laneyard 0.7.0 → 0.8.0

package/README.md

@@ -94,7 +94,7 @@ See [Credentials](docs/credentials.md).
 
 - **[Configuration](docs/configuration.md)** — `config.yml` and `laneyard.yml`.
 - **[Accounts](docs/accounts.md)** — the two roles, and which projects a builder reaches.
-- **[Credentials](docs/credentials.md)** — hardcoded credentials at setup, secrets, signing blocks.
+- **[Credentials](docs/credentials.md)** — hardcoded credentials at setup, secrets, the environment file, signing blocks.
 - **[Readiness](docs/readiness.md)** — the per-project checklist, and what a tick means.
 - **[Managing a project](docs/managing.md)** — the Fastfile editor, removing, resetting, uninstalling.
 - **[Security](docs/security.md)** — what is encrypted, what is not, and what this does not cover.

package/dist/src/cli/remove.js

@@ -45,8 +45,8 @@ async function readCounts(home, slug) {
         return {
             activeRun: runs.hasActiveRun(slug),
             runs: runs.listByProject(slug, -1).length,
-            secrets: new SecretStore(db).listOwn(slug).length,
-            signingBlocks: new CredentialStore(db).listOwn(slug).length,
+            secrets: new SecretStore(db).list(slug).length,
+            signingBlocks: new CredentialStore(db).list(slug).length,
         };
     }
     finally {

package/dist/src/cli/reset.js

@@ -31,8 +31,8 @@ function renderInventory(inv) {
         out += field("database", inv.db === null ? dim("not there") : dim("could not be read")) + "\n";
     }
     else {
-        out += field("secrets", `${plural(v.projectSecrets, "project secret")}, ${plural(v.globalSecrets, "global secret")}`) + "\n";
-        out += field("signing", `${plural(v.projectBlocks, "project signing block")}, ${plural(v.globalBlocks, "global signing block")}`) + "\n";
+        out += field("secrets", plural(v.secrets, "secret")) + "\n";
+        out += field("signing", plural(v.blocks, "signing block")) + "\n";
         out += field("history", plural(v.runs, "run")) + "\n";
     }
     if (inv.folders.length === 0) {

package/dist/src/cli/uninstall.js

@@ -103,13 +103,8 @@ async function readVault(dbPath) {
         const count = (sql) => db.prepare(sql).get().n;
         return {
             vault: {
-                // The empty slug is how a global row is stored — the same convention
-                // `SecretStore` and `CredentialStore` use, and the reason the two are
-                // counted apart: a global secret belongs to every project.
-                projectSecrets: count("SELECT COUNT(*) AS n FROM secret WHERE project_slug != ''"),
-                globalSecrets: count("SELECT COUNT(*) AS n FROM secret WHERE project_slug = ''"),
-                projectBlocks: count("SELECT COUNT(*) AS n FROM credential WHERE project_slug != ''"),
-                globalBlocks: count("SELECT COUNT(*) AS n FROM credential WHERE project_slug = ''"),
+                secrets: count("SELECT COUNT(*) AS n FROM secret"),
+                blocks: count("SELECT COUNT(*) AS n FROM credential"),
                 runs: count("SELECT COUNT(*) AS n FROM run"),
             },
             unreadable: null,
@@ -221,19 +216,8 @@ export function renderInventory(inv) {
         }
         else {
             const v = inv.db.vault;
-            out += field("secrets", `${plural(v.projectSecrets, "project secret")}`) + "\n";
-            // Said on its own line and in words rather than folded into the number
-            // above: a global secret is read by every project on this machine, and
-            // "in scope" is the fact someone needs before they answer the question.
-            out +=
-                field("", v.globalSecrets === 0
-                    ? dim("no global secret")
-                    : `${plural(v.globalSecrets, "global secret")} — shared by every project, ${bold("removed too")}`) + "\n";
-            out += field("signing", `${plural(v.projectBlocks, "project signing block")}`) + "\n";
-            out +=
-                field("", v.globalBlocks === 0
-                    ? dim("no global signing block")
-                    : `${plural(v.globalBlocks, "global signing block")} — shared by every project, ${bold("removed too")}`) + "\n";
+            out += field("secrets", plural(v.secrets, "secret")) + "\n";
+            out += field("signing", plural(v.blocks, "signing block")) + "\n";
             out += field("history", plural(v.runs, "run")) + "\n";
         }
     }
@@ -267,7 +251,7 @@ export function renderInventory(inv) {
  */
 export function renderIrreversible(inv) {
     const v = inv.db?.vault;
-    const stored = v === undefined || v === null ? null : v.projectSecrets + v.globalSecrets + v.projectBlocks + v.globalBlocks;
+    const stored = v === undefined || v === null ? null : v.secrets + v.blocks;
     return (heading("what cannot be undone") +
         warn(`The vault key is the one thing here that has no other copy.\n`) +
         dim("  Every secret and every signing block is encrypted under " + (inv.key?.path ?? join(inv.home, "key")) + ".\n") +

