laneyard 0.6.1 → 0.8.0

package/dist/src/cli/remove.js

@@ -13,14 +13,18 @@ import { LogStore } from "../logs/store.js";
 import { Vault } from "../secrets/vault.js";
 import { readLine } from "./home.js";
 import { bad, bold, dim, field, heading, ok, warn } from "./style.js";
-export const REMOVE_USAGE = `laneyard remove [--dry-run]
+export const REMOVE_USAGE = `laneyard remove [<slug>] [--dry-run]
 
-Run from your app's directory — the one that holds laneyard.yml. Removes
-everything Laneyard holds for that project: its block in config.yml, its clone,
-its artifacts, its run history and logs, and its own secrets and signing blocks
-in the vault. It also removes the repository's laneyard.yml, which you then
-commit. It does not touch the git remote, the credential originals, or the
-global secrets and signing blocks other projects share.
+Run from the directory that holds laneyard.yml — the repository root for most
+projects, the app's own folder in a monorepo — and the project is the one that
+file names. Give a slug instead when there is no such file.
+
+Removes everything Laneyard holds for that project: its block in config.yml, its
+clone, its artifacts, its run history and logs, and its own secrets and signing
+blocks in the vault. It also removes that laneyard.yml, which you then commit —
+one naming another project is left alone. It does not touch the git remote, the
+credential originals, or the global secrets and signing blocks other projects
+share.
 
