laneyard 0.6.1 → 0.8.0

package/dist/src/db/migrate-global-scope.js

@@ -0,0 +1,75 @@
+/** The two tables that carried a scope, and the column that identified a row in each. */
+const TABLES = [
+    { table: "secret", column: "key", what: "secret" },
+    { table: "credential", column: "kind", what: "signing block" },
+];
+/**
+ * Gives every row that belonged to everything to each project that read it.
+ *
+ * The vault used to have two scopes: a row stored under the empty slug applied
+ * to every project, and a row under a real slug shadowed it. That is gone — a
+ * secret and a signing block now belong to exactly one project — and this is
+ * what happens to the rows written before it went.
+ *
+ * **Copied, never dropped.** A global secret was read by every project, so
+ * writing it into every project preserves precisely the behaviour it had:
+ * nothing that built yesterday stops building today. The alternative — deleting
+ * rows the user never asked to delete, on an upgrade — would break working
+ * projects to tidy a table.
+ *
+ * **A project that overrode a global one keeps its own value.** The insert
+ * takes no action on conflict, which is the same precedence the merged read
+ * applied, made permanent rather than recomputed on every query.
+ *
+ * The cost is real and is the point of the report: someone who stored one App
+ * Store Connect key now has five, and rotating it means replacing five. They
+ * have to be told, or they will find out from a build that uploads with a key
+ * they thought they had replaced.
+ *
+ * With no projects configured there is nowhere to copy to, and the row is
+ * deleted rather than left: every query names a slug now, so the empty one is
+ * unreachable — not shared, just invisible and forever unread.
+ */
+export function migrateGlobalScope(db, allSlugs) {
+    const report = { copied: [], dropped: [] };
+    // The empty slug is the sentinel this function is deleting. A configuration
+    // cannot produce one — `slugSchema` refuses it — but if one ever arrived, the
+    // copy would land on the row about to be deleted and the data would go with
+    // it, silently. That is the one input worth refusing by hand.
+    const slugs = allSlugs.filter((slug) => slug !== "");
+    const run = db.transaction(() => {
+        for (const { table, column, what } of TABLES) {
+            const names = db.prepare(`SELECT ${column} AS name FROM ${table} WHERE project_slug = '' ORDER BY ${column}`).all().map((row) => row.name);
+            if (names.length === 0)
+                continue;
+            // `SELECT ?, <rest>` rather than a read-then-write: it keeps every column
+            // the table has without naming them here, so a column added later travels
+            // with the copy instead of being silently dropped by a migration nobody
+            // thought to update.
+            const columns = db.prepare(`PRAGMA table_info(${table})`).all().map((c) => c.name);
+            const rest = columns.filter((c) => c !== "project_slug");
+            const copy = db.prepare(`INSERT INTO ${table} (project_slug, ${rest.join(", ")})
+         SELECT ?, ${rest.join(", ")} FROM ${table} WHERE project_slug = '' AND ${column} = ?
+         ON CONFLICT DO NOTHING`);
+            for (const name of names) {
+                const wrote = [];
+                for (const slug of slugs)
+                    if (copy.run(slug, name).changes > 0)
+                        wrote.push(slug);
+                // Dropped means "deleted and copied nowhere", which covers two cases:
+                // there was no project to copy into, and every project already defined
+                // the name and kept its own. The second changes nothing anyone could
+                // observe — the row was shadowed everywhere, so nothing ever read it —
+                // but it is still a deletion, and a migration that deletes in silence is
+                // one nobody can audit afterwards.
+                if (wrote.length > 0)
+                    report.copied.push({ what, name, slugs: wrote });
+                else
+                    report.dropped.push({ what, name });
+            }
+            db.prepare(`DELETE FROM ${table} WHERE project_slug = ''`).run();
+        }
+    });
+    run();
+    return report;
+}

package/dist/src/db/open.js

@@ -9,6 +9,10 @@ export function openDatabase(path) {
     migrateIntrospectionCache(db);
     const here = dirname(fileURLToPath(import.meta.url));
     db.exec(readFileSync(join(here, "schema.sql"), "utf8"));
+    // After the schema, not before: on a fresh database the table has to exist
+    // for the column check to mean anything, and there `CREATE TABLE` has already
+    // put the column in.
+    migrateEnvFileColumn(db);
     return db;
 }
 /**
@@ -25,3 +29,20 @@ function migrateIntrospectionCache(db) {
         db.exec("DROP TABLE introspection_cache");
     }
 }
+/**
+ * Adds `secret.in_env_file` to a database written before the environment file
+ * existed.
+ *
+ * `CREATE TABLE IF NOT EXISTS` leaves an existing table alone, so a column added
+ * to the schema never reaches a database that already has the table. The cache
+ * above answers that by dropping and rebuilding; here that would delete the
+ * vault. `ALTER TABLE … ADD COLUMN` with a default is the whole migration: every
+ * row that predates the column reads as "not in the file", which is exactly what
+ * it was.
+ */
+function migrateEnvFileColumn(db) {
+    const columns = db.prepare("PRAGMA table_info(secret)").all();
+    if (!columns.some((c) => c.name === "in_env_file")) {
+        db.exec("ALTER TABLE secret ADD COLUMN in_env_file INTEGER NOT NULL DEFAULT 0");
+    }
+}