package/dist/src/config/env-file-setting.js

@@ -0,0 +1,57 @@
+import { readFile, writeFile } from "node:fs/promises";
+import { isAbsolute, normalize } from "node:path";
+import { parseDocument, YAMLMap, YAMLSeq } from "yaml";
+import { serializeYaml } from "./yaml.js";
+/**
+ * Sets or clears a project's `env_file`, in `config.yml`, leaving the rest of
+ * the file alone.
+ *
+ * The setting is configuration, so it lives in a file — that is what makes
+ * backing Laneyard up a matter of copying one. But it is also the only way to
+ * turn the environment file on, and a feature reachable exclusively by editing
+ * YAML by hand is one nobody finds. So the screen writes the file, the way the
+ * accounts screen already writes accounts and the removal screen already
+ * removes a project's block.
+ *
+ * A `laneyard.yml` in the repository still wins, unchanged: that precedence is
+ * the same for every setting, and this function is not the place to invent an
+ * exception to it. The screen reports it rather than offering to fight it.
+ *
+ * Returns false when no project carries that slug, so the caller can answer 404
+ * rather than rewrite the file to say what it already said.
+ */
+export async function setEnvFileSetting(path, slug, envFile) {
+    const doc = parseDocument(await readFile(path, "utf8"));
+    const projects = doc.get("projects");
+    if (!(projects instanceof YAMLSeq))
+        return false;
+    const entry = projects.items.find((item) => item instanceof YAMLMap && item.get("slug") === slug);
+    if (!entry)
+        return false;
+    if (envFile === null)
+        entry.delete("env_file");
+    else
+        entry.set("env_file", envFile);
+    await writeFile(path, serializeYaml(doc), "utf8");
+    return true;
+}
+/**
+ * Why this path cannot be used, or null.
+ *
+ * The same rule the schema enforces at load, applied here so a bad value is
+ * refused by the screen that typed it rather than accepted and then reported as
+ * a broken configuration on the next reload. The file holds the values the vault
+ * exists to protect, and a path climbing out of the app would let it be dropped
+ * anywhere on the server.
+ */
+export function envFileProblem(envFile) {
+    if (envFile === "")
+        return "A path is required.";
+    if (isAbsolute(envFile))
+        return "A path inside the app, not an absolute one.";
+    const clean = normalize(envFile);
+    if (clean === ".." || clean.startsWith("../") || clean.startsWith("..\\")) {
+        return "A path inside the app, not one that climbs out of it.";
+    }
+    return null;
+}

package/dist/src/config/resolve.js

@@ -18,13 +18,13 @@ function underApp(appRoot, p) {
  * duplicated keeps its file unchanged. But everything downstream resolves paths
  * as repo-root-relative (`join(workspacePath, …)`, globs with `cwd:
  * workspacePath`). So the app-relativity is collapsed here, once, at the
- * boundary: the two path fields are prefixed with the app directory before the
+ * boundary: the path fields are prefixed with the app directory before the
  * merge ever sees them, and nothing past this point learns a new rule.
  *
- * Only the path fields move. `platforms`, `runtime`, `timeout_minutes`,
- * `interactive_default`, `required_secrets` and `retention` are not paths and
- * pass through untouched. A root-level file is never handed here: its paths are
- * already repo-root-relative.
+ * Only the path fields move — `fastlane_dir`, `artifact_globs` and `env_file`.
+ * `platforms`, `runtime`, `timeout_minutes`, `interactive_default`,
+ * `required_secrets` and `retention` are not paths and pass through untouched. A
+ * root-level file is never handed here: its paths are already repo-root-relative.
  */
 export function normaliseAppConfig(repo, appRoot) {
     const out = { ...repo };
@@ -34,6 +34,9 @@ export function normaliseAppConfig(repo, appRoot) {
     if (repo.artifact_globs !== undefined) {
         out.artifact_globs = repo.artifact_globs.map((g) => underApp(appRoot, g));
     }
+    if (repo.env_file !== undefined) {
+        out.env_file = underApp(appRoot, repo.env_file);
+    }
     return out;
 }
 /**