   laneyard remove --dry-run   show what would go and stop
 
@@ -41,8 +45,8 @@ async function readCounts(home, slug) {
         return {
             activeRun: runs.hasActiveRun(slug),
             runs: runs.listByProject(slug, -1).length,
-            secrets: new SecretStore(db).listOwn(slug).length,
-            signingBlocks: new CredentialStore(db).listOwn(slug).length,
+            secrets: new SecretStore(db).list(slug).length,
+            signingBlocks: new CredentialStore(db).list(slug).length,
         };
     }
     finally {
@@ -65,7 +69,7 @@ function renderInventory(slug, name, home, counts, clonePath, ymlPath) {
         field("secrets", plural(counts.secrets, "project secret")) + "\n" +
         field("signing", plural(counts.signingBlocks, "project signing block")) + "\n" +
         // The one thing removed outside `home`: the repository's own file.
-        field("laneyard.yml", ymlPath) + "\n" +
+        (ymlPath === null ? "" : field("laneyard.yml", ymlPath) + "\n") +
         heading("what will not be touched") +
         dim("  the git remote — the repository is yours, on your host and your disk.\n") +
         dim("  the credential originals — Laneyard removes only its own encrypted copy;\n") +
@@ -73,43 +77,56 @@ function renderInventory(slug, name, home, counts, clonePath, ymlPath) {
         dim("  global secrets and global signing blocks — shared by every project.\n"));
 }
 /**
- * Entry point for `laneyard remove`, run from the app's own directory.
+ * Entry point for `laneyard remove`, run from wherever the project's
+ * `laneyard.yml` sits — the repository root unless the app is one folder of a
+ * monorepo.
+ *
+ * The project is the one whose `laneyard.yml` sits in `cwd`, so the command names
+ * what the directory already is. A slug given outright overrides that, and is the
+ * only way to reach a project whose file was never written, lost its slug, or
+ * whose repository is no longer on this machine.
  *
- * The project is the one whose `laneyard.yml` sits in `cwd`; the slug is read
- * from that file rather than given as an argument, so the command names what the
- * directory already is. It reads the inventory first, prints what will and will
- * not go, and only then asks for the slug typed back — the same gate the web
- * route uses, for the same reason: the run history it deletes is the one thing
- * here nothing can rebuild.
+ * It reads the inventory first, prints what will and will not go, and only then
+ * asks for the slug typed back — the same gate the web route uses, for the same
+ * reason: the run history it deletes is the one thing here nothing can rebuild.
  */
 export async function runRemoveCommand(home, cwd, args, io) {
     let dryRun = false;
+    let given = null;
     for (const arg of args) {
         if (arg === "--dry-run" || arg === "-n")
             dryRun = true;
-        else {
+        else if (arg.startsWith("-")) {
             io.err(`Unknown option: ${arg}\n\n${REMOVE_USAGE}`);
             return 1;
         }
+        else if (given === null)
+            given = arg;
+        else {
+            io.err(`One project at a time. Give a single slug.\n\n${REMOVE_USAGE}`);
+            return 1;
+        }
     }
-    // The project is the one whose `laneyard.yml` is here — the file setup wrote
-    // and the slug it recorded in it. Run from anywhere else and there is nothing
-    // to name, which is the whole point: a project is removed from where it lives.
+    // The project is normally the one whose `laneyard.yml` is here — the file setup
+    // wrote, and the slug it recorded in it.
     const ymlPath = join(cwd, "laneyard.yml");
-    if (!existsSync(ymlPath)) {
-        io.err("\n" +
-            bad("No laneyard.yml here.") +
-            " Run `laneyard remove` from your app's directory — the one that holds it.\n");
-        return 1;
-    }
-    const repo = await loadRepoConfig(ymlPath);
-    const slug = repo.ok ? repo.config.slug : undefined;
+    const inFile = existsSync(ymlPath)
+        ? await loadRepoConfig(ymlPath).then((r) => (r.ok ? r.config.slug : undefined))
+        : undefined;
+    // A slug given outright is the way out when there is no such file: one that
+    // was never written, lost its slug, or whose repository is not on this machine
+    // any more. Without it those projects could only be removed from the web.
+    const slug = given ?? inFile;
     if (slug === undefined || slug === "") {
         io.err("\n" +
-            bad("This laneyard.yml has no slug.") +
-            " Run `laneyard setup` again to record which project it is.\n");
+            bad(existsSync(ymlPath) ? "This laneyard.yml has no slug." : "No laneyard.yml here.") +
+            " Run `laneyard remove` from the directory that holds it — usually the repository" +
+            " root — or name the project: `laneyard remove <slug>`.\n");
         return 1;
     }
+    // Removed only when it is this project's file. Given a slug explicitly, a
+    // `laneyard.yml` naming a different project is somebody else's and stays.
+    const ownYml = inFile !== undefined && inFile === slug ? ymlPath : null;
     const configPath = join(home, "config.yml");
     const config = new ConfigStore(configPath);
     const loaded = await config.load();
@@ -136,7 +153,7 @@ export async function runRemoveCommand(home, cwd, args, io) {
             " Wait for it to finish, or cancel it, then remove the project. Nothing was removed.\n");
         return 1;
     }
-    io.out(renderInventory(slug, entry.name, home, counts, clonePath, ymlPath));
+    io.out(renderInventory(slug, entry.name, home, counts, clonePath, ownYml));
     if (dryRun) {
         io.out("\n" +
             dim("Nothing was removed. Run `laneyard remove` without --dry-run to remove it.") +
@@ -172,7 +189,8 @@ export async function runRemoveCommand(home, cwd, args, io) {
         // The machine data went first, so a file removed here is one whose project
         // is already gone — never the other way round. `force` because the removal
         // must still report success if the file was deleted by hand meanwhile.
-        await rm(ymlPath, { force: true }).catch(() => { });
+        if (ownYml !== null)
+            await rm(ownYml, { force: true }).catch(() => { });
         io.out(heading("removed") +
             ok(`"${slug}": ${plural(result.runs, "run")}, ${plural(result.secrets, "secret")}, ` +
                 `${plural(result.signingBlocks, "signing block")}.\n`) +
@@ -180,7 +198,7 @@ export async function runRemoveCommand(home, cwd, args, io) {
                 ? dim(`  ${result.clonePath} is gone.\n`)
                 : dim("  There was no clone to remove.\n")) +
             dim(`  The block is out of ${configPath}.\n`) +
-            dim(`  ${ymlPath} is gone.\n`) +
+            (ownYml === null ? "" : dim(`  ${ownYml} is gone.\n`)) +
             "\n" +
             // The file is committed, so deleting the working copy is not the end of
             // it — the same trap adoption's report names about a patched Fastfile.

