laneyard 0.3.0 → 0.4.0

package/dist/src/cli/secret.js

@@ -1,17 +1,29 @@
+import { execFile } from "node:child_process";
 import { join } from "node:path";
+import { promisify } from "node:util";
+import { readFile } from "node:fs/promises";
+import { applyImport, envFilesIn, parseEnvFile, planImport } from "./secret-import.js";
 import { ConfigStore } from "../config/store.js";
 import { openDatabase } from "../db/open.js";
+import { CredentialStore } from "../db/credentials.js";
 import { SecretStore } from "../db/secrets.js";
 import { MIN_LENGTH as MIN_REDACTABLE } from "../logs/redact.js";
 import { Vault } from "../secrets/vault.js";
 /** Same rule as the API: what cannot become an environment variable is refused here too. */
 const VALID_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
 export const SECRET_USAGE = `laneyard secret set <NAME> [--project <slug>] [--no-mask]
+laneyard secret import --project <slug> [--yes]
 
 The value is read from standard input, never from an argument:
 
   laneyard secret set MATCH_PASSWORD --project app
   echo "$TOKEN" | laneyard secret set GITHUB_TOKEN
+
+\`import\` reads this project's fastlane/.env and stores what it finds. A
+variable naming a service account JSON has the *file* stored, under the name
+fastlane looks for — a path does not travel to a build machine. A variable
+naming a .p8 is left alone and reported instead: that credential belongs in a
+signing block from the secrets tab, not in a loose variable.
 `;
 /**
  * Reads standard input whole.
@@ -69,6 +81,9 @@ function parse(args) {
  */
 export async function runSecretCommand(home, args, io) {
     const [subcommand, ...rest] = args;
+    if (subcommand === "import") {
+        return runSecretImport(home, rest, io);
+    }
     if (subcommand !== "set") {
         io.err(subcommand === undefined ? `${SECRET_USAGE}` : `Unknown subcommand: ${subcommand}\n\n${SECRET_USAGE}`);
         return 1;
@@ -121,7 +136,7 @@ export async function runSecretCommand(home, args, io) {
     }
     const db = openDatabase(join(home, "laneyard.db"));
     try {
-        const vault = await Vault.open(home, new SecretStore(db));
+        const vault = await Vault.open(home, new SecretStore(db), new CredentialStore(db));
         await vault.set(parsed.project, parsed.key, value, parsed.masked);
     }
     finally {
@@ -131,3 +146,149 @@ export async function runSecretCommand(home, args, io) {
         `  ${parsed.masked ? "kept out of the logs" : "shown in the logs"}\n`);
     return 0;
 }
+/**
+ * `laneyard secret import` — the existing `.env` into the vault.
+ *
+ * Shows what it would do before doing it, in names only. An import that reads
+ * eight files and writes eight secrets before saying a word is one nobody can
+ * check, and this is the one command that handles every credential a project
+ * has at once.
+ */
+async function runSecretImport(home, args, io) {
+    let project = null;
+    let yes = false;
+    for (let i = 0; i < args.length; i += 1) {
+        const arg = args[i];
+        if (arg === "--project" || arg === "-p") {
+            const next = args[i + 1];
+            if (next === undefined || next.startsWith("-")) {
+                io.err("--project needs a slug.\n");
+                return 1;
+            }
+            project = next;
+            i += 1;
+        }
+        else if (arg === "--yes" || arg === "-y") {
+            yes = true;
+        }
+        else {
+            io.err(`Unknown option: ${arg}\n\n${SECRET_USAGE}`);
+            return 1;
+        }
+    }
+    if (project === null) {
+        io.err("Which project? Give it with --project <slug>.\n");
+        return 1;
+    }
+    const config = new ConfigStore(join(home, "config.yml"));
+    const loaded = await config.load();
+    if (!loaded.ok) {
+        io.err(`Unreadable configuration in ${join(home, "config.yml")}: ${loaded.error}\n`);
+        return 1;
+    }
+    const entry = config.project(project);
+    if (!entry) {
+        const known = config.projects().map((p) => p.slug);
+        io.err(`Unknown project: "${project}".` +
+            (known.length > 0 ? ` Known projects: ${known.join(", ")}.` : " No project is declared yet.") +
+            "\n");
+        return 1;
+    }
+    // Read from the working copy this command was run in — the only place a
+    // gitignored `.env` exists; the server's clone never has one.
+    //
+    // Resolved against the repository root, not the current directory:
