@devdogsuga/backstage 0.1.12 → 0.1.14

package/README.md

@@ -47,7 +47,8 @@ pnpm backstage export attendance --meeting 2026-09-09 --format bevy,involvement
 | `deploy <app> --tier <t>`                          | Checks `CLOUDFLARE_API_TOKEN`, writes the Worker's secrets file, deploys, removes it.  |
 | `deploy write-env`                                 | Composes `.env.<DEPLOY_ENV>` from the GitHub environment.                              |
 | `deploy preflight`                                 | Classifies the project: paused (skip) or broken (fail).                                |
-| `deploy plan`, `deploy migrate`                    | Dry-run the migrations into the job summary; apply them to `DB_URL`.                   |
+| `deploy plan`, `deploy migrate [--include-seed]`   | Dry-run the migrations (and new seed files) into the job summary; apply them.          |
+| `deploy avatars`                                   | Uploads seeded headshots the bucket lacks; never replaces one (`SECRET_KEY`).          |
 | `deploy smoke --tier <t> [--app]`                  | Public routes answer 200, the auth redirect works, this deploy's Sentry release shows. |
 | `deploy reconcile --tier <t>`                      | The platform's config reconcile, after the deploy (`CRON_SECRET`).                     |
 | `deploy prune-monitors --tier <t> [--app]`         | Deletes the app's Sentry Crons monitors it no longer declares (production only).       |
@@ -153,8 +154,10 @@ a Send another officer made creates a new one, with a new link, under yours.
 
 The roster needs production's `DB_URL`: `--db-url`, else `.env.production` in a
 checkout, else Secrets Manager. The Linear key: `--linear-token`, then
-`LINEAR_API_KEY`, then the vault item "DevDogs Linear API key (backstage)", then
-a prompt; it is never saved.
+`LINEAR_API_KEY`, then the item "DevDogs Linear API key (backstage)" in your
+personal vault, then a prompt, which offers to save it there. Use your own key,
+never one shared through the DevDogs organization: Linear records every edit
+under the key's owner, and creds ignores organization items of that name.
 
 ## Member data: `import` and `export`
 
@@ -254,8 +257,10 @@ command that is not read-only asks once first (`--yes` answers it).
 Each command checks for the secrets it uses up front: `deploy <app>` for
 `CLOUDFLARE_API_TOKEN`, `deploy reconcile` for `CRON_SECRET`, `deploy
 prune-monitors` for `SENTRY_MONITORS_TOKEN` (skipped without it), `env` for the
-Secrets Manager token (flag, environment, then the Bitwarden vault, which `env`
-signs in to and unlocks itself, then asking).
+Secrets Manager token (flag, environment, then your personal Bitwarden vault,
+which `env` signs in to and unlocks itself, then asking). The token is each
+person's own: the vault read skips organization items, and a save sets no
+organization, so one person's token can be revoked without the rest.
 
 ## Layout
 

package/dist/{catalog-BLgY4knB.js → catalog-D7eGX7cD.js}

@@ -371,7 +371,8 @@ const supabase = (...args) => run$1([
 * The one spelling of the migration push, shared by the contributor `db
 * migrate` path (`stack.ts`'s `pushMigrations`) and CI's `deploy migrate`.
 * `--yes` is the unattended apply CI wants; the contributor path omits it so a
-* human still confirms. Neither variant regenerates types — that is
+* human still confirms. `includeSeed` adds the `[db.seed]` files, which the
+* CLI runs once each and records in `supabase_migrations.seed_files`. Neither variant regenerates types — that is
 * `pushMigrations`' own second step, layered on top only where a checkout is
 * meant to be rewritten. A CI apply must NOT write back into the repo, which is
 * exactly why the bare push is factored out here rather than reused whole.
@@ -383,6 +384,7 @@ function dbPush(dbUrl, opts = {}) {
 		"--db-url",
 		dbUrl
 	];
+	if (opts.includeSeed) args.push("--include-seed");
 	if (opts.yes) args.push("--yes");
 	return supabase(...args);
 }
@@ -397,17 +399,19 @@ function dbPush(dbUrl, opts = {}) {
 * apply". The child's own output is surfaced in the thrown message, because for
 * a dry run that output is precisely the reason the operator needs.
 */
-async function dbPushDryRun(dbUrl) {
+async function dbPushDryRun(dbUrl, opts = {}) {
+	const args = [
+		"exec",
+		"supabase",
+		"db",
+		"push",
+		"--db-url",
+		dbUrl
+	];
+	if (opts.includeSeed) args.push("--include-seed");
+	args.push("--dry-run");
 	try {
-		const { stdout, stderr } = await runFile("pnpm", [
-			"exec",
-			"supabase",
-			"db",
-			"push",
-			"--db-url",
-			dbUrl,
-			"--dry-run"
-		], {
+		const { stdout, stderr } = await runFile("pnpm", args, {
 			cwd: findRepoRoot(),
 			encoding: "utf8",
 			maxBuffer: 33554432
@@ -1130,6 +1134,10 @@ function app(name) {
 		]
 	};
 }
+const INCLUDE_SEED = {
+	flag: "--include-seed",
+	summary: "Also run the seed files the database has not recorded."
+};
 const deployCommand = {
 	name: "deploy",
 	dryRun: "handled",
@@ -1161,11 +1169,17 @@ const deployCommand = {
 				flag: "--label",
 				value: "<title>",
 				summary: "Heading for the summary section."
-			}]
+			}, INCLUDE_SEED]
 		},
 		{
 			name: "migrate",
 			summary: "Apply the migrations to DB_URL.",
+			options: [INCLUDE_SEED, DRY_RUN]
+		},
+		{
+			name: "avatars",
+			summary: "Upload seeded headshots the avatars bucket does not have yet.",
+			hint: "never replaces an existing photo",
 			options: [DRY_RUN]
 		},
 		{

package/dist/{cli-B7W_-WdD.js → cli-CqbqBpaT.js}

@@ -31,7 +31,7 @@ async function readProductionKey(key) {
 		const value = nonEmpty(EnvDocument.parse(text).get(key));
 		if (value) return value;
 	} catch {}
-	const { listSecrets, projectIdFor } = await import("./client-DCRfKvpP.js");
+	const { listSecrets, projectIdFor } = await import("./client-CJPfmtwW.js");
 	const secrets = await listSecrets(await projectIdFor(PRODUCTION_PROJECT));
 	return nonEmpty(secrets.find((s) => s.key === key)?.value);
 }

