laneyard 0.1.0 → 0.3.0

package/README.md

@@ -9,7 +9,7 @@ your signing keys, and nobody meters your minutes.
 It replaces neither fastlane nor your Fastfile — it drives them. Your lanes stay exactly where
 they are.
 
-![A build running in Laneyard: step timeline on the left, live output on the right, artifacts below](docs/screenshots/run.png)
+![A build running in Laneyard: step timeline on the left, live output on the right, artifacts below](https://raw.githubusercontent.com/martinfrouin/laneyard/main/docs/screenshots/run.png)
 
 ## Why
 
@@ -33,10 +33,11 @@ change here.
 | cost per build               | electricity | per minute   | electricity        |
 | setup                        | one command | a signup form| a weekend          |
 | works offline                | yes         | no           | yes                |
-| build queue across a team    | planned     | yes          | yes                |
+| build queue across a team    | yes, serial | yes          | yes                |
 | runs on pull requests        | planned     | yes          | yes                |
 
-If your team needs parallel builds across a fleet today, use something else and come back later.
+Laneyard's queue is serial: runs are drained one at a time across every project, in the order
+they were asked for. If your team needs parallel builds across a fleet today, use something else.
 Laneyard is for one machine you control.
 
 ## Requirements
@@ -57,14 +58,15 @@ Then, from a project you already build with fastlane:
 
 ```bash
 cd ~/code/your-app
-laneyard add     # adopt this project
+laneyard setup   # answer a few questions about this project
 laneyard         # start the server
 ```
 
-`laneyard add` inspects what is there — the `fastlane` directory even when nested in a monorepo, a
-`Gemfile`, an Xcode project or a Gradle build — writes the matching block into
-`~/.laneyard/config.yml`, and prints a generated server password once. Write it down; it is not
-shown again.
+`laneyard setup` inspects what is there — the `fastlane` directory even when nested in a monorepo, a
+`Gemfile`, an Xcode project or a Gradle build — and writes the matching block into
+`~/.laneyard/config.yml`. On a machine that has no account yet, it also creates the first admin:
+it asks what to call it and prints its generated password once. Write it down; it is not shown
+again, and nothing stores it.
 
 <details>
 <summary>Running from source instead</summary>
@@ -81,7 +83,7 @@ npm link         # puts `laneyard` on your PATH
 Open it from any machine on your network, sign in, and your lanes are listed — because Laneyard
 asked your project's own fastlane for them.
 
-![The project screen: lanes read from the Fastfile, with their descriptions, and the run history](docs/screenshots/project.png)
+![The project screen: lanes read from the Fastfile, with their descriptions, and the run history](https://raw.githubusercontent.com/martinfrouin/laneyard/main/docs/screenshots/project.png)
 
 ## Configuration
 
@@ -94,8 +96,10 @@ Laneyard means copying one file, and restoring it means copying it back.
 server:
   port: 7890
   bind: 0.0.0.0
-  password_hash: "scrypt$…"      # written by `laneyard add`
-  max_concurrent_runs: 1
+  users:                         # written by `laneyard setup`, see Accounts
+    - { name: martin, role: admin, password_hash: "scrypt$…" }
+    - { name: lea, role: builder, password_hash: "scrypt$…" }
+  max_concurrent_runs: 1         # only 1 is accepted, see below
   retention: { runs: 50, artifact_days: 30 }
 
 projects:
@@ -106,9 +110,61 @@ projects:
     git_auth: { kind: ssh_key, ref: ~/.ssh/id_ed25519 }
 ```
 
-### `laneyard.yml` — optional, committed in your repository
+`max_concurrent_runs` accepts `1` and nothing else. Runs are drained from a single queue, one at
+a time across every project — parallel runs would need a working directory per run, which does
+not exist yet. A larger number is refused when the file loads rather than silently ignored, so a
+server is never configured for builds that never happen.
