laneyard 0.2.0 → 0.4.0

package/dist/src/db/schema.sql

@@ -61,3 +61,42 @@ CREATE TABLE IF NOT EXISTS secret (
   updated_at   TEXT    NOT NULL,
   PRIMARY KEY (project_slug, key)
 );
+
+-- A signing credential: a file plus the fields that make it usable. Separate
+-- from `secret` because these are not key/value pairs — stored as loose rows,
+-- nothing knew the parts belonged together, and deleting one left a half-dead
+-- group no check could detect.
+--
+-- `fields_enc` is one encrypted JSON object rather than a column per field: the
+-- three kinds do not share a shape, and a column per field would mean a
+-- migration every time a kind gains one.
+--
+-- `var_names` is NOT encrypted. It holds variable names, never values, and the
+-- interface has to display them.
+CREATE TABLE IF NOT EXISTS credential (
+  project_slug TEXT NOT NULL DEFAULT '',
+  kind         TEXT NOT NULL,
+  file_name    TEXT NOT NULL,
+  file_enc     TEXT NOT NULL,
+  fields_enc   TEXT NOT NULL,
+  var_names    TEXT NOT NULL,
+  updated_at   TEXT NOT NULL,
+  PRIMARY KEY (project_slug, kind)
+);
+
+-- Sessions outlive a restart, which is the whole reason they are here rather
+-- than in a Map. What is stored is a SHA-256 of the token, never the token: the
+-- cookie is a bearer credential, and a stolen `laneyard.db` must not hand
+-- anybody a live session the way a table of raw tokens would.
+--
+-- `expires_at` is an ISO timestamp compared as text, which sorts correctly
+-- because ISO-8601 does. A session with no end is not a convenience, it is a
+-- credential nobody can lose track of.
+CREATE TABLE IF NOT EXISTS session (
+  token_hash TEXT PRIMARY KEY,
+  name       TEXT NOT NULL,
+  role       TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS session_by_name ON session (name);

package/dist/src/db/secrets.js

@@ -34,6 +34,34 @@ export class SecretStore {
         }
         return [...byKey.values()].sort((a, b) => a.key.localeCompare(b.key));
     }
+    /** One applicable row, ciphertext included, or undefined. */
+    find(projectSlug, key) {
+        const row = this.applicable(projectSlug).find((r) => r.key === key);
+        return row
+            ? {
+                key: row.key,
+                masked: row.masked === 1,
+                scope: row.project_slug === GLOBAL ? "global" : "project",
+                valueEnc: row.value_enc,
+            }
+            : undefined;
+    }
+    /**
+     * Flips whether a value is kept out of the logs, leaving the value alone.
+     *
+     * Its own operation rather than a re-`set`, because of a circle: to reveal a
+     * value you must first declare it not secret, and declaring that by storing it
+     * again would mean typing the value you were trying to read.
+     *
+     * Returns false when no row matches, so a caller can answer 404 rather than
+     * report a change that did not happen.
+     */
+    setMasked(projectSlug, key, masked) {
+        return (this.db
+            .prepare(`UPDATE secret SET masked = ?, updated_at = ?
+           WHERE project_slug = ? AND key = ?`)
+            .run(masked ? 1 : 0, new Date().toISOString(), projectSlug ?? GLOBAL, key).changes > 0);
+    }
     list(projectSlug) {
         return this.applicable(projectSlug).map((row) => ({
             key: row.key,

