laneyard 0.2.0 → 0.4.0

package/dist/src/server/routes/credentials.js

@@ -0,0 +1,108 @@
+import { CREDENTIAL_KINDS, defaultVarNames, fieldsOf } from "../../credentials/kinds.js";
+/**
+ * Signing blocks over HTTP: the file and the fields that make it usable.
+ *
+ * The file arrives base64 inside a JSON body rather than as a multipart upload.
+ * No multipart plugin is registered — see `app.ts` — and a `.p8` is two
+ * kilobytes, so adding a dependency to carry it would be paying in supply chain
+ * for a convenience the browser can provide in one `FileReader` call.
+ *
+ * A block is taken or refused whole. That is what makes it a block rather than
+ * three loose rows: a keystore stored without its alias is not a partial
+ * success, it is a build that fails in a month with an unusable artifact.
+ */
+/** POSIX environment variable names. Anything else would never reach fastlane. */
+const VALID_VAR = /^[A-Za-z_][A-Za-z0-9_]*$/;
+export async function registerCredentialRoutes(app, ctx) {
+    app.get("/api/credentials", async () => ctx.vault.listGlobalCredentials());
+    app.get("/api/projects/:slug/credentials", async (req, reply) => {
+        const { slug } = req.params;
+        if (!ctx.config.project(slug))
+            return reply.code(404).send({ error: "Unknown project" });
+        return ctx.vault.listCredentials(slug);
+    });
+    const put = async (slug, kind, body, reply) => {
+        const spec = CREDENTIAL_KINDS.find((k) => k.kind === kind);
+        if (!spec) {
+            return reply.code(400).send({
+                error: `"${kind}" is not a kind of credential Laneyard knows: ${CREDENTIAL_KINDS.map((k) => k.kind).join(", ")}.`,
+            });
+        }
+        const { fileName, fileBase64, fields, varNames } = (body ?? {});
+        if (typeof fileName !== "string" || fileName === "") {
+            return reply.code(400).send({ error: "A file name is required" });
+        }
+        if (typeof fileBase64 !== "string" || fileBase64 === "") {
+            return reply.code(400).send({ error: `The ${spec.what} file is required, base64-encoded.` });
+        }
+        const given = (fields ?? {});
+        if (typeof given !== "object" || Array.isArray(given)) {
+            return reply.code(400).send({ error: "`fields` is an object of name to value." });
+        }
+        // Optional fields are the settings a block may leave unanswered — where a
+        // gradle properties file goes, what it is read under. Laneyard is allowed to
+        // ask; refusing the whole block over an unanswered one would be requiring.
+        const missing = fieldsOf(spec.kind)
+            .filter((f) => !f.optional && (typeof given[f.name] !== "string" || given[f.name] === ""))
+            .map((f) => f.name);
+        if (missing.length > 0) {
+            return reply.code(400).send({
+                error: `A ${spec.what} needs ${missing.join(", ")}. Without it the file alone signs nothing.`,
+            });
+        }
+        // Only the fields the kind declares are kept. An extra one would be stored,
+        // never read, and quietly disagree with what the block claims to be.
+        const kept = {};
+        for (const field of fieldsOf(spec.kind)) {
+            const value = given[field.name];
+            // An unanswered optional field is absent from the block rather than
+            // stored empty: the reader then falls back to what it would have used
+            // anyway, instead of taking "" for an answer someone gave.
+            if (typeof value === "string" && value !== "")
+                kept[field.name] = value;
+        }
+        const names = { ...defaultVarNames(spec.kind), ...(varNames ?? {}) };
+        for (const [slot, name] of Object.entries(names)) {
+            if (!(slot in defaultVarNames(spec.kind))) {
+                return reply.code(400).send({ error: `A ${spec.what} exports nothing called "${slot}".` });
+            }
+            if (typeof name !== "string" || !VALID_VAR.test(name)) {
+                return reply.code(400).send({
+                    error: `"${name}" is not a valid environment variable name: letters, digits and underscore, not starting with a digit.`,
+                });
+            }
+        }
+        // Node's base64 decoder ignores what it cannot read rather than refusing, so
+        // a truncated or mistyped upload would be stored as a shorter file and only
+        // surface as an unreadable key at signing time.
+        const fileBytes = Buffer.from(fileBase64, "base64");
+        if (fileBytes.length === 0 || fileBytes.toString("base64").replace(/=+$/, "") !== fileBase64.replace(/=+$/, "")) {
+            return reply.code(400).send({ error: "The file is not valid base64." });
+        }
+        await ctx.vault.setCredential(slug, spec.kind, { fileName, fileBytes, fields: kept, varNames: names });
+        return reply.code(204).send();
+    };
+    app.put("/api/credentials/:kind", async (req, reply) => put(null, req.params.kind, req.body, reply));
+    app.put("/api/projects/:slug/credentials/:kind", async (req, reply) => {
+        const { slug, kind } = req.params;
+        if (!ctx.config.project(slug))
+            return reply.code(404).send({ error: "Unknown project" });
+        return put(slug, kind, req.body, reply);
+    });
+    app.delete("/api/credentials/:kind", async (req, reply) => {
+        const { kind } = req.params;
+        const removed = ctx.vault.removeCredential(null, kind);
+        return removed ? reply.code(204).send() : reply.code(404).send({ error: "Unknown credential" });
+    });
+    /**
+     * Removes this project's own block, and only that one. A global block that
+     * was shadowed comes back into view, which is the deletion someone asked for:
+     * they are undoing an override, not deleting everyone's key from inside one
+     * project.
+     */
+    app.delete("/api/projects/:slug/credentials/:kind", async (req, reply) => {
+        const { slug, kind } = req.params;
+        const removed = ctx.vault.removeCredential(slug, kind);
+        return removed ? reply.code(204).send() : reply.code(404).send({ error: "Unknown credential" });
+    });
+}

