laneyard 0.3.0 → 0.4.1

package/dist/src/main.js

@@ -5,20 +5,23 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import { bold, dim, field, heading } from "./cli/style.js";
 import { fileURLToPath } from "node:url";
+import { PromptAborted } from "./cli/prompt.js";
 import { runSetupCommand } from "./cli/setup.js";
 import { runSecretCommand } from "./cli/secret.js";
+import { runUninstallCommand } from "./cli/uninstall.js";
 import { runUserCommand } from "./cli/user.js";
 import { ConfigStore } from "./config/store.js";
 import { CacheStore } from "./db/cache.js";
 import { openDatabase } from "./db/open.js";
 import { RunStore } from "./db/runs.js";
+import { CredentialStore } from "./db/credentials.js";
 import { SecretStore } from "./db/secrets.js";
 import { buildApp } from "./server/app.js";
 import { Vault } from "./secrets/vault.js";
 import { makeInvoke } from "./sidecar/bridge.js";
 import { LaneReader } from "./sidecar/lanes.js";
 import { UsesReader } from "./sidecar/uses.js";
-export const version = "0.3.0";
+export const version = "0.4.1";
 /** Assembles the server from a data folder. */
 export async function createServerFromConfig(root) {
     const config = new ConfigStore(join(root, "config.yml"));
@@ -30,7 +33,7 @@ export async function createServerFromConfig(root) {
     // it. Queued runs never began, so they stay queued for the next start.
     new RunStore(db).interruptInFlight();
     const cache = new CacheStore(db);
-    const vault = await Vault.open(root, new SecretStore(db));
+    const vault = await Vault.open(root, new SecretStore(db), new CredentialStore(db));
     const app = await buildApp({
         config,
         db,
@@ -109,6 +112,8 @@ const USAGE = `laneyard — a self-hosted web UI for fastlane
                       store a secret, its value read from standard input
   laneyard user add NAME [--role admin|builder]
                       create an account, its password read from standard input
+  laneyard uninstall  remove Laneyard's data folder, after showing what is in it
+                      --dry-run shows the inventory and stops
   laneyard            start the server
   laneyard --version  print the version
 
@@ -150,6 +155,13 @@ if (invokedDirectly()) {
             process.exit(await runSetupCommand(process.cwd(), join(home, "config.yml"), { slug, yes }));
         }
         catch (cause) {
+            // Ctrl-C in the middle of the questions. Nothing is written before the
+            // last confirmation, so the only thing worth saying is that it is safe to
+            // start over. 130 is what a shell expects from a command killed by SIGINT.
+            if (cause instanceof PromptAborted) {
+                process.stdout.write(`\n${dim("Setup interrupted — nothing was written. Run `laneyard setup` again.")}\n`);
+                process.exit(130);
+            }
             // A taken slug or an unreadable file are ordinary situations. A stack
             // trace is not an error message; it just suggests the tool is broken.
             process.stderr.write(`${cause.message}\n`);
@@ -177,6 +189,15 @@ if (invokedDirectly()) {
             err: (text) => process.stderr.write(text),
         }));
     }
+    // No `mkdir` here, unlike the commands above: this one asks what is there
+    // and would look ridiculous creating the folder it is about to report on.
+    if (command === "uninstall") {
+        process.exit(await runUninstallCommand(homeDir(), rest, {
+            stdin: process.stdin,
+            out: (text) => process.stdout.write(text),
+            err: (text) => process.stderr.write(text),
+        }));
+    }
     // 0.1.0 shipped this as `add`. Anyone who learned that name deserves a
     // sentence rather than "Unknown command".
     if (command === "add") {

package/dist/src/runner/gradle-properties.js

@@ -0,0 +1,187 @@
+import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { dirname, isAbsolute, join, normalize, relative, resolve } from "node:path";
+import { findAndroidBuild } from "../heuristics/android-root.js";
+/**
+ * The file the build already asks for, supplied rather than demanded.