package/dist/src/config/schema.js

@@ -1,4 +1,18 @@
+import { isAbsolute, normalize } from "node:path";
 import { z } from "zod";
+/**
+ * Whether a relative path leaves the directory it is relative to.
+ *
+ * `normalize` collapses `a/../../b` to `../b`, so one check after it catches
+ * both the obvious `../.env` and the roundabout spelling. An absolute path is
+ * refused outright: it does not mean "inside the app" under any reading.
+ */
+function escapesApp(p) {
+    if (isAbsolute(p))
+        return true;
+    const clean = normalize(p);
+    return clean === ".." || clean.startsWith(`..${"/"}`) || clean.startsWith("..\\");
+}
 /** A slug is used as a folder name and a URL segment. */
 const slugSchema = z
     .string()
@@ -17,6 +31,21 @@ export const projectSettingsSchema = z.object({
     interactive_default: z.boolean().default(false),
     artifact_globs: z.array(z.string()).default([]),
     required_secrets: z.array(z.string()).default([]),
+    // Where to write the file the build reads from disk — a gitignored `.env`, a
+    // `config.json` for `--dart-define-from-file`. No default: absent means the
+    // project wants no such file, which is almost every project, and an empty
+    // string would be a path to interpret rather than an absence to respect.
+    //
+    // Relative to the app directory, like `fastlane_dir`. A path that climbs out
+    // of it is refused here rather than at write time: the file holds the values
+    // the vault exists to protect, and a configuration must never be able to drop
+    // one anywhere on the server. Refusing at load also means the last valid
+    // configuration stays live, which is what every other bad value gets.
+    env_file: z
+        .string()
+        .min(1, "env_file: a path, or leave it out")
+        .refine((p) => !escapesApp(p), "env_file: a path inside the app, not one that climbs out of it")
+        .optional(),
     // What this project builds for. No default: absent means "nobody said", and
     // the readiness checklist falls back to looking at the repository. Setting it
     // is how a repository that happens to carry an Xcode project it never builds

