@devdogsuga/backstage 0.1.13 → 0.1.14

package/README.md

@@ -47,7 +47,8 @@ pnpm backstage export attendance --meeting 2026-09-09 --format bevy,involvement
 | `deploy <app> --tier <t>`                          | Checks `CLOUDFLARE_API_TOKEN`, writes the Worker's secrets file, deploys, removes it.  |
 | `deploy write-env`                                 | Composes `.env.<DEPLOY_ENV>` from the GitHub environment.                              |
 | `deploy preflight`                                 | Classifies the project: paused (skip) or broken (fail).                                |
-| `deploy plan`, `deploy migrate`                    | Dry-run the migrations into the job summary; apply them to `DB_URL`.                   |
+| `deploy plan`, `deploy migrate [--include-seed]`   | Dry-run the migrations (and new seed files) into the job summary; apply them.          |
+| `deploy avatars`                                   | Uploads seeded headshots the bucket lacks; never replaces one (`SECRET_KEY`).          |
 | `deploy smoke --tier <t> [--app]`                  | Public routes answer 200, the auth redirect works, this deploy's Sentry release shows. |
 | `deploy reconcile --tier <t>`                      | The platform's config reconcile, after the deploy (`CRON_SECRET`).                     |
 | `deploy prune-monitors --tier <t> [--app]`         | Deletes the app's Sentry Crons monitors it no longer declares (production only).       |

package/dist/{catalog-BLgY4knB.js → catalog-D7eGX7cD.js}

@@ -371,7 +371,8 @@ const supabase = (...args) => run$1([
 * The one spelling of the migration push, shared by the contributor `db
 * migrate` path (`stack.ts`'s `pushMigrations`) and CI's `deploy migrate`.
 * `--yes` is the unattended apply CI wants; the contributor path omits it so a
-* human still confirms. Neither variant regenerates types — that is
+* human still confirms. `includeSeed` adds the `[db.seed]` files, which the
+* CLI runs once each and records in `supabase_migrations.seed_files`. Neither variant regenerates types — that is
 * `pushMigrations`' own second step, layered on top only where a checkout is
 * meant to be rewritten. A CI apply must NOT write back into the repo, which is
 * exactly why the bare push is factored out here rather than reused whole.
@@ -383,6 +384,7 @@ function dbPush(dbUrl, opts = {}) {
 		"--db-url",
 		dbUrl
 	];
+	if (opts.includeSeed) args.push("--include-seed");
 	if (opts.yes) args.push("--yes");
 	return supabase(...args);
 }
@@ -397,17 +399,19 @@ function dbPush(dbUrl, opts = {}) {
 * apply". The child's own output is surfaced in the thrown message, because for
 * a dry run that output is precisely the reason the operator needs.
 */
-async function dbPushDryRun(dbUrl) {
+async function dbPushDryRun(dbUrl, opts = {}) {
+	const args = [
+		"exec",
+		"supabase",
+		"db",
+		"push",
+		"--db-url",
+		dbUrl
+	];
+	if (opts.includeSeed) args.push("--include-seed");
+	args.push("--dry-run");
 	try {
-		const { stdout, stderr } = await runFile("pnpm", [
-			"exec",
-			"supabase",
-			"db",
-			"push",
-			"--db-url",
-			dbUrl,
-			"--dry-run"
-		], {
+		const { stdout, stderr } = await runFile("pnpm", args, {
 			cwd: findRepoRoot(),
 			encoding: "utf8",
 			maxBuffer: 33554432
@@ -1130,6 +1134,10 @@ function app(name) {
 		]
 	};
 }
+const INCLUDE_SEED = {
+	flag: "--include-seed",
+	summary: "Also run the seed files the database has not recorded."
+};
 const deployCommand = {
 	name: "deploy",
 	dryRun: "handled",
@@ -1161,11 +1169,17 @@ const deployCommand = {
 				flag: "--label",
 				value: "<title>",
 				summary: "Heading for the summary section."