package/dist/src/db/sessions.js

@@ -0,0 +1,61 @@
+import { createHash } from "node:crypto";
+/**
+ * A token is never stored, only its digest.
+ *
+ * SHA-256 without a salt on purpose, unlike a password: the token is 32 random
+ * bytes from `randomBytes`, so there is no dictionary to build and no cheaper
+ * attack than guessing the token itself. What this buys is that a copy of
+ * `laneyard.db` is a list of digests rather than a ring of working keys.
+ */
+const digest = (token) => createHash("sha256").update(token).digest("hex");
+/**
+ * Where sessions live between restarts.
+ *
+ * They used to live in a Map, with a comment saying they did not survive a
+ * restart "and that's just fine". It was not fine: a server restarted to pick
+ * up a configuration change signed everybody out, and on a machine you are
+ * still setting up that is several times an hour.
+ */
+export class SessionRecords {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    insert(token, owner, expiresAt) {
+        this.db
+            .prepare(`INSERT INTO session (token_hash, name, role, created_at, expires_at)
+         VALUES (?, ?, ?, ?, ?)`)
+            .run(digest(token), owner.name, owner.role, new Date().toISOString(), expiresAt.toISOString());
+    }
+    /** The owner, or undefined when the token is unknown or its time is up. */
+    find(token, now = new Date()) {
+        const row = this.db
+            .prepare(`SELECT name, role FROM session WHERE token_hash = ? AND expires_at > ?`)
+            .get(digest(token), now.toISOString());
+        return row ? { name: row.name, role: row.role } : undefined;
+    }
+    remove(token) {
+        this.db.prepare(`DELETE FROM session WHERE token_hash = ?`).run(digest(token));
+    }
+    removeAllFor(name) {
+        this.db.prepare(`DELETE FROM session WHERE name = ?`).run(name);
+    }
+    /**
+     * Drops what has already expired.
+     *
+     * Called at startup rather than on a timer: the rows are harmless — `find`
+     * already refuses them — so this is housekeeping, not correctness, and a
+     * timer would be a moving part earning nothing.
+     */
+    prune(now = new Date()) {
+        return this.db.prepare(`DELETE FROM session WHERE expires_at <= ?`).run(now.toISOString())
+            .changes;
+    }
+    /** Number of live sessions. Exposed so expiry can be tested without sleeping. */
+    count(now = new Date()) {
+        const row = this.db
+            .prepare(`SELECT COUNT(*) AS n FROM session WHERE expires_at > ?`)
+            .get(now.toISOString());
+        return row.n;
+    }
+}

package/dist/src/git/workspace.js

@@ -7,6 +7,27 @@ const exec = promisify(execFile);
  * A clone managed by Laneyard, kept between runs.
  * All git commands go through here to share the authentication environment.
  */
+/**
+ * The environment git needs to work without a person at the keyboard.
+ *
+ * Lifted out of `Workspace` because it is not only Workspace's problem. A lane
+ * may run git itself — pushing a bumped build number is a common and reasonable
+ * thing for a Fastfile to do — and that `sh("git push")` inherited none of
+ * this. The result was the worst possible failure: a push that needed a
+ * credential did not fail, it *waited*, and the run sat there until it hit its
+ * timeout with nothing in the log to say what it was waiting for.
+ *
+ * `GIT_TERMINAL_PROMPT=0` is what turns that wait into an error. The SSH
+ * command is what makes the push succeed instead — the key configured for
+ * cloning is by definition the right one for pushing to the same remote.
+ */
+export function gitEnvFor(auth) {
+    const env = { GIT_TERMINAL_PROMPT: "0" };
+    if (auth.kind === "ssh_key" && auth.ref) {
+        env["GIT_SSH_COMMAND"] = `ssh -i ${auth.ref} -o IdentitiesOnly=yes -o BatchMode=yes`;
+    }
+    return env;
+}
 export class Workspace {
     path;
     gitUrl;
@@ -17,12 +38,17 @@ export class Workspace {
         this.auth = auth;
     }
     env() {
-        // Without this, git can block on a credentials prompt and freeze the run.
-        const env = { ...process.env, GIT_TERMINAL_PROMPT: "0" };
-        if (this.auth.kind === "ssh_key" && this.auth.ref) {
-            env["GIT_SSH_COMMAND"] = `ssh -i ${this.auth.ref} -o IdentitiesOnly=yes -o BatchMode=yes`;
-        }
-        return env;
+        return { ...process.env, ...gitEnvFor(this.auth) };
+    }
+    /**
+     * The git identity this workspace would commit under, or null.
+     *
+     * Exposed because a lane that runs `git commit` itself needs the same answer,
+     * and a clone Laneyard made has no identity of its own — so the question is
+     * whether the *server* has one.
+     */
+    async identity() {
+        return this.gitIdentity();
     }
     /**
      * Replaces the repository URL with a neutral token in a piece of text.

