laneyard 0.3.0 → 0.4.1

package/dist/src/cli/secret.js

@@ -1,17 +1,29 @@
+import { execFile } from "node:child_process";
 import { join } from "node:path";
+import { promisify } from "node:util";
+import { readFile } from "node:fs/promises";
+import { applyImport, envFilesIn, parseEnvFile, planImport } from "./secret-import.js";
 import { ConfigStore } from "../config/store.js";
 import { openDatabase } from "../db/open.js";
+import { CredentialStore } from "../db/credentials.js";
 import { SecretStore } from "../db/secrets.js";
 import { MIN_LENGTH as MIN_REDACTABLE } from "../logs/redact.js";
 import { Vault } from "../secrets/vault.js";
 /** Same rule as the API: what cannot become an environment variable is refused here too. */
 const VALID_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
 export const SECRET_USAGE = `laneyard secret set <NAME> [--project <slug>] [--no-mask]
+laneyard secret import --project <slug> [--yes]
 
 The value is read from standard input, never from an argument:
 
   laneyard secret set MATCH_PASSWORD --project app
   echo "$TOKEN" | laneyard secret set GITHUB_TOKEN
+
+\`import\` reads this project's fastlane/.env and stores what it finds. A
+variable naming a service account JSON has the *file* stored, under the name
+fastlane looks for — a path does not travel to a build machine. A variable
+naming a .p8 is left alone and reported instead: that credential belongs in a
+signing block from the secrets tab, not in a loose variable.
 `;
 /**
  * Reads standard input whole.
@@ -69,6 +81,9 @@ function parse(args) {
  */
 export async function runSecretCommand(home, args, io) {
     const [subcommand, ...rest] = args;
+    if (subcommand === "import") {
+        return runSecretImport(home, rest, io);
+    }
     if (subcommand !== "set") {
         io.err(subcommand === undefined ? `${SECRET_USAGE}` : `Unknown subcommand: ${subcommand}\n\n${SECRET_USAGE}`);
         return 1;
@@ -121,7 +136,7 @@ export async function runSecretCommand(home, args, io) {
     }
     const db = openDatabase(join(home, "laneyard.db"));
     try {
-        const vault = await Vault.open(home, new SecretStore(db));
+        const vault = await Vault.open(home, new SecretStore(db), new CredentialStore(db));
         await vault.set(parsed.project, parsed.key, value, parsed.masked);
     }
     finally {
@@ -131,3 +146,149 @@ export async function runSecretCommand(home, args, io) {
         `  ${parsed.masked ? "kept out of the logs" : "shown in the logs"}\n`);
     return 0;
 }
+/**
+ * `laneyard secret import` — the existing `.env` into the vault.
+ *
+ * Shows what it would do before doing it, in names only. An import that reads
+ * eight files and writes eight secrets before saying a word is one nobody can
+ * check, and this is the one command that handles every credential a project
+ * has at once.
+ */
+async function runSecretImport(home, args, io) {
+    let project = null;
+    let yes = false;
+    for (let i = 0; i < args.length; i += 1) {
+        const arg = args[i];
+        if (arg === "--project" || arg === "-p") {
+            const next = args[i + 1];
+            if (next === undefined || next.startsWith("-")) {
+                io.err("--project needs a slug.\n");
+                return 1;
+            }
+            project = next;
+            i += 1;
+        }
+        else if (arg === "--yes" || arg === "-y") {
+            yes = true;
+        }
+        else {
+            io.err(`Unknown option: ${arg}\n\n${SECRET_USAGE}`);
+            return 1;
+        }
+    }
+    if (project === null) {
+        io.err("Which project? Give it with --project <slug>.\n");
+        return 1;
+    }
+    const config = new ConfigStore(join(home, "config.yml"));
+    const loaded = await config.load();
+    if (!loaded.ok) {
+        io.err(`Unreadable configuration in ${join(home, "config.yml")}: ${loaded.error}\n`);
+        return 1;
+    }
+    const entry = config.project(project);
+    if (!entry) {
+        const known = config.projects().map((p) => p.slug);
+        io.err(`Unknown project: "${project}".` +
+            (known.length > 0 ? ` Known projects: ${known.join(", ")}.` : " No project is declared yet.") +
+            "\n");
+        return 1;
+    }
+    // Read from the working copy this command was run in — the only place a
+    // gitignored `.env` exists; the server's clone never has one.
