@devdogsuga/backstage 0.1.11 → 0.1.13

package/README.md

@@ -153,8 +153,10 @@ a Send another officer made creates a new one, with a new link, under yours.
 
 The roster needs production's `DB_URL`: `--db-url`, else `.env.production` in a
 checkout, else Secrets Manager. The Linear key: `--linear-token`, then
-`LINEAR_API_KEY`, then the vault item "DevDogs Linear API key (backstage)", then
-a prompt; it is never saved.
+`LINEAR_API_KEY`, then the item "DevDogs Linear API key (backstage)" in your
+personal vault, then a prompt, which offers to save it there. Use your own key,
+never one shared through the DevDogs organization: Linear records every edit
+under the key's owner, and creds ignores organization items of that name.
 
 ## Member data: `import` and `export`
 
@@ -254,8 +256,10 @@ command that is not read-only asks once first (`--yes` answers it).
 Each command checks for the secrets it uses up front: `deploy <app>` for
 `CLOUDFLARE_API_TOKEN`, `deploy reconcile` for `CRON_SECRET`, `deploy
 prune-monitors` for `SENTRY_MONITORS_TOKEN` (skipped without it), `env` for the
-Secrets Manager token (flag, environment, then the Bitwarden vault, which `env`
-signs in to and unlocks itself, then asking).
+Secrets Manager token (flag, environment, then your personal Bitwarden vault,
+which `env` signs in to and unlocks itself, then asking). The token is each
+person's own: the vault read skips organization items, and a save sets no
+organization, so one person's token can be revoked without the rest.
 
 ## Layout
 

package/dist/{cli-B7W_-WdD.js → cli-CqbqBpaT.js}

@@ -31,7 +31,7 @@ async function readProductionKey(key) {
 		const value = nonEmpty(EnvDocument.parse(text).get(key));
 		if (value) return value;
 	} catch {}
-	const { listSecrets, projectIdFor } = await import("./client-DCRfKvpP.js");
+	const { listSecrets, projectIdFor } = await import("./client-CJPfmtwW.js");
 	const secrets = await listSecrets(await projectIdFor(PRODUCTION_PROJECT));
 	return nonEmpty(secrets.find((s) => s.key === key)?.value);
 }

