laneyard 0.4.0 → 0.4.1

package/README.md

@@ -155,9 +155,9 @@ shell history. Without `--role`, the account is a builder.
 Two things are refused, in the API and on the command line alike: removing the last admin, and
 demoting the last admin. A server nobody can administer cannot be repaired from the interface.
 
-Anyone changes their own password from **your account**, reached by clicking your name in the
-header — a builder included, since that page is about one person rather than about the server's
-list of people. It asks for the current password even though you are already signed in: a session
+Anyone changes their own password from **your account**, which is said in those words in the header
+and again on your own row of the accounts screen — a builder included, since that page is about one
+person rather than about the server's list of people. It asks for the current password even though you are already signed in: a session
 is a cookie in a browser that may have been left open on a desk. Doing it ends every other session
 that account has, and leaves the page you did it on signed in. That is how the random password
 `laneyard setup` printed once stops being a string on a sticky note.
@@ -451,14 +451,52 @@ What it does *not* do is most of the point, because "delete" elsewhere usually m
   each still at its own address. Removing a project means stop showing it, not destroy its past;
 - **the clone and the artifacts stay on disk.** Their paths are printed when it is done, so you
   can remove them yourself. Nothing is deleted from a web page on one click;
-- **the secrets stay in the vault**, encrypted and unreachable, and come back if you add the
-  project again under the same name;
+- **the secrets and the signing blocks stay in the vault**, encrypted. The screen counts them
+  before you confirm and again once it is done, because they are the one thing on this list you
+  cannot go and look at — no route ever sends a credential back. Their scope is the slug, so a
+  project set up later under the same name finds them and would sign with a keystore nobody
+  uploaded;
 - **the repository is untouched.** Its `laneyard.yml`, its Fastfile and its history are the
   repository's, not Laneyard's.
 
 Removal is refused while a run of that project is in flight — that run is using the workspace. A
 run still waiting in the queue will not start: it ends as failed, saying its project is gone.
 
+Once it is done, the result screen offers the one thing removal deliberately did not do: removing
+what the vault still holds under that name. It is a second action, confirmed by typing the name
+again, and it is never part of removing the project — a `.p8` or a keystore cannot be read back
+out of Laneyard, so the copy it holds is the only one it ever had. Global secrets and global
+signing blocks are shared by every project and are left alone.
+
+### Uninstalling
+
+```bash
+laneyard uninstall --dry-run   # list what is there, and stop
+laneyard uninstall             # remove it, after a typed confirmation
+npm uninstall -g laneyard      # remove the package itself
+```
+
+`laneyard uninstall` removes the data folder: `config.yml`, the vault key, the database, the
+workspaces, the artifacts and the logs. It reads the whole inventory from disk first — the
+projects, the number of secrets and signing blocks, the real sizes and paths — and prints it
+before asking anything.
+
+The vault key is the one loss that cannot be undone. Every secret and every signing block is
+encrypted under `~/.laneyard/key`; once it is gone the database is ciphertext nobody can read, and
+restoring a backup of `laneyard.db` alone brings nothing back. The originals are yours and are
+untouched — the `.p8` in your downloads, the keystore in your safe — so what you are agreeing to
+is uploading them again. Global secrets and global signing blocks are shared by every project and
+go too; the inventory says so on its own line.
+
+It is confirmed by typing the folder's path, not `y`: this is the one command in Laneyard that
+destroys credentials, and `$LANEYARD_HOME` is exactly the case where a reflex is wrong. Anything
+in the folder that Laneyard did not put there is named, left alone, and the folder is kept for it.
+
+It does not remove the npm package — a command cannot sensibly delete the binary it is running
+from — and it prints the command that does. There is no npm lifecycle hook doing any of this on
+`npm uninstall`, on purpose: a package manager must not delete someone's signing keys on its own,
+and a lifecycle script cannot ask.
+
 ## Security
 
