laneyard 0.4.1 → 0.6.0

package/dist/src/cli/setup.js

@@ -1,5 +1,7 @@
+import { execFile } from "node:child_process";
 import { readFile, writeFile } from "node:fs/promises";
 import { join } from "node:path";
+import { promisify } from "node:util";
 import { Document, parseDocument, YAMLSeq } from "yaml";
 import { VALID_NAME, ensureFirstAdmin, hasAccount } from "../config/accounts.js";
 import { loadServerConfig } from "../config/load.js";
@@ -7,6 +9,13 @@ import { serializeYaml as serialize } from "../config/yaml.js";
 import { bad, bold, dim, field, heading, ok, warn } from "./style.js";
 import { acceptingAsker, terminalAsker } from "./prompt.js";
 import { detectProject } from "./detect.js";
+import { appRootOf } from "../heuristics/platforms.js";
+import { CredentialStore } from "../db/credentials.js";
+import { openDatabase } from "../db/open.js";
+import { SecretStore } from "../db/secrets.js";
+import { Vault } from "../secrets/vault.js";
+import { runAdoption } from "./adopt.js";
+const exec = promisify(execFile);
 /**
  * Adds a project block to config.yml while preserving the rest of the file.
  *
@@ -76,6 +85,28 @@ export async function removeProjectFromConfig(path, slug) {
     await writeFile(path, serialize(doc), "utf8");
     return true;
 }
+/**
+ * Empties the project list, leaving the `server:` block and the file's shape.
+ *
+ * What `laneyard reset` does to config.yml: every project goes, the accounts and
+ * the port stay. The same YAML-document edit as removing one project, and for
+ * the same reason — the file is hand-written, so its comments and its key order
+ * must survive being touched. The items are spliced out of the existing sequence
+ * rather than the key replaced, so `projects:` keeps its place and any comment
+ * sitting on it.
+ *
+ * Returns how many blocks were removed, so the caller can report the count.
+ */
+export async function clearProjectsInConfig(path) {
+    const doc = parseDocument(await readFile(path, "utf8"));
+    const projects = doc.getIn(["projects"]);
+    if (!(projects instanceof YAMLSeq) || projects.items.length === 0)
+        return 0;
+    const removed = projects.items.length;
+    projects.items.splice(0, removed);
+    await writeFile(path, serialize(doc), "utf8");
+    return removed;
+}
 /**
  * Entry point for `laneyard setup`.
  *
@@ -120,7 +151,12 @@ export async function runSetupCommand(cwd, configPath, options = {}) {
                 dim("  Continuing updates its entry, keeping anything you added by hand.\n") +
                 dim("  Give it another name to keep both.\n"));
         }
-        const repoConfigPath = join(repoRoot(cwd, d.subPath), LANEYARD_YML);
+        // The repository file lives in the app's own directory, so a monorepo of N
+        // apps carries N of them — one beside each app's fastlane folder. `appRoot`
+        // is the fastlane dir's parent; for a plain app whose fastlane sits at the
+        // root it is `.`, and the file lands at the repository root as it always did.
+        const appRoot = appRootOf(d.fastlaneDir);
+        const repoConfigPath = join(repoRoot(cwd, d.subPath), appRoot, LANEYARD_YML);
         if (await fileExists(repoConfigPath)) {
             process.stdout.write("\n" + warn(`${LANEYARD_YML} already exists in the repository.\n`) +
                 dim("  Its values win over anything written here; it will be left alone.\n"));
@@ -152,6 +188,18 @@ export async function runSetupCommand(cwd, configPath, options = {}) {
         const gitUrl = await asker.ask("repository", d.gitUrl);
         const branch = await asker.ask("default branch", d.defaultBranch, dim("A run uses this branch unless you pick another one when you start it."));
         const fastlaneDir = await asker.ask("fastlane directory", d.fastlaneDir, dim("Relative to the repository root, because that is what Laneyard clones."));
+        // A fastlane folder that is on disk but not in git will not survive the
+        // clone Laneyard builds from — the case that started this: a stray
+        // `app copie/` macOS made, detected here and absent from the remote.
+        // Warned, not refused: setup proposes and the user decides, exactly as with
+        // every value above. Silent when git cannot answer — a courtesy, not a gate.
+        if (!(await fastlaneDirIsTracked(repoRoot(cwd, d.subPath), fastlaneDir))) {
+            process.stdout.write("\n" +
+                warn(`${bold(fastlaneDir)} exists here but is not tracked by git.\n`) +
+                dim("  Laneyard builds from a clone of the remote, so a path that is not in\n") +
+                dim("  git will not be in the clone — the build will fail looking for it.\n") +
+                dim("  Commit and push it, or give a path that is in git.\n"));
+        }
         const useBundler = await asker.confirm("\n" +
             dim("  With bundler, runs use the fastlane version pinned in the Gemfile.\n") +
             dim("  Without it, whichever fastlane is installed on the build machine.\n") +
@@ -204,10 +252,20 @@ export async function runSetupCommand(cwd, configPath, options = {}) {
         // The repository half: how it builds. This is the part that was going into
         // the machine's file and therefore never being committed — which is exactly
         // backwards, since it is the part a colleague needs.
+        //
+        // Its paths are written relative to the app's own directory, because the file
+        // lives there: `fastlane_dir` is omitted when it is the plain `fastlane` the