-			}]
+			}, INCLUDE_SEED]
 		},
 		{
 			name: "migrate",
 			summary: "Apply the migrations to DB_URL.",
+			options: [INCLUDE_SEED, DRY_RUN]
+		},
+		{
+			name: "avatars",
+			summary: "Upload seeded headshots the avatars bucket does not have yet.",
+			hint: "never replaces an existing photo",
 			options: [DRY_RUN]
 		},
 		{

package/dist/{cli-DIXhcRjn.js → cli-xqblG51R.js}

@@ -1,5 +1,5 @@
 import { C as discoverRepoRoot, M as flagValue, N as positionals, T as cliName, b as ownPackageDir, c as reportDevtoolsError, f as isNoEnv, l as reportDevtoolsFailure, n as captureDevtoolsError, o as initDevtoolsTelemetry, p as isNonInteractive, w as findRepoRoot, x as ownVersion } from "./telemetry-RNK5Wu74.js";
-import { a as recordEnteredTier, f as helpPath, i as beginInvocation, l as dbPush, m as renderHelp, n as bareGroupStartPath, o as recordResolved, p as renderCommandList, r as runMenu, s as reproducibleCommand, t as catalog, u as dbPushDryRun } from "./catalog-BLgY4knB.js";
+import { a as recordEnteredTier, f as helpPath, i as beginInvocation, l as dbPush, m as renderHelp, n as bareGroupStartPath, o as recordResolved, p as renderCommandList, r as runMenu, s as reproducibleCommand, t as catalog, u as dbPushDryRun } from "./catalog-D7eGX7cD.js";
 import { a as repoPeerUrl, n as loadEnv, r as loadEnvLoad, t as getEnvSync } from "./peers-DE07w6nT.js";
 import { t as nonEmpty } from "./connection-D3XsOE3S.js";
 import { a as wouldRunLine, n as isDryRun, t as dryRunKind } from "./dry-run-OzO0jUhK.js";
@@ -12,7 +12,7 @@ import { pathToFileURL } from "node:url";
 import { appendFileSync, existsSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { basename, join, resolve } from "node:path";
 import { confirm, intro, log, note, outro, select } from "@clack/prompts";
-import { chmod, readFile, writeFile } from "node:fs/promises";
+import { chmod, readFile, readdir, writeFile } from "node:fs/promises";
 import { execFile, execFileSync, spawn } from "node:child_process";
 import { promisify } from "node:util";
 import { tmpdir } from "node:os";
@@ -491,6 +491,103 @@ function summary(lines, env = process.env) {
 	appendFileSync(path, `${lines.join("\n")}\n`);
 }
 //#endregion
+//#region src/deploy/avatars.ts
+/**
+* `backstage deploy avatars`: the seeded headshots, uploaded where missing.
+*
+* `supabase db push --include-seed` runs the seed SQL but never touches
+* Storage, so a new officer's profile reached a hosted tier without their
+* photo. `supabase seed buckets` would upload it, but it sends every file with
+* `x-upsert: true`, and the app stores an officer's own upload at the same key
+* (`avatars/<user id>`, also upserted). Run on every deploy, it would put the
+* seed photo back over whatever the officer chose since.
+*
+* So this uploads each file under a bucket's `objects_path` WITHOUT upsert,
+* and Storage's duplicate refusal is the "already there" answer. That makes it
+* insert-only, like the seed SQL beside it: a photo is added once and never
+* replaced, and there is no check-then-write race to lose.
+*
+* Reads `API_URL` (else `https://<PROJECT_REF>.supabase.co`) and `SECRET_KEY`
+* from the step's own `env:`, like the other credential-holding steps.
+*/
+/**
+* Every `[storage.buckets.<name>]` in `supabase/config.toml` that declares an
+* `objects_path`. A line scan rather than a TOML parser: the two keys are
+* flat, quoted and always written this way by the Supabase template, and a
+* table header ends the previous section.