package/dist/src/db/credentials.js

@@ -1,11 +1,14 @@
-const GLOBAL = "";
 /**
  * Stores signing credential blocks: a file plus the fields that make it
  * usable. Knows nothing about encryption itself: it takes and returns
  * ciphertext, so a bug here cannot leak a plaintext value.
  *
- * A project credential shadows a global one of the same kind — the same
- * precedence as `SecretStore`, and the least surprising rule.
+ * One project, one block per kind. A block used to be storable under no project
+ * and read by all of them — an App Store Connect key is usually one per
+ * developer account, not one per app, so the sharing matched something real.
+ * It went anyway: it meant no screen could show what a project actually signs
+ * with. Five apps under one account now hold five copies of the key, and
+ * rotating it means replacing five.
  */
 export class CredentialStore {
     db;
@@ -22,68 +25,30 @@ export class CredentialStore {
                fields_enc = excluded.fields_enc,
                var_names  = excluded.var_names,
                updated_at = excluded.updated_at`)
-            .run(projectSlug ?? GLOBAL, kind, input.fileName, input.fileEnc, input.fieldsEnc, JSON.stringify(input.varNames), new Date().toISOString());
+            .run(projectSlug, kind, input.fileName, input.fileEnc, input.fieldsEnc, JSON.stringify(input.varNames), new Date().toISOString());
     }
-    /** Rows that apply to a project, project scope winning over global. */
-    applicable(projectSlug) {
+    /** This project's blocks, ciphertext included. */
+    rows(projectSlug) {
         const rows = this.db
-            .prepare("SELECT * FROM credential WHERE project_slug IN (?, ?) ORDER BY kind")
-            .all(projectSlug, GLOBAL);
-        const byKind = new Map();
-        for (const row of rows) {
-            const existing = byKind.get(row.kind);
-            if (!existing || row.project_slug !== GLOBAL)
-                byKind.set(row.kind, row);
-        }
-        return [...byKind.values()]
-            .sort((a, b) => a.kind.localeCompare(b.kind))
-            .map((row) => this.toSummary(row));
+            .prepare("SELECT * FROM credential WHERE project_slug = ? ORDER BY kind")
+            .all(projectSlug);
+        return rows.map((row) => this.toSummary(row));
     }
-    /** One applicable block, ciphertext included, or undefined. */
+    /** One block, ciphertext included, or undefined. */
     find(projectSlug, kind) {
-        return this.applicable(projectSlug).find((r) => r.kind === kind);
+        return this.rows(projectSlug).find((r) => r.kind === kind);
     }
     list(projectSlug) {
-        return this.applicable(projectSlug).map(({ fileEnc: _fileEnc, fieldsEnc: _fieldsEnc, ...summary }) => summary);
+        return this.rows(projectSlug).map(({ fileEnc: _fileEnc, fieldsEnc: _fieldsEnc, ...summary }) => summary);
     }
-    /**
-     * The blocks stored under this slug, and no global one.
-     *
-     * Same distinction as `SecretStore.listOwn`, and it matters more here: a
-     * global keystore shadowed by nothing is shared by every project on the
-     * machine, and counting it as one project's would offer to delete the one
-     * credential every other project signs with.
-     */
-    listOwn(projectSlug) {
-        if (projectSlug === GLOBAL)
-            return [];
-        const rows = this.db
-            .prepare("SELECT * FROM credential WHERE project_slug = ? ORDER BY kind")
-            .all(projectSlug);
-        return rows.map((row) => {
-            const { fileEnc: _fileEnc, fieldsEnc: _fieldsEnc, ...summary } = this.toSummary(row);
-            return summary;
-        });
-    }
-    /** Removes every block stored under this slug, and returns how many. */
-    removeAllOwn(projectSlug) {
-        if (projectSlug === GLOBAL)
-            return 0;
+    /** Removes every block this project holds, and returns how many. */
+    removeAll(projectSlug) {
         return this.db.prepare("DELETE FROM credential WHERE project_slug = ?").run(projectSlug).changes;
     }
-    listGlobal() {
-        const rows = this.db
-            .prepare("SELECT * FROM credential WHERE project_slug = ? ORDER BY kind")
-            .all(GLOBAL);
-        return rows.map((row) => {
-            const { fileEnc: _fileEnc, fieldsEnc: _fieldsEnc, ...summary } = this.toSummary(row);
-            return summary;
-        });
-    }
     remove(projectSlug, kind) {
         const res = this.db
             .prepare("DELETE FROM credential WHERE project_slug = ? AND kind = ?")
-            .run(projectSlug ?? GLOBAL, kind);
+            .run(projectSlug, kind);
         return res.changes > 0;
     }
     toSummary(row) {
@@ -92,7 +57,6 @@ export class CredentialStore {
             fileName: row.file_name,
             fileEnc: row.file_enc,
             fieldsEnc: row.fields_enc,
-            scope: row.project_slug === GLOBAL ? "global" : "project",
             varNames: JSON.parse(row.var_names),
             updatedAt: row.updated_at,
         };

