laneyard 0.4.0 → 0.5.0

package/README.md

@@ -103,7 +103,7 @@ server:
   bind: 0.0.0.0
   users:                         # written by `laneyard setup`, see Accounts
     - { name: martin, role: admin, password_hash: "scrypt$…" }
-    - { name: lea, role: builder, password_hash: "scrypt$…" }
+    - { name: lea, role: builder, password_hash: "scrypt$…", projects: [cartes-ios] }
   max_concurrent_runs: 1         # only 1 is accepted, see below
   retention: { runs: 50, artifact_days: 30 }
 
@@ -143,6 +143,26 @@ tabs are not drawn, and neither is the accounts screen. That is courtesy, not se
 server refuses those routes on its own, whatever the browser was shown, and the test suite
 proves it for every verb and every spelling of the address.
 
+#### Which projects a builder reaches
+
+An admin reaches every project — managing the server is the whole role. A builder reaches only the
+projects it is granted, one at a time, from the accounts screen: each builder carries a checklist
+of the projects, and ticking one grants it. A project a builder cannot reach is **invisible**, not
+shown-and-locked — absent from its project list and its navigation, and a 404 by URL, answered with
+the very body a project that does not exist gives, so the two cannot be told apart. This is enforced
+by the server, in one place, not hidden in the browser.
+
+The reach is a `projects` list on the account in `config.yml`, and its three states are deliberate:
+
+- **absent** — every project. A config written before this feature has no such field on anyone, so
+  nobody loses access on an upgrade.
+- **`[]`** — no project. This is what a newly created account is written with, so a new builder
+  starts seeing nothing until granted.
+- **a list of slugs** — exactly those projects.
+
+Removing a project strips its slug from every account, so a grant never points at a project that is
+gone, and a project re-created later under the same slug does not silently inherit an old grant.
+
 Add and remove accounts from the accounts screen, or from the command line:
 
 ```bash
@@ -155,23 +175,23 @@ shell history. Without `--role`, the account is a builder.
 Two things are refused, in the API and on the command line alike: removing the last admin, and
 demoting the last admin. A server nobody can administer cannot be repaired from the interface.
 
-Anyone changes their own password from **your account**, reached by clicking your name in the
-header — a builder included, since that page is about one person rather than about the server's
-list of people. It asks for the current password even though you are already signed in: a session
+Anyone changes their own password — and their own name — from **your account**, which is said in
+those words in the header and again on your own row of the accounts screen — a builder included,
+since that page is about one person rather than about the server's list of people. Either one asks
+for the current password even though you are already signed in: a session
 is a cookie in a browser that may have been left open on a desk. Doing it ends every other session
 that account has, and leaves the page you did it on signed in. That is how the random password
 `laneyard setup` printed once stops being a string on a sticky note.
 
+Changing your name edits your entry in `config.yml` in place, keeping your role and your project
+access exactly as they were, and refuses a name another account already has. It is your login name
+that changes: the next time you sign in, it is the new one you type. This is self-service and needs
+no admin — the identifier is yours to change, whatever your role.
+
 Removing an account ends its sessions immediately — "remove the account" and "revoke access" are
 the same act. So does editing `config.yml` by hand: every request looks the account up again, so
 a demotion takes effect at once rather than at the next restart.
 
-**Upgrading from 0.2.** An existing `server.password_hash` keeps working, unedited. It is read as
-a single admin account called `admin` — sign in with that name and the password you already have.
-The first time you add someone, the file is rewritten into the `users` form above, comments and
-all. Do not write both forms: a file holding a `password_hash` *and* a `users` list is refused at
-load, because there is no obvious winner.
-
 ### `laneyard.yml` — in your repository, and committed
 
 Build behaviour belongs next to the code, so it can be versioned with it — `laneyard setup`
@@ -203,6 +223,16 @@ Field by field, the repository file wins over the server block, which wins over
 field of `laneyard.yml` may also be written in the server block, so a repository you would rather
 not touch can be configured entirely from `config.yml`.
 
+**A monorepo of several apps carries one `laneyard.yml` per app.** The file may live in the app's
+own directory — beside its fastlane folder — rather than at the repository root, so two apps on one
+git remote each describe their own build without a single root file having to speak for both.