package/dist/src/db/schema.sql

@@ -50,14 +50,19 @@ CREATE TABLE IF NOT EXISTS introspection_cache (
   PRIMARY KEY (project_slug, kind)
 );
 
--- A global secret is stored with an empty project_slug rather than NULL:
--- SQLite considers two NULLs distinct in a UNIQUE index, so NULL would let the
--- same global name be inserted twice.
+-- Every secret belongs to one project. There was a second scope once — the
+-- empty slug, read by every project — and `migrate-global-scope.ts` is what
+-- became of the rows written under it.
+-- `in_env_file` says this variable is also written into the file the build reads
+-- from disk — see `runner/env-file.ts`. It is membership, not a second value: a
+-- flagged secret still reaches the run as an environment variable like any
+-- other. `open.ts` adds the column to a database written before it existed.
 CREATE TABLE IF NOT EXISTS secret (
-  project_slug TEXT    NOT NULL DEFAULT '',
+  project_slug TEXT    NOT NULL,
   key          TEXT    NOT NULL,
   value_enc    TEXT    NOT NULL,
   masked       INTEGER NOT NULL DEFAULT 1,
+  in_env_file  INTEGER NOT NULL DEFAULT 0,
   updated_at   TEXT    NOT NULL,
   PRIMARY KEY (project_slug, key)
 );
@@ -74,7 +79,7 @@ CREATE TABLE IF NOT EXISTS secret (
 -- `var_names` is NOT encrypted. It holds variable names, never values, and the
 -- interface has to display them.
 CREATE TABLE IF NOT EXISTS credential (
-  project_slug TEXT NOT NULL DEFAULT '',
+  project_slug TEXT NOT NULL,
   kind         TEXT NOT NULL,
   file_name    TEXT NOT NULL,
   file_enc     TEXT NOT NULL,