+    // `fastlane_dir` is recorded relative to the root, so running this from
+    // `app/` would otherwise look for `app/app/fastlane/.env`. The same
+    // confusion, one command along, as the one that produced an ENOENT in the
+    // lane list.
+    const fastlaneDir = entry.fastlane_dir ?? "fastlane";
+    const root = await repositoryRoot(process.cwd());
+    const env = new Map();
+    const readFrom = [];
+    for (const file of envFilesIn(fastlaneDir)) {
+        const text = await readFile(join(root, file), "utf8").catch(() => null);
+        if (text === null)
+            continue;
+        readFrom.push(file);
+        for (const [k, v] of parseEnvFile(text))
+            env.set(k, v);
+    }
+    if (readFrom.length === 0) {
+        io.err(`No ${fastlaneDir}/.env under ${root}. Run this from the working copy that has one — ` +
+            "it is the file that never reaches a clone, which is the whole reason for this command.\n");
+        return 1;
+    }
+    const db = openDatabase(join(home, "laneyard.db"));
+    try {
+        const vault = await Vault.open(home, new SecretStore(db), new CredentialStore(db));
+        // Paths inside a `.env` are written relative to where fastlane runs, which
+        // is the fastlane directory's parent — the app, not the repository root.
+        const plan = await planImport(env, join(root, fastlaneDir, ".."), vault.list(project).map((s) => s.key));
+        if (plan.planned.length === 0) {
+            io.out(`Nothing to import from ${readFrom.join(" and ")}.\n`);
+            return 0;
+        }
+        io.out(`\nFrom ${readFrom.join(" and ")}, into "${project}":\n\n`);
+        for (const item of plan.planned) {
+            if (item.kind === "unresolved-path") {
+                io.out(`  ✗ ${item.key} — names ${item.path}, which is not there. Skipped.\n`);
+            }
+            else if (item.kind === "suggest-block") {
+                io.out(`  ▸ ${item.key} names ${item.path} — no action in fastlane reads that variable. ` +
+                    "Upload the `.p8` as an App Store Connect key block from the secrets tab instead, with " +
+                    "its key id and issuer id. Not imported here.\n");
+            }
+            else if (item.kind === "file-contents") {
+                io.out(`  ● ${item.key}${item.from ? ` (the contents of ${item.from})` : ""}\n`);
+            }
+            else {
+                io.out(`  ● ${item.key}\n`);
+            }
+        }
+        if (plan.replacing.length > 0) {
+            io.out(`\n  ${plan.replacing.join(", ")} already in the vault — they will be replaced.\n`);
+        }
+        const skipped = plan.planned.filter((p) => p.kind === "unresolved-path");
+        if (skipped.length > 0) {
+            io.out("\n  A skipped file is the credential this project most needs. Check the path.\n");
+        }
+        if (!yes) {
+            io.out("\nNothing is written yet. Run it again with --yes to store these.\n");
+            return 0;
+        }
+        const stored = await applyImport(vault, project, plan);
+        io.out(`\n✓ Stored ${stored} ${stored === 1 ? "secret" : "secrets"}, all kept out of the logs.\n`);
+        // Said here because it is easy to assume an import leaves lanes with
+        // homework. It does not: `key_filepath:` and `json_key:` are the supported
+        // forms, not a stopgap. A signing credential block writes its file to disk
+        // for the length of a run, so a lane that names a path keeps reading a
+        // real one, unedited.
+        io.out("\nNothing in your lanes needs to change. `key_filepath:` and `json_key:` keep working as " +
+            "written. From here, a `.p8` or a service account JSON belongs in a signing credential block " +
+            "from the secrets tab, not as a loose variable in this file.\n");
+        return 0;
+    }
+    finally {
+        db.close();
+    }
+}
+/**
+ * The repository root, or the directory given if this is not a repository.
+ *
+ * `fastlane_dir` is recorded relative to the root — that is what the clone is
+ * measured from — so anything resolving it has to agree about where the root is,
+ * whichever sub-directory the command happens to be run from.
+ */
+async function repositoryRoot(from) {
+    try {
+        const { stdout } = await promisify(execFile)("git", ["rev-parse", "--show-toplevel"], {
+            cwd: from,
+            timeout: 5_000,
+        });
+        return stdout.trim() || from;
+    }
+    catch {
+        return from;
+    }
+}

