laneyard 0.4.0 → 0.5.0

package/dist/src/config/accounts.js

@@ -1,8 +1,7 @@
 import { randomBytes } from "node:crypto";
 import { readFile, writeFile } from "node:fs/promises";
-import { Document, parseDocument, YAMLSeq } from "yaml";
+import { Document, parseDocument, YAMLMap, YAMLSeq } from "yaml";
 import { hashPassword } from "../server/auth.js";
-import { LEGACY_ADMIN_NAME } from "./load.js";
 import { serializeYaml } from "./yaml.js";
 /**
  * Accounts, as they are written to and taken out of config.yml.
@@ -53,25 +52,6 @@ async function open(path) {
         doc = new Document({});
     return doc;
 }
-/**
- * Turns a lone `server.password_hash` into the `users` form, in place.
- *
- * A file holding both is the one combination the loader refuses, so adding a
- * colleague to a 0.2 installation has to migrate it — otherwise the act of
- * inviting someone is the act of breaking the server's configuration.
- *
- * The name is the one the loader already reads that hash under, so nobody's
- * password changes meaning on the way through.
- */
-function migrateLegacyHash(doc) {
-    const hash = doc.getIn(["server", "password_hash"]);
-    if (typeof hash !== "string")
-        return;
-    doc.deleteIn(["server", "password_hash"]);
-    if (doc.hasIn(["server", "users"]))
-        return;
-    doc.setIn(["server", "users"], doc.createNode([{ name: LEGACY_ADMIN_NAME, role: "admin", password_hash: hash }]));
-}
 /** The accounts sequence, created if the file has none yet. */
 function usersSeq(doc) {
     const existing = doc.getIn(["server", "users"]);
@@ -94,21 +74,109 @@ const nameOf = (item) => item.get?.("name");
  */
 export async function upsertUserInConfig(path, entry) {
     const doc = await open(path);
-    migrateLegacyHash(doc);
     const seq = usersSeq(doc);
-    const stored = {
-        name: entry.name,
-        role: entry.role,
-        password_hash: hashPassword(entry.password),
-    };
     const at = seq.items.findIndex((item) => nameOf(item) === entry.name);
-    const node = doc.createNode(stored);
+    const password_hash = hashPassword(entry.password);
+    if (at === -1) {
+        // A new account starts with no access: `projects: []` is the empty grant,
+        // told apart from an absent field, which would mean "every project". A
+        // builder is thus created seeing nothing until an admin grants a project;
+        // an admin ignores the field, and carries it only so the entries are
+        // uniform.
+        seq.add(doc.createNode({ name: entry.name, role: entry.role, password_hash, projects: [] }));
+        await writeFile(path, serializeYaml(doc), "utf8");
+        return { created: true };
+    }
+    // Replacing changes the role and the password and nothing else: the fields are
+    // set on the existing node rather than a fresh one put in its place, so a
+    // hand-added `projects` grant — and any comment or key order — survives a
+    // password change it has nothing to do with.
+    const item = seq.items[at];
+    item.set("role", entry.role);
+    item.set("password_hash", password_hash);
+    await writeFile(path, serializeYaml(doc), "utf8");
+    return { created: false };
+}
+/**
+ * Renames an account in place, keeping everything else it carried.
+ *
+ * A rename is not an upsert. `upsertUserInConfig` keys by name, so handing it the
+ * new name would add a second account and orphan the first — dropping the role,
+ * the hash and, most quietly of all, the `projects` grants the old entry held.
+ * So the edit is to the `name` field of the matching node, through the YAML
+ * document, which leaves role, password_hash, projects and the file's comments
+ * and key order exactly where they were.
+ *
+ * Refuses when `newName` already belongs to another account rather than folding
+ * two entries into one, and refuses when no account carried `oldName` — there is
+ * nothing there to rename. Returns whether the rename happened, which is the
+ * difference between a fresh name and a collision in a sentence.
+ */
+export async function renameUserInConfig(path, oldName, newName) {
+    const doc = await open(path);
+    const users = doc.getIn(["server", "users"]);
+    if (!(users instanceof YAMLSeq))
+        return false;
+    // Checked before the target is looked up: a name already in the file must not
+    // be written onto a second entry, whoever else already holds it.
