laneyard 0.1.0 → 0.2.0

package/README.md

@@ -9,7 +9,7 @@ your signing keys, and nobody meters your minutes.
 It replaces neither fastlane nor your Fastfile — it drives them. Your lanes stay exactly where
 they are.
 
-![A build running in Laneyard: step timeline on the left, live output on the right, artifacts below](docs/screenshots/run.png)
+![A build running in Laneyard: step timeline on the left, live output on the right, artifacts below](https://raw.githubusercontent.com/martinfrouin/laneyard/main/docs/screenshots/run.png)
 
 ## Why
 
@@ -33,10 +33,11 @@ change here.
 | cost per build               | electricity | per minute   | electricity        |
 | setup                        | one command | a signup form| a weekend          |
 | works offline                | yes         | no           | yes                |
-| build queue across a team    | planned     | yes          | yes                |
+| build queue across a team    | yes, serial | yes          | yes                |
 | runs on pull requests        | planned     | yes          | yes                |
 
-If your team needs parallel builds across a fleet today, use something else and come back later.
+Laneyard's queue is serial: runs are drained one at a time across every project, in the order
+they were asked for. If your team needs parallel builds across a fleet today, use something else.
 Laneyard is for one machine you control.
 
 ## Requirements
@@ -81,7 +82,7 @@ npm link         # puts `laneyard` on your PATH
 Open it from any machine on your network, sign in, and your lanes are listed — because Laneyard
 asked your project's own fastlane for them.
 
-![The project screen: lanes read from the Fastfile, with their descriptions, and the run history](docs/screenshots/project.png)
+![The project screen: lanes read from the Fastfile, with their descriptions, and the run history](https://raw.githubusercontent.com/martinfrouin/laneyard/main/docs/screenshots/project.png)
 
 ## Configuration
 
@@ -95,7 +96,7 @@ server:
   port: 7890
   bind: 0.0.0.0
   password_hash: "scrypt$…"      # written by `laneyard add`
-  max_concurrent_runs: 1
+  max_concurrent_runs: 1         # only 1 is accepted, see below
   retention: { runs: 50, artifact_days: 30 }
 
 projects:
@@ -106,6 +107,11 @@ projects:
     git_auth: { kind: ssh_key, ref: ~/.ssh/id_ed25519 }
 ```
 
+`max_concurrent_runs` accepts `1` and nothing else. Runs are drained from a single queue, one at
+a time across every project — parallel runs would need a working directory per run, which does
+not exist yet. A larger number is refused when the file loads rather than silently ignored, so a
+server is never configured for builds that never happen.
+
 ### `laneyard.yml` — optional, committed in your repository
 
 Build behaviour belongs next to the code, so it can be versioned with it:
@@ -126,6 +132,78 @@ not touch can be configured entirely from `config.yml`.
 Both files are watched: edit them by hand and Laneyard picks the change up. An invalid file is
 reported and the last valid configuration stays live — a typo never takes the server down.
 
+### Secrets
+
+Credentials do not live in a file. They go into an encrypted vault, from the Secrets tab of a
+project or from the command line:
+
+```bash
+laneyard secret set MATCH_PASSWORD --project cartes-ios   # reads the value from standard input
+echo "$GITHUB_TOKEN" | laneyard secret set GITHUB_TOKEN    # global, and out of your shell history
+```
+
+The value is never an argument: a command line ends up in `~/.zsh_history` and in the output of
+`ps`. Typing the command alone leaves you at a blank line — type or paste the value, then
+`Ctrl-D`.
+
+A secret becomes an environment variable for every run of the project it belongs to. Without
+`--project` it applies to every project; a project secret of the same name wins over a global
+one. Secrets are kept out of the logs unless you pass `--no-mask`, and a masked value must be at
+least four characters long — see below.
+
+### Readiness
+
+Every project has a Readiness tab: five checks on what stands between it and a build that runs
+while nobody watches.
+
+- **the repository** answers `git ls-remote` without asking for credentials — a run that meets a
+  password prompt does not fail, it waits;
+- **dependencies** are installable: `bundle check` against your Gemfile, or the `fastlane` a run
+  would otherwise find on the PATH;
+- **App Store Connect** has an API key in the vault rather than a `FASTLANE_SESSION`, which
+  expires and takes the next night's build with it;
+- **match** has its `MATCH_PASSWORD` stored and is called `readonly`, so it fetches certificates
+  instead of trying to create them;
+- **no lane calls an action known to stop and ask** — `prompt`, `sigh`, a writable `match`.