 
-Build behaviour belongs next to the code, so it can be versioned with it:
+### Accounts
+
+Everyone who signs in has a name, a password and one of two roles. Two, because a third role is
+easy to add and impossible to remove.
+
+| | **admin** | **builder** |
+|---|---|---|
+| start a build, watch it, cancel it | ✓ | ✓ |
+| download artifacts, read logs and the Fastfile | ✓ | ✓ |
+| see the readiness checklist | ✓ | ✓ |
+| read and write secrets | ✓ | |
+| save, commit and push the Fastfile | ✓ | |
+| remove a project | ✓ | |
+| manage accounts | ✓ | |
+
+A builder is what you give someone who ships without being trusted with the signing chain: they
+can press the button and watch what happens, and they never see a credential.
+
+The interface shows a builder only what a builder can use — the secrets, fastfile and settings
+tabs are not drawn, and neither is the accounts screen. That is courtesy, not security: the
+server refuses those routes on its own, whatever the browser was shown, and the test suite
+proves it for every verb and every spelling of the address.
+
+Add and remove accounts from the accounts screen, or from the command line:
+
+```bash
+echo "$PASSWORD" | laneyard user add lea --role builder
+```
+
+The password is read from standard input, never taken as an argument — an argument lands in your
+shell history. Without `--role`, the account is a builder.
+
+Two things are refused, in the API and on the command line alike: removing the last admin, and
+demoting the last admin. A server nobody can administer cannot be repaired from the interface.
+
+Removing an account ends its sessions immediately — "remove the account" and "revoke access" are
+the same act. So does editing `config.yml` by hand: every request looks the account up again, so
+a demotion takes effect at once rather than at the next restart.
+
+**Upgrading from 0.2.** An existing `server.password_hash` keeps working, unedited. It is read as
+a single admin account called `admin` — sign in with that name and the password you already have.
+The first time you add someone, the file is rewritten into the `users` form above, comments and
+all. Do not write both forms: a file holding a `password_hash` *and* a `users` list is refused at
+load, because there is no obvious winner.
+
+### `laneyard.yml` — in your repository, and committed
+
+Build behaviour belongs next to the code, so it can be versioned with it — `laneyard setup`
+writes this file for you, and you should commit it. A colleague who clones the repository then
+builds it the same way, without configuring anything.
 
 ```yaml
 fastlane_dir: fastlane
@@ -117,8 +173,13 @@ timeout_minutes: 60
 artifact_globs:
   - "build/**/*.ipa"
   - "build/**/*.app.dSYM.zip"
+platforms: [ios]                 # or `[android]`, or both
 ```
 
+`platforms` decides which half of the readiness checklist applies: an Android project is never
+asked for an App Store Connect key. Left out, Laneyard looks at the repository — an Xcode project
+means iOS, a Gradle build means Android — and reports what it found rather than assuming.
+
 Field by field, the repository file wins over the server block, which wins over the defaults. Any
 field of `laneyard.yml` may also be written in the server block, so a repository you would rather
 not touch can be configured entirely from `config.yml`.
@@ -126,24 +187,160 @@ not touch can be configured entirely from `config.yml`.
 Both files are watched: edit them by hand and Laneyard picks the change up. An invalid file is
 reported and the last valid configuration stays live — a typo never takes the server down.
 
+### Secrets
+
+Credentials do not live in a file. They go into an encrypted vault, from the Secrets tab of a
+project or from the command line:
+
+```bash
+laneyard secret set MATCH_PASSWORD --project cartes-ios   # reads the value from standard input
+echo "$GITHUB_TOKEN" | laneyard secret set GITHUB_TOKEN    # global, and out of your shell history
+```
+
+The value is never an argument: a command line ends up in `~/.zsh_history` and in the output of
+`ps`. Typing the command alone leaves you at a blank line — type or paste the value, then
+`Ctrl-D`.