+*/
+function seededBuckets(configToml, supabaseDir) {
+	const found = [];
+	let bucket;
+	for (const line of configToml.split("\n")) {
+		const header = /^\s*\[([^\]]+)\]\s*$/.exec(line);
+		if (header) {
+			bucket = /^storage\.buckets\.([A-Za-z0-9_-]+)$/.exec(header[1].trim())?.[1];
+			continue;
+		}
+		const path = /^\s*objects_path\s*=\s*"([^"]+)"/.exec(line);
+		if (bucket && path) found.push({
+			bucket,
+			dir: resolve(supabaseDir, path[1])
+		});
+	}
+	return found;
+}
+/** The content type Storage needs, from the bytes; the seeds have no extension. */
+function sniffImageType(bytes) {
+	const ascii = (from, to) => String.fromCharCode(...bytes.subarray(from, to));
+	if (ascii(0, 4) === "RIFF" && ascii(8, 12) === "WEBP") return "image/webp";
+	if (bytes[0] === 137 && ascii(1, 4) === "PNG") return "image/png";
+	if (bytes[0] === 255 && bytes[1] === 216) return "image/jpeg";
+}
+/**
+* POST without `x-upsert`. Storage refuses a duplicate key with 409, or (older
+* Storage) a 400 whose body says `"statusCode":"409"` / `"Duplicate"`.
+*/
+async function uploadIfMissing(apiUrl, secretKey, bucket, name, bytes, contentType, fetchImpl = fetch) {
+	const res = await fetchImpl(`${apiUrl.replace(/\/+$/, "")}/storage/v1/object/${encodeURIComponent(bucket)}/${encodeURIComponent(name)}`, {
+		method: "POST",
+		headers: {
+			apikey: secretKey,
+			Authorization: `Bearer ${secretKey}`,
+			"Content-Type": contentType,
+			"x-upsert": "false"
+		},
+		body: bytes
+	});
+	if (res.ok) return "uploaded";
+	const body = await res.text().catch(() => "");
+	if (res.status === 409 || /"statusCode"\s*:\s*"409"|Duplicate/i.test(body)) return "exists";
+	throw new DeployError(`Uploading ${bucket}/${name} failed (HTTP ${res.status}).`, [body.slice(0, 300) || "Storage gave no reason."]);
+}
+async function runDeployAvatars(env = process.env, deps = {}) {
+	const ref = nonEmpty(env.PROJECT_REF);
+	const apiUrl = nonEmpty(env.API_URL) ?? (ref ? `https://${ref}.supabase.co` : void 0);
+	const secretKey = nonEmpty(env.SECRET_KEY);
+	if (!apiUrl || !secretKey) throw new DeployError(`${apiUrl ? "SECRET_KEY" : "API_URL (or PROJECT_REF)"} is not set — refusing to upload.`, [
+		"This step reads the Storage endpoint and the tier's secret key from",
+		"its own env: block. An empty value usually means the workflow step",
+		"lost it, or the environment never had it."
+	]);
+	const supabaseDir = join(deps.root ?? findRepoRoot(), "supabase");
+	const config = await readFile(join(supabaseDir, "config.toml"), "utf8");
+	let uploaded = 0;
+	let existing = 0;
+	for (const { bucket, dir } of seededBuckets(config, supabaseDir)) {
+		const names = (await readdir(dir, { withFileTypes: true })).filter((e) => e.isFile() && !e.name.startsWith(".")).map((e) => e.name).sort();
+		for (const name of names) {
+			const bytes = new Uint8Array(await readFile(join(dir, name)));
+			const type = sniffImageType(bytes);
+			if (!type) throw new DeployError(`${bucket}/${name} is not a WebP, PNG or JPEG.`);
+			if (await uploadIfMissing(apiUrl, secretKey, bucket, name, bytes, type, deps.fetch) === "uploaded") {
+				uploaded++;
+				say([`deploy avatars: uploaded ${bucket}/${name}`]);
+			} else existing++;
+		}
+	}
+	say([`deploy avatars: ${uploaded} uploaded, ${existing} already there (left alone).`]);
+}
+//#endregion
 //#region src/deploy/migrations.ts
 /**
 * `backstage deploy plan` and `deploy migrate`.