+    //
+    // Resolved against the repository root, not the current directory:
+    // `fastlane_dir` is recorded relative to the root, so running this from
+    // `app/` would otherwise look for `app/app/fastlane/.env`. The same
+    // confusion, one command along, as the one that produced an ENOENT in the
+    // lane list.
+    const fastlaneDir = entry.fastlane_dir ?? "fastlane";
+    const root = await repositoryRoot(process.cwd());
+    const env = new Map();
+    const readFrom = [];
+    for (const file of envFilesIn(fastlaneDir)) {
+        const text = await readFile(join(root, file), "utf8").catch(() => null);
+        if (text === null)
+            continue;
+        readFrom.push(file);
+        for (const [k, v] of parseEnvFile(text))
+            env.set(k, v);
+    }
+    if (readFrom.length === 0) {
+        io.err(`No ${fastlaneDir}/.env under ${root}. Run this from the working copy that has one — ` +
+            "it is the file that never reaches a clone, which is the whole reason for this command.\n");
+        return 1;
+    }
+    const db = openDatabase(join(home, "laneyard.db"));
+    try {
+        const vault = await Vault.open(home, new SecretStore(db), new CredentialStore(db));
+        // Paths inside a `.env` are written relative to where fastlane runs, which
+        // is the fastlane directory's parent — the app, not the repository root.
+        const plan = await planImport(env, join(root, fastlaneDir, ".."), vault.list(project).map((s) => s.key));
+        if (plan.planned.length === 0) {
+            io.out(`Nothing to import from ${readFrom.join(" and ")}.\n`);
+            return 0;
+        }
+        io.out(`\nFrom ${readFrom.join(" and ")}, into "${project}":\n\n`);
+        for (const item of plan.planned) {
+            if (item.kind === "unresolved-path") {
+                io.out(`  ✗ ${item.key} — names ${item.path}, which is not there. Skipped.\n`);
+            }
+            else if (item.kind === "suggest-block") {
+                io.out(`  ▸ ${item.key} names ${item.path} — no action in fastlane reads that variable. ` +
+                    "Upload the `.p8` as an App Store Connect key block from the secrets tab instead, with " +
+                    "its key id and issuer id. Not imported here.\n");
+            }
+            else if (item.kind === "file-contents") {
+                io.out(`  ● ${item.key}${item.from ? ` (the contents of ${item.from})` : ""}\n`);
+            }
+            else {
+                io.out(`  ● ${item.key}\n`);
+            }
+        }
+        if (plan.replacing.length > 0) {
+            io.out(`\n  ${plan.replacing.join(", ")} already in the vault — they will be replaced.\n`);
+        }
+        const skipped = plan.planned.filter((p) => p.kind === "unresolved-path");
+        if (skipped.length > 0) {
+            io.out("\n  A skipped file is the credential this project most needs. Check the path.\n");
+        }
+        if (!yes) {
+            io.out("\nNothing is written yet. Run it again with --yes to store these.\n");
+            return 0;
+        }
+        const stored = await applyImport(vault, project, plan);
+        io.out(`\n✓ Stored ${stored} ${stored === 1 ? "secret" : "secrets"}, all kept out of the logs.\n`);
+        // Said here because it is easy to assume an import leaves lanes with
+        // homework. It does not: `key_filepath:` and `json_key:` are the supported
+        // forms, not a stopgap. A signing credential block writes its file to disk
+        // for the length of a run, so a lane that names a path keeps reading a
+        // real one, unedited.
+        io.out("\nNothing in your lanes needs to change. `key_filepath:` and `json_key:` keep working as " +
+            "written. From here, a `.p8` or a service account JSON belongs in a signing credential block " +
+            "from the secrets tab, not as a loose variable in this file.\n");
+        return 0;
+    }
+    finally {
+        db.close();
+    }
+}
+/**
+ * The repository root, or the directory given if this is not a repository.
+ *
+ * `fastlane_dir` is recorded relative to the root — that is what the clone is
+ * measured from — so anything resolving it has to agree about where the root is,
+ * whichever sub-directory the command happens to be run from.