+ *
+ * `heuristics/android-signing.ts` describes the trap: the Flutter documentation
+ * ships a release build that falls back to the debug signing config when
+ * `key.properties` is absent, and gitignores that file. On a build server it is
+ * therefore always absent, the release build succeeds, and the `.aab` is signed
+ * with the debug key.
+ *
+ * The obvious fix is to tell the user to rewrite their build script. Laneyard
+ * does not do that — the project never adapts to Laneyard. So it writes the file
+ * the script is already looking for, for the length of one run, and only where
+ * its absence would ship a debug-signed artifact.
+ *
+ * **The property names are a convention, not a reading.** `conditionalOn` gave
+ * the file's *name*, because that is what appears in the script; the keys inside
+ * it are read somewhere else entirely, usually through a `Properties` object
+ * indexed by string. The four defaults below are the Flutter documentation's,
+ * which is why they are right most of the time and never certain. A project
+ * reading `keystoreProperties["alias"]` says so in the block's `property_names`
+ * setting — asking at configuration time is allowed; requiring a repository
+ * change is not.
+ *
+ * This is the one credential written into the persistent clone, because Gradle
+ * resolves the path relative to the build rather than to anything a run owns.
+ * Three guards earn that:
+ *
+ *  1. The first line is a marker, and Laneyard removes a marked file at the end
+ *     of the run and sweeps for one again at the start of the next, so a process
+ *     killed mid-build cannot leave passwords in a working tree indefinitely.
+ *  2. A file without the marker is never written over and never removed. It is
+ *     the user's own — possibly their real signing configuration — and clobbering
+ *     it would be far worse than any warning Laneyard could print.
+ *  3. Readiness must not read this file back and report the project ready
+ *     because of something Laneyard wrote. That is enforced elsewhere; nothing
+ *     here may make it impossible, which is the other reason for the marker.
+ */
+export const LANEYARD_MARKER = "# written by laneyard, do not commit";
+/**
+ * The keys the Flutter documentation uses, in the order `property_names` lists
+ * them. The setting is a plain comma-separated list because that is the form a
+ * user can correct in one keystroke: the field arrives pre-filled with exactly
+ * these four, and a project that reads `alias` edits the fourth one.
+ */
+const DEFAULT_PROPERTY_NAMES = ["storeFile", "storePassword", "keyPassword", "keyAlias"];
+/** Where each of those four names gets its value from. */
+const SLOTS = ["storeFile", "store_password", "key_password", "key_alias"];
+/**
+ * Where the file goes, or null when nobody can say.
+ *
+ * The configured path wins outright: it exists precisely because detection
+ * cannot always tell, and a setting the user corrected must not be second-
+ * guessed by the guess it corrected. It is read relative to the app root, the
+ * same root the build script was found under, and a path climbing out of it is
+ * refused rather than followed — the value came from a form, and a run must not
+ * be able to drop a file with passwords in it anywhere on the server.
+ *
+ * Otherwise the parser's answer decides, and `unknown` means the file is not
+ * written at all. Writing it in the likelier of two directories would be worse
+ * than writing nothing: the build would go on signing with the debug key while
+ * a file sat next to it looking like the problem had been dealt with.
+ */
+async function locate(root, fields) {
+    const build = await findAndroidBuild(root);
+    // The build makes no such bet — or there is no android build here at all — so
+    // nothing is at stake and nothing is written. Checked even when the path was
+    // configured by hand: the setting says where the file would go, never that it
+    // is wanted, and a project that has since fixed its build script should stop
+    // being written into without having to remember to clear a field.
