laneyard 0.3.0 → 0.4.1

package/dist/src/credentials/kinds.js

@@ -0,0 +1,120 @@
+/**
+ * What each kind of credential block is made of — the one table the server,
+ * runner, readiness checks, and web UI all read, so an agreement kept in one
+ * place instead of copied four times.
+ *
+ * Apple and Play defaults are the names fastlane itself reads — verified
+ * against fastlane 2.237: `app_store_connect_api_key` declares
+ * `APP_STORE_CONNECT_API_KEY_KEY_FILEPATH` / `_KEY_ID` / `..._ISSUER_ID`,
+ * and `supply` declares `SUPPLY_JSON_KEY`.
+ *
+ * Android defaults are Laneyard's own — nothing in fastlane reads a keystore
+ * by convention. `ANDROID_KEYSTORE_PASSWORD` was not chosen freely: it
+ * matches the `/(^|_)(KEYSTORE|STORE)_PASSWORD$/` pattern that
+ * `src/heuristics/readiness.ts` already recognises, so the check and the
+ * block agree by construction rather than by coincidence.
+ */
+export const CREDENTIAL_KINDS = [
+    {
+        kind: "apple_asc",
+        platform: "ios",
+        what: "app store connect key",
+        accept: ".p8",
+        fields: [
+            { name: "key_id", secret: false, label: "Key ID" },
+            { name: "issuer_id", secret: false, label: "Issuer ID" },
+        ],
+        defaults: {
+            path: "APP_STORE_CONNECT_API_KEY_KEY_FILEPATH",
+            key_id: "APP_STORE_CONNECT_API_KEY_KEY_ID",
+            issuer_id: "APP_STORE_CONNECT_API_KEY_ISSUER_ID",
+        },
+    },
+    {
+        kind: "android_keystore",
+        platform: "android",
+        what: "android upload keystore",
+        accept: ".jks,.keystore",
+        fields: [
+            { name: "key_alias", secret: false, label: "Key alias" },
+            { name: "store_password", secret: true, label: "Store password" },
+            { name: "key_password", secret: true, label: "Key password" },
+            // The two things about a gradle properties file that cannot be deduced.
+            // `runner/gradle-properties.ts` writes that file where a build script
+            // falls back to the debug key; the script names the file, and says
+            // nothing about where the name is resolved when the receiver is a
+            // variable, nor about the keys read out of it afterwards. Both are asked
+            // here, pre-filled from what detection could tell, and left empty rather
+            // than guessed when it could tell nothing.
+            {
+                name: "properties_path",
+                secret: false,
+                optional: true,
+                label: "Properties file, relative to the app",
+            },
+            {
+                name: "property_names",
+                secret: false,
+                optional: true,
+                suggested: "storeFile,storePassword,keyPassword,keyAlias",
+                label: "Names your build reads inside it",
+            },
+        ],
+        defaults: {
+            path: "ANDROID_KEYSTORE_PATH",
+            store_password: "ANDROID_KEYSTORE_PASSWORD",
+            key_alias: "ANDROID_KEY_ALIAS",
+            key_password: "ANDROID_KEY_PASSWORD",
+        },
+    },
+    {
+        kind: "play_service_account",
+        platform: "android",
+        what: "play store service account",
+        accept: ".json,application/json",
+        fields: [],
+        defaults: {
+            path: "SUPPLY_JSON_KEY",
+        },
+    },
+];
+function specOf(kind) {
+    const spec = CREDENTIAL_KINDS.find((k) => k.kind === kind);
+    if (!spec)
+        throw new Error(`unknown credential kind: ${kind}`);
+    return spec;
+}
+export function defaultVarNames(kind) {
+    return specOf(kind).defaults;
+}
+export function fieldsOf(kind) {
+    return specOf(kind).fields;
+}
+/**
+ * The variable names a set of stored blocks will export into a run.
+ *
+ * Read off the summaries — the kind and the names stored beside it — so nothing
+ * here decrypts anything. That is what lets the readiness check and the secrets
+ * screen both ask the question: a name a block supplies is a name the project
+ * already has, and asking someone to type it by hand is asking them for what
+ * Laneyard is about to hand the run itself.
+ *
+ * Every name in the block is counted, and no value is looked at. `path` is
+ * always exported, and every other slot belongs to a field the block could not
+ * be stored without — `credentials.ts` refuses a block with a required field
+ * empty, and the optional two have no slot at all. So a name here is a name
+ * `runner/materialise.ts` will set.
+ *
+ * The blocks passed in are the ones that apply, project shadowing global, which
+ * is `Vault.listCredentials` and the precedence a run uses.
+ */
+export function exportedVarNames(blocks) {
+    const names = new Set();
+    for (const block of blocks) {
+        for (const name of Object.values({ ...defaultVarNames(block.kind), ...block.varNames })) {
+            if (name)
+                names.add(name);
+        }
+    }
+    return [...names].sort();
+}