+        // default already assumes, and each glob is stripped of the app prefix. An
+        // app moved or duplicated keeps this file unchanged; `store.ts` puts the
+        // prefix back when it reads it.
         const wroteRepoConfig = await writeRepoConfigIfAbsent(repoConfigPath, {
-            fastlane_dir: fastlaneDir,
+            // First, as the file's identity: `remove` reads it from here.
+            slug,
+            ...(appRelative(appRoot, fastlaneDir) === "fastlane"
+                ? {}
+                : { fastlane_dir: appRelative(appRoot, fastlaneDir) }),
             runtime,
-            artifact_globs: globs,
+            artifact_globs: globs.map((g) => appRelative(appRoot, g)),
             // Written down rather than re-inferred on every readiness check: a value
             // in a file can be corrected when the guess was wrong, and setup and the
             // checklist cannot end up disagreeing about the same repository.
@@ -245,6 +303,29 @@ export async function runSetupCommand(cwd, configPath, options = {}) {
             `  ${dim(`http://localhost:${port}`)}\n` +
             "\n" +
             dim("Already running? The configuration is watched — it appears on its own.\n"));
+        // The second act. After the success message, never before it: declining
+        // everything here must leave exactly the project the lines above just
+        // announced. See `cli/adopt.ts`.
+        //
+        // The repository root, not `cwd`: `fastlaneDir` is measured from there, and
+        // so are the credential paths a Fastfile one directory down writes and the
+        // `git ls-files` that asks whether they are committed.
+        if (options.home !== undefined) {
+            const db = openDatabase(join(options.home, "laneyard.db"));
+            try {
+                const vault = await Vault.open(options.home, new SecretStore(db), new CredentialStore(db));
+                await runAdoption({ cwd: repoRoot(cwd, d.subPath), fastlaneDir, slug, vault, asker });
+            }
+            catch (cause) {
+                // Adoption is a courtesy on top of a command that has already
+                // succeeded. Its failure is reported and swallowed: exiting non-zero
+                // here would say the project was not set up, and the project is set up.
+                process.stdout.write("\n" + warn(`Could not finish reading your Fastfile: ${cause.message}\n`));
+            }
+            finally {
+                db.close();
+            }
+        }
         return 0;
     }
     finally {
@@ -264,22 +345,38 @@ async function configuredPort(configPath) {
 }
 /** The repository file, named once so the message and the write cannot disagree. */
 const LANEYARD_YML = "laneyard.yml";
-/**
- * What the first account is called when nobody says otherwise.
- *
- * The same name a lone `password_hash` is read under, so a machine set up today
- * and a machine upgraded from 0.2 sign in the same way.
- */
+/** What the first account is called when nobody says otherwise. */
 const DEFAULT_ADMIN_NAME = "admin";
 /**
  * The repository root, from where the command ran and how deep it sits.
  *
- * `laneyard.yml` belongs at the root because that is where the server reads it:
- * the clone is the repository, not the sub-directory someone was standing in.
+ * The anchor everything else is measured against: the clone is the whole
+ * repository, not the sub-directory someone was standing in, so `config.yml`'s
+ * `fastlane_dir` and the app directory `laneyard.yml` lands in are both relative
+ * to here, whichever folder setup was run from.
  */
 function repoRoot(cwd, subPath) {
     return subPath === "" ? cwd : join(cwd, ...subPath.split("/").map(() => ".."));
 }
+/**
+ * Whether git tracks anything under a path in the working copy setup ran in.
+ *
+ * A folder can be on disk and absent from git — untracked, gitignored, or a
+ * stray local copy — and such a folder does not survive the clone Laneyard
+ * builds from. `git ls-files` lists nothing under an untracked path, so an
+ * empty listing is the signal. Returns true — warning nothing — when git
+ * cannot answer at all (not a repository, git missing): the check is a
+ * courtesy, and setup must not crash on its account.
+ */
+export async function fastlaneDirIsTracked(root, dir) {
+    try {
+        const { stdout } = await exec("git", ["ls-files", "--", dir], { cwd: root });
+        return stdout.trim() !== "";
+    }
+    catch {
+        return true;
+    }
+}
 const fileExists = async (path) => {
     try {
         await readFile(path);
@@ -313,6 +410,21 @@ async function writeRepoConfigIfAbsent(path, settings) {
     await writeFile(path, doc.toString(), "utf8");
     return true;
 }
+/**
+ * A repo-root-relative path read as relative to the app directory.
+ *
+ * The inverse of what `store.ts` does when it reads an app-level file: the file
+ * lives in `<appRoot>/`, so its paths drop that prefix. `.` is the repository
+ * root — a path there is already app-relative and unchanged. A path that does
+ * not sit under the app (an unanchored glob like `**​/*.ipa`) is left as it is;
+ * it still means the same thing once the read-time prefix is applied.
+ */
+function appRelative(appRoot, p) {
+    if (appRoot === "" || appRoot === ".")
+        return p;
+    const prefix = `${appRoot}/`;
+    return p.startsWith(prefix) ? p.slice(prefix.length) : p;
+}
 /** `git@github.com:you/thing.git` reads better as `you/thing` in a sentence. */
 function repositoryLabel(url) {
     return url.replace(/^.*[:/]([^/:]+\/[^/]+?)(\.git)?$/, "$1");