+
+They run when you open the tab or press refresh, never on their own: they shell out to git and to
+bundler. The time of the last run is on screen, because a stale green tick is worse than a red
+cross.
+
+Nothing here blocks anything. A red check is never the reason a run cannot be started, and
+Laneyard never edits a Fastfile to make its own checklist go green — each line explains, you
+decide. Where the fix genuinely is one action, the line links to the Secrets tab instead of
+growing a second copy of its form.
+
+**What it cannot see.** The checklist reads *literal* arguments only. `match(readonly: true)` is
+green and `match(readonly: false)` is a warning, but `match(readonly: ENV["RO"])` has no value
+until the lane runs, so it is reported as undetermined — `○`, with the reason — rather than
+guessed either way. The same applies to anything a lane computes: a checklist that guesses gets
+believed, and then it is worse than no checklist. Android signing is not covered at all yet.
+
+### The Fastfile
+
+Every project has a Fastfile tab. **It is a text editor** — your file, in a box, with Ruby
+syntax highlighting and nothing between you and it. The structured view described in the design
+document, where lanes and actions are things you arrange rather than type, is still to come. This
+is the honest first half of it, and it is useful on its own: fixing a lane at 2am should not
+require an SSH session.
+
+**Every write is verified.** Saving sends the file to the server, which writes it byte-for-byte —
+no reformatting, no trailing-newline fixing, no reordering — then asks fastlane to parse it and
+list its lanes. If that fails, the previous content is put back on disk before the request
+answers, and the reason fastlane gave appears above the editor with your work still in the box.
+A broken Fastfile never reaches a workspace a run might build from.
+
+Saving is explicit, never automatic: verification is a Ruby subprocess, not a regular expression,
+and an editor that ran it on every keystroke would be both slow and dangerous. `⌘S` is another
+way to ask, not an autosave. Laneyard also refuses to write at all while a run of that project is
+in flight — that run is reading the very file the write would replace.
+
+Below the editor is what git makes of the workspace: the diff, a message field, `commit` and
+`push`. A commit stages exactly the files that changed and never `git add -A` — a build leaves
+artifacts and reports scattered around, and none of them belong in your history.
+
 ## Security
 
 Read this before putting Laneyard on a network.
@@ -135,15 +213,30 @@ Read this before putting Laneyard on a network.
   put it behind a VPN or an SSH tunnel.
 - **The password** is stored as an scrypt hash and repeated failures are throttled. Sessions live
   in memory and do not survive a restart.
-- **There is no secret vault yet.** Today, fastlane sees the environment the Laneyard process was
-  started with, so credentials are managed the way you already manage them — an `.env` read by
-  your Fastfile, the system keychain, or exported variables. Do not put secrets in `config.yml`.
-- **Logs are not redacted yet.** A run's full output is written to disk under `~/.laneyard/logs/`.
-  Assume anything fastlane prints is stored in the clear. Laneyard does remove its own git remote
-  URL from error messages, so a token embedded in a repository URL does not leak that way.
-
-The encrypted vault and log redaction are the next milestone, and the reason this section is
-this blunt.
+- **Secrets are encrypted at rest.** Values are stored with AES-256-GCM under a key kept in
+  `~/.laneyard/key` — outside the database, mode `600`, and Laneyard refuses to start if anyone
+  else can read it. Someone who walks off with `laneyard.db` gets ciphertext. Nothing else in the
+  process holds plaintext: the store, the API and the interface deal in names only, and no route
+  ever sends a value back — which is why the Secrets tab has no reveal button.
+- **Masked values are removed from output before it is written, not when it is displayed.** The
+  substitution happens once, at the point where a run's output fans out, so the log file on disk,
+  the live stream to your browser and the stored error summary all contain `••••••` and never the
+  value. It survives being split across two chunks of terminal output.
+- **Do not put secrets in `config.yml`.** It is a plain file with ordinary permissions. Use
+  `laneyard secret set` or the Secrets tab.
+
+What this does *not* cover, stated plainly:
+
+- **Git credentials are not in the vault.** `git_auth` points at an SSH key on disk by path;
+  token authentication is refused at load time rather than silently ignored, so a project cannot
+  be configured for something that never happens. Laneyard removes the configured repository URL
+  from its own git error messages — so a token embedded in an HTTPS URL does not leak that way —
+  but that is one string, not a vault.