package/dist/src/server/routes/projects.js

@@ -1,3 +1,5 @@
+import { existsSync } from "node:fs";
+import { removeProjectFromConfig } from "../../cli/setup.js";
 export async function registerProjectRoutes(app, ctx) {
     app.get("/api/projects", async () => ctx.config.projects().map((p) => {
         const last = ctx.runs.listByProject(p.slug, 1)[0] ?? null;
@@ -8,6 +10,46 @@ export async function registerProjectRoutes(app, ctx) {
             lastRun: last && { id: last.id, status: last.status, lane: last.lane, finishedAt: last.finishedAt },
         };
     }));
+    /**
+     * Stops showing a project. It is the one destructive route in the product,
+     * and what it does not destroy is most of the point:
+     *
+     *  - the project's block leaves config.yml, through the YAML document so the
+     *    rest of a hand-written file is untouched;
+     *  - its runs stay in the database, still reachable at their own URL — the
+     *    history of what this machine built is not the project's to take away;
+     *  - the clone and the artifacts stay on disk, named in the answer so they
+     *    can be removed by hand. Deleting files someone may still want, from a
+     *    web page, on one click, is not a thing to do.
+     */
+    app.delete("/api/projects/:slug", async (req, reply) => {
+        const { slug } = req.params;
+        const entry = ctx.config.project(slug);
+        if (!entry)
+            return reply.code(404).send({ error: "Unknown project" });
+        // A run that has begun is reading the workspace this project points at.
+        // Queued runs are not: the queue already fails a run whose project went
+        // away, so waiting on them would only mean refusing for longer.
+        if (ctx.runs.hasActiveRun(slug)) {
+            return reply.code(409).send({
+                error: `"${slug}" has a run in flight. Wait for it to finish, or cancel it, then remove the project.`,
+            });
+        }
+        const removed = await removeProjectFromConfig(ctx.config.configPath(), slug);
+        if (!removed)
+            return reply.code(404).send({ error: "Unknown project" });
+        // The file is watched, but on a debounce: reloading here is what makes the
+        // very next request — the listing this page is about to ask for — truthful.
+        await ctx.config.load();
+        // -1 is SQLite's "no limit": the answer names every artifact folder left
+        // behind, and a project with sixty runs must not be told about fifty of them.
+        const runs = ctx.runs.listByProject(slug, -1);
+        const leftOnDisk = [
+            ctx.workspacePath(slug),
+            ...runs.map((run) => ctx.artifactsDir(run.id)),
+        ].filter((path) => existsSync(path));
+        return reply.send({ slug, name: entry.name, runsKept: runs.length, leftOnDisk });
+    });
     app.get("/api/projects/:slug/lanes", async (req, reply) => {
         const { slug } = req.params;
         const entry = ctx.config.project(slug);

