laneyard 0.4.1 → 0.6.0

package/dist/src/cli/adopt.js

@@ -0,0 +1,221 @@
+import { execFile } from "node:child_process";
+import { readFile, writeFile } from "node:fs/promises";
+import { basename, isAbsolute, join, resolve } from "node:path";
+import { promisify } from "node:util";
+import { fieldsOf } from "../credentials/kinds.js";
+import { appRootOf } from "../heuristics/platforms.js";
+import { proposalsFor } from "../fastfile/adoption.js";
+import { splice } from "../fastfile/splice.js";
+import { scanFastfile } from "../sidecar/scan.js";
+import { bold, dim, heading, ok, warn } from "./style.js";
+const exec = promisify(execFile);
+/**
+ * Setup's second act: what to do about credentials the Fastfile names outright.
+ *
+ * **It runs after the project is already set up, and that ordering is the
+ * whole guarantee.** Declining everything here must leave exactly the project
+ * setup produced before this feature existed — so the act is separate rather
+ * than folded into setup's final confirmation, and "refusing works" is true by
+ * construction instead of by promise.
+ *
+ * Nothing it can do is required. No Ruby with Prism, no Fastfile, an
+ * unparseable file, a literal naming a file that is not on disk: every one of
+ * those means "nothing proposed", and setup carries on.
+ */
+export async function runAdoption(options) {
+    const { cwd, fastlaneDir, slug, vault, asker } = options;
+    const literals = await scanFastfile(cwd, fastlaneDir);
+    if (literals === null) {
+        process.stdout.write("\n" + dim("Fastfile not analysed — no Ruby with Prism available. Nothing else changes.\n"));
+        return { applied: 0 };
+    }
+    // A literal pointing at nothing is dropped rather than reported: there is no
+    // file to lift into the vault, and patching to a variable nothing supplies
+    // would trade one broken build for another.
+    // Resolved once, here, so the prompt, the vault write and the git check all
+    // speak about the same file rather than each resolving the path again.
+    const found = new Map();
+    const proposals = [];
+    for (const proposal of proposalsFor(literals)) {
+        if (proposal.tier === "file") {
+            const hit = await readCredential(cwd, fastlaneDir, proposal);
+            if (hit === null)
+                continue;
+            found.set(proposal, hit);
+        }
+        proposals.push(proposal);
+    }
+    if (proposals.length === 0)
+        return { applied: 0 };
+    process.stdout.write(heading("I read your Fastfile"));
+    const accepted = [];
+    for (const proposal of proposals) {
+        process.stdout.write(describe(fastlaneDir, proposal) + "\n");
+        if (!(await asker.confirm(`  Store it here and use ${bold(proposal.varName)}?`, proposal.checked))) {
+            continue;
+        }
+        accepted.push(proposal.tier === "secret" ? await named(asker, proposal) : proposal);
+    }
+    if (accepted.length === 0) {
+        process.stdout.write(dim("\nNothing written. Your Fastfile is as it was.\n"));
+        return { applied: 0 };
+    }
+    // The vault first, always. If lifting a credential fails, no Fastfile has
+    // been patched to read a variable that nothing supplies.
+    for (const proposal of accepted)
+        await store(vault, slug, asker, proposal, found.get(proposal));
+    const path = join(cwd, fastlaneDir, "Fastfile");
+    const previous = await readFile(path, "utf8");
+    const edits = accepted.flatMap((p) => (options.editFor ? [options.editFor(p)] : p.edits));
+    await writeFile(path, splice(previous, edits), "utf8");
+    // Verified with Prism rather than with fastlane: setup has no server to ask
+    // for a lane list, and "does it still parse" is the question that matters.
+    // Same contract as `FastfileStore.write` — the previous content goes back on
+    // disk before this function returns, and no backup file is left behind.
