laneyard 0.5.0 → 0.6.0

package/dist/src/cli/adopt.js

@@ -0,0 +1,221 @@
+import { execFile } from "node:child_process";
+import { readFile, writeFile } from "node:fs/promises";
+import { basename, isAbsolute, join, resolve } from "node:path";
+import { promisify } from "node:util";
+import { fieldsOf } from "../credentials/kinds.js";
+import { appRootOf } from "../heuristics/platforms.js";
+import { proposalsFor } from "../fastfile/adoption.js";
+import { splice } from "../fastfile/splice.js";
+import { scanFastfile } from "../sidecar/scan.js";
+import { bold, dim, heading, ok, warn } from "./style.js";
+const exec = promisify(execFile);
+/**
+ * Setup's second act: what to do about credentials the Fastfile names outright.
+ *
+ * **It runs after the project is already set up, and that ordering is the
+ * whole guarantee.** Declining everything here must leave exactly the project
+ * setup produced before this feature existed — so the act is separate rather
+ * than folded into setup's final confirmation, and "refusing works" is true by
+ * construction instead of by promise.
+ *
+ * Nothing it can do is required. No Ruby with Prism, no Fastfile, an
+ * unparseable file, a literal naming a file that is not on disk: every one of
+ * those means "nothing proposed", and setup carries on.
+ */
+export async function runAdoption(options) {
+    const { cwd, fastlaneDir, slug, vault, asker } = options;
+    const literals = await scanFastfile(cwd, fastlaneDir);
+    if (literals === null) {
+        process.stdout.write("\n" + dim("Fastfile not analysed — no Ruby with Prism available. Nothing else changes.\n"));
+        return { applied: 0 };
+    }
+    // A literal pointing at nothing is dropped rather than reported: there is no
+    // file to lift into the vault, and patching to a variable nothing supplies
+    // would trade one broken build for another.
+    // Resolved once, here, so the prompt, the vault write and the git check all
+    // speak about the same file rather than each resolving the path again.
+    const found = new Map();
+    const proposals = [];
+    for (const proposal of proposalsFor(literals)) {
+        if (proposal.tier === "file") {
+            const hit = await readCredential(cwd, fastlaneDir, proposal);
+            if (hit === null)
+                continue;
+            found.set(proposal, hit);
+        }
+        proposals.push(proposal);
+    }
+    if (proposals.length === 0)
+        return { applied: 0 };
+    process.stdout.write(heading("I read your Fastfile"));
+    const accepted = [];
+    for (const proposal of proposals) {
+        process.stdout.write(describe(fastlaneDir, proposal) + "\n");
+        if (!(await asker.confirm(`  Store it here and use ${bold(proposal.varName)}?`, proposal.checked))) {
+            continue;
+        }
+        accepted.push(proposal.tier === "secret" ? await named(asker, proposal) : proposal);
+    }
+    if (accepted.length === 0) {
+        process.stdout.write(dim("\nNothing written. Your Fastfile is as it was.\n"));
+        return { applied: 0 };
+    }
+    // The vault first, always. If lifting a credential fails, no Fastfile has
+    // been patched to read a variable that nothing supplies.
+    for (const proposal of accepted)
+        await store(vault, slug, asker, proposal, found.get(proposal));
+    const path = join(cwd, fastlaneDir, "Fastfile");
+    const previous = await readFile(path, "utf8");
+    const edits = accepted.flatMap((p) => (options.editFor ? [options.editFor(p)] : p.edits));
+    await writeFile(path, splice(previous, edits), "utf8");
+    // Verified with Prism rather than with fastlane: setup has no server to ask
+    // for a lane list, and "does it still parse" is the question that matters.
+    // Same contract as `FastfileStore.write` — the previous content goes back on
+    // disk before this function returns, and no backup file is left behind.
+    if ((await scanFastfile(cwd, fastlaneDir)) === null) {
+        await writeFile(path, previous, "utf8");
+        process.stdout.write("\n" + warn("The patch stopped the Fastfile parsing. It has been put back as it was.\n"));
+        return { applied: 0 };
+    }
+    await report(cwd, fastlaneDir, accepted, found);
+    return { applied: accepted.length };
+}
+/**
+ * The bytes behind a `file` proposal, or null when the path names nothing.
+ *
+ * **A relative path in a Fastfile has no single meaning.** `"./play.json"`
+ * resolves against whatever directory fastlane was invoked from, which is
+ * usually the app root — the fastlane folder's parent — but a project that runs
+ * fastlane from the repository root, or writes paths relative to the fastlane
+ * folder itself, is equally ordinary. Nothing in the file says which.
+ *
+ * So all three are tried, nearest first. This costs nothing to be wrong about:
+ * the patch replaces the literal with `ENV.fetch` either way, and the only
+ * thing the path is needed for is finding bytes to put in the vault. Failing to
+ * find them means no proposal, which is the safe answer.
+ */
+async function readCredential(cwd, fastlaneDir, proposal) {
+    const value = proposal.literal.value;
+    const candidates = isAbsolute(value)
+        ? [value]
+        : [
+            resolve(cwd, appRootOf(fastlaneDir), value),
+            resolve(cwd, fastlaneDir, value),
+            resolve(cwd, value),
+        ];
+    for (const path of candidates) {
+        const bytes = await readFile(path).catch(() => null);
+        if (bytes !== null)