package/dist/{cli-B8Lshscc.js → cli-DIXhcRjn.js}

@@ -6,7 +6,7 @@ import { a as wouldRunLine, n as isDryRun, t as dryRunKind } from "./dry-run-OzO
 import { a as explainError, i as explain, n as bail, o as unwrap, r as errorMessage } from "./ui-RFZyr6k_.js";
 import { t as DONE } from "./dispatch-D048O65I.js";
 import { t as EnvDocument } from "./document-DumoZXoO.js";
-import { a as listSecrets$1, c as updateSecret, i as createSecret, o as projectIdFor, r as byKey, s as setExplicitAccessToken } from "./client-Djo8fRdS.js";
+import { a as listSecrets$1, c as updateSecret, i as createSecret, o as projectIdFor, r as byKey, s as setExplicitAccessToken } from "./client-CFhbS3nu.js";
 import { register } from "node:module";
 import { pathToFileURL } from "node:url";
 import { appendFileSync, existsSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
@@ -3681,11 +3681,15 @@ function buildDesiredRulesets(actors) {
 			conditions: main$1,
 			bypass_actors: [
 				{
-					actor_id: actors.reviewersTeamId,
+					actor_id: actors.focusLeadsTeamId,
+					actor_type: "Team",
+					bypass_mode: "pull_request"
+				},
+				{
+					actor_id: actors.devopsTeamId,
 					actor_type: "Team",
 					bypass_mode: "pull_request"
 				},
-				always(actors.devopsTeamId),
 				always(actors.adminsTeamId)
 			],
 			rules: [{
@@ -3698,7 +3702,7 @@ function buildDesiredRulesets(actors) {
 			target: "branch",
 			enforcement: "active",
 			conditions: main$1,
-			bypass_actors: [always(actors.devopsTeamId), always(actors.adminsTeamId)],
+			bypass_actors: [always(actors.adminsTeamId)],
 			rules: [{
 				type: "pull_request",
 				parameters: {
@@ -3716,7 +3720,7 @@ function buildDesiredRulesets(actors) {
 			target: "branch",
 			enforcement: "active",
 			conditions: main$1,
-			bypass_actors: [always(actors.devopsTeamId), always(actors.adminsTeamId)],
+			bypass_actors: [always(actors.adminsTeamId)],
 			rules: [{
 				type: "required_status_checks",
 				parameters: {
@@ -3752,6 +3756,7 @@ function buildDesiredRulesets(actors) {
 				exclude: ["refs/heads/main", "refs/heads/team/**"]
 			} },
 			bypass_actors: [
+				always(actors.focusLeadsTeamId),
 				always(actors.devopsTeamId),
 				always(actors.adminsTeamId),
 				...actors.renovateAppId === void 0 ? [] : [{
@@ -3778,15 +3783,11 @@ function buildDesiredRulesets(actors) {
 				include: ["refs/heads/team/**"],
 				exclude: []
 			} },
-			bypass_actors: [
-				{
-					actor_id: actors.appId,
-					actor_type: "Integration",
-					bypass_mode: "always"
-				},
-				always(actors.devopsTeamId),
-				always(actors.adminsTeamId)
-			],
+			bypass_actors: [{
+				actor_id: actors.appId,
+				actor_type: "Integration",
+				bypass_mode: "always"
+			}, always(actors.adminsTeamId)],
 			rules: [
 				{ type: "creation" },
 				{ type: "deletion" },
@@ -4006,7 +4007,6 @@ const DEFAULT_REPO$1 = "DevDogsUGA";
 const DEFAULT_APP_SLUG = "devdogs-platform";
 const DEFAULT_DEVOPS_SLUG = "devops";
 const DEFAULT_ADMINS_SLUG = "admins";
-const DEFAULT_REVIEWERS_SLUG = "reviewers";
 /** TASK-299 — installed separately from the platform App; may not exist yet. */
 const DEFAULT_RENOVATE_SLUG = "renovate";
 function parseOptions$1(argv) {
@@ -4085,14 +4085,14 @@ async function runGithubRulesets(argv) {
 		repo: opts.repo
 	};
 	let devopsTeamId;
+	let focusLeadsTeamId;
 	let adminsTeamId;
-	let reviewersTeamId;
 	let appId;
 	try {
-		[devopsTeamId, adminsTeamId, reviewersTeamId, appId] = await Promise.all([
+		[devopsTeamId, focusLeadsTeamId, adminsTeamId, appId] = await Promise.all([
 			resolveTeamId(opts.org, DEFAULT_DEVOPS_SLUG),
+			resolveTeamId(opts.org, "focus-leads"),
 			resolveTeamId(opts.org, DEFAULT_ADMINS_SLUG),
-			resolveTeamId(opts.org, DEFAULT_REVIEWERS_SLUG),
 			resolveAppId(opts.org, opts.appSlug)
 		]);
 	} catch (err) {
@@ -4107,8 +4107,8 @@ async function runGithubRulesets(argv) {
 	}
 	const actors = {
 		devopsTeamId,
+		focusLeadsTeamId,
 		adminsTeamId,
-		reviewersTeamId,
 		appId,
 		renovateAppId
 	};
@@ -5389,9 +5389,9 @@ const HANDLERS = {
 	graphics: async (rest) => (await import("./commands-BAh2_Nds.js")).handleGraphics(rest),
 	qr: async (rest) => (await import("./commands-DILvdMc2.js")).handleQr(rest),
 	newsletter: async (rest) => (await import("./commands-C3_hAcZS.js")).handleNewsletter(rest),
-	creds: async (rest) => (await import("./commands-C6w8jm6a.js")).handleCreds(rest),
-	import: async (rest) => (await import("./commands-DfWNSPra.js")).handleImport(rest),
-	export: async (rest) => (await import("./commands-3HvxDq-2.js")).handleExport(rest)
+	creds: async (rest) => (await import("./commands-CTQjJ45_.js")).handleCreds(rest),
+	import: async (rest) => (await import("./commands-DfQKdPJY.js")).handleImport(rest),
+	export: async (rest) => (await import("./commands-BEYZyI4Y.js")).handleExport(rest)
 };
 /**
 * Names that were commands of the contributor CLI, refused with where they

