAAY,EAAE,WAAW,eAAe,GAAG;AACtD,aAAO,KAAK,eAAe,UAAU,SAAS,CAAC;AAAA,IACjD,WAAW,cAAc,KAAK,QAAQ,GAAG;AACvC,aAAO,KAAK,aAAa,UAAU,SAAS,CAAC;AAAA,IAC/C,WAAW,CAAC,WAAW,KAAK,QAAQ,GAAG;AACrC,aAAO,KAAK,QAAQ,UAAU,SAAS,CAAC;AAAA,IAC1C;AAAA,EACF;AAEA,QAAM,UAAU,oBAAI,IAAsB;AAC1C,aAAW,EAAE,UAAU,UAAU,KAAK,OAAO;AAC3C,UAAM,MAAM,SAAS,YAAY;AACjC,UAAM,OAAO,QAAQ,IAAI,GAAG;AAC5B,QAAI,SAAS,QAAW;AACtB,cAAQ,IAAI,KAAK,CAAC,SAAS,CAAC;AAAA,IAC9B,OAAO;AACL,WAAK,KAAK,SAAS;AAAA,IACrB;AAAA,EACF;AACA,aAAW,OAAO,CAAC,GAAG,QAAQ,KAAK,CAAC,EAAE,KAAK,GAAG;AAC5C,UAAM,aAAa,QAAQ,IAAI,GAAG;AAClC,QAAI,eAAe,UAAa,WAAW,SAAS,GAAG;AACrD;AAAA,IACF;AACA,WAAO,KAAK,cAAc,KAAK,CAAC,GAAG,UAAU,EAAE,KAAK,CAAC,CAAC;AAAA,EACxD;AAEA,SAAO;AACT;;;AD1GO,IAAM,oBAAN,cAAgC,MAAM;AAAA,EACzB,OAAO;AAAA;AAAA,EAEhB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,UAAmB,QAAuB,QAAgB,MAAyB;AAC7F,UAAM,MAAM,KAAK,KAAK,GAAG,CAAC,WAAW,WAAW,cAAc,OAAO,MAAM,CAAC,EAAE;AAC9E,SAAK,WAAW;AAChB,SAAK,SAAS;AACd,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;AAUA,SAAS,OAAO,OAA4C;AAC1D,MAAI,UAAU,OAAW,QAAO;AAChC,SAAO,OAAO,UAAU,WAAW,QAAQ,MAAM,SAAS,MAAM;AAClE;AAGO,IAAM,kBAA4B,CAAC,MAAM,UAAU;AACxD,MAAI;AACF,eAAO,wCAAa,MAAM,CAAC,GAAG,IAAI,GAAG;AAAA,MACnC,GAAI,UAAU,SAAY,CAAC,IAAI,EAAE,MAAM;AAAA,MACvC,UAAU;AAAA,MACV,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,MAC9B,KAAK,EAAE,GAAG,QAAQ,KAAK,oBAAoB,KAAK,UAAU,IAAI;AAAA,IAChE,CAAC;AAAA,EACH,SAAS,OAAO;AACd,UAAM,IAAI;AAIV,UAAM,SAAS,OAAO,EAAE,WAAW,WAAW,EAAE,SAAS;AACzD,UAAM,IAAI,kBAAkB,EAAE,SAAS,UAAU,QAAQ,OAAO,EAAE,MAAM,GAAG,IAAI;AAAA,EACjF;AACF;AAEA,IAAM,YAAY;AAElB,SAAS,eAAuC;AAC9C,SAAO,IAAI;AAAA,IACT;AAAA,IACA;AAAA,IACA;AAAA,EAEF;AACF;AAEA,SAAS,iBAAiB,QAAwC;AAChE,SAAO,IAAI;AAAA,IACT;AAAA,IACA;AAAA,IACA,0GACe,OAAO,KAAK,MAAM,KAAK,KAAK;AAAA,aAAgB,OAAO,KAAK,CAAC,EAAE;AAAA,EAC5E;AACF;AAEA,SAAS,cAAc,QAAgB,QAAwC;AAC7E,SAAO,IAAI;AAAA,IACT;AAAA,IACA,gBAAgB,MAAM;AAAA,IACtB,4IAC+C,OAAO,KAAK,MAAM,KAAK,KAAK;AAAA,aAAgB,OAAO,KAAK,CAAC,EAAE;AAAA,EAC5G;AACF;AAGA,SAAS,WAAW,OAAgB,QAAwC;AAC1E,MAAI,iBAAiB,mBAAmB;AACtC,QAAI,MAAM,SAAU,QAAO,aAAa;AACxC,QAAI,UAAU,KAAK,MAAM,MAAM,EAAG,QAAO,iBAAiB,MAAM,MAAM;AACtE,WAAO,cAAc,QAAQ,MAAM,MAAM;AAAA,EAC3C;AACA,SAAO,cAAc,QAAQ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AACrF;AAGA,SAAS,UAAU,OAAoB,MAAoC;AACzE,QAAM,WAAW,SAAS,SAAY,CAAC,IAAI,CAAC,UAAU,IAAI;AAC1D,SAAO,MAAM,SAAS,gBAAgB,CAAC,SAAS,MAAM,aAAa,GAAG,QAAQ,IAAI,CAAC,GAAG,QAAQ;AAChG;AAOA,SAAS,gBAAgB,QAAgB,QAAoC;AAC3E,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,MAAM;AAAA,EAC5B,SAAS,OAAO;AACd,UAAM,cAAc,QAAQ,wCAAwC,OAAO,OAAO,KAAK,CAAC,CAAC,EAAE;AAAA,EAC7F;AACA,MAAI,CAAC,MAAM,QAAQ,MAAM,GAAG;AAC1B,UAAM,cAAc,QAAQ,kDAAkD;AAAA,EAChF;AACA,QAAM,UAA8B,CAAC;AACrC,aAAW,SAAS,QAAuB;AACzC,QAAI,OAAO,OAAO,SAAS,YAAY,OAAO,MAAM,cAAc,UAAU;AAC1E;AAAA,IACF;AACA,YAAQ,KAAK,EAAE,MAAM,MAAM,MAAM,WAAW,MAAM,UAAU,CAAC;AAAA,EAC/D;AACA,SAAO;AACT;AASO,IAAM,iBAAN,MAAmD;AAAA,EAC/C,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOP,eAAe,EAAE,OAAO,cAAc,aAAa,MAAM;AAAA,EAEzD;AAAA,EACA;AAAA;AAAA,EAET;AAAA,EAEA,YAAY,UAAiC,CAAC,GAAG;AAC/C,SAAK,QAAQ,QAAQ;AACrB,SAAK,OAAO,QAAQ,OAAO;AAAA,EAC7B;AAAA,EAEA,MAAM,SAAwB;AAC5B,QAAI;AACF,WAAK,KAAK,CAAC,QAAQ,QAAQ,CAAC;AAAA,IAC9B,SAAS,OAAO;AACd,UAAI,iBAAiB,qBAAqB,MAAM,UAAU;AACxD,cAAM,aAAa;AAAA,MACrB;AACA,YAAM,iBAAiB,iBAAiB,oBAAoB,MAAM,SAAS,OAAO,KAAK,CAAC;AAAA,IAC1F;AAOA,QAAI;AACF,WAAK,KAAK;AAAA,QACR;AAAA,QACA;AAAA,QACA,GAAG,UAAU,EAAE,MAAM,aAAa,GAAG,KAAK,KAAK;AAAA,QAC/C;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,WAAW,OAAO,iCAAiC;AAAA,IAC3D;AAAA,EACF;AAAA,EAEA,MAAM,KAAK,MAAc,OAAe,OAAmC;AACzE,UAAM,OAAO,CAAC,UAAU,OAAO,MAAM,GAAG,UAAU,OAAO,KAAK,KAAK,CAAC;AACpE,QAAI;AACF,WAAK,KAAK,MAAM,KAAK;AAAA,IACvB,SAAS,OAAO;AACd,YAAM,WAAW,OAAO,oBAAoB,IAAI,IAAI;AAAA,IACtD;AAAA,EACF;AAAA,EAEA,MAAM,KAAK,OAAiD;AAC1D,UAAM,OAAO,CAAC,UAAU,QAAQ,GAAG,UAAU,OAAO,KAAK,KAAK,GAAG,UAAU,gBAAgB;AAC3F,QAAI;AACJ,QAAI;AACF,eAAS,KAAK,KAAK,IAAI;AAAA,IACzB,SAAS,OAAO;AACd,YAAM,WAAW,OAAO,cAAc;AAAA,IACxC;AACA,WAAO,gBAAgB,QAAQ,cAAc;AAAA,EAC/C;AAAA;AAAA,EAGA,WAAW,MAA+B,QAAqC;AAC7E,WAAO,iBAAiB,MAAM,MAAM;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,cAAsB;AACpB,QAAI,KAAK,UAAU,QAAW;AAC5B,aAAO,KAAK;AAAA,IACd;AACA,QAAI,KAAK,kBAAkB,QAAW;AACpC,UAAI;AACJ,UAAI;AACF,iBAAS,KAAK,KAAK,CAAC,QAAQ,QAAQ,UAAU,iBAAiB,QAAQ,gBAAgB,CAAC;AAAA,MAC1F,SAAS,OAAO;AACd,cAAM,WAAW,OAAO,kDAAkD;AAAA,MAC5E;AACA,YAAM,OAAO,OAAO,KAAK;AACzB,UAAI,SAAS,IAAI;AACf,cAAM;AAAA,UACJ;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,WAAK,gBAAgB;AAAA,IACvB;AACA,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,aAAa,aAAuC;AACxD,QAAI;AACF,WAAK,KAAK,CAAC,OAAO,SAAS,KAAK,YAAY,CAAC,iBAAiB,WAAW,EAAE,CAAC;AAC5E,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UAAI,iBAAiB,qBAAqB,sBAAsB,KAAK,MAAM,MAAM,GAAG;AAClF,eAAO;AAAA,MACT;AACA,YAAM,WAAW,OAAO,mCAAmC,WAAW,WAAW;AAAA,IACnF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,aAAa,aAAoC;AACrD,QAAI;AACF,WAAK,KAAK;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS,KAAK,YAAY,CAAC,iBAAiB,WAAW;AAAA,MACzD,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,WAAW,OAAO,4BAA4B,WAAW,IAAI;AAAA,IACrE;AAAA,EACF;AACF;AAEO,SAAS,qBAAqB,UAAiC,CAAC,GAAmB;AACxF,SAAO,IAAI,eAAe,OAAO;AACnC;;;AE5QO,SAAS,oBAAoB,SAAqD;AACvF,QAAM,WAAW,QAAQ,gBAAgB;AACzC,SAAO,qBAAqB,aAAa,SAAY,CAAC,IAAI,EAAE,MAAM,SAAS,CAAC;AAC9E;","names":["import_core"]}

package/dist/index.d.cts

@@ -0,0 +1,159 @@
+import { PenvError, ProviderFactoryContext, ProjectionProvider, SecretScope, ProjectionSecret, ParameterRef, PenvConfig, PenvErrorLike } from '@penvhq/core';
+
+/**
+ * The provider's own errors, extending penv's base so they print with a remedy and
+ * carry a stable code, exactly as core's do. They live here rather than in core
+ * because they encode GitHub's grammar and GitHub's plumbing — the reserved
+ * `GITHUB_` prefix, the `gh` CLI — which are someone else's product, not penv's.