 Read this before putting Laneyard on a network.
@@ -523,6 +561,7 @@ What this does *not* cover, stated plainly:
 - `✓` signing credentials stored whole — the file and the fields beside it — written to disk for
   the length of a run and exported under the names your project already reads
 - `✓` remove a project from the interface, without touching its history
+- `✓` `laneyard uninstall`: the whole inventory first, then a typed confirmation, then the folder
 - `✓` named accounts, with a builder role that never sees a credential
 - `○` git-triggered and scheduled builds
 

package/dist/src/cli/uninstall.js

@@ -0,0 +1,390 @@
+import Database from "better-sqlite3";
+import { readdir, readFile, rm, stat } from "node:fs/promises";
+import { join } from "node:path";
+import { createInterface } from "node:readline";
+import { parse } from "yaml";
+import { bad, bold, dim, field, heading, ok, warn } from "./style.js";
+export const UNINSTALL_USAGE = `laneyard uninstall [--dry-run]
+
+Removes Laneyard's data folder: the configuration, the vault key, the database,
+the workspaces, the artifacts and the logs. It does not remove the npm package —
+a command cannot sensibly delete the binary it is running from — and it prints
+the command that does.
+
+  laneyard uninstall --dry-run   list what is there and stop
+
+There is no npm lifecycle hook doing any of this on \`npm uninstall\`, on
+purpose: a package manager must not delete someone's signing keys on its own,
+and a lifecycle script cannot ask.
+`;
+/** What Laneyard writes into its home, and nothing else. */
+const OWN_FILES = ["config.yml", "key", "laneyard.db", "laneyard.db-wal", "laneyard.db-shm"];
+const OWN_FOLDERS = ["workspaces", "artifacts", "logs", "runs"];
+export async function readInventory(home) {
+    const empty = {
+        home,
+        exists: false,
+        config: null,
+        key: null,
+        db: null,
+        folders: [],
+        strangers: [],
+        bytes: 0,
+    };
+    const here = await stat(home).catch(() => null);
+    if (here === null || !here.isDirectory())
+        return empty;
+    const present = new Set((await readdir(home).catch(() => [])));
+    const configPath = join(home, "config.yml");
+    const configBytes = await sizeOf(configPath);
+    const config = configBytes === null
+        ? null
+        : { path: configPath, bytes: configBytes, projects: await projectsIn(configPath) };
+    const keyPath = join(home, "key");
+    const keyBytes = await sizeOf(keyPath);
+    const key = keyBytes === null ? null : { path: keyPath, bytes: keyBytes };
+    const dbPath = join(home, "laneyard.db");
+    const dbBytes = await sizeOf(dbPath);
+    const db = dbBytes === null
+        ? null
+        : {
+            path: dbPath,
+            // The write-ahead log is part of the database, not a stray file: a row
+            // written a second ago may live only there. Counted with it so the
+            // size on screen is the size on disk.
+            bytes: dbBytes + ((await sizeOf(`${dbPath}-wal`)) ?? 0) + ((await sizeOf(`${dbPath}-shm`)) ?? 0),
+            ...(await readVault(dbPath)),
+        };
+    const folders = [];
+    for (const name of OWN_FOLDERS) {
+        const path = join(home, name);
+        const tally = await tallyFolder(path);
+        if (tally !== null)
+            folders.push({ name, path, ...tally });
+    }
+    const strangers = [...present]
+        .filter((name) => !OWN_FILES.includes(name) && !OWN_FOLDERS.includes(name))
+        .sort();
+    return {
+        home,
+        exists: true,
+        config,
+        key,
+        db,
+        folders,
+        strangers,
+        bytes: (config?.bytes ?? 0) +
+            (key?.bytes ?? 0) +
+            (db?.bytes ?? 0) +
+            folders.reduce((sum, f) => sum + f.bytes, 0),
+    };
+}
+/**
+ * Counts what the vault holds, without writing a byte.
+ *
+ * Opened read-only rather than through `openDatabase`: that one applies the
+ * schema and switches on the write-ahead log, both of which are writes, and
+ * `--dry-run` promises not to make one.
+ *
+ * Read-only is not quite enough on its own. SQLite needs a `-shm` beside a WAL
+ * database, and it creates one to open it even for reading — so the two are
+ * noted before and removed again after if they were not there. They are scratch
+ * files with nothing of anyone's in them, and removing what we made is what
+ * lets the promise be a real one. A server that is running has them open
+ * already, so they exist beforehand and are never touched.