package/dist/src/db/credentials.js

@@ -0,0 +1,100 @@
+const GLOBAL = "";
+/**
+ * Stores signing credential blocks: a file plus the fields that make it
+ * usable. Knows nothing about encryption itself: it takes and returns
+ * ciphertext, so a bug here cannot leak a plaintext value.
+ *
+ * A project credential shadows a global one of the same kind — the same
+ * precedence as `SecretStore`, and the least surprising rule.
+ */
+export class CredentialStore {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    set(projectSlug, kind, input) {
+        this.db
+            .prepare(`INSERT INTO credential (project_slug, kind, file_name, file_enc, fields_enc, var_names, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT (project_slug, kind) DO UPDATE
+           SET file_name  = excluded.file_name,
+               file_enc   = excluded.file_enc,
+               fields_enc = excluded.fields_enc,
+               var_names  = excluded.var_names,
+               updated_at = excluded.updated_at`)
+            .run(projectSlug ?? GLOBAL, kind, input.fileName, input.fileEnc, input.fieldsEnc, JSON.stringify(input.varNames), new Date().toISOString());
+    }
+    /** Rows that apply to a project, project scope winning over global. */
+    applicable(projectSlug) {
+        const rows = this.db
+            .prepare("SELECT * FROM credential WHERE project_slug IN (?, ?) ORDER BY kind")
+            .all(projectSlug, GLOBAL);
+        const byKind = new Map();
+        for (const row of rows) {
+            const existing = byKind.get(row.kind);
+            if (!existing || row.project_slug !== GLOBAL)
+                byKind.set(row.kind, row);
+        }
+        return [...byKind.values()]
+            .sort((a, b) => a.kind.localeCompare(b.kind))
+            .map((row) => this.toSummary(row));
+    }
+    /** One applicable block, ciphertext included, or undefined. */
+    find(projectSlug, kind) {
+        return this.applicable(projectSlug).find((r) => r.kind === kind);
+    }
+    list(projectSlug) {
+        return this.applicable(projectSlug).map(({ fileEnc: _fileEnc, fieldsEnc: _fieldsEnc, ...summary }) => summary);
+    }
+    /**
+     * The blocks stored under this slug, and no global one.
+     *
+     * Same distinction as `SecretStore.listOwn`, and it matters more here: a
+     * global keystore shadowed by nothing is shared by every project on the
+     * machine, and counting it as one project's would offer to delete the one
+     * credential every other project signs with.
+     */
+    listOwn(projectSlug) {
+        if (projectSlug === GLOBAL)
+            return [];
+        const rows = this.db
+            .prepare("SELECT * FROM credential WHERE project_slug = ? ORDER BY kind")
+            .all(projectSlug);
+        return rows.map((row) => {
+            const { fileEnc: _fileEnc, fieldsEnc: _fieldsEnc, ...summary } = this.toSummary(row);
+            return summary;
+        });
+    }
+    /** Removes every block stored under this slug, and returns how many. */
+    removeAllOwn(projectSlug) {
+        if (projectSlug === GLOBAL)
+            return 0;
+        return this.db.prepare("DELETE FROM credential WHERE project_slug = ?").run(projectSlug).changes;
+    }
+    listGlobal() {
+        const rows = this.db
+            .prepare("SELECT * FROM credential WHERE project_slug = ? ORDER BY kind")
+            .all(GLOBAL);
+        return rows.map((row) => {
+            const { fileEnc: _fileEnc, fieldsEnc: _fieldsEnc, ...summary } = this.toSummary(row);
+            return summary;
+        });
+    }
+    remove(projectSlug, kind) {
+        const res = this.db
+            .prepare("DELETE FROM credential WHERE project_slug = ? AND kind = ?")
+            .run(projectSlug ?? GLOBAL, kind);
+        return res.changes > 0;
+    }
+    toSummary(row) {
+        return {
+            kind: row.kind,
+            fileName: row.file_name,
+            fileEnc: row.file_enc,
+            fieldsEnc: row.fields_enc,
+            scope: row.project_slug === GLOBAL ? "global" : "project",
+            varNames: JSON.parse(row.var_names),
+            updatedAt: row.updated_at,
+        };
+    }
+}

