laneyard 0.3.0 → 0.4.0

package/dist/src/server/app.js

@@ -6,14 +6,18 @@ import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { LEGACY_ADMIN_NAME } from "../config/load.js";
 import { RunStore } from "../db/runs.js";
+import { SessionRecords } from "../db/sessions.js";
 import { Workspace } from "../git/workspace.js";
 import { LogStore } from "../logs/store.js";
+import { materialiseCredentials } from "../runner/materialise.js";
 import { executeRun } from "../runner/orchestrate.js";
 import { RunQueue } from "../runner/queue.js";
-import { authenticate, LoginThrottle, SESSION_COOKIE, SessionStore } from "./auth.js";
+import { authenticate, LoginThrottle, COOKIE_OPTIONS, SESSION_COOKIE, SessionStore } from "./auth.js";
 import { requiresAdmin } from "./permissions.js";
+import { registerCredentialRoutes } from "./routes/credentials.js";
 import { registerFastfileRoutes } from "./routes/fastfile.js";
 import { registerProjectRoutes } from "./routes/projects.js";
+import { registerAccountRoutes } from "./routes/account.js";
 import { registerReadinessRoutes } from "./routes/readiness.js";
 import { registerRunRoutes } from "./routes/runs.js";
 import { registerSecretRoutes } from "./routes/secrets.js";
@@ -30,9 +34,10 @@ export async function buildApp(deps) {
         ...deps,
         runs: new RunStore(deps.db),
         logs: new LogStore(join(deps.root, "logs")),
-        sessions: new SessionStore(),
+        sessions: new SessionStore(new SessionRecords(deps.db)),
         workspacePath,
         artifactsDir: (runId) => join(deps.root, "artifacts", String(runId)),
+        runSecretsDir: (runId) => join(deps.root, "runs", String(runId), "secrets"),
         ensureWorkspace: async (slug) => {
             const entry = deps.config.project(slug);
             if (!entry)
@@ -61,6 +66,23 @@ export async function buildApp(deps) {
             });
             return;
         }
+        // Before the run, and outside it: `executeRun` is handed plaintext and
+        // never the vault, a boundary worth more than the convenience of moving
+        // this one call inside. A block that will not decrypt stops the run here,
+        // with the reason, rather than producing an artifact signed by nothing.
+        let credentials;
+        try {
+            credentials = await materialiseCredentials(ctx.vault, slug, ctx.runSecretsDir(runId));
+        }
+        catch (cause) {
+            ctx.runs.finish(runId, {
+                status: "failed",
+                exitCode: null,
+                errorSummary: ctx.vault.scrub(slug, cause.message),
+            });
+            ctx.sockets?.finish(runId, "failed");
+            return;
+        }
         await executeRun({
             runId,
             runs: ctx.runs,
@@ -77,6 +99,9 @@ export async function buildApp(deps) {
             },
             env: process.env,
             secrets: ctx.vault.resolve(slug),
+            credentialEnv: credentials.env,
+            androidKeystore: credentials.keystore,
+            cleanup: credentials.cleanup,
             maskedValues: ctx.vault.maskedValues(slug),
             signal,
             onChunk: (chunk, offset) => app.broadcastRunChunk?.(runId, chunk, offset),
@@ -130,7 +155,7 @@ export async function buildApp(deps) {
         throttle.recordSuccess(account);
         const token = ctx.sessions.issue(identity);
         return reply
-            .setCookie(SESSION_COOKIE, token, { path: "/", httpOnly: true, sameSite: "lax" })
+            .setCookie(SESSION_COOKIE, token, COOKIE_OPTIONS)
             .send({ ok: true, name: identity.name, role: identity.role });
     });
     // Every /api route except /api/login requires a session, and the routes on
@@ -180,9 +205,11 @@ export async function buildApp(deps) {
     await registerProjectRoutes(app, ctx);
     await registerRunRoutes(app, ctx);
     await registerSecretRoutes(app, ctx);
+    await registerCredentialRoutes(app, ctx);
     await registerReadinessRoutes(app, ctx);
     await registerFastfileRoutes(app, ctx);
     await registerUserRoutes(app, ctx);
+    await registerAccountRoutes(app, ctx);
     // Resolved from the module's location, not from the data folder:
     // `deps.root` is ~/.laneyard, the built SPA lives in the repository. Two
     // relative positions, depending on whether we're running on the sources