+
+**Two of them are files.** An App Store Connect key arrives as a `.p8` and a Play Store service
+account as a JSON file, and pasting either into a text field is the moment you are most likely to
+paste it somewhere else by accident. The Secrets tab takes the file directly — *app store connect
+key* and *play store service account*, beside the value field. Your browser reads it and sends its
+text to the same route a typed value goes through, under the name fastlane and the readiness
+checklist both look for: `APP_STORE_CONNECT_API_KEY_P8` and `SUPPLY_JSON_KEY_DATA`. Nothing is
+uploaded, nothing is written to disk on the way, and the page only ever shows the file's name.
+
+A secret becomes an environment variable for every run of the project it belongs to. Without
+`--project` it applies to every project; a project secret of the same name wins over a global
+one. Secrets are kept out of the logs unless you pass `--no-mask`, and a masked value must be at
+least four characters long — see below.
+
+### Readiness
+
+Every project has a Readiness tab: what stands between it and a build that runs while nobody
+watches. Only the checks that apply to the project are shown — an Android project is never asked
+for an App Store Connect key, because one irrelevant warning teaches you to ignore the screen.
+
+Always:
+
+- **the repository** answers `git ls-remote` without asking for credentials — a run that meets a
+  password prompt does not fail, it waits;
+- **dependencies** are installable: `bundle check` against your Gemfile, or the `fastlane` a run
+  would otherwise find on the PATH;
+- **no lane calls an action known to stop and ask** — `prompt`, `sigh`, `cert`, a writable
+  `match`, an upload waiting for its summary to be confirmed.
+
+On iOS:
+
+- **App Store Connect** has an API key in the vault rather than a `FASTLANE_SESSION`, which
+  expires and takes the next night's build with it;
+- **match** has its `MATCH_PASSWORD` stored and is called `readonly`, so it fetches certificates
+  instead of trying to create them.
+
+On Android:
+
+- **the keystore** is reachable without a prompt: a lane handing `gradle` a `storeFile` needs a
+  passphrase, and one that is neither in the call nor in the vault makes gradle stop and ask;
+- **the Play Store service account** is in the vault when a lane calls `upload_to_play_store`.
+
+Like the iOS ones, the Android checks read **literal arguments only**. `gradle(storePassword:
+ENV["PW"])` is reported as undetermined, never guessed at: a checklist that guesses gets believed.
+
+They run when you open the tab or press refresh, never on their own: they shell out to git and to
+bundler. The time of the last run is on screen, because a stale green tick is worse than a red
+cross.
+
+Nothing here blocks anything. A red check is never the reason a run cannot be started, and
+Laneyard never edits a Fastfile to make its own checklist go green — each line explains, you
+decide. Where the fix genuinely is one action, the line links to the Secrets tab instead of
+growing a second copy of its form.
+
+**What it cannot see.** The checklist reads *literal* arguments only. `match(readonly: true)` is
+green and `match(readonly: false)` is a warning, but `match(readonly: ENV["RO"])` has no value
+until the lane runs, so it is reported as undetermined — `○`, with the reason — rather than
+guessed either way. The same applies to anything a lane computes: a checklist that guesses gets
+believed, and then it is worse than no checklist. Android signing is not covered at all yet.
+
+### The Fastfile
+
+Every project has a Fastfile tab. **It is a text editor** — your file, in a box, with Ruby
+syntax highlighting and nothing between you and it. The structured view described in the design
+document, where lanes and actions are things you arrange rather than type, is still to come. This
+is the honest first half of it, and it is useful on its own: fixing a lane at 2am should not
+require an SSH session.
+
+**Every write is verified.** Saving sends the file to the server, which writes it byte-for-byte —
+no reformatting, no trailing-newline fixing, no reordering — then asks fastlane to parse it and
+list its lanes. If that fails, the previous content is put back on disk before the request
+answers, and the reason fastlane gave appears above the editor with your work still in the box.
