@devdogsuga/backstage 0.1.3 → 0.1.4

package/README.md

@@ -14,7 +14,7 @@ match. The two flags matter outside a DevDogsUGA checkout, where the workspace's
 `pnpm backstage` is the script).
 
 It **starts without a checkout**. Help, `version`, `completions`, the tools
-below that need no secrets (`graphics`, `qr`, `github`, `newsletter`) and
+below that need no secrets (`graphics`, `qr`, `github`, `newsletter`, `creds`) and
 anything run with `--no-env` never look for one; a command that reads a checkout says
 "run this from inside a DevDogsUGA clone" and exits 1. The DevDogsUGA libraries
 it reads (`@devdogsuga/env`, `@devdogsuga/db`) are optional peers, resolved
@@ -31,6 +31,8 @@ pnpm backstage --no-env planner status           # the preflight credential, fro
 pnpm backstage graphics 'event/*' --out ~/images # club images, no checkout
 pnpm backstage qr https://devdogsuga.org --format svg,png,webp --logo acm
 pnpm backstage newsletter send 3.0.1 --to a@uga.edu   # asks first; --yes with no terminal
+pnpm backstage creds                             # share a club login with officers, as a Bitwarden Send
+pnpm backstage creds renew                       # extend every Send 30 days
 ```
 
 ## Commands
@@ -49,6 +51,7 @@ pnpm backstage newsletter send 3.0.1 --to a@uga.edu   # asks first; --yes with n
 | `qr <text>`                                    | QR codes with every option of `/console/qr`.                                           |
 | `github rulesets\|settings`                    | Diff (and with `--apply` write) GitHub config, through `gh`.                           |
 | `newsletter render\|draft\|send <issue…>`      | Changelog issues as files, mailbox drafts, or a send.                                  |
+| `creds send\|add\|renew\|list\|report`         | Club logins from Bitwarden as email-verified Sends, and the Linear report.             |
 
 `smoke` and `reconcile` replace DevDogsUGA's `packages/deploy-checks`. The
 per-app data (hosts, public paths, the protected path and its redirect) stays in
@@ -106,6 +109,47 @@ entry for them (`envFree` in the command tree).
   Microsoft or UGA's tenant blocks it, sending needs a club-owned app
   registration.
 
+## Shared logins: `creds`
+
+The club's shared logins (Instagram, Canva, ArchPass, Linktree, later project
+API keys) live only in the **Shared Accounts** collection of the DevDogs
+Bitwarden organization. `creds` hands them to officers as Bitwarden Sends:
+
+- **`send`** picks items and recipients (officers by name or by role, read live
+  from production: everyone holding a role other than `Member`, by UGA MyID
+  email), shows a preview with the password masked as `••••••••`, then creates
+  or updates **one Send per item**, restricted by email verification to its
+  recipients and deleted 30 days out. Removing an address revokes it. Addresses
+  off the roster need `--allow-email`. Non-interactive: `--item`, `--to`,
+  `--role`, `--yes`.
+- **`add`** saves a new login into the collection (org-owned), then sends it.
+  The password is typed at a hidden prompt, or read with `--password-stdin`;
+  never argv.
+- **`renew`** pushes each Send's deletion 30 days out in place (the link stays)
+  and re-syncs its recipients and body from the item. It asks first for any Send
+  with more than 7 days left.
+- **`list`** prints items, recipients and expiry (`--json` for scripts).
+- **`report`** regenerates the **Shared Accounts** Linear document (Platform &
+  DevOps initiative), which `send`, `add` and `renew` also do. It is generated
+  whole; edits there are overwritten.
+
+Each item's custom fields are the only access record: `Recipients`, `Owner`,
+`Send ID`, `Send link`, `Send expires`, `Send account`. Sends belong to the
+Bitwarden account that creates them, so `creds` runs on your own `bw` session
+(signing in and unlocking after asking, or `BW_SESSION`), never on CI; renewing
+a Send another officer made creates a new one, with a new link, under yours.
+
+The roster needs production's `DB_URL`: `--db-url`, else `.env.production` in a
+checkout, else Secrets Manager. The Linear key: `--linear-token`, then
+`LINEAR_API_KEY`, then the vault item "DevDogs Linear API key (backstage)", then
+a prompt; it is never saved.
+
+No secret value reaches stdout, stderr, the failure log, Sentry, an error
+message or argv: values go to `bw` as base64 JSON on stdin, every error is
+scrubbed of every value read so far (`src/creds/secrets.ts`), and the clipboard
+only ever gets the link. `src/creds/commands.test.ts` runs every path against a
+fake `bw` with a sentinel password and looks for it in all of those places.