+    if ((await scanFastfile(cwd, fastlaneDir)) === null) {
+        await writeFile(path, previous, "utf8");
+        process.stdout.write("\n" + warn("The patch stopped the Fastfile parsing. It has been put back as it was.\n"));
+        return { applied: 0 };
+    }
+    await report(cwd, fastlaneDir, accepted, found);
+    return { applied: accepted.length };
+}
+/**
+ * The bytes behind a `file` proposal, or null when the path names nothing.
+ *
+ * **A relative path in a Fastfile has no single meaning.** `"./play.json"`
+ * resolves against whatever directory fastlane was invoked from, which is
+ * usually the app root — the fastlane folder's parent — but a project that runs
+ * fastlane from the repository root, or writes paths relative to the fastlane
+ * folder itself, is equally ordinary. Nothing in the file says which.
+ *
+ * So all three are tried, nearest first. This costs nothing to be wrong about:
+ * the patch replaces the literal with `ENV.fetch` either way, and the only
+ * thing the path is needed for is finding bytes to put in the vault. Failing to
+ * find them means no proposal, which is the safe answer.
+ */
+async function readCredential(cwd, fastlaneDir, proposal) {
+    const value = proposal.literal.value;
+    const candidates = isAbsolute(value)
+        ? [value]
+        : [
+            resolve(cwd, appRootOf(fastlaneDir), value),
+            resolve(cwd, fastlaneDir, value),
+            resolve(cwd, value),
+        ];
+    for (const path of candidates) {
+        const bytes = await readFile(path).catch(() => null);
+        if (bytes !== null)
+            return { bytes, path };
+    }
+    return null;
+}
+/** One proposal, as three lines: where, what, and why it will not survive. */
+function describe(fastlaneDir, proposal) {
+    const { literal } = proposal;
+    // A path is shown; a secret is not. Tier 3 is a value someone called a token
+    // or a password, and setup's output is pasted into bug reports and kept in CI
+    // transcripts — printing it there would be this feature leaking the very
+    // thing it exists to put away. The file and line above say where to look.
+    const shown = proposal.tier === "file"
+        ? `"${literal.value}"`
+        : proposal.tier === "inline"
+            ? dim("(a key, inline in the file)")
+            : dim("(a literal value, masked)");
+    const why = proposal.tier === "inline"
+        ? "This key is in your repository in cleartext."
+        : proposal.tier === "file"
+            ? "That path does not survive the clone: Laneyard builds from your remote."
+            : "A literal secret in a build file is a secret in your history.";
+    return ("\n" +
+        `  ${bold(`${fastlaneDir}/Fastfile:${literal.line}`)}   ${literal.action}(${literal.arg}:)\n` +
+        `                        → ${shown}\n` +
+        dim(`  ${why}\n`));
+}
+/**
+ * A tier-3 proposal carrying the variable name the user actually wants.
+ *
+ * This is the one tier whose name is a guess. Tiers 1 and 2 take theirs from
+ * `credentials/kinds.ts`, which holds the names fastlane itself reads; a
+ * literal secret has no such table, so the name is assembled from the action
+ * and the argument — `PILOT_API_TOKEN` — and a project that already calls that
+ * variable something else would end up with the vault holding one name and the
+ * patched Fastfile reading another. Nothing would report it: the run would
+ * simply meet an absent variable.
+ *
+ * The replacement is rebuilt from the answer rather than patched afterwards,
+ * so the name stored and the name read cannot drift apart.
+ */
+async function named(asker, proposal) {
+    const varName = await asker.ask("  variable name", proposal.varName);
+    return {
+        ...proposal,
+        varName,
+        edits: [{ ...proposal.edits[0], replacement: `ENV.fetch("${varName}")` }],
+    };
+}
+/** Lifts one accepted proposal into the vault. */
+async function store(vault, slug, asker, proposal, found) {
+    if (proposal.kind === undefined) {
+        await vault.set(slug, proposal.varName, proposal.literal.value, true);
+        return;
+    }
+    const bytes = proposal.tier === "inline" ? Buffer.from(proposal.literal.value, "utf8") : found.bytes;
+    // The original name is kept: some tools read meaning from it, and
+    // `materialise.ts` already relies on `AuthKey_<KEY ID>.p8` surviving intact.