+    if (!build || !build.facts.releaseCanUseDebugKey)
+        return null;
+    const configured = (fields["properties_path"] ?? "").trim();
+    if (configured !== "") {
+        const path = resolve(root, normalize(configured));
+        const inside = relative(root, path);
+        if (inside === "" || inside.startsWith("..") || isAbsolute(inside))
+            return null;
+        return path;
+    }
+    if (build.facts.conditionalOn === null)
+        return null;
+    const { name, scope } = build.facts.conditionalOn;
+    if (scope === "root")
+        return join(build.gradleRoot, name);
+    if (scope === "module")
+        return join(build.moduleDir, name);
+    return null;
+}
+/** The first line of a file, or null when there is no file to read. */
+async function firstLine(path) {
+    const text = await readFile(path, "utf8").catch(() => null);
+    return text === null ? null : (text.split("\n")[0] ?? "");
+}
+/**
+ * Java `.properties` escaping, applied to values only.
+ *
+ * A backslash is an escape character in that format, and the store path ends in
+ * a file name that came from an upload — so a value can genuinely contain one.
+ * Newlines are escaped rather than dropped: a password truncated at a line break
+ * would produce a file Gradle reads happily and signs wrongly with.
+ */
+function escapeValue(value) {
+    return value.replace(/\\/g, "\\\\").replace(/\r/g, "\\r").replace(/\n/g, "\\n");
+}
+/**
+ * The names to write, positionally overridden by the block's setting.
+ *
+ * Exported because the readiness check names them on screen: what Laneyard is
+ * going to write into someone's build is not something to leave implicit, and
+ * the check must read the same list the writer does rather than a copy of it.
+ */
+export function propertyNames(fields) {
+    const configured = (fields["property_names"] ?? "").split(",").map((n) => n.trim());
+    return DEFAULT_PROPERTY_NAMES.map((fallback, i) => configured[i] || fallback);
+}
+/**
+ * Writes the properties file, and returns its path — or null, having written
+ * nothing.
+ *
+ * Null is the ordinary outcome, and there are four ways to reach it: no keystore
+ * block applies, the build does not fall back to the debug key, nobody could say
+ * where the file goes, or a file is already there that Laneyard did not write.
+ * Only the last of those is worth a word to the user, and it is the checklist's
+ * word to say, not the runner's.
+ */
+export async function writeGradleProperties(root, keystore) {
+    if (!keystore)
+        return null;
+    const path = await locate(root, keystore.fields);
+    if (path === null)
+        return null;
+    // Guard two. Anything already there without the marker is the user's, and the
+    // build using it is the correct outcome — their real signing configuration
+    // beats the one Laneyard would have assembled.
+    const existing = await firstLine(path);
+    if (existing !== null && existing.trimEnd() !== LANEYARD_MARKER)
+        return null;
+    const names = propertyNames(keystore.fields);
+    const values = SLOTS.map((slot) => slot === "storeFile" ? keystore.storeFile : (keystore.fields[slot] ?? ""));
+    const body = names
+        .map((name, i) => `${name}=${escapeValue(values[i])}`)
+        .join("\n");
+    await mkdir(dirname(path), { recursive: true });
+    // The mode is set twice deliberately, as in `materialise.ts`: `writeFile`'s
+    // mode is masked by the process umask and ignored outright for a file that
+    // already exists, and this one holds a signing password.
+    await writeFile(path, `${LANEYARD_MARKER}\n${body}\n`, { mode: 0o600 });
+    await chmod(path, 0o600);
+    return path;
+}
+/**
+ * Removes a file this run wrote, and only such a file.
+ *
+ * Called from the run's `finally`, beside the removal of the run's secrets
+ * directory, so a keystore password does not outlive the build that needed it.
+ * Takes null so the caller can hand it whatever `writeGradleProperties`
+ * returned without a branch of its own.
+ */
+export async function removeGradleProperties(path) {
+    if (path === null)
+        return;
+    if ((await firstLine(path))?.trimEnd() !== LANEYARD_MARKER)
+        return;
+    await rm(path, { force: true }).catch(() => { });
+}
+/**
+ * Removes a marked file left where this run would write one.
+ *
+ * A run killed between writing the file and reaching its `finally` — an
+ * unplugged server, a `kill -9`, a container that lost its node — leaves
+ * passwords in a working tree that is kept between runs. Nothing at that moment
+ * can clean up after itself, so the next run does it before doing anything else.