package/dist/src/cli/reset.js

@@ -31,8 +31,8 @@ function renderInventory(inv) {
         out += field("database", inv.db === null ? dim("not there") : dim("could not be read")) + "\n";
     }
     else {
-        out += field("secrets", `${plural(v.projectSecrets, "project secret")}, ${plural(v.globalSecrets, "global secret")}`) + "\n";
-        out += field("signing", `${plural(v.projectBlocks, "project signing block")}, ${plural(v.globalBlocks, "global signing block")}`) + "\n";
+        out += field("secrets", plural(v.secrets, "secret")) + "\n";
+        out += field("signing", plural(v.blocks, "signing block")) + "\n";
         out += field("history", plural(v.runs, "run")) + "\n";
     }
     if (inv.folders.length === 0) {

package/dist/src/cli/setup.js

@@ -151,16 +151,6 @@ export async function runSetupCommand(cwd, configPath, options = {}) {
                 dim("  Continuing updates its entry, keeping anything you added by hand.\n") +
                 dim("  Give it another name to keep both.\n"));
         }
-        // The repository file lives in the app's own directory, so a monorepo of N
-        // apps carries N of them — one beside each app's fastlane folder. `appRoot`
-        // is the fastlane dir's parent; for a plain app whose fastlane sits at the
-        // root it is `.`, and the file lands at the repository root as it always did.
-        const appRoot = appRootOf(d.fastlaneDir);
-        const repoConfigPath = join(repoRoot(cwd, d.subPath), appRoot, LANEYARD_YML);
-        if (await fileExists(repoConfigPath)) {
-            process.stdout.write("\n" + warn(`${LANEYARD_YML} already exists in the repository.\n`) +
-                dim("  Its values win over anything written here; it will be left alone.\n"));
-        }
         // A machine with no account gets its first admin here. Asked rather than
         // assumed: the name is typed into a login form every day afterwards, and
         // `admin` is a poor thing to call a person once there are two of them.
@@ -187,7 +177,24 @@ export async function runSetupCommand(cwd, configPath, options = {}) {
         }
         const gitUrl = await asker.ask("repository", d.gitUrl);
         const branch = await asker.ask("default branch", d.defaultBranch, dim("A run uses this branch unless you pick another one when you start it."));
-        const fastlaneDir = await asker.ask("fastlane directory", d.fastlaneDir, dim("Relative to the repository root, because that is what Laneyard clones."));
+        // Asked as it is written from where the command ran: from `app/`, the folder
+        // is `fastlane`, not `app/fastlane`. The repository-root-relative form is
+        // what the clone has and what `config.yml` stores, but prefixing it is
+        // Laneyard's job — asking someone to type a path they are standing inside
+        // reads like a mistake, and is the one people correct wrongly.
+        const fastlaneDir = fromRepoRoot(d.subPath, await asker.ask("fastlane directory", fromHere(d.subPath, d.fastlaneDir), dim("Relative to this directory.")));
+        // Computed from the answer, never from the detection: correcting the folder
+        // moves the app root with it, and with it where `laneyard.yml` is written and
+        // which prefix its paths drop. Read before the prompt, a correction was
+        // silently ignored and the file landed beside the wrong app.
+        const appRoot = appRootOf(fastlaneDir);
+        const repoConfigPath = join(repoRoot(cwd, d.subPath), appRoot, LANEYARD_YML);
+        const repoConfigExists = await fileExists(repoConfigPath);
+        if (repoConfigExists) {
+            process.stdout.write("\n" + warn(`${LANEYARD_YML} already exists in the repository.\n`) +
+                dim("  Its values win over anything written here and are left alone.\n") +
+                dim("  Only a missing `slug:` is added, so this project can be removed later.\n"));
+        }
         // A fastlane folder that is on disk but not in git will not survive the
         // clone Laneyard builds from — the case that started this: a stray