package/dist/src/server/routes/readiness.js

@@ -1,9 +1,16 @@
 import { execFile } from "node:child_process";
-import { access } from "node:fs/promises";
+import { access, readFile } from "node:fs/promises";
 import { join } from "node:path";
 import { promisify } from "node:util";
+import { glob } from "tinyglobby";
 import { Workspace } from "../../git/workspace.js";
-import { runChecks } from "../../heuristics/readiness.js";
+import { NO_APPFILE, parseAppfile } from "../../heuristics/appfile.js";
+import { findAndroidBuild } from "../../heuristics/android-root.js";
+import { exportedVarNames } from "../../credentials/kinds.js";
+import { envExampleNames } from "../required-secrets.js";
+import { appRootOf, resolvePlatforms, searchDir } from "../../heuristics/platforms.js";
+import { runChecklist } from "../../heuristics/readiness.js";
+import { LANEYARD_MARKER, propertyNames } from "../../runner/gradle-properties.js";
 const exec = promisify(execFile);
 /**
  * `bundle check` in the workspace, rejecting with what bundler said.
@@ -33,7 +40,100 @@ async function findFastlane() {
         return null;
     }
 }
+/** The globbing `heuristics/platforms.ts` asks for, bound to a directory. */
+const findIn = (dir) => (globs, { onlyDirectories }) => glob(globs, onlyDirectories ? { cwd: dir, onlyDirectories: true } : { cwd: dir, onlyFiles: true });
 const exists = async (path) => access(path).then(() => true, () => false);
+/**
+ * Is this the user's own properties file — as opposed to one Laneyard wrote
+ * and failed to clean up?
+ *
+ * `gradle-properties.ts` marks every file it writes with `LANEYARD_MARKER` as
+ * its first line, precisely so this check can tell the two apart. A run killed
+ * between writing the file and reaching its `finally` leaves a marked one
+ * behind in the persistent clone; counting it as the user's own signing
+ * configuration would flip the checklist from "the release build will use the
+ * debug key" to "the release key is used" — a green verdict Laneyard
+ * manufactured for itself out of a cleanup it failed to run.
+ *
+ * Reading fails the same way `exists` does: a missing file, a permission
+ * error, or one this process cannot open are all "not the user's file",
+ * because none of them is evidence of a real signing configuration.
+ */
+async function isUsersOwn(path) {
+    const text = await readFile(path, "utf8").catch(() => null);
+    if (text === null)
+        return false;
+    return (text.split("\n")[0] ?? "").trimEnd() !== LANEYARD_MARKER;
+}
+/**
+ * Is the properties file where the build script would look for it — and is it
+ * the user's, not Laneyard's own leftover?
+ *
+ * The module directory is the one holding the build script, and the Gradle root
+ * is its parent — `android/` for an `android/app/build.gradle`. Which of the two
+ * the name is relative to is the script's decision, and the parser reports which
+ * one it made. When it could not tell, both are looked in: answering "not in the
+ * clone" because the wrong directory was searched would have the checklist
+ * inventing the very failure it exists to catch. Both places apply the same
+ * marker rule — a leftover in either one is still Laneyard's, not the user's.
+ */
+async function isPresent(build, file) {
+    const { moduleDir, gradleRoot } = build;
+    const places = file.scope === "root"
+        ? [gradleRoot]
+        : file.scope === "module"
+            ? [moduleDir]
+            : [gradleRoot, moduleDir];
+    const found = await Promise.all(places.map((dir) => isUsersOwn(join(dir, file.name))));
+    return found.some(Boolean);
+}
+/**
+ * What the android build script says about release signing, and whether the
+ * file it depends on is in the clone.
+ *
+ * The listing is the caller's half of the answer, as everywhere else here: the
+ * check reads text and reaches for nothing. Which script speaks for the android
