laneyard 0.3.0 → 0.4.1

package/README.md

@@ -25,6 +25,11 @@ the Fastfile you already have and asks *your* fastlane what it can do — plugin
 hard-codes no knowledge of fastlane at all, so upgrading fastlane or adding a plugin needs no
 change here.
 
+The adaptation goes one way. A repository that builds today keeps building unedited: signing
+credentials reach your lanes under the variable names your Fastfile already reads, and where
+Laneyard needs to know something no file can tell it, it asks on a form rather than asking you to
+change the file.
+
 ## Where it fits
 
 |                              | Laneyard    | Hosted CI    | Self-hosted runner |
@@ -150,6 +155,13 @@ shell history. Without `--role`, the account is a builder.
 Two things are refused, in the API and on the command line alike: removing the last admin, and
 demoting the last admin. A server nobody can administer cannot be repaired from the interface.
 
+Anyone changes their own password from **your account**, which is said in those words in the header
+and again on your own row of the accounts screen — a builder included, since that page is about one
+person rather than about the server's list of people. It asks for the current password even though you are already signed in: a session
+is a cookie in a browser that may have been left open on a desk. Doing it ends every other session
+that account has, and leaves the page you did it on signed in. That is how the random password
+`laneyard setup` printed once stops being a string on a sticky note.
+
 Removing an account ends its sessions immediately — "remove the account" and "revoke access" are
 the same act. So does editing `config.yml` by hand: every request looks the account up again, so
 a demotion takes effect at once rather than at the next restart.
@@ -180,6 +192,13 @@ platforms: [ios]                 # or `[android]`, or both
 asked for an App Store Connect key. Left out, Laneyard looks at the repository — an Xcode project
 means iOS, a Gradle build means Android — and reports what it found rather than assuming.
 
+It looks **beside the Fastfile**, not at the repository root, because that is where an app keeps
+its platform folders: `ios/` and `fastlane/` are siblings, and both move together when the app is
+one directory of a monorepo. So `app/fastlane/Fastfile` alongside `app/ios/Runner.xcodeproj` is
+found, and a project configured with `ios/fastlane` reports iOS alone rather than being shown the
+Android section on the strength of a sibling folder its lanes never touch. When that guess is
+wrong, `platforms` is read first and settles it.
+
 Field by field, the repository file wins over the server block, which wins over the defaults. Any
 field of `laneyard.yml` may also be written in the server block, so a repository you would rather
 not touch can be configured entirely from `config.yml`.
@@ -189,8 +208,9 @@ reported and the last valid configuration stays live — a typo never takes the
 
 ### Secrets
 
-Credentials do not live in a file. They go into an encrypted vault, from the Secrets tab of a
-project or from the command line:
+The variables your lanes read do not live in a file. They go into an encrypted vault, from the
+Secrets tab of a project or from the command line — the files a project signs with go in the same
+vault, as blocks, and have a section of their own below:
 
 ```bash
 laneyard secret set MATCH_PASSWORD --project cartes-ios   # reads the value from standard input
@@ -201,25 +221,117 @@ The value is never an argument: a command line ends up in `~/.zsh_history` and i
 `ps`. Typing the command alone leaves you at a blank line — type or paste the value, then
 `Ctrl-D`.
 
-**Two of them are files.** An App Store Connect key arrives as a `.p8` and a Play Store service
-account as a JSON file, and pasting either into a text field is the moment you are most likely to
-paste it somewhere else by accident. The Secrets tab takes the file directly — *app store connect
-key* and *play store service account*, beside the value field. Your browser reads it and sends its
-text to the same route a typed value goes through, under the name fastlane and the readiness
-checklist both look for: `APP_STORE_CONNECT_API_KEY_P8` and `SUPPLY_JSON_KEY_DATA`. Nothing is
-uploaded, nothing is written to disk on the way, and the page only ever shows the file's name.
+**Reading one back.** The vault is write-only for anything you called a secret: the server never
+sends a masked value back, so the interface has nothing to uncover and no browser ever holds one.