+ *
+ * The counts are read rather than skipped over: the number of stored
+ * credentials is exactly the wrong thing to guess at. When the database cannot
+ * be opened at all, that is reported instead, in its own words.
+ */
+async function readVault(dbPath) {
+    const sidecars = [`${dbPath}-wal`, `${dbPath}-shm`];
+    const ours = await Promise.all(sidecars.map(async (path) => ((await stat(path).catch(() => null)) === null ? path : null)));
+    let db = null;
+    try {
+        db = new Database(dbPath, { readonly: true, fileMustExist: true });
+        const count = (sql) => db.prepare(sql).get().n;
+        return {
+            vault: {
+                // The empty slug is how a global row is stored — the same convention
+                // `SecretStore` and `CredentialStore` use, and the reason the two are
+                // counted apart: a global secret belongs to every project.
+                projectSecrets: count("SELECT COUNT(*) AS n FROM secret WHERE project_slug != ''"),
+                globalSecrets: count("SELECT COUNT(*) AS n FROM secret WHERE project_slug = ''"),
+                projectBlocks: count("SELECT COUNT(*) AS n FROM credential WHERE project_slug != ''"),
+                globalBlocks: count("SELECT COUNT(*) AS n FROM credential WHERE project_slug = ''"),
+                runs: count("SELECT COUNT(*) AS n FROM run"),
+            },
+            unreadable: null,
+        };
+    }
+    catch (cause) {
+        return { vault: null, unreadable: cause.message };
+    }
+    finally {
+        db?.close();
+        for (const path of ours) {
+            if (path !== null)
+                await rm(path, { force: true }).catch(() => undefined);
+        }
+    }
+}
+/** The slugs config.yml declares, or none if it cannot be read. */
+async function projectsIn(path) {
+    try {
+        const doc = parse(await readFile(path, "utf8"));
+        return (doc?.projects ?? []).map((p) => p?.slug ?? "?").filter((s) => s !== "");
+    }
+    catch {
+        return [];
+    }
+}
+async function sizeOf(path) {
+    const info = await stat(path).catch(() => null);
+    return info === null || !info.isFile() ? null : info.size;
+}
+/**
+ * A folder's direct children, and the total size of everything under it.
+ *
+ * Only regular files count. A symlink is followed by nothing here — a clone is
+ * perfectly capable of holding a link to somewhere enormous that this command
+ * is not going to remove, and counting the target would report a size that is
+ * not the size of what goes.
+ */
+async function tallyFolder(path) {
+    const info = await stat(path).catch(() => null);
+    if (info === null || !info.isDirectory())
+        return null;
+    const children = await readdir(path).catch(() => []);
+    return { entries: children.length, bytes: await sizeUnder(path) };
+}
+/**
+ * Every regular file under a folder, added up.
+ *
+ * `readdir` with file types answers from the directory entry itself, so a
+ * symlink is neither a file nor a directory here and is skipped — which is the
+ * behaviour wanted: `rm` will remove the link, not what it points at, and the
+ * size on screen has to be the size of what actually goes.
+ */
+async function sizeUnder(path) {
+    const entries = await readdir(path, { withFileTypes: true }).catch(() => []);
+    let bytes = 0;
+    for (const entry of entries) {
+        if (entry.isDirectory())
+            bytes += await sizeUnder(join(path, entry.name));
+        else if (entry.isFile()) {
+            const info = await stat(join(path, entry.name)).catch(() => null);
+            bytes += info?.size ?? 0;
+        }
+    }
+    return bytes;
+}
+/** Sizes in the units a person reads, not in bytes. */
+export function humanSize(bytes) {
+    if (bytes < 1024)
+        return `${bytes} B`;
+    const units = ["KB", "MB", "GB", "TB"];
+    let value = bytes / 1024;
+    let unit = 0;
+    while (value >= 1024 && unit < units.length - 1) {
+        value /= 1024;
+        unit += 1;
+    }
+    return `${value < 10 ? value.toFixed(1) : Math.round(value)} ${units[unit]}`;
+}
+const plural = (n, noun) => `${n} ${n === 1 ? noun : `${noun}s`}`;
+/** English, not a rule: "entry" does not take an `s`. */
+const entries = (n) => `${n} ${n === 1 ? "entry" : "entries"}`;
+/** The inventory, as it appears on screen. Shared by the dry run and the real one. */
+export function renderInventory(inv) {
+    let out = heading("laneyard uninstall");
+    out += field("home", inv.home) + "\n";