+    const fileName = proposal.tier === "inline" ? `${proposal.kind}.key` : basename(found.path);
+    // The fields the file cannot carry. `fieldsOf` is the same table the web
+    // upload form reads, so the CLI cannot end up asking for a different set.
+    const fields = {};
+    for (const field of fieldsOf(proposal.kind)) {
+        if (field.optional)
+            continue;
+        const suggested = proposal.suggestedFields[field.name] ?? field.suggested ?? "";
+        fields[field.name] = await asker.ask(`  ${field.label}`, suggested);
+    }
+    await vault.setCredential(slug, proposal.kind, { fileName, fileBytes: bytes, fields, varNames: {} });
+}
+/** What is left for the user to do, including the part Laneyard will not do. */
+async function report(cwd, fastlaneDir, accepted, found) {
+    process.stdout.write("\n" +
+        ok(`Stored ${accepted.length} credential${accepted.length > 1 ? "s" : ""} in this machine's vault.\n`) +
+        ok(`Patched ${fastlaneDir}/Fastfile.\n`) +
+        "\n" +
+        // Said plainly because it is the trap `addProjectToConfig` already
+        // documents: Laneyard builds from a clone of the remote, so nothing in
+        // the working copy reaches a run until it is pushed.
+        warn("Commit and push it, or your runs still read the old file.\n") +
+        dim("  git diff -- " + join(fastlaneDir, "Fastfile") + "\n"));
+    // Said, never done. Removing a file from someone's repository is not
+    // setup's to decide, and `git rm --cached` does not take it out of the
+    // history anyway — so the honest thing is to name it.
+    const tracked = await trackedCredentials(cwd, accepted, found);
+    if (tracked.length > 0) {
+        process.stdout.write("\n" +
+            warn(`${tracked.join(", ")} ${tracked.length > 1 ? "are" : "is"} tracked by git.\n`) +
+            dim("  The patch does not take it out of your history. Rotating the key does.\n"));
+    }
+}
+/**
+ * Which of the accepted credentials git already has. Silent when git cannot
+ * answer — the same courtesy `fastlaneDirIsTracked` extends.
+ *
+ * Asked about the *resolved* paths, not the literals: `"./play.json"` written
+ * in a Fastfile one directory down is not a path `git ls-files` can answer
+ * about from the repository root.
+ */
+async function trackedCredentials(cwd, accepted, found) {
+    const paths = accepted.flatMap((p) => {
+        const hit = found.get(p);
+        return hit ? [hit.path] : [];
+    });
+    if (paths.length === 0)
+        return [];
+    try {
+        const { stdout } = await exec("git", ["ls-files", "--", ...paths], { cwd });
+        return stdout.split("\n").filter((line) => line.trim() !== "");
+    }
+    catch {
+        return [];
+    }
+}

package/dist/src/cli/home.js

@@ -0,0 +1,46 @@
+import { rm, stat } from "node:fs/promises";
+import { join } from "node:path";
+import { createInterface } from "node:readline";
+/**
+ * What Laneyard writes into its home, and the folders it fills as it runs.
+ *
+ * Named in one place because three commands read them — `uninstall` removes all
+ * of it, `reset` removes the data but keeps the accounts and the key, and each
+ * has to agree with the others about what "Laneyard's own" means.
+ */
+/** The three files SQLite keeps for one WAL database. */
+export const DB_FILES = ["laneyard.db", "laneyard.db-wal", "laneyard.db-shm"];
+/** The files Laneyard owns in its home. */
+export const OWN_FILES = ["config.yml", "key", ...DB_FILES];
+/** The folders Laneyard fills: clones, artifacts, logs, per-run scratch. */
+export const OWN_FOLDERS = ["workspaces", "artifacts", "logs", "runs"];
+/** Reads one line, which works the same whether it is typed or piped in. */
+export async function readLine(stdin) {
+    const rl = createInterface({ input: stdin });
+    try {
+        for await (const line of rl)
+            return line.trim();
+        return "";
+    }
+    finally {
+        rl.close();
+    }
+}
+/**
+ * Removes named entries under `home`, and returns the names it actually removed.