+ * Core stays destination-agnostic; the destination's rules live with the provider.
+ */
+
+/** Which of GitHub's name rules a generated variable breaks. */
+type GithubNameReason = "reserved-prefix" | "leading-digit" | "charset" | "case-collision";
+/**
+ * A generated variable the destination will not accept. Mirrors core's
+ * `NameCollisionError`: the offending variable and the parameters that produce
+ * it are public fields, the message names them, and the remedy points at the
+ * `override` block — the one place any of these can be repaired.
+ */
+declare class GithubNameError extends PenvError {
+    readonly name = "GithubNameError";
+    readonly reason: GithubNameReason;
+    readonly variable: string;
+    /** The dotted parameter ids generating this variable — two for a case collision, one otherwise. */
+    readonly parameters: readonly string[];
+    constructor(reason: GithubNameReason, variable: string, parameters: readonly string[], message: string, remedy: string);
+}
+/** Why penv cannot reach GitHub. Never fallen back from — see the RFC's provider-unification decision. */
+type GithubUnavailableReason = "not-installed" | "not-authenticated" | "command-failed";
+/**
+ * The destination could not be reached or refused an operation. penv holds no
+ * GitHub credential of its own and never falls back to a weaker path, so it names
+ * which of "not installed", "not authenticated", or "the command failed" is true
+ * and stops.
+ */
+declare class GithubUnavailableError extends PenvError {
+    readonly name = "GithubUnavailableError";
+    readonly reason: GithubUnavailableReason;
+    constructor(reason: GithubUnavailableReason, message: string, remedy: string);
+}
+
+/**
+ * The plugin seam: what the penv CLI calls when a `providers.*.type` names this
+ * package. The factory owns the translation from the config's provider-agnostic
+ * surface (`location`) to this provider's own options, so the config never
+ * learns GitHub vocabulary and the provider never parses config.
+ */
+
+declare module "@penvhq/core" {
+    interface ProviderConfigMap {
+        "@penvhq/provider-github": {
+            /**
+             * The repository penv maps the projection onto — `owner/repo`. Left
+             * unset, `gh` resolves it from the working directory.
+             */
+            readonly location?: string;
+        };
+    }
+}
+/** Builds the GitHub provider for one environment's declared destination. */
+declare function penvProviderFactory(context: ProviderFactoryContext): ProjectionProvider;
+
+/**
+ * The GitHub Actions Secrets provider — the first to declare both capability
+ * limits: it holds a *projection* (resolved variable names, `.local` scopes
+ * skipped, plaintext GitHub re-seals) and it cannot read values back, because
+ * GitHub's API never returns one at any scope through any endpoint.
+ *
+ * penv reaches GitHub through the `gh` CLI and holds no GitHub credential of its
+ * own: `gh auth login` has already happened, the token is `gh`'s to keep, and
+ * penv's config gains no field for it. Values cross on **stdin**, never `--body`
+ * (argv is readable by other processes) and never `--env-file` (a plaintext temp
+ * file is the arrangement penv exists to delete) — one `gh` process per
+ * parameter, which is slow and correct on a command that runs at deploy prep.
+ */
+
+/** A `gh` invocation failed. Normalized so the provider maps it without touching Node's error shape. */
+declare class GhInvocationError extends Error {
+    readonly name = "GhInvocationError";
+    /** True when `gh` is not on PATH (spawn `ENOENT`). */
+    readonly notFound: boolean;
+    readonly status: number | null;
+    readonly stderr: string;
+    readonly args: readonly string[];
+    constructor(notFound: boolean, status: number | null, stderr: string, args: readonly string[]);
+}
+/**
+ * Runs `gh` with an argument array (never a shell string, so values with spaces
+ * or special characters are never re-parsed) and optional stdin, returning
+ * stdout. Injectable so the provider is testable without the binary; throws
+ * {@link GhInvocationError} on failure.
+ */
+type GhRunner = (args: readonly string[], input?: string) => string;
+/** The real runner. Keeps `gh` non-interactive so it fails loudly rather than prompting. */
+declare const defaultGhRunner: GhRunner;
+interface GithubProviderOptions {
+    /** The `owner/repo` `gh` targets. Left unset, `gh` resolves it from the working directory. */
+    readonly repo?: string;
+    /** The `gh` runner. Defaults to invoking the real binary; injected in tests. */
+    readonly run?: GhRunner;
+}
+declare class GithubProvider implements ProjectionProvider {
+    #private;
+    readonly type = "@penvhq/provider-github";
+    /**
+     * Both limits, declared: the store holds a resolved projection, and values
+     * never come back — GitHub's own reference says a get "without revealing its
+     * encrypted value" is all there is. The declaration is what lets `push`,
+     * `pull`, and `doctor` treat this store honestly without a separate concept.
+     */
+    readonly capabilities: {
+        readonly holds: "projection";
+        readonly readsValues: false;
+    };
+    constructor(options?: GithubProviderOptions);
+    verify(): Promise<void>;
+    push(name: string, value: string, scope: SecretScope): Promise<void>;
+    list(scope: SecretScope): Promise<ProjectionSecret[]>;
+    /** GitHub's name grammar, judged before the first PUT — the provider owns its own rules. */
+    checkNames(refs: readonly ParameterRef[], config: PenvConfig): PenvErrorLike[];
+    /**
+     * Whether the GitHub deployment environment exists. A 404 is an ordinary
+     * answer — the very one `ensureTarget` exists to fix — never an error.
+     */
+    targetExists(environment: string): Promise<boolean>;
+    /**
+     * Creates the deployment environment. Idempotent on GitHub's side (PUT), and
+     * only ever called after the CLI has an explicit go-ahead — the provider
+     * itself never asks, never guesses.
+     */
+    ensureTarget(environment: string): Promise<void>;
+}
+declare function createGithubProvider(options?: GithubProviderOptions): GithubProvider;
+
+/**
+ * The GitHub name pre-flight: judge every generated variable against GitHub's
+ * secret grammar *before* anything is pushed, so a push is all or nothing and a
+ * reserved name is never discovered after sixty secrets are already placed.
+ *
+ * The rule that matters most: validate the variable `penv generate` actually
+ * emits, never the parameter name. `config.names` values reach the destination
+ * verbatim with no charset or case validation in core, so a parameter named
+ * `githubToken` — a perfectly good name — transforms to `GITHUB_TOKEN`, which
+ * GitHub reserves. Composed from the real transform (`variableName`) rather than
+ * re-deriving it, so it cannot drift from what a push actually sends.
+ */
+
+/**
+ * Every generated variable that violates GitHub's grammar, collected rather than
+ * thrown so a push reports every bad name at once and refuses before the first
+ * PUT. Deterministic: per-name violations in variable order, then case
+ * collisions in uppercased-key order, each parameter list sorted.
+ *
+ * Exact-string collisions (two parameters producing the identical variable) are
+ * core's `checkNameCollisions`, run before this. Here the concern is GitHub's
+ * *case-insensitivity*, which core's exact-string map cannot see.