+ * side is `heuristics/android-root.ts`'s decision rather than this file's,
+ * because the runner writes the properties file against that same decision — see
+ * that module for why the two must not be able to disagree.
+ */
+async function androidSigning(workspacePath, appRoot, unreachable) {
+    if (unreachable !== null) {
+        return { androidSigning: { ok: false, reason: unreachable }, signingFilePresent: false };
+    }
+    const build = await findAndroidBuild(join(workspacePath, appRoot));
+    if (build === null) {
+        return {
+            androidSigning: { ok: false, reason: "no android build.gradle found in the clone" },
+            signingFilePresent: false,
+        };
+    }
+    const present = build.facts.conditionalOn === null ? false : await isPresent(build, build.facts.conditionalOn);
+    return { androidSigning: { ok: true, value: build.facts }, signingFilePresent: present };
+}
+/**
+ * What the keystore block says about the properties file, and nothing else.
+ *
+ * The block has to be decrypted to be asked — `property_names` and
+ * `properties_path` are stored with the passphrases — so the narrowing happens
+ * here, at the last point that touches plaintext. What crosses into the
+ * checklist is two settings a browser is already shown on the block's own form.
+ *
+ * A block that will not decrypt is not an error page: it is a keystore the
+ * checklist cannot speak for, and `credentials` already reports that separately.
+ */
+function keystoreSetting(vault, slug) {
+    try {
+        const block = vault.resolveCredential(slug, "android_keystore");
+        if (!block)
+            return null;
+        const path = (block.fields["properties_path"] ?? "").trim();
+        return { propertyNames: propertyNames(block.fields), propertiesPath: path === "" ? null : path };
+    }
+    catch {
+        return null;
+    }
+}
 export async function registerReadinessRoutes(app, ctx) {
     /**
      * Computed only when asked for.
@@ -63,15 +163,61 @@ export async function registerReadinessRoutes(app, ctx) {
         }
         const resolved = await ctx.config.resolve(slug, workspacePath);
         const fastlaneDir = resolved?.settings.fastlane_dir ?? "fastlane";
-        const uses = unreachable !== null
+        const read = unreachable !== null
             ? { ok: false, reason: unreachable }
             : await ctx
                 .uses(slug, workspacePath, fastlaneDir)
-                .then((lanes) => ({ ok: true, value: lanes }))
+                .then((value) => ({ ok: true, value }))
                 // Broken Fastfile, no Ruby, no fastlane: all of them are "could not
                 // tell", none of them is a 500.
                 .catch((cause) => ({ ok: false, reason: cause.message }));
-        const checks = await runChecks({
+        const uses = read.ok
+            ? { ok: true, value: read.value.lanes }
+            : { ok: false, reason: read.reason };
+        // What reading the Fastfile could not account for. `fastlane/actions` is the
+        // caller's half of the answer — a directory listing, not something the Ruby
+        // parser could know — and the sidecar supplies the other, `import`. A check
+        // that would conclude something from finding nothing consults this first.
+        const unread = read.ok
+            ? {
+                ok: true,
+                value: {
+                    imports: read.value.imports,
+                    customActions: await exists(join(workspacePath, fastlaneDir, "actions")),
+                },
+            }
+            : { ok: false, reason: read.reason };
+        // What the project builds for decides which half of the checklist applies.
+        // `laneyard.yml` answers on its own; without it the workspace is looked at,
+        // and an unreachable workspace is a "could not tell" rather than a claim
+        // that the repository holds neither an Xcode project nor a Gradle build.