package/dist/{cli-Bv5hcXnG.js → cli-xqblG51R.js}

@@ -1,18 +1,18 @@
 import { C as discoverRepoRoot, M as flagValue, N as positionals, T as cliName, b as ownPackageDir, c as reportDevtoolsError, f as isNoEnv, l as reportDevtoolsFailure, n as captureDevtoolsError, o as initDevtoolsTelemetry, p as isNonInteractive, w as findRepoRoot, x as ownVersion } from "./telemetry-RNK5Wu74.js";
-import { a as recordEnteredTier, f as helpPath, i as beginInvocation, l as dbPush, m as renderHelp, n as bareGroupStartPath, o as recordResolved, p as renderCommandList, r as runMenu, s as reproducibleCommand, t as catalog, u as dbPushDryRun } from "./catalog-BLgY4knB.js";
+import { a as recordEnteredTier, f as helpPath, i as beginInvocation, l as dbPush, m as renderHelp, n as bareGroupStartPath, o as recordResolved, p as renderCommandList, r as runMenu, s as reproducibleCommand, t as catalog, u as dbPushDryRun } from "./catalog-D7eGX7cD.js";
 import { a as repoPeerUrl, n as loadEnv, r as loadEnvLoad, t as getEnvSync } from "./peers-DE07w6nT.js";
 import { t as nonEmpty } from "./connection-D3XsOE3S.js";
 import { a as wouldRunLine, n as isDryRun, t as dryRunKind } from "./dry-run-OzO0jUhK.js";
 import { a as explainError, i as explain, n as bail, o as unwrap, r as errorMessage } from "./ui-RFZyr6k_.js";
 import { t as DONE } from "./dispatch-D048O65I.js";
 import { t as EnvDocument } from "./document-DumoZXoO.js";
-import { a as listSecrets$1, c as updateSecret, i as createSecret, o as projectIdFor, r as byKey, s as setExplicitAccessToken } from "./client-Djo8fRdS.js";
+import { a as listSecrets$1, c as updateSecret, i as createSecret, o as projectIdFor, r as byKey, s as setExplicitAccessToken } from "./client-CFhbS3nu.js";
 import { register } from "node:module";
 import { pathToFileURL } from "node:url";
 import { appendFileSync, existsSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { basename, join, resolve } from "node:path";
 import { confirm, intro, log, note, outro, select } from "@clack/prompts";
-import { chmod, readFile, writeFile } from "node:fs/promises";
+import { chmod, readFile, readdir, writeFile } from "node:fs/promises";
 import { execFile, execFileSync, spawn } from "node:child_process";
 import { promisify } from "node:util";
 import { tmpdir } from "node:os";
@@ -491,6 +491,103 @@ function summary(lines, env = process.env) {
 	appendFileSync(path, `${lines.join("\n")}\n`);
 }
 //#endregion
+//#region src/deploy/avatars.ts
+/**
+* `backstage deploy avatars`: the seeded headshots, uploaded where missing.
+*
+* `supabase db push --include-seed` runs the seed SQL but never touches
+* Storage, so a new officer's profile reached a hosted tier without their
+* photo. `supabase seed buckets` would upload it, but it sends every file with
+* `x-upsert: true`, and the app stores an officer's own upload at the same key
+* (`avatars/<user id>`, also upserted). Run on every deploy, it would put the
+* seed photo back over whatever the officer chose since.
+*
+* So this uploads each file under a bucket's `objects_path` WITHOUT upsert,
+* and Storage's duplicate refusal is the "already there" answer. That makes it
+* insert-only, like the seed SQL beside it: a photo is added once and never
+* replaced, and there is no check-then-write race to lose.
+*
+* Reads `API_URL` (else `https://<PROJECT_REF>.supabase.co`) and `SECRET_KEY`
+* from the step's own `env:`, like the other credential-holding steps.
+*/
+/**
+* Every `[storage.buckets.<name>]` in `supabase/config.toml` that declares an
+* `objects_path`. A line scan rather than a TOML parser: the two keys are
+* flat, quoted and always written this way by the Supabase template, and a
+* table header ends the previous section.
+*/
+function seededBuckets(configToml, supabaseDir) {
+	const found = [];
+	let bucket;
+	for (const line of configToml.split("\n")) {
+		const header = /^\s*\[([^\]]+)\]\s*$/.exec(line);
+		if (header) {
+			bucket = /^storage\.buckets\.([A-Za-z0-9_-]+)$/.exec(header[1].trim())?.[1];
+			continue;
+		}
+		const path = /^\s*objects_path\s*=\s*"([^"]+)"/.exec(line);
+		if (bucket && path) found.push({
+			bucket,
+			dir: resolve(supabaseDir, path[1])
+		});
+	}
+	return found;
+}
+/** The content type Storage needs, from the bytes; the seeds have no extension. */
+function sniffImageType(bytes) {
+	const ascii = (from, to) => String.fromCharCode(...bytes.subarray(from, to));
+	if (ascii(0, 4) === "RIFF" && ascii(8, 12) === "WEBP") return "image/webp";
+	if (bytes[0] === 137 && ascii(1, 4) === "PNG") return "image/png";
+	if (bytes[0] === 255 && bytes[1] === 216) return "image/jpeg";
+}
+/**
+* POST without `x-upsert`. Storage refuses a duplicate key with 409, or (older
+* Storage) a 400 whose body says `"statusCode":"409"` / `"Duplicate"`.
+*/
+async function uploadIfMissing(apiUrl, secretKey, bucket, name, bytes, contentType, fetchImpl = fetch) {
+	const res = await fetchImpl(`${apiUrl.replace(/\/+$/, "")}/storage/v1/object/${encodeURIComponent(bucket)}/${encodeURIComponent(name)}`, {
+		method: "POST",
+		headers: {
+			apikey: secretKey,
+			Authorization: `Bearer ${secretKey}`,
+			"Content-Type": contentType,
+			"x-upsert": "false"
+		},
+		body: bytes
+	});
+	if (res.ok) return "uploaded";
+	const body = await res.text().catch(() => "");
+	if (res.status === 409 || /"statusCode"\s*:\s*"409"|Duplicate/i.test(body)) return "exists";
+	throw new DeployError(`Uploading ${bucket}/${name} failed (HTTP ${res.status}).`, [body.slice(0, 300) || "Storage gave no reason."]);
+}
+async function runDeployAvatars(env = process.env, deps = {}) {
+	const ref = nonEmpty(env.PROJECT_REF);
+	const apiUrl = nonEmpty(env.API_URL) ?? (ref ? `https://${ref}.supabase.co` : void 0);
+	const secretKey = nonEmpty(env.SECRET_KEY);
+	if (!apiUrl || !secretKey) throw new DeployError(`${apiUrl ? "SECRET_KEY" : "API_URL (or PROJECT_REF)"} is not set — refusing to upload.`, [
+		"This step reads the Storage endpoint and the tier's secret key from",
+		"its own env: block. An empty value usually means the workflow step",
+		"lost it, or the environment never had it."
+	]);
+	const supabaseDir = join(deps.root ?? findRepoRoot(), "supabase");
+	const config = await readFile(join(supabaseDir, "config.toml"), "utf8");
+	let uploaded = 0;
+	let existing = 0;
+	for (const { bucket, dir } of seededBuckets(config, supabaseDir)) {
+		const names = (await readdir(dir, { withFileTypes: true })).filter((e) => e.isFile() && !e.name.startsWith(".")).map((e) => e.name).sort();