+    out += field("total", humanSize(inv.bytes)) + "\n";
+    out += heading("configuration");
+    if (inv.config === null) {
+        out += field("config.yml", dim("not there")) + "\n";
+    }
+    else {
+        out += field("config.yml", `${inv.config.path}  ${dim(humanSize(inv.config.bytes))}`) + "\n";
+        out +=
+            field("projects", inv.config.projects.length === 0 ? dim("none declared") : inv.config.projects.join(", ")) + "\n";
+    }
+    out += heading("the vault");
+    out += field("key", inv.key === null ? dim("not there") : inv.key.path) + "\n";
+    if (inv.db === null) {
+        out += field("database", dim("not there")) + "\n";
+    }
+    else {
+        out += field("database", `${inv.db.path}  ${dim(humanSize(inv.db.bytes))}`) + "\n";
+        if (inv.db.vault === null) {
+            out +=
+                field("contents", dim("could not be read")) + "\n" +
+                    dim(`               ${inv.db.unreadable ?? "unknown reason"}\n`) +
+                    dim("               Stop the server and run this again to see what is in it.\n");
+        }
+        else {
+            const v = inv.db.vault;
+            out += field("secrets", `${plural(v.projectSecrets, "project secret")}`) + "\n";
+            // Said on its own line and in words rather than folded into the number
+            // above: a global secret is read by every project on this machine, and
+            // "in scope" is the fact someone needs before they answer the question.
+            out +=
+                field("", v.globalSecrets === 0
+                    ? dim("no global secret")
+                    : `${plural(v.globalSecrets, "global secret")} — shared by every project, ${bold("removed too")}`) + "\n";
+            out += field("signing", `${plural(v.projectBlocks, "project signing block")}`) + "\n";
+            out +=
+                field("", v.globalBlocks === 0
+                    ? dim("no global signing block")
+                    : `${plural(v.globalBlocks, "global signing block")} — shared by every project, ${bold("removed too")}`) + "\n";
+            out += field("history", plural(v.runs, "run")) + "\n";
+        }
+    }
+    out += heading("on disk");
+    if (inv.folders.length === 0) {
+        out += dim("  nothing: no workspace was ever cloned and no run ever produced anything.\n");
+    }
+    for (const folder of inv.folders) {
+        out +=
+            field(folder.name, folder.entries === 0
+                ? dim("empty")
+                : `${entries(folder.entries)}  ${dim(humanSize(folder.bytes))}`) + "\n";
+        out += dim(`               ${folder.path}\n`);
+    }
+    if (inv.strangers.length > 0) {
+        out += heading("not Laneyard's");
+        out += dim("  These are in the folder and were not put there by Laneyard. They are left\n");
+        out += dim("  where they are, and the folder is left with them.\n\n");
+        for (const name of inv.strangers)
+            out += `  ${join(inv.home, name)}\n`;
+    }
+    return out;
+}
+/**
+ * The one paragraph this command exists to make sure someone reads.
+ *
+ * Everything else here is recoverable: a config.yml can be written again by
+ * `laneyard setup`, a workspace re-cloned, an artifact rebuilt. The key cannot.
+ * It is a random 32 bytes that exists in one place, and every stored value is
+ * ciphertext without it — so a backup of `laneyard.db` alone restores nothing.
+ */
+export function renderIrreversible(inv) {
+    const v = inv.db?.vault;
+    const stored = v === undefined || v === null ? null : v.projectSecrets + v.globalSecrets + v.projectBlocks + v.globalBlocks;
+    return (heading("what cannot be undone") +
+        warn(`The vault key is the one thing here that has no other copy.\n`) +
+        dim("  Every secret and every signing block is encrypted under " + (inv.key?.path ?? join(inv.home, "key")) + ".\n") +
+        dim("  Once it is gone, laneyard.db is ciphertext nobody can read — restoring a backup\n") +
+        dim("  of the database alone will not bring anything back.\n") +
+        (stored === null || stored === 0
+            ? ""
+            : dim(`  ${plural(stored, "stored value")} ${stored === 1 ? "goes" : "go"} with it.\n`)) +
+        "\n" +
+        dim("  The originals are yours and are untouched: the .p8 in your downloads, the\n") +
+        dim("  keystore in your safe, the passwords in your password manager. It is Laneyard's\n") +
+        dim("  copy that is unrecoverable — you will upload them again from wherever you keep\n") +