package/dist/src/cli/setup.js

@@ -33,13 +33,25 @@ export async function addProjectToConfig(path, entry) {
     const seq = projects instanceof YAMLSeq ? projects : new YAMLSeq();
     if (!(projects instanceof YAMLSeq))
         doc.setIn(["projects"], seq);
-    for (const item of seq.items) {
-        const slug = item.get?.("slug");
-        if (slug === entry.slug) {
-            throw new Error(`A project already uses the slug "${entry.slug}" in ${path}`);
-        }
+    // An entry of the same name is updated, not refused.
+    //
+    // Setup prints "Continuing replaces its entry" before asking anything, and
+    // then this threw — so the one way to correct a stale entry, running setup
+    // again, was the one thing that could not be done. A project written by an
+    // older version and missing a field it now needs was unfixable except by hand.
+    //
+    // Field by field rather than wholesale, though the warning says "replaces":
+    // an entry may carry things setup knows nothing about — a `git_auth` pointing
+    // at an SSH key, a raised `timeout_minutes` — and losing those silently, on a
+    // command someone ran to fix something else, would be its own bug.
+    const existing = seq.items.find((item) => item.get?.("slug") === entry.slug);
+    if (existing?.set) {
+        for (const [key, value] of Object.entries(entry))
+            existing.set(key, value);
+    }
+    else {
+        seq.add(doc.createNode(entry));
     }
-    seq.add(doc.createNode(entry));
     await writeFile(path, serialize(doc), "utf8");
 }
 /**
@@ -105,7 +117,8 @@ export async function runSetupCommand(cwd, configPath, options = {}) {
         if (existing) {
             process.stdout.write("\n" +
                 warn(`This machine already knows a project called ${bold(existing)}.\n`) +
-                dim("  Continuing replaces its entry. Give it another name to keep both.\n"));
+                dim("  Continuing updates its entry, keeping anything you added by hand.\n") +
+                dim("  Give it another name to keep both.\n"));
         }
         const repoConfigPath = join(repoRoot(cwd, d.subPath), LANEYARD_YML);
         if (await fileExists(repoConfigPath)) {
@@ -163,6 +176,30 @@ export async function runSetupCommand(cwd, configPath, options = {}) {
             name: slug,
             git_url: gitUrl,
             default_branch: branch,
+            // Written on this machine too, and only when it is not the default,
+            // because of the gap between the two files. Laneyard builds from a clone
+            // of the remote, so nothing written into the working copy reaches it
+            // until `laneyard.yml` is committed and pushed — and until then
+            // `fastlane_dir` falls back to `fastlane`, which in a monorepo is not
+            // where anything is. The project was unreadable from the moment setup
+            // finished until a git push, with an ENOENT for an explanation.
+            //
+            // This is not a second source of truth: the repository file wins the
+            // moment it lands, which is the precedence `config.yml` already
+            // documents and the schema already allows. It is the value setup just
+            // proposed and the user just accepted, kept where it is useful until the
+            // authoritative copy arrives.
+            //
+            // Omitted when it *is* the default, so an ordinary project's block stays
+            // about how the project is reached and nothing else.
+            // Both of the fields the sidecar needs before it can read anything, and
+            // only when they are not already the default. `runtime` belongs here for
+            // exactly the same reason as `fastlane_dir`: without it the sidecar is
+            // launched under `bundle exec` and a project that uses a system fastlane
+            // fails with "Could not locate Gemfile" — the same bootstrap gap, one
+            // field along.
+            ...(fastlaneDir === "fastlane" ? {} : { fastlane_dir: fastlaneDir }),
+            ...(runtime === "bundle" ? {} : { runtime }),
         });
         // The repository half: how it builds. This is the part that was going into
         // the machine's file and therefore never being committed — which is exactly