package/dist/src/server/auth.js

@@ -65,23 +65,47 @@ export async function authenticate(users, name, password) {
         return null;
     return { name: user.name, role: user.role };
 }
-/** In-memory sessions: they don't survive a restart, and that's just fine. */
+/**
+ * How long a session lasts, and how long the cookie is kept for.
+ *
+ * Thirty days, not forever: a browser left on a desk is the reason the password
+ * change asks for the current password, and a session that never ended would
+ * make that precaution pointless. The cookie carries the same figure, so the
+ * browser stops presenting a token the server would refuse anyway.
+ */
+export const SESSION_TTL_DAYS = 30;
+export const SESSION_TTL_MS = SESSION_TTL_DAYS * 24 * 60 * 60 * 1000;
+/**
+ * Sessions, kept in the database so they outlive a restart.
+ *
+ * They used to be a Map, with a comment saying they did not survive a restart
+ * "and that's just fine". It was not: restarting the server to pick up an edit
+ * to config.yml signed everybody out, which on a machine still being set up is
+ * several times an hour. The API is unchanged — every caller still issues, gets
+ * and revokes — only the shelf underneath is different.
+ */
 export class SessionStore {
-    tokens = new Map();
-    issue(identity) {
+    records;
+    constructor(records) {
+        this.records = records;
+    }
+    issue(identity, now = new Date()) {
         const token = randomBytes(32).toString("hex");
-        this.tokens.set(token, identity);
+        this.records.insert(token, identity, new Date(now.getTime() + SESSION_TTL_MS));
         return token;
     }
     /** Who the token belongs to, or undefined if it belongs to nobody. */
     get(token) {
-        return token === undefined ? undefined : this.tokens.get(token);
+        if (token === undefined)
+            return undefined;
+        const owner = this.records.find(token);
+        return owner ? { name: owner.name, role: owner.role } : undefined;
     }
     valid(token) {
         return this.get(token) !== undefined;
     }
     revoke(token) {
-        this.tokens.delete(token);
+        this.records.remove(token);
     }
     /**
      * Drops every session belonging to a name.
@@ -93,13 +117,29 @@ export class SessionStore {
      * every interface that offers the first implies the second.
      */
     revokeAllFor(name) {
-        for (const [token, identity] of this.tokens) {
-            if (identity.name === name)
-                this.tokens.delete(token);
-        }
+        this.records.removeAllFor(name);
     }
 }
 export const SESSION_COOKIE = "laneyard_session";
+/**
+ * How the session cookie is written, in one place so the two routes that issue
+ * one cannot disagree.
+ *
+ * `maxAge` is the half that was missing: without it the browser treats this as
+ * a session cookie and forgets it the moment the window closes, so signing in
+ * again was the price of quitting Chrome. It matches the server's own TTL, so
+ * the browser stops presenting a token the server would refuse anyway.
+ *
+ * Not `secure`: Laneyard is commonly reached over plain HTTP on a local
+ * network, and a cookie the browser refuses to send is a login page that never
+ * goes away.
+ */
+export const COOKIE_OPTIONS = {
+    path: "/",
+    httpOnly: true,
+    sameSite: "lax",
+    maxAge: SESSION_TTL_MS / 1000,
+};
 /** Past this many tracked names, the entries that no longer delay anyone go. */
 const THROTTLE_PRUNE_ABOVE = 1_000;
 /**

package/dist/src/server/permissions.js

@@ -20,6 +20,8 @@
 export const REQUIRES_ADMIN = [
     { method: "*", path: "/api/secrets" },
     { method: "*", path: "/api/projects/:slug/secrets" },
+    { method: "*", path: "/api/credentials" },
+    { method: "*", path: "/api/projects/:slug/credentials" },
     { method: "PUT", path: "/api/projects/:slug/fastfile" },
     { method: "POST", path: "/api/projects/:slug/commit" },
     { method: "POST", path: "/api/projects/:slug/push" },

