@rathnasgala/cli 0.0.22 → 1.0.0

package/src/github-credential-store.js

@@ -1,104 +0,0 @@
-import { chmod, lstat, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-
-export function githubCredentialPath({ platform = process.platform, environment = process.env, home = os.homedir() } = {}) {
-  if (platform === 'win32') {
-    if (!environment.APPDATA) throw new Error('APPDATA is required to store GitHub credentials on Windows');
-    return path.join(environment.APPDATA, 'Gala', 'github-credentials.json');
-  }
-  if (platform === 'darwin') return path.join(home, 'Library', 'Application Support', 'Gala', 'github-credentials.json');
-  return path.join(environment.XDG_CONFIG_HOME || path.join(home, '.config'), 'gala', 'github-credentials.json');
-}
-
-async function regularOrMissing(target) {
-  try {
-    const metadata = await lstat(target);
-    if (metadata.isSymbolicLink() || !metadata.isFile()) throw new TypeError('GitHub credential must be a regular file');
-    return true;
-  } catch (error) {
-    if (error.code === 'ENOENT') return false;
-    throw error;
-  }
-}
-
-/**
- * Schema 2 stores a GitHub App user token, which has no scopes.
- *
- * Schema 1 held an OAuth App token and recorded the `repo` and `workflow` scopes it had negotiated.
- * A GitHub App has neither: its permissions are fixed on the app and granted at installation. The
- * version bump is what makes the difference visible — a schema-1 file is rejected on read, so a
- * writer carrying an OAuth token is sent through `auth github` once rather than presenting a
- * credential the API will refuse in a less obvious way later.
- */
-export async function writeGithubCredential({
-  accessToken, expiresAt, refreshToken, target = githubCredentialPath()
-}) {
-  if (typeof accessToken !== 'string' || accessToken === '') throw new TypeError('accessToken is required');
-  if (expiresAt != null && Number.isNaN(new Date(expiresAt).getTime())) {
-    throw new TypeError('expiresAt must be a date');
-  }
-  const directory = path.dirname(path.resolve(target));
-  await mkdir(directory, { recursive: true, mode: 0o700 });
-  const directoryMetadata = await lstat(directory);
-  if (directoryMetadata.isSymbolicLink() || !directoryMetadata.isDirectory()) {
-    throw new TypeError('GitHub credential directory must be a real directory');
-  }
-  await chmod(directory, 0o700);
-  const exists = await regularOrMissing(target);
-  const temporary = `${target}.gala-${process.pid}`;
-  const backup = `${target}.gala-backup-${process.pid}`;
-  try {
-    const record = {
-      schemaVersion: 2,
-      accessToken,
-      ...(expiresAt == null ? {} : { expiresAt: new Date(expiresAt).toISOString() }),
-      ...(refreshToken == null ? {} : { refreshToken })
-    };
-    await writeFile(temporary, `${JSON.stringify(record)}\n`, {
-      flag: 'wx', mode: 0o600
-    });
-    await chmod(temporary, 0o600);
-    if (exists) await rename(target, backup);
-    try { await rename(temporary, target); }
-    catch (error) { if (exists) await rename(backup, target); throw error; }
-    await chmod(target, 0o600);
-    if (exists) await rm(backup);
-    return path.resolve(target);
-  } catch (error) {
-    await rm(temporary, { force: true });
-    throw error;
-  }
-}
-
-export async function readGithubCredential({ target = githubCredentialPath(), now = new Date() } = {}) {
-  if (!await regularOrMissing(target)) throw new Error('GitHub authentication is missing; run `gala auth github`');
-  const payload = JSON.parse(await readFile(target, 'utf8'));
-  if (payload?.schemaVersion === 1) {
-    // An OAuth App token. It cannot list installations and organisations may refuse it outright, so
-    // it is not usable — and saying that here beats a confusing 403 four calls later.
-    throw new Error('GitHub authentication is out of date; run `gala auth github` again');
-  }
-  if (payload?.schemaVersion !== 2 || typeof payload.accessToken !== 'string'
-      || payload.accessToken === '') {
-    throw new TypeError('GitHub credential file has an unsupported schema');
-  }
-  /*
-   * The app expires user tokens after eight hours. Refreshing one needs the app's client secret,
-   * which lives on the server, so until that exchange exists the honest answer is to ask for a
-   * sign-in here — rather than hand out a token that fails as a 401 several calls deeper, which is
-   * exactly how the legacy Gala credential wasted a week.
-   */
-  if (typeof payload.expiresAt === 'string') {
-    const expiresAt = new Date(payload.expiresAt);
-    if (Number.isNaN(expiresAt.getTime()) || expiresAt <= now) {
-      throw new Error('GitHub authentication expired; run `gala auth github` again');
-    }
-    return Object.freeze({
-      accessToken: payload.accessToken,
-      expiresAt,
-      ...(typeof payload.refreshToken === 'string' ? { refreshToken: payload.refreshToken } : {})
-    });
-  }
-  return Object.freeze({ accessToken: payload.accessToken });
-}