+
+Not everything stored here is a secret, though — `APP_VERSION`, `SENTRY_ORG`, an issuer id are
+identifiers, and being unable to check what an import stored makes the import something you take on
+faith. So the line is the one you drew yourself: a value kept out of the logs is never returned; a
+value you stored without that is shown on request, one named key at a time. `mask` and `unmask`
+change which it is without touching the value — otherwise revealing something would mean first
+retyping the value you were trying to read.
+
+**Bring the ones you already have.** A project that builds today has its variables in
+`fastlane/.env` — gitignored, on one laptop, and therefore absent from the clone a build runs
+from. From that working copy:
+
+```bash
+laneyard secret import --project cartes-ios          # shows what it would store
+laneyard secret import --project cartes-ios --yes    # stores it
+```
+
+It runs from the CLI because that is where the `.env` is; the server only ever sees a clone. A
+variable naming a service account JSON has the **file's contents** stored, under `SUPPLY_JSON_KEY_DATA`
+— a name supply reads on its own — because a path does not travel to another machine. A variable
+naming a `.p8` is reported and left alone: no action in fastlane reads a `.p8` out of an environment
+variable, and that credential belongs in a signing block, described below. Everything stored is
+masked, and nothing is printed but names.
+
+Nothing in your lanes has to change afterwards. `key_filepath:` and `json_key:` keep working as
+written — a signing block puts a real file back on disk for the length of a run.
 
 A secret becomes an environment variable for every run of the project it belongs to. Without
 `--project` it applies to every project; a project secret of the same name wins over a global
 one. Secrets are kept out of the logs unless you pass `--no-mask`, and a masked value must be at
 least four characters long — see below.
 
+### Signing credentials
+
+A signing credential is not a string. An Android keystore is bytes that Gradle reads through a path,
+and a `.p8` is useless without the key id and the issuer id that go with it — so these are stored as
+blocks: one file, plus the handful of fields that make it usable, taken whole or refused. A keystore
+stored without its alias is not a partial success; it is a build that fails in a month.
+
+| block | the file | the fields beside it |
+| ------------------------------ | ---------------------- | ------------------------------------------- |
+| *app store connect key*        | `.p8`                  | key id, issuer id                           |
+| *android upload keystore*      | `.jks` or `.keystore`  | key alias, store password, key password     |
+| *play store service account*   | JSON                   | —                                           |
+
+They live in the **signing** part of a project's Secrets tab, beside the variables and the secrets.
+The file is encrypted at rest like everything else in the vault and never comes back out to a
+browser: a stored block shows its file name and nothing more, so replacing one means giving it again
+in full.
+
+A variable a block has made redundant is said to be so, beside the row and in one sentence:
+`SUPPLY_JSON_KEY_DATA` once a Play block applies — it still works, but the same credential is then
+stored twice — and `APP_STORE_CONNECT_API_KEY_P8`, which no action in fastlane has ever read.
+Neither is removed for you: the row is yours, and the button to drop it is on the same line.
+
+**A block becomes real files, for the length of a run.** Gradle's `storeFile` is a path, and
+`app_store_connect_api_key` wants a path, so a credential that exists only as ciphertext in a
+database cannot be used by anything. Each block that applies is written into
+`~/.laneyard/runs/<run id>/secrets/`, mode `600` in a `700` directory, and that directory is removed
+when the run ends — whether it passed, failed, was cancelled or timed out. Every applicable block is
+written, whether or not the lane looks like it needs one: a Fastfile can reach anything through `sh`
+or a plugin, and a guess of "not needed" that is wrong is a debug-signed artifact rather than a
+missing variable.
+
+**It reaches your lanes under the names your project already reads.** Each block's form arrives
+pre-filled with the names fastlane itself declares — `APP_STORE_CONNECT_API_KEY_KEY_FILEPATH`,
+`APP_STORE_CONNECT_API_KEY_KEY_ID`, `APP_STORE_CONNECT_API_KEY_ISSUER_ID` for the key, and
+`SUPPLY_JSON_KEY` for the service account — and every one of them is editable. A Fastfile written
+around `ENV.fetch("ASC_KEY_FILEPATH")` is not a Fastfile doing it wrong: you say so on that form,
+rather than being asked to rename anything in the repository. The name stored with the block is the
+only name exported, and no default is emitted alongside it as a courtesy — that courtesy is what
+would make a typo in the configured name look like it had worked.