+ */
+async function repositoryRoot(from) {
+    try {
+        const { stdout } = await promisify(execFile)("git", ["rev-parse", "--show-toplevel"], {
+            cwd: from,
+            timeout: 5_000,
+        });
+        return stdout.trim() || from;
+    }
+    catch {
+        return from;
+    }
+}

package/dist/src/cli/setup.js

@@ -33,13 +33,25 @@ export async function addProjectToConfig(path, entry) {
     const seq = projects instanceof YAMLSeq ? projects : new YAMLSeq();
     if (!(projects instanceof YAMLSeq))
         doc.setIn(["projects"], seq);
-    for (const item of seq.items) {
-        const slug = item.get?.("slug");
-        if (slug === entry.slug) {
-            throw new Error(`A project already uses the slug "${entry.slug}" in ${path}`);
-        }
+    // An entry of the same name is updated, not refused.
+    //
+    // Setup prints "Continuing replaces its entry" before asking anything, and
+    // then this threw — so the one way to correct a stale entry, running setup
+    // again, was the one thing that could not be done. A project written by an
+    // older version and missing a field it now needs was unfixable except by hand.
+    //
+    // Field by field rather than wholesale, though the warning says "replaces":
+    // an entry may carry things setup knows nothing about — a `git_auth` pointing
+    // at an SSH key, a raised `timeout_minutes` — and losing those silently, on a
+    // command someone ran to fix something else, would be its own bug.
+    const existing = seq.items.find((item) => item.get?.("slug") === entry.slug);
+    if (existing?.set) {
+        for (const [key, value] of Object.entries(entry))
+            existing.set(key, value);
+    }
+    else {
+        seq.add(doc.createNode(entry));
     }
-    seq.add(doc.createNode(entry));
     await writeFile(path, serialize(doc), "utf8");
 }
 /**
@@ -105,7 +117,8 @@ export async function runSetupCommand(cwd, configPath, options = {}) {
         if (existing) {
             process.stdout.write("\n" +
                 warn(`This machine already knows a project called ${bold(existing)}.\n`) +
-                dim("  Continuing replaces its entry. Give it another name to keep both.\n"));
+                dim("  Continuing updates its entry, keeping anything you added by hand.\n") +
+                dim("  Give it another name to keep both.\n"));
         }
         const repoConfigPath = join(repoRoot(cwd, d.subPath), LANEYARD_YML);
         if (await fileExists(repoConfigPath)) {
@@ -163,6 +176,30 @@ export async function runSetupCommand(cwd, configPath, options = {}) {
             name: slug,
             git_url: gitUrl,
             default_branch: branch,
+            // Written on this machine too, and only when it is not the default,
+            // because of the gap between the two files. Laneyard builds from a clone
+            // of the remote, so nothing written into the working copy reaches it
+            // until `laneyard.yml` is committed and pushed — and until then
+            // `fastlane_dir` falls back to `fastlane`, which in a monorepo is not
+            // where anything is. The project was unreadable from the moment setup
+            // finished until a git push, with an ENOENT for an explanation.
+            //
+            // This is not a second source of truth: the repository file wins the
+            // moment it lands, which is the precedence `config.yml` already
+            // documents and the schema already allows. It is the value setup just
+            // proposed and the user just accepted, kept where it is useful until the
+            // authoritative copy arrives.
+            //
+            // Omitted when it *is* the default, so an ordinary project's block stays
+            // about how the project is reached and nothing else.
+            // Both of the fields the sidecar needs before it can read anything, and
+            // only when they are not already the default. `runtime` belongs here for
+            // exactly the same reason as `fastlane_dir`: without it the sidecar is
+            // launched under `bundle exec` and a project that uses a system fastlane
+            // fails with "Could not locate Gemfile" — the same bootstrap gap, one
+            // field along.
+            ...(fastlaneDir === "fastlane" ? {} : { fastlane_dir: fastlaneDir }),
+            ...(runtime === "bundle" ? {} : { runtime }),
         });
         // The repository half: how it builds. This is the part that was going into
         // the machine's file and therefore never being committed — which is exactly

package/dist/src/cli/uninstall.js

@@ -0,0 +1,390 @@
+import Database from "better-sqlite3";
+import { readdir, readFile, rm, stat } from "node:fs/promises";
+import { join } from "node:path";
+import { createInterface } from "node:readline";
+import { parse } from "yaml";
+import { bad, bold, dim, field, heading, ok, warn } from "./style.js";
+export const UNINSTALL_USAGE = `laneyard uninstall [--dry-run]
+
+Removes Laneyard's data folder: the configuration, the vault key, the database,
+the workspaces, the artifacts and the logs. It does not remove the npm package —
+a command cannot sensibly delete the binary it is running from — and it prints
+the command that does.