+A broken Fastfile never reaches a workspace a run might build from.
+
+Saving is explicit, never automatic: verification is a Ruby subprocess, not a regular expression,
+and an editor that ran it on every keystroke would be both slow and dangerous. `⌘S` is another
+way to ask, not an autosave. Laneyard also refuses to write at all while a run of that project is
+in flight — that run is reading the very file the write would replace.
+
+Below the editor is what git makes of the workspace: the diff, a message field, `commit` and
+`push`. A commit stages exactly the files that changed and never `git add -A` — a build leaves
+artifacts and reports scattered around, and none of them belong in your history.
+
+### Removing a project
+
+Every project has a Settings tab, and the one thing on it is removal. It takes the project's block
+out of `config.yml` — through the YAML document, so your comments and your key order survive —
+and stops showing it. It is confirmed by typing the project's name: it is the one destructive
+action in Laneyard, and a dialogue you can click through is not a confirmation.
+
+What it does *not* do is most of the point, because "delete" elsewhere usually means the opposite:
+
+- **the runs stay.** Every build that project ever ran keeps its page, its log and its artifacts,
+  each still at its own address. Removing a project means stop showing it, not destroy its past;
+- **the clone and the artifacts stay on disk.** Their paths are printed when it is done, so you
+  can remove them yourself. Nothing is deleted from a web page on one click;
+- **the secrets stay in the vault**, encrypted and unreachable, and come back if you add the
+  project again under the same name;
+- **the repository is untouched.** Its `laneyard.yml`, its Fastfile and its history are the
+  repository's, not Laneyard's.
+
+Removal is refused while a run of that project is in flight — that run is using the workspace. A
+run still waiting in the queue will not start: it ends as failed, saying its project is gone.
+
 ## Security
 
 Read this before putting Laneyard on a network.
 
 - **It is built for a local network, not the internet.** It listens on `0.0.0.0` so you can reach
-  it from your laptop, behind one password. Do not expose it publicly. If you need remote access,
+  it from your laptop, behind a password. Do not expose it publicly. If you need remote access,
   put it behind a VPN or an SSH tunnel.
-- **The password** is stored as an scrypt hash and repeated failures are throttled. Sessions live
-  in memory and do not survive a restart.
-- **There is no secret vault yet.** Today, fastlane sees the environment the Laneyard process was
-  started with, so credentials are managed the way you already manage them — an `.env` read by
-  your Fastfile, the system keychain, or exported variables. Do not put secrets in `config.yml`.
-- **Logs are not redacted yet.** A run's full output is written to disk under `~/.laneyard/logs/`.
-  Assume anything fastlane prints is stored in the clear. Laneyard does remove its own git remote
-  URL from error messages, so a token embedded in a repository URL does not leak that way.
-
-The encrypted vault and log redaction are the next milestone, and the reason this section is
-this blunt.
+- **Passwords** are stored as scrypt hashes and repeated failures are throttled, per account, so
+  hammering one name cannot lock out the others. Sessions live in memory and do not survive a
+  restart.
+- **A role is enforced by the server, not by the interface.** One table names the routes that
+  require an admin, and one hook is the only thing that reads it — there is no permission check
+  hidden inside a handler. What a builder is not shown is also what a builder is refused.
+- **Secrets are encrypted at rest.** Values are stored with AES-256-GCM under a key kept in
+  `~/.laneyard/key` — outside the database, mode `600`, and Laneyard refuses to start if anyone
+  else can read it. Someone who walks off with `laneyard.db` gets ciphertext. Nothing else in the
+  process holds plaintext: the store, the API and the interface deal in names only, and no route
+  ever sends a value back — which is why the Secrets tab has no reveal button.
+- **Masked values are removed from output before it is written, not when it is displayed.** The
+  substitution happens once, at the point where a run's output fans out, so the log file on disk,
+  the live stream to your browser and the stored error summary all contain `••••••` and never the
+  value. It survives being split across two chunks of terminal output.