package/dist/src/db/schema.sql

@@ -61,3 +61,42 @@ CREATE TABLE IF NOT EXISTS secret (
   updated_at   TEXT    NOT NULL,
   PRIMARY KEY (project_slug, key)
 );
+
+-- A signing credential: a file plus the fields that make it usable. Separate
+-- from `secret` because these are not key/value pairs — stored as loose rows,
+-- nothing knew the parts belonged together, and deleting one left a half-dead
+-- group no check could detect.
+--
+-- `fields_enc` is one encrypted JSON object rather than a column per field: the
+-- three kinds do not share a shape, and a column per field would mean a
+-- migration every time a kind gains one.
+--
+-- `var_names` is NOT encrypted. It holds variable names, never values, and the
+-- interface has to display them.
+CREATE TABLE IF NOT EXISTS credential (
+  project_slug TEXT NOT NULL DEFAULT '',
+  kind         TEXT NOT NULL,
+  file_name    TEXT NOT NULL,
+  file_enc     TEXT NOT NULL,
+  fields_enc   TEXT NOT NULL,
+  var_names    TEXT NOT NULL,
+  updated_at   TEXT NOT NULL,
+  PRIMARY KEY (project_slug, kind)
+);
+
+-- Sessions outlive a restart, which is the whole reason they are here rather
+-- than in a Map. What is stored is a SHA-256 of the token, never the token: the
+-- cookie is a bearer credential, and a stolen `laneyard.db` must not hand
+-- anybody a live session the way a table of raw tokens would.
+--
+-- `expires_at` is an ISO timestamp compared as text, which sorts correctly
+-- because ISO-8601 does. A session with no end is not a convenience, it is a
+-- credential nobody can lose track of.
+CREATE TABLE IF NOT EXISTS session (
+  token_hash TEXT PRIMARY KEY,
+  name       TEXT NOT NULL,
+  role       TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS session_by_name ON session (name);