package/dist/src/credentials/kinds.js

@@ -0,0 +1,120 @@
+/**
+ * What each kind of credential block is made of — the one table the server,
+ * runner, readiness checks, and web UI all read, so an agreement kept in one
+ * place instead of copied four times.
+ *
+ * Apple and Play defaults are the names fastlane itself reads — verified
+ * against fastlane 2.237: `app_store_connect_api_key` declares
+ * `APP_STORE_CONNECT_API_KEY_KEY_FILEPATH` / `_KEY_ID` / `..._ISSUER_ID`,
+ * and `supply` declares `SUPPLY_JSON_KEY`.
+ *
+ * Android defaults are Laneyard's own — nothing in fastlane reads a keystore
+ * by convention. `ANDROID_KEYSTORE_PASSWORD` was not chosen freely: it
+ * matches the `/(^|_)(KEYSTORE|STORE)_PASSWORD$/` pattern that
+ * `src/heuristics/readiness.ts` already recognises, so the check and the
+ * block agree by construction rather than by coincidence.
+ */
+export const CREDENTIAL_KINDS = [
+    {
+        kind: "apple_asc",
+        platform: "ios",
+        what: "app store connect key",
+        accept: ".p8",
+        fields: [
+            { name: "key_id", secret: false, label: "Key ID" },
+            { name: "issuer_id", secret: false, label: "Issuer ID" },
+        ],
+        defaults: {
+            path: "APP_STORE_CONNECT_API_KEY_KEY_FILEPATH",
+            key_id: "APP_STORE_CONNECT_API_KEY_KEY_ID",
+            issuer_id: "APP_STORE_CONNECT_API_KEY_ISSUER_ID",
+        },
+    },
+    {
+        kind: "android_keystore",
+        platform: "android",
+        what: "android upload keystore",
+        accept: ".jks,.keystore",
+        fields: [
+            { name: "key_alias", secret: false, label: "Key alias" },
+            { name: "store_password", secret: true, label: "Store password" },
+            { name: "key_password", secret: true, label: "Key password" },
+            // The two things about a gradle properties file that cannot be deduced.
+            // `runner/gradle-properties.ts` writes that file where a build script
+            // falls back to the debug key; the script names the file, and says
+            // nothing about where the name is resolved when the receiver is a
+            // variable, nor about the keys read out of it afterwards. Both are asked
+            // here, pre-filled from what detection could tell, and left empty rather
+            // than guessed when it could tell nothing.
+            {
+                name: "properties_path",
+                secret: false,
+                optional: true,
+                label: "Properties file, relative to the app",
+            },
+            {
+                name: "property_names",
+                secret: false,
+                optional: true,
+                suggested: "storeFile,storePassword,keyPassword,keyAlias",
+                label: "Names your build reads inside it",
+            },
+        ],
+        defaults: {
+            path: "ANDROID_KEYSTORE_PATH",
+            store_password: "ANDROID_KEYSTORE_PASSWORD",
+            key_alias: "ANDROID_KEY_ALIAS",
+            key_password: "ANDROID_KEY_PASSWORD",
+        },
+    },
+    {
+        kind: "play_service_account",
+        platform: "android",
+        what: "play store service account",
+        accept: ".json,application/json",
+        fields: [],
+        defaults: {
+            path: "SUPPLY_JSON_KEY",
+        },
+    },
+];
+function specOf(kind) {
+    const spec = CREDENTIAL_KINDS.find((k) => k.kind === kind);
+    if (!spec)
+        throw new Error(`unknown credential kind: ${kind}`);
+    return spec;
+}
+export function defaultVarNames(kind) {
+    return specOf(kind).defaults;
+}
+export function fieldsOf(kind) {
+    return specOf(kind).fields;
+}
+/**
+ * The variable names a set of stored blocks will export into a run.
+ *
+ * Read off the summaries — the kind and the names stored beside it — so nothing
+ * here decrypts anything. That is what lets the readiness check and the secrets
+ * screen both ask the question: a name a block supplies is a name the project
+ * already has, and asking someone to type it by hand is asking them for what
+ * Laneyard is about to hand the run itself.
+ *
+ * Every name in the block is counted, and no value is looked at. `path` is
+ * always exported, and every other slot belongs to a field the block could not
+ * be stored without — `credentials.ts` refuses a block with a required field
+ * empty, and the optional two have no slot at all. So a name here is a name
+ * `runner/materialise.ts` will set.
+ *
+ * The blocks passed in are the ones that apply, project shadowing global, which
+ * is `Vault.listCredentials` and the precedence a run uses.
+ */
+export function exportedVarNames(blocks) {
+    const names = new Set();
+    for (const block of blocks) {
+        for (const name of Object.values({ ...defaultVarNames(block.kind), ...block.varNames })) {
+            if (name)
+                names.add(name);
+        }
+    }
+    return [...names].sort();
+}