package/dist/src/cli/uninstall.js

@@ -1,8 +1,8 @@
 import Database from "better-sqlite3";
 import { readdir, readFile, rm, stat } from "node:fs/promises";
 import { join } from "node:path";
-import { createInterface } from "node:readline";
 import { parse } from "yaml";
+import { OWN_FILES, OWN_FOLDERS, readLine, removePaths } from "./home.js";
 import { bad, bold, dim, field, heading, ok, warn } from "./style.js";
 export const UNINSTALL_USAGE = `laneyard uninstall [--dry-run]
 
@@ -17,9 +17,6 @@ There is no npm lifecycle hook doing any of this on \`npm uninstall\`, on
 purpose: a package manager must not delete someone's signing keys on its own,
 and a lifecycle script cannot ask.
 `;
-/** What Laneyard writes into its home, and nothing else. */
-const OWN_FILES = ["config.yml", "key", "laneyard.db", "laneyard.db-wal", "laneyard.db-shm"];
-const OWN_FOLDERS = ["workspaces", "artifacts", "logs", "runs"];
 export async function readInventory(home) {
     const empty = {
         home,
@@ -287,18 +284,6 @@ export function renderIrreversible(inv) {
         "\n" +
         dim("  Your repositories are untouched. Nothing outside " + inv.home + " is read or written.\n"));
 }
-/** Reads one line, which works the same whether it is typed or piped in. */
-async function readLine(stdin) {
-    const rl = createInterface({ input: stdin });
-    try {
-        for await (const line of rl)
-            return line.trim();
-        return "";
-    }
-    finally {
-        rl.close();
-    }
-}
 /**
  * Entry point for `laneyard uninstall`.
  *
@@ -352,14 +337,7 @@ export async function runUninstallCommand(home, args, io) {
             "\n");
         return 1;
     }
-    const removed = [];
-    for (const name of [...OWN_FILES, ...OWN_FOLDERS]) {
-        const path = join(home, name);
-        if ((await stat(path).catch(() => null)) === null)
-            continue;
-        await rm(path, { recursive: true, force: true });
-        removed.push(name);
-    }
+    const removed = await removePaths(home, [...OWN_FILES, ...OWN_FOLDERS]);
     // The folder itself only when there is nothing left in it. Anything Laneyard
     // did not write is somebody's, and this command has no business deciding
     // otherwise — `$LANEYARD_HOME` can point anywhere.