+		for (const name of names) {
+			const bytes = new Uint8Array(await readFile(join(dir, name)));
+			const type = sniffImageType(bytes);
+			if (!type) throw new DeployError(`${bucket}/${name} is not a WebP, PNG or JPEG.`);
+			if (await uploadIfMissing(apiUrl, secretKey, bucket, name, bytes, type, deps.fetch) === "uploaded") {
+				uploaded++;
+				say([`deploy avatars: uploaded ${bucket}/${name}`]);
+			} else existing++;
+		}
+	}
+	say([`deploy avatars: ${uploaded} uploaded, ${existing} already there (left alone).`]);
+}
+//#endregion
 //#region src/deploy/migrations.ts
 /**
 * `backstage deploy plan` and `deploy migrate`.
@@ -525,10 +622,10 @@ const MISSING_DB_URL = [
 * the caller distinguish the two stages (`main`'s early plan vs the one taken
 * seconds before the apply); it is the only thing that varies between them.
 */
-async function runDeployPlan(label = "Migration plan", env = process.env, plan = dbPushDryRun) {
+async function runDeployPlan(label = "Migration plan", env = process.env, plan, { includeSeed = false } = {}) {
 	const url = env.DB_URL;
 	if (!url) throw new DeployError("DB_URL is not set — refusing to plan.", MISSING_DB_URL);
-	const text = await plan(url);
+	const text = await (plan ?? ((u) => dbPushDryRun(u, { includeSeed })))(url);
 	say([text]);
 	summary([
 		`### ${label}`,
@@ -541,16 +638,19 @@ async function runDeployPlan(label = "Migration plan", env = process.env, plan =
 /**
 * Apply the migrations to DB_URL.
 *
-* `dbPush(url, { yes: true })` — the bare push, WITHOUT the type regeneration
+* `dbPush(url, { yes: true, includeSeed })` — the bare push, WITHOUT the type regeneration
 * the contributor path layers on, so a production apply never writes back into
 * the checkout. A non-zero exit becomes a DeployError so the job fails with a
 * line a person can read; the supabase CLI's own output (inherited stdio) says
 * why above it.
 */
-async function runDeployMigrate(env = process.env, push = (url) => dbPush(url, { yes: true })) {
+async function runDeployMigrate(env = process.env, push, { includeSeed = false } = {}) {
 	const url = env.DB_URL;
 	if (!url) throw new DeployError("DB_URL is not set — refusing to migrate.", MISSING_DB_URL);
-	const code = await push(url);
+	const code = await (push ?? ((u) => dbPush(u, {
+		yes: true,
+		includeSeed
+	})))(url);
 	if (code !== 0) throw new DeployError(`\`supabase db push\` failed (exit ${code}).`, ["The migration was not applied. The supabase CLI output above says why."]);
 	say(["deploy migrate: migrations applied."]);
 }
@@ -1664,11 +1764,11 @@ function renderWriteEnvReport(result) {
 * deploy` from the app dir resolves through it with no `--config` needed.
 * Both apps share one deploy step.
 *
-* Steps (`write-env`, `preflight`, `plan`, `migrate`, `smoke`, `reconcile`,
-* `prune-monitors`) are individually addressable for jobs that run only one.
-* The ones that hold a single credential in the job's own `env:` block and
-* compose no env file (`preflight`, `plan`, `migrate`, `smoke`, `reconcile`,
-* `prune-monitors`), and `write-env`,
+* Steps (`write-env`, `preflight`, `plan`, `migrate`, `avatars`, `smoke`,
+* `reconcile`, `prune-monitors`) are individually addressable for jobs that run
+* only one. The ones that hold their credentials in the job's own `env:` block
+* and compose no env file (`preflight`, `plan`, `migrate`, `avatars`, `smoke`,
+* `reconcile`, `prune-monitors`), and `write-env`,
 * which CREATES the file tier resolution would otherwise insist on reading,
 * run with `--no-env`.
 */
@@ -1786,18 +1886,22 @@ function renderDeployFailure(label, err) {
 }
 /** Whether a dry run stops before this step, because the step writes. */
 function writesWhenLive(sub) {
-	return sub === "write-env" || sub === "migrate";
+	return sub === "write-env" || sub === "migrate" || sub === "avatars";
 }
 /**
 * The steps, by name.
 */
 async function runStep(sub, rest) {
 	if (sub === "plan") {
-		await runDeployPlan(flagValue(rest, "--label"));
+		await runDeployPlan(flagValue(rest, "--label"), process.env, void 0, { includeSeed: rest.includes("--include-seed") });
 		return true;
 	}
 	if (sub === "migrate") {
-		await runDeployMigrate();
+		await runDeployMigrate(process.env, void 0, { includeSeed: rest.includes("--include-seed") });
+		return true;
+	}
+	if (sub === "avatars") {
+		await runDeployAvatars();
 		return true;
 	}
 	if (sub === "preflight") {
@@ -4835,11 +4939,17 @@ const handleGithub = async (rest) => {
 * production" from `main`, so whatever it authenticates with is reachable
 * from the `main` trust tier. The plan refuses even a general read-only role
 * there, because that puts every row of production data behind that boundary.
-* What is left is a role that can read the migrations-history table and
-* nothing else. Two grants are the whole of it:
+* What is left is a role that can read the CLI's two ledgers and nothing
+* else. Three grants are the whole of it:
 *
 *   grant usage  on schema supabase_migrations            to migration_planner;
 *   grant select on supabase_migrations.schema_migrations to migration_planner;
+*   grant select on supabase_migrations.seed_files        to migration_planner;
+*
+* The third lets the dry run plan seeds too (`deploy plan --include-seed`).
+* `seed_files` holds a path and a content hash per seed file, no member data.
+* The CLI creates it on the first seeded push, so the grant is skipped while
+* it does not exist, and `planner status` says when it is missing.
 *
 * This module is the pure half: names, SQL text, password generation, URL
 * derivation. Everything that talks to a database lives beside it.
@@ -4860,9 +4970,15 @@ function createRoleSql(password) {
 	return [
 		`create role ${PLANNER_ROLE} login password '${password}'`,
 		`grant usage on schema supabase_migrations to ${PLANNER_ROLE}`,
-		`grant select on supabase_migrations.schema_migrations to ${PLANNER_ROLE}`
+		`grant select on supabase_migrations.schema_migrations to ${PLANNER_ROLE}`,
+		GRANT_SEED_FILES
 	];
 }
+/**
+* The seed-ledger grant, applied only when the table exists. Also what
+* `planner status` tells you to run when it is missing.
+*/
+const GRANT_SEED_FILES = `do \$\$ begin if to_regclass('supabase_migrations.seed_files') is not null then grant select on supabase_migrations.seed_files to ${PLANNER_ROLE}; end if; end \$\$`;
 /** ALTER ROLE, same interpolation contract as `createRoleSql`. */
 function resetPasswordSql(password) {