         // `app copie/` macOS made, detected here and absent from the remote.
@@ -209,10 +216,14 @@ export async function runSetupCommand(cwd, configPath, options = {}) {
         // prompt is a miserable way to start, the detected ones are nearly always
         // right, and the file is there to be edited when they are not.
         const globs = d.artifactGlobs;
-        if (!(await asker.confirm(`\n${bold(`Set up "${slug}"`)}?`, true))) {
-            process.stdout.write(dim("Nothing written.") + "\n");
-            return 0;
-        }
+        // No final "and write those?" here, on purpose. It was a rubber stamp: by
+        // this line every value has been proposed and accepted one at a time, so the
+        // answer was always yes — and a question nobody ever says no to teaches
+        // people to press Return without reading the ones that matter. Nothing here
+        // destroys anything either: the project block is additive and `laneyard
+        // remove` undoes it, an existing `laneyard.yml` keeps its values, and the
+        // report below says exactly what was written and where. Ctrl-C still works
+        // at every prompt above.
         // The account first, so the server block is written before the project list
         // it sits above. `null` when this machine already has one, and then nothing
         // is written and nothing is printed.
@@ -271,7 +282,6 @@ export async function runSetupCommand(cwd, configPath, options = {}) {
             // checklist cannot end up disagreeing about the same repository.
             ...(d.platforms.length > 0 ? { platforms: d.platforms } : {}),
         });
-        const port = await configuredPort(configPath);
         process.stdout.write(heading(`Project "${slug}" is set up`) +
             field("repository", `${gitUrl} (${branch})`) + "\n" +
             field("fastlane", fastlaneDir) + "\n" +
@@ -282,9 +292,12 @@ export async function runSetupCommand(cwd, configPath, options = {}) {
             // one line of the file just written.
             field("platforms", d.platforms.join(", ") || dim("none detected")) + "\n" +
             "\n" +
-            (wroteRepoConfig
+            (wroteRepoConfig === "written"
                 ? ok(`Wrote ${bold(LANEYARD_YML)} — ${bold("commit it")} so your team builds the same way.\n`)
-                : warn(`Left the existing ${LANEYARD_YML} alone.\n`)) +
+                : wroteRepoConfig === "slug-added"
+                    ? ok(`Added ${bold(`slug: ${slug}`)} to the existing ${LANEYARD_YML}, and left the rest ` +
+                        `alone — ${bold("commit it")}.\n`)
+                    : warn(`Left the existing ${LANEYARD_YML} alone.\n`)) +
             ok(`Registered in ${configPath}\n`) +
             // Last thing before the invitation to start the server, because it is
             // the one line here that cannot be read again anywhere: the file holds
@@ -298,11 +311,14 @@ export async function runSetupCommand(cwd, configPath, options = {}) {
                     "\n" +
                     warn("Write the password down — it is not shown again, and it is not stored.\n") +
                     dim("  Add a colleague later with `laneyard user add <name> --role builder`.\n")) +
-            heading("Start Laneyard") +
+            // An instruction, not a status. `Start Laneyard` over a command and a URL
+            // read as "started, and here is the address" — the URL especially, which
+            // nothing was serving yet. The verb says who does it, and the address is
+            // the server's to print once it is listening.
+            heading("The server is not running yet — start it with") +
             `  ${bold("laneyard")}\n` +
-            `  ${dim(`http://localhost:${port}`)}\n` +
             "\n" +
-            dim("Already running? The configuration is watched — it appears on its own.\n"));
+            dim("Already running? The configuration is watched — this project appears on its own.\n"));