+
 ## Tiers, `--no-env`, CI
 
 Nothing is ever asked at launch. `--tier <t>` (anywhere in argv) or

package/dist/{catalog-BOBE4ee7.js → catalog-BuNLUu08.js}

@@ -1,11 +1,9 @@
-import { A as YES, D as DRY_RUN, O as JSON_FLAG, S as RepoNotFoundError, j as createCatalog, k as SCOPES, v as noteRan, w as findRepoRoot } from "./telemetry-Bjoz29Hl.js";
+import { A as YES, D as DRY_RUN, O as JSON_FLAG, j as createCatalog, k as SCOPES, v as noteRan, w as findRepoRoot } from "./telemetry-Bjoz29Hl.js";
 import { o as isDryRun, r as qrCatalogOptions } from "./options-BTjOf5KP.js";
 import { o as unwrap } from "./ui-CdKo8mLw.js";
 import { n as positionals } from "./args-Cjr_Iqts.js";
-import { createRequire } from "node:module";
-import { pathToFileURL } from "node:url";
-import { existsSync, readFileSync, readdirSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
 import { confirm, note, select, text } from "@clack/prompts";
 import "node:fs/promises";
 import { execFile, execFileSync, spawn } from "node:child_process";
@@ -193,235 +191,6 @@ function renderCommandList(catalog, version) {
 	}, null, 2);
 }
 //#endregion
-//#region ../cli-core/src/repo/resolve.ts
-/**
-* Resolves an `@devdogsuga/*` package FROM the target repo, not from
-* devtools' own (dlx-isolated) `node_modules`.
-*
-* Ported from the `devtools-dlx` prototype
-* (`/home/sloan/scratchpad/devdogs/prototypes/devtools-dlx/FINDINGS.md`,
-* experiments 2 and 4 — read that file for the two gotchas this module
-* exists to avoid). The short version:
-*
-*   - `require.resolve(\`${specifier}/package.json\`)` throws
-*     `ERR_PACKAGE_PATH_NOT_EXPORTED` on packages (like `@devdogsuga/env`,
-*     `@devdogsuga/open-graph`) whose `exports` map does not list
-*     `"./package.json"`, even though the file is on disk.
-*   - A resolved path cannot be assumed to contain a literal
-*     `node_modules/<specifier>` segment — pnpm workspace-linked packages
-*     resolve to their REALPATH (e.g. `packages/open-graph/dist/index.js`),
-*     which has no such segment at all.
-*   - `require.resolve` ignores whatever `conditions` a caller has set on
-*     `tsx`'s `register()` — condition-based resolution (the
-*     `devdogs-source` condition) has to be done by hand, reading the
-*     target package's own `exports["."]` map.
-*
-* Both problems are solved the same way: walk up from the resolved file's
-* directory to the nearest `package.json` whose own `"name"` field matches
-* the specifier. That works for a real installed dependency AND a
-* workspace symlink, uniformly.
-*/
-/**
-* The installable package name a (possibly subpath) specifier belongs to:
-* `@devdogsuga/env/load` → `@devdogsuga/env`, `foo/bar` → `foo`. A repo's
-* package.json declares the PACKAGE as a dependency, never a subpath, so
-* `findDependent` has to search on this rather than the literal specifier a
-* caller wants to import.
-*/
-function packageNameOf(specifier) {
-	const parts = specifier.split("/");
-	return specifier.startsWith("@") ? parts.slice(0, 2).join("/") : parts[0];
-}
-/**
-* Scans `apps/*` and `packages/*` under `repoRoot` for the first
-* `package.json` whose `dependencies`/`devDependencies`/`peerDependencies`
-* names `specifier`'s package (see `packageNameOf`). Returns its path
-* relative to `repoRoot`, or `null` if nothing in the repo depends on it.
-*
-* Re-scans the filesystem on every call — fine for a short-lived CLI
-* invocation calling this a handful of times; see FINDINGS item 5 if this
-* is ever called in a hot loop.