 	return `alter role ${PLANNER_ROLE} password '${password}'`;
@@ -4901,6 +5017,8 @@ function plannerUrlFrom(adminUrl, password) {
 *   1. Who did Postgres authenticate? (`current_user`)
 *   2. Can it read an application schema? (it must not)
 *   3. Can it read the migrations table? (it must, the dry run is next)
+*   4. Can it read the seed ledger? (it must, once the table exists, for
+*      `deploy plan --include-seed`)
 *
 * Shared between `deploy require-planner` (which turns a bad answer into a
 * red CI job) and `planner create` / `planner reset-password` (which run the
@@ -4923,6 +5041,7 @@ const CHECK_IDENTITY = "select current_user as who";
 */
 const CHECK_OVERREACH = "select * from platform.profile limit 1";
 const CHECK_MIGRATIONS = "select count(*)::int as n from supabase_migrations.schema_migrations";
+const CHECK_SEEDS = "select count(*)::int as n from supabase_migrations.seed_files";
 /**
 * Runs the three checks over an OPEN connection; never closes it.
 *
@@ -4967,11 +5086,27 @@ async function checkPlanner(db) {
 			problem: `${PLANNER_ROLE} cannot read supabase_migrations.schema_migrations, so the migration dry run would fail right after this. Re-apply the two grants (see planner/role.ts).`
 		};
 	}
+	try {
+		const [row] = await db.run(CHECK_SEEDS);
+		lines.push(`can read supabase_migrations.seed_files (${String(row?.n)} rows)`);
+	} catch (error) {
+		if (isMissingTable(error)) lines.push("no supabase_migrations.seed_files yet (no seeded push)");
+		else return {
+			ok: false,
+			lines,
+			problem: `${PLANNER_ROLE} cannot read supabase_migrations.seed_files, so \`deploy plan --include-seed\` would fail. As an admin, run: grant select on supabase_migrations.seed_files to ${PLANNER_ROLE};`
+		};
+	}
 	return {
 		ok: true,
 		lines
 	};
 }
+/** Postgres 42P01 (undefined_table), with a text fallback. */
+function isMissingTable(error) {
+	const e = error;
+	return e.code === "42P01" || /relation "?[\w.]*seed_files"? does not exist/i.test(e.message ?? "");
+}
 /** Postgres 3F000 (invalid_schema_name), with a text fallback. */
 function isMissingSchema(error) {
 	const e = error;
@@ -5064,7 +5199,7 @@ const QUERY_ROLE = `select rolcanlogin from pg_roles where rolname = '${PLANNER_
 * it strands a grant-less role behind a refusal to re-run.
 */
 const QUERY_SCHEMA = "select 1 from pg_namespace where nspname = 'supabase_migrations'";
-const QUERY_GRANTS = `select has_schema_privilege('${PLANNER_ROLE}', 'supabase_migrations', 'usage') as schema_usage, has_table_privilege('${PLANNER_ROLE}', 'supabase_migrations.schema_migrations', 'select') as table_select`;
+const QUERY_GRANTS = `select has_schema_privilege('${PLANNER_ROLE}', 'supabase_migrations', 'usage') as schema_usage, has_table_privilege('${PLANNER_ROLE}', 'supabase_migrations.schema_migrations', 'select') as table_select, to_regclass('supabase_migrations.seed_files') is not null as seed_table, case when to_regclass('supabase_migrations.seed_files') is null then false else has_table_privilege('${PLANNER_ROLE}', 'supabase_migrations.seed_files', 'select') end as seed_select`;
 /**
 * Membership is the quiet way a "narrow" role widens: `grant postgres to
 * migration_planner` leaves both privilege queries above looking correct.
@@ -5147,7 +5282,7 @@ async function inspectRole(connect, admin) {
 		if (!schemaReady) lines.push("⚠️ the supabase_migrations schema DOES NOT EXIST on this database — the grants below cannot hold and the dry run cannot plan. Initialize the migration history, then `planner reset-password` will re-verify (or `planner drop` and re-run `planner create`).");
 		if (schemaReady) {
 			const [grants] = await db.run(QUERY_GRANTS);
-			lines.push(grants?.schema_usage ? "has usage on supabase_migrations" : "⚠️ MISSING usage on supabase_migrations", grants?.table_select ? "has select on supabase_migrations.schema_migrations" : "⚠️ MISSING select on supabase_migrations.schema_migrations");
+			lines.push(grants?.schema_usage ? "has usage on supabase_migrations" : "⚠️ MISSING usage on supabase_migrations", grants?.table_select ? "has select on supabase_migrations.schema_migrations" : "⚠️ MISSING select on supabase_migrations.schema_migrations", !grants?.seed_table ? "no supabase_migrations.seed_files yet (granted on the next create once it exists)" : grants.seed_select ? "has select on supabase_migrations.seed_files" : `⚠️ MISSING select on supabase_migrations.seed_files — grant select on supabase_migrations.seed_files to ${PLANNER_ROLE};`);
 		}
 		const memberships = await db.run(QUERY_MEMBERSHIPS);
 		lines.push(memberships.length === 0 ? "member of no other role" : `⚠️ MEMBER OF: ${memberships.map((m) => String(m.rolname)).join(", ")} — inherited privileges reach past the validated pair`);
@@ -5250,7 +5385,7 @@ async function runPlannerCreate(options = {}) {
 	const connect = options.connect ?? connectDb;
 	const admin = await adminUrl(options);
 	if (!unwrap(await confirm({
-		message: `Create role migration_planner on the PRODUCTION database, with its two grants and a generated password?`,
+		message: `Create role migration_planner on the PRODUCTION database, with its three grants and a generated password?`,
 		initialValue: false
 	}))) bail();
 	await withDb(connect, admin, async (db) => {
@@ -5265,7 +5400,7 @@ async function runPlannerCreate(options = {}) {
 			await db.run("rollback").catch(() => void 0);
 			throw error;
 		}
-		log.success(`Created ${PLANNER_ROLE} with the two validated grants.`);
+		log.success(`Created ${PLANNER_ROLE} with the validated grants.`);
 		await verifyAndStore(connect, admin, password);
 	});
 }
@@ -5389,9 +5524,9 @@ const HANDLERS = {
 	graphics: async (rest) => (await import("./commands-BAh2_Nds.js")).handleGraphics(rest),
 	qr: async (rest) => (await import("./commands-DILvdMc2.js")).handleQr(rest),
 	newsletter: async (rest) => (await import("./commands-C3_hAcZS.js")).handleNewsletter(rest),
-	creds: async (rest) => (await import("./commands-C6w8jm6a.js")).handleCreds(rest),
-	import: async (rest) => (await import("./commands-DfWNSPra.js")).handleImport(rest),
-	export: async (rest) => (await import("./commands-3HvxDq-2.js")).handleExport(rest)
+	creds: async (rest) => (await import("./commands-CTQjJ45_.js")).handleCreds(rest),
+	import: async (rest) => (await import("./commands-DfQKdPJY.js")).handleImport(rest),
+	export: async (rest) => (await import("./commands-BEYZyI4Y.js")).handleExport(rest)
 };
 /**
 * Names that were commands of the contributor CLI, refused with where they