+ *
+ * A missing entry is skipped rather than reported, so a caller can hand in the
+ * full list without first checking which parts are there. `rm` with `recursive`
+ * and `force` handles a file and a whole folder alike.
+ */
+export async function removePaths(home, names) {
+    const removed = [];
+    for (const name of names) {
+        const path = join(home, name);
+        if ((await stat(path).catch(() => null)) === null)
+            continue;
+        await rm(path, { recursive: true, force: true });
+        removed.push(name);
+    }
+    return removed;
+}

package/dist/src/cli/remove.js

@@ -0,0 +1,195 @@
+import Database from "better-sqlite3";
+import { existsSync } from "node:fs";
+import { rm, stat } from "node:fs/promises";
+import { join } from "node:path";
+import { loadRepoConfig } from "../config/load.js";
+import { ConfigStore } from "../config/store.js";
+import { CredentialStore } from "../db/credentials.js";
+import { openDatabase } from "../db/open.js";
+import { RunStore } from "../db/runs.js";
+import { SecretStore } from "../db/secrets.js";
+import { removeProjectData } from "../data/remove-project.js";
+import { LogStore } from "../logs/store.js";
+import { Vault } from "../secrets/vault.js";
+import { readLine } from "./home.js";
+import { bad, bold, dim, field, heading, ok, warn } from "./style.js";
+export const REMOVE_USAGE = `laneyard remove [--dry-run]
+
+Run from your app's directory — the one that holds laneyard.yml. Removes
+everything Laneyard holds for that project: its block in config.yml, its clone,
+its artifacts, its run history and logs, and its own secrets and signing blocks
+in the vault. It also removes the repository's laneyard.yml, which you then
+commit. It does not touch the git remote, the credential originals, or the
+global secrets and signing blocks other projects share.
+
+  laneyard remove --dry-run   show what would go and stop
+
+The run history is the one thing here nothing can rebuild, so it is confirmed by
+typing the project's slug back, not \`y\`.
+`;
+const plural = (n, noun) => `${n} ${n === 1 ? noun : `${noun}s`}`;
+async function readCounts(home, slug) {
+    const dbPath = join(home, "laneyard.db");
+    if (!existsSync(dbPath))
+        return { activeRun: false, runs: 0, secrets: 0, signingBlocks: 0 };
+    const sidecars = [`${dbPath}-wal`, `${dbPath}-shm`];
+    const ours = await Promise.all(sidecars.map(async (path) => ((await stat(path).catch(() => null)) === null ? path : null)));
+    let db = null;
+    try {
+        db = new Database(dbPath, { readonly: true, fileMustExist: true });
+        const runs = new RunStore(db);
+        return {
+            activeRun: runs.hasActiveRun(slug),
+            runs: runs.listByProject(slug, -1).length,
+            secrets: new SecretStore(db).listOwn(slug).length,
+            signingBlocks: new CredentialStore(db).listOwn(slug).length,
+        };
+    }
+    finally {
+        db?.close();
+        for (const path of ours) {
+            if (path !== null)
+                await rm(path, { force: true }).catch(() => undefined);
+        }
+    }
+}
+/** The inventory, and what the removal will and will not reach. */
+function renderInventory(slug, name, home, counts, clonePath, ymlPath) {
+    const cloned = existsSync(clonePath);
+    return (heading(`laneyard remove "${slug}"`) +
+        field("home", home) + "\n" +
+        field("project", name === slug ? slug : `${name} (${slug})`) + "\n" +
+        heading("what will be removed") +
+        field("runs", counts.runs === 0 ? dim("no run yet") : plural(counts.runs, "run")) + "\n" +
+        field("clone", cloned ? clonePath : dim("not cloned")) + "\n" +
+        field("secrets", plural(counts.secrets, "project secret")) + "\n" +
+        field("signing", plural(counts.signingBlocks, "project signing block")) + "\n" +
+        // The one thing removed outside `home`: the repository's own file.