+            return { bytes, path };
+    }
+    return null;
+}
+/** One proposal, as three lines: where, what, and why it will not survive. */
+function describe(fastlaneDir, proposal) {
+    const { literal } = proposal;
+    // A path is shown; a secret is not. Tier 3 is a value someone called a token
+    // or a password, and setup's output is pasted into bug reports and kept in CI
+    // transcripts — printing it there would be this feature leaking the very
+    // thing it exists to put away. The file and line above say where to look.
+    const shown = proposal.tier === "file"
+        ? `"${literal.value}"`
+        : proposal.tier === "inline"
+            ? dim("(a key, inline in the file)")
+            : dim("(a literal value, masked)");
+    const why = proposal.tier === "inline"
+        ? "This key is in your repository in cleartext."
+        : proposal.tier === "file"
+            ? "That path does not survive the clone: Laneyard builds from your remote."
+            : "A literal secret in a build file is a secret in your history.";
+    return ("\n" +
+        `  ${bold(`${fastlaneDir}/Fastfile:${literal.line}`)}   ${literal.action}(${literal.arg}:)\n` +
+        `                        → ${shown}\n` +
+        dim(`  ${why}\n`));
+}
+/**
+ * A tier-3 proposal carrying the variable name the user actually wants.
+ *
+ * This is the one tier whose name is a guess. Tiers 1 and 2 take theirs from
+ * `credentials/kinds.ts`, which holds the names fastlane itself reads; a
+ * literal secret has no such table, so the name is assembled from the action
+ * and the argument — `PILOT_API_TOKEN` — and a project that already calls that
+ * variable something else would end up with the vault holding one name and the
+ * patched Fastfile reading another. Nothing would report it: the run would
+ * simply meet an absent variable.
+ *
+ * The replacement is rebuilt from the answer rather than patched afterwards,
+ * so the name stored and the name read cannot drift apart.
+ */
+async function named(asker, proposal) {
+    const varName = await asker.ask("  variable name", proposal.varName);
+    return {
+        ...proposal,
+        varName,
+        edits: [{ ...proposal.edits[0], replacement: `ENV.fetch("${varName}")` }],
+    };
+}
+/** Lifts one accepted proposal into the vault. */
+async function store(vault, slug, asker, proposal, found) {
+    if (proposal.kind === undefined) {
+        await vault.set(slug, proposal.varName, proposal.literal.value, true);
+        return;
+    }
+    const bytes = proposal.tier === "inline" ? Buffer.from(proposal.literal.value, "utf8") : found.bytes;
+    // The original name is kept: some tools read meaning from it, and
+    // `materialise.ts` already relies on `AuthKey_<KEY ID>.p8` surviving intact.
+    const fileName = proposal.tier === "inline" ? `${proposal.kind}.key` : basename(found.path);
+    // The fields the file cannot carry. `fieldsOf` is the same table the web
+    // upload form reads, so the CLI cannot end up asking for a different set.
+    const fields = {};
+    for (const field of fieldsOf(proposal.kind)) {
+        if (field.optional)
+            continue;
+        const suggested = proposal.suggestedFields[field.name] ?? field.suggested ?? "";
+        fields[field.name] = await asker.ask(`  ${field.label}`, suggested);
+    }
+    await vault.setCredential(slug, proposal.kind, { fileName, fileBytes: bytes, fields, varNames: {} });
+}
+/** What is left for the user to do, including the part Laneyard will not do. */
+async function report(cwd, fastlaneDir, accepted, found) {
+    process.stdout.write("\n" +
+        ok(`Stored ${accepted.length} credential${accepted.length > 1 ? "s" : ""} in this machine's vault.\n`) +
+        ok(`Patched ${fastlaneDir}/Fastfile.\n`) +
+        "\n" +
+        // Said plainly because it is the trap `addProjectToConfig` already
+        // documents: Laneyard builds from a clone of the remote, so nothing in
+        // the working copy reaches a run until it is pushed.
+        warn("Commit and push it, or your runs still read the old file.\n") +
+        dim("  git diff -- " + join(fastlaneDir, "Fastfile") + "\n"));
+    // Said, never done. Removing a file from someone's repository is not
+    // setup's to decide, and `git rm --cached` does not take it out of the
+    // history anyway — so the honest thing is to name it.
+    const tracked = await trackedCredentials(cwd, accepted, found);
+    if (tracked.length > 0) {
+        process.stdout.write("\n" +
+            warn(`${tracked.join(", ")} ${tracked.length > 1 ? "are" : "is"} tracked by git.\n`) +
+            dim("  The patch does not take it out of your history. Rotating the key does.\n"));
+    }
+}
+/**
+ * Which of the accepted credentials git already has. Silent when git cannot
+ * answer — the same courtesy `fastlaneDirIsTracked` extends.
+ *
+ * Asked about the *resolved* paths, not the literals: `"./play.json"` written
+ * in a Fastfile one directory down is not a path `git ls-files` can answer
+ * about from the repository root.
+ */
+async function trackedCredentials(cwd, accepted, found) {
+    const paths = accepted.flatMap((p) => {
+        const hit = found.get(p);
+        return hit ? [hit.path] : [];
+    });
+    if (paths.length === 0)
+        return [];
+    try {
+        const { stdout } = await exec("git", ["ls-files", "--", ...paths], { cwd });
+        return stdout.split("\n").filter((line) => line.trim() !== "");
+    }
+    catch {
+        return [];
+    }
+}