package/dist/{client-Djo8fRdS.js → client-CFhbS3nu.js}

@@ -2,7 +2,7 @@ import { w as findRepoRoot } from "./telemetry-RNK5Wu74.js";
 import { n as loadEnv } from "./peers-DE07w6nT.js";
 import { o as unwrap } from "./ui-RFZyr6k_.js";
 import { t as EnvDocument } from "./document-DumoZXoO.js";
-import { a as readTokenFromVault, o as saveTokenToVault, t as VAULT_ITEM_NAME } from "./vault-BpYSYcuT.js";
+import { a as readTokenFromVault, s as saveTokenToVault, t as VAULT_ITEM_NAME } from "./vault-DVmaQC_E.js";
 import { dirname, join, resolve } from "node:path";
 import { log, password, select, text } from "@clack/prompts";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
@@ -66,7 +66,7 @@ function looksLikeAccessToken(value) {
 async function promptForToken() {
 	if (!process.stdin.isTTY) return void 0;
 	const typed = unwrap(await password({
-		message: "Paste the Secrets Manager access token for the `admin` account",
+		message: "Paste your own Secrets Manager access token (`admin` machine account)",
 		mask: "•",
 		validate: (v) => (v ?? "").trim() === "" ? "An access token is required." : void 0
 	})).trim();

package/dist/client-CJPfmtwW.js

@@ -0,0 +1,2 @@
+import { a as listSecrets, o as projectIdFor } from "./client-CFhbS3nu.js";
+export { listSecrets, projectIdFor };

package/dist/{commands-3HvxDq-2.js → commands-BEYZyI4Y.js}

@@ -2,8 +2,8 @@ import { n as isDryRun } from "./dry-run-OzO0jUhK.js";
 import { o as unwrap, r as errorMessage, t as UsageError } from "./ui-RFZyr6k_.js";
 import { i as exportParams, n as EXPORT_KINDS, r as auditFilters, t as EXPORTS } from "./queries-D3mTchag.js";
 import { t as DONE } from "./dispatch-D048O65I.js";
-import { c as ProductionError, d as requireProductionKey, i as plural, l as connect, o as reportFailure, r as expandHome, s as say, t as canPrompt, u as dbError } from "./cli-B7W_-WdD.js";
-import { i as parseBound, n as findMeetingsWith, r as pickMeeting, t as describeMeeting } from "./meetings-BAX4Sils.js";
+import { c as ProductionError, d as requireProductionKey, i as plural, l as connect, o as reportFailure, r as expandHome, s as say, t as canPrompt, u as dbError } from "./cli-CqbqBpaT.js";
+import { i as parseBound, n as findMeetingsWith, r as pickMeeting, t as describeMeeting } from "./meetings-QgVEoBIV.js";
 import { existsSync, readdirSync, statSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
 import { autocomplete, confirm, multiselect, text } from "@clack/prompts";