+    if (users.items.some((item) => nameOf(item) === newName))
+        return false;
+    const at = users.items.findIndex((item) => nameOf(item) === oldName);
     if (at === -1)
-        seq.add(node);
-    else
-        seq.items[at] = node;
+        return false;
+    users.items[at].set("name", newName);
     await writeFile(path, serializeYaml(doc), "utf8");
-    return { created: at === -1 };
+    return true;
+}
+/**
+ * Writes an account's project grants, replacing whatever list it had.
+ *
+ * The one edit behind `PUT /api/users/:name/projects`: it sets `projects` on the
+ * named account through the YAML document, so a hand-written file keeps its
+ * comments and its key order. Returns false when no account carried that name,
+ * so the caller can answer 404 rather than write a grant onto nobody.
+ */
+export async function setUserProjectsInConfig(path, name, projects) {
+    const doc = await open(path);
+    const users = doc.getIn(["server", "users"]);
+    if (!(users instanceof YAMLSeq))
+        return false;
+    const at = users.items.findIndex((item) => nameOf(item) === name);
+    if (at === -1)
+        return false;
+    users.items[at].set("projects", doc.createNode(projects));
+    await writeFile(path, serializeYaml(doc), "utf8");
+    return true;
+}
+/**
+ * Strips a project's slug from every account's grants.
+ *
+ * Called when a project is removed: a grant pointing at a project that no longer
+ * exists is dead data, and — the same hazard as a re-used vault slug — a project
+ * re-created later under that slug must not silently inherit an old grant. Only
+ * accounts that carried the slug are touched, so a file with no grants at all
+ * comes back byte-for-byte unchanged.
+ */
+export async function removeProjectFromAccounts(path, slug) {
+    const doc = await open(path);
+    const users = doc.getIn(["server", "users"]);
+    if (!(users instanceof YAMLSeq))
+        return;
+    let changed = false;
+    for (const item of users.items) {
+        if (!(item instanceof YAMLMap))
+            continue;
+        const projects = item.get("projects");
+        if (!(projects instanceof YAMLSeq))
+            continue;
+        const at = projects.items.findIndex((n) => (n && typeof n === "object" && "value" in n ? n.value : n) === slug);
+        if (at !== -1) {
+            projects.items.splice(at, 1);
+            changed = true;
+        }
+    }
+    if (changed)
+        await writeFile(path, serializeYaml(doc), "utf8");
 }
 /**
  * Takes an account out of config.yml, leaving the rest of the file alone.
@@ -118,7 +186,6 @@ export async function upsertUserInConfig(path, entry) {
  */
 export async function removeUserFromConfig(path, name) {
     const doc = await open(path);
-    migrateLegacyHash(doc);
     const users = doc.getIn(["server", "users"]);
     if (!(users instanceof YAMLSeq))
         return false;
@@ -130,7 +197,7 @@ export async function removeUserFromConfig(path, name) {
     return true;
 }
 /**
- * Does this file already declare somebody, in either of the two forms?
+ * Does this file already declare somebody?
  *
  * Asked before a question is put to the user rather than after: `laneyard setup`
  * only asks for an admin's name on a machine that has none, and asking anyway
@@ -138,7 +205,7 @@ export async function removeUserFromConfig(path, name) {
  */
 export async function hasAccount(path) {
     const doc = await open(path);
-    return doc.hasIn(["server", "password_hash"]) || doc.hasIn(["server", "users"]);
+    return doc.hasIn(["server", "users"]);
 }
 /**
  * Creates the first admin if the file declares no account at all.
@@ -151,12 +218,9 @@ export async function hasAccount(path) {
  */
 export async function ensureFirstAdmin(path, name) {
     const doc = await open(path);
-    if (doc.hasIn(["server", "password_hash"]) || doc.hasIn(["server", "users"]))
+    if (doc.hasIn(["server", "users"]))
         return null;
     const password = randomBytes(9).toString("base64url");
-    // The `users` form, never a bare `password_hash`: writing the legacy shape on
-    // a fresh machine would mean every new installation immediately needs the
-    // migration above the first time someone adds a colleague.
     doc.setIn(["server", "users"], doc.createNode([{ name, role: "admin", password_hash: hashPassword(password) }]));
     await writeFile(path, serializeYaml(doc), "utf8");
     return password;

