@devdogsuga/backstage 0.1.4 → 0.1.6

package/README.md

@@ -14,7 +14,8 @@ match. The two flags matter outside a DevDogsUGA checkout, where the workspace's
 `pnpm backstage` is the script).
 
 It **starts without a checkout**. Help, `version`, `completions`, the tools
-below that need no secrets (`graphics`, `qr`, `github`, `newsletter`, `creds`) and
+below that need no secrets (`graphics`, `qr`, `github`, `newsletter`, `creds`),
+`import`, `export` and
 anything run with `--no-env` never look for one; a command that reads a checkout says
 "run this from inside a DevDogsUGA clone" and exits 1. The DevDogsUGA libraries
 it reads (`@devdogsuga/env`, `@devdogsuga/db`) are optional peers, resolved
@@ -33,25 +34,31 @@ pnpm backstage qr https://devdogsuga.org --format svg,png,webp --logo acm
 pnpm backstage newsletter send 3.0.1 --to a@uga.edu   # asks first; --yes with no terminal
 pnpm backstage creds                             # share a club login with officers, as a Bitwarden Send
 pnpm backstage creds renew                       # extend every Send 30 days
+pnpm backstage import involvement --file OrganizationRoster.csv  # verify members; previews, then asks
+pnpm backstage import attendance --meeting 2026-09-09 --file sign-in.csv
+pnpm backstage export stars --from 2026-08-17   # audited under your gh login
 ```
 
 ## Commands
 
-| Command                                        | What it does                                                                           |
-| ---------------------------------------------- | -------------------------------------------------------------------------------------- |
-| `deploy <app> --tier <t>`                      | Checks `CLOUDFLARE_API_TOKEN`, writes the Worker's secrets file, deploys, removes it.  |
-| `deploy write-env`                             | Composes `.env.<DEPLOY_ENV>` from the GitHub environment.                              |
-| `deploy preflight`                             | Classifies the project: paused (skip) or broken (fail).                                |
-| `deploy plan`, `deploy migrate`                | Dry-run the migrations into the job summary; apply them to `DB_URL`.                   |
-| `deploy smoke --tier <t> [--app]`              | Public routes answer 200, the auth redirect works, this deploy's Sentry release shows. |
-| `deploy reconcile --tier <t>`                  | The platform's config reconcile, after the deploy (`CRON_SECRET`).                     |
-| `env pull\|push\|audit --target <t>`           | One env file per target, synced to Bitwarden and GitHub. `audit` lists orphans.        |
-| `planner status\|create\|reset-password\|drop` | The `migration_planner` role the preflight tier holds.                                 |
-| `graphics [graphic…]`                          | Club images from `@devdogsuga/brand`: `brand/*`, `app/*`, `event/*`.                   |
-| `qr <text>`                                    | QR codes with every option of `/console/qr`.                                           |
-| `github rulesets\|settings`                    | Diff (and with `--apply` write) GitHub config, through `gh`.                           |
-| `newsletter render\|draft\|send <issue…>`      | Changelog issues as files, mailbox drafts, or a send.                                  |
-| `creds send\|add\|renew\|list\|report`         | Club logins from Bitwarden as email-verified Sends, and the Linear report.             |
+| Command                                          | What it does                                                                           |
+| ------------------------------------------------ | -------------------------------------------------------------------------------------- |
+| `deploy <app> --tier <t>`                        | Checks `CLOUDFLARE_API_TOKEN`, writes the Worker's secrets file, deploys, removes it.  |
+| `deploy write-env`                               | Composes `.env.<DEPLOY_ENV>` from the GitHub environment.                              |
+| `deploy preflight`                               | Classifies the project: paused (skip) or broken (fail).                                |
+| `deploy plan`, `deploy migrate`                  | Dry-run the migrations into the job summary; apply them to `DB_URL`.                   |
+| `deploy smoke --tier <t> [--app]`                | Public routes answer 200, the auth redirect works, this deploy's Sentry release shows. |
+| `deploy reconcile --tier <t>`                    | The platform's config reconcile, after the deploy (`CRON_SECRET`).                     |