+- **Do not put secrets in `config.yml`.** It is a plain file with ordinary permissions. Use
+  `laneyard secret set` or the Secrets tab.
+
+What this does *not* cover, stated plainly:
+
+- **Git credentials are not in the vault.** `git_auth` points at an SSH key on disk by path;
+  token authentication is refused at load time rather than silently ignored, so a project cannot
+  be configured for something that never happens. Laneyard removes the configured repository URL
+  from its own git error messages — so a token embedded in an HTTPS URL does not leak that way —
+  but that is one string, not a vault.
+- **A value shorter than four characters is refused, not protected.** Removing a two-character
+  string from a log would shred the output while hiding nothing, so Laneyard says no rather than
+  pretending. Store it unmasked if it genuinely does not matter.
+- **Anything fastlane prints that is not a stored secret is stored in the clear**, under
+  `~/.laneyard/logs/`.
 
 ## Status
 
@@ -152,15 +349,24 @@ this blunt.
 - `✓` declare a project, clone it, list its lanes, run one, watch it live, download the artifact
 - `✓` configuration entirely in files you can version and back up
 - `✓` adopt an existing fastlane project with one command
-- `▸` encrypted secret vault and log redaction
-- `▸` build queue, cancellation, timeouts surfaced in the UI
-- `○` a checklist that gets a project running unattended
-- `○` Fastfile editor in the browser
+- `✓` encrypted secret vault and log redaction
+- `✓` build queue, cancellation, timeouts surfaced in the UI
+- `✓` a checklist that gets a project running unattended
+- `✓` edit the Fastfile in the browser, verified on every save
+- `✓` store a signing credential straight from its `.p8` or JSON file
+- `✓` remove a project from the interface, without touching its history
+- `✓` named accounts, with a builder role that never sees a credential
 - `○` git-triggered and scheduled builds
 
-Two limitations worth knowing today: listing lanes does not fetch the repository, so a lane you
-have just pushed appears after the next run; and a second run on a project is refused while the
-first is still going, since they would share one git workspace.
+Two things worth knowing today: listing lanes does not fetch the repository, so a lane you have
+just pushed appears after the next run; and runs execute one at a time across all projects, so a
+build triggered while another is going waits its turn rather than starting alongside it. A queued
+run survives a restart of the server — it is still queued when it comes back up, and starts on
+its own.
+
+## Changelog
+
+See [CHANGELOG.md](CHANGELOG.md).
 
 ## Contributing
 

package/dist/src/cli/detect.js

@@ -1,8 +1,9 @@
 import { execFile } from "node:child_process";
-import { access } from "node:fs/promises";
+import { access, realpath } from "node:fs/promises";
 import { basename, join, relative, sep } from "node:path";
 import { promisify } from "node:util";
 import { glob } from "tinyglobby";
+import { detectPlatforms } from "../heuristics/platforms.js";
 const exec = promisify(execFile);
 const exists = async (p) => {
     try {
@@ -30,14 +31,44 @@ function slugify(name) {
         .replace(/^-+|-+$/g, "");
     return s === "" ? "project" : s;
 }
+/** `git@host:owner/name.git` or `https://host/owner/name.git` → `name`. */
+function repositoryName(url) {
+    if (!url)
+        return null;
+    const last = url.replace(/\/+$/, "").split(/[/:]/).pop();
+    if (!last)
+        return null;
+    const name = last.replace(/\.git$/, "");
+    return name === "" ? null : name;
+}
+/** The globbing `heuristics/platforms.ts` asks for, bound to one directory. */
+const findIn = (dir) => (globs, { onlyDirectories }) => glob(globs, onlyDirectories ? { cwd: dir, onlyDirectories: true } : { cwd: dir, onlyFiles: true });
+/** Turns an absolute path into a repository-relative one, with forward slashes. */
+const toRepoPath = (root, absolute) => relative(root, absolute).split(sep).join("/");
 /**
  * Inspects an existing project and proposes a configuration.