package/dist/src/db/migrate-global-scope.js

@@ -0,0 +1,75 @@
+/** The two tables that carried a scope, and the column that identified a row in each. */
+const TABLES = [
+    { table: "secret", column: "key", what: "secret" },
+    { table: "credential", column: "kind", what: "signing block" },
+];
+/**
+ * Gives every row that belonged to everything to each project that read it.
+ *
+ * The vault used to have two scopes: a row stored under the empty slug applied
+ * to every project, and a row under a real slug shadowed it. That is gone — a
+ * secret and a signing block now belong to exactly one project — and this is
+ * what happens to the rows written before it went.
+ *
+ * **Copied, never dropped.** A global secret was read by every project, so
+ * writing it into every project preserves precisely the behaviour it had:
+ * nothing that built yesterday stops building today. The alternative — deleting
+ * rows the user never asked to delete, on an upgrade — would break working
+ * projects to tidy a table.
+ *
+ * **A project that overrode a global one keeps its own value.** The insert
+ * takes no action on conflict, which is the same precedence the merged read
+ * applied, made permanent rather than recomputed on every query.
+ *
+ * The cost is real and is the point of the report: someone who stored one App
+ * Store Connect key now has five, and rotating it means replacing five. They
+ * have to be told, or they will find out from a build that uploads with a key
+ * they thought they had replaced.
+ *
+ * With no projects configured there is nowhere to copy to, and the row is
+ * deleted rather than left: every query names a slug now, so the empty one is
+ * unreachable — not shared, just invisible and forever unread.
+ */
+export function migrateGlobalScope(db, allSlugs) {
+    const report = { copied: [], dropped: [] };
+    // The empty slug is the sentinel this function is deleting. A configuration
+    // cannot produce one — `slugSchema` refuses it — but if one ever arrived, the
+    // copy would land on the row about to be deleted and the data would go with
+    // it, silently. That is the one input worth refusing by hand.
+    const slugs = allSlugs.filter((slug) => slug !== "");
+    const run = db.transaction(() => {
+        for (const { table, column, what } of TABLES) {
+            const names = db.prepare(`SELECT ${column} AS name FROM ${table} WHERE project_slug = '' ORDER BY ${column}`).all().map((row) => row.name);
+            if (names.length === 0)
+                continue;
+            // `SELECT ?, <rest>` rather than a read-then-write: it keeps every column
+            // the table has without naming them here, so a column added later travels
+            // with the copy instead of being silently dropped by a migration nobody
+            // thought to update.
+            const columns = db.prepare(`PRAGMA table_info(${table})`).all().map((c) => c.name);
+            const rest = columns.filter((c) => c !== "project_slug");
+            const copy = db.prepare(`INSERT INTO ${table} (project_slug, ${rest.join(", ")})
+         SELECT ?, ${rest.join(", ")} FROM ${table} WHERE project_slug = '' AND ${column} = ?
+         ON CONFLICT DO NOTHING`);
+            for (const name of names) {
+                const wrote = [];
+                for (const slug of slugs)
+                    if (copy.run(slug, name).changes > 0)
+                        wrote.push(slug);
+                // Dropped means "deleted and copied nowhere", which covers two cases:
+                // there was no project to copy into, and every project already defined
+                // the name and kept its own. The second changes nothing anyone could
+                // observe — the row was shadowed everywhere, so nothing ever read it —
+                // but it is still a deletion, and a migration that deletes in silence is
+                // one nobody can audit afterwards.
+                if (wrote.length > 0)
+                    report.copied.push({ what, name, slugs: wrote });
+                else
+                    report.dropped.push({ what, name });
+            }
+            db.prepare(`DELETE FROM ${table} WHERE project_slug = ''`).run();
+        }
+    });
+    run();
+    return report;
+}

package/dist/src/db/open.js

@@ -9,6 +9,10 @@ export function openDatabase(path) {
     migrateIntrospectionCache(db);
     const here = dirname(fileURLToPath(import.meta.url));
     db.exec(readFileSync(join(here, "schema.sql"), "utf8"));
+    // After the schema, not before: on a fresh database the table has to exist
+    // for the column check to mean anything, and there `CREATE TABLE` has already
+    // put the column in.
+    migrateEnvFileColumn(db);
     return db;
 }
 /**
@@ -25,3 +29,20 @@ function migrateIntrospectionCache(db) {
         db.exec("DROP TABLE introspection_cache");
     }
 }
+/**
+ * Adds `secret.in_env_file` to a database written before the environment file
+ * existed.
+ *
+ * `CREATE TABLE IF NOT EXISTS` leaves an existing table alone, so a column added
+ * to the schema never reaches a database that already has the table. The cache
+ * above answers that by dropping and rebuilding; here that would delete the
+ * vault. `ALTER TABLE … ADD COLUMN` with a default is the whole migration: every
+ * row that predates the column reads as "not in the file", which is exactly what
+ * it was.
+ */
+function migrateEnvFileColumn(db) {
+    const columns = db.prepare("PRAGMA table_info(secret)").all();
+    if (!columns.some((c) => c.name === "in_env_file")) {
+        db.exec("ALTER TABLE secret ADD COLUMN in_env_file INTEGER NOT NULL DEFAULT 0");
+    }
+}

package/dist/src/db/schema.sql

@@ -50,14 +50,19 @@ CREATE TABLE IF NOT EXISTS introspection_cache (
   PRIMARY KEY (project_slug, kind)
 );
 