package/dist/src/config/accounts.js

@@ -1,8 +1,7 @@
 import { randomBytes } from "node:crypto";
 import { readFile, writeFile } from "node:fs/promises";
-import { Document, parseDocument, YAMLSeq } from "yaml";
+import { Document, parseDocument, YAMLMap, YAMLSeq } from "yaml";
 import { hashPassword } from "../server/auth.js";
-import { LEGACY_ADMIN_NAME } from "./load.js";
 import { serializeYaml } from "./yaml.js";
 /**
  * Accounts, as they are written to and taken out of config.yml.
@@ -53,25 +52,6 @@ async function open(path) {
         doc = new Document({});
     return doc;
 }
-/**
- * Turns a lone `server.password_hash` into the `users` form, in place.
- *
- * A file holding both is the one combination the loader refuses, so adding a
- * colleague to a 0.2 installation has to migrate it — otherwise the act of
- * inviting someone is the act of breaking the server's configuration.
- *
- * The name is the one the loader already reads that hash under, so nobody's
- * password changes meaning on the way through.
- */
-function migrateLegacyHash(doc) {
-    const hash = doc.getIn(["server", "password_hash"]);
-    if (typeof hash !== "string")
-        return;
-    doc.deleteIn(["server", "password_hash"]);
-    if (doc.hasIn(["server", "users"]))
-        return;
-    doc.setIn(["server", "users"], doc.createNode([{ name: LEGACY_ADMIN_NAME, role: "admin", password_hash: hash }]));
-}
 /** The accounts sequence, created if the file has none yet. */
 function usersSeq(doc) {
     const existing = doc.getIn(["server", "users"]);
@@ -94,21 +74,109 @@ const nameOf = (item) => item.get?.("name");
  */
 export async function upsertUserInConfig(path, entry) {
     const doc = await open(path);
-    migrateLegacyHash(doc);
     const seq = usersSeq(doc);
-    const stored = {
-        name: entry.name,
-        role: entry.role,
-        password_hash: hashPassword(entry.password),
-    };
     const at = seq.items.findIndex((item) => nameOf(item) === entry.name);
-    const node = doc.createNode(stored);
+    const password_hash = hashPassword(entry.password);
+    if (at === -1) {
+        // A new account starts with no access: `projects: []` is the empty grant,
+        // told apart from an absent field, which would mean "every project". A
+        // builder is thus created seeing nothing until an admin grants a project;
+        // an admin ignores the field, and carries it only so the entries are
+        // uniform.
+        seq.add(doc.createNode({ name: entry.name, role: entry.role, password_hash, projects: [] }));
+        await writeFile(path, serializeYaml(doc), "utf8");
+        return { created: true };
+    }
+    // Replacing changes the role and the password and nothing else: the fields are
+    // set on the existing node rather than a fresh one put in its place, so a
+    // hand-added `projects` grant — and any comment or key order — survives a
+    // password change it has nothing to do with.
+    const item = seq.items[at];
+    item.set("role", entry.role);
+    item.set("password_hash", password_hash);
+    await writeFile(path, serializeYaml(doc), "utf8");
+    return { created: false };
+}
+/**
+ * Renames an account in place, keeping everything else it carried.
+ *
+ * A rename is not an upsert. `upsertUserInConfig` keys by name, so handing it the
+ * new name would add a second account and orphan the first — dropping the role,
+ * the hash and, most quietly of all, the `projects` grants the old entry held.
+ * So the edit is to the `name` field of the matching node, through the YAML
+ * document, which leaves role, password_hash, projects and the file's comments
+ * and key order exactly where they were.
+ *
+ * Refuses when `newName` already belongs to another account rather than folding
+ * two entries into one, and refuses when no account carried `oldName` — there is
+ * nothing there to rename. Returns whether the rename happened, which is the
+ * difference between a fresh name and a collision in a sentence.
+ */
+export async function renameUserInConfig(path, oldName, newName) {
+    const doc = await open(path);
+    const users = doc.getIn(["server", "users"]);
+    if (!(users instanceof YAMLSeq))
+        return false;
+    // Checked before the target is looked up: a name already in the file must not
+    // be written onto a second entry, whoever else already holds it.