@@ -525,10 +622,10 @@ const MISSING_DB_URL = [
 * the caller distinguish the two stages (`main`'s early plan vs the one taken
 * seconds before the apply); it is the only thing that varies between them.
 */
-async function runDeployPlan(label = "Migration plan", env = process.env, plan = dbPushDryRun) {
+async function runDeployPlan(label = "Migration plan", env = process.env, plan, { includeSeed = false } = {}) {
 	const url = env.DB_URL;
 	if (!url) throw new DeployError("DB_URL is not set — refusing to plan.", MISSING_DB_URL);
-	const text = await plan(url);
+	const text = await (plan ?? ((u) => dbPushDryRun(u, { includeSeed })))(url);
 	say([text]);
 	summary([
 		`### ${label}`,
@@ -541,16 +638,19 @@ async function runDeployPlan(label = "Migration plan", env = process.env, plan =
 /**
 * Apply the migrations to DB_URL.
 *
-* `dbPush(url, { yes: true })` — the bare push, WITHOUT the type regeneration
+* `dbPush(url, { yes: true, includeSeed })` — the bare push, WITHOUT the type regeneration
 * the contributor path layers on, so a production apply never writes back into
 * the checkout. A non-zero exit becomes a DeployError so the job fails with a
 * line a person can read; the supabase CLI's own output (inherited stdio) says
 * why above it.
 */
-async function runDeployMigrate(env = process.env, push = (url) => dbPush(url, { yes: true })) {
+async function runDeployMigrate(env = process.env, push, { includeSeed = false } = {}) {
 	const url = env.DB_URL;
 	if (!url) throw new DeployError("DB_URL is not set — refusing to migrate.", MISSING_DB_URL);
-	const code = await push(url);
+	const code = await (push ?? ((u) => dbPush(u, {
+		yes: true,
+		includeSeed
+	})))(url);
 	if (code !== 0) throw new DeployError(`\`supabase db push\` failed (exit ${code}).`, ["The migration was not applied. The supabase CLI output above says why."]);
 	say(["deploy migrate: migrations applied."]);
 }
@@ -1664,11 +1764,11 @@ function renderWriteEnvReport(result) {
 * deploy` from the app dir resolves through it with no `--config` needed.
 * Both apps share one deploy step.
 *
-* Steps (`write-env`, `preflight`, `plan`, `migrate`, `smoke`, `reconcile`,
-* `prune-monitors`) are individually addressable for jobs that run only one.
-* The ones that hold a single credential in the job's own `env:` block and
-* compose no env file (`preflight`, `plan`, `migrate`, `smoke`, `reconcile`,
-* `prune-monitors`), and `write-env`,
+* Steps (`write-env`, `preflight`, `plan`, `migrate`, `avatars`, `smoke`,
+* `reconcile`, `prune-monitors`) are individually addressable for jobs that run
+* only one. The ones that hold their credentials in the job's own `env:` block
+* and compose no env file (`preflight`, `plan`, `migrate`, `avatars`, `smoke`,
+* `reconcile`, `prune-monitors`), and `write-env`,
 * which CREATES the file tier resolution would otherwise insist on reading,
 * run with `--no-env`.
 */
@@ -1786,18 +1886,22 @@ function renderDeployFailure(label, err) {
 }
 /** Whether a dry run stops before this step, because the step writes. */
 function writesWhenLive(sub) {
-	return sub === "write-env" || sub === "migrate";
+	return sub === "write-env" || sub === "migrate" || sub === "avatars";
 }
 /**
 * The steps, by name.