+ */
+declare function checkGithubNames(refs: readonly ParameterRef[], config: PenvConfig): GithubNameError[];
+
+export { GhInvocationError, type GhRunner, GithubNameError, type GithubNameReason, GithubProvider, type GithubProviderOptions, GithubUnavailableError, type GithubUnavailableReason, checkGithubNames, createGithubProvider, defaultGhRunner, penvProviderFactory };

package/dist/index.d.ts

@@ -0,0 +1,159 @@
+import { PenvError, ProviderFactoryContext, ProjectionProvider, SecretScope, ProjectionSecret, ParameterRef, PenvConfig, PenvErrorLike } from '@penvhq/core';
+
+/**
+ * The provider's own errors, extending penv's base so they print with a remedy and
+ * carry a stable code, exactly as core's do. They live here rather than in core
+ * because they encode GitHub's grammar and GitHub's plumbing — the reserved
+ * `GITHUB_` prefix, the `gh` CLI — which are someone else's product, not penv's.
+ * Core stays destination-agnostic; the destination's rules live with the provider.
+ */
+
+/** Which of GitHub's name rules a generated variable breaks. */
+type GithubNameReason = "reserved-prefix" | "leading-digit" | "charset" | "case-collision";
+/**
+ * A generated variable the destination will not accept. Mirrors core's
+ * `NameCollisionError`: the offending variable and the parameters that produce
+ * it are public fields, the message names them, and the remedy points at the
+ * `override` block — the one place any of these can be repaired.
+ */
+declare class GithubNameError extends PenvError {
+    readonly name = "GithubNameError";
+    readonly reason: GithubNameReason;
+    readonly variable: string;
+    /** The dotted parameter ids generating this variable — two for a case collision, one otherwise. */
+    readonly parameters: readonly string[];
+    constructor(reason: GithubNameReason, variable: string, parameters: readonly string[], message: string, remedy: string);
+}
+/** Why penv cannot reach GitHub. Never fallen back from — see the RFC's provider-unification decision. */
+type GithubUnavailableReason = "not-installed" | "not-authenticated" | "command-failed";
+/**
+ * The destination could not be reached or refused an operation. penv holds no
+ * GitHub credential of its own and never falls back to a weaker path, so it names
+ * which of "not installed", "not authenticated", or "the command failed" is true
+ * and stops.
+ */
+declare class GithubUnavailableError extends PenvError {
+    readonly name = "GithubUnavailableError";
+    readonly reason: GithubUnavailableReason;
+    constructor(reason: GithubUnavailableReason, message: string, remedy: string);
+}
+
+/**
+ * The plugin seam: what the penv CLI calls when a `providers.*.type` names this
+ * package. The factory owns the translation from the config's provider-agnostic
+ * surface (`location`) to this provider's own options, so the config never
+ * learns GitHub vocabulary and the provider never parses config.
+ */
+
+declare module "@penvhq/core" {
+    interface ProviderConfigMap {
+        "@penvhq/provider-github": {
+            /**
+             * The repository penv maps the projection onto — `owner/repo`. Left
+             * unset, `gh` resolves it from the working directory.
+             */
+            readonly location?: string;
+        };
+    }
+}
+/** Builds the GitHub provider for one environment's declared destination. */
+declare function penvProviderFactory(context: ProviderFactoryContext): ProjectionProvider;
+
+/**
+ * The GitHub Actions Secrets provider — the first to declare both capability
+ * limits: it holds a *projection* (resolved variable names, `.local` scopes
+ * skipped, plaintext GitHub re-seals) and it cannot read values back, because
+ * GitHub's API never returns one at any scope through any endpoint.
+ *
+ * penv reaches GitHub through the `gh` CLI and holds no GitHub credential of its
+ * own: `gh auth login` has already happened, the token is `gh`'s to keep, and
+ * penv's config gains no field for it. Values cross on **stdin**, never `--body`
+ * (argv is readable by other processes) and never `--env-file` (a plaintext temp
+ * file is the arrangement penv exists to delete) — one `gh` process per
+ * parameter, which is slow and correct on a command that runs at deploy prep.
+ */
+
+/** A `gh` invocation failed. Normalized so the provider maps it without touching Node's error shape. */
+declare class GhInvocationError extends Error {
+    readonly name = "GhInvocationError";
+    /** True when `gh` is not on PATH (spawn `ENOENT`). */
+    readonly notFound: boolean;
+    readonly status: number | null;
+    readonly stderr: string;
+    readonly args: readonly string[];
+    constructor(notFound: boolean, status: number | null, stderr: string, args: readonly string[]);
+}
+/**
+ * Runs `gh` with an argument array (never a shell string, so values with spaces
+ * or special characters are never re-parsed) and optional stdin, returning
+ * stdout. Injectable so the provider is testable without the binary; throws
+ * {@link GhInvocationError} on failure.
+ */
+type GhRunner = (args: readonly string[], input?: string) => string;
+/** The real runner. Keeps `gh` non-interactive so it fails loudly rather than prompting. */
+declare const defaultGhRunner: GhRunner;
+interface GithubProviderOptions {
+    /** The `owner/repo` `gh` targets. Left unset, `gh` resolves it from the working directory. */
+    readonly repo?: string;
+    /** The `gh` runner. Defaults to invoking the real binary; injected in tests. */
+    readonly run?: GhRunner;
+}
+declare class GithubProvider implements ProjectionProvider {
+    #private;
+    readonly type = "@penvhq/provider-github";
+    /**
+     * Both limits, declared: the store holds a resolved projection, and values
+     * never come back — GitHub's own reference says a get "without revealing its
+     * encrypted value" is all there is. The declaration is what lets `push`,
+     * `pull`, and `doctor` treat this store honestly without a separate concept.
+     */
+    readonly capabilities: {
+        readonly holds: "projection";
+        readonly readsValues: false;
+    };
+    constructor(options?: GithubProviderOptions);
+    verify(): Promise<void>;
+    push(name: string, value: string, scope: SecretScope): Promise<void>;
+    list(scope: SecretScope): Promise<ProjectionSecret[]>;
+    /** GitHub's name grammar, judged before the first PUT — the provider owns its own rules. */
+    checkNames(refs: readonly ParameterRef[], config: PenvConfig): PenvErrorLike[];
+    /**
+     * Whether the GitHub deployment environment exists. A 404 is an ordinary
+     * answer — the very one `ensureTarget` exists to fix — never an error.
+     */
+    targetExists(environment: string): Promise<boolean>;
+    /**
+     * Creates the deployment environment. Idempotent on GitHub's side (PUT), and
+     * only ever called after the CLI has an explicit go-ahead — the provider
+     * itself never asks, never guesses.
+     */
+    ensureTarget(environment: string): Promise<void>;
+}
+declare function createGithubProvider(options?: GithubProviderOptions): GithubProvider;
+
+/**
+ * The GitHub name pre-flight: judge every generated variable against GitHub's
+ * secret grammar *before* anything is pushed, so a push is all or nothing and a
+ * reserved name is never discovered after sixty secrets are already placed.
+ *
+ * The rule that matters most: validate the variable `penv generate` actually
+ * emits, never the parameter name. `config.names` values reach the destination
+ * verbatim with no charset or case validation in core, so a parameter named
+ * `githubToken` — a perfectly good name — transforms to `GITHUB_TOKEN`, which
+ * GitHub reserves. Composed from the real transform (`variableName`) rather than
+ * re-deriving it, so it cannot drift from what a push actually sends.
+ */
+
+/**
+ * Every generated variable that violates GitHub's grammar, collected rather than
+ * thrown so a push reports every bad name at once and refuses before the first
+ * PUT. Deterministic: per-name violations in variable order, then case
+ * collisions in uppercased-key order, each parameter list sorted.
+ *
+ * Exact-string collisions (two parameters producing the identical variable) are
+ * core's `checkNameCollisions`, run before this. Here the concern is GitHub's
+ * *case-insensitivity*, which core's exact-string map cannot see.
+ */
+declare function checkGithubNames(refs: readonly ParameterRef[], config: PenvConfig): GithubNameError[];
+
+export { GhInvocationError, type GhRunner, GithubNameError, type GithubNameReason, GithubProvider, type GithubProviderOptions, GithubUnavailableError, type GithubUnavailableReason, checkGithubNames, createGithubProvider, defaultGhRunner, penvProviderFactory };

package/dist/index.js

@@ -0,0 +1,335 @@
+// src/errors.ts
+import { PenvError } from "@penvhq/core";
+var GithubNameError = class extends PenvError {
+  name = "GithubNameError";
+  reason;
+  variable;
+  /** The dotted parameter ids generating this variable — two for a case collision, one otherwise. */
+  parameters;
+  constructor(reason, variable, parameters, message, remedy) {
+    super("GITHUB_NAME", message, remedy);
+    this.reason = reason;
+    this.variable = variable;
+    this.parameters = parameters;
+  }
+};
+var GithubUnavailableError = class extends PenvError {
+  name = "GithubUnavailableError";
+  reason;
+  constructor(reason, message, remedy) {
+    super("GITHUB_UNAVAILABLE", message, remedy);
+    this.reason = reason;
+  }
+};
+
+// src/github.ts
+import { execFileSync } from "child_process";
+
+// src/names.ts
+import { parameterId, variableName } from "@penvhq/core";
+var RESERVED_PREFIX = "GITHUB_";
+var LEADING_DIGIT = /^[0-9]/;
+var LEGAL_NAME = /^[A-Za-z0-9_]+$/;
+function reservedPrefix(variable, parameter) {
+  return new GithubNameError(
+    "reserved-prefix",
+    variable,
+    [parameter],
+    `The parameter \`${parameter}\` generates the variable \`${variable}\`, which GitHub reserves \u2014 a secret name may not begin with \`${RESERVED_PREFIX}\``,
+    "GitHub keeps the `GITHUB_` prefix for its own secrets. Rename the parameter, or map it to an allowed name in the `override` block of penv.config.ts."