+`laneyard setup` writes it there for you. Inside an app-level file **paths are relative to that
+file's own directory**, not to the repository: `artifact_globs: ["**/*.aab"]` and a plain
+`fastlane_dir: fastlane` (usually left out entirely), so an app moved or duplicated keeps its file
+unchanged. Laneyard finds the app from the project's `fastlane_dir` in `config.yml` and reads the
+file from there; a `laneyard.yml` at the repository root still works and keeps its paths
+repo-root-relative, exactly as before.
+
 Both files are watched: edit them by hand and Laneyard picks the change up. An invalid file is
 reported and the last valid configuration stays live — a typo never takes the server down.
 
@@ -440,25 +470,94 @@ artifacts and reports scattered around, and none of them belong in your history.
 
 ### Removing a project
 
-Every project has a Settings tab, and the one thing on it is removal. It takes the project's block
-out of `config.yml` — through the YAML document, so your comments and your key order survive —
-and stops showing it. It is confirmed by typing the project's name: it is the one destructive
-action in Laneyard, and a dialogue you can click through is not a confirmation.
+Every project has a Settings tab, and the one thing on it is removal. It removes everything
+Laneyard holds for the project, in one confirmed act. It is confirmed by typing the project's
+name: it is the one destructive action in Laneyard, and a dialogue you can click through is not a
+confirmation.
 
-What it does *not* do is most of the point, because "delete" elsewhere usually means the opposite:
+What it removes:
 
-- **the runs stay.** Every build that project ever ran keeps its page, its log and its artifacts,
-  each still at its own address. Removing a project means stop showing it, not destroy its past;
-- **the clone and the artifacts stay on disk.** Their paths are printed when it is done, so you
-  can remove them yourself. Nothing is deleted from a web page on one click;
-- **the secrets stay in the vault**, encrypted and unreachable, and come back if you add the
-  project again under the same name;
-- **the repository is untouched.** Its `laneyard.yml`, its Fastfile and its history are the
-  repository's, not Laneyard's.
+- **its block in `config.yml`** — taken out through the YAML document, so your comments and your
+  key order survive;
+- **its run history and its logs.** Every build the project ran, its rows and its logs, deleted.
+  This is the one thing here nothing can rebuild, and the reason removal is behind a typed name;
+- **the clone and the artifacts on disk**, deleted;
+- **its secrets and its signing blocks in the vault** — Laneyard's own encrypted copies, forgotten.
+  The screen counts them before you confirm and again once it is done, because they are the one
+  thing on this list you cannot go and look at: no route ever sends a credential back.
+
+What it does *not* touch, said as plainly:
+
+- **the git remote.** The repository is on your host and your disk. Laneyard neither reads nor
+  writes it;
+- **the credential originals.** The `.p8` and the keystore you uploaded are wherever you keep them
+  — a password manager, a safe. Laneyard removes only its own encrypted copy; you would upload them
+  again from there;
+- **global secrets and global signing blocks.** They are read by every project on the machine, not
+  this one's to take, and they are left alone. The result names how many it left.
 
 Removal is refused while a run of that project is in flight — that run is using the workspace. A
 run still waiting in the queue will not start: it ends as failed, saying its project is gone.
 
+The same thing from the command line:
+
+```bash
+laneyard remove cartes-ios --dry-run   # show what would go, and stop
+laneyard remove cartes-ios             # remove it, after a typed confirmation
+```
+
+It removes exactly what the Settings tab does, leaves exactly what it leaves, and is confirmed the
+same way — by typing the project's slug back, not `y`. `--dry-run` prints the inventory and stops.
+It is refused for an unknown slug, and while a run of the project is in flight.
+
+### Resetting
+
+```bash
+laneyard reset --dry-run   # show what would go, and stop
+laneyard reset             # wipe it, after a typed confirmation
+```
+
+`laneyard reset` wipes the data and keeps you able to use Laneyard: every project, the database,
+the workspaces, the artifacts and the logs go; your accounts and the vault key stay. It is a data
+reset that does not lock you out — you sign in with the same names afterwards — and it keeps the
+key, so any older `laneyard.db` backup stays readable rather than becoming ciphertext nobody can
+open. The database comes back empty from the schema on the next start, which also clears the
+sessions, so everyone signs in again.
+
+It keeps the `server:` block of `config.yml` (accounts, port, bind, retention) and
+`~/.laneyard/key`. It never touches the git remotes or the credential originals — those were never
+Laneyard's. It reads the inventory first and, like `uninstall`, is confirmed by typing the
+folder's path, not `y`.