+
+Nothing in fastlane reads a keystore by convention, so the keystore's names are Laneyard's own —
+`ANDROID_KEYSTORE_PATH`, `ANDROID_KEYSTORE_PASSWORD`, `ANDROID_KEY_ALIAS`, `ANDROID_KEY_PASSWORD` —
+and the same rule applies to them.
+
+**The keystore block can also supply `key.properties`.** The Flutter documentation's own build
+script signs with the release config when that file exists and with the debug config when it does
+not, and gitignores it — so on a build server it is always absent. Rather than telling you to
+rewrite your build script, Laneyard writes the file the script is already looking for, for the
+length of the run, out of the keystore block. Two things about that file cannot be read out of a
+build script and are asked for on the block instead: where it goes, when the script names it in a
+way that leaves the directory unresolved, and what the keys inside it are called, which start from
+the Flutter documentation's four. Asking at configuration time is allowed; requiring a change to
+your repository is not.
+
+**Only the projects that sign need any of this.** fastlane is not only for shipping to stores —
+lanes take screenshots, run tests, sync certificates — so the three blocks are an offer rather than
+a gate. A project that wants an artifact out of a Gradle build needs the keystore and nothing else,
+and three untouched circles are not three things it is failing.
+
+A block stored on a project belongs to that project. One stored globally applies to every project,
+and a project's own block wins over it. Both are admin-only, like the rest of the vault.
+
 ### Readiness
 
 Every project has a Readiness tab: what stands between it and a build that runs while nobody
 watches. Only the checks that apply to the project are shown — an Android project is never asked
 for an App Store Connect key, because one irrelevant warning teaches you to ignore the screen.
 
+**What a tick means.** The checks read your Fastfile, following a lane into the methods that
+Fastfile defines — factoring your lanes into `def deploy_ios` is good practice, not something that
+should make Laneyard blind. Two things stay out of reach and always will: `import`/`import_from_git`
+brings in lanes written elsewhere, and `fastlane/actions/` holds actions whose names mean nothing to
+a reader that has only seen the Fastfile. Where either applies, a check that found nothing says
+*could not tell* rather than ticking. A green tick here means "looked, and it is fine" — never
+"looked, and saw nothing".
+
 Always:
 
 - **the repository** answers `git ls-remote` without asking for credentials — a run that meets a
@@ -227,20 +339,61 @@ Always:
 - **dependencies** are installable: `bundle check` against your Gemfile, or the `fastlane` a run
   would otherwise find on the PATH;
 - **no lane calls an action known to stop and ask** — `prompt`, `sigh`, `cert`, a writable
-  `match`, an upload waiting for its summary to be confirmed.
+  `match`, an upload waiting for its summary to be confirmed;
+- **the variables the lanes read** are in the vault. Every `ENV.fetch("…")` a lane reaches is
+  collected and looked up. This is the check for the commonest way a project that works on your
+  laptop fails on a build server: the variables live in `fastlane/.env`, that file is gitignored,
+  and it never reaches the clone a build runs from — so the run stops at the first one with
+  nothing on screen to say why.
+
+  Two things a Fastfile cannot tell you, and two places to say them. A variable read by a tool the
+  lane shells out to — `sentry-cli` and its `SENTRY_AUTH_TOKEN` — is named nowhere in the lanes. A
+  committed `fastlane/.env.example` is read for exactly this, since that is what the file is for,
+  and `required_secrets` in `laneyard.yml` covers whatever it does not. A variable found only in
+  the server's own environment is reported rather than ticked over: it works, but it works because
+  of how this server was started.
+
+  A name a signing block exports counts as being in the vault, since that is where the block is:
+  a lane reading `SUPPLY_JSON_KEY` with a Play block stored is not asked for it again, on this
+  checklist or on the Secrets tab. The two read the same answer.