+- **A value shorter than four characters is refused, not protected.** Removing a two-character
+  string from a log would shred the output while hiding nothing, so Laneyard says no rather than
+  pretending. Store it unmasked if it genuinely does not matter.
+- **Anything fastlane prints that is not a stored secret is stored in the clear**, under
+  `~/.laneyard/logs/`.
 
 ## Status
 
@@ -152,15 +245,21 @@ this blunt.
 - `✓` declare a project, clone it, list its lanes, run one, watch it live, download the artifact
 - `✓` configuration entirely in files you can version and back up
 - `✓` adopt an existing fastlane project with one command
-- `▸` encrypted secret vault and log redaction
-- `▸` build queue, cancellation, timeouts surfaced in the UI
-- `○` a checklist that gets a project running unattended
-- `○` Fastfile editor in the browser
+- `✓` encrypted secret vault and log redaction
+- `✓` build queue, cancellation, timeouts surfaced in the UI
+- `✓` a checklist that gets a project running unattended
+- `✓` edit the Fastfile in the browser, verified on every save
 - `○` git-triggered and scheduled builds
 
-Two limitations worth knowing today: listing lanes does not fetch the repository, so a lane you
-have just pushed appears after the next run; and a second run on a project is refused while the
-first is still going, since they would share one git workspace.
+Two things worth knowing today: listing lanes does not fetch the repository, so a lane you have
+just pushed appears after the next run; and runs execute one at a time across all projects, so a
+build triggered while another is going waits its turn rather than starting alongside it. A queued
+run survives a restart of the server — it is still queued when it comes back up, and starts on
+its own.
+
+## Changelog
+
+See [CHANGELOG.md](CHANGELOG.md).
 
 ## Contributing
 

package/dist/src/cli/secret.js

@@ -0,0 +1,133 @@
+import { join } from "node:path";
+import { ConfigStore } from "../config/store.js";
+import { openDatabase } from "../db/open.js";
+import { SecretStore } from "../db/secrets.js";
+import { MIN_LENGTH as MIN_REDACTABLE } from "../logs/redact.js";
+import { Vault } from "../secrets/vault.js";
+/** Same rule as the API: what cannot become an environment variable is refused here too. */
+const VALID_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
+export const SECRET_USAGE = `laneyard secret set <NAME> [--project <slug>] [--no-mask]
+
+The value is read from standard input, never from an argument:
+
+  laneyard secret set MATCH_PASSWORD --project app
+  echo "$TOKEN" | laneyard secret set GITHUB_TOKEN
+`;
+/**
+ * Reads standard input whole.
+ *
+ * A single trailing newline is dropped: `echo "$TOKEN" |` adds one, and a secret
+ * that silently gained a `\n` would fail authentication somewhere far away from
+ * here, with nothing on screen to explain why.
+ */
+async function readValue(stdin) {
+    const chunks = [];
+    for await (const chunk of stdin)
+        chunks.push(Buffer.from(chunk));
+    const text = Buffer.concat(chunks).toString("utf8");
+    return text.replace(/\r?\n$/, "");
+}
+function parse(args) {
+    let key = null;
+    let project = null;
+    let masked = true;
+    for (let i = 0; i < args.length; i += 1) {
+        const arg = args[i];
+        if (arg === "--project" || arg === "-p") {
+            const next = args[i + 1];
+            if (next === undefined || next.startsWith("-"))
+                return "--project needs a project slug.";
+            project = next;
+            i += 1;
+        }
+        else if (arg === "--no-mask") {
+            masked = false;
+        }
+        else if (arg.startsWith("-")) {
+            return `Unknown option: ${arg}`;
+        }
+        else if (key === null) {
+            key = arg;
+        }
+        else {
+            // A second bare argument is almost certainly the value typed on the command
+            // line — exactly what this command exists to prevent. Saying so is kinder
+            // than storing the name and ignoring the rest.
+            return "The value is read from standard input, not from the command line.";
+        }
+    }
+    if (key === null)
+        return "Which secret? Give it a name.";
+    return { key, project, masked };
+}
+/**
+ * Entry point for `laneyard secret set`.
+ *
+ * Nothing it prints ever contains the value — not on success, not in an error.