+
+### Uninstalling
+
+```bash
+laneyard uninstall --dry-run   # list what is there, and stop
+laneyard uninstall             # remove it, after a typed confirmation
+npm uninstall -g laneyard      # remove the package itself
+```
+
+`laneyard uninstall` removes the data folder: `config.yml`, the vault key, the database, the
+workspaces, the artifacts and the logs. It reads the whole inventory from disk first — the
+projects, the number of secrets and signing blocks, the real sizes and paths — and prints it
+before asking anything.
+
+The vault key is the one loss that cannot be undone. Every secret and every signing block is
+encrypted under `~/.laneyard/key`; once it is gone the database is ciphertext nobody can read, and
+restoring a backup of `laneyard.db` alone brings nothing back. The originals are yours and are
+untouched — the `.p8` in your downloads, the keystore in your safe — so what you are agreeing to
+is uploading them again. Global secrets and global signing blocks are shared by every project and
+go too; the inventory says so on its own line.
+
+It is confirmed by typing the folder's path, not `y`: this is the one command in Laneyard that
+destroys credentials, and `$LANEYARD_HOME` is exactly the case where a reflex is wrong. Anything
+in the folder that Laneyard did not put there is named, left alone, and the folder is kept for it.
+
+It does not remove the npm package — a command cannot sensibly delete the binary it is running
+from — and it prints the command that does. There is no npm lifecycle hook doing any of this on
+`npm uninstall`, on purpose: a package manager must not delete someone's signing keys on its own,
+and a lifecycle script cannot ask.
+
 ## Security
 
 Read this before putting Laneyard on a network.
@@ -522,7 +621,8 @@ What this does *not* cover, stated plainly:
 - `✓` edit the Fastfile in the browser, verified on every save
 - `✓` signing credentials stored whole — the file and the fields beside it — written to disk for
   the length of a run and exported under the names your project already reads
-- `✓` remove a project from the interface, without touching its history
+- `✓` remove a project from the interface — everything Laneyard holds for it, behind a typed name
+- `✓` `laneyard uninstall`: the whole inventory first, then a typed confirmation, then the folder
 - `✓` named accounts, with a builder role that never sees a credential
 - `○` git-triggered and scheduled builds
 

package/dist/src/cli/home.js

@@ -0,0 +1,46 @@
+import { rm, stat } from "node:fs/promises";
+import { join } from "node:path";
+import { createInterface } from "node:readline";
+/**
+ * What Laneyard writes into its home, and the folders it fills as it runs.
+ *
+ * Named in one place because three commands read them — `uninstall` removes all
+ * of it, `reset` removes the data but keeps the accounts and the key, and each
+ * has to agree with the others about what "Laneyard's own" means.
+ */
+/** The three files SQLite keeps for one WAL database. */
+export const DB_FILES = ["laneyard.db", "laneyard.db-wal", "laneyard.db-shm"];
+/** The files Laneyard owns in its home. */
+export const OWN_FILES = ["config.yml", "key", ...DB_FILES];
+/** The folders Laneyard fills: clones, artifacts, logs, per-run scratch. */
+export const OWN_FOLDERS = ["workspaces", "artifacts", "logs", "runs"];
+/** Reads one line, which works the same whether it is typed or piped in. */
+export async function readLine(stdin) {
+    const rl = createInterface({ input: stdin });
+    try {
+        for await (const line of rl)
+            return line.trim();
+        return "";
+    }
+    finally {
+        rl.close();
+    }
+}
+/**
+ * Removes named entries under `home`, and returns the names it actually removed.
+ *
+ * A missing entry is skipped rather than reported, so a caller can hand in the
+ * full list without first checking which parts are there. `rm` with `recursive`
+ * and `force` handles a file and a whole folder alike.
+ */
+export async function removePaths(home, names) {
+    const removed = [];
+    for (const name of names) {
+        const path = join(home, name);
+        if ((await stat(path).catch(() => null)) === null)
+            continue;
+        await rm(path, { recursive: true, force: true });
+        removed.push(name);
+    }
+    return removed;
+}

package/dist/src/cli/remove.js

@@ -0,0 +1,173 @@
+import Database from "better-sqlite3";
+import { existsSync } from "node:fs";
+import { rm, stat } from "node:fs/promises";
+import { join } from "node:path";
+import { ConfigStore } from "../config/store.js";
+import { CredentialStore } from "../db/credentials.js";
+import { openDatabase } from "../db/open.js";
+import { RunStore } from "../db/runs.js";
+import { SecretStore } from "../db/secrets.js";
+import { removeProjectData } from "../data/remove-project.js";
+import { LogStore } from "../logs/store.js";
+import { Vault } from "../secrets/vault.js";
+import { readLine } from "./home.js";
+import { bad, bold, dim, field, heading, ok, warn } from "./style.js";
+export const REMOVE_USAGE = `laneyard remove <slug> [--dry-run]
+
+Removes everything Laneyard holds for one project: its block in config.yml, its
+clone, its artifacts, its run history and logs, and its own secrets and signing
+blocks in the vault. It does not touch the git remote, the credential originals,
+or the global secrets and signing blocks other projects share.