+    if (users.items.some((item) => nameOf(item) === newName))
+        return false;
+    const at = users.items.findIndex((item) => nameOf(item) === oldName);
     if (at === -1)
-        seq.add(node);
-    else
-        seq.items[at] = node;
+        return false;
+    users.items[at].set("name", newName);
     await writeFile(path, serializeYaml(doc), "utf8");
-    return { created: at === -1 };
+    return true;
+}
+/**
+ * Writes an account's project grants, replacing whatever list it had.
+ *
+ * The one edit behind `PUT /api/users/:name/projects`: it sets `projects` on the
+ * named account through the YAML document, so a hand-written file keeps its
+ * comments and its key order. Returns false when no account carried that name,
+ * so the caller can answer 404 rather than write a grant onto nobody.
+ */
+export async function setUserProjectsInConfig(path, name, projects) {
+    const doc = await open(path);
+    const users = doc.getIn(["server", "users"]);
+    if (!(users instanceof YAMLSeq))
+        return false;
+    const at = users.items.findIndex((item) => nameOf(item) === name);
+    if (at === -1)
+        return false;
+    users.items[at].set("projects", doc.createNode(projects));
+    await writeFile(path, serializeYaml(doc), "utf8");
+    return true;
+}
+/**
+ * Strips a project's slug from every account's grants.
+ *
+ * Called when a project is removed: a grant pointing at a project that no longer
+ * exists is dead data, and — the same hazard as a re-used vault slug — a project
+ * re-created later under that slug must not silently inherit an old grant. Only
+ * accounts that carried the slug are touched, so a file with no grants at all
+ * comes back byte-for-byte unchanged.
+ */
+export async function removeProjectFromAccounts(path, slug) {
+    const doc = await open(path);
+    const users = doc.getIn(["server", "users"]);
+    if (!(users instanceof YAMLSeq))
+        return;
+    let changed = false;
+    for (const item of users.items) {
+        if (!(item instanceof YAMLMap))
+            continue;
+        const projects = item.get("projects");
+        if (!(projects instanceof YAMLSeq))
+            continue;
+        const at = projects.items.findIndex((n) => (n && typeof n === "object" && "value" in n ? n.value : n) === slug);
+        if (at !== -1) {
+            projects.items.splice(at, 1);
+            changed = true;
+        }
+    }
+    if (changed)
+        await writeFile(path, serializeYaml(doc), "utf8");
 }
 /**
  * Takes an account out of config.yml, leaving the rest of the file alone.
@@ -118,7 +186,6 @@ export async function upsertUserInConfig(path, entry) {
  */
 export async function removeUserFromConfig(path, name) {
     const doc = await open(path);
-    migrateLegacyHash(doc);
     const users = doc.getIn(["server", "users"]);
     if (!(users instanceof YAMLSeq))
         return false;
@@ -130,7 +197,7 @@ export async function removeUserFromConfig(path, name) {
     return true;
 }
 /**
- * Does this file already declare somebody, in either of the two forms?
+ * Does this file already declare somebody?
  *
  * Asked before a question is put to the user rather than after: `laneyard setup`
  * only asks for an admin's name on a machine that has none, and asking anyway
@@ -138,7 +205,7 @@ export async function removeUserFromConfig(path, name) {
  */
 export async function hasAccount(path) {
     const doc = await open(path);
-    return doc.hasIn(["server", "password_hash"]) || doc.hasIn(["server", "users"]);
+    return doc.hasIn(["server", "users"]);
 }
 /**
  * Creates the first admin if the file declares no account at all.
@@ -151,12 +218,9 @@ export async function hasAccount(path) {
  */
 export async function ensureFirstAdmin(path, name) {
     const doc = await open(path);
-    if (doc.hasIn(["server", "password_hash"]) || doc.hasIn(["server", "users"]))
+    if (doc.hasIn(["server", "users"]))
         return null;
     const password = randomBytes(9).toString("base64url");
-    // The `users` form, never a bare `password_hash`: writing the legacy shape on
-    // a fresh machine would mean every new installation immediately needs the
-    // migration above the first time someone adds a colleague.
     doc.setIn(["server", "users"], doc.createNode([{ name, role: "admin", password_hash: hashPassword(password) }]));
     await writeFile(path, serializeYaml(doc), "utf8");
     return password;