--- A global secret is stored with an empty project_slug rather than NULL:
--- SQLite considers two NULLs distinct in a UNIQUE index, so NULL would let the
--- same global name be inserted twice.
+-- Every secret belongs to one project. There was a second scope once — the
+-- empty slug, read by every project — and `migrate-global-scope.ts` is what
+-- became of the rows written under it.
+-- `in_env_file` says this variable is also written into the file the build reads
+-- from disk — see `runner/env-file.ts`. It is membership, not a second value: a
+-- flagged secret still reaches the run as an environment variable like any
+-- other. `open.ts` adds the column to a database written before it existed.
 CREATE TABLE IF NOT EXISTS secret (
-  project_slug TEXT    NOT NULL DEFAULT '',
+  project_slug TEXT    NOT NULL,
   key          TEXT    NOT NULL,
   value_enc    TEXT    NOT NULL,
   masked       INTEGER NOT NULL DEFAULT 1,
+  in_env_file  INTEGER NOT NULL DEFAULT 0,
   updated_at   TEXT    NOT NULL,
   PRIMARY KEY (project_slug, key)
 );
@@ -74,7 +79,7 @@ CREATE TABLE IF NOT EXISTS secret (
 -- `var_names` is NOT encrypted. It holds variable names, never values, and the
 -- interface has to display them.
 CREATE TABLE IF NOT EXISTS credential (
-  project_slug TEXT NOT NULL DEFAULT '',
+  project_slug TEXT NOT NULL,
   kind         TEXT NOT NULL,
   file_name    TEXT NOT NULL,
   file_enc     TEXT NOT NULL,