+
+  laneyard remove <slug> --dry-run   show what would go and stop
+
+The run history is the one thing here nothing can rebuild, so it is confirmed by
+typing the project's slug back, not \`y\`.
+`;
+const plural = (n, noun) => `${n} ${n === 1 ? noun : `${noun}s`}`;
+async function readCounts(home, slug) {
+    const dbPath = join(home, "laneyard.db");
+    if (!existsSync(dbPath))
+        return { activeRun: false, runs: 0, secrets: 0, signingBlocks: 0 };
+    const sidecars = [`${dbPath}-wal`, `${dbPath}-shm`];
+    const ours = await Promise.all(sidecars.map(async (path) => ((await stat(path).catch(() => null)) === null ? path : null)));
+    let db = null;
+    try {
+        db = new Database(dbPath, { readonly: true, fileMustExist: true });
+        const runs = new RunStore(db);
+        return {
+            activeRun: runs.hasActiveRun(slug),
+            runs: runs.listByProject(slug, -1).length,
+            secrets: new SecretStore(db).listOwn(slug).length,
+            signingBlocks: new CredentialStore(db).listOwn(slug).length,
+        };
+    }
+    finally {
+        db?.close();
+        for (const path of ours) {
+            if (path !== null)
+                await rm(path, { force: true }).catch(() => undefined);
+        }
+    }
+}
+/** The inventory, and what the removal will and will not reach. */
+function renderInventory(slug, name, home, counts, clonePath) {
+    const cloned = existsSync(clonePath);
+    return (heading(`laneyard remove "${slug}"`) +
+        field("home", home) + "\n" +
+        field("project", name === slug ? slug : `${name} (${slug})`) + "\n" +
+        heading("what will be removed") +
+        field("runs", counts.runs === 0 ? dim("no run yet") : plural(counts.runs, "run")) + "\n" +
+        field("clone", cloned ? clonePath : dim("not cloned")) + "\n" +
+        field("secrets", plural(counts.secrets, "project secret")) + "\n" +
+        field("signing", plural(counts.signingBlocks, "project signing block")) + "\n" +
+        heading("what will not be touched") +
+        dim("  the git remote — the repository is yours, on your host and your disk.\n") +
+        dim("  the credential originals — Laneyard removes only its own encrypted copy;\n") +
+        dim("  the .p8 and the keystore you uploaded are wherever you keep them.\n") +
+        dim("  global secrets and global signing blocks — shared by every project.\n"));
+}
+/**
+ * Entry point for `laneyard remove <slug>`.
+ *
+ * The command-line equivalent of removing a project from the interface. It reads
+ * the inventory first, prints what will and will not go, and only then asks for
+ * the slug typed back — the same gate the web route uses, for the same reason:
+ * the run history it deletes is the one thing here nothing can rebuild.
+ */
+export async function runRemoveCommand(home, args, io) {
+    let dryRun = false;
+    let slug = null;
+    for (const arg of args) {
+        if (arg === "--dry-run" || arg === "-n")
+            dryRun = true;
+        else if (arg.startsWith("-")) {
+            io.err(`Unknown option: ${arg}\n\n${REMOVE_USAGE}`);
+            return 1;
+        }
+        else if (slug === null)
+            slug = arg;
+        else {
+            io.err(`One project at a time. Give a single slug.\n\n${REMOVE_USAGE}`);
+            return 1;
+        }
+    }
+    if (slug === null) {
+        io.err(`Which project? Give its slug.\n\n${REMOVE_USAGE}`);
+        return 1;
+    }
+    const configPath = join(home, "config.yml");
+    const config = new ConfigStore(configPath);
+    const loaded = await config.load();
+    if (!loaded.ok) {
+        io.err(`Unreadable configuration in ${configPath}: ${loaded.error}\n`);
+        return 1;
+    }
+    const entry = config.project(slug);
+    if (!entry) {
+        const known = config.projects().map((p) => p.slug);
+        io.err(`${bad(`Unknown project: "${slug}".`)} ` +
+            (known.length > 0 ? `Known projects: ${known.join(", ")}.` : "No project is declared yet.") +
+            "\n");
+        return 1;
+    }
+    const clonePath = join(home, "workspaces", slug);
+    const counts = await readCounts(home, slug);
+    // A run that has begun is reading the workspace this project points at.