package/dist/src/cli/remove.js

@@ -2,6 +2,7 @@ import Database from "better-sqlite3";
 import { existsSync } from "node:fs";
 import { rm, stat } from "node:fs/promises";
 import { join } from "node:path";
+import { loadRepoConfig } from "../config/load.js";
 import { ConfigStore } from "../config/store.js";
 import { CredentialStore } from "../db/credentials.js";
 import { openDatabase } from "../db/open.js";
@@ -12,14 +13,16 @@ import { LogStore } from "../logs/store.js";
 import { Vault } from "../secrets/vault.js";
 import { readLine } from "./home.js";
 import { bad, bold, dim, field, heading, ok, warn } from "./style.js";
-export const REMOVE_USAGE = `laneyard remove <slug> [--dry-run]
+export const REMOVE_USAGE = `laneyard remove [--dry-run]
 
-Removes everything Laneyard holds for one project: its block in config.yml, its
-clone, its artifacts, its run history and logs, and its own secrets and signing
-blocks in the vault. It does not touch the git remote, the credential originals,
-or the global secrets and signing blocks other projects share.
+Run from your app's directory — the one that holds laneyard.yml. Removes
+everything Laneyard holds for that project: its block in config.yml, its clone,
+its artifacts, its run history and logs, and its own secrets and signing blocks
+in the vault. It also removes the repository's laneyard.yml, which you then
+commit. It does not touch the git remote, the credential originals, or the
+global secrets and signing blocks other projects share.
 
-  laneyard remove <slug> --dry-run   show what would go and stop
+  laneyard remove --dry-run   show what would go and stop
 