package/dist/{client-Djo8fRdS.js → client-CFhbS3nu.js}

@@ -2,7 +2,7 @@ import { w as findRepoRoot } from "./telemetry-RNK5Wu74.js";
 import { n as loadEnv } from "./peers-DE07w6nT.js";
 import { o as unwrap } from "./ui-RFZyr6k_.js";
 import { t as EnvDocument } from "./document-DumoZXoO.js";
-import { a as readTokenFromVault, o as saveTokenToVault, t as VAULT_ITEM_NAME } from "./vault-BpYSYcuT.js";
+import { a as readTokenFromVault, s as saveTokenToVault, t as VAULT_ITEM_NAME } from "./vault-DVmaQC_E.js";
 import { dirname, join, resolve } from "node:path";
 import { log, password, select, text } from "@clack/prompts";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
@@ -66,7 +66,7 @@ function looksLikeAccessToken(value) {
 async function promptForToken() {
 	if (!process.stdin.isTTY) return void 0;
 	const typed = unwrap(await password({
-		message: "Paste the Secrets Manager access token for the `admin` account",
+		message: "Paste your own Secrets Manager access token (`admin` machine account)",
 		mask: "•",
 		validate: (v) => (v ?? "").trim() === "" ? "An access token is required." : void 0
 	})).trim();

package/dist/client-CJPfmtwW.js

@@ -0,0 +1,2 @@
+import { a as listSecrets, o as projectIdFor } from "./client-CFhbS3nu.js";
+export { listSecrets, projectIdFor };

package/dist/{commands-3HvxDq-2.js → commands-BEYZyI4Y.js}

@@ -2,8 +2,8 @@ import { n as isDryRun } from "./dry-run-OzO0jUhK.js";
 import { o as unwrap, r as errorMessage, t as UsageError } from "./ui-RFZyr6k_.js";
 import { i as exportParams, n as EXPORT_KINDS, r as auditFilters, t as EXPORTS } from "./queries-D3mTchag.js";
 import { t as DONE } from "./dispatch-D048O65I.js";
-import { c as ProductionError, d as requireProductionKey, i as plural, l as connect, o as reportFailure, r as expandHome, s as say, t as canPrompt, u as dbError } from "./cli-B7W_-WdD.js";
-import { i as parseBound, n as findMeetingsWith, r as pickMeeting, t as describeMeeting } from "./meetings-BAX4Sils.js";
+import { c as ProductionError, d as requireProductionKey, i as plural, l as connect, o as reportFailure, r as expandHome, s as say, t as canPrompt, u as dbError } from "./cli-CqbqBpaT.js";
+import { i as parseBound, n as findMeetingsWith, r as pickMeeting, t as describeMeeting } from "./meetings-QgVEoBIV.js";
 import { existsSync, readdirSync, statSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
 import { autocomplete, confirm, multiselect, text } from "@clack/prompts";