package/src/github-device-flow.js

@@ -1,153 +0,0 @@
-const DEVICE_CODE_URL = 'https://github.com/login/device/code';
-const ACCESS_TOKEN_URL = 'https://github.com/login/oauth/access_token';
-const DEVICE_GRANT = 'urn:ietf:params:oauth:grant-type:device_code';
-
-function requiredString(value, field) {
-  if (typeof value !== 'string' || value.trim() === '') {
-    throw new TypeError(`${field} is required`);
-  }
-  return value.trim();
-}
-
-function positiveInteger(value, field) {
-  if (!Number.isSafeInteger(value) || value <= 0) {
-    throw new TypeError(`${field} must be a positive integer`);
-  }
-  return value;
-}
-
-async function postForm(fetchImpl, url, fields) {
-  const response = await fetchImpl(url, {
-    method: 'POST',
-    headers: {
-      accept: 'application/json',
-      'content-type': 'application/x-www-form-urlencoded'
-    },
-    body: new URLSearchParams(fields)
-  });
-  if (!response.ok) {
-    throw new Error(`GitHub OAuth request failed with HTTP ${response.status}`);
-  }
-  const payload = await response.json();
-  if (payload == null || Array.isArray(payload) || typeof payload !== 'object') {
-    throw new TypeError('GitHub OAuth response must be a JSON object');
-  }
-  return payload;
-}
-
-/**
- * `scopes` is optional and must be omitted for a GitHub App.
- *
- * OAuth Apps negotiate scopes per authorization; GitHub Apps do not — their permissions are fixed
- * on the app and granted at installation. Sending a `scope` parameter to an App's device flow asks
- * for something the grant cannot express.
- */
-export async function requestDeviceCode({ clientId, scopes, fetchImpl = fetch }) {
-  const normalizedClientId = requiredString(clientId, 'clientId');
-  if (scopes != null && (!Array.isArray(scopes) || scopes.length === 0)) {
-    throw new TypeError('scopes must be a non-empty list when supplied');
-  }
-  const normalizedScopes = scopes == null
-    ? null
-    : scopes.map((scope) => requiredString(scope, 'scope'));
-  const payload = await postForm(fetchImpl, DEVICE_CODE_URL, {
-    client_id: normalizedClientId,
-    ...(normalizedScopes == null ? {} : { scope: normalizedScopes.join(' ') })
-  });
-
-  return Object.freeze({
-    deviceCode: requiredString(payload.device_code, 'device_code'),
-    userCode: requiredString(payload.user_code, 'user_code'),
-    verificationUri: requiredString(payload.verification_uri, 'verification_uri'),
-    expiresInSeconds: positiveInteger(payload.expires_in, 'expires_in'),
-    intervalSeconds: positiveInteger(payload.interval, 'interval')
-  });
-}
-
-export async function pollForAccessToken({
-  clientId,
-  deviceCode,
-  expiresInSeconds,
-  intervalSeconds,
-  requiredScopes = [],
-  fetchImpl = fetch,
-  sleep = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
-  now = Date.now
-}) {
-  const normalizedClientId = requiredString(clientId, 'clientId');
-  const normalizedDeviceCode = requiredString(deviceCode, 'deviceCode');
-  if (!Array.isArray(requiredScopes)) throw new TypeError('requiredScopes must be a list');
-  // A GitHub App answers with no `scope` field at all; there is nothing to require of it.
-  const normalizedRequiredScopes = (requiredScopes ?? []).map((scope) =>
-    requiredString(scope, 'scope').toLowerCase()
-  );