  *
- * Decides nothing irreversible: everything it returns is a proposal the
- * user sees and can correct before it's written.
+ * **Every path it reports is relative to the repository root, not to the
+ * directory the command was run in.** That distinction is the whole difficulty:
+ * Laneyard clones the repository, so a Fastfile at `app/fastlane` is at
+ * `app/fastlane` in the workspace no matter which folder someone happened to
+ * be standing in when they ran `laneyard setup`. Measuring from the current
+ * directory produced a configuration that looked right and pointed nowhere.
+ *
+ * Decides nothing irreversible: everything it returns is a proposal the user
+ * sees and can correct before it's written.
  */
 export async function detectProject(dir) {
-    // The Fastfile can be at the root or under a subfolder, for monorepos.
+    // Without a repository there is nothing to clone; `runAddCommand` refuses
+    // shortly after, so falling back to `dir` here only keeps this function total.
+    // Both sides are resolved before being compared: on macOS the temporary
+    // directory is a symlink, and git always answers with the real path — so a
+    // raw comparison yields a nonsense `../../private/...` relative path.
+    const here = await realpath(dir).catch(() => dir);
+    const root = await realpath((await gitOr(["rev-parse", "--show-toplevel"], dir, null)) ?? dir).catch(() => dir);
+    const subPath = toRepoPath(root, here);
+    // Look from where the user is standing — that is what they meant by "this
+    // project" — but report what is found relative to the repository root.
     const fastfiles = await glob(["fastlane/Fastfile", "*/fastlane/Fastfile", "*/*/fastlane/Fastfile"], {
         cwd: dir,
         absolute: true,
@@ -45,26 +76,39 @@ export async function detectProject(dir) {
     });
     const fastfile = fastfiles.sort((a, b) => a.length - b.length)[0] ?? null;
     const fastlaneDir = fastfile
-        ? relative(dir, join(fastfile, "..")).split(sep).join("/")
+        ? toRepoPath(root, await realpath(join(fastfile, "..")).catch(() => join(fastfile, "..")))
         : null;
-    const isIos = (await glob(["*.xcodeproj", "*.xcworkspace", "*/*.xcodeproj"], { cwd: dir, onlyDirectories: true }))
-        .length > 0;
-    const isAndroid = (await glob(["build.gradle", "build.gradle.kts", "*/build.gradle", "*/build.gradle.kts"], {
-        cwd: dir,
-        onlyFiles: true,
-    })).length > 0;
+    const platforms = await detectPlatforms(findIn(dir));
+    const isIos = platforms.includes("ios");
+    const isAndroid = platforms.includes("android");
+    // Artifact patterns are anchored to the sub-project too. In a monorepo an
+    // unanchored `**/*.ipa` would collect a sibling app's build as if it were
+    // this one's — and nothing downstream would notice.
+    const prefix = subPath === "" ? "" : `${subPath}/`;
     const artifactGlobs = [];
     if (isIos)
-        artifactGlobs.push("**/*.ipa", "**/*.app.dSYM.zip");
+        artifactGlobs.push(`${prefix}**/*.ipa`, `${prefix}**/*.app.dSYM.zip`);
     if (isAndroid)
-        artifactGlobs.push("**/*.apk", "**/*.aab");
+        artifactGlobs.push(`${prefix}**/*.apk`, `${prefix}**/*.aab`);
+    const gitUrl = await gitOr(["remote", "get-url", "origin"], dir, null);
+    // The slug names the repository, and the sub-project when there is one: two
+    // apps in the same monorepo must not both want to be called `app`.
+    //
+    // The name comes from the remote rather than the local folder, because the
+    // folder is an accident of where someone cloned. `…/popotheque.git` checked
+    // out into `~/work/current` should still be called `popotheque`.