 
 On iOS:
 
-- **App Store Connect** has an API key in the vault rather than a `FASTLANE_SESSION`, which
-  expires and takes the next night's build with it;
+- **App Store Connect** has an API key. The vault is checked first and is the only thing that
+  earns a tick — a signing block, or the variables a project stored before blocks existed, since
+  fastlane reads those exactly as it did. A project that configured fastlane long before it met
+  Laneyard keeps its key elsewhere, so the lanes are read for `app_store_connect_api_key` and for a `key_filepath` or
+  `api_key_path` argument, and the repository for a `.p8`. Any of those is reported as *could not
+  tell*, not as a warning: a path in a Fastfile says a key was arranged, not that the file is on
+  this machine. An Appfile holding only an `apple_id` is a warning — that is the account
+  two-factor authentication will stop the run to ask about. One name is called out rather than
+  accepted: a value stored under `APP_STORE_CONNECT_API_KEY_P8` used to earn a tick here, and no
+  action in fastlane has ever read a variable of that name — the check now says so, because being
+  told to redo the work beats a screen that has quietly gone silent about it;
 - **match** has its `MATCH_PASSWORD` stored and is called `readonly`, so it fetches certificates
   instead of trying to create them.
 
 On Android:
 
 - **the keystore** is reachable without a prompt: a lane handing `gradle` a `storeFile` needs a
-  passphrase, and one that is neither in the call nor in the vault makes gradle stop and ask;
-- **the Play Store service account** is in the vault when a lane calls `upload_to_play_store`.
+  passphrase, and one that is neither in the call nor in the vault makes gradle stop and ask. A
+  keystore block settles this before the lanes are read at all — the file and both passphrases
+  reach the run together, so nothing can stop and ask, whichever lane runs;
+- **the release is signed with the release key.** The one check here whose failure is silent:
+  the Flutter documentation's own snippet signs with the release config when `key.properties`
+  exists and with the *debug* config when it does not — and gitignores `key.properties`, so it is
+  absent from every clone. The build then succeeds, produces an artifact signed with the debug key,
+  and the rejection arrives from the store minutes later saying nothing about signing. This reads
+  the Gradle file as text and says so before the build, not after — and then, for a project whose
+  keystore is stored here, writes the `key.properties` that build is already asking for, for the
+  length of the run. Your build script is not asked to change: the file arrives where it looks for
+  it, marked `# written by laneyard, do not commit`, and is removed when fastlane stops. A file of
+  your own without that marker is never written over and never deleted;
+- **the Play Store service account** is there when a lane calls `upload_to_play_store`. The vault
+  first — a block, or a `SUPPLY_JSON_KEY` variable stored before blocks existed — then the
+  `json_key` argument in the call, then the **Appfile**: `json_key_file` and `json_key_data`, which
+  is where a long-standing project almost always keeps it. Only the vault is a tick; the other two
+  are *could not tell*, for the same reason as above.
 
 Like the iOS ones, the Android checks read **literal arguments only**. `gradle(storePassword:
 ENV["PW"])` is reported as undetermined, never guessed at: a checklist that guesses gets believed.
@@ -258,7 +411,9 @@ growing a second copy of its form.
 green and `match(readonly: false)` is a warning, but `match(readonly: ENV["RO"])` has no value
 until the lane runs, so it is reported as undetermined — `○`, with the reason — rather than
 guessed either way. The same applies to anything a lane computes: a checklist that guesses gets
-believed, and then it is worse than no checklist. Android signing is not covered at all yet.
+believed, and then it is worse than no checklist. Android signing is read out of the Gradle build
+script rather than the Fastfile, since that is where it lives — and read as text, because running
+someone's build script to ask it a question is not something a checklist may do.
 
 ### The Fastfile
 
@@ -296,14 +451,52 @@ What it does *not* do is most of the point, because "delete" elsewhere usually m
   each still at its own address. Removing a project means stop showing it, not destroy its past;
 - **the clone and the artifacts stay on disk.** Their paths are printed when it is done, so you
   can remove them yourself. Nothing is deleted from a web page on one click;
-- **the secrets stay in the vault**, encrypted and unreachable, and come back if you add the
-  project again under the same name;
+- **the secrets and the signing blocks stay in the vault**, encrypted. The screen counts them
+  before you confirm and again once it is done, because they are the one thing on this list you
+  cannot go and look at — no route ever sends a credential back. Their scope is the slug, so a
+  project set up later under the same name finds them and would sign with a keystore nobody
+  uploaded;
 - **the repository is untouched.** Its `laneyard.yml`, its Fastfile and its history are the
   repository's, not Laneyard's.