+ * A terminal keeps scrollback and a shell keeps history; the point of reading
+ * from stdin would be lost if the value came straight back out.
+ */
+export async function runSecretCommand(home, args, io) {
+    const [subcommand, ...rest] = args;
+    if (subcommand !== "set") {
+        io.err(subcommand === undefined ? `${SECRET_USAGE}` : `Unknown subcommand: ${subcommand}\n\n${SECRET_USAGE}`);
+        return 1;
+    }
+    const parsed = parse(rest);
+    if (typeof parsed === "string") {
+        io.err(`${parsed}\n\n${SECRET_USAGE}`);
+        return 1;
+    }
+    if (!VALID_KEY.test(parsed.key)) {
+        io.err(`"${parsed.key}" is not a valid environment variable name: letters, digits and underscore, ` +
+            "not starting with a digit.\n");
+        return 1;
+    }
+    // A slug typo would store a secret that no project ever sees, and the run
+    // would fail much later with fastlane complaining about a missing variable.
+    if (parsed.project !== null) {
+        const config = new ConfigStore(join(home, "config.yml"));
+        const loaded = await config.load();
+        if (!loaded.ok) {
+            io.err(`Unreadable configuration in ${join(home, "config.yml")}: ${loaded.error}\n`);
+            return 1;
+        }
+        if (!config.project(parsed.project)) {
+            const known = config.projects().map((p) => p.slug);
+            io.err(`Unknown project: "${parsed.project}".` +
+                (known.length > 0 ? ` Known projects: ${known.join(", ")}.` : " No project is declared yet.") +
+                "\n");
+            return 1;
+        }
+    }
+    if (io.interactive) {
+        io.err("The value is read from standard input, and standard input is a terminal.\n" +
+            "Pipe it in instead, so it stays out of your shell history:\n\n" +
+            `  echo "$TOKEN" | laneyard secret set ${parsed.key}\n`);
+        return 1;
+    }
+    const value = await readValue(io.stdin);
+    if (value === "") {
+        io.err("Nothing came in on standard input, so there is no value to store.\n");
+        return 1;
+    }
+    // Same refusal as the API: accepting the request and quietly not redacting
+    // would leave someone believing they are protected.
+    if (parsed.masked && value.length < MIN_REDACTABLE) {
+        io.err(`A value kept out of the logs must be at least ${MIN_REDACTABLE} characters. ` +
+            "Shorter than that, removing it would shred the log without hiding anything. " +
+            "Pass --no-mask if you accept it appearing in the output.\n");
+        return 1;
+    }
+    const db = openDatabase(join(home, "laneyard.db"));
+    try {
+        const vault = await Vault.open(home, new SecretStore(db));
+        await vault.set(parsed.project, parsed.key, value, parsed.masked);
+    }
+    finally {
+        db.close();
+    }
+    io.out(`✓ ${parsed.key}  ${parsed.project === null ? "global" : `project ${parsed.project}`}` +
+        `  ${parsed.masked ? "kept out of the logs" : "shown in the logs"}\n`);
+    return 0;
+}

package/dist/src/config/schema.js

@@ -27,8 +27,11 @@ export const projectEntrySchema = projectSettingsInputSchema.extend({
     default_branch: z.string().default("main"),
     git_auth: z
         .object({
-        kind: z.enum(["none", "ssh_key", "token"]),
-        /** File path if kind is ssh_key, secret name if kind is token. */
+        // `token` is not accepted yet. The workspace only knows how to use an SSH
+        // key, so accepting it would leave a project configured for something that
+        // silently never happens — worse than a clear refusal at load time.
+        kind: z.enum(["none", "ssh_key"]),
+        /** Path to the SSH key file. */
         ref: z.string().optional(),
     })
         .default({ kind: "none" }),
@@ -41,7 +44,22 @@ export const serverConfigSchema = z.object({
         port: z.number().int().positive().default(7890),
         bind: z.string().default("0.0.0.0"),
         password_hash: z.string().min(1),
-        max_concurrent_runs: z.number().int().positive().default(1),
+        // Only 1 is accepted. Runs share one working directory per project, so a
+        // higher number would promise parallel builds that never happen — the
+        // queue drains one run at a time, whatever this says. Refusing at load
+        // time is the honest answer, as with `git_auth: token`.