+    const repoName = repositoryName(gitUrl) ?? basename(root);
+    const slug = slugify(subPath === "" ? repoName : `${repoName}-${subPath}`);
     return {
-        slug: slugify(basename(dir)),
-        gitUrl: await gitOr(["remote", "get-url", "origin"], dir, null),
+        slug,
+        gitUrl,
         defaultBranch: (await gitOr(["rev-parse", "--abbrev-ref", "HEAD"], dir, "main")) ?? "main",
         fastlaneDir,
+        // A Gemfile beside the Fastfile is the one fastlane will use, not one at the
+        // repository root — `bundle exec` runs from the sub-project.
         runtime: (await exists(join(dir, "Gemfile"))) ? "bundle" : "system",
         artifactGlobs,
-        platform: isIos ? "ios" : isAndroid ? "android" : "unknown",
+        platforms,
+        subPath,
     };
 }

package/dist/src/cli/prompt.js

@@ -0,0 +1,36 @@
+import { createInterface } from "node:readline/promises";
+/** Reads from the real terminal. */
+export function terminalAsker() {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    return {
+        async ask(label, proposed, hint) {
+            if (hint)
+                process.stdout.write(`\n  ${hint}\n`);
+            // The proposal is shown in the prompt rather than typed for the user:
+            // pressing Return accepts it, which is what someone does nine times out
+            // of ten, and correcting it costs one line.
+            const answer = (await rl.question(`  ${label} [${proposed}]: `)).trim();
+            return answer === "" ? proposed : answer;
+        },
+        async confirm(question, defaultYes) {
+            const suffix = defaultYes ? "[Y/n]" : "[y/N]";
+            const answer = (await rl.question(`${question} ${suffix} `)).trim().toLowerCase();
+            if (answer === "")
+                return defaultYes;
+            return answer.startsWith("y");
+        },
+        close() {
+            rl.close();
+        },
+    };
+}
+/** Accepts every proposal without asking. Used by `--yes` and by the tests. */
+export const acceptingAsker = {
+    async ask(_label, proposed) {
+        return proposed;
+    },
+    async confirm(_question, defaultYes) {
+        return defaultYes;
+    },
+    close() { },
+};

package/dist/src/cli/secret.js

@@ -0,0 +1,133 @@
+import { join } from "node:path";
+import { ConfigStore } from "../config/store.js";
+import { openDatabase } from "../db/open.js";
+import { SecretStore } from "../db/secrets.js";
+import { MIN_LENGTH as MIN_REDACTABLE } from "../logs/redact.js";
+import { Vault } from "../secrets/vault.js";
+/** Same rule as the API: what cannot become an environment variable is refused here too. */
+const VALID_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
+export const SECRET_USAGE = `laneyard secret set <NAME> [--project <slug>] [--no-mask]
+
+The value is read from standard input, never from an argument:
+
+  laneyard secret set MATCH_PASSWORD --project app
+  echo "$TOKEN" | laneyard secret set GITHUB_TOKEN
+`;
+/**
+ * Reads standard input whole.
+ *
+ * A single trailing newline is dropped: `echo "$TOKEN" |` adds one, and a secret
+ * that silently gained a `\n` would fail authentication somewhere far away from
+ * here, with nothing on screen to explain why.
+ */
+async function readValue(stdin) {
+    const chunks = [];
+    for await (const chunk of stdin)
+        chunks.push(Buffer.from(chunk));
+    const text = Buffer.concat(chunks).toString("utf8");
+    return text.replace(/\r?\n$/, "");
+}
+function parse(args) {
+    let key = null;
+    let project = null;
+    let masked = true;
+    for (let i = 0; i < args.length; i += 1) {
+        const arg = args[i];
+        if (arg === "--project" || arg === "-p") {
+            const next = args[i + 1];
+            if (next === undefined || next.startsWith("-"))
+                return "--project needs a project slug.";
+            project = next;
+            i += 1;
+        }
+        else if (arg === "--no-mask") {
+            masked = false;
+        }
+        else if (arg.startsWith("-")) {
+            return `Unknown option: ${arg}`;
+        }
+        else if (key === null) {
+            key = arg;
+        }
+        else {
+            // A second bare argument is almost certainly the value typed on the command
+            // line — exactly what this command exists to prevent. Saying so is kinder
+            // than storing the name and ignoring the rest.