package/dist/src/heuristics/android-root.js

@@ -0,0 +1,49 @@
+import { readFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { parseAndroidSigning } from "./android-signing.js";
+/**
+ * Which build script speaks for the android side of a project — asked once, in
+ * one place.
+ *
+ * Two callers need the answer and they must never disagree. The checklist reads
+ * the script to decide whether a release build could go out signed with the
+ * debug key, and the runner writes the properties file that build asks for. If
+ * one of them stopped at `app/build.gradle` while the other read
+ * `android/app/build.gradle.kts`, the file would land where nothing reads it and
+ * the checklist would report green over an artifact signed by the debug key —
+ * the exact failure both of them exist to prevent. A shared list is what makes
+ * that disagreement impossible rather than unlikely.
+ *
+ * The order is a preference, not a ranking of correctness: `android/app` is
+ * where Flutter and React Native put theirs, and `app` is a repository that is
+ * an Android project outright. A repository with both is a monorepo whose
+ * fastlane directory should have pointed one level down, and the first match is
+ * the honest guess to make until it does.
+ */
+export const ANDROID_BUILD_SCRIPTS = [
+    "android/app/build.gradle.kts",
+    "android/app/build.gradle",
+    "app/build.gradle.kts",
+    "app/build.gradle",
+];
+/**
+ * Reads the first android build script under `root`, or null when there is none.
+ *
+ * `root` is the app root inside the clone, not the repository root: in a
+ * monorepo the app is one directory down and so are its platform folders.
+ *
+ * Never throws. An unreadable script is the same as an absent one to both
+ * callers — "could not tell" — and a checklist that raised here would turn a
+ * question it failed to answer into an error page.
+ */
+export async function findAndroidBuild(root) {
+    for (const candidate of ANDROID_BUILD_SCRIPTS) {
+        const scriptPath = join(root, candidate);
+        const text = await readFile(scriptPath, "utf8").catch(() => null);
+        if (text === null)
+            continue;
+        const moduleDir = dirname(scriptPath);
+        return { scriptPath, moduleDir, gradleRoot: dirname(moduleDir), facts: parseAndroidSigning(text) };
+    }
+    return null;
+}

package/dist/src/heuristics/android-signing.js

@@ -0,0 +1,98 @@
+/**
+ * Whether a release build is actually signed with the release key.
+ *
+ * The pattern this exists for is in the Flutter documentation, and therefore in
+ * thousands of projects:
+ *
+ *     signingConfig = if (keystorePropertiesFile.exists()) {
+ *         signingConfigs.getByName("release")
+ *     } else {
+ *         signingConfigs.getByName("debug")
+ *     }
+ *
+ * It is kind locally — `flutter run --release` works on a machine with no
+ * keystore — and it is a trap everywhere else. `key.properties` is gitignored
+ * by the same documentation, so it is by definition absent from a clone. The
+ * release build then *succeeds*, produces an `.aab` signed with the debug key,
+ * and the failure arrives minutes later from Google, saying nothing about
+ * signing.
+ *
+ * Silent, late, and misleading — which is exactly the shape of failure a
+ * checklist exists to move forward in time.
+ *
+ * Text, not a Gradle evaluation: running someone's build script to ask it a
+ * question is not something a checklist may do. So this errs towards saying
+ * nothing, and the check it feeds says "could not tell" rather than inventing a
+ * verdict from a file it half understood.
+ */
+export const NO_SIGNING_FACTS = {
+    releaseCanUseDebugKey: false,
+    conditionalOn: null,
+};
+/**
+ * `rootProject.file("key.properties")`, `file('signing.properties')` — the name,
+ * and whatever the call was made on.
+ *
+ * The receiver is optional and captured separately because it is the whole
+ * difference between two directories. It is matched as a dotted chain so that
+ * the match starts at the receiver rather than at `file(` in the middle of it:
+ * a pattern that ignored the receiver would read `keystoreDir.file(…)` as a bare
+ * call and confidently name the wrong place.
+ */
+const PROPERTIES_FILE = /(?:([A-Za-z_][\w.]*)\s*\.\s*)?\bfile\s*\(\s*["']([^"']+\.properties)["']\s*\)/;
+/**
+ * `project.file` is the bare call spelled out — Gradle defines one as the other
+ * — so both mean the module. Only `rootProject` climbs, and anything else is a
+ * receiver whose directory this has no way to know.
+ */
+function scopeOf(receiver) {
+    if (receiver === undefined || receiver === "project")
+        return "module";
+    if (receiver === "rootProject")
+        return "root";
+    return "unknown";
+}
+/**
+ * The `release { … }` block of `buildTypes`, as text.
+ *
+ * Braces are counted rather than matched with a regex, because the block nests
+ * and a lazy match would stop at the first `}` — which is usually inside it.
+ */
+function releaseBlock(source) {
+    const start = /buildTypes\s*\{/.exec(source);
+    if (!start)
+        return null;
+    const from = source.indexOf("release", start.index);
+    if (from === -1)
+        return null;
+    const open = source.indexOf("{", from);
+    if (open === -1)
+        return null;
+    let depth = 0;
+    for (let i = open; i < source.length; i += 1) {
+        if (source[i] === "{")
+            depth += 1;
+        else if (source[i] === "}") {
+            depth -= 1;
+            if (depth === 0)
+                return source.slice(open, i + 1);
+        }
+    }
+    return null;
+}
+/** Reads an `android/app/build.gradle` or its Kotlin equivalent. Never throws. */
+export function parseAndroidSigning(source) {
+    const release = releaseBlock(source);
+    if (release === null)
+        return NO_SIGNING_FACTS;
+    // `signingConfigs.debug` and `signingConfigs.getByName("debug")` are the two
+    // spellings; both mean the release build may go out with the debug key.
+    const usesDebug = /signingConfigs\s*(?:\.getByName\s*\(\s*["']debug["']\s*\)|\.debug\b)/.test(release);
+    const conditional = PROPERTIES_FILE.exec(source);
+    return {
+        releaseCanUseDebugKey: usesDebug,
+        conditionalOn: usesDebug && conditional
+            ? { name: conditional[2], scope: scopeOf(conditional[1]) }
+            : null,
+    };
+}

