Heroku config vars

Move secrets to and from one Heroku app's config vars.

The connection

What	This provider
Vendor	Heroku
Key	`heroku-config-vars`
Availability	`available`. You can connect it today.
Credential penv holds	`heroku-token`
Values read back	yes
Activation	`restart-on-write`

Direction	What it does
`import`	Reads names and values out of the store into penv.
`export`	Writes names and values from penv into the store.

restart-on-write. Writing a value restarts the workload.

Direction	Policies you can pick
`import`	`skip_existing`, `new_version`, `fail`
`export`	`create_only`, `overwrite`, `overwrite_and_prune`

How syncs work says what each one does.

You paste a credential you already hold. penv seals it and never shows it again.

Field	Label	Kind	Required	What it is
`token`	Heroku API token	secret, masked here and sealed	yes	Needs global or write-protected scope. A write token can deploy the app but cannot touch its config vars.

Answered once per environment you map.

Field	Label	Kind	Required	Advanced	What it is
`app`	App	text	yes	no	One app per sync. Changing a config var restarts it.

penv probes for these when it verifies the connection.

Permission	Directions	Blocking	Without it
`apps:read`	every direction	yes	The token cannot reach your apps at all.
`read-protected`	`import`	yes	Import cannot read config vars, because a plain read token is refused for them.
`write-protected`	`export`	yes	Export cannot write anything.