+    // Refused for the same reason the interface refuses it, and with the same way
+    // out: wait for it, or cancel it, then remove the project.
+    if (counts.activeRun) {
+        io.err("\n" +
+            bad(`"${slug}" has a run in flight.`) +
+            " Wait for it to finish, or cancel it, then remove the project. Nothing was removed.\n");
+        return 1;
+    }
+    io.out(renderInventory(slug, entry.name, home, counts, clonePath));
+    if (dryRun) {
+        io.out("\n" +
+            dim(`Nothing was removed. Run \`laneyard remove ${slug}\` without --dry-run to remove it.`) +
+            "\n");
+        return 0;
+    }
+    // Typed in full, not `y`: this deletes a run history nothing can rebuild, and
+    // the slug typed back is what proves the person read which project is going.
+    io.out("\n" +
+        bold("Type the project's slug, exactly, to confirm:") + "\n" +
+        `  ${slug}\n` +
+        "\n> ");
+    const answer = await readLine(io.stdin);
+    if (answer !== slug) {
+        io.err("\n" +
+            bad(answer === ""
+                ? "Nothing was typed, so nothing was removed."
+                : "That is not the slug, so nothing was removed.") +
+            "\n");
+        return 1;
+    }
+    const db = openDatabase(join(home, "laneyard.db"));
+    try {
+        const result = await removeProjectData({
+            configPath,
+            reloadConfig: () => config.load(),
+            runs: new RunStore(db),
+            logs: new LogStore(join(home, "logs")),
+            vault: await Vault.open(home, new SecretStore(db), new CredentialStore(db)),
+            workspacePath: (s) => join(home, "workspaces", s),
+            artifactsDir: (runId) => join(home, "artifacts", String(runId)),
+        }, slug);
+        io.out(heading("removed") +
+            ok(`"${slug}": ${plural(result.runs, "run")}, ${plural(result.secrets, "secret")}, ` +
+                `${plural(result.signingBlocks, "signing block")}.\n`) +
+            (result.workspace
+                ? dim(`  ${result.clonePath} is gone.\n`)
+                : dim("  There was no clone to remove.\n")) +
+            dim(`  The block is out of ${configPath}.\n`) +
+            "\n" +
+            warn("The git remote and your credential originals were never Laneyard's to touch, and " +
+                "global secrets and signing blocks were left alone.\n"));
+        return 0;
+    }
+    finally {
+        db.close();
+    }
+}

package/dist/src/cli/reset.js

@@ -0,0 +1,117 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { clearProjectsInConfig } from "./setup.js";
+import { DB_FILES, OWN_FOLDERS, readLine, removePaths } from "./home.js";
+import { humanSize, readInventory } from "./uninstall.js";
+import { bad, bold, dim, field, heading, ok, warn } from "./style.js";
+export const RESET_USAGE = `laneyard reset [--dry-run]
+
+Wipes Laneyard's data — every project, the database, the workspaces, the
+artifacts and the logs — and keeps the accounts and the vault key. A reset that
+does not lock you out: you sign in with the same names, and older database
+backups stay readable because the key they were encrypted under is still there.
+
+  laneyard reset --dry-run   show what would go and stop
+
+It keeps the \`server:\` block of config.yml (accounts, port, bind, retention)
+and ~/.laneyard/key. It never touches the git remotes or the credential
+originals — those were never Laneyard's.