package/dist/src/config/load.js

@@ -1,13 +1,6 @@
 import { readFile } from "node:fs/promises";
 import { parse as parseYaml } from "yaml";
 import { repoConfigSchema, serverConfigSchema } from "./schema.js";
-/**
- * The name a lone `password_hash` is read under.
- *
- * Also the name the legacy `{ password }` login form authenticates as, which is
- * what lets a 0.2 installation upgrade without anyone editing a file.
- */
-export const LEGACY_ADMIN_NAME = "admin";
 /** Reads and validates a YAML file. Never fails by throwing: the caller decides. */
 async function loadYamlFile(path, schema) {
     let raw;
@@ -34,26 +27,13 @@ async function loadYamlFile(path, schema) {
     return { ok: true, config: parsed.data };
 }
 /**
- * Folds both ways of declaring accounts into the one the rest of the code sees.
+ * Validates the declared accounts.
  *
  * Every refusal here is a locked room avoided: a server with no account, or
  * with none that can administer it, is one nobody can fix from the interface.
  */
 function normaliseUsers(server) {
-    const { password_hash, users } = server;
-    if (password_hash !== undefined && users !== undefined) {
-        return {
-            ok: false,
-            error: "server.password_hash and server.users both set — they are two ways to say the same " +
-                "thing and there is no obvious winner. Keep server.users and drop server.password_hash.",
-        };
-    }
-    if (password_hash !== undefined) {
-        return {
-            ok: true,
-            users: [{ name: LEGACY_ADMIN_NAME, role: "admin", password_hash }],
-        };
-    }
+    const { users } = server;
     if (users === undefined) {
         return {
             ok: false,
@@ -95,11 +75,7 @@ export async function loadServerConfig(path) {
     }
     // The display name falls back to the slug rather than being optional everywhere downstream.
     const projects = res.config.projects.map((p) => ({ ...p, name: p.name ?? p.slug }));
-    // `password_hash` is dropped rather than carried along: it has been folded
-    // into `users`, and leaving it in place would give downstream code a second
-    // source of truth to disagree with.
-    const { password_hash: _dropped, ...server } = res.config.server;
-    return { ok: true, config: { server: { ...server, users: accounts.users }, projects } };
+    return { ok: true, config: { server: { ...res.config.server, users: accounts.users }, projects } };
 }
 export async function loadRepoConfig(path) {
     return loadYamlFile(path, repoConfigSchema);