+        const configured = resolved?.settings.platforms;
+        const platforms = unreachable !== null && (configured === undefined || configured.length === 0)
+            ? { ok: false, reason: unreachable }
+            : {
+                ok: true,
+                // Beside the Fastfile rather than at the repository root: in a
+                // monorepo the app is one directory down, and so are its platform
+                // folders.
+                value: await resolvePlatforms(configured, findIn(searchDir(workspacePath, appRootOf(fastlaneDir)))),
+            };
+        // The Appfile is fastlane's own file, beside the Fastfile, and it is where a
+        // project configured long before it met Laneyard keeps its Play Store
+        // service account. An absent one is a fact — `NO_APPFILE` — not a failure;
+        // an unreachable workspace is the only reason this cannot be answered.
+        const appfile = unreachable !== null
+            ? { ok: false, reason: unreachable }
+            : await readFile(join(workspacePath, fastlaneDir, "Appfile"), "utf8").then((text) => ({ ok: true, value: parseAppfile(text) }), 
+            // Missing, unreadable, a directory: all of them mean the same to a
+            // check, which is that the Appfile says nothing.
+            () => ({ ok: true, value: NO_APPFILE }));
+        // Listed the same way platforms are, from the clone rather than from any
+        // path a Fastfile mentions: what is asked is "does the repository carry a
+        // key", which is a question about the repository.
+        const keyFilesInRepo = unreachable !== null
+            ? { ok: false, reason: unreachable }
+            : await glob(["**/*.p8"], { cwd: workspacePath, onlyFiles: true, dot: true }).then((found) => ({ ok: true, value: found.sort() }), (cause) => ({ ok: false, reason: cause.message }));
+        const sections = await runChecklist({
             probeRepository: () => workspace.probeRemote(),
             dependencies: {
                 workspace: unreachable !== null
@@ -82,8 +228,31 @@ export async function registerReadinessRoutes(app, ctx) {
             },
             // Names only: the vault never hands a value to anything but a run.
             secretKeys: ctx.vault.list(slug).map((s) => s.key),
+            // Which blocks apply, resolved the way a run resolves them — a project's
+            // own shadowing a global one — so the checklist and the run cannot
+            // disagree about whether a credential exists.
+            blocks: ctx.vault.listCredentials(slug).map((c) => c.kind),
+            // And the names those blocks will export, which the environment check
+            // counts as supplied — Laneyard writes the file and sets the variable
+            // itself, so a lane reading it is not a lane short of anything. The same
+            // list the secrets screen is given, from the same call.
+            blockNames: exportedVarNames(ctx.vault.listCredentials(slug)),
+            keystore: keystoreSetting(ctx.vault, slug),
             uses,
+            platforms,
+            appfile,
+            keyFilesInRepo,
+            unread,
+            // A run inherits the server's environment, so a variable exported where
+            // Laneyard was started really is available to a lane. Names only: a
+            // checklist has no business reading a value, here least of all.
+            serverEnv: Object.keys(process.env),
+            ...(await androidSigning(workspacePath, appRootOf(fastlaneDir), unreachable)),
+            declaredSecrets: [
+                ...(resolved?.settings.required_secrets ?? []),
+                ...(await envExampleNames(workspacePath, fastlaneDir)),
+            ],
         });
-        return { checkedAt: new Date().toISOString(), checks };
+        return { checkedAt: new Date().toISOString(), sections };
     });
 }