-  const lifetime = positiveInteger(expiresInSeconds, 'expiresInSeconds') * 1000;
-  let interval = positiveInteger(intervalSeconds, 'intervalSeconds');
-  const startedAt = now();
-  if (typeof startedAt !== 'number' || !Number.isFinite(startedAt)) {
-    throw new TypeError('Clock must return epoch milliseconds');
-  }
-
-  while (true) {
-    await sleep(interval * 1000);
-    const currentTime = now();
-    if (typeof currentTime !== 'number' || !Number.isFinite(currentTime)) {
-      throw new TypeError('Clock must return epoch milliseconds');
-    }
-    if (currentTime - startedAt >= lifetime) {
-      throw new Error('GitHub device code expired before authorization completed');
-    }
-
-    const payload = await postForm(fetchImpl, ACCESS_TOKEN_URL, {
-      client_id: normalizedClientId,
-      device_code: normalizedDeviceCode,
-      grant_type: DEVICE_GRANT
-    });
-    if (typeof payload.access_token === 'string' && payload.access_token !== '') {
-      const tokenType = requiredString(payload.token_type, 'token_type');
-      if (tokenType.toLowerCase() !== 'bearer') {
-        throw new TypeError('GitHub OAuth token_type must be bearer');
-      }
-      const grantedScopes = typeof payload.scope === 'string'
-        ? payload.scope.split(/[,\s]+/).map((scope) => scope.trim().toLowerCase()).filter(Boolean)
-        : [];
-      const missingScopes = normalizedRequiredScopes.filter((scope) => !grantedScopes.includes(scope));
-      if (missingScopes.length > 0) {
-        throw new Error(`GitHub authorization omitted required scope(s): ${missingScopes.join(', ')}`);
-      }
-      /*
-       * A GitHub App may be set to expire user tokens after eight hours, in which case GitHub
-       * returns `expires_in` and a refresh token. Refreshing one requires the app's client secret,
-       * which a published CLI cannot hold — so the expiry is reported rather than dropped, and the
-       * caller decides what to do about a credential it has no way to renew.
-       */
-      const expiresInSeconds = Number(payload.expires_in);
-      return Object.freeze({
-        accessToken: requiredString(payload.access_token, 'access_token'),
-        ...(Number.isFinite(expiresInSeconds) && expiresInSeconds > 0
-          ? { expiresAt: new Date(now() + expiresInSeconds * 1000) }
-          : {}),
-        ...(typeof payload.refresh_token === 'string' && payload.refresh_token !== ''
-          ? { refreshToken: payload.refresh_token }
-          : {}),
-        tokenType: 'bearer',
-        scopes: grantedScopes
-      });
-    }
-
-    if (payload.error === 'authorization_pending') continue;
-    if (payload.error === 'slow_down') {
-      interval = Number.isSafeInteger(payload.interval) && payload.interval > interval
-        ? payload.interval
-        : interval + 5;
-      continue;
-    }
-    if (payload.error === 'expired_token' || payload.error === 'token_expired') {
-      throw new Error('GitHub device code expired before authorization completed');
-    }
-    if (typeof payload.error === 'string' && payload.error !== '') {
-      throw new Error(`GitHub device authorization failed: ${payload.error}`);
-    }
-    throw new TypeError('GitHub OAuth response contained neither a token nor an error');
-  }
-}