package/dist/src/config/resolve.js

@@ -1,5 +1,41 @@
 import { projectSettingsSchema } from "./schema.js";
 const SETTING_KEYS = Object.keys(projectSettingsSchema.shape);
+/**
+ * Prefixes an app-relative path with the app directory.
+ *
+ * `.` (or an empty prefix) is the repository root, and a path there is already
+ * repo-root-relative — nothing to add.
+ */
+function underApp(appRoot, p) {
+    return appRoot === "" || appRoot === "." ? p : `${appRoot}/${p}`;
+}
+/**
+ * Reads an app-level `laneyard.yml` as if it had been written at the repository
+ * root.
+ *
+ * The file declares its paths relative to its own directory —
+ * `fastlane_dir: fastlane`, `artifact_globs: ['**​/*.aab']` — so an app moved or
+ * duplicated keeps its file unchanged. But everything downstream resolves paths
+ * as repo-root-relative (`join(workspacePath, …)`, globs with `cwd:
+ * workspacePath`). So the app-relativity is collapsed here, once, at the
+ * boundary: the two path fields are prefixed with the app directory before the
+ * merge ever sees them, and nothing past this point learns a new rule.
+ *
+ * Only the path fields move. `platforms`, `runtime`, `timeout_minutes`,
+ * `interactive_default`, `required_secrets` and `retention` are not paths and
+ * pass through untouched. A root-level file is never handed here: its paths are
+ * already repo-root-relative.
+ */
+export function normaliseAppConfig(repo, appRoot) {
+    const out = { ...repo };
+    if (repo.fastlane_dir !== undefined) {
+        out.fastlane_dir = underApp(appRoot, repo.fastlane_dir);
+    }
+    if (repo.artifact_globs !== undefined) {
+        out.artifact_globs = repo.artifact_globs.map((g) => underApp(appRoot, g));
+    }
+    return out;
+}
 /**
  * Merges the three sources field by field.
  * `undefined` means "not set"; any other value, including an empty array