 The run history is the one thing here nothing can rebuild, so it is confirmed by
 typing the project's slug back, not \`y\`.
@@ -51,7 +54,7 @@ async function readCounts(home, slug) {
     }
 }
 /** The inventory, and what the removal will and will not reach. */
-function renderInventory(slug, name, home, counts, clonePath) {
+function renderInventory(slug, name, home, counts, clonePath, ymlPath) {
     const cloned = existsSync(clonePath);
     return (heading(`laneyard remove "${slug}"`) +
         field("home", home) + "\n" +
@@ -61,6 +64,8 @@ function renderInventory(slug, name, home, counts, clonePath) {
         field("clone", cloned ? clonePath : dim("not cloned")) + "\n" +
         field("secrets", plural(counts.secrets, "project secret")) + "\n" +
         field("signing", plural(counts.signingBlocks, "project signing block")) + "\n" +
+        // The one thing removed outside `home`: the repository's own file.
+        field("laneyard.yml", ymlPath) + "\n" +
         heading("what will not be touched") +
         dim("  the git remote — the repository is yours, on your host and your disk.\n") +
         dim("  the credential originals — Laneyard removes only its own encrypted copy;\n") +
@@ -68,32 +73,41 @@ function renderInventory(slug, name, home, counts, clonePath) {
         dim("  global secrets and global signing blocks — shared by every project.\n"));
 }
 /**
- * Entry point for `laneyard remove <slug>`.
+ * Entry point for `laneyard remove`, run from the app's own directory.
  *
- * The command-line equivalent of removing a project from the interface. It reads
- * the inventory first, prints what will and will not go, and only then asks for
- * the slug typed back — the same gate the web route uses, for the same reason:
- * the run history it deletes is the one thing here nothing can rebuild.
+ * The project is the one whose `laneyard.yml` sits in `cwd`; the slug is read
+ * from that file rather than given as an argument, so the command names what the
+ * directory already is. It reads the inventory first, prints what will and will
+ * not go, and only then asks for the slug typed back — the same gate the web
+ * route uses, for the same reason: the run history it deletes is the one thing
+ * here nothing can rebuild.
  */
-export async function runRemoveCommand(home, args, io) {
+export async function runRemoveCommand(home, cwd, args, io) {
     let dryRun = false;
-    let slug = null;
     for (const arg of args) {
         if (arg === "--dry-run" || arg === "-n")
             dryRun = true;
-        else if (arg.startsWith("-")) {
-            io.err(`Unknown option: ${arg}\n\n${REMOVE_USAGE}`);
-            return 1;
-        }
-        else if (slug === null)
-            slug = arg;
         else {
-            io.err(`One project at a time. Give a single slug.\n\n${REMOVE_USAGE}`);
+            io.err(`Unknown option: ${arg}\n\n${REMOVE_USAGE}`);
             return 1;
         }
     }
-    if (slug === null) {
-        io.err(`Which project? Give its slug.\n\n${REMOVE_USAGE}`);
+    // The project is the one whose `laneyard.yml` is here — the file setup wrote
+    // and the slug it recorded in it. Run from anywhere else and there is nothing
+    // to name, which is the whole point: a project is removed from where it lives.
+    const ymlPath = join(cwd, "laneyard.yml");
+    if (!existsSync(ymlPath)) {
+        io.err("\n" +
+            bad("No laneyard.yml here.") +
+            " Run `laneyard remove` from your app's directory — the one that holds it.\n");
+        return 1;
+    }
+    const repo = await loadRepoConfig(ymlPath);
+    const slug = repo.ok ? repo.config.slug : undefined;
+    if (slug === undefined || slug === "") {
+        io.err("\n" +
+            bad("This laneyard.yml has no slug.") +
+            " Run `laneyard setup` again to record which project it is.\n");
         return 1;
     }
     const configPath = join(home, "config.yml");
@@ -122,10 +136,10 @@ export async function runRemoveCommand(home, args, io) {
             " Wait for it to finish, or cancel it, then remove the project. Nothing was removed.\n");
         return 1;
     }
-    io.out(renderInventory(slug, entry.name, home, counts, clonePath));
+    io.out(renderInventory(slug, entry.name, home, counts, clonePath, ymlPath));
     if (dryRun) {
         io.out("\n" +
-            dim(`Nothing was removed. Run \`laneyard remove ${slug}\` without --dry-run to remove it.`) +
+            dim("Nothing was removed. Run `laneyard remove` without --dry-run to remove it.") +
             "\n");
         return 0;
     }
@@ -155,6 +169,10 @@ export async function runRemoveCommand(home, args, io) {
             workspacePath: (s) => join(home, "workspaces", s),
             artifactsDir: (runId) => join(home, "artifacts", String(runId)),
         }, slug);
+        // The machine data went first, so a file removed here is one whose project
+        // is already gone — never the other way round. `force` because the removal
+        // must still report success if the file was deleted by hand meanwhile.
+        await rm(ymlPath, { force: true }).catch(() => { });
         io.out(heading("removed") +
             ok(`"${slug}": ${plural(result.runs, "run")}, ${plural(result.secrets, "secret")}, ` +
                 `${plural(result.signingBlocks, "signing block")}.\n`) +
@@ -162,7 +180,11 @@ export async function runRemoveCommand(home, args, io) {
                 ? dim(`  ${result.clonePath} is gone.\n`)
                 : dim("  There was no clone to remove.\n")) +
             dim(`  The block is out of ${configPath}.\n`) +
+            dim(`  ${ymlPath} is gone.\n`) +
             "\n" +
+            // The file is committed, so deleting the working copy is not the end of
+            // it — the same trap adoption's report names about a patched Fastfile.
+            warn("Commit its removal, or a clone still carries the laneyard.yml.\n") +
             warn("The git remote and your credential originals were never Laneyard's to touch, and " +
                 "global secrets and signing blocks were left alone.\n"));
         return 0;