+        field("laneyard.yml", ymlPath) + "\n" +
+        heading("what will not be touched") +
+        dim("  the git remote — the repository is yours, on your host and your disk.\n") +
+        dim("  the credential originals — Laneyard removes only its own encrypted copy;\n") +
+        dim("  the .p8 and the keystore you uploaded are wherever you keep them.\n") +
+        dim("  global secrets and global signing blocks — shared by every project.\n"));
+}
+/**
+ * Entry point for `laneyard remove`, run from the app's own directory.
+ *
+ * The project is the one whose `laneyard.yml` sits in `cwd`; the slug is read
+ * from that file rather than given as an argument, so the command names what the
+ * directory already is. It reads the inventory first, prints what will and will
+ * not go, and only then asks for the slug typed back — the same gate the web
+ * route uses, for the same reason: the run history it deletes is the one thing
+ * here nothing can rebuild.
+ */
+export async function runRemoveCommand(home, cwd, args, io) {
+    let dryRun = false;
+    for (const arg of args) {
+        if (arg === "--dry-run" || arg === "-n")
+            dryRun = true;
+        else {
+            io.err(`Unknown option: ${arg}\n\n${REMOVE_USAGE}`);
+            return 1;
+        }
+    }
+    // The project is the one whose `laneyard.yml` is here — the file setup wrote
+    // and the slug it recorded in it. Run from anywhere else and there is nothing
+    // to name, which is the whole point: a project is removed from where it lives.
+    const ymlPath = join(cwd, "laneyard.yml");
+    if (!existsSync(ymlPath)) {
+        io.err("\n" +
+            bad("No laneyard.yml here.") +
+            " Run `laneyard remove` from your app's directory — the one that holds it.\n");
+        return 1;
+    }
+    const repo = await loadRepoConfig(ymlPath);
+    const slug = repo.ok ? repo.config.slug : undefined;
+    if (slug === undefined || slug === "") {
+        io.err("\n" +
+            bad("This laneyard.yml has no slug.") +
+            " Run `laneyard setup` again to record which project it is.\n");
+        return 1;
+    }
+    const configPath = join(home, "config.yml");
+    const config = new ConfigStore(configPath);
+    const loaded = await config.load();
+    if (!loaded.ok) {
+        io.err(`Unreadable configuration in ${configPath}: ${loaded.error}\n`);
+        return 1;
+    }
+    const entry = config.project(slug);
+    if (!entry) {
+        const known = config.projects().map((p) => p.slug);
+        io.err(`${bad(`Unknown project: "${slug}".`)} ` +
+            (known.length > 0 ? `Known projects: ${known.join(", ")}.` : "No project is declared yet.") +
+            "\n");
+        return 1;
+    }
+    const clonePath = join(home, "workspaces", slug);
+    const counts = await readCounts(home, slug);
+    // A run that has begun is reading the workspace this project points at.
+    // Refused for the same reason the interface refuses it, and with the same way
+    // out: wait for it, or cancel it, then remove the project.
+    if (counts.activeRun) {
+        io.err("\n" +
+            bad(`"${slug}" has a run in flight.`) +
+            " Wait for it to finish, or cancel it, then remove the project. Nothing was removed.\n");
+        return 1;
+    }
+    io.out(renderInventory(slug, entry.name, home, counts, clonePath, ymlPath));
+    if (dryRun) {
+        io.out("\n" +
+            dim("Nothing was removed. Run `laneyard remove` without --dry-run to remove it.") +
+            "\n");
+        return 0;
+    }
+    // Typed in full, not `y`: this deletes a run history nothing can rebuild, and
+    // the slug typed back is what proves the person read which project is going.
+    io.out("\n" +
+        bold("Type the project's slug, exactly, to confirm:") + "\n" +
+        `  ${slug}\n` +
+        "\n> ");
+    const answer = await readLine(io.stdin);
+    if (answer !== slug) {
+        io.err("\n" +
+            bad(answer === ""
+                ? "Nothing was typed, so nothing was removed."