+
+  laneyard uninstall --dry-run   list what is there and stop
+
+There is no npm lifecycle hook doing any of this on \`npm uninstall\`, on
+purpose: a package manager must not delete someone's signing keys on its own,
+and a lifecycle script cannot ask.
+`;
+/** What Laneyard writes into its home, and nothing else. */
+const OWN_FILES = ["config.yml", "key", "laneyard.db", "laneyard.db-wal", "laneyard.db-shm"];
+const OWN_FOLDERS = ["workspaces", "artifacts", "logs", "runs"];
+export async function readInventory(home) {
+    const empty = {
+        home,
+        exists: false,
+        config: null,
+        key: null,
+        db: null,
+        folders: [],
+        strangers: [],
+        bytes: 0,
+    };
+    const here = await stat(home).catch(() => null);
+    if (here === null || !here.isDirectory())
+        return empty;
+    const present = new Set((await readdir(home).catch(() => [])));
+    const configPath = join(home, "config.yml");
+    const configBytes = await sizeOf(configPath);
+    const config = configBytes === null
+        ? null
+        : { path: configPath, bytes: configBytes, projects: await projectsIn(configPath) };
+    const keyPath = join(home, "key");
+    const keyBytes = await sizeOf(keyPath);
+    const key = keyBytes === null ? null : { path: keyPath, bytes: keyBytes };
+    const dbPath = join(home, "laneyard.db");
+    const dbBytes = await sizeOf(dbPath);
+    const db = dbBytes === null
+        ? null
+        : {
+            path: dbPath,
+            // The write-ahead log is part of the database, not a stray file: a row
+            // written a second ago may live only there. Counted with it so the
+            // size on screen is the size on disk.
+            bytes: dbBytes + ((await sizeOf(`${dbPath}-wal`)) ?? 0) + ((await sizeOf(`${dbPath}-shm`)) ?? 0),
+            ...(await readVault(dbPath)),
+        };
+    const folders = [];
+    for (const name of OWN_FOLDERS) {
+        const path = join(home, name);
+        const tally = await tallyFolder(path);
+        if (tally !== null)
+            folders.push({ name, path, ...tally });
+    }
+    const strangers = [...present]
+        .filter((name) => !OWN_FILES.includes(name) && !OWN_FOLDERS.includes(name))
+        .sort();
+    return {
+        home,
+        exists: true,
+        config,
+        key,
+        db,
+        folders,
+        strangers,
+        bytes: (config?.bytes ?? 0) +
+            (key?.bytes ?? 0) +
+            (db?.bytes ?? 0) +
+            folders.reduce((sum, f) => sum + f.bytes, 0),
+    };
+}
+/**
+ * Counts what the vault holds, without writing a byte.
+ *
+ * Opened read-only rather than through `openDatabase`: that one applies the
+ * schema and switches on the write-ahead log, both of which are writes, and
+ * `--dry-run` promises not to make one.
+ *
+ * Read-only is not quite enough on its own. SQLite needs a `-shm` beside a WAL
+ * database, and it creates one to open it even for reading — so the two are
+ * noted before and removed again after if they were not there. They are scratch
+ * files with nothing of anyone's in them, and removing what we made is what
+ * lets the promise be a real one. A server that is running has them open
+ * already, so they exist beforehand and are never touched.
+ *
+ * The counts are read rather than skipped over: the number of stored
+ * credentials is exactly the wrong thing to guess at. When the database cannot
+ * be opened at all, that is reported instead, in its own words.