package/dist/src/cli/setup.js

@@ -10,6 +10,11 @@ import { bad, bold, dim, field, heading, ok, warn } from "./style.js";
 import { acceptingAsker, terminalAsker } from "./prompt.js";
 import { detectProject } from "./detect.js";
 import { appRootOf } from "../heuristics/platforms.js";
+import { CredentialStore } from "../db/credentials.js";
+import { openDatabase } from "../db/open.js";
+import { SecretStore } from "../db/secrets.js";
+import { Vault } from "../secrets/vault.js";
+import { runAdoption } from "./adopt.js";
 const exec = promisify(execFile);
 /**
  * Adds a project block to config.yml while preserving the rest of the file.
@@ -254,6 +259,8 @@ export async function runSetupCommand(cwd, configPath, options = {}) {
         // app moved or duplicated keeps this file unchanged; `store.ts` puts the
         // prefix back when it reads it.
         const wroteRepoConfig = await writeRepoConfigIfAbsent(repoConfigPath, {
+            // First, as the file's identity: `remove` reads it from here.
+            slug,
             ...(appRelative(appRoot, fastlaneDir) === "fastlane"
                 ? {}
                 : { fastlane_dir: appRelative(appRoot, fastlaneDir) }),
@@ -296,6 +303,29 @@ export async function runSetupCommand(cwd, configPath, options = {}) {
             `  ${dim(`http://localhost:${port}`)}\n` +
             "\n" +
             dim("Already running? The configuration is watched — it appears on its own.\n"));
+        // The second act. After the success message, never before it: declining
+        // everything here must leave exactly the project the lines above just
+        // announced. See `cli/adopt.ts`.
+        //
+        // The repository root, not `cwd`: `fastlaneDir` is measured from there, and
+        // so are the credential paths a Fastfile one directory down writes and the
+        // `git ls-files` that asks whether they are committed.
+        if (options.home !== undefined) {
+            const db = openDatabase(join(options.home, "laneyard.db"));
+            try {
+                const vault = await Vault.open(options.home, new SecretStore(db), new CredentialStore(db));
+                await runAdoption({ cwd: repoRoot(cwd, d.subPath), fastlaneDir, slug, vault, asker });
+            }
+            catch (cause) {
+                // Adoption is a courtesy on top of a command that has already
+                // succeeded. Its failure is reported and swallowed: exiting non-zero
+                // here would say the project was not set up, and the project is set up.
+                process.stdout.write("\n" + warn(`Could not finish reading your Fastfile: ${cause.message}\n`));
+            }
+            finally {
+                db.close();
+            }
+        }
         return 0;
     }
     finally {

package/dist/src/config/schema.js

@@ -1,6 +1,16 @@
 import { z } from "zod";
+/** A slug is used as a folder name and a URL segment. */
+const slugSchema = z
+    .string()
+    .regex(/^[a-z0-9][a-z0-9-]*$/, "slug: lowercase letters, digits and hyphens only");
 /** Build behaviour settings. They can come from the repository or the server. */
 export const projectSettingsSchema = z.object({
+    // The project this file belongs to. Written by `setup` and read by `remove`,
+    // which runs from the app's directory and takes the slug from here rather than
+    // from an argument. An identity, not a path — `normaliseAppConfig` leaves it
+    // untouched — and the running server ignores it, identifying the project
+    // through `config.yml`. Optional so an older file without it still parses.
+    slug: slugSchema.optional(),
     fastlane_dir: z.string().default("fastlane"),
     runtime: z.enum(["bundle", "system"]).default("bundle"),
     timeout_minutes: z.number().int().positive().default(60),
@@ -21,10 +31,6 @@ export const projectSettingsSchema = z.object({
 });
 /** Same vocabulary, but everything is optional in the files. */
 export const projectSettingsInputSchema = projectSettingsSchema.partial();
-/** A slug is used as a folder name and a URL segment. */
-const slugSchema = z
-    .string()
-    .regex(/^[a-z0-9][a-z0-9-]*$/, "slug: lowercase letters, digits and hyphens only");
 export const projectEntrySchema = projectSettingsInputSchema.extend({
     slug: slugSchema,
     name: z.string().optional(),