 
 Removal is refused while a run of that project is in flight — that run is using the workspace. A
 run still waiting in the queue will not start: it ends as failed, saying its project is gone.
 
+Once it is done, the result screen offers the one thing removal deliberately did not do: removing
+what the vault still holds under that name. It is a second action, confirmed by typing the name
+again, and it is never part of removing the project — a `.p8` or a keystore cannot be read back
+out of Laneyard, so the copy it holds is the only one it ever had. Global secrets and global
+signing blocks are shared by every project and are left alone.
+
+### Uninstalling
+
+```bash
+laneyard uninstall --dry-run   # list what is there, and stop
+laneyard uninstall             # remove it, after a typed confirmation
+npm uninstall -g laneyard      # remove the package itself
+```
+
+`laneyard uninstall` removes the data folder: `config.yml`, the vault key, the database, the
+workspaces, the artifacts and the logs. It reads the whole inventory from disk first — the
+projects, the number of secrets and signing blocks, the real sizes and paths — and prints it
+before asking anything.
+
+The vault key is the one loss that cannot be undone. Every secret and every signing block is
+encrypted under `~/.laneyard/key`; once it is gone the database is ciphertext nobody can read, and
+restoring a backup of `laneyard.db` alone brings nothing back. The originals are yours and are
+untouched — the `.p8` in your downloads, the keystore in your safe — so what you are agreeing to
+is uploading them again. Global secrets and global signing blocks are shared by every project and
+go too; the inventory says so on its own line.
+
+It is confirmed by typing the folder's path, not `y`: this is the one command in Laneyard that
+destroys credentials, and `$LANEYARD_HOME` is exactly the case where a reflex is wrong. Anything
+in the folder that Laneyard did not put there is named, left alone, and the folder is kept for it.
+
+It does not remove the npm package — a command cannot sensibly delete the binary it is running
+from — and it prints the command that does. There is no npm lifecycle hook doing any of this on
+`npm uninstall`, on purpose: a package manager must not delete someone's signing keys on its own,
+and a lifecycle script cannot ask.
+
 ## Security
 
 Read this before putting Laneyard on a network.
@@ -312,8 +505,9 @@ Read this before putting Laneyard on a network.
   it from your laptop, behind a password. Do not expose it publicly. If you need remote access,
   put it behind a VPN or an SSH tunnel.
 - **Passwords** are stored as scrypt hashes and repeated failures are throttled, per account, so
-  hammering one name cannot lock out the others. Sessions live in memory and do not survive a
-  restart.
+  hammering one name cannot lock out the others. Sessions survive a restart, and what is stored is
+  a SHA-256 of the token rather than the token: a stolen `laneyard.db` is a list of digests, not a
+  ring of working keys.
 - **A role is enforced by the server, not by the interface.** One table names the routes that
   require an admin, and one hook is the only thing that reads it — there is no permission check
   hidden inside a handler. What a builder is not shown is also what a builder is refused.
@@ -322,6 +516,11 @@ Read this before putting Laneyard on a network.
   else can read it. Someone who walks off with `laneyard.db` gets ciphertext. Nothing else in the
   process holds plaintext: the store, the API and the interface deal in names only, and no route
   ever sends a value back — which is why the Secrets tab has no reveal button.
+- **A signing block is on disk only while a run needs it.** A keystore has no string form, so the
+  file is written into `~/.laneyard/runs/<run id>/secrets/`, mode `600` inside a `700` directory,
+  and that directory goes when the run ends. The block's secret fields — the two keystore
+  passphrases — are removed from a run's output the same way a masked secret is, because gradle is
+  perfectly willing to echo one back on failure.
 - **Masked values are removed from output before it is written, not when it is displayed.** The
   substitution happens once, at the point where a run's output fans out, so the log file on disk,
   the live stream to your browser and the stored error summary all contain `••••••` and never the
@@ -341,6 +540,12 @@ What this does *not* cover, stated plainly:
   pretending. Store it unmasked if it genuinely does not matter.