package/dist/src/db/credentials.js

@@ -0,0 +1,75 @@
+const GLOBAL = "";
+/**
+ * Stores signing credential blocks: a file plus the fields that make it
+ * usable. Knows nothing about encryption itself: it takes and returns
+ * ciphertext, so a bug here cannot leak a plaintext value.
+ *
+ * A project credential shadows a global one of the same kind — the same
+ * precedence as `SecretStore`, and the least surprising rule.
+ */
+export class CredentialStore {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    set(projectSlug, kind, input) {
+        this.db
+            .prepare(`INSERT INTO credential (project_slug, kind, file_name, file_enc, fields_enc, var_names, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT (project_slug, kind) DO UPDATE
+           SET file_name  = excluded.file_name,
+               file_enc   = excluded.file_enc,
+               fields_enc = excluded.fields_enc,
+               var_names  = excluded.var_names,
+               updated_at = excluded.updated_at`)
+            .run(projectSlug ?? GLOBAL, kind, input.fileName, input.fileEnc, input.fieldsEnc, JSON.stringify(input.varNames), new Date().toISOString());
+    }
+    /** Rows that apply to a project, project scope winning over global. */
+    applicable(projectSlug) {
+        const rows = this.db
+            .prepare("SELECT * FROM credential WHERE project_slug IN (?, ?) ORDER BY kind")
+            .all(projectSlug, GLOBAL);
+        const byKind = new Map();
+        for (const row of rows) {
+            const existing = byKind.get(row.kind);
+            if (!existing || row.project_slug !== GLOBAL)
+                byKind.set(row.kind, row);
+        }
+        return [...byKind.values()]
+            .sort((a, b) => a.kind.localeCompare(b.kind))
+            .map((row) => this.toSummary(row));
+    }
+    /** One applicable block, ciphertext included, or undefined. */
+    find(projectSlug, kind) {
+        return this.applicable(projectSlug).find((r) => r.kind === kind);
+    }
+    list(projectSlug) {
+        return this.applicable(projectSlug).map(({ fileEnc: _fileEnc, fieldsEnc: _fieldsEnc, ...summary }) => summary);
+    }
+    listGlobal() {
+        const rows = this.db
+            .prepare("SELECT * FROM credential WHERE project_slug = ? ORDER BY kind")
+            .all(GLOBAL);
+        return rows.map((row) => {
+            const { fileEnc: _fileEnc, fieldsEnc: _fieldsEnc, ...summary } = this.toSummary(row);
+            return summary;
+        });
+    }
+    remove(projectSlug, kind) {
+        const res = this.db
+            .prepare("DELETE FROM credential WHERE project_slug = ? AND kind = ?")
+            .run(projectSlug ?? GLOBAL, kind);
+        return res.changes > 0;
+    }
+    toSummary(row) {
+        return {
+            kind: row.kind,
+            fileName: row.file_name,
+            fileEnc: row.file_enc,
+            fieldsEnc: row.fields_enc,
+            scope: row.project_slug === GLOBAL ? "global" : "project",
+            varNames: JSON.parse(row.var_names),
+            updatedAt: row.updated_at,
+        };
+    }
+}