+                : "That is not the slug, so nothing was removed.") +
+            "\n");
+        return 1;
+    }
+    const db = openDatabase(join(home, "laneyard.db"));
+    try {
+        const result = await removeProjectData({
+            configPath,
+            reloadConfig: () => config.load(),
+            runs: new RunStore(db),
+            logs: new LogStore(join(home, "logs")),
+            vault: await Vault.open(home, new SecretStore(db), new CredentialStore(db)),
+            workspacePath: (s) => join(home, "workspaces", s),
+            artifactsDir: (runId) => join(home, "artifacts", String(runId)),
+        }, slug);
+        // The machine data went first, so a file removed here is one whose project
+        // is already gone — never the other way round. `force` because the removal
+        // must still report success if the file was deleted by hand meanwhile.
+        await rm(ymlPath, { force: true }).catch(() => { });
+        io.out(heading("removed") +
+            ok(`"${slug}": ${plural(result.runs, "run")}, ${plural(result.secrets, "secret")}, ` +
+                `${plural(result.signingBlocks, "signing block")}.\n`) +
+            (result.workspace
+                ? dim(`  ${result.clonePath} is gone.\n`)
+                : dim("  There was no clone to remove.\n")) +
+            dim(`  The block is out of ${configPath}.\n`) +
+            dim(`  ${ymlPath} is gone.\n`) +
+            "\n" +
+            // The file is committed, so deleting the working copy is not the end of
+            // it — the same trap adoption's report names about a patched Fastfile.
+            warn("Commit its removal, or a clone still carries the laneyard.yml.\n") +
+            warn("The git remote and your credential originals were never Laneyard's to touch, and " +
+                "global secrets and signing blocks were left alone.\n"));
+        return 0;
+    }
+    finally {
+        db.close();
+    }
+}

package/dist/src/cli/reset.js

@@ -0,0 +1,117 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { clearProjectsInConfig } from "./setup.js";
+import { DB_FILES, OWN_FOLDERS, readLine, removePaths } from "./home.js";
+import { humanSize, readInventory } from "./uninstall.js";
+import { bad, bold, dim, field, heading, ok, warn } from "./style.js";
+export const RESET_USAGE = `laneyard reset [--dry-run]
+
+Wipes Laneyard's data — every project, the database, the workspaces, the
+artifacts and the logs — and keeps the accounts and the vault key. A reset that
+does not lock you out: you sign in with the same names, and older database
+backups stay readable because the key they were encrypted under is still there.
+
+  laneyard reset --dry-run   show what would go and stop
+
+It keeps the \`server:\` block of config.yml (accounts, port, bind, retention)
+and ~/.laneyard/key. It never touches the git remotes or the credential
+originals — those were never Laneyard's.
+`;
+const plural = (n, noun) => `${n} ${n === 1 ? noun : `${noun}s`}`;
+const entries = (n) => `${n} ${n === 1 ? "entry" : "entries"}`;
+/** The inventory, in reset's own framing: what goes, and what stays. */
+function renderInventory(inv) {
+    let out = heading("laneyard reset");
+    out += field("home", inv.home) + "\n";
+    out += heading("what will be wiped");
+    const projects = inv.config?.projects ?? [];
+    out += field("projects", projects.length === 0 ? dim("none declared") : projects.join(", ")) + "\n";
+    const v = inv.db?.vault ?? null;
+    if (v === null) {
+        out += field("database", inv.db === null ? dim("not there") : dim("could not be read")) + "\n";
+    }
+    else {
+        out += field("secrets", `${plural(v.projectSecrets, "project secret")}, ${plural(v.globalSecrets, "global secret")}`) + "\n";
+        out += field("signing", `${plural(v.projectBlocks, "project signing block")}, ${plural(v.globalBlocks, "global signing block")}`) + "\n";
+        out += field("history", plural(v.runs, "run")) + "\n";
+    }
+    if (inv.folders.length === 0) {
+        out += field("on disk", dim("nothing cloned, nothing built")) + "\n";
+    }
+    for (const folder of inv.folders) {
+        out +=
+            field(folder.name, folder.entries === 0 ? dim("empty") : `${entries(folder.entries)}  ${dim(humanSize(folder.bytes))}`) + "\n";
+    }
+    out += heading("what will be kept");
+    // Said plainly, because these are the two facts that make a reset a reset and
+    // not an uninstall: the door is not locked behind you, and the old backups are
+    // not turned into ciphertext nobody can read.