package/dist/src/db/secrets.js

@@ -1,50 +1,41 @@
-const GLOBAL = "";
+const summaryOf = (row) => ({
+    key: row.key,
+    masked: row.masked === 1,
+    inEnvFile: row.in_env_file === 1,
+});
 /**
  * Stores encrypted secrets. Knows nothing about encryption itself: it takes and
  * returns ciphertext, so a bug here cannot leak a plaintext value.
  *
- * A project secret shadows a global one of the same name — the same precedence
- * as the configuration, and the least surprising rule.
+ * Every row belongs to exactly one project. There used to be a second scope —
+ * a row under no project, read by all of them, shadowed by a project's own —
+ * and it is gone: see `migrate-global-scope.ts`. What it cost was the answer to
+ * "what does this project see", which was a merge of two sets that no screen
+ * ever showed whole. It is now one query.
  */
 export class SecretStore {
     db;
     constructor(db) {
         this.db = db;
     }
-    set(projectSlug, key, valueEnc, masked) {
+    set(projectSlug, key, valueEnc, masked, inEnvFile = false) {
         this.db
-            .prepare(`INSERT INTO secret (project_slug, key, value_enc, masked, updated_at)
-         VALUES (?, ?, ?, ?, ?)
+            .prepare(`INSERT INTO secret (project_slug, key, value_enc, masked, in_env_file, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?)
          ON CONFLICT (project_slug, key) DO UPDATE
            SET value_enc = excluded.value_enc,
                masked = excluded.masked,
+               in_env_file = excluded.in_env_file,
                updated_at = excluded.updated_at`)
-            .run(projectSlug ?? GLOBAL, key, valueEnc, masked ? 1 : 0, new Date().toISOString());
+            .run(projectSlug, key, valueEnc, masked ? 1 : 0, inEnvFile ? 1 : 0, new Date().toISOString());
     }
-    /** Rows that apply to a project, project scope winning over global. */
-    applicable(projectSlug) {
-        const rows = this.db
-            .prepare("SELECT * FROM secret WHERE project_slug IN (?, ?) ORDER BY key")
-            .all(projectSlug, GLOBAL);
-        const byKey = new Map();
-        for (const row of rows) {
-            const existing = byKey.get(row.key);
-            if (!existing || row.project_slug !== GLOBAL)
-                byKey.set(row.key, row);
-        }
-        return [...byKey.values()].sort((a, b) => a.key.localeCompare(b.key));
+    rows(projectSlug) {
+        return this.db.prepare("SELECT * FROM secret WHERE project_slug = ? ORDER BY key").all(projectSlug);
     }
-    /** One applicable row, ciphertext included, or undefined. */
+    /** One row, ciphertext included, or undefined. */
     find(projectSlug, key) {
-        const row = this.applicable(projectSlug).find((r) => r.key === key);
-        return row
-            ? {
-                key: row.key,
-                masked: row.masked === 1,
-                scope: row.project_slug === GLOBAL ? "global" : "project",
-                valueEnc: row.value_enc,
-            }
-            : undefined;
+        const row = this.rows(projectSlug).find((r) => r.key === key);
+        return row ? { ...summaryOf(row), valueEnc: row.value_enc } : undefined;
     }
     /**
      * Flips whether a value is kept out of the logs, leaving the value alone.
@@ -60,58 +51,46 @@ export class SecretStore {
         return (this.db
             .prepare(`UPDATE secret SET masked = ?, updated_at = ?
            WHERE project_slug = ? AND key = ?`)
-            .run(masked ? 1 : 0, new Date().toISOString(), projectSlug ?? GLOBAL, key).changes > 0);
+            .run(masked ? 1 : 0, new Date().toISOString(), projectSlug, key).changes > 0);
     }
     /**
-     * The rows stored under this slug, and no global one.
+     * Flips whether this variable is written into the environment file, leaving
+     * the value and the masking alone.
      *
-     * `list` answers "what does this project see", which is the right question
-     * everywhere else and the wrong one when a project is going away: a global
-     * secret three other projects also read is not this one's to count, and
-     * certainly not its to remove.
-     *
-     * The empty slug is the global scope's own key, so it is refused here rather
-     * than quietly returning every global row as if one project owned them.
+     * Its own operation for the same reason as `setMasked`: re-`set` would mean
+     * handing back a value the caller may not be able to read.
      */
-    listOwn(projectSlug) {
-        if (projectSlug === GLOBAL)
-            return [];
-        const rows = this.db
-            .prepare("SELECT * FROM secret WHERE project_slug = ? ORDER BY key")
-            .all(projectSlug);
-        return rows.map((row) => ({ key: row.key, masked: row.masked === 1, scope: "project" }));
+    setInEnvFile(projectSlug, key, inEnvFile) {
+        return (this.db
+            .prepare(`UPDATE secret SET in_env_file = ?, updated_at = ?
+           WHERE project_slug = ? AND key = ?`)
+            .run(inEnvFile ? 1 : 0, new Date().toISOString(), projectSlug, key).changes > 0);
     }
-    /** Removes every row stored under this slug, and returns how many. */
-    removeAllOwn(projectSlug) {
-        if (projectSlug === GLOBAL)
-            return 0;
+    /** Removes every row this project holds, and returns how many. */
+    removeAll(projectSlug) {
         return this.db.prepare("DELETE FROM secret WHERE project_slug = ?").run(projectSlug).changes;
     }
     list(projectSlug) {
-        return this.applicable(projectSlug).map((row) => ({
-            key: row.key,
-            masked: row.masked === 1,
-            scope: row.project_slug === GLOBAL ? "global" : "project",
-        }));
+        return this.rows(projectSlug).map(summaryOf);
     }
-    listGlobal() {
-        const rows = this.db
-            .prepare("SELECT * FROM secret WHERE project_slug = ? ORDER BY key")
-            .all(GLOBAL);
-        return rows.map((row) => ({ key: row.key, masked: row.masked === 1, scope: "global" }));
+    /** The names that go in the environment file, in the order they are written. */
+    envFileKeys(projectSlug) {
+        return this.rows(projectSlug)
+            .filter((r) => r.in_env_file === 1)
+            .map((r) => r.key);
     }
     /** Ciphertext by name, for the vault to decrypt. */
     encrypted(projectSlug) {
-        return Object.fromEntries(this.applicable(projectSlug).map((row) => [row.key, row.value_enc]));
+        return Object.fromEntries(this.rows(projectSlug).map((row) => [row.key, row.value_enc]));
     }
-    /** Which of the applicable secrets should be kept out of the logs. */
+    /** Which of this project's secrets should be kept out of the logs. */
     maskedKeys(projectSlug) {
-        return new Set(this.applicable(projectSlug).filter((r) => r.masked === 1).map((r) => r.key));
+        return new Set(this.rows(projectSlug)
+            .filter((r) => r.masked === 1)
+            .map((r) => r.key));
     }
     remove(projectSlug, key) {
-        const res = this.db
-            .prepare("DELETE FROM secret WHERE project_slug = ? AND key = ?")
-            .run(projectSlug ?? GLOBAL, key);
+        const res = this.db.prepare("DELETE FROM secret WHERE project_slug = ? AND key = ?").run(projectSlug, key);
         return res.changes > 0;
     }
 }