package/dist/src/config/load.js

@@ -1,13 +1,6 @@
 import { readFile } from "node:fs/promises";
 import { parse as parseYaml } from "yaml";
 import { repoConfigSchema, serverConfigSchema } from "./schema.js";
-/**
- * The name a lone `password_hash` is read under.
- *
- * Also the name the legacy `{ password }` login form authenticates as, which is
- * what lets a 0.2 installation upgrade without anyone editing a file.
- */
-export const LEGACY_ADMIN_NAME = "admin";
 /** Reads and validates a YAML file. Never fails by throwing: the caller decides. */
 async function loadYamlFile(path, schema) {
     let raw;
@@ -34,26 +27,13 @@ async function loadYamlFile(path, schema) {
     return { ok: true, config: parsed.data };
 }
 /**
- * Folds both ways of declaring accounts into the one the rest of the code sees.
+ * Validates the declared accounts.
  *
  * Every refusal here is a locked room avoided: a server with no account, or
  * with none that can administer it, is one nobody can fix from the interface.
  */
 function normaliseUsers(server) {
-    const { password_hash, users } = server;
-    if (password_hash !== undefined && users !== undefined) {
-        return {
-            ok: false,
-            error: "server.password_hash and server.users both set — they are two ways to say the same " +
-                "thing and there is no obvious winner. Keep server.users and drop server.password_hash.",
-        };
-    }
-    if (password_hash !== undefined) {
-        return {
-            ok: true,
-            users: [{ name: LEGACY_ADMIN_NAME, role: "admin", password_hash }],
-        };
-    }
+    const { users } = server;
     if (users === undefined) {
         return {
             ok: false,
@@ -95,11 +75,7 @@ export async function loadServerConfig(path) {
     }
     // The display name falls back to the slug rather than being optional everywhere downstream.
     const projects = res.config.projects.map((p) => ({ ...p, name: p.name ?? p.slug }));
-    // `password_hash` is dropped rather than carried along: it has been folded
-    // into `users`, and leaving it in place would give downstream code a second
-    // source of truth to disagree with.
-    const { password_hash: _dropped, ...server } = res.config.server;
-    return { ok: true, config: { server: { ...server, users: accounts.users }, projects } };
+    return { ok: true, config: { server: { ...res.config.server, users: accounts.users }, projects } };
 }
 export async function loadRepoConfig(path) {
     return loadYamlFile(path, repoConfigSchema);

package/dist/src/config/resolve.js

@@ -1,5 +1,41 @@
 import { projectSettingsSchema } from "./schema.js";
 const SETTING_KEYS = Object.keys(projectSettingsSchema.shape);
+/**
+ * Prefixes an app-relative path with the app directory.
+ *
+ * `.` (or an empty prefix) is the repository root, and a path there is already
+ * repo-root-relative — nothing to add.
+ */
+function underApp(appRoot, p) {
+    return appRoot === "" || appRoot === "." ? p : `${appRoot}/${p}`;
+}
+/**
+ * Reads an app-level `laneyard.yml` as if it had been written at the repository
+ * root.
+ *
+ * The file declares its paths relative to its own directory —
+ * `fastlane_dir: fastlane`, `artifact_globs: ['**​/*.aab']` — so an app moved or
+ * duplicated keeps its file unchanged. But everything downstream resolves paths
+ * as repo-root-relative (`join(workspacePath, …)`, globs with `cwd:
+ * workspacePath`). So the app-relativity is collapsed here, once, at the
+ * boundary: the two path fields are prefixed with the app directory before the
+ * merge ever sees them, and nothing past this point learns a new rule.
+ *
+ * Only the path fields move. `platforms`, `runtime`, `timeout_minutes`,
+ * `interactive_default`, `required_secrets` and `retention` are not paths and
+ * pass through untouched. A root-level file is never handed here: its paths are
+ * already repo-root-relative.
+ */
+export function normaliseAppConfig(repo, appRoot) {
+    const out = { ...repo };
+    if (repo.fastlane_dir !== undefined) {
+        out.fastlane_dir = underApp(appRoot, repo.fastlane_dir);
+    }
+    if (repo.artifact_globs !== undefined) {
+        out.artifact_globs = repo.artifact_globs.map((g) => underApp(appRoot, g));
+    }
+    return out;
+}
 /**
  * Merges the three sources field by field.
  * `undefined` means "not set"; any other value, including an empty array