+ */
+async function readVault(dbPath) {
+    const sidecars = [`${dbPath}-wal`, `${dbPath}-shm`];
+    const ours = await Promise.all(sidecars.map(async (path) => ((await stat(path).catch(() => null)) === null ? path : null)));
+    let db = null;
+    try {
+        db = new Database(dbPath, { readonly: true, fileMustExist: true });
+        const count = (sql) => db.prepare(sql).get().n;
+        return {
+            vault: {
+                // The empty slug is how a global row is stored — the same convention
+                // `SecretStore` and `CredentialStore` use, and the reason the two are
+                // counted apart: a global secret belongs to every project.
+                projectSecrets: count("SELECT COUNT(*) AS n FROM secret WHERE project_slug != ''"),
+                globalSecrets: count("SELECT COUNT(*) AS n FROM secret WHERE project_slug = ''"),
+                projectBlocks: count("SELECT COUNT(*) AS n FROM credential WHERE project_slug != ''"),
+                globalBlocks: count("SELECT COUNT(*) AS n FROM credential WHERE project_slug = ''"),
+                runs: count("SELECT COUNT(*) AS n FROM run"),
+            },
+            unreadable: null,
+        };
+    }
+    catch (cause) {
+        return { vault: null, unreadable: cause.message };
+    }
+    finally {
+        db?.close();
+        for (const path of ours) {
+            if (path !== null)
+                await rm(path, { force: true }).catch(() => undefined);
+        }
+    }
+}
+/** The slugs config.yml declares, or none if it cannot be read. */
+async function projectsIn(path) {
+    try {
+        const doc = parse(await readFile(path, "utf8"));
+        return (doc?.projects ?? []).map((p) => p?.slug ?? "?").filter((s) => s !== "");
+    }
+    catch {
+        return [];
+    }
+}
+async function sizeOf(path) {
+    const info = await stat(path).catch(() => null);
+    return info === null || !info.isFile() ? null : info.size;
+}
+/**
+ * A folder's direct children, and the total size of everything under it.
+ *
+ * Only regular files count. A symlink is followed by nothing here — a clone is
+ * perfectly capable of holding a link to somewhere enormous that this command
+ * is not going to remove, and counting the target would report a size that is
+ * not the size of what goes.
+ */
+async function tallyFolder(path) {
+    const info = await stat(path).catch(() => null);
+    if (info === null || !info.isDirectory())
+        return null;
+    const children = await readdir(path).catch(() => []);
+    return { entries: children.length, bytes: await sizeUnder(path) };
+}
+/**
+ * Every regular file under a folder, added up.
+ *
+ * `readdir` with file types answers from the directory entry itself, so a
+ * symlink is neither a file nor a directory here and is skipped — which is the
+ * behaviour wanted: `rm` will remove the link, not what it points at, and the
+ * size on screen has to be the size of what actually goes.
+ */
+async function sizeUnder(path) {
+    const entries = await readdir(path, { withFileTypes: true }).catch(() => []);
+    let bytes = 0;
+    for (const entry of entries) {
+        if (entry.isDirectory())
+            bytes += await sizeUnder(join(path, entry.name));
+        else if (entry.isFile()) {
+            const info = await stat(join(path, entry.name)).catch(() => null);
+            bytes += info?.size ?? 0;
+        }
+    }
+    return bytes;
+}
+/** Sizes in the units a person reads, not in bytes. */
+export function humanSize(bytes) {
+    if (bytes < 1024)
+        return `${bytes} B`;
+    const units = ["KB", "MB", "GB", "TB"];
+    let value = bytes / 1024;
+    let unit = 0;
+    while (value >= 1024 && unit < units.length - 1) {
+        value /= 1024;
+        unit += 1;
+    }
+    return `${value < 10 ? value.toFixed(1) : Math.round(value)} ${units[unit]}`;
+}
+const plural = (n, noun) => `${n} ${n === 1 ? noun : `${noun}s`}`;
+/** English, not a rule: "entry" does not take an `s`. */
+const entries = (n) => `${n} ${n === 1 ? "entry" : "entries"}`;
+/** The inventory, as it appears on screen. Shared by the dry run and the real one. */
+export function renderInventory(inv) {
+    let out = heading("laneyard uninstall");
+    out += field("home", inv.home) + "\n";
+    out += field("total", humanSize(inv.bytes)) + "\n";
+    out += heading("configuration");
+    if (inv.config === null) {
+        out += field("config.yml", dim("not there")) + "\n";
+    }
+    else {
+        out += field("config.yml", `${inv.config.path}  ${dim(humanSize(inv.config.bytes))}`) + "\n";
+        out +=
+            field("projects", inv.config.projects.length === 0 ? dim("none declared") : inv.config.projects.join(", ")) + "\n";
+    }
+    out += heading("the vault");
+    out += field("key", inv.key === null ? dim("not there") : inv.key.path) + "\n";
+    if (inv.db === null) {
+        out += field("database", dim("not there")) + "\n";
+    }
+    else {
+        out += field("database", `${inv.db.path}  ${dim(humanSize(inv.db.bytes))}`) + "\n";
+        if (inv.db.vault === null) {
+            out +=
+                field("contents", dim("could not be read")) + "\n" +
+                    dim(`               ${inv.db.unreadable ?? "unknown reason"}\n`) +
+                    dim("               Stop the server and run this again to see what is in it.\n");
+        }
+        else {
+            const v = inv.db.vault;
+            out += field("secrets", `${plural(v.projectSecrets, "project secret")}`) + "\n";
+            // Said on its own line and in words rather than folded into the number
+            // above: a global secret is read by every project on this machine, and
+            // "in scope" is the fact someone needs before they answer the question.