package/dist/src/server/routes/secrets.js

@@ -1,4 +1,6 @@
 import { MIN_LENGTH as MIN_REDACTABLE } from "../../logs/redact.js";
+import { exportedVarNames } from "../../credentials/kinds.js";
+import { requiredSecrets } from "../required-secrets.js";
 /** POSIX environment variable names. Anything else would never reach fastlane. */
 const VALID_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
 export async function registerSecretRoutes(app, ctx) {
@@ -39,6 +41,105 @@ export async function registerSecretRoutes(app, ctx) {
             return reply.code(404).send({ error: "Unknown project" });
         return put(slug, key, req.body, reply);
     });
+    /**
+     * One value, in the clear — and only one that was never declared secret.
+     *
+     * A separate route rather than a field on the listing, so that reading a value
+     * is always a deliberate request for one named key. A listing that carried
+     * values would put every one of them in a browser at once, for a page most
+     * people open to check a name.
+     */
+    app.get("/api/projects/:slug/secrets/:key/value", async (req, reply) => {
+        const { slug, key } = req.params;
+        if (!ctx.config.project(slug))
+            return reply.code(404).send({ error: "Unknown project" });
+        try {
+            const value = ctx.vault.reveal(slug, key);
+            if (value === null)
+                return reply.code(404).send({ error: "Unknown secret" });
+            return { key, value };
+        }
+        catch (cause) {
+            // The vault refuses a masked value whoever asks. 409 rather than 403: the
+            // request is not forbidden to this account, it is refused for this secret.
+            return reply.code(409).send({ error: cause.message });
+        }
+    });
+    /**
+     * Turns the redaction on or off, leaving the value alone.
+     *
+     * Needed because of a circle: to read a value you must first declare it not
+     * secret, and declaring that by storing it again would mean typing the value
+     * you were trying to read.
+     */
+    app.patch("/api/projects/:slug/secrets/:key", async (req, reply) => {
+        const { slug, key } = req.params;
+        if (!ctx.config.project(slug))
+            return reply.code(404).send({ error: "Unknown project" });
+        const { masked } = (req.body ?? {});
+        if (typeof masked !== "boolean") {
+            return reply.code(400).send({ error: "`masked` is true or false." });
+        }
+        const existing = ctx.vault.list(slug).find((s) => s.key === key);
+        if (!existing)
+            return reply.code(404).send({ error: "Unknown secret" });
+        if (existing.scope === "global") {
+            // The same rule the interface draws: a global secret belongs to every
+            // project, so changing it from inside one would hide that from the rest.
+            return reply.code(409).send({ error: "That is a global secret. Change it with `laneyard secret set`." });
+        }
+        // A value too short to redact cannot be masked, the same refusal as on the
+        // way in — accepting it would leave someone believing they are protected.
+        if (masked) {
+            const value = ctx.vault.reveal(slug, key);
+            if (value !== null && value.length < MIN_REDACTABLE) {
+                return reply.code(400).send({
+                    error: `A value kept out of the logs must be at least ${MIN_REDACTABLE} characters.`,
+                });
+            }
+        }
+        ctx.vault.setMasked(slug, key, masked);
+        return reply.code(204).send();
+    });
+    /**
+     * The names this project needs, and which of them are still missing.
+     *
+     * Exists so the secrets screen can put the form up with the names already in
+     * it. Someone arriving here has just been told by the checklist that eight
+     * variables are missing; retyping those eight names by hand, correctly, is a
+     * chore where one typo stores a secret nothing will ever read.
+     *
+     * Names only, and never a value from anywhere: the file that holds the real
+     * ones is the file that does not reach a clone, which is the problem rather
+     * than a source. What goes in the boxes is typed by a person.
+     */
+    app.get("/api/projects/:slug/required-secrets", async (req, reply) => {
+        const { slug } = req.params;
+        if (!ctx.config.project(slug))
+            return reply.code(404).send({ error: "Unknown project" });
+        const workspacePath = ctx.workspacePath(slug);
+        const resolved = await ctx.config.resolve(slug, workspacePath);
+        const fastlaneDir = resolved?.settings.fastlane_dir ?? "fastlane";
+        // A workspace that was never cloned, or a Fastfile that will not parse, is
+        // a reason to offer nothing — not a reason to fail the page someone opened
+        // to store a secret by hand.
+        const lanes = await ctx
+            .uses(slug, workspacePath, fastlaneDir)
+            .then((u) => u.lanes)
+            .catch(() => []);
+        return requiredSecrets({
+            lanes,
+            declared: resolved?.settings.required_secrets ?? [],
+            workspacePath,
+            fastlaneDir,
+            vaultKeys: ctx.vault.list(slug).map((s) => s.key),
+            // Resolved the way a run resolves them, a project's own block shadowing a
+            // global one, so the form and the checklist cannot disagree about what is
+            // already supplied.
+            blockNames: exportedVarNames(ctx.vault.listCredentials(slug)),
+            serverEnv: Object.keys(process.env),
+        });
+    });
     app.delete("/api/secrets/:key", async (req, reply) => {
         const removed = ctx.vault.remove(null, req.params.key);
         return removed ? reply.code(204).send() : reply.code(404).send({ error: "Unknown secret" });