package/src/github-empty-repository.js

@@ -1,89 +0,0 @@
-import { spawn } from 'node:child_process';
-import { describeHttpFailure } from './http-failure.js';
-
-const API_VERSION = '2026-03-10';
-
-export async function verifyEmptyRepository({ owner, repository, accessToken, fetchImpl = fetch }) {
-  const repositoryUrl = `https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repository)}`;
-  const headers = {
-    accept: 'application/vnd.github+json', authorization: `Bearer ${accessToken}`,
-    'x-github-api-version': API_VERSION
-  };
-  const response = await fetchImpl(repositoryUrl, {
-    headers
-  });
-  if (response.status === 404) {
-    /*
-     * A GitHub App user token only sees repositories the App is installed on, so "not found" here
-     * usually means "not shared with Gala" rather than "does not exist". The OAuth token this
-     * replaced held `repo` and could see everything, which is exactly the access we stopped asking
-     * for — so the cost is that this needs saying out loud.
-     */
-    throw new Error(
-      `${owner}/${repository} is not visible to Gala. Either it does not exist, or the Gala GitHub `
-      + 'App has not been given access to it — install or share it at '
-      + 'https://github.com/settings/installations, then run scaffold again.'
-    );
-  }
-  if (!response.ok) throw new Error(await describeHttpFailure(response, 'GitHub repository lookup'));
-  const payload = await response.json();
-  if (payload.full_name?.toLowerCase() !== `${owner}/${repository}`.toLowerCase()) {
-    throw new TypeError('GitHub returned an unexpected repository');
-  }
-  const branchesResponse = await fetchImpl(`${repositoryUrl}/branches?per_page=1`, {
-    headers: {
-      ...headers
-    }
-  });
-  if (!branchesResponse.ok) throw new Error(await describeHttpFailure(branchesResponse, 'GitHub branch lookup'));
-  const branches = await branchesResponse.json();
-  if (payload.size !== 0 || !Array.isArray(branches) || branches.length !== 0) {
-    throw new Error('Existing repository is not empty; explicit non-empty adoption is not implemented');
-  }
-}
-
-export function setRepositoryOrigin({ root, owner, repository, spawnProcess = spawn }) {
-  const target = `https://github.com/${owner}/${repository}.git`;
-  return new Promise((resolve, reject) => {
-    const child = spawnProcess('git', ['-C', root, 'remote', 'set-url', 'origin', target], {
-      cwd: root, shell: false, stdio: 'inherit'
-    });
-    child.once('error', reject);
-    child.once('exit', (code, signal) => {
-      if (signal) reject(new Error(`Git remote update terminated by signal ${signal}`));
-      else if (code !== 0) reject(new Error(`Git remote update exited with code ${code}`));
-      else resolve();
-    });
-  });
-}
-
-export function verifyRepositoryOrigin({ root, owner, repository, spawnProcess = spawn }) {
-  const expected = `https://github.com/${owner}/${repository}.git`;
-  const expectedPath = `/${owner}/${repository}.git`;
-  return new Promise((resolve, reject) => {
-    const child = spawnProcess('git', ['-C', root, 'remote', 'get-url', 'origin'], {
-      cwd: root, shell: false, stdio: ['ignore', 'pipe', 'inherit']
-    });
-    let output = '';
-    child.stdout?.setEncoding('utf8');
-    child.stdout?.on('data', (chunk) => { output += chunk; });
-    child.once('error', reject);
-    child.once('exit', (code, signal) => {
-      if (signal) reject(new Error(`Git origin verification terminated by signal ${signal}`));
-      else if (code !== 0) reject(new Error(`Git origin verification exited with code ${code}`));
-      else {
-        let origin;
-        try {
-          origin = new URL(output.trim());
-        } catch {
-          reject(new Error(`Existing checkout origin must be ${expected}`));
-          return;
-        }
-        if (origin.protocol !== 'https:' || origin.hostname !== 'github.com' || origin.port !== ''
-            || origin.pathname !== expectedPath || origin.search !== '' || origin.hash !== '') {
-          reject(new Error(`Existing checkout origin must be ${expected}`));
-        } else resolve(root);
-      }
-    });
-  });
-}