+        max_concurrent_runs: z
+            .number()
+            .int()
+            .positive()
+            // Refined on the field itself, so zod reports `server.max_concurrent_runs`
+            // on its own: `load.ts` prefixes the message with that path, and an error
+            // saying `(root)` would leave the reader hunting for the field.
+            .refine((n) => n === 1, {
+            message: "only 1 is supported: runs are executed one at a time, and accepting more would " +
+                "promise parallel builds that never happen",
+        })
+            .default(1),
         retention: z
             .object({
             runs: z.number().int().positive().default(50),

package/dist/src/db/cache.js

@@ -3,20 +3,20 @@ export class CacheStore {
     constructor(db) {
         this.db = db;
     }
-    get(slug, hash) {
+    get(slug, kind, hash) {
         const row = this.db
-            .prepare("SELECT payload FROM introspection_cache WHERE project_slug = ? AND config_hash = ?")
-            .get(slug, hash);
+            .prepare("SELECT payload FROM introspection_cache WHERE project_slug = ? AND kind = ? AND config_hash = ?")
+            .get(slug, kind, hash);
         return row ? JSON.parse(row.payload) : null;
     }
-    put(slug, hash, payload) {
+    put(slug, kind, hash, payload) {
         this.db
-            .prepare(`INSERT INTO introspection_cache (project_slug, config_hash, payload, fetched_at)
-         VALUES (?, ?, ?, ?)
-         ON CONFLICT (project_slug) DO UPDATE
+            .prepare(`INSERT INTO introspection_cache (project_slug, kind, config_hash, payload, fetched_at)
+         VALUES (?, ?, ?, ?, ?)
+         ON CONFLICT (project_slug, kind) DO UPDATE
            SET config_hash = excluded.config_hash,
                payload = excluded.payload,
                fetched_at = excluded.fetched_at`)
-            .run(slug, hash, JSON.stringify(payload), new Date().toISOString());
+            .run(slug, kind, hash, JSON.stringify(payload), new Date().toISOString());
     }
 }

package/dist/src/db/open.js

@@ -6,7 +6,22 @@ export function openDatabase(path) {
     const db = new Database(path);
     db.pragma("journal_mode = WAL");
     db.pragma("foreign_keys = ON");
+    migrateIntrospectionCache(db);
     const here = dirname(fileURLToPath(import.meta.url));
     db.exec(readFileSync(join(here, "schema.sql"), "utf8"));
     return db;
 }
+/**
+ * Rebuilds the introspection cache when it predates the `kind` column.
+ *
+ * `CREATE TABLE IF NOT EXISTS` leaves an existing table alone, so a database
+ * written by 0.1.0 would keep the old single-key shape and collide. Dropping is
+ * the right answer here and only here: this table is a cache, and losing it
+ * costs one slow read.
+ */
+function migrateIntrospectionCache(db) {
+    const columns = db.prepare("PRAGMA table_info(introspection_cache)").all();
+    if (columns.length > 0 && !columns.some((c) => c.name === "kind")) {
+        db.exec("DROP TABLE introspection_cache");
+    }
+}

package/dist/src/db/runs.js

@@ -1,5 +1,5 @@
-/** A run is active until it reaches a terminal state. */
-const ACTIVE = ["queued", "preparing", "running"];
+/** Statuses that mean a run has begun and cannot survive the process that started it. */
+const IN_FLIGHT = ["preparing", "running"];
 const toRun = (r) => ({
     id: r.id,
     projectSlug: r.project_slug,
@@ -52,12 +52,57 @@ export class RunStore {
             .prepare("UPDATE run SET status = ?, finished_at = ?, exit_code = ?, error_summary = ? WHERE id = ?")
             .run(r.status, now(), r.exitCode, r.errorSummary, id);
     }
-    /** At startup: no run can still be in progress, the process that carried it is dead. */
-    interruptActive() {
-        const placeholders = ACTIVE.map(() => "?").join(", ");
+    /** Runs waiting to start, oldest first. Insertion order is the queue. */
+    queued() {
+        const rows = this.db
+            .prepare("SELECT * FROM run WHERE status = 'queued' ORDER BY id")
+            .all();
+        return rows.map(toRun);
+    }
+    /** 1 for the next to start, null if the run is not waiting. */
+    queuePosition(id) {
+        const row = this.db
+            .prepare(`SELECT COUNT(*) AS ahead FROM run
+         WHERE status = 'queued' AND id <= ?