+ *
+ * Silent about everything: a workspace that was never cloned has nothing to
+ * sweep, and a sweep that failed must not be the reason a build did not start.
+ */
+export async function sweepGradleProperties(root, keystore) {
+    // Deliberately not conditional on there being a block. The leftover to remove
+    // is from a *previous* run, and a keystore deleted since then would otherwise
+    // make the file that run wrote permanent — the one arrangement in which
+    // nothing would ever come back to clean it up.
+    const path = await locate(root, keystore?.fields ?? {}).catch(() => null);
+    await removeGradleProperties(path).catch(() => { });
+}

package/dist/src/runner/materialise.js

@@ -0,0 +1,92 @@
+import { chmod, mkdir, rm, rmdir, writeFile } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
+import { defaultVarNames } from "../credentials/kinds.js";
+/**
+ * Turns the stored signing blocks into real files, for the length of one run.
+ *
+ * A keystore has no string form. Gradle's `storeFile` is a path, `sign_apk`
+ * wants a path, `app_store_connect_api_key` wants a path — so a block that
+ * exists only as ciphertext in SQLite cannot be used by anything, and something
+ * has to put bytes on a disk. This is that something, and the files it writes
+ * live exactly as long as the run does.
+ *
+ * The variable names are the project's, never Laneyard's. A Fastfile written
+ * around `ENV["ASC_KEY_FILEPATH"]` is not a Fastfile doing it wrong, and asking
+ * it to rename anything would make Laneyard a thing projects adapt to. So the
+ * name stored with the block is the only name exported: no default is emitted
+ * alongside it as a courtesy, because that courtesy is what makes a typo in the
+ * configured name look like it worked.
+ *
+ * **Every applicable block is materialised, whether or not the lane looks like
+ * it needs it.** Narrowing this to what a lane appears to use is tempting: it
+ * would shrink the window a private key spends unencrypted on disk, which is
+ * the one cost this module carries. It is not worth it. Detection reads a
+ * Fastfile that can call anything through `sh`, a plugin, or a lane in another
+ * file; a detector that guesses "not needed" and guesses wrong turns a build
+ * that worked into a build that fails — or worse, into a debug-signed artifact
+ * that ships. Detection decides what Laneyard *asks* for, never what it
+ * withholds at run time.
+ *
+ * A block that will not decrypt throws, and the run never starts. That is the
+ * same trade `Vault.resolveCredential` makes and for the same reason: an
+ * absent signing key is not a missing variable fastlane will name for you, it
+ * is an artifact that builds, uploads, and is rejected by the store days later.
+ */
+export async function materialiseCredentials(vault, projectSlug, runSecretsDir) {
+    const env = {};
+    let keystore;
+    const cleanup = async () => {
+        await rm(runSecretsDir, { recursive: true, force: true });
+        // And the `runs/<run id>` folder that held it, so a server does not
+        // accumulate one empty directory per build it has ever run. `rmdir` rather
+        // than `rm -r`: it refuses a folder that still has something in it, which
+        // is exactly the protection wanted for a path this function did not create.
+        await rmdir(dirname(runSecretsDir)).catch(() => { });
+    };
+    // The mode is applied explicitly rather than trusted to `mkdir`: the mode
+    // argument is masked by the process umask, and a server started from a shell
+    // with a lax umask would otherwise hand out a world-readable key directory.
+    await mkdir(runSecretsDir, { recursive: true });
+    await chmod(runSecretsDir, 0o700);
+    try {
+        for (const summary of vault.listCredentials(projectSlug)) {
+            const block = vault.resolveCredential(projectSlug, summary.kind);
+            if (!block)
+                continue;
+            const defaults = defaultVarNames(summary.kind);
+            const names = { ...defaults, ...block.varNames };
+            // One directory per kind, so the original file name survives intact.