package/src/github-identity.js

@@ -1,32 +0,0 @@
-import { describeHttpFailure } from './http-failure.js';
-const GITHUB_API_VERSION = '2026-03-10';
-
-/**
- * The GitHub account the stored credential belongs to.
- *
- * `scaffold` used to make the writer pass `--owner`, which is a value the token already knows and
- * they can only get wrong. The credential file holds the token and its scopes and nothing else, so
- * this is a live lookup rather than something cached at `auth github` time — a login can be
- * changed, and a stale one would create the repository under a name that no longer exists.
- */
-export async function resolveGithubLogin({ accessToken, fetchImpl = fetch }) {
-  if (typeof accessToken !== 'string' || accessToken === '') {
-    throw new TypeError('accessToken is required');
-  }
-  const response = await fetchImpl('https://api.github.com/user', {
-    headers: {
-      accept: 'application/vnd.github+json',
-      authorization: `Bearer ${accessToken}`,
-      'x-github-api-version': GITHUB_API_VERSION
-    }
-  });
-  if (!response.ok) throw new Error(await describeHttpFailure(response, 'GitHub account lookup'));
-  const payload = await response.json();
-  const login = payload?.login;
-  // The same shape `scaffold` demands of `--owner`. Refusing here beats a confusing failure four
-  // API calls later.
-  if (typeof login !== 'string' || !/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/.test(login)) {
-    throw new TypeError('GitHub returned an unusable account login');
-  }
-  return login;
-}

package/src/github-pages-provisioning.js

@@ -1,107 +0,0 @@
-import { describeHttpFailure } from './http-failure.js';
-const GITHUB_API_VERSION = '2026-03-10';
-const SEGMENT = /^[A-Za-z0-9_.-]+$/;
-const SHA = /^[0-9a-f]{40}$/;
-
-function required(value, field, pattern = null) {
-  if (typeof value !== 'string' || value.length === 0 || (pattern != null && !pattern.test(value))) {
-    throw new TypeError(`${field} is invalid`);
-  }
-  return value;
-}
-
-function headers(accessToken) {
-  return {
-    accept: 'application/vnd.github+json',
-    authorization: `Bearer ${accessToken}`,
-    'content-type': 'application/json',
-    'x-github-api-version': GITHUB_API_VERSION
-  };
-}
-
-async function json(response, operation) {
-  if (!response.ok) throw new Error(await describeHttpFailure(response, `GitHub ${operation}`));
-  return response.json();
-}
-
-export async function provisionGithubPages({
-  owner, repository, accessToken, commitSha, fetchImpl = fetch,
-  customDomain = null,
-  sleep = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
-  pollIntervalMs = 5_000, maxPolls = 120
-}) {
-  const normalizedOwner = required(owner, 'owner', SEGMENT);
-  const normalizedRepository = required(repository, 'repository', SEGMENT);
-  const token = required(accessToken, 'accessToken');
-  const sha = required(commitSha, 'commitSha', SHA);
-  if (customDomain != null && (typeof customDomain !== 'string'
-      || !/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(customDomain))) {
-    throw new TypeError('customDomain is invalid');
-  }
-  if (!Number.isSafeInteger(pollIntervalMs) || pollIntervalMs < 0) {
-    throw new TypeError('pollIntervalMs must be a non-negative safe integer');
-  }
-  if (!Number.isSafeInteger(maxPolls) || maxPolls <= 0) {
-    throw new TypeError('maxPolls must be a positive safe integer');
-  }
-  const requestHeaders = headers(token);
-  const repositoryUrl = `https://api.github.com/repos/${encodeURIComponent(normalizedOwner)}/${encodeURIComponent(normalizedRepository)}`;
-  const query = new URLSearchParams({ event: 'push', head_sha: sha, per_page: '10' });
-  let run = null;
-  for (let poll = 0; poll < maxPolls; poll += 1) {
-    const response = await fetchImpl(`${repositoryUrl}/actions/workflows/publish.yml/runs?${query}`, {
-      method: 'GET', headers: requestHeaders
-    });
-    const payload = await json(response, 'publish workflow runs request');
-    run = payload.workflow_runs?.find((candidate) => candidate.head_sha === sha) ?? null;
-    if (run?.status === 'completed') break;
-    if (poll + 1 < maxPolls) await sleep(pollIntervalMs);
-  }
-  if (run == null || run.status !== 'completed') {
-    throw new Error(`Timed out waiting for the publish workflow for ${sha}`);
-  }
-  if (run.conclusion !== 'success') {
-    throw new Error(`Initial publish workflow failed: ${run.html_url}`);
-  }
-  const branch = await fetchImpl(`${repositoryUrl}/branches/gh-pages`, {
-    method: 'GET', headers: requestHeaders
-  });
-  if (!branch.ok) {
-    throw new Error(`Successful publish run created no gh-pages branch: ${run.html_url}`);
-  }
-  const current = await fetchImpl(`${repositoryUrl}/pages`, { method: 'GET', headers: requestHeaders });
-  if (current.ok) {
-    const configuration = await current.json();
-    if (configuration.source?.branch !== 'gh-pages' || configuration.source?.path !== '/') {
-      throw new Error('Existing GitHub Pages configuration does not use gh-pages at /');
-    }
-    if ((configuration.cname ?? null) !== customDomain) {
-      const updated = await fetchImpl(`${repositoryUrl}/pages`, {
-        method: 'PUT', headers: requestHeaders,
-        body: JSON.stringify({ cname: customDomain, source: { branch: 'gh-pages', path: '/' } })
-      });
-      if (updated.status !== 204) {
-        throw new Error(`GitHub Pages custom-domain update failed with HTTP ${updated.status}`);
-      }
-    }
-    return Object.freeze({ created: false, url: configuration.html_url, runUrl: run.html_url });
-  }
-  if (current.status !== 404) {
-    throw new Error(await describeHttpFailure(current, 'GitHub Pages configuration request'));
-  }
-  const created = await fetchImpl(`${repositoryUrl}/pages`, {
-    method: 'POST', headers: requestHeaders,
-    body: JSON.stringify({ source: { branch: 'gh-pages', path: '/' } })
-  });
-  const configuration = await json(created, 'Pages activation');
-  if (customDomain != null) {
-    const updated = await fetchImpl(`${repositoryUrl}/pages`, {
-      method: 'PUT', headers: requestHeaders,
-      body: JSON.stringify({ cname: customDomain, source: { branch: 'gh-pages', path: '/' } })
-    });
-    if (updated.status !== 204) {
-      throw new Error(`GitHub Pages custom-domain update failed with HTTP ${updated.status}`);
-    }
-  }
-  return Object.freeze({ created: true, url: configuration.html_url, runUrl: run.html_url });
-}