+  );
+}
+function leadingDigit(variable, parameter) {
+  return new GithubNameError(
+    "leading-digit",
+    variable,
+    [parameter],
+    `The parameter \`${parameter}\` generates the variable \`${variable}\`, which GitHub rejects \u2014 a secret name may not begin with a digit`,
+    "Rename the parameter, or map it to a name that starts with a letter or `_` in the `override` block of penv.config.ts."
+  );
+}
+function charset(variable, parameter) {
+  return new GithubNameError(
+    "charset",
+    variable,
+    [parameter],
+    `The parameter \`${parameter}\` generates the variable \`${variable}\`, which GitHub rejects \u2014 a secret name may contain only letters, digits, and \`_\``,
+    "Rename the parameter, or map it to a name matching `[A-Za-z0-9_]` in the `override` block of penv.config.ts."
+  );
+}
+function caseCollision(upper, parameters) {
+  return new GithubNameError(
+    "case-collision",
+    upper,
+    parameters,
+    `Parameters ${parameters.map((p) => `\`${p}\``).join(" and ")} generate variables that differ only in case, and GitHub secret names are case-insensitive \u2014 they would overwrite one another`,
+    "Give one of them a distinct name \u2014 not just a different case \u2014 in the `override` block of penv.config.ts."
+  );
+}
+function checkGithubNames(refs, config) {
+  const named = refs.map((ref) => ({
+    variable: variableName(ref, config),
+    parameter: parameterId(ref)
+  }));
+  const errors = [];
+  const perName = [...named].sort(
+    (a, b) => a.variable < b.variable ? -1 : a.variable > b.variable ? 1 : a.parameter < b.parameter ? -1 : a.parameter > b.parameter ? 1 : 0
+  );
+  for (const { variable, parameter } of perName) {
+    if (variable.toUpperCase().startsWith(RESERVED_PREFIX)) {
+      errors.push(reservedPrefix(variable, parameter));
+    } else if (LEADING_DIGIT.test(variable)) {
+      errors.push(leadingDigit(variable, parameter));
+    } else if (!LEGAL_NAME.test(variable)) {
+      errors.push(charset(variable, parameter));
+    }
+  }
+  const byUpper = /* @__PURE__ */ new Map();
+  for (const { variable, parameter } of named) {
+    const key = variable.toUpperCase();
+    const list = byUpper.get(key);
+    if (list === void 0) {
+      byUpper.set(key, [parameter]);
+    } else {
+      list.push(parameter);
+    }
+  }
+  for (const key of [...byUpper.keys()].sort()) {
+    const parameters = byUpper.get(key);
+    if (parameters === void 0 || parameters.length < 2) {
+      continue;
+    }
+    errors.push(caseCollision(key, [...parameters].sort()));
+  }
+  return errors;
+}
+
+// src/github.ts
+var GhInvocationError = class extends Error {
+  name = "GhInvocationError";
+  /** True when `gh` is not on PATH (spawn `ENOENT`). */
+  notFound;
+  status;
+  stderr;
+  args;
+  constructor(notFound, status, stderr, args) {
+    super(`gh ${args.join(" ")} exited ${notFound ? "not found" : String(status)}`);
+    this.notFound = notFound;
+    this.status = status;
+    this.stderr = stderr;
+    this.args = args;
+  }
+};
+function toText(value) {
+  if (value === void 0) return "";
+  return typeof value === "string" ? value : value.toString("utf8");
+}
+var defaultGhRunner = (args, input) => {
+  try {
+    return execFileSync("gh", [...args], {
+      ...input === void 0 ? {} : { input },
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"],
+      env: { ...process.env, GH_PROMPT_DISABLED: "1", NO_COLOR: "1" }
+    });
+  } catch (error) {
+    const e = error;
+    const status = typeof e.status === "number" ? e.status : null;
+    throw new GhInvocationError(e.code === "ENOENT", status, toText(e.stderr), args);
+  }
+};
+var AUTH_HINT = /not logged in|authentication|gh auth login|no accounts/i;
+function notInstalled() {
+  return new GithubUnavailableError(
+    "not-installed",
+    "The `gh` CLI is not installed or not on your PATH",
+    "penv reaches GitHub Actions through `gh` and holds no GitHub credential itself. Install it from https://cli.github.com and run `gh auth login`, then try again."
+  );
+}
+function notAuthenticated(stderr) {
+  return new GithubUnavailableError(
+    "not-authenticated",
+    "penv could not authenticate to GitHub through `gh`",
+    `Run \`gh auth login\` (with a token that can write repository and environment secrets), then try again.${stderr.trim() === "" ? "" : `
+  gh said: ${stderr.trim()}`}`
+  );
+}
+function commandFailed(action, stderr) {
+  return new GithubUnavailableError(
+    "command-failed",
+    `gh could not ${action}`,
+    `Check that \`gh\` is authenticated with a token scoped to write this repository's secrets, and that the repository and environment exist.${stderr.trim() === "" ? "" : `
+  gh said: ${stderr.trim()}`}`
+  );
+}
+function mapFailure(error, action) {
+  if (error instanceof GhInvocationError) {
+    if (error.notFound) return notInstalled();
+    if (AUTH_HINT.test(error.stderr)) return notAuthenticated(error.stderr);
+    return commandFailed(action, error.stderr);
+  }
+  return commandFailed(action, error instanceof Error ? error.message : String(error));
+}
+function scopeArgs(scope, repo) {
+  const repoArgs = repo === void 0 ? [] : ["--repo", repo];
+  return scope.kind === "environment" ? ["--env", scope.environment, ...repoArgs] : [...repoArgs];
+}
+function parseSecretList(stdout, action) {
+  let parsed;
+  try {
+    parsed = JSON.parse(stdout);
+  } catch (cause) {
+    throw commandFailed(action, `gh returned output that is not JSON: ${toText(String(cause))}`);
+  }
+  if (!Array.isArray(parsed)) {
+    throw commandFailed(action, "gh returned JSON that is not an array of secrets");
+  }
+  const secrets = [];
+  for (const entry of parsed) {
+    if (typeof entry?.name !== "string" || typeof entry.updatedAt !== "string") {
+      continue;
+    }
+    secrets.push({ name: entry.name, updatedAt: entry.updatedAt });
+  }
+  return secrets;
+}
+var GithubProvider = class {
+  type = "@penvhq/provider-github";
+  /**
+   * Both limits, declared: the store holds a resolved projection, and values
+   * never come back — GitHub's own reference says a get "without revealing its
+   * encrypted value" is all there is. The declaration is what lets `push`,
+   * `pull`, and `doctor` treat this store honestly without a separate concept.
+   */
+  capabilities = { holds: "projection", readsValues: false };
+  #repo;
+  #run;
+  /** The `owner/repo` actually targeted, resolved once when no option named it. */
+  #resolvedRepo;
+  constructor(options = {}) {
+    this.#repo = options.repo;
+    this.#run = options.run ?? defaultGhRunner;
+  }
+  async verify() {
+    try {
+      this.#run(["auth", "status"]);
+    } catch (error) {
+      if (error instanceof GhInvocationError && error.notFound) {
+        throw notInstalled();
+      }
+      throw notAuthenticated(error instanceof GhInvocationError ? error.stderr : String(error));
+    }
+    try {
+      this.#run([
+        "secret",
+        "list",
+        ...scopeArgs({ kind: "repository" }, this.#repo),
+        "--json",
+        "name"
+      ]);
+    } catch (error) {
+      throw mapFailure(error, "reach this repository's secrets");
+    }
+  }
+  async push(name, value, scope) {
+    const args = ["secret", "set", name, ...scopeArgs(scope, this.#repo)];
+    try {
+      this.#run(args, value);
+    } catch (error) {
+      throw mapFailure(error, `set the secret \`${name}\``);
+    }
+  }
+  async list(scope) {
+    const args = ["secret", "list", ...scopeArgs(scope, this.#repo), "--json", "name,updatedAt"];
+    let stdout;
+    try {
+      stdout = this.#run(args);
+    } catch (error) {
+      throw mapFailure(error, "list secrets");
+    }
+    return parseSecretList(stdout, "list secrets");
+  }
+  /** GitHub's name grammar, judged before the first PUT — the provider owns its own rules. */
+  checkNames(refs, config) {
+    return checkGithubNames(refs, config);
+  }
+  /**
+   * The `owner/repo` the API paths below need. `gh secret` resolves the repo
+   * from the working directory on its own, but `gh api` takes a literal path —
+   * so when no `location` named one, ask `gh` once and keep the answer.
+   */
+  #targetRepo() {
+    if (this.#repo !== void 0) {
+      return this.#repo;
+    }
+    if (this.#resolvedRepo === void 0) {
+      let stdout;
+      try {
+        stdout = this.#run(["repo", "view", "--json", "nameWithOwner", "--jq", ".nameWithOwner"]);
+      } catch (error) {
+        throw mapFailure(error, "resolve the repository this directory belongs to");
+      }
+      const repo = stdout.trim();
+      if (repo === "") {
+        throw commandFailed(
+          "resolve the repository this directory belongs to",
+          "gh reported no repository. Set `location` to `owner/repo` in the provider entry."