package/dist/src/config/schema.js

@@ -58,16 +58,26 @@ export const userEntrySchema = z.object({
     name: z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/, "name: letters, digits, dot, dash, underscore"),
     role: userRoleSchema,
     password_hash: z.string().min(1),
+    /**
+     * Which projects a builder may reach, by slug. Three-way, and the three ways
+     * carry back-compat for free:
+     *
+     *   absent → every project. A file written before this feature has no field
+     *     on anyone, so nobody loses access on upgrade.
+     *   []     → no project. What account creation now writes, so a new builder
+     *     starts with nothing until granted.
+     *   a list → exactly those slugs.
+     *
+     * An `admin` ignores it entirely: managing the server is their whole role.
+     */
+    projects: z.array(slugSchema).optional(),
 });
 export const serverConfigSchema = z.object({
     server: z.object({
         port: z.number().int().positive().default(7890),
         bind: z.string().default("0.0.0.0"),
-        // Both optional in the file, exactly one required by the loader. The old
-        // single-password form is what a 0.2 installation has on disk, and it must
-        // keep working unedited; `load.ts` normalises it into `users` so that
-        // nothing downstream ever learns which of the two forms was written.
-        password_hash: z.string().min(1).optional(),
+        // Optional in the file, required by the loader: a configuration that
+        // declares no account is refused rather than started.
         users: z.array(userEntrySchema).optional(),
         // Only 1 is accepted. Runs share one working directory per project, so a
         // higher number would promise parallel builds that never happen — the

package/dist/src/config/store.js

@@ -1,6 +1,7 @@
 import { watch } from "node:fs";
 import { loadRepoConfig, loadServerConfig } from "./load.js";
-import { resolveProjectSettings } from "./resolve.js";
+import { normaliseAppConfig, resolveProjectSettings } from "./resolve.js";
+import { appRootOf } from "../heuristics/platforms.js";
 import { join } from "node:path";
 /**
  * The server's live configuration.
@@ -68,13 +69,36 @@ export class ConfigStore {
      * Resolves a project's effective settings by reading its workspace's
      * laneyard.yml if it exists. The workspace may not be cloned yet: we
      * then fall back to the project's block and the defaults.
+     *
+     * The file is looked for in two places, in order:
+     *
+     * 1. `<workspace>/<appRoot>/laneyard.yml` — the app-level file, its paths
+     *    relative to the app's own directory, so a monorepo of N apps carries N
+     *    of them. Normalised back to repo-root-relative before the merge.
+     * 2. `<workspace>/laneyard.yml` — the repository-root file, repo-root-relative,
+     *    which is what existing installs have and keeps working unchanged.
+     *
+     * `appRoot` is derived from the project's `fastlane_dir` as declared in
+     * `config.yml` — the server-side anchor, present for every monorepo project by
+     * necessity and what points at the app before any repo file is read. When it is
+     * the repository root (the default `fastlane`), the two locations coincide and
+     * nothing changes.
      */
     async resolve(slug, workspacePath) {
         const entry = this.project(slug);
         if (!entry)
             return null;
-        const repoRes = await loadRepoConfig(join(workspacePath, "laneyard.yml"));
-        const repo = repoRes.ok ? repoRes.config : null;
+        const appRoot = appRootOf(entry.fastlane_dir);
+        let repo = null;
+        if (appRoot !== ".") {
+            const appRes = await loadRepoConfig(join(workspacePath, appRoot, "laneyard.yml"));
+            if (appRes.ok)
+                repo = normaliseAppConfig(appRes.config, appRoot);
+        }
+        if (repo === null) {
+            const rootRes = await loadRepoConfig(join(workspacePath, "laneyard.yml"));
+            repo = rootRes.ok ? rootRes.config : null;
+        }
         const { settings, provenance } = resolveProjectSettings(entry, repo);
         return { entry, settings, provenance };
     }