package/dist/src/server/routes/users.js

@@ -0,0 +1,64 @@
+import { MIN_PASSWORD_LENGTH, VALID_NAME, refusalFor, removeUserFromConfig, upsertUserInConfig, } from "../../config/accounts.js";
+const ROLES = ["admin", "builder"];
+/**
+ * The accounts, as the interface sees them.
+ *
+ * Every route here is on the admin list in `permissions.ts`, so nothing below
+ * checks a role: the hook already refused anyone who has no business here, and
+ * a second check inside a handler is a permission nobody finds during an audit.
+ */
+export async function registerUserRoutes(app, ctx) {
+    const accounts = () => ctx.config.server()?.users ?? [];
+    // Name and role, and that is the whole shape. The hash is not truncated or
+    // masked on the way out — it is simply never put on the wire.
+    app.get("/api/users", async () => accounts().map((u) => ({ name: u.name, role: u.role })));
+    app.post("/api/users", async (req, reply) => {
+        const { name, role, password } = (req.body ?? {});
+        if (typeof name !== "string" || !VALID_NAME.test(name)) {
+            return reply.code(400).send({
+                error: "A name is letters, digits, dot, dash and underscore, starting with a letter or a digit.",
+            });
+        }
+        if (typeof role !== "string" || !ROLES.includes(role)) {
+            return reply.code(400).send({ error: `A role is ${ROLES.join(" or ")}.` });
+        }
+        if (typeof password !== "string" || password.length < MIN_PASSWORD_LENGTH) {
+            return reply
+                .code(400)
+                .send({ error: `A password is at least ${MIN_PASSWORD_LENGTH} characters.` });
+        }
+        const refusal = refusalFor(accounts(), name, role);
+        if (refusal)
+            return reply.code(409).send({ error: refusal });
+        const { created } = await upsertUserInConfig(ctx.config.configPath(), {
+            name,
+            role: role,
+            password,
+        });
+        // Replacing an account changes the password and possibly the role, and a
+        // session holds neither — it holds a snapshot taken at login. The sessions
+        // go, so that what was just written is what is true everywhere.
+        if (!created)
+            ctx.sessions.revokeAllFor(name);
+        // The file is watched, but on a debounce: reloading here is what makes the
+        // very next request — the listing this page is about to ask for — truthful,
+        // and what lets the new account log in immediately.
+        await ctx.config.load();
+        return reply.code(created ? 201 : 200).send({ name, role });
+    });
+    app.delete("/api/users/:name", async (req, reply) => {
+        const { name } = req.params;
+        if (!accounts().some((u) => u.name === name)) {
+            return reply.code(404).send({ error: "Unknown account" });
+        }
+        const refusal = refusalFor(accounts(), name, null);
+        if (refusal)
+            return reply.code(409).send({ error: refusal });
+        const removed = await removeUserFromConfig(ctx.config.configPath(), name);
+        if (!removed)
+            return reply.code(404).send({ error: "Unknown account" });
+        ctx.sessions.revokeAllFor(name);
+        await ctx.config.load();
+        return reply.code(204).send();
+    });
+}