package/dist/src/heuristics/appfile.js

@@ -0,0 +1,60 @@
+/**
+ * What fastlane's `Appfile` says about credentials.
+ *
+ * The Appfile is the other half of a fastlane setup, and the half Laneyard used
+ * to be blind to: a project whose Play Store service account has been configured
+ * for years — `json_key_file` on line two — was told it had no service account,
+ * because the only place the checklist looked was Laneyard's own vault. A
+ * warning that is false for a working project is worse than no warning: it is
+ * the one that teaches someone the screen is wrong and can be skipped.
+ *
+ * This is a reader, not an evaluator. The Appfile is Ruby and may compute its
+ * values — `json_key_file ENV["KEY"]` is legal and common — so anything that is
+ * not a plain string literal is reported as "set, but not to something readable
+ * from here" rather than guessed at. The checks turn that into `unknown`, which
+ * is the honest answer: the value exists, and whether it resolves to a file on
+ * this machine is not a question a text file can settle.
+ */
+const ABSENT = { kind: "absent" };
+export const NO_APPFILE = {
+    jsonKeyFile: ABSENT,
+    jsonKeyData: ABSENT,
+    appleId: ABSENT,
+};
+/**
+ * Strips comments, so `# json_key_file "old.json"` is not read as a setting.
+ *
+ * Naive about `#` inside a string, deliberately: the alternative is a Ruby
+ * lexer, and the cost of being wrong here is one line read as a comment — the
+ * check answers "not found" instead of "found", which is the direction this
+ * whole module errs in anyway.
+ */
+const withoutComments = (line) => line.replace(/#.*$/, "");
+/**
+ * `json_key_file "x"`, `json_key_file("x")`, `json_key_file 'x'` — and the
+ * `for_platform`/`for_lane` blocks they may sit inside, which change nothing
+ * about whether the key is set, only about when.
+ */
+function read(lines, key) {
+    const declaration = new RegExp(`^\\s*${key}\\s*(\\(|\\s)`);
+    const literal = new RegExp(`^\\s*${key}\\s*\\(?\\s*(["'])(.*?)\\1\\s*\\)?\\s*$`);
+    let found = ABSENT;
+    for (const line of lines) {
+        if (!declaration.test(line))
+            continue;
+        const match = literal.exec(line);
+        // A later assignment wins, the way it would when Ruby runs the file — and a
+        // literal that follows a computed one is still the value that lands.
+        found = match ? { kind: "literal", value: match[2] } : { kind: "computed" };
+    }
+    return found;
+}
+/** Reads an Appfile's text. Never throws: an unreadable Appfile is `NO_APPFILE`. */
+export function parseAppfile(content) {
+    const lines = content.split("\n").map(withoutComments);
+    return {
+        jsonKeyFile: read(lines, "json_key_file"),
+        jsonKeyData: read(lines, "json_key_data"),
+        appleId: read(lines, "apple_id"),
+    };
+}