package/dist/src/data/remove-project.js

@@ -0,0 +1,70 @@
+import { existsSync } from "node:fs";
+import { rm } from "node:fs/promises";
+import { removeProjectFromAccounts } from "../config/accounts.js";
+import { removeProjectFromConfig } from "../cli/setup.js";
+/**
+ * Removes everything Laneyard holds for one project, and reports what went.
+ *
+ * The block leaves config.yml, through the YAML document so the rest of a
+ * hand-written file is untouched; the clone is deleted; every artifact folder
+ * goes; the run history — the rows and their logs — is deleted; and the
+ * project's own secrets and signing blocks are forgotten from the vault. The
+ * history is the one thing here that cannot be made again.
+ *
+ * What it does not reach, and why each is out of scope:
+ *
+ *  - the git remote. The repository is on the host and the user's disk. It is
+ *    theirs, not Laneyard's, and nothing here reads or writes it.
+ *  - the credential originals. Laneyard removes its own encrypted copy of a
+ *    `.p8` or a keystore; the file that went in is still in the password manager
+ *    or the safe it came from.
+ *  - global secrets and global signing blocks. They are read by every project on
+ *    the machine — `vault.forget` touches only slug-scoped rows.
+ *
+ * It removes; it does not confirm and it does not shape a reply. The callers do
+ * that: the route behind a slug typed back, the CLI behind the same. The one
+ * irreversible thing must not be reachable without one of them.
+ */
+export async function removeProjectData(deps, slug) {
+    const clonePath = deps.workspacePath(slug);
+    // Read before anything is touched. -1 is SQLite's "no limit": every run of the
+    // project, because each one names an artifact folder and a log file to remove.
+    const runs = deps.runs.listByProject(slug, -1);
+    // The config block first: once it is gone the project cannot be started, so
+    // nothing new begins reading the files the rest of this is about to remove.
+    const removed = await removeProjectFromConfig(deps.configPath, slug);
+    if (!removed) {
+        return { found: false, runs: 0, artifacts: 0, workspace: false, clonePath, secrets: 0, signingBlocks: 0 };
+    }
+    // The slug also leaves every account's grants, in the same file: a grant onto
+    // a project that no longer exists is dead data, and a slug re-used later must
+    // not silently inherit it.
+    await removeProjectFromAccounts(deps.configPath, slug);
+    await deps.reloadConfig();
+    // The clone.
+    const workspace = existsSync(clonePath);
+    await rm(clonePath, { recursive: true, force: true });
+    // The artifacts and the logs, one of each per run that produced them.
+    let artifacts = 0;
+    for (const run of runs) {
+        const dir = deps.artifactsDir(run.id);
+        if (existsSync(dir))
+            artifacts += 1;
+        await rm(dir, { recursive: true, force: true });
+        await deps.logs.remove(run.id);
+    }
+    // The run history: the rows, and their steps and artifact records by cascade.
+    deps.runs.removeByProject(slug);
+    // The project's own secrets and signing blocks. Slug-scoped only: a global
+    // secret three other projects read is not this one's to take.
+    const forgotten = deps.vault.forget(slug);
+    return {
+        found: true,
+        runs: runs.length,
+        artifacts,
+        workspace,
+        clonePath,
+        secrets: forgotten.secrets,
+        signingBlocks: forgotten.credentials,
+    };
+}