+            // Some tools read meaning from it — `AuthKey_<KEY ID>.p8` is a convention
+            // fastlane's own docs use — and flattening two blocks into one directory
+            // would let a `.p8` and a service account JSON that happen to share a name
+            // overwrite each other, silently, on the run that used both.
+            const dir = join(runSecretsDir, summary.kind);
+            await mkdir(dir, { recursive: true });
+            await chmod(dir, 0o700);
+            // `basename` because the name came from an upload and has never been
+            // constrained: a stored `../../id_rsa` must land in this directory, not
+            // over something in the user's home.
+            const path = join(dir, basename(block.fileName) || summary.kind);
+            await writeFile(path, block.fileBytes, { mode: 0o600 });
+            await chmod(path, 0o600);
+            if (summary.kind === "android_keystore")
+                keystore = { storeFile: path, fields: block.fields };
+            env[names["path"] ?? defaults["path"]] = path;
+            for (const [field, value] of Object.entries(block.fields)) {
+                const name = names[field];
+                // A field with no name is a block stored before that field existed;
+                // dropping it beats exporting it under a name nobody agreed on.
+                if (name && value)
+                    env[name] = value;
+            }
+        }
+    }
+    catch (cause) {
+        // Nothing may survive a partial materialisation: the blocks that did get
+        // written are as sensitive as the one that failed, and the caller's
+        // `cleanup` is never reached when this function throws.
+        await cleanup();
+        throw cause;
+    }
+    return { env, keystore, cleanup };
+}

package/dist/src/runner/orchestrate.js

@@ -1,9 +1,11 @@
 import { rm } from "node:fs/promises";
 import { join } from "node:path";
-import { Workspace } from "../git/workspace.js";
+import { gitEnvFor, Workspace } from "../git/workspace.js";
 import { summarizeFailure } from "../heuristics/error-summary.js";
+import { appRootOf, searchDir } from "../heuristics/platforms.js";
 import { Redactor, scrub } from "../logs/redact.js";
 import { collectArtifacts } from "./artifacts.js";
+import { removeGradleProperties, sweepGradleProperties, writeGradleProperties, } from "./gradle-properties.js";
 import { LiveStepTracker } from "./live-steps.js";
 import { startPty } from "./pty.js";
 import { readReport } from "./report.js";
@@ -13,8 +15,37 @@ import { readReport } from "./report.js";
  * Never throws: every error is converted into a documented `failed` run,
  * because a run that disappears without a trace is the worst possible
  * behaviour for a build server.
+ *
+ * The whole of it is wrapped so the signing blocks written for this run are
+ * removed on every way out — the successful return, the four early exits, the
+ * cancellations, and the exception this function promises not to raise but
+ * cannot rule out. A private key left on disk because a clone failed is a leak
+ * with no expiry date, and the only moment at which it is certainly safe to
+ * delete is the moment fastlane has stopped running.
+ *
+ * The gradle properties file is removed here too, and it is the one written
+ * somewhere this run does not own: the clone is kept between runs, so passwords
+ * left in it would sit in a working tree until someone noticed. The path is
+ * carried out through a holder rather than returned, because it is decided deep
+ * inside the run and has to be visible to a `finally` wrapped around all of it.
  */
 export async function executeRun(opts) {
+    const wrote = { properties: null };
+    try {
+        return await execute(opts, wrote);
+    }
+    finally {
+        // Guarded by the marker, so a file the user replaced mid-run survives.
+        await removeGradleProperties(wrote.properties).catch(() => { });
+        // Deliberately swallowed: by now the log writer is closed and the run's
+        // verdict is recorded, so there is nowhere left to report this without
+        // rewriting a finished run's outcome as a failure it did not have. A
+        // directory that resists `rm -rf` is a broken disk, not a broken build.