package/dist/src/db/secrets.js

@@ -1,50 +1,41 @@
-const GLOBAL = "";
+const summaryOf = (row) => ({
+    key: row.key,
+    masked: row.masked === 1,
+    inEnvFile: row.in_env_file === 1,
+});
 /**
  * Stores encrypted secrets. Knows nothing about encryption itself: it takes and
  * returns ciphertext, so a bug here cannot leak a plaintext value.
  *
- * A project secret shadows a global one of the same name — the same precedence
- * as the configuration, and the least surprising rule.
+ * Every row belongs to exactly one project. There used to be a second scope —
+ * a row under no project, read by all of them, shadowed by a project's own —
+ * and it is gone: see `migrate-global-scope.ts`. What it cost was the answer to
+ * "what does this project see", which was a merge of two sets that no screen
+ * ever showed whole. It is now one query.
  */
 export class SecretStore {
     db;
     constructor(db) {
         this.db = db;
     }
-    set(projectSlug, key, valueEnc, masked) {
+    set(projectSlug, key, valueEnc, masked, inEnvFile = false) {
         this.db
-            .prepare(`INSERT INTO secret (project_slug, key, value_enc, masked, updated_at)
-         VALUES (?, ?, ?, ?, ?)
+            .prepare(`INSERT INTO secret (project_slug, key, value_enc, masked, in_env_file, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?)
          ON CONFLICT (project_slug, key) DO UPDATE
            SET value_enc = excluded.value_enc,
                masked = excluded.masked,
+               in_env_file = excluded.in_env_file,
                updated_at = excluded.updated_at`)
-            .run(projectSlug ?? GLOBAL, key, valueEnc, masked ? 1 : 0, new Date().toISOString());
+            .run(projectSlug, key, valueEnc, masked ? 1 : 0, inEnvFile ? 1 : 0, new Date().toISOString());
     }
-    /** Rows that apply to a project, project scope winning over global. */
-    applicable(projectSlug) {
-        const rows = this.db
-            .prepare("SELECT * FROM secret WHERE project_slug IN (?, ?) ORDER BY key")
-            .all(projectSlug, GLOBAL);
-        const byKey = new Map();
-        for (const row of rows) {
-            const existing = byKey.get(row.key);
-            if (!existing || row.project_slug !== GLOBAL)
-                byKey.set(row.key, row);
-        }
-        return [...byKey.values()].sort((a, b) => a.key.localeCompare(b.key));
+    rows(projectSlug) {
+        return this.db.prepare("SELECT * FROM secret WHERE project_slug = ? ORDER BY key").all(projectSlug);
     }
-    /** One applicable row, ciphertext included, or undefined. */
+    /** One row, ciphertext included, or undefined. */
     find(projectSlug, key) {
-        const row = this.applicable(projectSlug).find((r) => r.key === key);
-        return row
-            ? {
-                key: row.key,
-                masked: row.masked === 1,
-                scope: row.project_slug === GLOBAL ? "global" : "project",
-                valueEnc: row.value_enc,
-            }
-            : undefined;
+        const row = this.rows(projectSlug).find((r) => r.key === key);
+        return row ? { ...summaryOf(row), valueEnc: row.value_enc } : undefined;
     }
     /**
      * Flips whether a value is kept out of the logs, leaving the value alone.
@@ -60,58 +51,46 @@ export class SecretStore {
         return (this.db
             .prepare(`UPDATE secret SET masked = ?, updated_at = ?
            WHERE project_slug = ? AND key = ?`)
-            .run(masked ? 1 : 0, new Date().toISOString(), projectSlug ?? GLOBAL, key).changes > 0);
+            .run(masked ? 1 : 0, new Date().toISOString(), projectSlug, key).changes > 0);
     }
     /**
-     * The rows stored under this slug, and no global one.
+     * Flips whether this variable is written into the environment file, leaving
+     * the value and the masking alone.
      *
-     * `list` answers "what does this project see", which is the right question
-     * everywhere else and the wrong one when a project is going away: a global
-     * secret three other projects also read is not this one's to count, and
-     * certainly not its to remove.
-     *
-     * The empty slug is the global scope's own key, so it is refused here rather
-     * than quietly returning every global row as if one project owned them.
+     * Its own operation for the same reason as `setMasked`: re-`set` would mean
+     * handing back a value the caller may not be able to read.
      */
-    listOwn(projectSlug) {
-        if (projectSlug === GLOBAL)
-            return [];
-        const rows = this.db
-            .prepare("SELECT * FROM secret WHERE project_slug = ? ORDER BY key")
-            .all(projectSlug);
-        return rows.map((row) => ({ key: row.key, masked: row.masked === 1, scope: "project" }));
+    setInEnvFile(projectSlug, key, inEnvFile) {
+        return (this.db
+            .prepare(`UPDATE secret SET in_env_file = ?, updated_at = ?
+           WHERE project_slug = ? AND key = ?`)
+            .run(inEnvFile ? 1 : 0, new Date().toISOString(), projectSlug, key).changes > 0);
     }
-    /** Removes every row stored under this slug, and returns how many. */
-    removeAllOwn(projectSlug) {
-        if (projectSlug === GLOBAL)
-            return 0;
+    /** Removes every row this project holds, and returns how many. */
+    removeAll(projectSlug) {
         return this.db.prepare("DELETE FROM secret WHERE project_slug = ?").run(projectSlug).changes;
     }
     list(projectSlug) {
-        return this.applicable(projectSlug).map((row) => ({
-            key: row.key,
-            masked: row.masked === 1,
-            scope: row.project_slug === GLOBAL ? "global" : "project",
-        }));
+        return this.rows(projectSlug).map(summaryOf);
     }
-    listGlobal() {
-        const rows = this.db
-            .prepare("SELECT * FROM secret WHERE project_slug = ? ORDER BY key")
-            .all(GLOBAL);
-        return rows.map((row) => ({ key: row.key, masked: row.masked === 1, scope: "global" }));
+    /** The names that go in the environment file, in the order they are written. */
+    envFileKeys(projectSlug) {
+        return this.rows(projectSlug)
+            .filter((r) => r.in_env_file === 1)
+            .map((r) => r.key);
     }
     /** Ciphertext by name, for the vault to decrypt. */
     encrypted(projectSlug) {
-        return Object.fromEntries(this.applicable(projectSlug).map((row) => [row.key, row.value_enc]));
+        return Object.fromEntries(this.rows(projectSlug).map((row) => [row.key, row.value_enc]));
     }
-    /** Which of the applicable secrets should be kept out of the logs. */
+    /** Which of this project's secrets should be kept out of the logs. */
     maskedKeys(projectSlug) {
-        return new Set(this.applicable(projectSlug).filter((r) => r.masked === 1).map((r) => r.key));
+        return new Set(this.rows(projectSlug)
+            .filter((r) => r.masked === 1)
+            .map((r) => r.key));
     }
     remove(projectSlug, key) {
-        const res = this.db
-            .prepare("DELETE FROM secret WHERE project_slug = ? AND key = ?")
-            .run(projectSlug ?? GLOBAL, key);
+        const res = this.db.prepare("DELETE FROM secret WHERE project_slug = ? AND key = ?").run(projectSlug, key);
         return res.changes > 0;
     }
 }