package/dist/{commands-C6w8jm6a.js → commands-CTQjJ45_.js}

@@ -3,7 +3,7 @@ import { t as nonEmpty } from "./connection-D3XsOE3S.js";
 import { a as explainError, i as explain, o as unwrap, r as errorMessage, t as UsageError } from "./ui-RFZyr6k_.js";
 import { t as DONE } from "./dispatch-D048O65I.js";
 import { t as EnvDocument } from "./document-DumoZXoO.js";
-import { i as readPasswordFromVault, n as bwArgs, r as openVault, s as bwCommand } from "./vault-BpYSYcuT.js";
+import { c as bwCommand, i as readPasswordFromVault, n as bwArgs, o as savePasswordToVault, r as openVault } from "./vault-DVmaQC_E.js";
 import { resolve } from "node:path";
 import { confirm, log, multiselect, note, password, select, text } from "@clack/prompts";
 import { readFile } from "node:fs/promises";
@@ -632,7 +632,7 @@ async function readCheckoutDbUrl() {
 	}
 }
 async function readSecretsManagerDbUrl() {
-	const { listSecrets, projectIdFor } = await import("./client-DCRfKvpP.js");
+	const { listSecrets, projectIdFor } = await import("./client-CJPfmtwW.js");
 	const secrets = await listSecrets(await projectIdFor(PRODUCTION_PROJECT));
 	return nonEmpty(secrets.find((s) => s.key === "DB_URL")?.value);
 }
@@ -660,6 +660,12 @@ function rosterQueryFor(url) {
 		}
 	};
 }
+/**
+* In the officer's PERSONAL vault, never the DevDogs organization: a Linear
+* key acts as the person who made it, so a shared one would put every edit to
+* the document under one name. It would also be an organization login that
+* `creds send` could hand out.
+*/
 const LINEAR_VAULT_ITEM = "DevDogs Linear API key (backstage)";
 const LINEAR_API = "https://api.linear.app/graphql";
 function cell(text) {
@@ -695,21 +701,36 @@ function renderReport(items, now, roster) {
 	return `${lines.join("\n")}\n`;
 }
 /**
-* `--linear-token`, then `LINEAR_API_KEY`, then the vault item, then a prompt.
-* Never saved anywhere: the vault is where it lives.
+* `--linear-token`, then `LINEAR_API_KEY`, then your personal vault item, then
+* a prompt, which offers to save what was typed to your personal vault.
 */
 async function resolveLinearToken(sources) {
-	const token = nonEmpty(sources.explicit) ?? nonEmpty(sources.env) ?? await (sources.fromVault ?? readLinearTokenFromVault)() ?? await (sources.prompt ?? promptForLinearToken)();
-	if (!token) throw new CredsError(`No Linear API key. Set LINEAR_API_KEY, or store one in your vault as "${LINEAR_VAULT_ITEM}".`);
-	registerSecret(token);
-	return token;
+	const token = nonEmpty(sources.explicit) ?? nonEmpty(sources.env) ?? await (sources.fromVault ?? readLinearTokenFromVault)();
+	if (token) {
+		registerSecret(token);
+		return token;
+	}
+	const typed = await (sources.prompt ?? promptForLinearToken)();
+	if (!typed) throw new CredsError(`No Linear API key. Set LINEAR_API_KEY, or store your own in your personal vault as "${LINEAR_VAULT_ITEM}".`);
+	registerSecret(typed);
+	await (sources.offerSave ?? offerToSaveLinearToken)(typed);
+	return typed;
 }
 function readLinearTokenFromVault() {
 	return readPasswordFromVault(LINEAR_VAULT_ITEM, "the Linear API key", "read the Linear API key", "LINEAR_API_KEY");
 }
+async function offerToSaveLinearToken(token) {
+	if (!process.stdin.isTTY) return;
+	if (!unwrap(await confirm({
+		message: `Save it to your personal Bitwarden vault as "DevDogs Linear API key (backstage)"?`,
+		initialValue: true
+	}))) return;
+	if (await savePasswordToVault("DevDogs Linear API key (backstage)", "Your own Linear API key, read by `backstage creds` to update the Shared Accounts document. Keep it in your personal vault, never the DevDogs organization: Linear records every edit under the key's owner.", token, "save the Linear API key")) log.success(`Stored as "${LINEAR_VAULT_ITEM}" in your vault.`);
+	else log.warn("Could not save it; continuing with the key you typed.");
+}
 async function promptForLinearToken() {
 	if (!process.stdin.isTTY) return void 0;
-	const value = unwrap(await password({ message: "Linear API key? (Settings → Security & access → API keys)" }));
+	const value = unwrap(await password({ message: "Your Linear API key? (Settings → Security & access → API keys)" }));
 	return nonEmpty(value.trim());
 }
 /** Replaces the document's content. Returns its URL. */

package/dist/{commands-DfWNSPra.js → commands-DfQKdPJY.js}

@@ -2,8 +2,8 @@ import { i as explain } from "./ui-RFZyr6k_.js";
 //#region src/import/commands.ts
 const handleImport = async (rest) => {
 	const [what, ...args] = rest;
-	if (what === "involvement") return (await import("./commands-B25Vafxz.js")).handleInvolvement(args);
-	if (what === "attendance") return (await import("./commands-D-Vvufb0.js")).handleAttendance(args);
+	if (what === "involvement") return (await import("./commands-DsyAE7BO.js")).handleInvolvement(args);
+	if (what === "attendance") return (await import("./commands-H4DGzVqb.js")).handleAttendance(args);
 	explain(what ? `Unknown import "${what}". Try involvement or attendance.` : "Name the import: involvement or attendance.", "");
 	process.exitCode = 1;
 	return null;

package/dist/{commands-B25Vafxz.js → commands-DsyAE7BO.js}

@@ -1,8 +1,8 @@
 import { n as isDryRun } from "./dry-run-OzO0jUhK.js";
 import { r as errorMessage, t as UsageError } from "./ui-RFZyr6k_.js";
 import { t as DONE } from "./dispatch-D048O65I.js";
-import { a as readInputFile, d as requireProductionKey, f as withConnection, i as plural, n as confirmWrite, o as reportFailure, s as say, t as canPrompt } from "./cli-B7W_-WdD.js";
-import { a as createAccounts, i as createAccountFor, n as accountFinder, o as readAccounts, t as parseCsv } from "./read-Dd388anq.js";
+import { a as readInputFile, d as requireProductionKey, f as withConnection, i as plural, n as confirmWrite, o as reportFailure, s as say, t as canPrompt } from "./cli-CqbqBpaT.js";
+import { a as createAccounts, i as createAccountFor, n as accountFinder, o as readAccounts, t as parseCsv } from "./read-DMderLHG.js";
 import { parseArgs } from "node:util";
 //#region src/involvement/csv.ts
 /**