+        if (opts.cleanup)
+            await opts.cleanup().catch(() => { });
+    }
+}
+async function execute(opts, wrote) {
     const { runId, runs, logs } = opts;
     const writer = await logs.open(runId);
     const tracker = new LiveStepTracker();
@@ -79,6 +110,29 @@ export async function executeRun(opts) {
     catch (cause) {
         return fail(`Unreadable project settings: ${cause.message}`);
     }
+    // The properties file gradle may be waiting for, in the clone rather than in
+    // this run's own directory — `gradle-properties.ts` says why, and why it is
+    // hedged about with a marker. It happens here, after the settings, because
+    // the app root it is written under is derived from `fastlane_dir`, and before
+    // the cancellation checkpoint, so that a run cancelled in this exact instant
+    // still leaves the workspace as it found it.
+    //
+    // The sweep first, and whether or not this project still has a keystore: a
+    // run killed mid-build leaves a file nothing was left running to remove, and
+    // the next run is the first moment anything can. Its failure is not reported
+    // — a leftover that resists removal is a broken disk, not a broken build, and
+    // saying so here would fail a run for a file it has not needed yet.
+    const androidRoot = searchDir(opts.workspacePath, appRootOf(settings.fastlane_dir));
+    await sweepGradleProperties(androidRoot, opts.androidKeystore).catch(() => { });
+    try {
+        wrote.properties = await writeGradleProperties(androidRoot, opts.androidKeystore);
+    }
+    catch (cause) {
+        // Failing the run rather than carrying on. Carrying on is what produces the
+        // artifact this whole module exists to prevent: a release build that
+        // succeeds, signed with the debug key, rejected by the store days later.
+        return fail(`Could not write the signing properties file: ${cause.message}`);
+    }
     // Cancelled during preparation: fastlane never gets to start.
     if (opts.signal?.aborted) {
         return finishAs("cancelled", "Cancelled");
@@ -90,6 +144,19 @@ export async function executeRun(opts) {
     // didn't have time to overwrite. Without this cleanup, a run that fails
     // before even reaching fastlane would adopt the previous run's timeline.
     await rm(reportPath, { force: true });
+    // The identity fallback is only set when the workspace has none of its own:
+    // a clone Laneyard made carries no `user.email`, so a lane running `git
+    // commit` fails with "Please tell me who you are" on any server whose global
+    // git configuration is empty. Where an identity does exist — the server's own,
+    // or one set on the repository — it is left to win, because these variables
+    // override configuration rather than backing it up.
+    const gitEnv = gitEnvFor(opts.gitAuth ?? { kind: "none" });
+    if ((await workspace.identity().catch(() => null)) === null) {
+        gitEnv["GIT_AUTHOR_NAME"] = "Laneyard";
+        gitEnv["GIT_AUTHOR_EMAIL"] = "laneyard@localhost";
+        gitEnv["GIT_COMMITTER_NAME"] = "Laneyard";
+        gitEnv["GIT_COMMITTER_EMAIL"] = "laneyard@localhost";
+    }
     const { done } = startPty({
         command: useBundle ? "bundle" : "fastlane",
         args: useBundle
@@ -99,12 +166,27 @@ export async function executeRun(opts) {
         env: {
             ...opts.env,
             ...(opts.secrets ?? {}),
+            // After the secrets: a block is the more deliberate of the two, and it is
+            // the only one whose path variable points at a file that actually exists
+            // right now. A stray secret of the same name would otherwise send gradle
+            // looking for a keystore at a path from a previous machine.
+            ...(opts.credentialEnv ?? {}),
             // Order matters: secrets come after opts.env so a stored secret wins over
             // a variable that happens to exist in the server's own environment, and
-            // before these three fixed variables so no secret can override CI.
+            // before these fixed variables so no secret can override CI.
             CI: "true",
             FASTLANE_SKIP_UPDATE_CHECK: "1",
             FORCE_COLOR: "1",
+            // A lane may run git itself — bumping and pushing a build number is a
+            // reasonable thing for a Fastfile to do — and until now that `sh("git
+            // push")` inherited none of the care Laneyard takes with its own git
+            // calls. It got the worst failure available: a push needing a credential
+            // did not fail, it waited, and the run sat there until its timeout with
+            // nothing in the log to say what for.