-*/
-function findDependent(repoRoot, specifier) {
-	const packageName = packageNameOf(specifier);
-	for (const group of ["apps", "packages"]) {
-		const groupDir = join(repoRoot, group);
-		let entries;
-		try {
-			entries = readdirSync(groupDir);
-		} catch {
-			continue;
-		}
-		for (const entry of entries) {
-			const pkgJsonPath = join(groupDir, entry, "package.json");
-			if (!existsSync(pkgJsonPath)) continue;
-			let pkg;
-			try {
-				pkg = JSON.parse(readFileSync(pkgJsonPath, "utf8"));
-			} catch {
-				continue;
-			}
-			if (packageName in {
-				...pkg.dependencies,
-				...pkg.devDependencies,
-				...pkg.peerDependencies
-			}) return join(group, entry, "package.json");
-		}
-	}
-	return null;
-}
-/** Walks up from `startDir` to the nearest `package.json` whose `"name"` matches `specifier`. */
-function findOwningPackageJson(startDir, specifier) {
-	const packageName = packageNameOf(specifier);
-	let dir = startDir;
-	for (;;) {
-		const candidate = join(dir, "package.json");
-		if (existsSync(candidate)) try {
-			if (JSON.parse(readFileSync(candidate, "utf8")).name === packageName) return candidate;
-		} catch {}
-		const parent = dirname(dir);
-		if (parent === dir) throw new Error(`resolveFromRepo: could not find ${specifier}'s own package.json by walking up from ${startDir}`);
-		dir = parent;
-	}
-}
-/**
-* Resolves `specifier` as `resolutionBase` (a workspace-relative
-* `package.json` path known to depend on it, from `findDependent()`) would
-* see it.
-*
-* `opts.condition`, when given, is NOT passed through to Node's resolver —
-* `require.resolve` ignores tsx's `register({ conditions })` entirely (see
-* this module's header). Instead the target package's own
-* `exports["."]` map is read directly and `exports["."][condition]` is
-* picked, falling back to `.default`.
-*/
-function resolveFromRepo(repoRoot, resolutionBase, specifier, opts) {
-	const baseFile = join(repoRoot, resolutionBase);
-	const require = createRequire(baseFile);
-	let resolvedPath;
-	if (opts?.condition) {
-		const defaultEntry = require.resolve(specifier);
-		const pkgJsonPath = findOwningPackageJson(dirname(defaultEntry), specifier);
-		const rootExport = JSON.parse(readFileSync(pkgJsonPath, "utf8")).exports?.["."];
-		const conditioned = rootExport && typeof rootExport === "object" ? rootExport[opts.condition] ?? rootExport.default : void 0;
-		if (typeof conditioned !== "string") throw new Error(`resolveFromRepo: ${specifier} has no "${opts.condition}" (or "default") export in its exports["."] map`);
-		resolvedPath = join(dirname(pkgJsonPath), conditioned);
-	} else resolvedPath = require.resolve(specifier);
-	const pkgJsonPath = findOwningPackageJson(dirname(resolvedPath), specifier);
-	const pkg = JSON.parse(readFileSync(pkgJsonPath, "utf8"));
-	return {
-		resolvedPath,
-		version: pkg.version ?? "0.0.0",
-		pkgJsonPath
-	};
-}
-//#endregion
-//#region ../cli-core/src/repo/peers.ts
-/**
-* Loads devtools' optional-peer `@devdogsuga/*` libraries — the ones
-* published to npm and consumed by the TARGET repo, which devtools reads at
-* runtime rather than bundling its own copy of (see this package's
-* `package.json`: `peerDependencies` + `peerDependenciesMeta.optional`, and
-* `FINDINGS.md` experiment 2).
-*
-* Every export here is memoized per module (one dynamic `import()` per
-* process, not per call) — this is what makes the module-identity guarantee
-* in FINDINGS experiment 3 hold: every devtools call site that needs
-* `@devdogsuga/env`'s registry gets the exact same module instance the
-* repo's own manifests populated via `declare()`/`define()`, because both
-* resolve to the identical absolute file path and Node's ESM cache is keyed
-* by resolved URL.
-*/
-const moduleCache = /* @__PURE__ */ new Map();
-/** The file URL each peer resolved to through the target repo, set only on
-*  that path (not on either plain bare-specifier fallback). See
-*  `repoPeerUrl()`. */
-const resolvedUrls = /* @__PURE__ */ new Map();
-/**
-* Dynamically imports `specifier` as the repo would resolve it, memoized so
-* repeated calls in one process return the SAME module instance (required
-* for the env-registry identity guarantee above).
-*
-* Falls back to a plain bare-specifier `import()` when devtools is not
-* running inside a DevDogsUGA checkout at all (`findRepoRoot()` throws
-* `RepoNotFoundError`). That is not a production affordance — under real
-* `pnpm dlx` use, `specifier` is an optional peer devtools' own package
-* never installs, so the fallback import fails with the ordinary
-* `MODULE_NOT_FOUND` either way. It exists so devtools' OWN test suite
-* (which has no target repo to discover, but does have every one of these
-* peers as a real Backstage workspace package) exercises this code against
-* the genuine package rather than needing every test to mock this module.