 - **Anything fastlane prints that is not a stored secret is stored in the clear**, under
   `~/.laneyard/logs/`.
+- **`key.properties` is written into the workspace, and it holds passwords.** It is the one
+  credential Laneyard puts in the clone rather than in the run's own directory, because Gradle
+  resolves that path relative to the build. It is mode `600`, carries a marker line as its first
+  line, is removed when the run ends, and is swept for again at the start of the next run in case a
+  server was killed mid-build. A file of yours without that marker is never written over and never
+  removed.
 
 ## Status
 
@@ -353,8 +558,10 @@ What this does *not* cover, stated plainly:
 - `✓` build queue, cancellation, timeouts surfaced in the UI
 - `✓` a checklist that gets a project running unattended
 - `✓` edit the Fastfile in the browser, verified on every save
-- `✓` store a signing credential straight from its `.p8` or JSON file
+- `✓` signing credentials stored whole — the file and the fields beside it — written to disk for
+  the length of a run and exported under the names your project already reads
 - `✓` remove a project from the interface, without touching its history
+- `✓` `laneyard uninstall`: the whole inventory first, then a typed confirmation, then the folder
 - `✓` named accounts, with a builder role that never sees a credential
 - `○` git-triggered and scheduled builds
 

package/dist/src/cli/detect.js

@@ -3,7 +3,7 @@ import { access, realpath } from "node:fs/promises";
 import { basename, join, relative, sep } from "node:path";
 import { promisify } from "node:util";
 import { glob } from "tinyglobby";
-import { detectPlatforms } from "../heuristics/platforms.js";
+import { detectPlatforms, searchDir } from "../heuristics/platforms.js";
 const exec = promisify(execFile);
 const exists = async (p) => {
     try {
@@ -59,7 +59,7 @@ const toRepoPath = (root, absolute) => relative(root, absolute).split(sep).join(
  * sees and can correct before it's written.
  */
 export async function detectProject(dir) {
-    // Without a repository there is nothing to clone; `runAddCommand` refuses
+    // Without a repository there is nothing to clone; `runSetupCommand` refuses
     // shortly after, so falling back to `dir` here only keeps this function total.
     // Both sides are resolved before being compared: on macOS the temporary
     // directory is a symlink, and git always answers with the real path — so a
@@ -78,7 +78,16 @@ export async function detectProject(dir) {
     const fastlaneDir = fastfile
         ? toRepoPath(root, await realpath(join(fastfile, "..")).catch(() => join(fastfile, "..")))
         : null;
-    const platforms = await detectPlatforms(findIn(dir));
+    // From beside the Fastfile rather than from where the user is standing: the
+    // markers are the app's siblings, and `*/*/fastlane/Fastfile` above already
+    // allows the app to be two directories down, out of reach of the two-level
+    // marker globs from here.
+    // `fastlaneDir` is relative to the repository root, while the listing happens
+    // where the user is standing — the same directory only when they are at the
+    // root. The absolute Fastfile path needs no such reconciling, so the app root
+    // is taken from it: the Fastfile's grandparent is the app.
+    const appRoot = fastfile ? toRepoPath(dir, join(fastfile, "..", "..")) : null;
+    const platforms = await detectPlatforms(findIn(searchDir(dir, appRoot)));
     const isIos = platforms.includes("ios");
     const isAndroid = platforms.includes("android");
     // Artifact patterns are anchored to the sub-project too. In a monorepo an

package/dist/src/cli/prompt.js

@@ -1,7 +1,32 @@
 import { createInterface } from "node:readline/promises";
+/**
+ * Thrown when the user walks away from a question — Ctrl-C or Ctrl-D. Not a
+ * failure: the caller turns it into one sentence and a 130 exit code.
+ */
+export class PromptAborted extends Error {
+    constructor() {
+        super("interrupted");
+        this.name = "PromptAborted";
+    }
+}
 /** Reads from the real terminal. */
 export function terminalAsker() {
     const rl = createInterface({ input: process.stdin, output: process.stdout });
+    // Left alone, Ctrl-C closes the interface while `rl.question` stays pending
+    // forever, and node reports that as "Detected unsettled top-level await" —
+    // an internal complaint about our code, printed at someone who just pressed
+    // Ctrl-C. Aborting the question makes it a rejection we can answer for.