         // The second act. After the success message, never before it: declining
         // everything here must leave exactly the project the lines above just
         // announced. See `cli/adopt.ts`.
@@ -332,17 +348,6 @@ export async function runSetupCommand(cwd, configPath, options = {}) {
         asker.close();
     }
 }
-/**
- * The port the server will actually listen on.
- *
- * Read back from the file rather than assumed: telling someone to open a port
- * their configuration does not use is the kind of small wrongness that makes a
- * tool feel unreliable on first contact.
- */
-async function configuredPort(configPath) {
-    const res = await loadServerConfig(configPath);
-    return res.ok ? res.config.server.port : 7890;
-}
 /** The repository file, named once so the message and the write cannot disagree. */
 const LANEYARD_YML = "laneyard.yml";
 /** What the first account is called when nobody says otherwise. */
@@ -401,14 +406,30 @@ async function existingProject(configPath, slug) {
  * values win anyway.
  */
 async function writeRepoConfigIfAbsent(path, settings) {
-    if (await fileExists(path))
-        return false;
-    const doc = new Document(settings);
-    doc.commentBefore =
-        " How this project builds. Committed, so everyone builds it the same way.\n" +
-            " Values here win over the project's block in the server's config.yml.";
-    await writeFile(path, doc.toString(), "utf8");
-    return true;
+    const existing = await readFile(path, "utf8").catch(() => null);
+    if (existing === null) {
+        const doc = new Document(settings);
+        doc.commentBefore =
+            " How this project builds. Committed, so everyone builds it the same way.\n" +
+                " Values here win over the project's block in the server's config.yml.";
+        await writeFile(path, doc.toString(), "utf8");
+        return "written";
+    }
+    // The one edit an existing file gets: the slug, and only when it has none.
+    //
+    // A file written before slugs existed has no way to gain one otherwise, and
+    // `laneyard remove` refuses a slug-less file while telling you to run setup
+    // again — which left it untouched. That was a project nothing could remove.
+    //
+    // Through the YAML document, like `addProjectToConfig`: the comments, the key
+    // order and every value the file carried come back out unchanged. An existing
+    // slug is never touched, whatever it says.
+    const doc = parseDocument(existing);
+    if (doc.getIn(["slug"]) !== undefined)
+        return "left";
+    doc.setIn(["slug"], settings.slug);
+    await writeFile(path, serialize(doc), "utf8");
+    return "slug-added";
 }
 /**
  * A repo-root-relative path read as relative to the app directory.
@@ -425,6 +446,30 @@ function appRelative(appRoot, p) {
     const prefix = `${appRoot}/`;
     return p.startsWith(prefix) ? p.slice(prefix.length) : p;
 }
+/**
+ * A repository-root-relative path as it is written from where setup ran.
+ *
+ * `app/fastlane` is `fastlane` when standing in `app/`. A path outside that
+ * directory has no shorter form and is shown as it is.
+ */
+function fromHere(subPath, repoRelative) {
+    if (subPath === "")
+        return repoRelative;
+    const prefix = `${subPath}/`;
+    return repoRelative.startsWith(prefix) ? repoRelative.slice(prefix.length) : repoRelative;
+}
+/**
+ * The inverse: back to repository-root-relative, which is the shape of the clone.
+ *
+ * Tolerant of an answer that already carries the prefix — someone who types
+ * `app/fastlane` from `app/` means the same folder, and double-prefixing it into
+ * `app/app/fastlane` would be a worse answer than the one they gave.
+ */
+function fromRepoRoot(subPath, here) {
+    if (subPath === "" || here === "")
+        return here;
+    return here === subPath || here.startsWith(`${subPath}/`) ? here : `${subPath}/${here}`;
+}
 /** `git@github.com:you/thing.git` reads better as `you/thing` in a sentence. */
 function repositoryLabel(url) {
     return url.replace(/^.*[:/]([^/:]+\/[^/]+?)(\.git)?$/, "$1");