package/dist/src/server/required-secrets.js

@@ -0,0 +1,30 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { parseEnvExample } from "../heuristics/env-example.js";
+export async function requiredSecrets(input) {
+    const fromExample = await envExampleNames(input.workspacePath, input.fastlaneDir);
+    const required = [
+        ...new Set([...input.lanes.flatMap((l) => l.env ?? []), ...input.declared, ...fromExample]),
+    ].sort();
+    const supplied = new Set([...input.vaultKeys, ...input.blockNames, ...input.serverEnv]);
+    return {
+        required,
+        missing: required.filter((name) => !supplied.has(name)),
+    };
+}
+/**
+ * The names a committed `.env.example` advertises, if there is one.
+ *
+ * Two conventional filenames and no more: a convenience for the common case,
+ * not a search. Never throws — an absent file is the ordinary situation and
+ * means "nothing declared", not a failure.
+ */
+export async function envExampleNames(workspacePath, fastlaneDir) {
+    const names = [];
+    for (const file of [".env.example", ".env.sample"]) {
+        const text = await readFile(join(workspacePath, fastlaneDir, file), "utf8").catch(() => null);
+        if (text !== null)
+            names.push(...parseEnvExample(text));
+    }
+    return names;
+}

package/dist/src/server/routes/account.js

@@ -0,0 +1,57 @@
+import { MIN_PASSWORD_LENGTH, upsertUserInConfig } from "../../config/accounts.js";
+import { COOKIE_OPTIONS, SESSION_COOKIE, authenticate } from "../auth.js";
+/**
+ * What someone may do to their own account, whatever their role.
+ *
+ * Deliberately not under `/api/users`: that prefix is on the admin list in
+ * `permissions.ts`, and it means "the accounts on this machine". This is the
+ * other thing entirely — one person, their own password — and a builder must be
+ * able to reach it. Changing the password of somebody *else* stays admin-only,
+ * and stays over there.
+ *
+ * The current password is required even though the session already proves who
+ * this is. A session is a cookie in a browser that may have been left open on a
+ * desk; a password is the one thing that says the person at the keyboard is
+ * still the person who signed in.
+ */
+export async function registerAccountRoutes(app, ctx) {
+    app.post("/api/account/password", async (req, reply) => {
+        // Non-null: the hook in `app.ts` rejected every request without a session
+        // before this handler could run.
+        const { name, role } = req.identity;
+        const { current, next } = (req.body ?? {});
+        if (typeof next !== "string" || next.length < MIN_PASSWORD_LENGTH) {
+            return reply
+                .code(400)
+                .send({ error: `A password is at least ${MIN_PASSWORD_LENGTH} characters.` });
+        }
+        const users = ctx.config.server()?.users ?? [];
+        if (typeof current !== "string" || !(await authenticate(users, name, current))) {
+            // No throttle here, unlike `/api/login`: reaching this route already costs
+            // a valid session, so there is nobody to slow down who is not already in.
+            return reply.code(401).send({ error: "That is not your current password." });
+        }
+        if (next === current) {
+            return reply.code(400).send({ error: "That is the password you already have." });
+        }
+        // The role is carried over rather than read from the body: this route
+        // changes a password and nothing else, and an account that could hand
+        // itself `admin` in a field named `role` would make the whole permission
+        // table decorative.
+        await upsertUserInConfig(ctx.config.configPath(), { name, role, password: next });
+        // Every session this account has, gone — including this one. That is the
+        // point: changing a password is what someone does when they think another
+        // browser somewhere should stop being signed in. A fresh session is issued
+        // immediately afterwards, so the person who just did it is not signed out
+        // of the page they did it on.
+        ctx.sessions.revokeAllFor(name);
+        const token = ctx.sessions.issue({ name, role });
+        // The file is watched on a debounce; loading here is what makes the very
+        // next request see the new hash instead of the old one.
+        await ctx.config.load();
+        return reply
+            .setCookie(SESSION_COOKIE, token, COOKIE_OPTIONS)
+            .code(204)
+            .send();
+    });
+}