+            return "The value is read from standard input, not from the command line.";
+        }
+    }
+    if (key === null)
+        return "Which secret? Give it a name.";
+    return { key, project, masked };
+}
+/**
+ * Entry point for `laneyard secret set`.
+ *
+ * Nothing it prints ever contains the value — not on success, not in an error.
+ * A terminal keeps scrollback and a shell keeps history; the point of reading
+ * from stdin would be lost if the value came straight back out.
+ */
+export async function runSecretCommand(home, args, io) {
+    const [subcommand, ...rest] = args;
+    if (subcommand !== "set") {
+        io.err(subcommand === undefined ? `${SECRET_USAGE}` : `Unknown subcommand: ${subcommand}\n\n${SECRET_USAGE}`);
+        return 1;
+    }
+    const parsed = parse(rest);
+    if (typeof parsed === "string") {
+        io.err(`${parsed}\n\n${SECRET_USAGE}`);
+        return 1;
+    }
+    if (!VALID_KEY.test(parsed.key)) {
+        io.err(`"${parsed.key}" is not a valid environment variable name: letters, digits and underscore, ` +
+            "not starting with a digit.\n");
+        return 1;
+    }
+    // A slug typo would store a secret that no project ever sees, and the run
+    // would fail much later with fastlane complaining about a missing variable.
+    if (parsed.project !== null) {
+        const config = new ConfigStore(join(home, "config.yml"));
+        const loaded = await config.load();
+        if (!loaded.ok) {
+            io.err(`Unreadable configuration in ${join(home, "config.yml")}: ${loaded.error}\n`);
+            return 1;
+        }
+        if (!config.project(parsed.project)) {
+            const known = config.projects().map((p) => p.slug);
+            io.err(`Unknown project: "${parsed.project}".` +
+                (known.length > 0 ? ` Known projects: ${known.join(", ")}.` : " No project is declared yet.") +
+                "\n");
+            return 1;
+        }
+    }
+    if (io.interactive) {
+        io.err("The value is read from standard input, and standard input is a terminal.\n" +
+            "Pipe it in instead, so it stays out of your shell history:\n\n" +
+            `  echo "$TOKEN" | laneyard secret set ${parsed.key}\n`);
+        return 1;
+    }
+    const value = await readValue(io.stdin);
+    if (value === "") {
+        io.err("Nothing came in on standard input, so there is no value to store.\n");
+        return 1;
+    }
+    // Same refusal as the API: accepting the request and quietly not redacting
+    // would leave someone believing they are protected.
+    if (parsed.masked && value.length < MIN_REDACTABLE) {
+        io.err(`A value kept out of the logs must be at least ${MIN_REDACTABLE} characters. ` +
+            "Shorter than that, removing it would shred the log without hiding anything. " +
+            "Pass --no-mask if you accept it appearing in the output.\n");
+        return 1;
+    }
+    const db = openDatabase(join(home, "laneyard.db"));
+    try {
+        const vault = await Vault.open(home, new SecretStore(db));
+        await vault.set(parsed.project, parsed.key, value, parsed.masked);
+    }
+    finally {
+        db.close();
+    }
+    io.out(`✓ ${parsed.key}  ${parsed.project === null ? "global" : `project ${parsed.project}`}` +
+        `  ${parsed.masked ? "kept out of the logs" : "shown in the logs"}\n`);
+    return 0;
+}