package/dist/src/cli/uninstall.js

@@ -103,13 +103,8 @@ async function readVault(dbPath) {
         const count = (sql) => db.prepare(sql).get().n;
         return {
             vault: {
-                // The empty slug is how a global row is stored — the same convention
-                // `SecretStore` and `CredentialStore` use, and the reason the two are
-                // counted apart: a global secret belongs to every project.
-                projectSecrets: count("SELECT COUNT(*) AS n FROM secret WHERE project_slug != ''"),
-                globalSecrets: count("SELECT COUNT(*) AS n FROM secret WHERE project_slug = ''"),
-                projectBlocks: count("SELECT COUNT(*) AS n FROM credential WHERE project_slug != ''"),
-                globalBlocks: count("SELECT COUNT(*) AS n FROM credential WHERE project_slug = ''"),
+                secrets: count("SELECT COUNT(*) AS n FROM secret"),
+                blocks: count("SELECT COUNT(*) AS n FROM credential"),
                 runs: count("SELECT COUNT(*) AS n FROM run"),
             },
             unreadable: null,
@@ -221,19 +216,8 @@ export function renderInventory(inv) {
         }
         else {
             const v = inv.db.vault;
-            out += field("secrets", `${plural(v.projectSecrets, "project secret")}`) + "\n";
-            // Said on its own line and in words rather than folded into the number
-            // above: a global secret is read by every project on this machine, and
-            // "in scope" is the fact someone needs before they answer the question.
-            out +=
-                field("", v.globalSecrets === 0
-                    ? dim("no global secret")
-                    : `${plural(v.globalSecrets, "global secret")} — shared by every project, ${bold("removed too")}`) + "\n";
-            out += field("signing", `${plural(v.projectBlocks, "project signing block")}`) + "\n";
-            out +=
-                field("", v.globalBlocks === 0
-                    ? dim("no global signing block")
-                    : `${plural(v.globalBlocks, "global signing block")} — shared by every project, ${bold("removed too")}`) + "\n";
+            out += field("secrets", plural(v.secrets, "secret")) + "\n";
+            out += field("signing", plural(v.blocks, "signing block")) + "\n";
             out += field("history", plural(v.runs, "run")) + "\n";
         }
     }
@@ -267,7 +251,7 @@ export function renderInventory(inv) {
  */
 export function renderIrreversible(inv) {
     const v = inv.db?.vault;
-    const stored = v === undefined || v === null ? null : v.projectSecrets + v.globalSecrets + v.projectBlocks + v.globalBlocks;
+    const stored = v === undefined || v === null ? null : v.secrets + v.blocks;
     return (heading("what cannot be undone") +
         warn(`The vault key is the one thing here that has no other copy.\n`) +
         dim("  Every secret and every signing block is encrypted under " + (inv.key?.path ?? join(inv.home, "key")) + ".\n") +

package/dist/src/config/env-file-setting.js

@@ -0,0 +1,57 @@
+import { readFile, writeFile } from "node:fs/promises";
+import { isAbsolute, normalize } from "node:path";
+import { parseDocument, YAMLMap, YAMLSeq } from "yaml";
+import { serializeYaml } from "./yaml.js";
+/**
+ * Sets or clears a project's `env_file`, in `config.yml`, leaving the rest of
+ * the file alone.
+ *
+ * The setting is configuration, so it lives in a file — that is what makes
+ * backing Laneyard up a matter of copying one. But it is also the only way to
+ * turn the environment file on, and a feature reachable exclusively by editing
+ * YAML by hand is one nobody finds. So the screen writes the file, the way the
+ * accounts screen already writes accounts and the removal screen already
+ * removes a project's block.
+ *
+ * A `laneyard.yml` in the repository still wins, unchanged: that precedence is
+ * the same for every setting, and this function is not the place to invent an
+ * exception to it. The screen reports it rather than offering to fight it.
+ *
+ * Returns false when no project carries that slug, so the caller can answer 404
+ * rather than rewrite the file to say what it already said.
+ */
+export async function setEnvFileSetting(path, slug, envFile) {
+    const doc = parseDocument(await readFile(path, "utf8"));
+    const projects = doc.get("projects");
+    if (!(projects instanceof YAMLSeq))
+        return false;
+    const entry = projects.items.find((item) => item instanceof YAMLMap && item.get("slug") === slug);
+    if (!entry)
+        return false;
+    if (envFile === null)
+        entry.delete("env_file");
+    else
+        entry.set("env_file", envFile);
+    await writeFile(path, serializeYaml(doc), "utf8");
+    return true;
+}
+/**
+ * Why this path cannot be used, or null.
+ *
+ * The same rule the schema enforces at load, applied here so a bad value is
+ * refused by the screen that typed it rather than accepted and then reported as
+ * a broken configuration on the next reload. The file holds the values the vault
+ * exists to protect, and a path climbing out of the app would let it be dropped
+ * anywhere on the server.
+ */
+export function envFileProblem(envFile) {
+    if (envFile === "")
+        return "A path is required.";
+    if (isAbsolute(envFile))
+        return "A path inside the app, not an absolute one.";
+    const clean = normalize(envFile);
+    if (clean === ".." || clean.startsWith("../") || clean.startsWith("..\\")) {
+        return "A path inside the app, not one that climbs out of it.";
+    }
+    return null;
+}