package/dist/src/fastfile/adoption.js

@@ -0,0 +1,142 @@
+import { defaultVarNames } from "../credentials/kinds.js";
+/** Which action arguments name a credential file, and which block they mean. */
+const FILE_ARGS = [
+    { action: /^app_store_connect_api_key$/, arg: "key_filepath", kind: "apple_asc" },
+    { action: /^(supply|upload_to_play_store|validate_play_store_json_key)$/, arg: "json_key", kind: "play_service_account" },
+];
+/**
+ * Arguments holding a credential's *contents* inline, and the argument they
+ * must become.
+ *
+ * The rename is not cosmetic. `materialise.ts` stores a block as a file and
+ * exports its *path*; there is no slot that exports contents. Replacing the
+ * value alone would hand a filesystem path to an argument expecting PEM text,
+ * and fastlane's complaint would point nowhere near here.
+ */
+const INLINE_ARGS = [
+    { action: /^app_store_connect_api_key$/, arg: "key_content", becomes: "key_filepath", kind: "apple_asc" },
+    { action: /^(supply|upload_to_play_store)$/, arg: "json_key_data", becomes: "json_key", kind: "play_service_account" },
+];
+/** What a literal secret looks like when nothing more specific matched. */
+const SECRET_ARG = /(^|_)(token|password|secret|api_key|url)$/;
+/** `AuthKey_<KEY ID>.p8` is the name fastlane's own documentation uses. */
+const P8_KEY_ID = /(?:^|\/)AuthKey_([A-Z0-9]+)\.p8$/;
+/**
+ * Turns what a Fastfile literally says into what could be done about it.
+ *
+ * Pure, and deliberately so: every judgement about credentials is here, in one
+ * function, beside the one table that describes them. `ruby/scan.rb` reports
+ * what the file says and knows nothing of any of this.
+ *
+ * The order of the three passes is the order of confidence. A `json_key`
+ * pointing at a literal path is unambiguous; an `api_token` holding a literal
+ * might be a real token or might be a placeholder, so it falls through to the
+ * unchecked tier rather than being claimed by a rule that was almost right.
+ */
+export function proposalsFor(literals) {
+    const out = [];
+    // The App Store Connect identifiers written inline, to be carried by whatever
+    // proposal creates the `apple_asc` block. Attributed by action alone: the
+    // literals arrive as a flat list with no call identity, and the vault holds
+    // one `apple_asc` block per project — so a second `app_store_connect_api_key`
+    // call's key is already unrepresentable, and gathering both calls' identifiers
+    // here does not widen a limit the block model does not already impose.
+    const appleIdentifiers = literals.filter((l) => l.action === "app_store_connect_api_key" &&
+        (l.arg === "key_id" || l.arg === "issuer_id") &&
+        l.value.trim() !== "");
+    for (const literal of literals) {
+        if (literal.value.trim() === "")
+            continue;
+        const file = FILE_ARGS.find((r) => r.action.test(literal.action) && r.arg === literal.arg);
+        if (file) {
+            const name = defaultVarNames(file.kind)["path"];
+            const identifiers = file.kind === "apple_asc" ? appleIdentifierRewrites(appleIdentifiers) : EMPTY;
+            out.push({
+                tier: "file",
+                kind: file.kind,
+                varName: name,
+                // The explicit literal wins over the Key ID read from the filename.
+                suggestedFields: { ...suggestedFields(file.kind, literal.value), ...identifiers.fields },
+                literal,
+                edits: [
+                    { start: literal.valueStart, length: literal.valueLength, replacement: `ENV.fetch("${name}")` },
+                    ...identifiers.edits,
+                ],
+                checked: true,
+            });
+            continue;
+        }
+        const inline = INLINE_ARGS.find((r) => r.action.test(literal.action) && r.arg === literal.arg);
+        if (inline) {
+            const name = defaultVarNames(inline.kind)["path"];
+            const identifiers = inline.kind === "apple_asc" ? appleIdentifierRewrites(appleIdentifiers) : EMPTY;
+            out.push({
+                tier: "inline",
+                kind: inline.kind,
+                varName: name,
+                suggestedFields: identifiers.fields,
+                literal,
+                // The whole pair, because the keyword changes too.
+                edits: [
+                    {
+                        start: literal.pairStart,
+                        length: literal.pairLength,
+                        replacement: `${inline.becomes}: ENV.fetch("${name}")`,
+                    },
+                    ...identifiers.edits,
+                ],
+                checked: true,
+            });
+            continue;
+        }
+        if (SECRET_ARG.test(literal.arg)) {
+            const name = `${literal.action}_${literal.arg}`.toUpperCase();
+            out.push({
+                tier: "secret",
+                varName: name,
+                literal,
+                suggestedFields: {},
+                edits: [{ start: literal.valueStart, length: literal.valueLength, replacement: `ENV.fetch("${name}")` }],
+                // Unticked on purpose. This is the one tier where a false positive is
+                // likely — a non-secret URL, a placeholder — and a patch applied by
+                // default to a value that was not a secret is a silent regression in
+                // someone's build.
+                checked: false,
+            });
+        }
+    }
+    return out;
+}
+/** Neither an edit nor a field: an `apple_asc` block that names no identifier. */
+const EMPTY = { edits: [], fields: {} };
+/**
+ * The rewrites and pre-filled fields for the identifiers written beside an
+ * App Store Connect key file.
+ *
+ * The variable names come from `defaultVarNames("apple_asc")`, the same table
+ * `materialise.ts` exports the block's fields through — so the name the Fastfile
+ * is patched to read is the name the run will set. These never form a proposal
+ * of their own: an identifier is only ever lifted when the key file that anchors
+ * its block is, because nothing else exports the variable it would come to read.
+ */
+function appleIdentifierRewrites(identifiers) {
+    const defaults = defaultVarNames("apple_asc");
+    const edits = [];
+    const fields = {};
+    for (const id of identifiers) {
+        edits.push({
+            start: id.valueStart,
+            length: id.valueLength,
+            replacement: `ENV.fetch("${defaults[id.arg]}")`,
+        });
+        fields[id.arg] = id.value;
+    }
+    return { edits, fields };
+}
+/** What the credential's filename gives away, so the prompt starts filled in. */
+function suggestedFields(kind, path) {
+    if (kind !== "apple_asc")
+        return {};
+    const keyId = P8_KEY_ID.exec(path)?.[1];
+    return keyId ? { key_id: keyId } : {};
+}