+           AND EXISTS (SELECT 1 FROM run r2 WHERE r2.id = ? AND r2.status = 'queued')`)
+            .get(id, id);
+        return row.ahead === 0 ? null : row.ahead;
+    }
+    /** How many runs have begun. The worker consults it before taking the next. */
+    activeCount() {
+        const placeholders = IN_FLIGHT.map(() => "?").join(", ");
+        const row = this.db
+            .prepare(`SELECT COUNT(*) AS n FROM run WHERE status IN (${placeholders})`)
+            .get(...IN_FLIGHT);
+        return row.n;
+    }
+    /**
+     * True if this project has a run that has begun and not yet finished.
+     *
+     * Used to refuse a Fastfile write while it's true: that run is reading the
+     * very file the write would replace, the same reason `prepare` refuses to
+     * touch a dirty workspace.
+     */
+    hasActiveRun(slug) {
+        const placeholders = IN_FLIGHT.map(() => "?").join(", ");
+        const row = this.db
+            .prepare(`SELECT COUNT(*) AS n FROM run WHERE project_slug = ? AND status IN (${placeholders})`)
+            .get(slug, ...IN_FLIGHT);
+        return row.n > 0;
+    }
+    /**
+     * Marks as interrupted every run that had begun, leaving queued ones alone.
+     *
+     * A run that started cannot survive the process that spawned it — its
+     * pseudo-terminal died with it. A queued run never began: it still means
+     * exactly what it meant, and dropping it would be a silent surprise for
+     * someone who queued three builds and restarted the server.
+     */
+    interruptInFlight() {
+        const placeholders = IN_FLIGHT.map(() => "?").join(", ");
         const res = this.db
             .prepare(`UPDATE run SET status = 'interrupted', finished_at = ? WHERE status IN (${placeholders})`)
-            .run(now(), ...ACTIVE);
+            .run(now(), ...IN_FLIGHT);
         return res.changes;
     }
     replaceSteps(runId, steps) {

package/dist/src/db/schema.sql

@@ -37,9 +37,27 @@ CREATE TABLE IF NOT EXISTS artifact (
   kind     TEXT    NOT NULL
 );
 
+-- `kind` is part of the key because more than one reader caches per project —
+-- lanes and the actions each lane calls. Without it the second write overwrites
+-- the first, and the next read returns a payload of the wrong shape rather than
+-- missing the cache.
 CREATE TABLE IF NOT EXISTS introspection_cache (
-  project_slug TEXT PRIMARY KEY,
+  project_slug TEXT NOT NULL,
+  kind         TEXT NOT NULL,
   config_hash  TEXT NOT NULL,
   payload      TEXT NOT NULL,
-  fetched_at   TEXT NOT NULL
+  fetched_at   TEXT NOT NULL,
+  PRIMARY KEY (project_slug, kind)
+);
+
+-- A global secret is stored with an empty project_slug rather than NULL:
+-- SQLite considers two NULLs distinct in a UNIQUE index, so NULL would let the
+-- same global name be inserted twice.
+CREATE TABLE IF NOT EXISTS secret (
+  project_slug TEXT    NOT NULL DEFAULT '',
+  key          TEXT    NOT NULL,
+  value_enc    TEXT    NOT NULL,
+  masked       INTEGER NOT NULL DEFAULT 1,
+  updated_at   TEXT    NOT NULL,
+  PRIMARY KEY (project_slug, key)
 );

package/dist/src/db/secrets.js

@@ -0,0 +1,64 @@
+const GLOBAL = "";
+/**
+ * Stores encrypted secrets. Knows nothing about encryption itself: it takes and
+ * returns ciphertext, so a bug here cannot leak a plaintext value.
+ *
+ * A project secret shadows a global one of the same name — the same precedence
+ * as the configuration, and the least surprising rule.
+ */
+export class SecretStore {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    set(projectSlug, key, valueEnc, masked) {
+        this.db
+            .prepare(`INSERT INTO secret (project_slug, key, value_enc, masked, updated_at)
+         VALUES (?, ?, ?, ?, ?)