+            out +=
+                field("", v.globalSecrets === 0
+                    ? dim("no global secret")
+                    : `${plural(v.globalSecrets, "global secret")} — shared by every project, ${bold("removed too")}`) + "\n";
+            out += field("signing", `${plural(v.projectBlocks, "project signing block")}`) + "\n";
+            out +=
+                field("", v.globalBlocks === 0
+                    ? dim("no global signing block")
+                    : `${plural(v.globalBlocks, "global signing block")} — shared by every project, ${bold("removed too")}`) + "\n";
+            out += field("history", plural(v.runs, "run")) + "\n";
+        }
+    }
+    out += heading("on disk");
+    if (inv.folders.length === 0) {
+        out += dim("  nothing: no workspace was ever cloned and no run ever produced anything.\n");
+    }
+    for (const folder of inv.folders) {
+        out +=
+            field(folder.name, folder.entries === 0
+                ? dim("empty")
+                : `${entries(folder.entries)}  ${dim(humanSize(folder.bytes))}`) + "\n";
+        out += dim(`               ${folder.path}\n`);
+    }
+    if (inv.strangers.length > 0) {
+        out += heading("not Laneyard's");
+        out += dim("  These are in the folder and were not put there by Laneyard. They are left\n");
+        out += dim("  where they are, and the folder is left with them.\n\n");
+        for (const name of inv.strangers)
+            out += `  ${join(inv.home, name)}\n`;
+    }
+    return out;
+}
+/**
+ * The one paragraph this command exists to make sure someone reads.
+ *
+ * Everything else here is recoverable: a config.yml can be written again by
+ * `laneyard setup`, a workspace re-cloned, an artifact rebuilt. The key cannot.
+ * It is a random 32 bytes that exists in one place, and every stored value is
+ * ciphertext without it — so a backup of `laneyard.db` alone restores nothing.
+ */
+export function renderIrreversible(inv) {
+    const v = inv.db?.vault;
+    const stored = v === undefined || v === null ? null : v.projectSecrets + v.globalSecrets + v.projectBlocks + v.globalBlocks;
+    return (heading("what cannot be undone") +
+        warn(`The vault key is the one thing here that has no other copy.\n`) +
+        dim("  Every secret and every signing block is encrypted under " + (inv.key?.path ?? join(inv.home, "key")) + ".\n") +
+        dim("  Once it is gone, laneyard.db is ciphertext nobody can read — restoring a backup\n") +
+        dim("  of the database alone will not bring anything back.\n") +
+        (stored === null || stored === 0
+            ? ""
+            : dim(`  ${plural(stored, "stored value")} ${stored === 1 ? "goes" : "go"} with it.\n`)) +
+        "\n" +
+        dim("  The originals are yours and are untouched: the .p8 in your downloads, the\n") +
+        dim("  keystore in your safe, the passwords in your password manager. It is Laneyard's\n") +
+        dim("  copy that is unrecoverable — you will upload them again from wherever you keep\n") +
+        dim("  them. If you do not know where that is, stop here and go and find out.\n") +
+        "\n" +
+        dim("  Your repositories are untouched. Nothing outside " + inv.home + " is read or written.\n"));
+}
+/** Reads one line, which works the same whether it is typed or piped in. */
+async function readLine(stdin) {
+    const rl = createInterface({ input: stdin });
+    try {
+        for await (const line of rl)
+            return line.trim();
+        return "";
+    }
+    finally {
+        rl.close();
+    }
+}
+/**
+ * Entry point for `laneyard uninstall`.