package/dist/src/config/schema.js

@@ -1,6 +1,16 @@
 import { z } from "zod";
+/** A slug is used as a folder name and a URL segment. */
+const slugSchema = z
+    .string()
+    .regex(/^[a-z0-9][a-z0-9-]*$/, "slug: lowercase letters, digits and hyphens only");
 /** Build behaviour settings. They can come from the repository or the server. */
 export const projectSettingsSchema = z.object({
+    // The project this file belongs to. Written by `setup` and read by `remove`,
+    // which runs from the app's directory and takes the slug from here rather than
+    // from an argument. An identity, not a path — `normaliseAppConfig` leaves it
+    // untouched — and the running server ignores it, identifying the project
+    // through `config.yml`. Optional so an older file without it still parses.
+    slug: slugSchema.optional(),
     fastlane_dir: z.string().default("fastlane"),
     runtime: z.enum(["bundle", "system"]).default("bundle"),
     timeout_minutes: z.number().int().positive().default(60),
@@ -21,10 +31,6 @@ export const projectSettingsSchema = z.object({
 });
 /** Same vocabulary, but everything is optional in the files. */
 export const projectSettingsInputSchema = projectSettingsSchema.partial();
-/** A slug is used as a folder name and a URL segment. */
-const slugSchema = z
-    .string()
-    .regex(/^[a-z0-9][a-z0-9-]*$/, "slug: lowercase letters, digits and hyphens only");
 export const projectEntrySchema = projectSettingsInputSchema.extend({
     slug: slugSchema,
     name: z.string().optional(),
@@ -58,16 +64,26 @@ export const userEntrySchema = z.object({
     name: z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/, "name: letters, digits, dot, dash, underscore"),
     role: userRoleSchema,
     password_hash: z.string().min(1),
+    /**
+     * Which projects a builder may reach, by slug. Three-way, and the three ways
+     * carry back-compat for free:
+     *
+     *   absent → every project. A file written before this feature has no field
+     *     on anyone, so nobody loses access on upgrade.
+     *   []     → no project. What account creation now writes, so a new builder
+     *     starts with nothing until granted.
+     *   a list → exactly those slugs.
+     *
+     * An `admin` ignores it entirely: managing the server is their whole role.
+     */
+    projects: z.array(slugSchema).optional(),
 });
 export const serverConfigSchema = z.object({
     server: z.object({
         port: z.number().int().positive().default(7890),
         bind: z.string().default("0.0.0.0"),
-        // Both optional in the file, exactly one required by the loader. The old
-        // single-password form is what a 0.2 installation has on disk, and it must
-        // keep working unedited; `load.ts` normalises it into `users` so that
-        // nothing downstream ever learns which of the two forms was written.
-        password_hash: z.string().min(1).optional(),
+        // Optional in the file, required by the loader: a configuration that
+        // declares no account is refused rather than started.
         users: z.array(userEntrySchema).optional(),
         // Only 1 is accepted. Runs share one working directory per project, so a
         // higher number would promise parallel builds that never happen — the

package/dist/src/config/store.js

@@ -1,6 +1,7 @@
 import { watch } from "node:fs";
 import { loadRepoConfig, loadServerConfig } from "./load.js";
-import { resolveProjectSettings } from "./resolve.js";
+import { normaliseAppConfig, resolveProjectSettings } from "./resolve.js";
+import { appRootOf } from "../heuristics/platforms.js";
 import { join } from "node:path";
 /**
  * The server's live configuration.
@@ -68,13 +69,36 @@ export class ConfigStore {
      * Resolves a project's effective settings by reading its workspace's
      * laneyard.yml if it exists. The workspace may not be cloned yet: we
      * then fall back to the project's block and the defaults.
+     *
+     * The file is looked for in two places, in order:
+     *
+     * 1. `<workspace>/<appRoot>/laneyard.yml` — the app-level file, its paths
+     *    relative to the app's own directory, so a monorepo of N apps carries N
+     *    of them. Normalised back to repo-root-relative before the merge.
+     * 2. `<workspace>/laneyard.yml` — the repository-root file, repo-root-relative,
+     *    which is what existing installs have and keeps working unchanged.
+     *
+     * `appRoot` is derived from the project's `fastlane_dir` as declared in
+     * `config.yml` — the server-side anchor, present for every monorepo project by
+     * necessity and what points at the app before any repo file is read. When it is
+     * the repository root (the default `fastlane`), the two locations coincide and
+     * nothing changes.
      */
     async resolve(slug, workspacePath) {
         const entry = this.project(slug);
         if (!entry)
             return null;
-        const repoRes = await loadRepoConfig(join(workspacePath, "laneyard.yml"));
-        const repo = repoRes.ok ? repoRes.config : null;
+        const appRoot = appRootOf(entry.fastlane_dir);
+        let repo = null;
+        if (appRoot !== ".") {
+            const appRes = await loadRepoConfig(join(workspacePath, appRoot, "laneyard.yml"));
+            if (appRes.ok)
+                repo = normaliseAppConfig(appRes.config, appRoot);
+        }
+        if (repo === null) {
+            const rootRes = await loadRepoConfig(join(workspacePath, "laneyard.yml"));
+            repo = rootRes.ok ? rootRes.config : null;
+        }
         const { settings, provenance } = resolveProjectSettings(entry, repo);
         return { entry, settings, provenance };
     }