package/dist/src/server/routes/credentials.js

@@ -0,0 +1,108 @@
+import { CREDENTIAL_KINDS, defaultVarNames, fieldsOf } from "../../credentials/kinds.js";
+/**
+ * Signing blocks over HTTP: the file and the fields that make it usable.
+ *
+ * The file arrives base64 inside a JSON body rather than as a multipart upload.
+ * No multipart plugin is registered — see `app.ts` — and a `.p8` is two
+ * kilobytes, so adding a dependency to carry it would be paying in supply chain
+ * for a convenience the browser can provide in one `FileReader` call.
+ *
+ * A block is taken or refused whole. That is what makes it a block rather than
+ * three loose rows: a keystore stored without its alias is not a partial
+ * success, it is a build that fails in a month with an unusable artifact.
+ */
+/** POSIX environment variable names. Anything else would never reach fastlane. */
+const VALID_VAR = /^[A-Za-z_][A-Za-z0-9_]*$/;
+export async function registerCredentialRoutes(app, ctx) {
+    app.get("/api/credentials", async () => ctx.vault.listGlobalCredentials());
+    app.get("/api/projects/:slug/credentials", async (req, reply) => {
+        const { slug } = req.params;
+        if (!ctx.config.project(slug))
+            return reply.code(404).send({ error: "Unknown project" });
+        return ctx.vault.listCredentials(slug);
+    });
+    const put = async (slug, kind, body, reply) => {
+        const spec = CREDENTIAL_KINDS.find((k) => k.kind === kind);
+        if (!spec) {
+            return reply.code(400).send({
+                error: `"${kind}" is not a kind of credential Laneyard knows: ${CREDENTIAL_KINDS.map((k) => k.kind).join(", ")}.`,
+            });
+        }
+        const { fileName, fileBase64, fields, varNames } = (body ?? {});
+        if (typeof fileName !== "string" || fileName === "") {
+            return reply.code(400).send({ error: "A file name is required" });
+        }
+        if (typeof fileBase64 !== "string" || fileBase64 === "") {
+            return reply.code(400).send({ error: `The ${spec.what} file is required, base64-encoded.` });
+        }
+        const given = (fields ?? {});
+        if (typeof given !== "object" || Array.isArray(given)) {
+            return reply.code(400).send({ error: "`fields` is an object of name to value." });
+        }
+        // Optional fields are the settings a block may leave unanswered — where a
+        // gradle properties file goes, what it is read under. Laneyard is allowed to
+        // ask; refusing the whole block over an unanswered one would be requiring.
+        const missing = fieldsOf(spec.kind)
+            .filter((f) => !f.optional && (typeof given[f.name] !== "string" || given[f.name] === ""))
+            .map((f) => f.name);
+        if (missing.length > 0) {
+            return reply.code(400).send({
+                error: `A ${spec.what} needs ${missing.join(", ")}. Without it the file alone signs nothing.`,
+            });
+        }
+        // Only the fields the kind declares are kept. An extra one would be stored,
+        // never read, and quietly disagree with what the block claims to be.
+        const kept = {};
+        for (const field of fieldsOf(spec.kind)) {
+            const value = given[field.name];
+            // An unanswered optional field is absent from the block rather than
+            // stored empty: the reader then falls back to what it would have used
+            // anyway, instead of taking "" for an answer someone gave.
+            if (typeof value === "string" && value !== "")
+                kept[field.name] = value;
+        }
+        const names = { ...defaultVarNames(spec.kind), ...(varNames ?? {}) };
+        for (const [slot, name] of Object.entries(names)) {
+            if (!(slot in defaultVarNames(spec.kind))) {
+                return reply.code(400).send({ error: `A ${spec.what} exports nothing called "${slot}".` });
+            }
+            if (typeof name !== "string" || !VALID_VAR.test(name)) {
+                return reply.code(400).send({
+                    error: `"${name}" is not a valid environment variable name: letters, digits and underscore, not starting with a digit.`,
+                });
+            }
+        }
+        // Node's base64 decoder ignores what it cannot read rather than refusing, so
+        // a truncated or mistyped upload would be stored as a shorter file and only
+        // surface as an unreadable key at signing time.
+        const fileBytes = Buffer.from(fileBase64, "base64");
+        if (fileBytes.length === 0 || fileBytes.toString("base64").replace(/=+$/, "") !== fileBase64.replace(/=+$/, "")) {
+            return reply.code(400).send({ error: "The file is not valid base64." });
+        }
+        await ctx.vault.setCredential(slug, spec.kind, { fileName, fileBytes, fields: kept, varNames: names });
+        return reply.code(204).send();
+    };
+    app.put("/api/credentials/:kind", async (req, reply) => put(null, req.params.kind, req.body, reply));
+    app.put("/api/projects/:slug/credentials/:kind", async (req, reply) => {
+        const { slug, kind } = req.params;
+        if (!ctx.config.project(slug))
+            return reply.code(404).send({ error: "Unknown project" });
+        return put(slug, kind, req.body, reply);
+    });
+    app.delete("/api/credentials/:kind", async (req, reply) => {
+        const { kind } = req.params;
+        const removed = ctx.vault.removeCredential(null, kind);
+        return removed ? reply.code(204).send() : reply.code(404).send({ error: "Unknown credential" });
+    });
+    /**
+     * Removes this project's own block, and only that one. A global block that
+     * was shadowed comes back into view, which is the deletion someone asked for:
+     * they are undoing an override, not deleting everyone's key from inside one
+     * project.
+     */
+    app.delete("/api/projects/:slug/credentials/:kind", async (req, reply) => {
+        const { slug, kind } = req.params;
+        const removed = ctx.vault.removeCredential(slug, kind);
+        return removed ? reply.code(204).send() : reply.code(404).send({ error: "Unknown credential" });
+    });
+}