package/dist/src/config/resolve.js

@@ -18,13 +18,13 @@ function underApp(appRoot, p) {
  * duplicated keeps its file unchanged. But everything downstream resolves paths
  * as repo-root-relative (`join(workspacePath, …)`, globs with `cwd:
  * workspacePath`). So the app-relativity is collapsed here, once, at the
- * boundary: the two path fields are prefixed with the app directory before the
+ * boundary: the path fields are prefixed with the app directory before the
  * merge ever sees them, and nothing past this point learns a new rule.
  *
- * Only the path fields move. `platforms`, `runtime`, `timeout_minutes`,
- * `interactive_default`, `required_secrets` and `retention` are not paths and
- * pass through untouched. A root-level file is never handed here: its paths are
- * already repo-root-relative.
+ * Only the path fields move — `fastlane_dir`, `artifact_globs` and `env_file`.
+ * `platforms`, `runtime`, `timeout_minutes`, `interactive_default`,
+ * `required_secrets` and `retention` are not paths and pass through untouched. A
+ * root-level file is never handed here: its paths are already repo-root-relative.
  */
 export function normaliseAppConfig(repo, appRoot) {
     const out = { ...repo };
@@ -34,6 +34,9 @@ export function normaliseAppConfig(repo, appRoot) {
     if (repo.artifact_globs !== undefined) {
         out.artifact_globs = repo.artifact_globs.map((g) => underApp(appRoot, g));
     }
+    if (repo.env_file !== undefined) {
+        out.env_file = underApp(appRoot, repo.env_file);
+    }
     return out;
 }
 /**

package/dist/src/config/schema.js

@@ -1,4 +1,18 @@
+import { isAbsolute, normalize } from "node:path";
 import { z } from "zod";
+/**
+ * Whether a relative path leaves the directory it is relative to.
+ *
+ * `normalize` collapses `a/../../b` to `../b`, so one check after it catches
+ * both the obvious `../.env` and the roundabout spelling. An absolute path is
+ * refused outright: it does not mean "inside the app" under any reading.
+ */
+function escapesApp(p) {
+    if (isAbsolute(p))
+        return true;
+    const clean = normalize(p);
+    return clean === ".." || clean.startsWith(`..${"/"}`) || clean.startsWith("..\\");
+}
 /** A slug is used as a folder name and a URL segment. */
 const slugSchema = z
     .string()
@@ -17,6 +31,21 @@ export const projectSettingsSchema = z.object({
     interactive_default: z.boolean().default(false),
     artifact_globs: z.array(z.string()).default([]),
     required_secrets: z.array(z.string()).default([]),
+    // Where to write the file the build reads from disk — a gitignored `.env`, a
+    // `config.json` for `--dart-define-from-file`. No default: absent means the
+    // project wants no such file, which is almost every project, and an empty
+    // string would be a path to interpret rather than an absence to respect.
+    //
+    // Relative to the app directory, like `fastlane_dir`. A path that climbs out
+    // of it is refused here rather than at write time: the file holds the values
+    // the vault exists to protect, and a configuration must never be able to drop
+    // one anywhere on the server. Refusing at load also means the last valid
+    // configuration stays live, which is what every other bad value gets.
+    env_file: z
+        .string()
+        .min(1, "env_file: a path, or leave it out")
+        .refine((p) => !escapesApp(p), "env_file: a path inside the app, not one that climbs out of it")
+        .optional(),
     // What this project builds for. No default: absent means "nobody said", and
     // the readiness checklist falls back to looking at the repository. Setting it
     // is how a repository that happens to carry an Xcode project it never builds