package/dist/{commands-C6w8jm6a.js → commands-CTQjJ45_.js}

@@ -3,7 +3,7 @@ import { t as nonEmpty } from "./connection-D3XsOE3S.js";
 import { a as explainError, i as explain, o as unwrap, r as errorMessage, t as UsageError } from "./ui-RFZyr6k_.js";
 import { t as DONE } from "./dispatch-D048O65I.js";
 import { t as EnvDocument } from "./document-DumoZXoO.js";
-import { i as readPasswordFromVault, n as bwArgs, r as openVault, s as bwCommand } from "./vault-BpYSYcuT.js";
+import { c as bwCommand, i as readPasswordFromVault, n as bwArgs, o as savePasswordToVault, r as openVault } from "./vault-DVmaQC_E.js";
 import { resolve } from "node:path";
 import { confirm, log, multiselect, note, password, select, text } from "@clack/prompts";
 import { readFile } from "node:fs/promises";
@@ -632,7 +632,7 @@ async function readCheckoutDbUrl() {
 	}
 }
 async function readSecretsManagerDbUrl() {
-	const { listSecrets, projectIdFor } = await import("./client-DCRfKvpP.js");
+	const { listSecrets, projectIdFor } = await import("./client-CJPfmtwW.js");
 	const secrets = await listSecrets(await projectIdFor(PRODUCTION_PROJECT));
 	return nonEmpty(secrets.find((s) => s.key === "DB_URL")?.value);
 }
@@ -660,6 +660,12 @@ function rosterQueryFor(url) {
 		}
 	};
 }
+/**
+* In the officer's PERSONAL vault, never the DevDogs organization: a Linear
+* key acts as the person who made it, so a shared one would put every edit to
+* the document under one name. It would also be an organization login that
+* `creds send` could hand out.
+*/
 const LINEAR_VAULT_ITEM = "DevDogs Linear API key (backstage)";
 const LINEAR_API = "https://api.linear.app/graphql";
 function cell(text) {
@@ -695,21 +701,36 @@ function renderReport(items, now, roster) {
 	return `${lines.join("\n")}\n`;
 }
 /**
-* `--linear-token`, then `LINEAR_API_KEY`, then the vault item, then a prompt.
-* Never saved anywhere: the vault is where it lives.
+* `--linear-token`, then `LINEAR_API_KEY`, then your personal vault item, then
+* a prompt, which offers to save what was typed to your personal vault.
 */
 async function resolveLinearToken(sources) {
-	const token = nonEmpty(sources.explicit) ?? nonEmpty(sources.env) ?? await (sources.fromVault ?? readLinearTokenFromVault)() ?? await (sources.prompt ?? promptForLinearToken)();
-	if (!token) throw new CredsError(`No Linear API key. Set LINEAR_API_KEY, or store one in your vault as "${LINEAR_VAULT_ITEM}".`);
-	registerSecret(token);
-	return token;
+	const token = nonEmpty(sources.explicit) ?? nonEmpty(sources.env) ?? await (sources.fromVault ?? readLinearTokenFromVault)();
+	if (token) {
+		registerSecret(token);
+		return token;
+	}
+	const typed = await (sources.prompt ?? promptForLinearToken)();
+	if (!typed) throw new CredsError(`No Linear API key. Set LINEAR_API_KEY, or store your own in your personal vault as "${LINEAR_VAULT_ITEM}".`);
+	registerSecret(typed);
+	await (sources.offerSave ?? offerToSaveLinearToken)(typed);
+	return typed;
 }
 function readLinearTokenFromVault() {
 	return readPasswordFromVault(LINEAR_VAULT_ITEM, "the Linear API key", "read the Linear API key", "LINEAR_API_KEY");
 }
+async function offerToSaveLinearToken(token) {
+	if (!process.stdin.isTTY) return;
+	if (!unwrap(await confirm({
+		message: `Save it to your personal Bitwarden vault as "DevDogs Linear API key (backstage)"?`,
+		initialValue: true
+	}))) return;
+	if (await savePasswordToVault("DevDogs Linear API key (backstage)", "Your own Linear API key, read by `backstage creds` to update the Shared Accounts document. Keep it in your personal vault, never the DevDogs organization: Linear records every edit under the key's owner.", token, "save the Linear API key")) log.success(`Stored as "${LINEAR_VAULT_ITEM}" in your vault.`);
+	else log.warn("Could not save it; continuing with the key you typed.");
+}
 async function promptForLinearToken() {
 	if (!process.stdin.isTTY) return void 0;
-	const value = unwrap(await password({ message: "Linear API key? (Settings → Security & access → API keys)" }));
+	const value = unwrap(await password({ message: "Your Linear API key? (Settings → Security & access → API keys)" }));
 	return nonEmpty(value.trim());
 }
 /** Replaces the document's content. Returns its URL. */

package/dist/{commands-DfWNSPra.js → commands-DfQKdPJY.js}

@@ -2,8 +2,8 @@ import { i as explain } from "./ui-RFZyr6k_.js";
 //#region src/import/commands.ts
 const handleImport = async (rest) => {
 	const [what, ...args] = rest;
-	if (what === "involvement") return (await import("./commands-B25Vafxz.js")).handleInvolvement(args);
-	if (what === "attendance") return (await import("./commands-D-Vvufb0.js")).handleAttendance(args);
+	if (what === "involvement") return (await import("./commands-DsyAE7BO.js")).handleInvolvement(args);
+	if (what === "attendance") return (await import("./commands-H4DGzVqb.js")).handleAttendance(args);
 	explain(what ? `Unknown import "${what}". Try involvement or attendance.` : "Name the import: involvement or attendance.", "");
 	process.exitCode = 1;
 	return null;