package/dist/src/db/secrets.js

@@ -34,6 +34,59 @@ export class SecretStore {
         }
         return [...byKey.values()].sort((a, b) => a.key.localeCompare(b.key));
     }
+    /** One applicable row, ciphertext included, or undefined. */
+    find(projectSlug, key) {
+        const row = this.applicable(projectSlug).find((r) => r.key === key);
+        return row
+            ? {
+                key: row.key,
+                masked: row.masked === 1,
+                scope: row.project_slug === GLOBAL ? "global" : "project",
+                valueEnc: row.value_enc,
+            }
+            : undefined;
+    }
+    /**
+     * Flips whether a value is kept out of the logs, leaving the value alone.
+     *
+     * Its own operation rather than a re-`set`, because of a circle: to reveal a
+     * value you must first declare it not secret, and declaring that by storing it
+     * again would mean typing the value you were trying to read.
+     *
+     * Returns false when no row matches, so a caller can answer 404 rather than
+     * report a change that did not happen.
+     */
+    setMasked(projectSlug, key, masked) {
+        return (this.db
+            .prepare(`UPDATE secret SET masked = ?, updated_at = ?
+           WHERE project_slug = ? AND key = ?`)
+            .run(masked ? 1 : 0, new Date().toISOString(), projectSlug ?? GLOBAL, key).changes > 0);
+    }
+    /**
+     * The rows stored under this slug, and no global one.
+     *
+     * `list` answers "what does this project see", which is the right question
+     * everywhere else and the wrong one when a project is going away: a global
+     * secret three other projects also read is not this one's to count, and
+     * certainly not its to remove.
+     *
+     * The empty slug is the global scope's own key, so it is refused here rather
+     * than quietly returning every global row as if one project owned them.
+     */
+    listOwn(projectSlug) {
+        if (projectSlug === GLOBAL)
+            return [];
+        const rows = this.db
+            .prepare("SELECT * FROM secret WHERE project_slug = ? ORDER BY key")
+            .all(projectSlug);
+        return rows.map((row) => ({ key: row.key, masked: row.masked === 1, scope: "project" }));
+    }
+    /** Removes every row stored under this slug, and returns how many. */
+    removeAllOwn(projectSlug) {
+        if (projectSlug === GLOBAL)
+            return 0;
+        return this.db.prepare("DELETE FROM secret WHERE project_slug = ?").run(projectSlug).changes;
+    }
     list(projectSlug) {
         return this.applicable(projectSlug).map((row) => ({
             key: row.key,

package/dist/src/db/sessions.js

@@ -0,0 +1,61 @@
+import { createHash } from "node:crypto";
+/**
+ * A token is never stored, only its digest.
+ *
+ * SHA-256 without a salt on purpose, unlike a password: the token is 32 random
+ * bytes from `randomBytes`, so there is no dictionary to build and no cheaper
+ * attack than guessing the token itself. What this buys is that a copy of
+ * `laneyard.db` is a list of digests rather than a ring of working keys.
+ */
+const digest = (token) => createHash("sha256").update(token).digest("hex");
+/**
+ * Where sessions live between restarts.
+ *
+ * They used to live in a Map, with a comment saying they did not survive a
+ * restart "and that's just fine". It was not fine: a server restarted to pick
+ * up a configuration change signed everybody out, and on a machine you are
+ * still setting up that is several times an hour.
+ */
+export class SessionRecords {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    insert(token, owner, expiresAt) {
+        this.db
+            .prepare(`INSERT INTO session (token_hash, name, role, created_at, expires_at)
+         VALUES (?, ?, ?, ?, ?)`)
+            .run(digest(token), owner.name, owner.role, new Date().toISOString(), expiresAt.toISOString());
+    }
+    /** The owner, or undefined when the token is unknown or its time is up. */
+    find(token, now = new Date()) {
+        const row = this.db
+            .prepare(`SELECT name, role FROM session WHERE token_hash = ? AND expires_at > ?`)
+            .get(digest(token), now.toISOString());
+        return row ? { name: row.name, role: row.role } : undefined;
+    }
+    remove(token) {
+        this.db.prepare(`DELETE FROM session WHERE token_hash = ?`).run(digest(token));
+    }
+    removeAllFor(name) {
+        this.db.prepare(`DELETE FROM session WHERE name = ?`).run(name);
+    }
+    /**
+     * Drops what has already expired.
+     *
+     * Called at startup rather than on a timer: the rows are harmless — `find`
+     * already refuses them — so this is housekeeping, not correctness, and a
+     * timer would be a moving part earning nothing.
+     */
+    prune(now = new Date()) {
+        return this.db.prepare(`DELETE FROM session WHERE expires_at <= ?`).run(now.toISOString())
+            .changes;
+    }
+    /** Number of live sessions. Exposed so expiry can be tested without sleeping. */
+    count(now = new Date()) {
+        const row = this.db
+            .prepare(`SELECT COUNT(*) AS n FROM session WHERE expires_at > ?`)
+            .get(now.toISOString());
+        return row.n;
+    }
+}