package/dist/src/db/credentials.js

@@ -46,6 +46,31 @@ export class CredentialStore {
     list(projectSlug) {
         return this.applicable(projectSlug).map(({ fileEnc: _fileEnc, fieldsEnc: _fieldsEnc, ...summary }) => summary);
     }
+    /**
+     * The blocks stored under this slug, and no global one.
+     *
+     * Same distinction as `SecretStore.listOwn`, and it matters more here: a
+     * global keystore shadowed by nothing is shared by every project on the
+     * machine, and counting it as one project's would offer to delete the one
+     * credential every other project signs with.
+     */
+    listOwn(projectSlug) {
+        if (projectSlug === GLOBAL)
+            return [];
+        const rows = this.db
+            .prepare("SELECT * FROM credential WHERE project_slug = ? ORDER BY kind")
+            .all(projectSlug);
+        return rows.map((row) => {
+            const { fileEnc: _fileEnc, fieldsEnc: _fieldsEnc, ...summary } = this.toSummary(row);
+            return summary;
+        });
+    }
+    /** Removes every block stored under this slug, and returns how many. */
+    removeAllOwn(projectSlug) {
+        if (projectSlug === GLOBAL)
+            return 0;
+        return this.db.prepare("DELETE FROM credential WHERE project_slug = ?").run(projectSlug).changes;
+    }
     listGlobal() {
         const rows = this.db
             .prepare("SELECT * FROM credential WHERE project_slug = ? ORDER BY kind")

package/dist/src/db/runs.js

@@ -39,6 +39,17 @@ export class RunStore {
             .all(slug, limit);
         return rows.map(toRun);
     }
+    /**
+     * Deletes every run of a project, and returns how many rows went.
+     *
+     * The steps and the artifact records go with them, by the `ON DELETE CASCADE`
+     * on their foreign keys — with `foreign_keys = ON`, which `openDatabase` sets.
+     * The log files and the artifact folders live on disk, not here: the caller
+     * removes those, which is why it reads the run ids before calling this.
+     */
+    removeByProject(slug) {
+        return this.db.prepare("DELETE FROM run WHERE project_slug = ?").run(slug).changes;
+    }
     setStatus(id, status) {
         this.db.prepare("UPDATE run SET status = ? WHERE id = ?").run(status, id);
     }

package/dist/src/db/secrets.js

@@ -62,6 +62,31 @@ export class SecretStore {
            WHERE project_slug = ? AND key = ?`)
             .run(masked ? 1 : 0, new Date().toISOString(), projectSlug ?? GLOBAL, key).changes > 0);
     }
+    /**
+     * The rows stored under this slug, and no global one.
+     *
+     * `list` answers "what does this project see", which is the right question
+     * everywhere else and the wrong one when a project is going away: a global
+     * secret three other projects also read is not this one's to count, and
+     * certainly not its to remove.
+     *
+     * The empty slug is the global scope's own key, so it is refused here rather
+     * than quietly returning every global row as if one project owned them.
+     */
+    listOwn(projectSlug) {
+        if (projectSlug === GLOBAL)
+            return [];
+        const rows = this.db
+            .prepare("SELECT * FROM secret WHERE project_slug = ? ORDER BY key")
+            .all(projectSlug);
+        return rows.map((row) => ({ key: row.key, masked: row.masked === 1, scope: "project" }));
+    }
+    /** Removes every row stored under this slug, and returns how many. */
+    removeAllOwn(projectSlug) {
+        if (projectSlug === GLOBAL)
+            return 0;
+        return this.db.prepare("DELETE FROM secret WHERE project_slug = ?").run(projectSlug).changes;
+    }
     list(projectSlug) {
         return this.applicable(projectSlug).map((row) => ({
             key: row.key,

package/dist/src/logs/store.js

@@ -1,5 +1,5 @@
 import { createReadStream } from "node:fs";
-import { mkdir, open, readFile } from "node:fs/promises";
+import { mkdir, open, readFile, rm } from "node:fs/promises";
 import { join } from "node:path";
 /**
  * Append-only writer for a run.
@@ -63,4 +63,12 @@ export class LogStore {
     stream(runId, fromOffset = 0) {
         return createReadStream(this.pathFor(runId), { start: fromOffset });
     }
+    /**
+     * Removes a run's log file. A run that never opened one is not an error:
+     * `force` makes a missing file a no-op, which is exactly the case for a run
+     * that failed before it wrote a line.
+     */
+    async remove(runId) {
+        await rm(this.pathFor(runId), { force: true });
+    }
 }