package/dist/src/fastfile/splice.js

@@ -0,0 +1,38 @@
+/**
+ * Replaces ranges of a source, leaving every other byte exactly as it was.
+ *
+ * The same requirement `fastfile/store.ts` documents: a file written by hand
+ * must never come back reformatted, reordered, or with its trailing newline
+ * fixed. Someone may have spent a long time on that file.
+ *
+ * **Byte offsets, not string indices.** Prism reports positions in bytes, and
+ * one accented character above the literal would put every later offset off by
+ * one — a patch landing in the middle of a string, on a build file, silently.
+ * So the work happens on a Buffer.
+ *
+ * Edits are applied last-first so an earlier replacement cannot shift the
+ * offsets of the ones after it, and may be handed in in any order. Overlapping
+ * edits throw: two rules that both claim the same bytes is a bug in the rule
+ * table, and applying one of them arbitrarily would hide it.
+ */
+export function splice(source, edits) {
+    if (edits.length === 0)
+        return source;
+    const ordered = [...edits].sort((a, b) => a.start - b.start);
+    for (let i = 1; i < ordered.length; i += 1) {
+        const previous = ordered[i - 1];
+        if (previous.start + previous.length > ordered[i].start) {
+            throw new Error("edits overlap");
+        }
+    }
+    let buffer = Buffer.from(source, "utf8");
+    for (let i = ordered.length - 1; i >= 0; i -= 1) {
+        const edit = ordered[i];
+        buffer = Buffer.concat([
+            buffer.subarray(0, edit.start),
+            Buffer.from(edit.replacement, "utf8"),
+            buffer.subarray(edit.start + edit.length),
+        ]);
+    }
+    return buffer.toString("utf8");
+}