package/dist/{commands-D-Vvufb0.js → commands-H4DGzVqb.js}

@@ -1,9 +1,9 @@
 import { n as isDryRun } from "./dry-run-OzO0jUhK.js";
 import { o as unwrap, r as errorMessage, t as UsageError } from "./ui-RFZyr6k_.js";
 import { t as DONE } from "./dispatch-D048O65I.js";
-import { a as readInputFile, c as ProductionError, d as requireProductionKey, f as withConnection, i as plural, l as connect, n as confirmWrite, o as reportFailure, s as say, t as canPrompt } from "./cli-B7W_-WdD.js";
-import { a as createAccounts, i as createAccountFor, n as accountFinder, r as accountsWith, t as parseCsv } from "./read-Dd388anq.js";
-import { n as findMeetingsWith, r as pickMeeting, t as describeMeeting } from "./meetings-BAX4Sils.js";
+import { a as readInputFile, c as ProductionError, d as requireProductionKey, f as withConnection, i as plural, l as connect, n as confirmWrite, o as reportFailure, s as say, t as canPrompt } from "./cli-CqbqBpaT.js";
+import { a as createAccounts, i as createAccountFor, n as accountFinder, r as accountsWith, t as parseCsv } from "./read-DMderLHG.js";
+import { n as findMeetingsWith, r as pickMeeting, t as describeMeeting } from "./meetings-QgVEoBIV.js";
 import { text } from "@clack/prompts";
 import { parseArgs } from "node:util";
 //#region src/attendance/plan.ts

package/dist/launch.js

@@ -1,5 +1,5 @@
 import { C as discoverRepoRoot, E as setCliName, S as RepoNotFoundError, T as cliName, _ as installFailureLog, d as hasYes, g as stripTierFlag, h as stripNoEnvFlag, m as setNoEnv, n as captureDevtoolsError, o as initDevtoolsTelemetry, p as isNonInteractive, s as lastSentryEventId } from "./telemetry-RNK5Wu74.js";
-import { c as setMenuEnvHook, d as formatCommand, f as helpPath, n as bareGroupStartPath, t as catalog } from "./catalog-BLgY4knB.js";
+import { c as setMenuEnvHook, d as formatCommand, f as helpPath, n as bareGroupStartPath, t as catalog } from "./catalog-D7eGX7cD.js";
 import { i as loadEnvSession, r as loadEnvLoad } from "./peers-DE07w6nT.js";
 import { t as nonEmpty } from "./connection-D3XsOE3S.js";
 import { i as setDryRun, n as isDryRun, r as resolveDryRun } from "./dry-run-OzO0jUhK.js";
@@ -322,7 +322,7 @@ async function launchWith(argv, options) {
 */
 async function launch(argv) {
 	await launchWith(argv, { dispatch: async (args) => {
-		const { main } = await import("./cli-Bv5hcXnG.js");
+		const { main } = await import("./cli-xqblG51R.js");
 		await main(args);
 	} });
 }

package/dist/{meetings-BAX4Sils.js → meetings-QgVEoBIV.js}

@@ -1,5 +1,5 @@
 import { t as UsageError } from "./ui-RFZyr6k_.js";
-import "./cli-B7W_-WdD.js";
+import "./cli-CqbqBpaT.js";
 //#region src/production/time.ts
 /**
 * Dates as officers type them. Meetings happen in Athens, so a bare

package/dist/{read-Dd388anq.js → read-DMderLHG.js}

@@ -1,5 +1,5 @@
 import { r as errorMessage } from "./ui-RFZyr6k_.js";
-import { c as ProductionError, f as withConnection } from "./cli-B7W_-WdD.js";
+import { c as ProductionError, f as withConnection } from "./cli-CqbqBpaT.js";
 //#region src/production/accounts.ts
 /**
 * Production accounts: reading them, finding one by email, and creating the