package/dist/src/heuristics/blocking-actions.js

@@ -21,7 +21,29 @@ export const BLOCKING_RULES = [
         because: "renews provisioning profiles, which needs an Apple account interactively",
         fix: "Use `match` in readonly mode instead, with profiles stored in a repository.",
     },
+    {
+        action: "cert",
+        because: "creates or downloads a signing certificate, which needs an Apple account interactively",
+        fix: "Use `match` in readonly mode instead, with certificates stored in a repository.",
+    },
+    // `deliver` renders an HTML summary and waits for a yes before uploading.
+    // Only reported when the lane says `force: false` outright: the default is
+    // not something the sidecar reports, and inventing one would be a guess.
+    {
+        action: "deliver",
+        when: { arg: "force", equals: false },
+        because: "shows a summary and waits for it to be confirmed before uploading",
+        fix: "Pass `force: true` so it uploads without asking.",
+    },
+    {
+        action: "upload_to_app_store",
+        when: { arg: "force", equals: false },
+        because: "shows a summary and waits for it to be confirmed before uploading",
+        fix: "Pass `force: true` so it uploads without asking.",
+    },
 ];
+/** `given`, with the fallback that keeps an older cached payload readable. */
+export const argsGiven = (action) => action.given ?? Object.keys(action.args);
 /**
  * Applies the table to the actions a lane calls.
  *

package/dist/src/heuristics/env-example.js

@@ -0,0 +1,36 @@
+/**
+ * The variable names a `.env.example` advertises.
+ *
+ * A project that keeps its variables in `fastlane/.env` almost always commits a
+ * `.env.example` beside it — that is what the file is *for*: telling whoever
+ * clones the repository which variables they need. It is the one manifest of
+ * required variables that is both conventional and, unlike `.env` itself,
+ * actually present in the clone a build runs from.
+ *
+ * It catches what parsing the Fastfile cannot. `SENTRY_AUTH_TOKEN` is read by
+ * `sentry-cli`, not by any `ENV.fetch` in a lane, so no amount of reading the
+ * Fastfile finds it — and it sits in `.env.example`, named, all along.
+ *
+ * Only names are taken. The file is an example by definition, so its values are
+ * placeholders; reading them would be reading fiction, and a checklist that
+ * compared them to anything would be worse than one that did not look.
+ */
+export function parseEnvExample(content) {
+    const names = [];
+    for (const raw of content.split("\n")) {
+        const line = raw.trim();
+        if (line === "" || line.startsWith("#"))
+            continue;
+        // `export FOO=bar` is legal in these files and means the same thing.
+        const assignment = line.replace(/^export\s+/, "");
+        const eq = assignment.indexOf("=");
+        if (eq <= 0)
+            continue;
+        const name = assignment.slice(0, eq).trim();
+        // Shell-ish variable names only: anything else is a line this has
+        // misunderstood, and inventing a requirement is worse than missing one.
+        if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(name))
+            names.push(name);
+    }
+    return [...new Set(names)];
+}