package/dist/src/db/schema.sql

@@ -61,3 +61,42 @@ CREATE TABLE IF NOT EXISTS secret (
   updated_at   TEXT    NOT NULL,
   PRIMARY KEY (project_slug, key)
 );
+
+-- A signing credential: a file plus the fields that make it usable. Separate
+-- from `secret` because these are not key/value pairs — stored as loose rows,
+-- nothing knew the parts belonged together, and deleting one left a half-dead
+-- group no check could detect.
+--
+-- `fields_enc` is one encrypted JSON object rather than a column per field: the
+-- three kinds do not share a shape, and a column per field would mean a
+-- migration every time a kind gains one.
+--
+-- `var_names` is NOT encrypted. It holds variable names, never values, and the
+-- interface has to display them.
+CREATE TABLE IF NOT EXISTS credential (
+  project_slug TEXT NOT NULL DEFAULT '',
+  kind         TEXT NOT NULL,
+  file_name    TEXT NOT NULL,
+  file_enc     TEXT NOT NULL,
+  fields_enc   TEXT NOT NULL,
+  var_names    TEXT NOT NULL,
+  updated_at   TEXT NOT NULL,
+  PRIMARY KEY (project_slug, kind)
+);
+
+-- Sessions outlive a restart, which is the whole reason they are here rather
+-- than in a Map. What is stored is a SHA-256 of the token, never the token: the
+-- cookie is a bearer credential, and a stolen `laneyard.db` must not hand
+-- anybody a live session the way a table of raw tokens would.
+--
+-- `expires_at` is an ISO timestamp compared as text, which sorts correctly
+-- because ISO-8601 does. A session with no end is not a convenience, it is a
+-- credential nobody can lose track of.
+CREATE TABLE IF NOT EXISTS session (
+  token_hash TEXT PRIMARY KEY,
+  name       TEXT NOT NULL,
+  role       TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS session_by_name ON session (name);

package/dist/src/db/secrets.js

@@ -34,6 +34,34 @@ export class SecretStore {
         }
         return [...byKey.values()].sort((a, b) => a.key.localeCompare(b.key));
     }
+    /** One applicable row, ciphertext included, or undefined. */
+    find(projectSlug, key) {
+        const row = this.applicable(projectSlug).find((r) => r.key === key);
+        return row
+            ? {
+                key: row.key,
+                masked: row.masked === 1,
+                scope: row.project_slug === GLOBAL ? "global" : "project",
+                valueEnc: row.value_enc,
+            }
+            : undefined;
+    }
+    /**
+     * Flips whether a value is kept out of the logs, leaving the value alone.
+     *
+     * Its own operation rather than a re-`set`, because of a circle: to reveal a
+     * value you must first declare it not secret, and declaring that by storing it
+     * again would mean typing the value you were trying to read.
+     *
+     * Returns false when no row matches, so a caller can answer 404 rather than
+     * report a change that did not happen.
+     */
+    setMasked(projectSlug, key, masked) {
+        return (this.db
+            .prepare(`UPDATE secret SET masked = ?, updated_at = ?
+           WHERE project_slug = ? AND key = ?`)
+            .run(masked ? 1 : 0, new Date().toISOString(), projectSlug ?? GLOBAL, key).changes > 0);
+    }
     list(projectSlug) {
         return this.applicable(projectSlug).map((row) => ({
             key: row.key,