+            //
+            // After the secrets, deliberately. These are not preferences: a stored
+            // `GIT_TERMINAL_PROMPT=1` would restore exactly the hang this removes.
+            ...gitEnv,
         },
         onData: (chunk) => void emit(chunk),
         timeoutMs: settings.timeout_minutes * 60_000,
@@ -112,6 +194,13 @@ export async function executeRun(opts) {
     });
     const outcome = await done;
     await emitRest();
+    // The moment gradle has certainly stopped reading it, which is earlier than
+    // the `finally` and worth taking: the artifact collection below globs the
+    // workspace, and a project whose globs are broad enough would otherwise be
+    // offered its own signing passwords as a downloadable artifact. The `finally`
+    // still runs — this is a narrowing, not a replacement, and removing a file
+    // that is already gone costs nothing.
+    await removeGradleProperties(wrote.properties).catch(() => { });
     // --- Timeline -------------------------------------------------------------
     // Everything that follows is after-sales service: the timeline and the
     // artifacts embellish a run that's already finished. A database that

package/dist/src/secrets/vault.js

@@ -1,3 +1,4 @@
+import { fieldsOf } from "../credentials/kinds.js";
 import { scrub } from "../logs/redact.js";
 import { decrypt, encrypt } from "./cipher.js";
 import { loadOrCreateKey } from "./key.js";
@@ -11,12 +12,14 @@ import { loadOrCreateKey } from "./key.js";
 export class Vault {
     key;
     store;
-    constructor(key, store) {
+    credentials;
+    constructor(key, store, credentials) {
         this.key = key;
         this.store = store;
+        this.credentials = credentials;
     }
-    static async open(home, store) {
-        return new Vault(await loadOrCreateKey(home), store);
+    static async open(home, store, credentials) {
+        return new Vault(await loadOrCreateKey(home), store, credentials);
     }
     async set(projectSlug, key, value, masked) {
         this.store.set(projectSlug, key, encrypt(value, this.key), masked);
@@ -30,6 +33,37 @@ export class Vault {
     listGlobal() {
         return this.store.listGlobal();
     }
+    /**
+     * What the vault holds under one project's own name — secrets and signing
+     * blocks — and nothing global.
+     *
+     * Its own method rather than a filter over `list`, because the question is a
+     * different one: `list` is "what would a run of this project see", and this is
+     * "what would be left behind if the project went away". A global secret is in
+     * the first answer and must never be in the second.
+     */
+    ownedBy(projectSlug) {
+        return {
+            secrets: this.store.listOwn(projectSlug),
+            credentials: this.credentials.listOwn(projectSlug),
+        };
+    }
+    /**
+     * Forgets everything stored under one project's name.
+     *
+     * Never called by removing a project: that route leaves the vault alone on
+     * purpose and says what stayed. This is the separate, deliberate act someone
+     * takes afterwards, once they have read what it is they are about to lose —
+     * a credential is the one thing here that cannot be looked at before it goes.
+     *
+     * Scoped by slug, so a global secret or a global signing block survives it.
+     */
+    forget(projectSlug) {
+        return {
+            secrets: this.store.removeAllOwn(projectSlug),
+            credentials: this.credentials.removeAllOwn(projectSlug),
+        };
+    }
     /**
      * Removes this project's secret values from a piece of text, in one shot.
      *
@@ -58,11 +92,109 @@ export class Vault {
         }
         return out;
     }
-    /** The values a run's output must not contain. */
+    /**
+     * One value, in the clear — and only when it was never declared secret.
+     *
+     * The refusal is the point. This vault has been write-only since it was
+     * written: the server never sent a value back, so the interface had nothing to
+     * uncover and no browser ever held one. That is worth keeping for anything
+     * anyone called a secret.