 */
 async function runStep(sub, rest) {
 	if (sub === "plan") {
-		await runDeployPlan(flagValue(rest, "--label"));
+		await runDeployPlan(flagValue(rest, "--label"), process.env, void 0, { includeSeed: rest.includes("--include-seed") });
 		return true;
 	}
 	if (sub === "migrate") {
-		await runDeployMigrate();
+		await runDeployMigrate(process.env, void 0, { includeSeed: rest.includes("--include-seed") });
+		return true;
+	}
+	if (sub === "avatars") {
+		await runDeployAvatars();
 		return true;
 	}
 	if (sub === "preflight") {
@@ -4835,11 +4939,17 @@ const handleGithub = async (rest) => {
 * production" from `main`, so whatever it authenticates with is reachable
 * from the `main` trust tier. The plan refuses even a general read-only role
 * there, because that puts every row of production data behind that boundary.
-* What is left is a role that can read the migrations-history table and
-* nothing else. Two grants are the whole of it:
+* What is left is a role that can read the CLI's two ledgers and nothing
+* else. Three grants are the whole of it:
 *
 *   grant usage  on schema supabase_migrations            to migration_planner;
 *   grant select on supabase_migrations.schema_migrations to migration_planner;
+*   grant select on supabase_migrations.seed_files        to migration_planner;
+*
+* The third lets the dry run plan seeds too (`deploy plan --include-seed`).
+* `seed_files` holds a path and a content hash per seed file, no member data.
+* The CLI creates it on the first seeded push, so the grant is skipped while
+* it does not exist, and `planner status` says when it is missing.
 *
 * This module is the pure half: names, SQL text, password generation, URL
 * derivation. Everything that talks to a database lives beside it.
@@ -4860,9 +4970,15 @@ function createRoleSql(password) {
 	return [
 		`create role ${PLANNER_ROLE} login password '${password}'`,
 		`grant usage on schema supabase_migrations to ${PLANNER_ROLE}`,
-		`grant select on supabase_migrations.schema_migrations to ${PLANNER_ROLE}`
+		`grant select on supabase_migrations.schema_migrations to ${PLANNER_ROLE}`,
+		GRANT_SEED_FILES
 	];
 }
+/**
+* The seed-ledger grant, applied only when the table exists. Also what
+* `planner status` tells you to run when it is missing.
+*/
+const GRANT_SEED_FILES = `do \$\$ begin if to_regclass('supabase_migrations.seed_files') is not null then grant select on supabase_migrations.seed_files to ${PLANNER_ROLE}; end if; end \$\$`;
 /** ALTER ROLE, same interpolation contract as `createRoleSql`. */
 function resetPasswordSql(password) {
 	return `alter role ${PLANNER_ROLE} password '${password}'`;
@@ -4901,6 +5017,8 @@ function plannerUrlFrom(adminUrl, password) {
 *   1. Who did Postgres authenticate? (`current_user`)
 *   2. Can it read an application schema? (it must not)
 *   3. Can it read the migrations table? (it must, the dry run is next)
+*   4. Can it read the seed ledger? (it must, once the table exists, for
+*      `deploy plan --include-seed`)
 *
 * Shared between `deploy require-planner` (which turns a bad answer into a
 * red CI job) and `planner create` / `planner reset-password` (which run the
@@ -4923,6 +5041,7 @@ const CHECK_IDENTITY = "select current_user as who";
 */
 const CHECK_OVERREACH = "select * from platform.profile limit 1";
 const CHECK_MIGRATIONS = "select count(*)::int as n from supabase_migrations.schema_migrations";
+const CHECK_SEEDS = "select count(*)::int as n from supabase_migrations.seed_files";
 /**
 * Runs the three checks over an OPEN connection; never closes it.