package/dist/src/db/sessions.js

@@ -0,0 +1,61 @@
+import { createHash } from "node:crypto";
+/**
+ * A token is never stored, only its digest.
+ *
+ * SHA-256 without a salt on purpose, unlike a password: the token is 32 random
+ * bytes from `randomBytes`, so there is no dictionary to build and no cheaper
+ * attack than guessing the token itself. What this buys is that a copy of
+ * `laneyard.db` is a list of digests rather than a ring of working keys.
+ */
+const digest = (token) => createHash("sha256").update(token).digest("hex");
+/**
+ * Where sessions live between restarts.
+ *
+ * They used to live in a Map, with a comment saying they did not survive a
+ * restart "and that's just fine". It was not fine: a server restarted to pick
+ * up a configuration change signed everybody out, and on a machine you are
+ * still setting up that is several times an hour.
+ */
+export class SessionRecords {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    insert(token, owner, expiresAt) {
+        this.db
+            .prepare(`INSERT INTO session (token_hash, name, role, created_at, expires_at)
+         VALUES (?, ?, ?, ?, ?)`)
+            .run(digest(token), owner.name, owner.role, new Date().toISOString(), expiresAt.toISOString());
+    }
+    /** The owner, or undefined when the token is unknown or its time is up. */
+    find(token, now = new Date()) {
+        const row = this.db
+            .prepare(`SELECT name, role FROM session WHERE token_hash = ? AND expires_at > ?`)
+            .get(digest(token), now.toISOString());
+        return row ? { name: row.name, role: row.role } : undefined;
+    }
+    remove(token) {
+        this.db.prepare(`DELETE FROM session WHERE token_hash = ?`).run(digest(token));
+    }
+    removeAllFor(name) {
+        this.db.prepare(`DELETE FROM session WHERE name = ?`).run(name);
+    }
+    /**
+     * Drops what has already expired.
+     *
+     * Called at startup rather than on a timer: the rows are harmless — `find`
+     * already refuses them — so this is housekeeping, not correctness, and a
+     * timer would be a moving part earning nothing.
+     */
+    prune(now = new Date()) {
+        return this.db.prepare(`DELETE FROM session WHERE expires_at <= ?`).run(now.toISOString())
+            .changes;
+    }
+    /** Number of live sessions. Exposed so expiry can be tested without sleeping. */
+    count(now = new Date()) {
+        const row = this.db
+            .prepare(`SELECT COUNT(*) AS n FROM session WHERE expires_at > ?`)
+            .get(now.toISOString());
+        return row.n;
+    }
+}

package/dist/src/git/workspace.js

@@ -7,6 +7,27 @@ const exec = promisify(execFile);
  * A clone managed by Laneyard, kept between runs.
  * All git commands go through here to share the authentication environment.
  */
+/**
+ * The environment git needs to work without a person at the keyboard.
+ *
+ * Lifted out of `Workspace` because it is not only Workspace's problem. A lane
+ * may run git itself — pushing a bumped build number is a common and reasonable
+ * thing for a Fastfile to do — and that `sh("git push")` inherited none of
+ * this. The result was the worst possible failure: a push that needed a
+ * credential did not fail, it *waited*, and the run sat there until it hit its
+ * timeout with nothing in the log to say what it was waiting for.
+ *
+ * `GIT_TERMINAL_PROMPT=0` is what turns that wait into an error. The SSH
+ * command is what makes the push succeed instead — the key configured for
+ * cloning is by definition the right one for pushing to the same remote.
+ */
+export function gitEnvFor(auth) {
+    const env = { GIT_TERMINAL_PROMPT: "0" };
+    if (auth.kind === "ssh_key" && auth.ref) {
+        env["GIT_SSH_COMMAND"] = `ssh -i ${auth.ref} -o IdentitiesOnly=yes -o BatchMode=yes`;
+    }
+    return env;
+}
 export class Workspace {
     path;
     gitUrl;
@@ -17,12 +38,17 @@ export class Workspace {
         this.auth = auth;
     }
     env() {
-        // Without this, git can block on a credentials prompt and freeze the run.
-        const env = { ...process.env, GIT_TERMINAL_PROMPT: "0" };
-        if (this.auth.kind === "ssh_key" && this.auth.ref) {
-            env["GIT_SSH_COMMAND"] = `ssh -i ${this.auth.ref} -o IdentitiesOnly=yes -o BatchMode=yes`;
-        }
-        return env;
+        return { ...process.env, ...gitEnvFor(this.auth) };
+    }
+    /**
+     * The git identity this workspace would commit under, or null.
+     *
+     * Exposed because a lane that runs `git commit` itself needs the same answer,
+     * and a clone Laneyard made has no identity of its own — so the question is
+     * whether the *server* has one.
+     */
+    async identity() {
+        return this.gitIdentity();
     }
     /**
      * Replaces the repository URL with a neutral token in a piece of text.