package/dist/src/server/routes/readiness.js

@@ -1,11 +1,16 @@
 import { execFile } from "node:child_process";
-import { access } from "node:fs/promises";
+import { access, readFile } from "node:fs/promises";
 import { join } from "node:path";
 import { promisify } from "node:util";
 import { glob } from "tinyglobby";
 import { Workspace } from "../../git/workspace.js";
-import { resolvePlatforms } from "../../heuristics/platforms.js";
+import { NO_APPFILE, parseAppfile } from "../../heuristics/appfile.js";
+import { findAndroidBuild } from "../../heuristics/android-root.js";
+import { exportedVarNames } from "../../credentials/kinds.js";
+import { envExampleNames } from "../required-secrets.js";
+import { appRootOf, resolvePlatforms, searchDir } from "../../heuristics/platforms.js";
 import { runChecklist } from "../../heuristics/readiness.js";
+import { LANEYARD_MARKER, propertyNames } from "../../runner/gradle-properties.js";
 const exec = promisify(execFile);
 /**
  * `bundle check` in the workspace, rejecting with what bundler said.
@@ -35,9 +40,100 @@ async function findFastlane() {
         return null;
     }
 }
-/** The globbing `heuristics/platforms.ts` asks for, bound to the workspace. */
+/** The globbing `heuristics/platforms.ts` asks for, bound to a directory. */
 const findIn = (dir) => (globs, { onlyDirectories }) => glob(globs, onlyDirectories ? { cwd: dir, onlyDirectories: true } : { cwd: dir, onlyFiles: true });
 const exists = async (path) => access(path).then(() => true, () => false);
+/**
+ * Is this the user's own properties file — as opposed to one Laneyard wrote
+ * and failed to clean up?
+ *
+ * `gradle-properties.ts` marks every file it writes with `LANEYARD_MARKER` as
+ * its first line, precisely so this check can tell the two apart. A run killed
+ * between writing the file and reaching its `finally` leaves a marked one
+ * behind in the persistent clone; counting it as the user's own signing
+ * configuration would flip the checklist from "the release build will use the
+ * debug key" to "the release key is used" — a green verdict Laneyard
+ * manufactured for itself out of a cleanup it failed to run.
+ *
+ * Reading fails the same way `exists` does: a missing file, a permission
+ * error, or one this process cannot open are all "not the user's file",
+ * because none of them is evidence of a real signing configuration.
+ */
+async function isUsersOwn(path) {
+    const text = await readFile(path, "utf8").catch(() => null);
+    if (text === null)
+        return false;
+    return (text.split("\n")[0] ?? "").trimEnd() !== LANEYARD_MARKER;
+}
+/**
+ * Is the properties file where the build script would look for it — and is it
+ * the user's, not Laneyard's own leftover?
+ *
+ * The module directory is the one holding the build script, and the Gradle root
+ * is its parent — `android/` for an `android/app/build.gradle`. Which of the two
+ * the name is relative to is the script's decision, and the parser reports which
+ * one it made. When it could not tell, both are looked in: answering "not in the
+ * clone" because the wrong directory was searched would have the checklist
+ * inventing the very failure it exists to catch. Both places apply the same
+ * marker rule — a leftover in either one is still Laneyard's, not the user's.
+ */
+async function isPresent(build, file) {
+    const { moduleDir, gradleRoot } = build;
+    const places = file.scope === "root"
+        ? [gradleRoot]
+        : file.scope === "module"
+            ? [moduleDir]
+            : [gradleRoot, moduleDir];
+    const found = await Promise.all(places.map((dir) => isUsersOwn(join(dir, file.name))));
+    return found.some(Boolean);
+}
+/**
+ * What the android build script says about release signing, and whether the
+ * file it depends on is in the clone.
+ *
+ * The listing is the caller's half of the answer, as everywhere else here: the