package/dist/src/git/workspace.js

@@ -7,6 +7,27 @@ const exec = promisify(execFile);
  * A clone managed by Laneyard, kept between runs.
  * All git commands go through here to share the authentication environment.
  */
+/**
+ * The environment git needs to work without a person at the keyboard.
+ *
+ * Lifted out of `Workspace` because it is not only Workspace's problem. A lane
+ * may run git itself — pushing a bumped build number is a common and reasonable
+ * thing for a Fastfile to do — and that `sh("git push")` inherited none of
+ * this. The result was the worst possible failure: a push that needed a
+ * credential did not fail, it *waited*, and the run sat there until it hit its
+ * timeout with nothing in the log to say what it was waiting for.
+ *
+ * `GIT_TERMINAL_PROMPT=0` is what turns that wait into an error. The SSH
+ * command is what makes the push succeed instead — the key configured for
+ * cloning is by definition the right one for pushing to the same remote.
+ */
+export function gitEnvFor(auth) {
+    const env = { GIT_TERMINAL_PROMPT: "0" };
+    if (auth.kind === "ssh_key" && auth.ref) {
+        env["GIT_SSH_COMMAND"] = `ssh -i ${auth.ref} -o IdentitiesOnly=yes -o BatchMode=yes`;
+    }
+    return env;
+}
 export class Workspace {
     path;
     gitUrl;
@@ -17,12 +38,17 @@ export class Workspace {
         this.auth = auth;
     }
     env() {
-        // Without this, git can block on a credentials prompt and freeze the run.
-        const env = { ...process.env, GIT_TERMINAL_PROMPT: "0" };
-        if (this.auth.kind === "ssh_key" && this.auth.ref) {
-            env["GIT_SSH_COMMAND"] = `ssh -i ${this.auth.ref} -o IdentitiesOnly=yes -o BatchMode=yes`;
-        }
-        return env;
+        return { ...process.env, ...gitEnvFor(this.auth) };
+    }
+    /**
+     * The git identity this workspace would commit under, or null.
+     *
+     * Exposed because a lane that runs `git commit` itself needs the same answer,
+     * and a clone Laneyard made has no identity of its own — so the question is
+     * whether the *server* has one.
+     */
+    async identity() {
+        return this.gitIdentity();
     }
     /**
      * Replaces the repository URL with a neutral token in a piece of text.

package/dist/src/heuristics/android-root.js

@@ -0,0 +1,49 @@
+import { readFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { parseAndroidSigning } from "./android-signing.js";
+/**
+ * Which build script speaks for the android side of a project — asked once, in
+ * one place.
+ *
+ * Two callers need the answer and they must never disagree. The checklist reads
+ * the script to decide whether a release build could go out signed with the
+ * debug key, and the runner writes the properties file that build asks for. If
+ * one of them stopped at `app/build.gradle` while the other read
+ * `android/app/build.gradle.kts`, the file would land where nothing reads it and
+ * the checklist would report green over an artifact signed by the debug key —
+ * the exact failure both of them exist to prevent. A shared list is what makes
+ * that disagreement impossible rather than unlikely.
+ *
+ * The order is a preference, not a ranking of correctness: `android/app` is
+ * where Flutter and React Native put theirs, and `app` is a repository that is
+ * an Android project outright. A repository with both is a monorepo whose
+ * fastlane directory should have pointed one level down, and the first match is
+ * the honest guess to make until it does.
+ */
+export const ANDROID_BUILD_SCRIPTS = [
+    "android/app/build.gradle.kts",
+    "android/app/build.gradle",
+    "app/build.gradle.kts",
+    "app/build.gradle",
+];
+/**
+ * Reads the first android build script under `root`, or null when there is none.
+ *
+ * `root` is the app root inside the clone, not the repository root: in a
+ * monorepo the app is one directory down and so are its platform folders.
+ *
+ * Never throws. An unreadable script is the same as an absent one to both
+ * callers — "could not tell" — and a checklist that raised here would turn a
+ * question it failed to answer into an error page.
+ */
+export async function findAndroidBuild(root) {
+    for (const candidate of ANDROID_BUILD_SCRIPTS) {
+        const scriptPath = join(root, candidate);
+        const text = await readFile(scriptPath, "utf8").catch(() => null);
+        if (text === null)
+            continue;
+        const moduleDir = dirname(scriptPath);
+        return { scriptPath, moduleDir, gradleRoot: dirname(moduleDir), facts: parseAndroidSigning(text) };
+    }
+    return null;
+}