package/dist/{commands-B25Vafxz.js → commands-DsyAE7BO.js}

@@ -1,8 +1,8 @@
 import { n as isDryRun } from "./dry-run-OzO0jUhK.js";
 import { r as errorMessage, t as UsageError } from "./ui-RFZyr6k_.js";
 import { t as DONE } from "./dispatch-D048O65I.js";
-import { a as readInputFile, d as requireProductionKey, f as withConnection, i as plural, n as confirmWrite, o as reportFailure, s as say, t as canPrompt } from "./cli-B7W_-WdD.js";
-import { a as createAccounts, i as createAccountFor, n as accountFinder, o as readAccounts, t as parseCsv } from "./read-Dd388anq.js";
+import { a as readInputFile, d as requireProductionKey, f as withConnection, i as plural, n as confirmWrite, o as reportFailure, s as say, t as canPrompt } from "./cli-CqbqBpaT.js";
+import { a as createAccounts, i as createAccountFor, n as accountFinder, o as readAccounts, t as parseCsv } from "./read-DMderLHG.js";
 import { parseArgs } from "node:util";
 //#region src/involvement/csv.ts
 /**

package/dist/{commands-D-Vvufb0.js → commands-H4DGzVqb.js}

@@ -1,9 +1,9 @@
 import { n as isDryRun } from "./dry-run-OzO0jUhK.js";
 import { o as unwrap, r as errorMessage, t as UsageError } from "./ui-RFZyr6k_.js";
 import { t as DONE } from "./dispatch-D048O65I.js";
-import { a as readInputFile, c as ProductionError, d as requireProductionKey, f as withConnection, i as plural, l as connect, n as confirmWrite, o as reportFailure, s as say, t as canPrompt } from "./cli-B7W_-WdD.js";
-import { a as createAccounts, i as createAccountFor, n as accountFinder, r as accountsWith, t as parseCsv } from "./read-Dd388anq.js";
-import { n as findMeetingsWith, r as pickMeeting, t as describeMeeting } from "./meetings-BAX4Sils.js";
+import { a as readInputFile, c as ProductionError, d as requireProductionKey, f as withConnection, i as plural, l as connect, n as confirmWrite, o as reportFailure, s as say, t as canPrompt } from "./cli-CqbqBpaT.js";
+import { a as createAccounts, i as createAccountFor, n as accountFinder, r as accountsWith, t as parseCsv } from "./read-DMderLHG.js";
+import { n as findMeetingsWith, r as pickMeeting, t as describeMeeting } from "./meetings-QgVEoBIV.js";
 import { text } from "@clack/prompts";
 import { parseArgs } from "node:util";
 //#region src/attendance/plan.ts

package/dist/launch.js

@@ -322,7 +322,7 @@ async function launchWith(argv, options) {
 */
 async function launch(argv) {
 	await launchWith(argv, { dispatch: async (args) => {
-		const { main } = await import("./cli-B8Lshscc.js");
+		const { main } = await import("./cli-DIXhcRjn.js");
 		await main(args);
 	} });
 }

package/dist/{meetings-BAX4Sils.js → meetings-QgVEoBIV.js}

@@ -1,5 +1,5 @@
 import { t as UsageError } from "./ui-RFZyr6k_.js";
-import "./cli-B7W_-WdD.js";
+import "./cli-CqbqBpaT.js";
 //#region src/production/time.ts
 /**
 * Dates as officers type them. Meetings happen in Athens, so a bare

package/dist/{read-Dd388anq.js → read-DMderLHG.js}

@@ -1,5 +1,5 @@
 import { r as errorMessage } from "./ui-RFZyr6k_.js";
-import { c as ProductionError, f as withConnection } from "./cli-B7W_-WdD.js";
+import { c as ProductionError, f as withConnection } from "./cli-CqbqBpaT.js";
 //#region src/production/accounts.ts
 /**
 * Production accounts: reading them, finding one by email, and creating the