package/src/github-repository-secret.js

@@ -1,82 +0,0 @@
-import sodium from 'libsodium-wrappers';
-
-const GITHUB_API_VERSION = '2026-03-10';
-const OWNER_OR_REPOSITORY = /^[A-Za-z0-9_.-]+$/;
-const SECRET_NAME = /^[A-Z_][A-Z0-9_]*$/;
-
-function required(value, field, pattern) {
-  if (typeof value !== 'string' || !pattern.test(value)) {
-    throw new TypeError(`${field} is invalid`);
-  }
-  return value;
-}
-
-function requiredSecret(value, field) {
-  if (typeof value !== 'string' || value.length === 0) {
-    throw new TypeError(`${field} must not be empty`);
-  }
-  return value;
-}
-
-function headers(accessToken) {
-  return {
-    accept: 'application/vnd.github+json',
-    authorization: `Bearer ${accessToken}`,
-    'content-type': 'application/json',
-    'x-github-api-version': GITHUB_API_VERSION
-  };
-}
-
-async function requireSuccess(response, operation) {
-  if (!response?.ok) {
-    const status = Number.isInteger(response?.status) ? response.status : 'unknown';
-    throw new Error(`GitHub ${operation} failed with HTTP ${status}`);
-  }
-}
-
-export async function installRepositorySecret({
-  owner,
-  repository,
-  accessToken,
-  secretName,
-  secretValue,
-  fetchImpl = fetch,
-  sodiumImpl = sodium
-}) {
-  const normalizedOwner = required(owner, 'owner', OWNER_OR_REPOSITORY);
-  const normalizedRepository = required(repository, 'repository', OWNER_OR_REPOSITORY);
-  const normalizedSecretName = required(secretName, 'secretName', SECRET_NAME);
-  const token = requiredSecret(accessToken, 'accessToken');
-  const plaintext = requiredSecret(secretValue, 'secretValue');
-
-  await sodiumImpl.ready;
-
-  const baseUrl = `https://api.github.com/repos/${encodeURIComponent(normalizedOwner)}/${encodeURIComponent(normalizedRepository)}/actions/secrets`;
-  const publicKeyResponse = await fetchImpl(`${baseUrl}/public-key`, {
-    method: 'GET',
-    headers: headers(token)
-  });
-  await requireSuccess(publicKeyResponse, 'repository public-key request');
-  const publicKeyPayload = await publicKeyResponse.json();
-  const keyId = requiredSecret(publicKeyPayload?.key_id, 'GitHub key_id');
-  const publicKey = requiredSecret(publicKeyPayload?.key, 'GitHub public key');
-
-  const ciphertext = sodiumImpl.crypto_box_seal(
-    sodiumImpl.from_string(plaintext),
-    sodiumImpl.from_base64(publicKey, sodiumImpl.base64_variants.ORIGINAL)
-  );
-  const encryptedValue = sodiumImpl.to_base64(
-    ciphertext,
-    sodiumImpl.base64_variants.ORIGINAL
-  );
-
-  const uploadResponse = await fetchImpl(
-    `${baseUrl}/${encodeURIComponent(normalizedSecretName)}`,
-    {
-      method: 'PUT',
-      headers: headers(token),
-      body: JSON.stringify({ encrypted_value: encryptedValue, key_id: keyId })
-    }
-  );
-  await requireSuccess(uploadResponse, 'repository secret upload');
-}