package/dist/src/heuristics/android-signing.js

@@ -0,0 +1,98 @@
+/**
+ * Whether a release build is actually signed with the release key.
+ *
+ * The pattern this exists for is in the Flutter documentation, and therefore in
+ * thousands of projects:
+ *
+ *     signingConfig = if (keystorePropertiesFile.exists()) {
+ *         signingConfigs.getByName("release")
+ *     } else {
+ *         signingConfigs.getByName("debug")
+ *     }
+ *
+ * It is kind locally — `flutter run --release` works on a machine with no
+ * keystore — and it is a trap everywhere else. `key.properties` is gitignored
+ * by the same documentation, so it is by definition absent from a clone. The
+ * release build then *succeeds*, produces an `.aab` signed with the debug key,
+ * and the failure arrives minutes later from Google, saying nothing about
+ * signing.
+ *
+ * Silent, late, and misleading — which is exactly the shape of failure a
+ * checklist exists to move forward in time.
+ *
+ * Text, not a Gradle evaluation: running someone's build script to ask it a
+ * question is not something a checklist may do. So this errs towards saying
+ * nothing, and the check it feeds says "could not tell" rather than inventing a
+ * verdict from a file it half understood.
+ */
+export const NO_SIGNING_FACTS = {
+    releaseCanUseDebugKey: false,
+    conditionalOn: null,
+};
+/**
+ * `rootProject.file("key.properties")`, `file('signing.properties')` — the name,
+ * and whatever the call was made on.
+ *
+ * The receiver is optional and captured separately because it is the whole
+ * difference between two directories. It is matched as a dotted chain so that
+ * the match starts at the receiver rather than at `file(` in the middle of it:
+ * a pattern that ignored the receiver would read `keystoreDir.file(…)` as a bare
+ * call and confidently name the wrong place.
+ */
+const PROPERTIES_FILE = /(?:([A-Za-z_][\w.]*)\s*\.\s*)?\bfile\s*\(\s*["']([^"']+\.properties)["']\s*\)/;
+/**
+ * `project.file` is the bare call spelled out — Gradle defines one as the other
+ * — so both mean the module. Only `rootProject` climbs, and anything else is a
+ * receiver whose directory this has no way to know.
+ */
+function scopeOf(receiver) {
+    if (receiver === undefined || receiver === "project")
+        return "module";
+    if (receiver === "rootProject")
+        return "root";
+    return "unknown";
+}
+/**
+ * The `release { … }` block of `buildTypes`, as text.
+ *
+ * Braces are counted rather than matched with a regex, because the block nests
+ * and a lazy match would stop at the first `}` — which is usually inside it.
+ */
+function releaseBlock(source) {
+    const start = /buildTypes\s*\{/.exec(source);
+    if (!start)
+        return null;
+    const from = source.indexOf("release", start.index);
+    if (from === -1)
+        return null;
+    const open = source.indexOf("{", from);
+    if (open === -1)
+        return null;
+    let depth = 0;
+    for (let i = open; i < source.length; i += 1) {
+        if (source[i] === "{")
+            depth += 1;
+        else if (source[i] === "}") {
+            depth -= 1;
+            if (depth === 0)
+                return source.slice(open, i + 1);
+        }
+    }
+    return null;
+}
+/** Reads an `android/app/build.gradle` or its Kotlin equivalent. Never throws. */
+export function parseAndroidSigning(source) {
+    const release = releaseBlock(source);
+    if (release === null)
+        return NO_SIGNING_FACTS;
+    // `signingConfigs.debug` and `signingConfigs.getByName("debug")` are the two
+    // spellings; both mean the release build may go out with the debug key.
+    const usesDebug = /signingConfigs\s*(?:\.getByName\s*\(\s*["']debug["']\s*\)|\.debug\b)/.test(release);
+    const conditional = PROPERTIES_FILE.exec(source);
+    return {
+        releaseCanUseDebugKey: usesDebug,
+        conditionalOn: usesDebug && conditional
+            ? { name: conditional[2], scope: scopeOf(conditional[1]) }
+            : null,
+    };
+}