+     *
+     * But not everything stored here is one. `APP_VERSION`, `SENTRY_ORG`, an
+     * issuer id — those are identifiers, and being unable to check what was stored
+     * makes an import something you have to take on faith. The line between the
+     * two already existed and is the user's own: `masked` is "keep this out of the
+     * logs". A value that carries it is never returned, whoever asks.
+     *
+     * Returns null for an unknown key, and throws for a masked one — a caller
+     * that forgot to check must fail loudly rather than leak.
+     */
+    reveal(projectSlug, key) {
+        const row = this.store.find(projectSlug, key);
+        if (!row)
+            return null;
+        if (row.masked) {
+            throw new Error(`${key} is kept out of the logs, so its value is never sent back.`);
+        }
+        return decrypt(row.valueEnc, this.key);
+    }
+    /** Flips whether a value is kept out of the logs, leaving the value alone. */
+    setMasked(projectSlug, key, masked) {
+        return this.store.setMasked(projectSlug, key, masked);
+    }
+    /**
+     * Stores a signing block: the file, and the fields that make it usable.
+     *
+     * `cipher.ts` speaks strings and a `.jks` is bytes, so the file makes the trip
+     * as base64. The fields travel as one JSON object rather than one row each,
+     * because a keystore missing its alias is not a block with a gap in it — it is
+     * not a block.
+     */
+    async setCredential(projectSlug, kind, block) {
+        this.credentials.set(projectSlug, kind, {
+            fileName: block.fileName,
+            fileEnc: encrypt(block.fileBytes.toString("base64"), this.key),
+            fieldsEnc: encrypt(JSON.stringify(block.fields), this.key),
+            varNames: block.varNames,
+        });
+    }
+    /**
+     * One block that applies to a project, in the clear, or undefined if there is none.
+     *
+     * Unlike `resolve`, an unreadable row throws. The leniency there is earned: a
+     * missing variable makes fastlane stop and say which one. A block that quietly
+     * fails to decrypt costs a debug-signed artifact that builds, uploads, and is
+     * rejected by the store days later — by which point nobody is looking at this
+     * run's log. The kind is in the message because that is the part you need to
+     * know before you can act.
+     */
+    resolveCredential(projectSlug, kind) {
+        const row = this.credentials.find(projectSlug, kind);
+        if (!row)
+            return undefined;
+        try {
+            return {
+                fileName: row.fileName,
+                fileBytes: Buffer.from(decrypt(row.fileEnc, this.key), "base64"),
+                fields: JSON.parse(decrypt(row.fieldsEnc, this.key)),
+                varNames: row.varNames,
+            };
+        }
+        catch {
+            throw new Error(`The stored ${kind} block cannot be decrypted. Its encryption key changed or the row is damaged; upload the credential again.`);
+        }
+    }
+    listCredentials(projectSlug) {
+        return this.credentials.list(projectSlug);
+    }
+    listGlobalCredentials() {
+        return this.credentials.listGlobal();
+    }
+    removeCredential(projectSlug, kind) {
+        return this.credentials.remove(projectSlug, kind);
+    }
+    /**
+     * The values a run's output must not contain.
+     *
+     * A block's secret fields belong here as much as a masked secret does: a
+     * keystore password reaches the build as an environment variable, and gradle
+     * is perfectly willing to echo one back on failure.
+     */
     maskedValues(projectSlug) {
         const masked = this.store.maskedKeys(projectSlug);
-        return Object.entries(this.resolve(projectSlug))
+        const values = Object.entries(this.resolve(projectSlug))
             .filter(([key]) => masked.has(key))
             .map(([, value]) => value);
+        for (const summary of this.credentials.list(projectSlug)) {
+            const block = this.resolveCredential(projectSlug, summary.kind);
+            if (!block)
+                continue;
+            for (const field of fieldsOf(summary.kind)) {
+                const value = block.fields[field.name];
+                if (field.secret && value)
+                    values.push(value);
+            }
+        }
+        return values;
     }
 }