package/dist/src/db/credentials.js

@@ -1,11 +1,14 @@
-const GLOBAL = "";
 /**
  * Stores signing credential blocks: a file plus the fields that make it
  * usable. Knows nothing about encryption itself: it takes and returns
  * ciphertext, so a bug here cannot leak a plaintext value.
  *
- * A project credential shadows a global one of the same kind — the same
- * precedence as `SecretStore`, and the least surprising rule.
+ * One project, one block per kind. A block used to be storable under no project
+ * and read by all of them — an App Store Connect key is usually one per
+ * developer account, not one per app, so the sharing matched something real.
+ * It went anyway: it meant no screen could show what a project actually signs
+ * with. Five apps under one account now hold five copies of the key, and
+ * rotating it means replacing five.
  */
 export class CredentialStore {
     db;
@@ -22,68 +25,30 @@ export class CredentialStore {
                fields_enc = excluded.fields_enc,
                var_names  = excluded.var_names,
                updated_at = excluded.updated_at`)
-            .run(projectSlug ?? GLOBAL, kind, input.fileName, input.fileEnc, input.fieldsEnc, JSON.stringify(input.varNames), new Date().toISOString());
+            .run(projectSlug, kind, input.fileName, input.fileEnc, input.fieldsEnc, JSON.stringify(input.varNames), new Date().toISOString());
     }
-    /** Rows that apply to a project, project scope winning over global. */
-    applicable(projectSlug) {
+    /** This project's blocks, ciphertext included. */
+    rows(projectSlug) {
         const rows = this.db
-            .prepare("SELECT * FROM credential WHERE project_slug IN (?, ?) ORDER BY kind")
-            .all(projectSlug, GLOBAL);
-        const byKind = new Map();
-        for (const row of rows) {
-            const existing = byKind.get(row.kind);
-            if (!existing || row.project_slug !== GLOBAL)
-                byKind.set(row.kind, row);
-        }
-        return [...byKind.values()]
-            .sort((a, b) => a.kind.localeCompare(b.kind))
-            .map((row) => this.toSummary(row));
+            .prepare("SELECT * FROM credential WHERE project_slug = ? ORDER BY kind")
+            .all(projectSlug);
+        return rows.map((row) => this.toSummary(row));
     }
-    /** One applicable block, ciphertext included, or undefined. */
+    /** One block, ciphertext included, or undefined. */
     find(projectSlug, kind) {
-        return this.applicable(projectSlug).find((r) => r.kind === kind);
+        return this.rows(projectSlug).find((r) => r.kind === kind);
     }
     list(projectSlug) {
-        return this.applicable(projectSlug).map(({ fileEnc: _fileEnc, fieldsEnc: _fieldsEnc, ...summary }) => summary);
+        return this.rows(projectSlug).map(({ fileEnc: _fileEnc, fieldsEnc: _fieldsEnc, ...summary }) => summary);
     }
-    /**
-     * The blocks stored under this slug, and no global one.
-     *
-     * Same distinction as `SecretStore.listOwn`, and it matters more here: a
-     * global keystore shadowed by nothing is shared by every project on the
-     * machine, and counting it as one project's would offer to delete the one
-     * credential every other project signs with.
-     */
-    listOwn(projectSlug) {
-        if (projectSlug === GLOBAL)
-            return [];
-        const rows = this.db
-            .prepare("SELECT * FROM credential WHERE project_slug = ? ORDER BY kind")
-            .all(projectSlug);
-        return rows.map((row) => {
-            const { fileEnc: _fileEnc, fieldsEnc: _fieldsEnc, ...summary } = this.toSummary(row);
-            return summary;
-        });
-    }
-    /** Removes every block stored under this slug, and returns how many. */
-    removeAllOwn(projectSlug) {
-        if (projectSlug === GLOBAL)
-            return 0;
+    /** Removes every block this project holds, and returns how many. */
+    removeAll(projectSlug) {
         return this.db.prepare("DELETE FROM credential WHERE project_slug = ?").run(projectSlug).changes;
     }
-    listGlobal() {
-        const rows = this.db
-            .prepare("SELECT * FROM credential WHERE project_slug = ? ORDER BY kind")
-            .all(GLOBAL);
-        return rows.map((row) => {
-            const { fileEnc: _fileEnc, fieldsEnc: _fieldsEnc, ...summary } = this.toSummary(row);
-            return summary;
-        });
-    }
     remove(projectSlug, kind) {
         const res = this.db
             .prepare("DELETE FROM credential WHERE project_slug = ? AND kind = ?")
-            .run(projectSlug ?? GLOBAL, kind);
+            .run(projectSlug, kind);
         return res.changes > 0;
     }
     toSummary(row) {
@@ -92,7 +57,6 @@ export class CredentialStore {
             fileName: row.file_name,
             fileEnc: row.file_enc,
             fieldsEnc: row.fields_enc,
-            scope: row.project_slug === GLOBAL ? "global" : "project",
             varNames: JSON.parse(row.var_names),
             updatedAt: row.updated_at,
         };