+        dim("  them. If you do not know where that is, stop here and go and find out.\n") +
+        "\n" +
+        dim("  Your repositories are untouched. Nothing outside " + inv.home + " is read or written.\n"));
+}
+/** Reads one line, which works the same whether it is typed or piped in. */
+async function readLine(stdin) {
+    const rl = createInterface({ input: stdin });
+    try {
+        for await (const line of rl)
+            return line.trim();
+        return "";
+    }
+    finally {
+        rl.close();
+    }
+}
+/**
+ * Entry point for `laneyard uninstall`.
+ *
+ * Inventory, then the one irreversible thing, then a typed confirmation, then
+ * the removal. In that order and never any other: a question asked before the
+ * numbers are on screen is a question nobody can answer.
+ */
+export async function runUninstallCommand(home, args, io) {
+    let dryRun = false;
+    for (const arg of args) {
+        if (arg === "--dry-run" || arg === "-n")
+            dryRun = true;
+        else {
+            // Deliberately no `--keep-runs`, no `--yes`, no `--force`. Every one of
+            // them is a way to run this without reading it, which is the only thing
+            // standing between someone and an unrecoverable signing key. Keeping the
+            // run history without its database is not a thing that exists anyway.
+            io.err(`Unknown option: ${arg}\n\n${UNINSTALL_USAGE}`);
+            return 1;
+        }
+    }
+    const inv = await readInventory(home);
+    if (!inv.exists) {
+        io.out(`${dim(`No data folder at ${home}. There is nothing for Laneyard to remove.`)}\n\n` +
+            removalHint());
+        return 0;
+    }
+    io.out(renderInventory(inv));
+    io.out(renderIrreversible(inv));
+    if (dryRun) {
+        io.out("\n" +
+            dim("Nothing was removed. Run `laneyard uninstall` without --dry-run to remove it.") +
+            "\n\n" +
+            removalHint());
+        return 0;
+    }
+    // Typed in full, not `y`. A `y/n` is answered by a reflex; this is the one
+    // command in the product that destroys credentials, and the path is what
+    // proves the person read which folder is about to go — it is not always
+    // ~/.laneyard, and $LANEYARD_HOME is exactly the case where a reflex is wrong.
+    io.out("\n" +
+        bold("Type the path of the folder to remove, exactly, to confirm:") + "\n" +
+        `  ${inv.home}\n` +
+        "\n> ");
+    const answer = await readLine(io.stdin);
+    if (answer !== inv.home) {
+        io.err("\n" +
+            bad(answer === ""
+                ? "Nothing was typed, so nothing was removed."
+                : "That is not the path, so nothing was removed.") +
+            "\n");
+        return 1;
+    }
+    const removed = [];
+    for (const name of [...OWN_FILES, ...OWN_FOLDERS]) {
+        const path = join(home, name);
+        if ((await stat(path).catch(() => null)) === null)
+            continue;
+        await rm(path, { recursive: true, force: true });
+        removed.push(name);
+    }
+    // The folder itself only when there is nothing left in it. Anything Laneyard
+    // did not write is somebody's, and this command has no business deciding
+    // otherwise — `$LANEYARD_HOME` can point anywhere.
+    const left = (await readdir(home).catch(() => []));
+    if (left.length === 0)
+        await rm(home, { recursive: true, force: true }).catch(() => undefined);
+    io.out(heading("removed") +
+        ok(`${entries(removed.length)}, ${humanSize(inv.bytes)} freed.\n`) +
+        (left.length === 0
+            ? dim(`  ${home} is gone.\n`)
+            : dim(`  ${home} is kept: ${plural(left.length, "file")} in it ${left.length === 1 ? "is" : "are"} not Laneyard's.\n`)) +
+        "\n" +
+        removalHint());
+    return 0;
+}
+/**
+ * The package is still installed, and this cannot be the thing that removes it.
+ *
+ * A process cannot sensibly delete the binary it is running from, and a command
+ * that tried would leave someone with a half-removed install and no way to ask
+ * about it. So it says what to type instead — the whole command, so it can be
+ * copied rather than remembered.
+ */
+function removalHint() {
+    return (dim("The npm package is still installed. Laneyard does not remove its own binary:\n") +
+        `  ${bold("npm uninstall -g laneyard")}\n` +
+        dim("(installed from source with `npm link`? `npm unlink -g laneyard`.)\n"));
+}