+    const interrupted = new AbortController();
+    rl.on("SIGINT", () => rl.close());
+    rl.on("close", () => interrupted.abort());
+    async function question(prompt) {
+        try {
+            return await rl.question(prompt, { signal: interrupted.signal });
+        }
+        catch {
+            throw new PromptAborted();
+        }
+    }
     return {
         async ask(label, proposed, hint) {
             if (hint)
@@ -9,12 +34,12 @@ export function terminalAsker() {
             // The proposal is shown in the prompt rather than typed for the user:
             // pressing Return accepts it, which is what someone does nine times out
             // of ten, and correcting it costs one line.
-            const answer = (await rl.question(`  ${label} [${proposed}]: `)).trim();
+            const answer = (await question(`  ${label} [${proposed}]: `)).trim();
             return answer === "" ? proposed : answer;
         },
-        async confirm(question, defaultYes) {
+        async confirm(question_, defaultYes) {
             const suffix = defaultYes ? "[Y/n]" : "[y/N]";
-            const answer = (await rl.question(`${question} ${suffix} `)).trim().toLowerCase();
+            const answer = (await question(`${question_} ${suffix} `)).trim().toLowerCase();
             if (answer === "")
                 return defaultYes;
             return answer.startsWith("y");

package/dist/src/cli/secret-import.js

@@ -0,0 +1,162 @@
+import { access, readFile } from "node:fs/promises";
+import { isAbsolute, join, resolve } from "node:path";
+import { parseEnvExample } from "../heuristics/env-example.js";
+/**
+ * Bringing an existing `fastlane/.env` into the vault.
+ *
+ * Every project that already builds has its variables somewhere, and that
+ * somewhere is almost always `fastlane/.env` — gitignored, on one laptop, and
+ * therefore absent from the clone a build server works from. Typing eight
+ * values into a web form to reproduce a file that is already on disk is a poor
+ * way to start, and the sort of chore where one typo costs an evening.
+ *
+ * This runs from the CLI and not from the server on purpose: the `.env` exists
+ * where the working copy is, and the server only ever sees a clone.
+ *
+ * Values are never printed, never logged, and never passed as arguments. What
+ * the command shows is names.
+ */
+/**
+ * The variables whose value is a *path*, and the name their *contents* belong
+ * under.
+ *
+ * This is the translation that makes an import worth doing. `SUPPLY_JSON_KEY`
+ * points at a service account JSON on this laptop; copied verbatim into the
+ * vault it would point at nothing on the build machine, and the run would fail
+ * exactly as it does today. What has to travel is the file, so the file is
+ * read and stored under `SUPPLY_JSON_KEY_DATA` — a name supply reads on its
+ * own, verified against fastlane 2.237.
+ *
+ * There is no such entry for a `.p8`. `APP_STORE_CONNECT_API_KEY_P8` was one —
+ * an earlier version of this interface invented it, no action in fastlane has
+ * ever declared it, and the interface has since dropped it. See `P8_PATH_NAMES`
+ * for what a `.p8` path becomes instead.
+ */
+export const PATH_TO_CONTENTS = {
+    SUPPLY_JSON_KEY: "SUPPLY_JSON_KEY_DATA",
+    GOOGLE_APPLICATION_CREDENTIALS: "SUPPLY_JSON_KEY_DATA",
+};
+/**
+ * Variables that name a `.p8` the way projects and this interface's own
+ * earlier version did.
+ *
+ * None of them is a name fastlane reads: the App Store Connect action takes
+ * its key from `key_id`, `issuer_id` and a file, not from an environment
+ * variable an import could invent on its own. What this command can do
+ * honestly is find the file and say where it belongs — an App Store Connect
+ * key block, uploaded from the secrets tab with the two fields the file alone
+ * cannot supply.