+ * check reads text and reaches for nothing. Which script speaks for the android
+ * side is `heuristics/android-root.ts`'s decision rather than this file's,
+ * because the runner writes the properties file against that same decision — see
+ * that module for why the two must not be able to disagree.
+ */
+async function androidSigning(workspacePath, appRoot, unreachable) {
+    if (unreachable !== null) {
+        return { androidSigning: { ok: false, reason: unreachable }, signingFilePresent: false };
+    }
+    const build = await findAndroidBuild(join(workspacePath, appRoot));
+    if (build === null) {
+        return {
+            androidSigning: { ok: false, reason: "no android build.gradle found in the clone" },
+            signingFilePresent: false,
+        };
+    }
+    const present = build.facts.conditionalOn === null ? false : await isPresent(build, build.facts.conditionalOn);
+    return { androidSigning: { ok: true, value: build.facts }, signingFilePresent: present };
+}
+/**
+ * What the keystore block says about the properties file, and nothing else.
+ *
+ * The block has to be decrypted to be asked — `property_names` and
+ * `properties_path` are stored with the passphrases — so the narrowing happens
+ * here, at the last point that touches plaintext. What crosses into the
+ * checklist is two settings a browser is already shown on the block's own form.
+ *
+ * A block that will not decrypt is not an error page: it is a keystore the
+ * checklist cannot speak for, and `credentials` already reports that separately.
+ */
+function keystoreSetting(vault, slug) {
+    try {
+        const block = vault.resolveCredential(slug, "android_keystore");
+        if (!block)
+            return null;
+        const path = (block.fields["properties_path"] ?? "").trim();
+        return { propertyNames: propertyNames(block.fields), propertiesPath: path === "" ? null : path };
+    }
+    catch {
+        return null;
+    }
+}
 export async function registerReadinessRoutes(app, ctx) {
     /**
      * Computed only when asked for.
@@ -67,14 +163,30 @@ export async function registerReadinessRoutes(app, ctx) {
         }
         const resolved = await ctx.config.resolve(slug, workspacePath);
         const fastlaneDir = resolved?.settings.fastlane_dir ?? "fastlane";
-        const uses = unreachable !== null
+        const read = unreachable !== null
             ? { ok: false, reason: unreachable }
             : await ctx
                 .uses(slug, workspacePath, fastlaneDir)
-                .then((lanes) => ({ ok: true, value: lanes }))
+                .then((value) => ({ ok: true, value }))
                 // Broken Fastfile, no Ruby, no fastlane: all of them are "could not
                 // tell", none of them is a 500.
                 .catch((cause) => ({ ok: false, reason: cause.message }));
+        const uses = read.ok
+            ? { ok: true, value: read.value.lanes }
+            : { ok: false, reason: read.reason };
+        // What reading the Fastfile could not account for. `fastlane/actions` is the
+        // caller's half of the answer — a directory listing, not something the Ruby
+        // parser could know — and the sidecar supplies the other, `import`. A check
+        // that would conclude something from finding nothing consults this first.
+        const unread = read.ok
+            ? {
+                ok: true,
+                value: {
+                    imports: read.value.imports,
+                    customActions: await exists(join(workspacePath, fastlaneDir, "actions")),
+                },
+            }
+            : { ok: false, reason: read.reason };
         // What the project builds for decides which half of the checklist applies.
         // `laneyard.yml` answers on its own; without it the workspace is looked at,
         // and an unreachable workspace is a "could not tell" rather than a claim