+`;
+const plural = (n, noun) => `${n} ${n === 1 ? noun : `${noun}s`}`;
+const entries = (n) => `${n} ${n === 1 ? "entry" : "entries"}`;
+/** The inventory, in reset's own framing: what goes, and what stays. */
+function renderInventory(inv) {
+    let out = heading("laneyard reset");
+    out += field("home", inv.home) + "\n";
+    out += heading("what will be wiped");
+    const projects = inv.config?.projects ?? [];
+    out += field("projects", projects.length === 0 ? dim("none declared") : projects.join(", ")) + "\n";
+    const v = inv.db?.vault ?? null;
+    if (v === null) {
+        out += field("database", inv.db === null ? dim("not there") : dim("could not be read")) + "\n";
+    }
+    else {
+        out += field("secrets", `${plural(v.projectSecrets, "project secret")}, ${plural(v.globalSecrets, "global secret")}`) + "\n";
+        out += field("signing", `${plural(v.projectBlocks, "project signing block")}, ${plural(v.globalBlocks, "global signing block")}`) + "\n";
+        out += field("history", plural(v.runs, "run")) + "\n";
+    }
+    if (inv.folders.length === 0) {
+        out += field("on disk", dim("nothing cloned, nothing built")) + "\n";
+    }
+    for (const folder of inv.folders) {
+        out +=
+            field(folder.name, folder.entries === 0 ? dim("empty") : `${entries(folder.entries)}  ${dim(humanSize(folder.bytes))}`) + "\n";
+    }
+    out += heading("what will be kept");
+    // Said plainly, because these are the two facts that make a reset a reset and
+    // not an uninstall: the door is not locked behind you, and the old backups are
+    // not turned into ciphertext nobody can read.
+    out += field("accounts", inv.config === null ? dim("none") : "left as they are — you sign in with the same names") + "\n";
+    out += field("vault key", (inv.key?.path ?? join(inv.home, "key")) + " — kept, so older database backups stay readable") + "\n";
+    out += "\n";
+    out += dim("  The git remotes and your credential originals were never Laneyard's, and are not touched.\n");
+    return out;
+}
+/**
+ * Entry point for `laneyard reset`.
+ *
+ * Inventory first, then the typed confirmation, then the wipe — the order
+ * `uninstall` uses, and never any other: a question asked before the numbers are
+ * on screen is one nobody can answer. Unlike `uninstall`, the accounts and the
+ * key stay, so the confirmation guards a reset, not a lock-out.
+ */
+export async function runResetCommand(home, args, io) {
+    let dryRun = false;
+    for (const arg of args) {
+        if (arg === "--dry-run" || arg === "-n")
+            dryRun = true;
+        else {
+            io.err(`Unknown option: ${arg}\n\n${RESET_USAGE}`);
+            return 1;
+        }
+    }
+    const inv = await readInventory(home);
+    if (!inv.exists) {
+        io.out(dim(`No data folder at ${home}. There is nothing to reset.`) + "\n");
+        return 0;
+    }
+    io.out(renderInventory(inv));
+    if (dryRun) {
+        io.out("\n" + dim("Nothing was removed. Run `laneyard reset` without --dry-run to wipe it.") + "\n");
+        return 0;
+    }
+    // The folder's path, exactly, not `y` — the same gate as `uninstall`. A reset
+    // is less final than an uninstall, but it still throws away every run anyone
+    // ever kept, and `$LANEYARD_HOME` is exactly the case where a reflex is wrong.
+    io.out("\n" +
+        bold("Type the path of the folder to reset, exactly, to confirm:") + "\n" +
+        `  ${inv.home}\n` +
+        "\n> ");
+    const answer = await readLine(io.stdin);
+    if (answer !== inv.home) {
+        io.err("\n" +
+            bad(answer === ""
+                ? "Nothing was typed, so nothing was removed."
+                : "That is not the path, so nothing was removed.") +
+            "\n");
+        return 1;
+    }
+    const configPath = join(home, "config.yml");
+    const projectsCleared = existsSync(configPath) ? await clearProjectsInConfig(configPath) : 0;
+    // The database file, and the WAL sidecars beside it. It comes back empty from
+    // the schema on the next start — which also clears the sessions, so everyone
+    // signs in again, exactly what a reset should mean.
+    const dbRemoved = await removePaths(home, DB_FILES);
+    const foldersRemoved = await removePaths(home, OWN_FOLDERS);
+    io.out(heading("reset") +
+        ok(`${plural(projectsCleared, "project")} cleared, the database and ` +
+            `${plural(foldersRemoved.length, "data folder")} wiped.\n`) +
+        (dbRemoved.includes("laneyard.db")
+            ? dim("  laneyard.db is gone; it comes back empty on the next start.\n")
+            : dim("  There was no database to remove.\n")) +
+        "\n" +
+        warn("Kept: your accounts, and the vault key at " + (inv.key?.path ?? join(home, "key")) + ".\n") +
+        dim("  You sign in with the same names, and older database backups stay readable.\n") +
+        dim("  The git remotes and your credential originals were never Laneyard's to touch.\n"));
+    return 0;
+}