package/dist/{vault-BpYSYcuT.js → vault-DVmaQC_E.js}

@@ -50,9 +50,14 @@ function bwCommand(args) {
 * prerequisite.
 *
 * ⚠️ The token never passes through argv in either direction. Reads use
-* `bw get password <search>`, which puts only the item NAME on the command
+* `bw list items --search <name>`, which puts only the item NAME on the command
 * line, and writes pipe base64 JSON through **stdin**, which `bw create item`
 * documents as an accepted input.
+*
+* ⚠️ Only the PERSONAL vault. A token read from, or saved to, an organization
+* item would be one token for everybody who can see that item: every call made
+* with it looks the same, and revoking one person means revoking everyone.
+* Reads skip organization items and say so; writes set no organization.
 */
 const run = promisify(execFile);
 /**
@@ -177,20 +182,20 @@ function bwArgs(args, key) {
 		key
 	] : withNoInteraction;
 }
-/**
-* The stored token, or `undefined` for every reason it might not be there.
-*
-* `bw get password` takes a search term and fails when it matches more than one
-* item, which is the behaviour worth having: two items called something like
-* this means somebody should look, not that this should guess.
-*/
+/** The stored token, or `undefined` for every reason it might not be there. */
 async function readTokenFromVault() {
 	return readPasswordFromVault(VAULT_ITEM_NAME, "the access token", "look for the access token", "BWS_ACCESS_TOKEN");
 }
 /**
-* The password of the one vault item named `itemName`, or `undefined` for
-* every reason it might not be there. `what` names it in the spinner; `purpose`
-* finishes the sign-in and unlock questions.
+* The password of the one PERSONAL vault item named exactly `itemName`, or
+* `undefined` for every reason it might not be there. `what` names it in the
+* spinner; `purpose` finishes the sign-in and unlock questions.
+*
+* `bw list items --search` rather than `bw get password`: `get` takes the
+* first item it can see, organization items included, and an item of that
+* name in an organization is precisely the shared token this must not use.
+* Two personal items of the same name mean somebody should look, not that
+* this should guess, so that is "not found" too.
 */
 async function readPasswordFromVault(itemName, what, purpose, envVar) {
 	const status = await signInIfNeeded(await vaultStatus(), purpose);
@@ -202,34 +207,49 @@ async function readPasswordFromVault(itemName, what, purpose, envVar) {
 	if (status === "locked" && !key) return void 0;
 	const s = spinner();
 	s.start("Looking in your Bitwarden vault");
+	let items;
 	try {
 		const { stdout } = await run(...bwCommand(bwArgs([
-			"get",
-			"password",
-			itemName,
-			"--raw"
-		], key)), { shell: false });
-		const token = stdout.trim();
-		if (token === "") {
-			s.stop("Nothing stored in the vault yet");
-			return;
-		}
+			"list",
+			"items",
+			"--search",
+			itemName
+		], key)), {
+			shell: false,
+			maxBuffer: 16777216
+		});
+		items = JSON.parse(stdout).filter((item) => item.name === itemName);
+	} catch {
+		s.stop("Could not read your Bitwarden vault");
+		return;
+	}
+	const personal = items.filter((item) => !item.organizationId);
+	if (personal.length > 1) {
+		s.stop(`More than one "${itemName}" in your vault; delete the extras`);
+		return;
+	}
+	const token = personal[0]?.login?.password?.trim();
+	if (token) {
 		s.stop(`Read ${what} from your vault ("${itemName}")`);
 		return token;
-	} catch {
-		s.stop("No single matching item in your vault");
+	}
+	if (items.length > personal.length) {
+		s.stop(`"${itemName}" is in an organization, not your personal vault`);
+		log.warn(`Not using it: an organization item is one ${what} for everyone who can see it, so nothing it does can be told apart. Use your own, saved in your personal vault (no organization).`);
 		return;
 	}
+	s.stop("Nothing stored in the vault yet");
 }
 /**
-* Creates the item, with the token arriving on **stdin** as base64 JSON.
+* Saves `token` as a login item named `itemName` in the PERSONAL vault, the
+* token arriving on **stdin** as base64 JSON.
 *
 * `bw create item` documents an encoded-JSON positional AND stdin. Using stdin
 * is the difference between a live credential that is invisible and one that