package/dist/src/db/credentials.js

@@ -46,6 +46,31 @@ export class CredentialStore {
     list(projectSlug) {
         return this.applicable(projectSlug).map(({ fileEnc: _fileEnc, fieldsEnc: _fieldsEnc, ...summary }) => summary);
     }
+    /**
+     * The blocks stored under this slug, and no global one.
+     *
+     * Same distinction as `SecretStore.listOwn`, and it matters more here: a
+     * global keystore shadowed by nothing is shared by every project on the
+     * machine, and counting it as one project's would offer to delete the one
+     * credential every other project signs with.
+     */
+    listOwn(projectSlug) {
+        if (projectSlug === GLOBAL)
+            return [];
+        const rows = this.db
+            .prepare("SELECT * FROM credential WHERE project_slug = ? ORDER BY kind")
+            .all(projectSlug);
+        return rows.map((row) => {
+            const { fileEnc: _fileEnc, fieldsEnc: _fieldsEnc, ...summary } = this.toSummary(row);
+            return summary;
+        });
+    }
+    /** Removes every block stored under this slug, and returns how many. */
+    removeAllOwn(projectSlug) {
+        if (projectSlug === GLOBAL)
+            return 0;
+        return this.db.prepare("DELETE FROM credential WHERE project_slug = ?").run(projectSlug).changes;
+    }
     listGlobal() {
         const rows = this.db
             .prepare("SELECT * FROM credential WHERE project_slug = ? ORDER BY kind")

package/dist/src/db/secrets.js

@@ -62,6 +62,31 @@ export class SecretStore {
            WHERE project_slug = ? AND key = ?`)
             .run(masked ? 1 : 0, new Date().toISOString(), projectSlug ?? GLOBAL, key).changes > 0);
     }
+    /**
+     * The rows stored under this slug, and no global one.
+     *
+     * `list` answers "what does this project see", which is the right question
+     * everywhere else and the wrong one when a project is going away: a global
+     * secret three other projects also read is not this one's to count, and
+     * certainly not its to remove.
+     *
+     * The empty slug is the global scope's own key, so it is refused here rather
+     * than quietly returning every global row as if one project owned them.
+     */
+    listOwn(projectSlug) {
+        if (projectSlug === GLOBAL)
+            return [];
+        const rows = this.db
+            .prepare("SELECT * FROM secret WHERE project_slug = ? ORDER BY key")
+            .all(projectSlug);
+        return rows.map((row) => ({ key: row.key, masked: row.masked === 1, scope: "project" }));
+    }
+    /** Removes every row stored under this slug, and returns how many. */
+    removeAllOwn(projectSlug) {
+        if (projectSlug === GLOBAL)
+            return 0;
+        return this.db.prepare("DELETE FROM secret WHERE project_slug = ?").run(projectSlug).changes;
+    }
     list(projectSlug) {
         return this.applicable(projectSlug).map((row) => ({
             key: row.key,