package/dist/src/sidecar/bridge.js

@@ -1,10 +1,46 @@
 import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
 import { FASTLANE_UNAVAILABLE, resolveRubyEnv } from "./ruby-env.js";
 const exec = promisify(execFile);
-const SCRIPT = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "ruby", "introspect.rb");
+/**
+ * Locates `ruby/introspect.rb` from wherever this module happens to live.
+ *
+ * Two layouts, and only trying one of them is how listing lanes came to be
+ * broken in every installed copy while working perfectly from the sources:
+ * `src/sidecar/` sits two levels under the package root, `dist/src/sidecar/`
+ * sits three. The package ships `ruby/` at its root in both cases.
+ */
+export function resolveSidecarScript(moduleDir) {
+    const candidates = [
+        join(moduleDir, "..", "..", "ruby", "introspect.rb"),
+        join(moduleDir, "..", "..", "..", "ruby", "introspect.rb"),
+    ];
+    return candidates.find((candidate) => existsSync(candidate)) ?? candidates[0];
+}
+const SCRIPT = resolveSidecarScript(dirname(fileURLToPath(import.meta.url)));
+/**
+ * A digest of the sidecar script, for whoever caches what it produced.
+ *
+ * Caching introspection on the fastlane folder's contents alone is wrong in one
+ * direction that is easy to miss: the answer depends on the *reader* as much as
+ * on what is read. Teaching the parser to follow a lane into the methods it
+ * calls changed what a Fastfile means without changing the Fastfile, so every
+ * existing install went on being served the answer from before — a Play Store
+ * check reporting "no lane uploads", permanently, on a project that uploads.
+ *
+ * Hashing the script rather than bumping a constant is what keeps that from
+ * happening again: there is nothing to remember. Read once, because the file
+ * cannot change under a running process that already loaded it.
+ */
+let scriptDigest = null;
+export function sidecarVersion() {
+    scriptDigest ??= createHash("sha256").update(readFileSync(SCRIPT)).digest("hex").slice(0, 16);
+    return scriptDigest;
+}
 /**
  * Runs the sidecar in the project's context.
  * In `bundle` mode, the invocation goes through `bundle exec` to see the

package/dist/src/sidecar/fastlane-dir.js

@@ -0,0 +1,23 @@
+import { stat } from "node:fs/promises";
+/**
+ * Refuses a missing fastlane directory with a sentence instead of an ENOENT.
+ *
+ * The raw error read `ENOENT: no such file or directory, scandir
+ * '…/workspaces/popotheque-app/fastlane'` — technically accurate and no help at
+ * all, because the interesting part is *why* it was looking there.
+ *
+ * It is nearly always the same story. `laneyard setup` writes `laneyard.yml`
+ * into the working copy, and Laneyard builds from a clone of the remote, so the
+ * file that says where fastlane lives does not reach the clone until it is
+ * committed and pushed. Until then `fastlane_dir` falls back to `fastlane`,
+ * which in a monorepo is not where anything is.
+ */
+export async function assertFastlaneDir(dir, configured) {
+    const found = await stat(dir).then((s) => s.isDirectory(), () => false);
+    if (found)
+        return;
+    throw new Error(`No ${configured}/ in the clone. Laneyard builds from a clone of the remote, ` +
+        "so `laneyard.yml` only takes effect once it is committed and pushed — " +
+        "until then this falls back to `fastlane`. Push it, or set `fastlane_dir` " +
+        "on the project's block in config.yml.");
+}

package/dist/src/sidecar/lanes.js

@@ -1,13 +1,19 @@
 import { createHash } from "node:crypto";
 import { readdir, readFile } from "node:fs/promises";
 import { join } from "node:path";
+import { sidecarVersion } from "./bridge.js";
+import { assertFastlaneDir } from "./fastlane-dir.js";
 /**
  * Hash of the whole fastlane folder, not just the Fastfile:
  * an Appfile, a Pluginfile, or an imported file change the lanes just as much.
  */
 async function hashFastlaneDir(root, fastlaneDir) {
     const dir = join(root, fastlaneDir);
+    await assertFastlaneDir(dir, fastlaneDir);
     const hash = createHash("sha256");
+    // Same reason as in `uses.ts`: the reader is part of the key, so improving the
+    // sidecar cannot leave an install served by what the old one concluded.
+    hash.update(sidecarVersion());
     const entries = (await readdir(dir, { withFileTypes: true, recursive: true }))
         .filter((e) => e.isFile())
         .map((e) => join(e.parentPath, e.name))