package/dist/src/heuristics/platforms.js

@@ -0,0 +1,136 @@
+import { join } from "node:path";
+/**
+ * Where to look for the markers, given where the Fastfile turned out to be.
+ *
+ * Two places, and the order does not matter because the answer is a union.
+ *
+ * The repository root is the obvious one, and used to be the only one. It is
+ * wrong on its own: the markers sit *beside* an app's fastlane folder, not
+ * beside the repository root — `ios/Runner.xcodeproj` and `fastlane/` are
+ * siblings, and both move together when the app is one directory of a
+ * monorepo. A repository holding `app/fastlane/Fastfile` and
+ * `app/ios/Runner.xcodeproj` reported "no Xcode project and no Gradle build",
+ * because that is three levels down and the table reaches two.
+ *
+ * The app's own directory is the second, and it is the one laneyard already
+ * knows: it asked where the Fastfile was during setup. Between them they cover
+ * the arrangements that actually occur —
+ *
+ * - `fastlane/` and `*.xcodeproj` both at the root: a plain native app;
+ * - `fastlane/`, `ios/`, `android/` at the root: React Native, Flutter;
+ * - `app/fastlane/`, `app/ios/`, `app/android/`: the same app inside a monorepo;
+ * - `ios/fastlane/`: a fastlane set up for one platform only, which then
+ *   reports that one platform and not its sibling — right, since those lanes
+ *   build one platform, and an irrelevant section is what teaches someone to
+ *   ignore the screen.
+ *
+ * Keeping both roots rather than replacing one with the other is what makes
+ * this strictly an addition: nothing the old behaviour found is lost.
+ *
+ * What is deliberately *not* done is deepening the table to `*​/*​/*` or `**`.
+ * A third level would match `node_modules/some-package/ios/X.xcodeproj` and
+ * `app/ios/Pods/Pods.xcodeproj`, and report iOS for an Android-only project on
+ * the strength of a dependency's own Xcode project. `**` would do that and walk
+ * every build directory to do it. Two levels from a root that is actually the
+ * app is a better question than four levels from a root that is not.
+ */
+export function appRootOf(fastlaneDir) {
+    if (!fastlaneDir)
+        return ".";
+    // Repository-relative and always forward-slashed, whatever the platform.
+    const parent = fastlaneDir.replace(/\/+$/, "").split("/").slice(0, -1).join("/");
+    return parent === "" ? "." : parent;
+}
+/**
+ * The one directory to list, given where the Fastfile turned out to be.
+ *
+ * Not the repository root, which is what it used to be and what made a
+ * repository holding `app/fastlane/Fastfile` and `app/ios/Runner.xcodeproj`
+ * report "no Xcode project and no Gradle build": that is three levels down and
+ * the table reaches two.
+ *
+ * Not both, either, though that was tempting — keeping the root as well would
+ * have made this purely additive. It also means a project configured with
+ * `ios/fastlane` is shown the Android section, on the strength of a sibling
+ * `android/` folder those lanes never touch. The fastlane directory is not a
+ * guess: setup asked for it and `laneyard.yml` records it, and it says which
+ * app this project *is*. Trusting it is the difference between a checklist
+ * about this project and a checklist about the repository it lives in.
+ *
+ * Anyone it gets wrong has the escape hatch the check itself names: `platforms`
+ * in `laneyard.yml` is read first and skips all of this.
+ *
+ * What is deliberately not done is deepening the table to `*​/*​/*` or `**`. A
+ * third level matches `node_modules/some-package/ios/X.xcodeproj` and
+ * `app/ios/Pods/Pods.xcodeproj`, and would report iOS for an Android-only
+ * project on the strength of a dependency. Two levels from a directory that is
+ * actually the app beats four from one that is not.
+ */
+export function searchDir(from, appRoot) {
+    if (!appRoot || appRoot === "." || appRoot.startsWith(".."))
+        return from;
+    return join(from, appRoot);
+}
+/**
+ * What a repository looks like from the outside, as a table.
+ *
+ * The depth is deliberate: an app in a monorepo sits one level down
+ * (`android/build.gradle`, `ios/App.xcodeproj`), which is where Flutter and
+ * React Native put them.
+ */
+export const PLATFORM_MARKERS = [
+    {
+        platform: "ios",
+        globs: ["*.xcodeproj", "*.xcworkspace", "*/*.xcodeproj", "*/*.xcworkspace"],
+        onlyDirectories: true,
+    },
+    {
+        platform: "android",
+        globs: ["build.gradle", "build.gradle.kts", "*/build.gradle", "*/build.gradle.kts"],
+        onlyDirectories: false,
+    },
+];
+/**
+ * What the repository contains.
+ *
+ * Never throws. An absent clone is a reason to answer "nothing found", not to
+ * fail the checklist that was about to explain why the clone is absent.
+ */
+export async function detectPlatforms(find) {
+    const found = [];
+    // Sequential, and in the table's order, so the answer is stable: this list
+    // decides the order of the sections someone reads.
+    for (const marker of PLATFORM_MARKERS) {
+        try {
+            const paths = await find(marker.globs, { onlyDirectories: marker.onlyDirectories });
+            if (paths.length > 0)
+                found.push(marker.platform);
+        }
+        catch {
+            // A marker that cannot be looked for is simply not found.
+        }
+    }
+    return found;
+}
+/**
+ * The configuration first, then the repository.
+ *
+ * An empty configured list counts as saying nothing: `platforms: []` is what a
+ * commented-out line leaves behind, and reading it as "this project builds for
+ * nothing" would silently empty the checklist.
+ */
+export function platformsOf(configured, detected) {
+    const chosen = configured && configured.length > 0 ? configured : detected;
+    // Normalised through the table: a hand-written `[android, ios]` must not
+    // reorder the screen, and a platform named twice must not appear twice.
+    return PLATFORM_MARKERS.map((m) => m.platform).filter((p) => chosen.includes(p));
+}
+/** The two steps in one call, for callers that have a directory to look at. */
+export async function resolvePlatforms(configured, find) {
+    // The repository is only listed when the configuration did not answer:
+    // globbing a workspace costs a directory walk, and a project that says what
+    // it builds for should not pay for one.
+    if (configured && configured.length > 0)
+        return platformsOf(configured, []);
+    return platformsOf(undefined, await detectPlatforms(find));
+}