package/dist/src/main.js

@@ -8,6 +8,7 @@ import { fileURLToPath } from "node:url";
 import { PromptAborted } from "./cli/prompt.js";
 import { runSetupCommand } from "./cli/setup.js";
 import { runSecretCommand } from "./cli/secret.js";
+import { runUninstallCommand } from "./cli/uninstall.js";
 import { runUserCommand } from "./cli/user.js";
 import { ConfigStore } from "./config/store.js";
 import { CacheStore } from "./db/cache.js";
@@ -20,7 +21,7 @@ import { Vault } from "./secrets/vault.js";
 import { makeInvoke } from "./sidecar/bridge.js";
 import { LaneReader } from "./sidecar/lanes.js";
 import { UsesReader } from "./sidecar/uses.js";
-export const version = "0.3.0";
+export const version = "0.4.1";
 /** Assembles the server from a data folder. */
 export async function createServerFromConfig(root) {
     const config = new ConfigStore(join(root, "config.yml"));
@@ -111,6 +112,8 @@ const USAGE = `laneyard — a self-hosted web UI for fastlane
                       store a secret, its value read from standard input
   laneyard user add NAME [--role admin|builder]
                       create an account, its password read from standard input
+  laneyard uninstall  remove Laneyard's data folder, after showing what is in it
+                      --dry-run shows the inventory and stops
   laneyard            start the server
   laneyard --version  print the version
 
@@ -186,6 +189,15 @@ if (invokedDirectly()) {
             err: (text) => process.stderr.write(text),
         }));
     }
+    // No `mkdir` here, unlike the commands above: this one asks what is there
+    // and would look ridiculous creating the folder it is about to report on.
+    if (command === "uninstall") {
+        process.exit(await runUninstallCommand(homeDir(), rest, {
+            stdin: process.stdin,
+            out: (text) => process.stdout.write(text),
+            err: (text) => process.stderr.write(text),
+        }));
+    }
     // 0.1.0 shipped this as `add`. Anyone who learned that name deserves a
     // sentence rather than "Unknown command".
     if (command === "add") {

package/dist/src/secrets/vault.js

@@ -33,6 +33,37 @@ export class Vault {
     listGlobal() {
         return this.store.listGlobal();
     }
+    /**
+     * What the vault holds under one project's own name — secrets and signing
+     * blocks — and nothing global.
+     *
+     * Its own method rather than a filter over `list`, because the question is a
+     * different one: `list` is "what would a run of this project see", and this is
+     * "what would be left behind if the project went away". A global secret is in
+     * the first answer and must never be in the second.
+     */
+    ownedBy(projectSlug) {
+        return {
+            secrets: this.store.listOwn(projectSlug),
+            credentials: this.credentials.listOwn(projectSlug),
+        };
+    }
+    /**
+     * Forgets everything stored under one project's name.
+     *
+     * Never called by removing a project: that route leaves the vault alone on
+     * purpose and says what stayed. This is the separate, deliberate act someone
+     * takes afterwards, once they have read what it is they are about to lose —
+     * a credential is the one thing here that cannot be looked at before it goes.
+     *
+     * Scoped by slug, so a global secret or a global signing block survives it.
+     */
+    forget(projectSlug) {
+        return {
+            secrets: this.store.removeAllOwn(projectSlug),
+            credentials: this.credentials.removeAllOwn(projectSlug),
+        };
+    }
     /**
      * Removes this project's secret values from a piece of text, in one shot.
      *