 *
@@ -4967,11 +5086,27 @@ async function checkPlanner(db) {
 			problem: `${PLANNER_ROLE} cannot read supabase_migrations.schema_migrations, so the migration dry run would fail right after this. Re-apply the two grants (see planner/role.ts).`
 		};
 	}
+	try {
+		const [row] = await db.run(CHECK_SEEDS);
+		lines.push(`can read supabase_migrations.seed_files (${String(row?.n)} rows)`);
+	} catch (error) {
+		if (isMissingTable(error)) lines.push("no supabase_migrations.seed_files yet (no seeded push)");
+		else return {
+			ok: false,
+			lines,
+			problem: `${PLANNER_ROLE} cannot read supabase_migrations.seed_files, so \`deploy plan --include-seed\` would fail. As an admin, run: grant select on supabase_migrations.seed_files to ${PLANNER_ROLE};`
+		};
+	}
 	return {
 		ok: true,
 		lines
 	};
 }
+/** Postgres 42P01 (undefined_table), with a text fallback. */
+function isMissingTable(error) {
+	const e = error;
+	return e.code === "42P01" || /relation "?[\w.]*seed_files"? does not exist/i.test(e.message ?? "");
+}
 /** Postgres 3F000 (invalid_schema_name), with a text fallback. */
 function isMissingSchema(error) {
 	const e = error;
@@ -5064,7 +5199,7 @@ const QUERY_ROLE = `select rolcanlogin from pg_roles where rolname = '${PLANNER_
 * it strands a grant-less role behind a refusal to re-run.
 */
 const QUERY_SCHEMA = "select 1 from pg_namespace where nspname = 'supabase_migrations'";
-const QUERY_GRANTS = `select has_schema_privilege('${PLANNER_ROLE}', 'supabase_migrations', 'usage') as schema_usage, has_table_privilege('${PLANNER_ROLE}', 'supabase_migrations.schema_migrations', 'select') as table_select`;
+const QUERY_GRANTS = `select has_schema_privilege('${PLANNER_ROLE}', 'supabase_migrations', 'usage') as schema_usage, has_table_privilege('${PLANNER_ROLE}', 'supabase_migrations.schema_migrations', 'select') as table_select, to_regclass('supabase_migrations.seed_files') is not null as seed_table, case when to_regclass('supabase_migrations.seed_files') is null then false else has_table_privilege('${PLANNER_ROLE}', 'supabase_migrations.seed_files', 'select') end as seed_select`;
 /**
 * Membership is the quiet way a "narrow" role widens: `grant postgres to
 * migration_planner` leaves both privilege queries above looking correct.
@@ -5147,7 +5282,7 @@ async function inspectRole(connect, admin) {
 		if (!schemaReady) lines.push("⚠️ the supabase_migrations schema DOES NOT EXIST on this database — the grants below cannot hold and the dry run cannot plan. Initialize the migration history, then `planner reset-password` will re-verify (or `planner drop` and re-run `planner create`).");
 		if (schemaReady) {
 			const [grants] = await db.run(QUERY_GRANTS);
-			lines.push(grants?.schema_usage ? "has usage on supabase_migrations" : "⚠️ MISSING usage on supabase_migrations", grants?.table_select ? "has select on supabase_migrations.schema_migrations" : "⚠️ MISSING select on supabase_migrations.schema_migrations");
+			lines.push(grants?.schema_usage ? "has usage on supabase_migrations" : "⚠️ MISSING usage on supabase_migrations", grants?.table_select ? "has select on supabase_migrations.schema_migrations" : "⚠️ MISSING select on supabase_migrations.schema_migrations", !grants?.seed_table ? "no supabase_migrations.seed_files yet (granted on the next create once it exists)" : grants.seed_select ? "has select on supabase_migrations.seed_files" : `⚠️ MISSING select on supabase_migrations.seed_files — grant select on supabase_migrations.seed_files to ${PLANNER_ROLE};`);