+ *
+ * Inventory, then the one irreversible thing, then a typed confirmation, then
+ * the removal. In that order and never any other: a question asked before the
+ * numbers are on screen is a question nobody can answer.
+ */
+export async function runUninstallCommand(home, args, io) {
+    let dryRun = false;
+    for (const arg of args) {
+        if (arg === "--dry-run" || arg === "-n")
+            dryRun = true;
+        else {
+            // Deliberately no `--keep-runs`, no `--yes`, no `--force`. Every one of
+            // them is a way to run this without reading it, which is the only thing
+            // standing between someone and an unrecoverable signing key. Keeping the
+            // run history without its database is not a thing that exists anyway.
+            io.err(`Unknown option: ${arg}\n\n${UNINSTALL_USAGE}`);
+            return 1;
+        }
+    }
+    const inv = await readInventory(home);
+    if (!inv.exists) {
+        io.out(`${dim(`No data folder at ${home}. There is nothing for Laneyard to remove.`)}\n\n` +
+            removalHint());
+        return 0;
+    }
+    io.out(renderInventory(inv));
+    io.out(renderIrreversible(inv));
+    if (dryRun) {
+        io.out("\n" +
+            dim("Nothing was removed. Run `laneyard uninstall` without --dry-run to remove it.") +
+            "\n\n" +
+            removalHint());
+        return 0;
+    }
+    // Typed in full, not `y`. A `y/n` is answered by a reflex; this is the one
+    // command in the product that destroys credentials, and the path is what
+    // proves the person read which folder is about to go — it is not always
+    // ~/.laneyard, and $LANEYARD_HOME is exactly the case where a reflex is wrong.
+    io.out("\n" +
+        bold("Type the path of the folder to remove, exactly, to confirm:") + "\n" +
+        `  ${inv.home}\n` +
+        "\n> ");
+    const answer = await readLine(io.stdin);
+    if (answer !== inv.home) {
+        io.err("\n" +
+            bad(answer === ""
+                ? "Nothing was typed, so nothing was removed."
+                : "That is not the path, so nothing was removed.") +
+            "\n");
+        return 1;
+    }
+    const removed = [];
+    for (const name of [...OWN_FILES, ...OWN_FOLDERS]) {
+        const path = join(home, name);
+        if ((await stat(path).catch(() => null)) === null)
+            continue;
+        await rm(path, { recursive: true, force: true });
+        removed.push(name);
+    }
+    // The folder itself only when there is nothing left in it. Anything Laneyard
+    // did not write is somebody's, and this command has no business deciding
+    // otherwise — `$LANEYARD_HOME` can point anywhere.
+    const left = (await readdir(home).catch(() => []));
+    if (left.length === 0)
+        await rm(home, { recursive: true, force: true }).catch(() => undefined);
+    io.out(heading("removed") +
+        ok(`${entries(removed.length)}, ${humanSize(inv.bytes)} freed.\n`) +
+        (left.length === 0
+            ? dim(`  ${home} is gone.\n`)
+            : dim(`  ${home} is kept: ${plural(left.length, "file")} in it ${left.length === 1 ? "is" : "are"} not Laneyard's.\n`)) +
+        "\n" +
+        removalHint());
+    return 0;
+}
+/**
+ * The package is still installed, and this cannot be the thing that removes it.
+ *
+ * A process cannot sensibly delete the binary it is running from, and a command
+ * that tried would leave someone with a half-removed install and no way to ask
+ * about it. So it says what to type instead — the whole command, so it can be
+ * copied rather than remembered.
+ */
+function removalHint() {
+    return (dim("The npm package is still installed. Laneyard does not remove its own binary:\n") +
+        `  ${bold("npm uninstall -g laneyard")}\n` +
+        dim("(installed from source with `npm link`? `npm unlink -g laneyard`.)\n"));
+}