@@ -82,7 +194,29 @@ export async function registerReadinessRoutes(app, ctx) {
         const configured = resolved?.settings.platforms;
         const platforms = unreachable !== null && (configured === undefined || configured.length === 0)
             ? { ok: false, reason: unreachable }
-            : { ok: true, value: await resolvePlatforms(configured, findIn(workspacePath)) };
+            : {
+                ok: true,
+                // Beside the Fastfile rather than at the repository root: in a
+                // monorepo the app is one directory down, and so are its platform
+                // folders.
+                value: await resolvePlatforms(configured, findIn(searchDir(workspacePath, appRootOf(fastlaneDir)))),
+            };
+        // The Appfile is fastlane's own file, beside the Fastfile, and it is where a
+        // project configured long before it met Laneyard keeps its Play Store
+        // service account. An absent one is a fact — `NO_APPFILE` — not a failure;
+        // an unreachable workspace is the only reason this cannot be answered.
+        const appfile = unreachable !== null
+            ? { ok: false, reason: unreachable }
+            : await readFile(join(workspacePath, fastlaneDir, "Appfile"), "utf8").then((text) => ({ ok: true, value: parseAppfile(text) }), 
+            // Missing, unreadable, a directory: all of them mean the same to a
+            // check, which is that the Appfile says nothing.
+            () => ({ ok: true, value: NO_APPFILE }));
+        // Listed the same way platforms are, from the clone rather than from any
+        // path a Fastfile mentions: what is asked is "does the repository carry a
+        // key", which is a question about the repository.
+        const keyFilesInRepo = unreachable !== null
+            ? { ok: false, reason: unreachable }
+            : await glob(["**/*.p8"], { cwd: workspacePath, onlyFiles: true, dot: true }).then((found) => ({ ok: true, value: found.sort() }), (cause) => ({ ok: false, reason: cause.message }));
         const sections = await runChecklist({
             probeRepository: () => workspace.probeRemote(),
             dependencies: {
@@ -94,8 +228,30 @@ export async function registerReadinessRoutes(app, ctx) {
             },
             // Names only: the vault never hands a value to anything but a run.
             secretKeys: ctx.vault.list(slug).map((s) => s.key),
+            // Which blocks apply, resolved the way a run resolves them — a project's
+            // own shadowing a global one — so the checklist and the run cannot
+            // disagree about whether a credential exists.
+            blocks: ctx.vault.listCredentials(slug).map((c) => c.kind),
+            // And the names those blocks will export, which the environment check
+            // counts as supplied — Laneyard writes the file and sets the variable
+            // itself, so a lane reading it is not a lane short of anything. The same
+            // list the secrets screen is given, from the same call.
+            blockNames: exportedVarNames(ctx.vault.listCredentials(slug)),
+            keystore: keystoreSetting(ctx.vault, slug),
             uses,
             platforms,
+            appfile,
+            keyFilesInRepo,
+            unread,
+            // A run inherits the server's environment, so a variable exported where
+            // Laneyard was started really is available to a lane. Names only: a
+            // checklist has no business reading a value, here least of all.
+            serverEnv: Object.keys(process.env),
+            ...(await androidSigning(workspacePath, appRootOf(fastlaneDir), unreachable)),
+            declaredSecrets: [
+                ...(resolved?.settings.required_secrets ?? []),
+                ...(await envExampleNames(workspacePath, fastlaneDir)),
+            ],
         });
         return { checkedAt: new Date().toISOString(), sections };
     });