package/dist/src/fastfile/adoption.js

@@ -53,6 +53,10 @@ export function proposalsFor(literals) {
             const main = rewriteTo(literal, name);
             const identifiers = file.kind === "apple_asc" ? appleIdentifierRewrites(appleIdentifiers) : EMPTY;
             const edits = [...(main ? [main] : []), ...identifiers.edits];
+            const rewrites = [
+                ...(main ? [{ arg: literal.arg, literal, varName: name }] : []),
+                ...identifiers.rewrites,
+            ];
             // Every edit was a no-op — the value already reads its Laneyard name, and
             // so did each identifier. Nothing to propose.
             if (edits.length === 0)
@@ -69,6 +73,7 @@ export function proposalsFor(literals) {
                 },
                 literal,
                 edits,
+                rewrites,
                 checked: true,
             });
             continue;
@@ -96,6 +101,7 @@ export function proposalsFor(literals) {
                     },
                     ...identifiers.edits,
                 ],
+                rewrites: [{ arg: inline.becomes, literal, varName: name }, ...identifiers.rewrites],
                 checked: true,
             });
             continue;
@@ -108,6 +114,7 @@ export function proposalsFor(literals) {
                 literal,
                 suggestedFields: {},
                 edits: [{ start: literal.valueStart, length: literal.valueLength, replacement: `ENV.fetch("${name}")` }],
+                rewrites: [{ arg: literal.arg, literal, varName: name }],
                 // Unticked on purpose. This is the one tier where a false positive is
                 // likely — a non-secret URL, a placeholder — and a patch applied by
                 // default to a value that was not a secret is a silent regression in
@@ -119,7 +126,11 @@ export function proposalsFor(literals) {
     return out;
 }
 /** Neither an edit nor a field: an `apple_asc` block that names no identifier. */
-const EMPTY = { edits: [], fields: {} };
+const EMPTY = {
+    edits: [],
+    fields: {},
+    rewrites: [],
+};
 /**
  * The rewrites and pre-filled fields for the identifiers written beside an
  * App Store Connect key file.
@@ -133,17 +144,21 @@ const EMPTY = { edits: [], fields: {} };
 function appleIdentifierRewrites(identifiers) {
     const defaults = defaultVarNames("apple_asc");
     const edits = [];
+    const rewrites = [];
     const fields = {};
     for (const id of identifiers) {
-        const edit = rewriteTo(id, defaults[id.arg]);
-        if (edit)
+        const name = defaults[id.arg];
+        const edit = rewriteTo(id, name);
+        if (edit) {
             edits.push(edit);
+            rewrites.push({ arg: id.arg, literal: id, varName: name });
+        }
         // Only a literal is the identifier's value; an env name is the *variable* it
         // was read from, not the id itself, so it pre-fills nothing.
         if (id.kind === "literal")
             fields[id.arg] = id.value;
     }
-    return { edits, fields };
+    return { edits, fields, rewrites };
 }
 /**
  * The edit that makes one argument read `varName`, or null when it already does.

package/dist/src/git/workspace.js

@@ -199,6 +199,34 @@ export class Workspace {
         onProgress?.(`Cloning ${this.redact(this.gitUrl)}…`);
         await this.git(["clone", this.gitUrl, this.path], process.cwd());
     }
+    /**
+     * Commits this workspace holds that `origin/<branch>` does not.
+     *
+     * The one thing `prepare` would destroy without saying so: it moves the local
+     * branch onto origin's, and a commit only this clone had becomes reachable
+     * from the reflog and nowhere a person looks. That is not hypothetical — the
+     * Fastfile tab commits and pushes as two separate acts on purpose, so a
+     * workspace sitting one commit ahead is a state the product produces itself.
+     *
+     * Counted rather than listed: the caller refuses on any number above zero, and
+     * a list would invite showing it, which is a screen nobody asked for.
+     *
+     * Zero when the branch does not exist on the remote yet, and zero when
+     * anything about the question cannot be answered — a workspace that has never
+     * been fetched has no `origin/<branch>` to compare against, and refusing a
+     * refresh because the comparison failed would break the one case the refresh
+     * exists for.
+     */
+    async unpushedCount(branch) {
+        try {
+            const out = await this.git(["rev-list", "--count", `origin/${branch}..HEAD`]);
+            const n = Number(out.trim());
+            return Number.isInteger(n) ? n : 0;
+        }
+        catch {
+            return 0;
+        }
+    }
     /**
      * Brings the workspace to the requested branch, up to date.
      * Clones on the first call, just fetches afterwards.