-*/
-function loadPeer(specifier) {
-	const cached = moduleCache.get(specifier);
-	if (cached) return cached;
-	const promise = (async () => {
-		if (process.env.DEVTOOLS_TEST_REPO_ROOT) return import(specifier);
-		let repoRoot;
-		try {
-			repoRoot = findRepoRoot();
-		} catch (err) {
-			if (err instanceof RepoNotFoundError) return import(specifier);
-			throw err;
-		}
-		const resolutionBase = findDependent(repoRoot, specifier);
-		if (!resolutionBase) throw new Error(`Nothing in this repo depends on ${specifier} — expected an app or package under apps/* or packages/* to declare it (dependencies/devDependencies/peerDependencies).`);
-		const { resolvedPath } = resolveFromRepo(repoRoot, resolutionBase, specifier);
-		const url = pathToFileURL(resolvedPath).href;
-		resolvedUrls.set(specifier, url);
-		return import(url);
-	})();
-	moduleCache.set(specifier, promise);
-	return promise;
-}
-/**
-* The file URL `specifier` was loaded from through the target repo, or
-* undefined if it has not been loaded yet or came from a plain bare-specifier
-* `import()` (the test-suite and not-in-a-repo fallbacks above).
-*
-* For code devtools imports that itself names a peer by bare specifier --
-* today only devtools' own `env.ts` manifest. From an installed copy that
-* specifier cannot resolve at all (an optional peer is never installed next
-* to devtools under `pnpm dlx`), and even where it can, the only copy that
-* keeps module identity is this one. `repo/peer-redirect.ts` uses it to
-* point the import here.
-*/
-function repoPeerUrl(specifier) {
-	return resolvedUrls.get(specifier);
-}
-let resolvedEnvModule;
-function loadEnv() {
-	return loadPeer("@devdogsuga/env").then((mod) => {
-		resolvedEnvModule = mod;
-		return mod;
-	});
-}
-/**
-* The synchronous companion to `loadEnv()`, for the handful of call sites
-* (`gh/environments.ts`'s `GITHUB_ENVIRONMENT_SPECS` getters) that cannot
-* become async without changing their own callers' contract — they read a
-* plain array off a getter, not a Promise. Safe ONLY after `loadEnv()` has
-* resolved at least once; every caller of these getters already requires
-* `env/discovery.ts`'s `loadRegistry()` (which calls `loadEnv()` itself) to
-* have run first, via `assertRegistryLoaded()`'s own guard.
-*/
-function getEnvSync() {
-	if (!resolvedEnvModule) throw new Error("getEnvSync() called before loadEnv() ever resolved — call loadRegistry() (env/discovery.ts) first.");
-	return resolvedEnvModule;
-}
-function loadEnvLoad() {
-	return loadPeer("@devdogsuga/env/load");
-}
-function loadEnvSession() {
-	return loadPeer("@devdogsuga/env/session");
-}
-//#endregion
-//#region ../cli-core/src/db/connection.ts
-/** An env value, with unset and empty both meaning "not given". */
-function nonEmpty(value) {
-	return value === void 0 || value === "" ? void 0 : value;
-}
-//#endregion
 //#region ../cli-core/src/process-group.ts
 /**
 * Running a child tool so that stopping it stops everything it started.
@@ -1146,6 +915,141 @@ const completionsCommand = {
 	}]
 };
 //#endregion
+//#region src/creds/catalog.ts
+/**
+* `creds`'s place in the command tree: declaration only, nothing here runs.
+* The handler lives in `commands.ts` beside it.
+*
+* Every subcommand is `envFree`: it runs on the officer's own Bitwarden
+* session and reads production only for the roster, through `--db-url` or
+* Secrets Manager, so no env file or tier is entered. Bare `creds` at a
+* terminal opens this group's menu.
+*/
+const ITEM = {
+	flag: "--item",
+	value: "<name>",
+	summary: "A Shared Accounts item, by name or id. Repeat for several."
+};
+const TO = {
+	flag: "--to",
+	value: "<a@uga.edu,…>",
+	summary: "Recipients, comma-separated. Replaces the item's current list."
+};
+const ROLE = {
+	flag: "--role",
+	value: "<role,…>",
+	summary: "Everyone holding these officer roles, added to --to."