+    out += field("accounts", inv.config === null ? dim("none") : "left as they are — you sign in with the same names") + "\n";
+    out += field("vault key", (inv.key?.path ?? join(inv.home, "key")) + " — kept, so older database backups stay readable") + "\n";
+    out += "\n";
+    out += dim("  The git remotes and your credential originals were never Laneyard's, and are not touched.\n");
+    return out;
+}
+/**
+ * Entry point for `laneyard reset`.
+ *
+ * Inventory first, then the typed confirmation, then the wipe — the order
+ * `uninstall` uses, and never any other: a question asked before the numbers are
+ * on screen is one nobody can answer. Unlike `uninstall`, the accounts and the
+ * key stay, so the confirmation guards a reset, not a lock-out.
+ */
+export async function runResetCommand(home, args, io) {
+    let dryRun = false;
+    for (const arg of args) {
+        if (arg === "--dry-run" || arg === "-n")
+            dryRun = true;
+        else {
+            io.err(`Unknown option: ${arg}\n\n${RESET_USAGE}`);
+            return 1;
+        }
+    }
+    const inv = await readInventory(home);
+    if (!inv.exists) {
+        io.out(dim(`No data folder at ${home}. There is nothing to reset.`) + "\n");
+        return 0;
+    }
+    io.out(renderInventory(inv));
+    if (dryRun) {
+        io.out("\n" + dim("Nothing was removed. Run `laneyard reset` without --dry-run to wipe it.") + "\n");
+        return 0;
+    }
+    // The folder's path, exactly, not `y` — the same gate as `uninstall`. A reset
+    // is less final than an uninstall, but it still throws away every run anyone
+    // ever kept, and `$LANEYARD_HOME` is exactly the case where a reflex is wrong.
+    io.out("\n" +
+        bold("Type the path of the folder to reset, exactly, to confirm:") + "\n" +
+        `  ${inv.home}\n` +
+        "\n> ");
+    const answer = await readLine(io.stdin);
+    if (answer !== inv.home) {
+        io.err("\n" +
+            bad(answer === ""
+                ? "Nothing was typed, so nothing was removed."
+                : "That is not the path, so nothing was removed.") +
+            "\n");
+        return 1;
+    }
+    const configPath = join(home, "config.yml");
+    const projectsCleared = existsSync(configPath) ? await clearProjectsInConfig(configPath) : 0;
+    // The database file, and the WAL sidecars beside it. It comes back empty from
+    // the schema on the next start — which also clears the sessions, so everyone
+    // signs in again, exactly what a reset should mean.
+    const dbRemoved = await removePaths(home, DB_FILES);
+    const foldersRemoved = await removePaths(home, OWN_FOLDERS);
+    io.out(heading("reset") +
+        ok(`${plural(projectsCleared, "project")} cleared, the database and ` +
+            `${plural(foldersRemoved.length, "data folder")} wiped.\n`) +
+        (dbRemoved.includes("laneyard.db")
+            ? dim("  laneyard.db is gone; it comes back empty on the next start.\n")
+            : dim("  There was no database to remove.\n")) +
+        "\n" +
+        warn("Kept: your accounts, and the vault key at " + (inv.key?.path ?? join(home, "key")) + ".\n") +
+        dim("  You sign in with the same names, and older database backups stay readable.\n") +
+        dim("  The git remotes and your credential originals were never Laneyard's to touch.\n"));
+    return 0;
+}