+         ON CONFLICT (project_slug, key) DO UPDATE
+           SET value_enc = excluded.value_enc,
+               masked = excluded.masked,
+               updated_at = excluded.updated_at`)
+            .run(projectSlug ?? GLOBAL, key, valueEnc, masked ? 1 : 0, new Date().toISOString());
+    }
+    /** Rows that apply to a project, project scope winning over global. */
+    applicable(projectSlug) {
+        const rows = this.db
+            .prepare("SELECT * FROM secret WHERE project_slug IN (?, ?) ORDER BY key")
+            .all(projectSlug, GLOBAL);
+        const byKey = new Map();
+        for (const row of rows) {
+            const existing = byKey.get(row.key);
+            if (!existing || row.project_slug !== GLOBAL)
+                byKey.set(row.key, row);
+        }
+        return [...byKey.values()].sort((a, b) => a.key.localeCompare(b.key));
+    }
+    list(projectSlug) {
+        return this.applicable(projectSlug).map((row) => ({
+            key: row.key,
+            masked: row.masked === 1,
+            scope: row.project_slug === GLOBAL ? "global" : "project",
+        }));
+    }
+    listGlobal() {
+        const rows = this.db
+            .prepare("SELECT * FROM secret WHERE project_slug = ? ORDER BY key")
+            .all(GLOBAL);
+        return rows.map((row) => ({ key: row.key, masked: row.masked === 1, scope: "global" }));
+    }
+    /** Ciphertext by name, for the vault to decrypt. */
+    encrypted(projectSlug) {
+        return Object.fromEntries(this.applicable(projectSlug).map((row) => [row.key, row.value_enc]));
+    }
+    /** Which of the applicable secrets should be kept out of the logs. */
+    maskedKeys(projectSlug) {
+        return new Set(this.applicable(projectSlug).filter((r) => r.masked === 1).map((r) => r.key));
+    }
+    remove(projectSlug, key) {
+        const res = this.db
+            .prepare("DELETE FROM secret WHERE project_slug = ? AND key = ?")
+            .run(projectSlug ?? GLOBAL, key);
+        return res.changes > 0;
+    }
+}

package/dist/src/fastfile/store.js

@@ -0,0 +1,53 @@
+import { readFile, writeFile } from "node:fs/promises";
+import { isAbsolute, relative, resolve } from "node:path";
+const DEFAULT_FASTLANE_DIR = "fastlane";
+/**
+ * Reads and writes the Fastfile byte-for-byte.
+ *
+ * A file written by hand must never come back mangled: no reformatting, no
+ * trailing-newline fixing, no reordering. Someone may have spent a long time
+ * on that file, so `write` keeps the previous content only in memory — never
+ * in a sibling file, which would show up as an untracked file in the git
+ * workspace and eventually get committed by someone in a hurry — and puts it
+ * back the moment the injected verifier says the new content doesn't hold up.
+ */
+export class FastfileStore {
+    async read(workspacePath, fastlaneDir = DEFAULT_FASTLANE_DIR) {
+        return readFile(this.resolvePath(workspacePath, fastlaneDir), "utf8");
+    }
+    /**
+     * Writes `content` verbatim, then verifies it. On failure, the previous
+     * content is written back before returning, so the workspace never lands
+     * between the old file and the new one.
+     */
+    async write(workspacePath, content, verify, fastlaneDir = DEFAULT_FASTLANE_DIR) {
+        const path = this.resolvePath(workspacePath, fastlaneDir);
+        const previous = await readFile(path, "utf8");
+        await writeFile(path, content, "utf8");
+        const result = await verify();
+        if (!result.ok) {
+            // Whatever broke, the file on disk goes back to exactly what it was
+            // before this call — a stray backup file would be a second thing to
+            // clean up and forget about.
+            await writeFile(path, previous, "utf8");
+        }
+        return result;
+    }
+    /**
+     * Resolves the Fastfile's path, refusing to leave the workspace.
+     *
+     * `fastlaneDir` comes from configuration — the project's own
+     * `laneyard.yml`, or the server's `config.yml` — and a value like
+     * `../../etc` must not turn an editor into a way to write anywhere on the
+     * machine.
+     */
+    resolvePath(workspacePath, fastlaneDir) {
+        const root = resolve(workspacePath);
+        const full = resolve(root, fastlaneDir, "Fastfile");
+        const rel = relative(root, full);
+        if (rel.startsWith("..") || isAbsolute(rel)) {
+            throw new Error(`fastlane_dir resolves outside the workspace: ${fastlaneDir}`);
+        }
+        return full;
+    }
+}