package/src/github-repository-variable.js

@@ -1,56 +0,0 @@
-import { describeHttpFailure } from './http-failure.js';
-const GITHUB_API_VERSION = '2026-03-10';
-const OWNER_OR_REPOSITORY = /^[A-Za-z0-9_.-]+$/;
-const VARIABLE_NAME = /^[A-Z_][A-Z0-9_]*$/;
-
-function required(value, field, pattern) {
-  if (typeof value !== 'string' || !pattern.test(value)) {
-    throw new TypeError(`${field} is invalid`);
-  }
-  return value;
-}
-
-function requiredValue(value, field) {
-  if (typeof value !== 'string' || value.length === 0) {
-    throw new TypeError(`${field} must not be empty`);
-  }
-  return value;
-}
-
-function headers(accessToken) {
-  return {
-    accept: 'application/vnd.github+json',
-    authorization: `Bearer ${accessToken}`,
-    'content-type': 'application/json',
-    'x-github-api-version': GITHUB_API_VERSION
-  };
-}
-
-export async function installRepositoryVariable({
-  owner, repository, accessToken, variableName, variableValue, fetchImpl = fetch
-}) {
-  const normalizedOwner = required(owner, 'owner', OWNER_OR_REPOSITORY);
-  const normalizedRepository = required(repository, 'repository', OWNER_OR_REPOSITORY);
-  const normalizedName = required(variableName, 'variableName', VARIABLE_NAME);
-  const token = requiredValue(accessToken, 'accessToken');
-  const value = requiredValue(variableValue, 'variableValue');
-  const baseUrl = `https://api.github.com/repos/${encodeURIComponent(normalizedOwner)}/${encodeURIComponent(normalizedRepository)}/actions/variables`;
-  const requestHeaders = headers(token);
-  const update = await fetchImpl(`${baseUrl}/${encodeURIComponent(normalizedName)}`, {
-    method: 'PATCH',
-    headers: requestHeaders,
-    body: JSON.stringify({ name: normalizedName, value })
-  });
-  if (update.ok) return;
-  if (update.status !== 404) {
-    throw new Error(await describeHttpFailure(update, 'GitHub repository variable update'));
-  }
-  const create = await fetchImpl(baseUrl, {
-    method: 'POST',
-    headers: requestHeaders,
-    body: JSON.stringify({ name: normalizedName, value })
-  });
-  if (!create.ok) {
-    throw new Error(await describeHttpFailure(create, 'GitHub repository variable creation'));
-  }
-}