+ */
+export const P8_PATH_NAMES = new Set([
+    "ASC_KEY_FILEPATH",
+    "APP_STORE_CONNECT_API_KEY_PATH",
+    "APP_STORE_CONNECT_API_KEY_FILEPATH",
+]);
+/**
+ * Reads a `.env` into a name → value map.
+ *
+ * Shares `parseEnvExample`'s idea of what a line is, and adds the values, which
+ * that one deliberately drops. Quotes are stripped because a `.env` written by
+ * hand often has them and fastlane's own dotenv strips them too — a value that
+ * silently kept its quotes is a credential that never works, with nothing on
+ * screen to say why.
+ */
+export function parseEnvFile(content) {
+    const out = new Map();
+    for (const name of parseEnvExample(content)) {
+        // Re-scan for this name's value; `parseEnvExample` already vouched for the
+        // name, so this only has to find the last assignment, the way dotenv does.
+        for (const raw of content.split("\n")) {
+            const line = raw.trim().replace(/^export\s+/, "");
+            const eq = line.indexOf("=");
+            if (eq <= 0 || line.slice(0, eq).trim() !== name)
+                continue;
+            let value = line.slice(eq + 1).trim();
+            const quoted = /^(["'])(.*)\1$/.exec(value);
+            if (quoted)
+                value = quoted[2];
+            out.set(name, value);
+        }
+    }
+    return out;
+}
+/**
+ * Decides what would be stored, without storing anything.
+ *
+ * Separate from the writing so the command can show its work first. An import
+ * that reads eight files and writes eight secrets before saying a word is one
+ * nobody can check.
+ */
+export async function planImport(env, cwd, existingKeys) {
+    const planned = [];
+    const already = new Set(existingKeys);
+    for (const [name, value] of env) {
+        if (value === "")
+            continue;
+        if (P8_PATH_NAMES.has(name)) {
+            const path = isAbsolute(value) ? value : resolve(cwd, value);
+            const found = await access(path)
+                .then(() => true)
+                .catch(() => false);
+            if (!found) {
+                // Same handling as any other missing file: reported, not skipped in
+                // silence, because it is the credential the project most needs.
+                planned.push({ key: name, kind: "unresolved-path", path, value });
+                continue;
+            }
+            // The file is real, but nothing is stored under `name` — there is
+            // nowhere fastlane would read it from. Left to the caller to say what
+            // to do instead, in the same voice as the rest of the plan.
+            planned.push({ key: name, kind: "suggest-block", path, value });
+            continue;
+        }
+        const contentsKey = PATH_TO_CONTENTS[name];
+        if (contentsKey) {
+            const path = isAbsolute(value) ? value : resolve(cwd, value);
+            const contents = await readFile(path, "utf8").catch(() => null);
+            if (contents === null) {
+                // Named a file that is not there. Reported rather than skipped: it is
+                // the credential the project most needs, and silence would read as
+                // success.
+                planned.push({ key: name, kind: "unresolved-path", path, value });
+                continue;
+            }
+            planned.push({
+                key: contentsKey,
+                ...(contentsKey === name ? {} : { from: name }),
+                kind: "file-contents",
+                path,
+                value: contents,
+            });
+            continue;
+        }
+        planned.push({ key: name, kind: "value", value });
+    }
+    return {
+        planned,
+        replacing: planned
+            .filter((p) => p.kind !== "unresolved-path" && p.kind !== "suggest-block" && already.has(p.key))
+            .map((p) => p.key),
+    };
+}
+/**
+ * Writes the plan into the vault.
+ *
+ * Everything is masked. A value that came out of a `.env` is a credential by
+ * assumption — that is what the file is for — and the one that turns out not to
+ * be secret costs a redacted line in a log, while the reverse costs a leak.
+ */
+export async function applyImport(vault, slug, plan) {
+    let stored = 0;
+    for (const item of plan.planned) {
+        if (item.kind === "unresolved-path" || item.kind === "suggest-block")
+            continue;
+        await vault.set(slug, item.key, item.value, true);
+        stored += 1;
+    }
+    return stored;
+}
+/** Where a project's `.env` files live, in the order dotenv itself reads them. */
+export function envFilesIn(fastlaneDir) {
+    return [join(fastlaneDir, ".env.default"), join(fastlaneDir, ".env")];
+}