+};
+const ALLOW_EMAIL = {
+	flag: "--allow-email",
+	summary: "Accept addresses that are not on the officer roster."
+};
+const DB_URL$1 = {
+	flag: "--db-url",
+	value: "<url>",
+	summary: "Production connection for the roster. Defaults to .env.production, then Secrets Manager."
+};
+const LINEAR_TOKEN = {
+	flag: "--linear-token",
+	value: "<key>",
+	summary: "Linear API key. Prefer LINEAR_API_KEY or the vault item."
+};
+const NO_REPORT = {
+	flag: "--no-report",
+	summary: "Skip regenerating the Shared Accounts Linear document."
+};
+const credsCommand = {
+	name: "creds",
+	summary: "Share club logins from Bitwarden as email-verified Sends.",
+	hint: "your own Bitwarden session; officers only",
+	subcommands: [
+		{
+			name: "send",
+			envFree: true,
+			summary: "Create or update the Sends for existing shared accounts.",
+			hint: "pick accounts, then officers",
+			options: [
+				ITEM,
+				TO,
+				ROLE,
+				ALLOW_EMAIL,
+				DB_URL$1,
+				LINEAR_TOKEN,
+				NO_REPORT,
+				YES
+			]
+		},
+		{
+			name: "add",
+			envFree: true,
+			summary: "Save a new shared login to the collection, then send it.",
+			options: [
+				{
+					flag: "--name",
+					value: "<name>",
+					summary: "The item's name, e.g. Instagram."
+				},
+				{
+					flag: "--url",
+					value: "<url>",
+					summary: "The login page."
+				},
+				{
+					flag: "--username",
+					value: "<username>",
+					summary: "The login."
+				},
+				{
+					flag: "--owner",
+					value: "<name>",
+					summary: "The officer responsible for the account."
+				},
+				{
+					flag: "--password-stdin",
+					summary: "Read the password from stdin, for scripts."
+				},
+				TO,
+				ROLE,
+				ALLOW_EMAIL,
+				DB_URL$1,
+				LINEAR_TOKEN,
+				NO_REPORT,
+				YES
+			]
+		},
+		{
+			name: "renew",
+			envFree: true,
+			summary: "Extend Sends 30 days and re-sync their recipients.",
+			hint: "asks first for any with more than 7 days left",
+			options: [
+				ITEM,
+				LINEAR_TOKEN,
+				NO_REPORT,
+				YES
+			]
+		},
+		{
+			name: "list",
+			envFree: true,
+			dryRun: "read-only",
+			summary: "Shared accounts, their recipients and when each Send expires.",
+			hint: "reads only",
+			options: [JSON_FLAG]
+		},
+		{
+			name: "report",
+			envFree: true,
+			summary: "Regenerate the Shared Accounts Linear document.",
+			options: [LINEAR_TOKEN, {
+				flag: "--document",
+				value: "<id>",
+				summary: "A different Linear document id, for testing."
+			}]
+		}
+	]
+};
+//#endregion
 //#region src/deploy/catalog.ts
 /**
 * `deploy`'s place in the command tree: declaration only, nothing here runs.
@@ -1557,8 +1461,12 @@ const catalog = createCatalog({
 			commands: [graphicsCommand, qrCommand]
 		},
 		{
-			title: "Your own sign-in (gh login, club mailbox)",
-			commands: [githubCommand, newsletterCommand]
+			title: "Your own sign-in (gh login, club mailbox, Bitwarden)",
+			commands: [
+				githubCommand,
+				newsletterCommand,
+				credsCommand
+			]
 		},
 		{
 			title: "CLI utilities",
@@ -1567,4 +1475,4 @@ const catalog = createCatalog({
 	]
 });
 //#endregion
-export { repoPeerUrl as _, recordEnteredTier as a, renderHelp as b, setMenuEnvHook as c, formatCommand as d, nonEmpty as f, loadEnvSession as g, loadEnvLoad as h, beginInvocation as i, dbPush as l, loadEnv as m, bareGroupStartPath as n, recordResolved as o, getEnvSync as p, runMenu as r, reproducibleCommand as s, catalog as t, dbPushDryRun as u, helpPath as v, renderCommandList as y };
+export { recordEnteredTier as a, setMenuEnvHook as c, formatCommand as d, helpPath as f, beginInvocation as i, dbPush as l, renderHelp as m, bareGroupStartPath as n, recordResolved as o, renderCommandList as p, runMenu as r, reproducibleCommand as s, catalog as t, dbPushDryRun as u };