package/dist/src/heuristics/appfile.js

@@ -0,0 +1,60 @@
+/**
+ * What fastlane's `Appfile` says about credentials.
+ *
+ * The Appfile is the other half of a fastlane setup, and the half Laneyard used
+ * to be blind to: a project whose Play Store service account has been configured
+ * for years — `json_key_file` on line two — was told it had no service account,
+ * because the only place the checklist looked was Laneyard's own vault. A
+ * warning that is false for a working project is worse than no warning: it is
+ * the one that teaches someone the screen is wrong and can be skipped.
+ *
+ * This is a reader, not an evaluator. The Appfile is Ruby and may compute its
+ * values — `json_key_file ENV["KEY"]` is legal and common — so anything that is
+ * not a plain string literal is reported as "set, but not to something readable
+ * from here" rather than guessed at. The checks turn that into `unknown`, which
+ * is the honest answer: the value exists, and whether it resolves to a file on
+ * this machine is not a question a text file can settle.
+ */
+const ABSENT = { kind: "absent" };
+export const NO_APPFILE = {
+    jsonKeyFile: ABSENT,
+    jsonKeyData: ABSENT,
+    appleId: ABSENT,
+};
+/**
+ * Strips comments, so `# json_key_file "old.json"` is not read as a setting.
+ *
+ * Naive about `#` inside a string, deliberately: the alternative is a Ruby
+ * lexer, and the cost of being wrong here is one line read as a comment — the
+ * check answers "not found" instead of "found", which is the direction this
+ * whole module errs in anyway.
+ */
+const withoutComments = (line) => line.replace(/#.*$/, "");
+/**
+ * `json_key_file "x"`, `json_key_file("x")`, `json_key_file 'x'` — and the
+ * `for_platform`/`for_lane` blocks they may sit inside, which change nothing
+ * about whether the key is set, only about when.
+ */
+function read(lines, key) {
+    const declaration = new RegExp(`^\\s*${key}\\s*(\\(|\\s)`);
+    const literal = new RegExp(`^\\s*${key}\\s*\\(?\\s*(["'])(.*?)\\1\\s*\\)?\\s*$`);
+    let found = ABSENT;
+    for (const line of lines) {
+        if (!declaration.test(line))
+            continue;
+        const match = literal.exec(line);
+        // A later assignment wins, the way it would when Ruby runs the file — and a
+        // literal that follows a computed one is still the value that lands.
+        found = match ? { kind: "literal", value: match[2] } : { kind: "computed" };
+    }
+    return found;
+}
+/** Reads an Appfile's text. Never throws: an unreadable Appfile is `NO_APPFILE`. */
+export function parseAppfile(content) {
+    const lines = content.split("\n").map(withoutComments);
+    return {
+        jsonKeyFile: read(lines, "json_key_file"),
+        jsonKeyData: read(lines, "json_key_data"),
+        appleId: read(lines, "apple_id"),
+    };
+}

package/dist/src/heuristics/blocking-actions.js

@@ -42,6 +42,8 @@ export const BLOCKING_RULES = [
         fix: "Pass `force: true` so it uploads without asking.",
     },
 ];
+/** `given`, with the fallback that keeps an older cached payload readable. */
+export const argsGiven = (action) => action.given ?? Object.keys(action.args);
 /**
  * Applies the table to the actions a lane calls.
  *