package/dist/src/main.js

@@ -7,7 +7,10 @@ import { bold, dim, field, heading } from "./cli/style.js";
 import { fileURLToPath } from "node:url";
 import { PromptAborted } from "./cli/prompt.js";
 import { runSetupCommand } from "./cli/setup.js";
+import { runRemoveCommand } from "./cli/remove.js";
+import { runResetCommand } from "./cli/reset.js";
 import { runSecretCommand } from "./cli/secret.js";
+import { runUninstallCommand } from "./cli/uninstall.js";
 import { runUserCommand } from "./cli/user.js";
 import { ConfigStore } from "./config/store.js";
 import { CacheStore } from "./db/cache.js";
@@ -20,7 +23,7 @@ import { Vault } from "./secrets/vault.js";
 import { makeInvoke } from "./sidecar/bridge.js";
 import { LaneReader } from "./sidecar/lanes.js";
 import { UsesReader } from "./sidecar/uses.js";
-export const version = "0.3.0";
+export const version = "0.5.0";
 /** Assembles the server from a data folder. */
 export async function createServerFromConfig(root) {
     const config = new ConfigStore(join(root, "config.yml"));
@@ -111,6 +114,13 @@ const USAGE = `laneyard — a self-hosted web UI for fastlane
                       store a secret, its value read from standard input
   laneyard user add NAME [--role admin|builder]
                       create an account, its password read from standard input
+  laneyard remove <slug>
+                      remove one project and everything Laneyard holds for it
+                      --dry-run shows what would go and stops
+  laneyard reset      wipe the data, keeping the accounts and the vault key
+                      --dry-run shows what would go and stops
+  laneyard uninstall  remove Laneyard's data folder, after showing what is in it
+                      --dry-run shows the inventory and stops
   laneyard            start the server
   laneyard --version  print the version
 
@@ -186,6 +196,30 @@ if (invokedDirectly()) {
             err: (text) => process.stderr.write(text),
         }));
     }
+    // No `mkdir` here, unlike the commands above: this one asks what is there
+    // and would look ridiculous creating the folder it is about to report on.
+    if (command === "uninstall") {
+        process.exit(await runUninstallCommand(homeDir(), rest, {
+            stdin: process.stdin,
+            out: (text) => process.stdout.write(text),
+            err: (text) => process.stderr.write(text),
+        }));
+    }
+    // No `mkdir` either: like `uninstall`, these read what is already there.
+    if (command === "remove") {
+        process.exit(await runRemoveCommand(homeDir(), rest, {
+            stdin: process.stdin,
+            out: (text) => process.stdout.write(text),
+            err: (text) => process.stderr.write(text),
+        }));
+    }
+    if (command === "reset") {
+        process.exit(await runResetCommand(homeDir(), rest, {
+            stdin: process.stdin,
+            out: (text) => process.stdout.write(text),
+            err: (text) => process.stderr.write(text),
+        }));
+    }
     // 0.1.0 shipped this as `add`. Anyone who learned that name deserves a
     // sentence rather than "Unknown command".
     if (command === "add") {

package/dist/src/secrets/vault.js

@@ -33,6 +33,38 @@ export class Vault {
     listGlobal() {
         return this.store.listGlobal();
     }
+    /**
+     * What the vault holds under one project's own name — secrets and signing
+     * blocks — and nothing global.
+     *
+     * Its own method rather than a filter over `list`, because the question is a
+     * different one: `list` is "what would a run of this project see", and this is
+     * "what would be left behind if the project went away". A global secret is in
+     * the first answer and must never be in the second.
+     */
+    ownedBy(projectSlug) {
+        return {
+            secrets: this.store.listOwn(projectSlug),
+            credentials: this.credentials.listOwn(projectSlug),
+        };
+    }
+    /**
+     * Forgets everything stored under one project's name.
+     *
+     * Part of removing a project: that act clears the vault along with the clone,
+     * the artifacts and the run history, behind the one typed confirmation that
+     * covers all of it. What it forgets is Laneyard's own encrypted copy — the
+     * `.p8` and the keystore that went in are still wherever the user keeps them.
+     *
+     * Scoped by slug, so a global secret or a global signing block survives it:
+     * those are read by every project and are never one project's to remove.
+     */
+    forget(projectSlug) {
+        return {
+            secrets: this.store.removeAllOwn(projectSlug),
+            credentials: this.credentials.removeAllOwn(projectSlug),
+        };
+    }
     /**
      * Removes this project's secret values from a piece of text, in one shot.
      *