+        );
+      }
+      this.#resolvedRepo = repo;
+    }
+    return this.#resolvedRepo;
+  }
+  /**
+   * Whether the GitHub deployment environment exists. A 404 is an ordinary
+   * answer — the very one `ensureTarget` exists to fix — never an error.
+   */
+  async targetExists(environment) {
+    try {
+      this.#run(["api", `repos/${this.#targetRepo()}/environments/${environment}`]);
+      return true;
+    } catch (error) {
+      if (error instanceof GhInvocationError && /HTTP 404|Not Found/i.test(error.stderr)) {
+        return false;
+      }
+      throw mapFailure(error, `check whether the environment \`${environment}\` exists`);
+    }
+  }
+  /**
+   * Creates the deployment environment. Idempotent on GitHub's side (PUT), and
+   * only ever called after the CLI has an explicit go-ahead — the provider
+   * itself never asks, never guesses.
+   */
+  async ensureTarget(environment) {
+    try {
+      this.#run([
+        "api",
+        "--method",
+        "PUT",
+        `repos/${this.#targetRepo()}/environments/${environment}`
+      ]);
+    } catch (error) {
+      throw mapFailure(error, `create the environment \`${environment}\``);
+    }
+  }
+};
+function createGithubProvider(options = {}) {
+  return new GithubProvider(options);
+}
+
+// src/factory.ts
+function penvProviderFactory(context) {
+  const location = context.providerConfig?.location;
+  return createGithubProvider(location === void 0 ? {} : { repo: location });
+}
+export {
+  GhInvocationError,
+  GithubNameError,
+  GithubProvider,
+  GithubUnavailableError,
+  checkGithubNames,
+  createGithubProvider,
+  defaultGhRunner,
+  penvProviderFactory
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/errors.ts","../src/github.ts","../src/names.ts","../src/factory.ts"],"sourcesContent":["/**\n * The provider's own errors, extending penv's base so they print with a remedy and\n * carry a stable code, exactly as core's do. They live here rather than in core\n * because they encode GitHub's grammar and GitHub's plumbing — the reserved\n * `GITHUB_` prefix, the `gh` CLI — which are someone else's product, not penv's.\n * Core stays destination-agnostic; the destination's rules live with the provider.\n */\n\nimport { PenvError } from \"@penvhq/core\";\n\n/** Which of GitHub's name rules a generated variable breaks. */\nexport type GithubNameReason = \"reserved-prefix\" | \"leading-digit\" | \"charset\" | \"case-collision\";\n\n/**\n * A generated variable the destination will not accept. Mirrors core's\n * `NameCollisionError`: the offending variable and the parameters that produce\n * it are public fields, the message names them, and the remedy points at the\n * `override` block — the one place any of these can be repaired.\n */\nexport class GithubNameError extends PenvError {\n  override readonly name = \"GithubNameError\";\n  readonly reason: GithubNameReason;\n  readonly variable: string;\n  /** The dotted parameter ids generating this variable — two for a case collision, one otherwise. */\n  readonly parameters: readonly string[];\n\n  constructor(\n    reason: GithubNameReason,\n    variable: string,\n    parameters: readonly string[],\n    message: string,\n    remedy: string,\n  ) {\n    super(\"GITHUB_NAME\", message, remedy);\n    this.reason = reason;\n    this.variable = variable;\n    this.parameters = parameters;\n  }\n}\n\n/** Why penv cannot reach GitHub. Never fallen back from — see the RFC's provider-unification decision. */\nexport type GithubUnavailableReason = \"not-installed\" | \"not-authenticated\" | \"command-failed\";\n\n/**\n * The destination could not be reached or refused an operation. penv holds no\n * GitHub credential of its own and never falls back to a weaker path, so it names\n * which of \"not installed\", \"not authenticated\", or \"the command failed\" is true\n * and stops.\n */\nexport class GithubUnavailableError extends PenvError {\n  override readonly name = \"GithubUnavailableError\";\n  readonly reason: GithubUnavailableReason;\n\n  constructor(reason: GithubUnavailableReason, message: string, remedy: string) {\n    super(\"GITHUB_UNAVAILABLE\", message, remedy);\n    this.reason = reason;\n  }\n}\n","/**\n * The GitHub Actions Secrets provider — the first to declare both capability\n * limits: it holds a *projection* (resolved variable names, `.local` scopes\n * skipped, plaintext GitHub re-seals) and it cannot read values back, because\n * GitHub's API never returns one at any scope through any endpoint.\n *\n * penv reaches GitHub through the `gh` CLI and holds no GitHub credential of its\n * own: `gh auth login` has already happened, the token is `gh`'s to keep, and\n * penv's config gains no field for it. Values cross on **stdin**, never `--body`\n * (argv is readable by other processes) and never `--env-file` (a plaintext temp\n * file is the arrangement penv exists to delete) — one `gh` process per\n * parameter, which is slow and correct on a command that runs at deploy prep.\n */\n\nimport { execFileSync } from \"node:child_process\";\nimport type {\n  ParameterRef,\n  PenvConfig,\n  PenvErrorLike,\n  ProjectionProvider,\n  ProjectionSecret,\n  SecretScope,\n} from \"@penvhq/core\";\nimport { GithubUnavailableError } from \"./errors.js\";\nimport { checkGithubNames } from \"./names.js\";\n\n/** A `gh` invocation failed. Normalized so the provider maps it without touching Node's error shape. */\nexport class GhInvocationError extends Error {\n  override readonly name = \"GhInvocationError\";\n  /** True when `gh` is not on PATH (spawn `ENOENT`). */\n  readonly notFound: boolean;\n  readonly status: number | null;\n  readonly stderr: string;\n  readonly args: readonly string[];\n\n  constructor(notFound: boolean, status: number | null, stderr: string, args: readonly string[]) {\n    super(`gh ${args.join(\" \")} exited ${notFound ? \"not found\" : String(status)}`);\n    this.notFound = notFound;\n    this.status = status;\n    this.stderr = stderr;\n    this.args = args;\n  }\n}\n\n/**\n * Runs `gh` with an argument array (never a shell string, so values with spaces\n * or special characters are never re-parsed) and optional stdin, returning\n * stdout. Injectable so the provider is testable without the binary; throws\n * {@link GhInvocationError} on failure.\n */\nexport type GhRunner = (args: readonly string[], input?: string) => string;\n\nfunction toText(value: string | Buffer | undefined): string {\n  if (value === undefined) return \"\";\n  return typeof value === \"string\" ? value : value.toString(\"utf8\");\n}\n\n/** The real runner. Keeps `gh` non-interactive so it fails loudly rather than prompting. */\nexport const defaultGhRunner: GhRunner = (args, input) => {\n  try {\n    return execFileSync(\"gh\", [...args], {\n      ...(input === undefined ? {} : { input }),\n      encoding: \"utf8\",\n      stdio: [\"pipe\", \"pipe\", \"pipe\"],\n      env: { ...process.env, GH_PROMPT_DISABLED: \"1\", NO_COLOR: \"1\" },\n    });\n  } catch (error) {\n    const e = error as NodeJS.ErrnoException & {\n      status?: number | null;\n      stderr?: string | Buffer;\n    };\n    const status = typeof e.status === \"number\" ? e.status : null;\n    throw new GhInvocationError(e.code === \"ENOENT\", status, toText(e.stderr), args);\n  }\n};\n\nconst AUTH_HINT = /not logged in|authentication|gh auth login|no accounts/i;\n\nfunction notInstalled(): GithubUnavailableError {\n  return new GithubUnavailableError(\n    \"not-installed\",\n    \"The `gh` CLI is not installed or not on your PATH\",\n    \"penv reaches GitHub Actions through `gh` and holds no GitHub credential itself. Install it \" +\n      \"from https://cli.github.com and run `gh auth login`, then try again.