 		}
 		const memberships = await db.run(QUERY_MEMBERSHIPS);
 		lines.push(memberships.length === 0 ? "member of no other role" : `⚠️ MEMBER OF: ${memberships.map((m) => String(m.rolname)).join(", ")} — inherited privileges reach past the validated pair`);
@@ -5250,7 +5385,7 @@ async function runPlannerCreate(options = {}) {
 	const connect = options.connect ?? connectDb;
 	const admin = await adminUrl(options);
 	if (!unwrap(await confirm({
-		message: `Create role migration_planner on the PRODUCTION database, with its two grants and a generated password?`,
+		message: `Create role migration_planner on the PRODUCTION database, with its three grants and a generated password?`,
 		initialValue: false
 	}))) bail();
 	await withDb(connect, admin, async (db) => {
@@ -5265,7 +5400,7 @@ async function runPlannerCreate(options = {}) {
 			await db.run("rollback").catch(() => void 0);
 			throw error;
 		}
-		log.success(`Created ${PLANNER_ROLE} with the two validated grants.`);
+		log.success(`Created ${PLANNER_ROLE} with the validated grants.`);
 		await verifyAndStore(connect, admin, password);
 	});
 }

package/dist/launch.js

@@ -1,5 +1,5 @@
 import { C as discoverRepoRoot, E as setCliName, S as RepoNotFoundError, T as cliName, _ as installFailureLog, d as hasYes, g as stripTierFlag, h as stripNoEnvFlag, m as setNoEnv, n as captureDevtoolsError, o as initDevtoolsTelemetry, p as isNonInteractive, s as lastSentryEventId } from "./telemetry-RNK5Wu74.js";
-import { c as setMenuEnvHook, d as formatCommand, f as helpPath, n as bareGroupStartPath, t as catalog } from "./catalog-BLgY4knB.js";
+import { c as setMenuEnvHook, d as formatCommand, f as helpPath, n as bareGroupStartPath, t as catalog } from "./catalog-D7eGX7cD.js";
 import { i as loadEnvSession, r as loadEnvLoad } from "./peers-DE07w6nT.js";
 import { t as nonEmpty } from "./connection-D3XsOE3S.js";
 import { i as setDryRun, n as isDryRun, r as resolveDryRun } from "./dry-run-OzO0jUhK.js";
@@ -322,7 +322,7 @@ async function launchWith(argv, options) {
 */
 async function launch(argv) {
 	await launchWith(argv, { dispatch: async (args) => {
-		const { main } = await import("./cli-DIXhcRjn.js");
+		const { main } = await import("./cli-xqblG51R.js");
 		await main(args);
 	} });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devdogsuga/backstage",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "private": false,
   "type": "module",
   "description": "Officer and production CLI for DevDogsUGA: deploys, env sync with Bitwarden and GitHub, the migration planner role, club graphics and QR codes, GitHub rulesets and settings, and the newsletter. Ships built JS; run it anywhere with `pnpm dlx @devdogsuga/backstage` (no checkout needed to start; commands that read a checkout say so).",
@@ -41,9 +41,9 @@
     "typescript": "^6.0.3",
     "zod": "4.4.3",
     "@devdogsuga/brand": "0.1.8",
-    "@devdogsuga/events": "0.1.7",
+    "@devdogsuga/newsletter": "0.1.16",
     "@devdogsuga/telemetry": "0.1.4",
-    "@devdogsuga/newsletter": "0.1.15"
+    "@devdogsuga/events": "0.1.7"
   },
   "peerDependencies": {
     "@devdogsuga/db": "*",
@@ -64,9 +64,9 @@
     "eslint": "^9.39.5",
     "tsdown": "^0.23.0",
     "vitest": "^4.1.11",
+    "@devdogsuga/cli-core": "0.0.0",
     "@devdogsuga/config": "0.1.2",
     "@devdogsuga/db": "0.1.3",
-    "@devdogsuga/cli-core": "0.0.0",
     "@devdogsuga/env": "0.1.5"
   },
   "scripts": {