-* sits in `ps` output for the length of the call.
+* sits in `ps` output for the length of the call. `organizationId: null` is
+* what makes it personal, and it is not a parameter.
 */
-async function saveTokenToVault(token) {
-	const purpose = "save the access token";
+async function savePasswordToVault(itemName, notes, token, purpose) {
 	const status = await signInIfNeeded(await vaultStatus(), purpose);
 	if (status === "unavailable" || status === "unauthenticated") return false;
 	const key = await session(status, purpose);
@@ -239,8 +259,8 @@ async function saveTokenToVault(token) {
 		collectionIds: null,
 		folderId: null,
 		type: 1,
-		name: VAULT_ITEM_NAME,
-		notes: "Bitwarden Secrets Manager access token for the `admin` machine account, read/write on preflight, staging and production.\n\nRead automatically by `backstage env`. Never put this in a .env file: it unlocks all three projects, and the tool refuses to upload it.",
+		name: itemName,
+		notes,
 		favorite: false,
 		reprompt: 0,
 		login: {
@@ -268,10 +288,14 @@ async function saveTokenToVault(token) {
 		child.stdin.end(Buffer.from(JSON.stringify(item)).toString("base64"));
 	});
 }
+/** Saves the Secrets Manager access token. See {@link savePasswordToVault}. */
+function saveTokenToVault(token) {
+	return savePasswordToVault(VAULT_ITEM_NAME, "Your own Bitwarden Secrets Manager access token for the `admin` machine account, read/write on preflight, staging and production.\n\nRead automatically by `backstage env`. Keep it in your personal vault, never an organization: one token per person is what keeps calls attributable and lets one person's be revoked alone. Never put this in a .env that leaves this machine: it unlocks all three projects, and the tool refuses to upload it.", token, "save the access token");
+}
 /** Why the vault could not be used, phrased as something to do about it. */
 function explainVault(status, envVar = "BWS_ACCESS_TOKEN") {
 	if (status === "unavailable") return "The `bw` CLI is not installed, so the vault could not be checked. It ships with backstage, so reinstall it.";
 	if (status === "unauthenticated") return `You are not signed in to Bitwarden, and with no terminal there is nobody to sign in. Set ${envVar} instead.`;
 }
 //#endregion
-export { readTokenFromVault as a, readPasswordFromVault as i, bwArgs as n, saveTokenToVault as o, openVault as r, bwCommand as s, VAULT_ITEM_NAME as t };
+export { readTokenFromVault as a, bwCommand as c, readPasswordFromVault as i, bwArgs as n, savePasswordToVault as o, openVault as r, saveTokenToVault as s, VAULT_ITEM_NAME as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devdogsuga/backstage",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "private": false,
   "type": "module",
   "description": "Officer and production CLI for DevDogsUGA: deploys, env sync with Bitwarden and GitHub, the migration planner role, club graphics and QR codes, GitHub rulesets and settings, and the newsletter. Ships built JS; run it anywhere with `pnpm dlx @devdogsuga/backstage` (no checkout needed to start; commands that read a checkout say so).",
@@ -36,14 +36,14 @@
     "postgres": "^3.4.9",
     "react": "^19.2.8",
     "satori": "^0.33.4",
-    "sharp": "0.35.3",
+    "sharp": "0.35.5",
     "tsx": "^4.23.12",
     "typescript": "^6.0.3",
     "zod": "4.4.3",
-    "@devdogsuga/brand": "0.1.6",
+    "@devdogsuga/brand": "0.1.8",
     "@devdogsuga/events": "0.1.7",
-    "@devdogsuga/newsletter": "0.1.13",
-    "@devdogsuga/telemetry": "0.1.4"
+    "@devdogsuga/telemetry": "0.1.4",
+    "@devdogsuga/newsletter": "0.1.15"
   },
   "peerDependencies": {
     "@devdogsuga/db": "*",
@@ -64,10 +64,10 @@
     "eslint": "^9.39.5",
     "tsdown": "^0.23.0",
     "vitest": "^4.1.11",
-    "@devdogsuga/cli-core": "0.0.0",
+    "@devdogsuga/config": "0.1.2",
     "@devdogsuga/db": "0.1.3",
-    "@devdogsuga/env": "0.1.5",
-    "@devdogsuga/config": "0.1.2"
+    "@devdogsuga/cli-core": "0.0.0",
+    "@devdogsuga/env": "0.1.5"
   },
   "scripts": {
     "build": "tsdown && node scripts/write-build-info.mjs && node ../../scripts/check-bundle-imports.mjs",

package/dist/client-DCRfKvpP.js

@@ -1,2 +0,0 @@
-import { a as listSecrets, o as projectIdFor } from "./client-Djo8fRdS.js";
-export { listSecrets, projectIdFor };