\",\n  );\n}\n\nfunction notAuthenticated(stderr: string): GithubUnavailableError {\n  return new GithubUnavailableError(\n    \"not-authenticated\",\n    \"penv could not authenticate to GitHub through `gh`\",\n    `Run \\`gh auth login\\` (with a token that can write repository and environment secrets), then ` +\n      `try again.${stderr.trim() === \"\" ? \"\" : `\\n  gh said: ${stderr.trim()}`}`,\n  );\n}\n\nfunction commandFailed(action: string, stderr: string): GithubUnavailableError {\n  return new GithubUnavailableError(\n    \"command-failed\",\n    `gh could not ${action}`,\n    `Check that \\`gh\\` is authenticated with a token scoped to write this repository's secrets, and ` +\n      `that the repository and environment exist.${stderr.trim() === \"\" ? \"\" : `\\n  gh said: ${stderr.trim()}`}`,\n  );\n}\n\n/** Maps a failed invocation to the loud, specific refusal penv owes the user. */\nfunction mapFailure(error: unknown, action: string): GithubUnavailableError {\n  if (error instanceof GhInvocationError) {\n    if (error.notFound) return notInstalled();\n    if (AUTH_HINT.test(error.stderr)) return notAuthenticated(error.stderr);\n    return commandFailed(action, error.stderr);\n  }\n  return commandFailed(action, error instanceof Error ? error.message : String(error));\n}\n\n/** `--env <name>` for an environment secret, nothing for a repository secret; `--repo` when declared. */\nfunction scopeArgs(scope: SecretScope, repo: string | undefined): string[] {\n  const repoArgs = repo === undefined ? [] : [\"--repo\", repo];\n  return scope.kind === \"environment\" ? [\"--env\", scope.environment, ...repoArgs] : [...repoArgs];\n}\n\ninterface RawSecret {\n  readonly name: unknown;\n  readonly updatedAt: unknown;\n}\n\nfunction parseSecretList(stdout: string, action: string): ProjectionSecret[] {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(stdout);\n  } catch (cause) {\n    throw commandFailed(action, `gh returned output that is not JSON: ${toText(String(cause))}`);\n  }\n  if (!Array.isArray(parsed)) {\n    throw commandFailed(action, \"gh returned JSON that is not an array of secrets\");\n  }\n  const secrets: ProjectionSecret[] = [];\n  for (const entry of parsed as RawSecret[]) {\n    if (typeof entry?.name !== \"string\" || typeof entry.updatedAt !== \"string\") {\n      continue;\n    }\n    secrets.push({ name: entry.name, updatedAt: entry.updatedAt });\n  }\n  return secrets;\n}\n\nexport interface GithubProviderOptions {\n  /** The `owner/repo` `gh` targets. Left unset, `gh` resolves it from the working directory. */\n  readonly repo?: string;\n  /** The `gh` runner. Defaults to invoking the real binary; injected in tests. */\n  readonly run?: GhRunner;\n}\n\nexport class GithubProvider implements ProjectionProvider {\n  readonly type = \"@penvhq/provider-github\";\n  /**\n   * Both limits, declared: the store holds a resolved projection, and values\n   * never come back — GitHub's own reference says a get \"without revealing its\n   * encrypted value\" is all there is. The declaration is what lets `push`,\n   * `pull`, and `doctor` treat this store honestly without a separate concept.\n   */\n  readonly capabilities = { holds: \"projection\", readsValues: false } as const;\n\n  readonly #repo: string | undefined;\n  readonly #run: GhRunner;\n  /** The `owner/repo` actually targeted, resolved once when no option named it. */\n  #resolvedRepo: string | undefined;\n\n  constructor(options: GithubProviderOptions = {}) {\n    this.#repo = options.repo;\n    this.#run = options.run ?? defaultGhRunner;\n  }\n\n  async verify(): Promise<void> {\n    try {\n      this.#run([\"auth\", \"status\"]);\n    } catch (error) {\n      if (error instanceof GhInvocationError && error.notFound) {\n        throw notInstalled();\n      }\n      throw notAuthenticated(error instanceof GhInvocationError ? error.stderr : String(error));\n    }\n    // Authenticated is not the same as able to write here. Listing the\n    // repository's secrets is a live probe that the token can reach *this*\n    // repository's secrets API — catching a wrong or inaccessible repo and a\n    // grossly under-scoped token before the first PUT rather than mid-push. It\n    // cannot prove per-environment write permission without writing, so that\n    // narrower failure can still surface at push time as a loud refusal.\n    try {\n      this.#run([\n        \"secret\",\n        \"list\",\n        ...scopeArgs({ kind: \"repository\" }, this.#repo),\n        \"--json\",\n        \"name\",\n      ]);\n    } catch (error) {\n      throw mapFailure(error, \"reach this repository's secrets\");\n    }\n  }\n\n  async push(name: string, value: string, scope: SecretScope): Promise<void> {\n    const args = [\"secret\", \"set\", name, ...scopeArgs(scope, this.#repo)];\n    try {\n      this.#run(args, value);\n    } catch (error) {\n      throw mapFailure(error, `set the secret \\`${name}\\``);\n    }\n  }\n\n  async list(scope: SecretScope): Promise<ProjectionSecret[]> {\n    const args = [\"secret\", \"list\", ...scopeArgs(scope, this.#repo), \"--json\", \"name,updatedAt\"];\n    let stdout: string;\n    try {\n      stdout = this.#run(args);\n    } catch (error) {\n      throw mapFailure(error, \"list secrets\");\n    }\n    return parseSecretList(stdout, \"list secrets\");\n  }\n\n  /** GitHub's name grammar, judged before the first PUT — the provider owns its own rules. */\n  checkNames(refs: readonly ParameterRef[], config: PenvConfig): PenvErrorLike[] {\n    return checkGithubNames(refs, config);\n  }\n\n  /**\n   * The `owner/repo` the API paths below need. `gh secret` resolves the repo\n   * from the working directory on its own, but `gh api` takes a literal path —\n   * so when no `location` named one, ask `gh` once and keep the answer.\n   */\n  #targetRepo(): string {\n    if (this.#repo !== undefined) {\n      return this.#repo;\n    }\n    if (this.#resolvedRepo === undefined) {\n      let stdout: string;\n      try {\n        stdout = this.#run([\"repo\", \"view\", \"--json\", \"nameWithOwner\", \"--jq\", \".nameWithOwner\"]);\n      } catch (error) {\n        throw mapFailure(error, \"resolve the repository this directory belongs to\");\n      }\n      const repo = stdout.trim();\n      if (repo === \"\") {\n        throw commandFailed(\n          \"resolve the repository this directory belongs to\",\n          \"gh reported no repository. Set `location` to `owner/repo` in the provider entry.\",\n        );\n      }\n      this.#resolvedRepo = repo;\n    }\n    return this.#resolvedRepo;\n  }\n\n  /**\n   * Whether the GitHub deployment environment exists. A 404 is an ordinary\n   * answer — the very one `ensureTarget` exists to fix — never an error.\n   */\n  async targetExists(environment: string): Promise<boolean> {\n    try {\n      this.#run([\"api\", `repos/${this.