package/dist/{vault-BpYSYcuT.js → vault-DVmaQC_E.js}

@@ -50,9 +50,14 @@ function bwCommand(args) {
 * prerequisite.
 *
 * ⚠️ The token never passes through argv in either direction. Reads use
-* `bw get password <search>`, which puts only the item NAME on the command
+* `bw list items --search <name>`, which puts only the item NAME on the command
 * line, and writes pipe base64 JSON through **stdin**, which `bw create item`
 * documents as an accepted input.
+*
+* ⚠️ Only the PERSONAL vault. A token read from, or saved to, an organization
+* item would be one token for everybody who can see that item: every call made
+* with it looks the same, and revoking one person means revoking everyone.
+* Reads skip organization items and say so; writes set no organization.
 */
 const run = promisify(execFile);
 /**
@@ -177,20 +182,20 @@ function bwArgs(args, key) {
 		key
 	] : withNoInteraction;
 }
-/**
-* The stored token, or `undefined` for every reason it might not be there.
-*
-* `bw get password` takes a search term and fails when it matches more than one
-* item, which is the behaviour worth having: two items called something like
-* this means somebody should look, not that this should guess.
-*/
+/** The stored token, or `undefined` for every reason it might not be there. */
 async function readTokenFromVault() {
 	return readPasswordFromVault(VAULT_ITEM_NAME, "the access token", "look for the access token", "BWS_ACCESS_TOKEN");
 }
 /**
-* The password of the one vault item named `itemName`, or `undefined` for
-* every reason it might not be there. `what` names it in the spinner; `purpose`
-* finishes the sign-in and unlock questions.
+* The password of the one PERSONAL vault item named exactly `itemName`, or
+* `undefined` for every reason it might not be there. `what` names it in the
+* spinner; `purpose` finishes the sign-in and unlock questions.
+*
+* `bw list items --search` rather than `bw get password`: `get` takes the
+* first item it can see, organization items included, and an item of that
+* name in an organization is precisely the shared token this must not use.
+* Two personal items of the same name mean somebody should look, not that
+* this should guess, so that is "not found" too.
 */
 async function readPasswordFromVault(itemName, what, purpose, envVar) {
 	const status = await signInIfNeeded(await vaultStatus(), purpose);
@@ -202,34 +207,49 @@ async function readPasswordFromVault(itemName, what, purpose, envVar) {
 	if (status === "locked" && !key) return void 0;
 	const s = spinner();
 	s.start("Looking in your Bitwarden vault");
+	let items;
 	try {
 		const { stdout } = await run(...bwCommand(bwArgs([
-			"get",
-			"password",
-			itemName,
-			"--raw"
-		], key)), { shell: false });
-		const token = stdout.trim();
-		if (token === "") {
-			s.stop("Nothing stored in the vault yet");
-			return;
-		}
+			"list",
+			"items",
+			"--search",
+			itemName
+		], key)), {
+			shell: false,
+			maxBuffer: 16777216
+		});
+		items = JSON.parse(stdout).filter((item) => item.name === itemName);
+	} catch {
+		s.stop("Could not read your Bitwarden vault");
+		return;
+	}
+	const personal = items.filter((item) => !item.organizationId);
+	if (personal.length > 1) {
+		s.stop(`More than one "${itemName}" in your vault; delete the extras`);
+		return;
+	}
+	const token = personal[0]?.login?.password?.trim();
+	if (token) {
 		s.stop(`Read ${what} from your vault ("${itemName}")`);
 		return token;
-	} catch {
-		s.stop("No single matching item in your vault");
+	}
+	if (items.length > personal.length) {
+		s.stop(`"${itemName}" is in an organization, not your personal vault`);
+		log.warn(`Not using it: an organization item is one ${what} for everyone who can see it, so nothing it does can be told apart. Use your own, saved in your personal vault (no organization).`);
 		return;
 	}
+	s.stop("Nothing stored in the vault yet");
 }
 /**
-* Creates the item, with the token arriving on **stdin** as base64 JSON.
+* Saves `token` as a login item named `itemName` in the PERSONAL vault, the
+* token arriving on **stdin** as base64 JSON.
 *
 * `bw create item` documents an encoded-JSON positional AND stdin. Using stdin
 * is the difference between a live credential that is invisible and one that
-* sits in `ps` output for the length of the call.
+* sits in `ps` output for the length of the call. `organizationId: null` is
+* what makes it personal, and it is not a parameter.
 */
-async function saveTokenToVault(token) {
-	const purpose = "save the access token";
+async function savePasswordToVault(itemName, notes, token, purpose) {
 	const status = await signInIfNeeded(await vaultStatus(), purpose);
 	if (status === "unavailable" || status === "unauthenticated") return false;
 	const key = await session(status, purpose);
@@ -239,8 +259,8 @@ async function saveTokenToVault(token) {
 		collectionIds: null,
 		folderId: null,
 		type: 1,
-		name: VAULT_ITEM_NAME,
-		notes: "Bitwarden Secrets Manager access token for the `admin` machine account, read/write on preflight, staging and production.\n\nRead automatically by `backstage env`. Never put this in a .env file: it unlocks all three projects, and the tool refuses to upload it.",
+		name: itemName,
+		notes,
 		favorite: false,
 		reprompt: 0,
 		login: {
@@ -268,10 +288,14 @@ async function saveTokenToVault(token) {
 		child.stdin.end(Buffer.from(JSON.stringify(item)).toString("base64"));
 	});
 }
+/** Saves the Secrets Manager access token. See {@link savePasswordToVault}. */
+function saveTokenToVault(token) {
+	return savePasswordToVault(VAULT_ITEM_NAME, "Your own Bitwarden Secrets Manager access token for the `admin` machine account, read/write on preflight, staging and production.\n\nRead automatically by `backstage env`. Keep it in your personal vault, never an organization: one token per person is what keeps calls attributable and lets one person's be revoked alone. Never put this in a .env that leaves this machine: it unlocks all three projects, and the tool refuses to upload it.", token, "save the access token");
+}
 /** Why the vault could not be used, phrased as something to do about it. */
 function explainVault(status, envVar = "BWS_ACCESS_TOKEN") {
 	if (status === "unavailable") return "The `bw` CLI is not installed, so the vault could not be checked. It ships with backstage, so reinstall it.";
 	if (status === "unauthenticated") return `You are not signed in to Bitwarden, and with no terminal there is nobody to sign in. Set ${envVar} instead.`;
 }
 //#endregion
-export { readTokenFromVault as a, readPasswordFromVault as i, bwArgs as n, saveTokenToVault as o, openVault as r, bwCommand as s, VAULT_ITEM_NAME as t };
+export { readTokenFromVault as a, bwCommand as c, readPasswordFromVault as i, bwArgs as n, savePasswordToVault as o, openVault as r, saveTokenToVault as s, VAULT_ITEM_NAME as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devdogsuga/backstage",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "private": false,
   "type": "module",
   "description": "Officer and production CLI for DevDogsUGA: deploys, env sync with Bitwarden and GitHub, the migration planner role, club graphics and QR codes, GitHub rulesets and settings, and the newsletter. Ships built JS; run it anywhere with `pnpm dlx @devdogsuga/backstage` (no checkout needed to start; commands that read a checkout say so).",
@@ -40,10 +40,10 @@
     "tsx": "^4.23.12",
     "typescript": "^6.0.3",
     "zod": "4.4.3",
-    "@devdogsuga/brand": "0.1.7",
-    "@devdogsuga/events": "0.1.7",
+    "@devdogsuga/brand": "0.1.8",
+    "@devdogsuga/newsletter": "0.1.16",
     "@devdogsuga/telemetry": "0.1.4",
-    "@devdogsuga/newsletter": "0.1.14"
+    "@devdogsuga/events": "0.1.7"
   },
   "peerDependencies": {
     "@devdogsuga/db": "*",
@@ -64,8 +64,8 @@
     "eslint": "^9.39.5",
     "tsdown": "^0.23.0",
     "vitest": "^4.1.11",
-    "@devdogsuga/config": "0.1.2",
     "@devdogsuga/cli-core": "0.0.0",
+    "@devdogsuga/config": "0.1.2",
     "@devdogsuga/db": "0.1.3",
     "@devdogsuga/env": "0.1.5"
   },

package/dist/client-DCRfKvpP.js

@@ -1,2 +0,0 @@
-import { a as listSecrets, o as projectIdFor } from "./client-Djo8fRdS.js";
-export { listSecrets, projectIdFor };