#targetRepo()}/environments/${environment}`]);\n      return true;\n    } catch (error) {\n      if (error instanceof GhInvocationError && /HTTP 404|Not Found/i.test(error.stderr)) {\n        return false;\n      }\n      throw mapFailure(error, `check whether the environment \\`${environment}\\` exists`);\n    }\n  }\n\n  /**\n   * Creates the deployment environment. Idempotent on GitHub's side (PUT), and\n   * only ever called after the CLI has an explicit go-ahead — the provider\n   * itself never asks, never guesses.\n   */\n  async ensureTarget(environment: string): Promise<void> {\n    try {\n      this.#run([\n        \"api\",\n        \"--method\",\n        \"PUT\",\n        `repos/${this.#targetRepo()}/environments/${environment}`,\n      ]);\n    } catch (error) {\n      throw mapFailure(error, `create the environment \\`${environment}\\``);\n    }\n  }\n}\n\nexport function createGithubProvider(options: GithubProviderOptions = {}): GithubProvider {\n  return new GithubProvider(options);\n}\n","/**\n * The GitHub name pre-flight: judge every generated variable against GitHub's\n * secret grammar *before* anything is pushed, so a push is all or nothing and a\n * reserved name is never discovered after sixty secrets are already placed.\n *\n * The rule that matters most: validate the variable `penv generate` actually\n * emits, never the parameter name. `config.names` values reach the destination\n * verbatim with no charset or case validation in core, so a parameter named\n * `githubToken` — a perfectly good name — transforms to `GITHUB_TOKEN`, which\n * GitHub reserves. Composed from the real transform (`variableName`) rather than\n * re-deriving it, so it cannot drift from what a push actually sends.\n */\n\nimport type { ParameterRef, PenvConfig } from \"@penvhq/core\";\nimport { parameterId, variableName } from \"@penvhq/core\";\nimport { GithubNameError } from \"./errors.js\";\n\n/** GitHub reserves this prefix for its own secrets. */\nconst RESERVED_PREFIX = \"GITHUB_\";\n/** A secret name may not begin with a digit. */\nconst LEADING_DIGIT = /^[0-9]/;\n/** A secret name is letters, digits, and underscores only. */\nconst LEGAL_NAME = /^[A-Za-z0-9_]+$/;\n\nfunction reservedPrefix(variable: string, parameter: string): GithubNameError {\n  return new GithubNameError(\n    \"reserved-prefix\",\n    variable,\n    [parameter],\n    `The parameter \\`${parameter}\\` generates the variable \\`${variable}\\`, which GitHub reserves — a secret name may not begin with \\`${RESERVED_PREFIX}\\``,\n    \"GitHub keeps the `GITHUB_` prefix for its own secrets. Rename the parameter, or map it to an \" +\n      \"allowed name in the `override` block of penv.config.ts.\",\n  );\n}\n\nfunction leadingDigit(variable: string, parameter: string): GithubNameError {\n  return new GithubNameError(\n    \"leading-digit\",\n    variable,\n    [parameter],\n    `The parameter \\`${parameter}\\` generates the variable \\`${variable}\\`, which GitHub rejects — a secret name may not begin with a digit`,\n    \"Rename the parameter, or map it to a name that starts with a letter or `_` in the `override` \" +\n      \"block of penv.config.ts.\",\n  );\n}\n\nfunction charset(variable: string, parameter: string): GithubNameError {\n  return new GithubNameError(\n    \"charset\",\n    variable,\n    [parameter],\n    `The parameter \\`${parameter}\\` generates the variable \\`${variable}\\`, which GitHub rejects — a secret name may contain only letters, digits, and \\`_\\``,\n    \"Rename the parameter, or map it to a name matching `[A-Za-z0-9_]` in the `override` block of \" +\n      \"penv.config.ts.\",\n  );\n}\n\nfunction caseCollision(upper: string, parameters: readonly string[]): GithubNameError {\n  return new GithubNameError(\n    \"case-collision\",\n    upper,\n    parameters,\n    `Parameters ${parameters.map((p) => `\\`${p}\\``).join(\" and \")} generate variables that differ only in case, and GitHub secret names are case-insensitive — they would overwrite one another`,\n    \"Give one of them a distinct name — not just a different case — in the `override` block of \" +\n      \"penv.config.ts.\",\n  );\n}\n\n/**\n * Every generated variable that violates GitHub's grammar, collected rather than\n * thrown so a push reports every bad name at once and refuses before the first\n * PUT. Deterministic: per-name violations in variable order, then case\n * collisions in uppercased-key order, each parameter list sorted.\n *\n * Exact-string collisions (two parameters producing the identical variable) are\n * core's `checkNameCollisions`, run before this. Here the concern is GitHub's\n * *case-insensitivity*, which core's exact-string map cannot see.\n */\nexport function checkGithubNames(\n  refs: readonly ParameterRef[],\n  config: PenvConfig,\n): GithubNameError[] {\n  const named = refs.map((ref) => ({\n    variable: variableName(ref, config),\n    parameter: parameterId(ref),\n  }));\n\n  const errors: GithubNameError[] = [];\n\n  const perName = [...named].sort((a, b) =>\n    a.variable < b.variable\n      ? -1\n      : a.variable > b.variable\n        ? 1\n        : a.parameter < b.parameter\n          ? -1\n          : a.parameter > b.parameter\n            ? 1\n            : 0,\n  );\n  for (const { variable, parameter } of perName) {\n    // Case-insensitively, because GitHub reserves the prefix case-insensitively:\n    // an `override` of `github_token` reaches GitHub verbatim and is refused\n    // there, so it must be refused here — the same case-folding the collision\n    // check below already applies.\n    if (variable.toUpperCase().startsWith(RESERVED_PREFIX)) {\n      errors.push(reservedPrefix(variable, parameter));\n    } else if (LEADING_DIGIT.test(variable)) {\n      errors.push(leadingDigit(variable, parameter));\n    } else if (!LEGAL_NAME.test(variable)) {\n      errors.push(charset(variable, parameter));\n    }\n  }\n\n  const byUpper = new Map<string, string[]>();\n  for (const { variable, parameter } of named) {\n    const key = variable.toUpperCase();\n    const list = byUpper.get(key);\n    if (list === undefined) {\n      byUpper.set(key, [parameter]);\n    } else {\n      list.push(parameter);\n    }\n  }\n  for (const key of [...byUpper.keys()].sort()) {\n    const parameters = byUpper.get(key);\n    if (parameters === undefined || parameters.length < 2) {\n      continue;\n    }\n    errors.push(caseCollision(key, [...parameters].sort()));\n  }\n\n  return errors;\n}\n","/**\n * The plugin seam: what the penv CLI calls when a `providers.*.type` names this\n * package. The factory owns the translation from the config's provider-agnostic\n * surface (`location`) to this provider's own options, so the config never\n * learns GitHub vocabulary and the provider never parses config.\n */\n\nimport type { ProjectionProvider, ProviderFactoryContext } from \"@penvhq/core\";\nimport { createGithubProvider } from \"./github.js\";\n\ndeclare module \"@penvhq/core\" {\n  interface ProviderConfigMap {\n    \"@penvhq/provider-github\": {\n      /**\n       * The repository penv maps the projection onto — `owner/repo`. Left\n       * unset, `gh` resolves it from the working directory.\n       */\n      readonly location?: string;\n    };\n  }\n}\n\n/** Builds the GitHub provider for one environment's declared destination. */\nexport function penvProviderFactory(context: ProviderFactoryContext): ProjectionProvider {\n  const location = context.providerConfig?.location;\n  return createGithubProvider(location === undefined ? {} : { repo: location });\n}\n"],"mappings":";AAQA,SAAS,iBAAiB;AAWnB,IAAM,kBAAN,cAA8B,UAAU;AAAA,EAC3B,OAAO;AAAA,EAChB;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EAET,YACE,QACA,UACA,YACA,SACA,QACA;AACA,UAAM,eAAe,SAAS,MAAM;AACpC,SAAK,SAAS;AACd,SAAK,WAAW;AAChB,SAAK,aAAa;AAAA,EACpB;AACF;AAWO,IAAM,yBAAN,cAAqC,UAAU;AAAA,EAClC,OAAO;AAAA,EAChB;AAAA,EAET,YAAY,QAAiC,SAAiB,QAAgB;AAC5E,UAAM,sBAAsB,SAAS,MAAM;AAC3C,SAAK,SAAS;AAAA,EAChB;AACF;;;AC3CA,SAAS,oBAAoB;;;ACA7B,SAAS,aAAa,oBAAoB;AAI1C,IAAM,kBAAkB;AAExB,IAAM,gBAAgB;AAEtB,IAAM,aAAa;AAEnB,SAAS,eAAe,UAAkB,WAAoC;AAC5E,SAAO,IAAI;AAAA,IACT;AAAA,IACA;AAAA,IACA,CAAC,SAAS;AAAA,IACV,mBAAmB,SAAS,+BAA+B,QAAQ,uEAAkE,eAAe;AAAA,IACpJ;AAAA,EAEF;AACF;AAEA,SAAS,aAAa,UAAkB,WAAoC;AAC1E,SAAO,IAAI;AAAA,IACT;AAAA,IACA;AAAA,IACA,CAAC,SAAS;AAAA,IACV,mBAAmB,SAAS,+BAA+B,QAAQ;AAAA,IACnE;AAAA,EAEF;AACF;AAEA,SAAS,QAAQ,UAAkB,WAAoC;AACrE,SAAO,IAAI;AAAA,IACT;AAAA,IACA;AAAA,IACA,CAAC,SAAS;AAAA,IACV,mBAAmB,SAAS,+BAA+B,QAAQ;AAAA,IACnE;AAAA,EAEF;AACF;AAEA,SAAS,cAAc,OAAe,YAAgD;AACpF,SAAO,IAAI;AAAA,IACT;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc,WAAW,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC;AAAA,IAC7D;AAAA,EAEF;AACF;AAYO,SAAS,iBACd,MACA,QACmB;AACnB,QAAM,QAAQ,KAAK,IAAI,CAAC,SAAS;AAAA,IAC/B,UAAU,aAAa,KAAK,MAAM;AAAA,IAClC,WAAW,YAAY,GAAG;AAAA,EAC5B,EAAE;AAEF,QAAM,SAA4B,CAAC;AAEnC,QAAM,UAAU,CAAC,GAAG,KAAK,EAAE;AAAA,IAAK,CAAC,GAAG,MAClC,EAAE,WAAW,EAAE,WACX,KACA,EAAE,WAAW,EAAE,WACb,IACA,EAAE,YAAY,EAAE,YACd,KACA,EAAE,YAAY,EAAE,YACd,IACA;AAAA,EACZ;AACA,aAAW,EAAE,UAAU,UAAU,KAAK,SAAS;AAK7C,QAAI,SAAS,YAAY,EAAE,WAAW,eAAe,GAAG;AACtD,aAAO,KAAK,eAAe,UAAU,SAAS,CAAC;AAAA,IACjD,WAAW,cAAc,KAAK,QAAQ,GAAG;AACvC,aAAO,KAAK,aAAa,UAAU,SAAS,CAAC;AAAA,IAC/C,WAAW,CAAC,WAAW,KAAK,QAAQ,GAAG;AACrC,aAAO,KAAK,QAAQ,UAAU,SAAS,CAAC;AAAA,IAC1C;AAAA,EACF;AAEA,QAAM,UAAU,oBAAI,IAAsB;AAC1C,aAAW,EAAE,UAAU,UAAU,KAAK,OAAO;AAC3C,UAAM,MAAM,SAAS,YAAY;AACjC,UAAM,OAAO,QAAQ,IAAI,GAAG;AAC5B,QAAI,SAAS,QAAW;AACtB,cAAQ,IAAI,KAAK,CAAC,SAAS,CAAC;AAAA,IAC9B,OAAO;AACL,WAAK,KAAK,SAAS;AAAA,IACrB;AAAA,EACF;AACA,aAAW,OAAO,CAAC,GAAG,QAAQ,KAAK,CAAC,EAAE,KAAK,GAAG;AAC5C,UAAM,aAAa,QAAQ,IAAI,GAAG;AAClC,QAAI,eAAe,UAAa,WAAW,SAAS,GAAG;AACrD;AAAA,IACF;AACA,WAAO,KAAK,cAAc,KAAK,CAAC,GAAG,UAAU,EAAE,KAAK,CAAC,CAAC;AAAA,EACxD;AAEA,SAAO;AACT;;;AD1GO,IAAM,oBAAN,cAAgC,MAAM;AAAA,EACzB,OAAO;AAAA;AAAA,EAEhB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,UAAmB,QAAuB,QAAgB,MAAyB;AAC7F,UAAM,MAAM,KAAK,KAAK,GAAG,CAAC,WAAW,WAAW,cAAc,OAAO,MAAM,CAAC,EAAE;AAC9E,SAAK,WAAW;AAChB,SAAK,SAAS;AACd,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;AAUA,SAAS,OAAO,OAA4C;AAC1D,MAAI,UAAU,OAAW,QAAO;AAChC,SAAO,OAAO,UAAU,WAAW,QAAQ,MAAM,SAAS,MAAM;AAClE;AAGO,IAAM,kBAA4B,CAAC,MAAM,UAAU;AACxD,MAAI;AACF,WAAO,aAAa,MAAM,CAAC,GAAG,IAAI,GAAG;AAAA,MACnC,GAAI,UAAU,SAAY,CAAC,IAAI,EAAE,MAAM;AAAA,MACvC,UAAU;AAAA,MACV,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,MAC9B,KAAK,EAAE,GAAG,QAAQ,KAAK,oBAAoB,KAAK,UAAU,IAAI;AAAA,IAChE,CAAC;AAAA,EACH,SAAS,OAAO;AACd,UAAM,IAAI;AAIV,UAAM,SAAS,OAAO,EAAE,WAAW,WAAW,EAAE,SAAS;AACzD,UAAM,IAAI,kBAAkB,EAAE,SAAS,UAAU,QAAQ,OAAO,EAAE,MAAM,GAAG,IAAI;AAAA,EACjF;AACF;AAEA,IAAM,YAAY;AAElB,SAAS,eAAuC;AAC9C,SAAO,IAAI;AAAA,IACT;AAAA,IACA;AAAA,IACA;AAAA,EAEF;AACF;AAEA,SAAS,iBAAiB,QAAwC;AAChE,SAAO,IAAI;AAAA,IACT;AAAA,IACA;AAAA,IACA,0GACe,OAAO,KAAK,MAAM,KAAK,KAAK;AAAA,aAAgB,OAAO,KAAK,CAAC,EAAE;AAAA,EAC5E;AACF;AAEA,SAAS,cAAc,QAAgB,QAAwC;AAC7E,SAAO,IAAI;AAAA,IACT;AAAA,IACA,gBAAgB,MAAM;AAAA,IACtB,4IAC+C,OAAO,KAAK,MAAM,KAAK,KAAK;AAAA,aAAgB,OAAO,KAAK,CAAC,EAAE;AAAA,EAC5G;AACF;AAGA,SAAS,WAAW,OAAgB,QAAwC;AAC1E,MAAI,iBAAiB,mBAAmB;AACtC,QAAI,MAAM,SAAU,QAAO,aAAa;AACxC,QAAI,UAAU,KAAK,MAAM,MAAM,EAAG,QAAO,iBAAiB,MAAM,MAAM;AACtE,WAAO,cAAc,QAAQ,MAAM,MAAM;AAAA,EAC3C;AACA,SAAO,cAAc,QAAQ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AACrF;AAGA,SAAS,UAAU,OAAoB,MAAoC;AACzE,QAAM,WAAW,SAAS,SAAY,CAAC,IAAI,CAAC,UAAU,IAAI;AAC1D,SAAO,MAAM,SAAS,gBAAgB,CAAC,SAAS,MAAM,aAAa,GAAG,QAAQ,IAAI,CAAC,GAAG,QAAQ;AAChG;AAOA,SAAS,gBAAgB,QAAgB,QAAoC;AAC3E,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,MAAM;AAAA,EAC5B,SAAS,OAAO;AACd,UAAM,cAAc,QAAQ,wCAAwC,OAAO,OAAO,KAAK,CAAC,CAAC,EAAE;AAAA,EAC7F;AACA,MAAI,CAAC,MAAM,QAAQ,MAAM,GAAG;AAC1B,UAAM,cAAc,QAAQ,kDAAkD;AAAA,EAChF;AACA,QAAM,UAA8B,CAAC;AACrC,aAAW,SAAS,QAAuB;AACzC,QAAI,OAAO,OAAO,SAAS,YAAY,OAAO,MAAM,cAAc,UAAU;AAC1E;AAAA,IACF;AACA,YAAQ,KAAK,EAAE,MAAM,MAAM,MAAM,WAAW,MAAM,UAAU,CAAC;AAAA,EAC/D;AACA,SAAO;AACT;AASO,IAAM,iBAAN,MAAmD;AAAA,EAC/C,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOP,eAAe,EAAE,OAAO,cAAc,aAAa,MAAM;AAAA,EAEzD;AAAA,EACA;AAAA;AAAA,EAET;AAAA,EAEA,YAAY,UAAiC,CAAC,GAAG;AAC/C,SAAK,QAAQ,QAAQ;AACrB,SAAK,OAAO,QAAQ,OAAO;AAAA,EAC7B;AAAA,EAEA,MAAM,SAAwB;AAC5B,QAAI;AACF,WAAK,KAAK,CAAC,QAAQ,QAAQ,CAAC;AAAA,IAC9B,SAAS,OAAO;AACd,UAAI,iBAAiB,qBAAqB,MAAM,UAAU;AACxD,cAAM,aAAa;AAAA,MACrB;AACA,YAAM,iBAAiB,iBAAiB,oBAAoB,MAAM,SAAS,OAAO,KAAK,CAAC;AAAA,IAC1F;AAOA,QAAI;AACF,WAAK,KAAK;AAAA,QACR;AAAA,QACA;AAAA,QACA,GAAG,UAAU,EAAE,MAAM,aAAa,GAAG,KAAK,KAAK;AAAA,QAC/C;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,WAAW,OAAO,iCAAiC;AAAA,IAC3D;AAAA,EACF;AAAA,EAEA,MAAM,KAAK,MAAc,OAAe,OAAmC;AACzE,UAAM,OAAO,CAAC,UAAU,OAAO,MAAM,GAAG,UAAU,OAAO,KAAK,KAAK,CAAC;AACpE,QAAI;AACF,WAAK,KAAK,MAAM,KAAK;AAAA,IACvB,SAAS,OAAO;AACd,YAAM,WAAW,OAAO,oBAAoB,IAAI,IAAI;AAAA,IACtD;AAAA,EACF;AAAA,EAEA,MAAM,KAAK,OAAiD;AAC1D,UAAM,OAAO,CAAC,UAAU,QAAQ,GAAG,UAAU,OAAO,KAAK,KAAK,GAAG,UAAU,gBAAgB;AAC3F,QAAI;AACJ,QAAI;AACF,eAAS,KAAK,KAAK,IAAI;AAAA,IACzB,SAAS,OAAO;AACd,YAAM,WAAW,OAAO,cAAc;AAAA,IACxC;AACA,WAAO,gBAAgB,QAAQ,cAAc;AAAA,EAC/C;AAAA;AAAA,EAGA,WAAW,MAA+B,QAAqC;AAC7E,WAAO,iBAAiB,MAAM,MAAM;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,cAAsB;AACpB,QAAI,KAAK,UAAU,QAAW;AAC5B,aAAO,KAAK;AAAA,IACd;AACA,QAAI,KAAK,kBAAkB,QAAW;AACpC,UAAI;AACJ,UAAI;AACF,iBAAS,KAAK,KAAK,CAAC,QAAQ,QAAQ,UAAU,iBAAiB,QAAQ,gBAAgB,CAAC;AAAA,MAC1F,SAAS,OAAO;AACd,cAAM,WAAW,OAAO,kDAAkD;AAAA,MAC5E;AACA,YAAM,OAAO,OAAO,KAAK;AACzB,UAAI,SAAS,IAAI;AACf,cAAM;AAAA,UACJ;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,WAAK,gBAAgB;AAAA,IACvB;AACA,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,aAAa,aAAuC;AACxD,QAAI;AACF,WAAK,KAAK,CAAC,OAAO,SAAS,KAAK,YAAY,CAAC,iBAAiB,WAAW,EAAE,CAAC;AAC5E,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UAAI,iBAAiB,qBAAqB,sBAAsB,KAAK,MAAM,MAAM,GAAG;AAClF,eAAO;AAAA,MACT;AACA,YAAM,WAAW,OAAO,mCAAmC,WAAW,WAAW;AAAA,IACnF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,aAAa,aAAoC;AACrD,QAAI;AACF,WAAK,KAAK;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS,KAAK,YAAY,CAAC,iBAAiB,WAAW;AAAA,MACzD,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,WAAW,OAAO,4BAA4B,WAAW,IAAI;AAAA,IACrE;AAAA,EACF;AACF;AAEO,SAAS,qBAAqB,UAAiC,CAAC,GAAmB;AACxF,SAAO,IAAI,eAAe,OAAO;AACnC;;;AE5QO,SAAS,oBAAoB,SAAqD;AACvF,QAAM,WAAW,QAAQ,gBAAgB;AACzC,SAAO,qBAAqB,aAAa,SAAY,CAAC,IAAI,EAAE,MAAM,SAAS,CAAC;AAC9E;","names":[]}

package/package.json

@@ -0,0 +1,26 @@
+{
+  "name": "@penvhq/provider-github",
+  "version": "0.5.0",
+  "description": "The GitHub Actions Secrets provider — a projection-holding, value-withholding store penv pushes to through the gh CLI.",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@penvhq/core": "0.5.0"
+  },
+  "scripts": {
+    "build": "tsup"
+  }
+}