+| `env pull\|push\|audit --target <t>`             | One env file per target, synced to Bitwarden and GitHub. `audit` lists orphans.        |
+| `planner status\|create\|reset-password\|drop`   | The `migration_planner` role the preflight tier holds.                                 |
+| `graphics [graphic…]`                            | Club images from `@devdogsuga/brand`: `brand/*`, `app/*`, `event/*`.                   |
+| `qr <text>`                                      | QR codes with every option of `/console/qr`.                                           |
+| `github rulesets\|settings`                      | Diff (and with `--apply` write) GitHub config, through `gh`.                           |
+| `newsletter render\|draft\|send <issue…>`        | Changelog issues as files, mailbox drafts, or a send.                                  |
+| `creds send\|add\|renew\|list\|report`           | Club logins from Bitwarden as email-verified Sends, and the Linear report.             |
+| `import involvement --file <csv>`                | Verifies the members on the Involvement Network roster, unverifies everyone else.      |
+| `import attendance --meeting <day> --file <csv>` | Records a meeting's attendance from a sign-in sheet (method `import`).                 |
+| `export stars\|attendance\|reflections`          | Member data as CSV, each export audited under the officer's gh login.                  |
 
 `smoke` and `reconcile` replace DevDogsUGA's `packages/deploy-checks`. The
 per-app data (hosts, public paths, the protected path and its redirect) stays in
@@ -112,8 +119,10 @@ entry for them (`envFree` in the command tree).
 ## Shared logins: `creds`
 
 The club's shared logins (Instagram, Canva, ArchPass, Linktree, later project
-API keys) live only in the **Shared Accounts** collection of the DevDogs
-Bitwarden organization. `creds` hands them to officers as Bitwarden Sends:
+API keys) live in the DevDogs Bitwarden organization, in whatever collection
+suits them. `creds` hands any login or secure note there to officers as a
+Bitwarden Send. Personal items, other organizations' items and production
+secrets (which are in Secrets Manager, not the vault) are out of its reach.
 
 - **`send`** picks items and recipients (officers by name or by role, read live
   from production: everyone holding a role other than `Member`, by UGA MyID
@@ -122,16 +131,18 @@ Bitwarden organization. `creds` hands them to officers as Bitwarden Sends:
   recipients and deleted 30 days out. Removing an address revokes it. Addresses
   off the roster need `--allow-email`. Non-interactive: `--item`, `--to`,
   `--role`, `--yes`.
-- **`add`** saves a new login into the collection (org-owned), then sends it.
-  The password is typed at a hidden prompt, or read with `--password-stdin`;
-  never argv.
+- **`add`** saves a new login to the organization, then sends it. It goes in
+  the one collection you can see, or the one you pick (`--collection` with no
+  terminal). The password is typed at a hidden prompt, or read with
+  `--password-stdin`; never argv.
 - **`renew`** pushes each Send's deletion 30 days out in place (the link stays)
   and re-syncs its recipients and body from the item. It asks first for any Send
   with more than 7 days left.
 - **`list`** prints items, recipients and expiry (`--json` for scripts).
 - **`report`** regenerates the **Shared Accounts** Linear document (Platform &
-  DevOps initiative), which `send`, `add` and `renew` also do. It is generated
-  whole; edits there are overwritten.
+  DevOps initiative), which `send`, `add` and `renew` also do. It lists only
+  items that have been shared, and is generated whole; edits there are
+  overwritten.
 
 Each item's custom fields are the only access record: `Recipients`, `Owner`,
 `Send ID`, `Send link`, `Send expires`, `Send account`. Sends belong to the
@@ -144,6 +155,62 @@ checkout, else Secrets Manager. The Linear key: `--linear-token`, then
 `LINEAR_API_KEY`, then the vault item "DevDogs Linear API key (backstage)", then
 a prompt; it is never saved.
 
+## Member data: `import` and `export`
+
+These replace the platform's `/console/verification` upload and
+`/console/exports` downloads. They read and write production only:
+`DB_URL`, `API_URL` and `SECRET_KEY` come from `.env.production` in a checkout,
+else Secrets Manager. There is no `--db-url`, since a database override would
+leave account creation pointed at production. Days (`--meeting 2026-09-09`,
+`--from`, `--to`) are Eastern, and `--to` includes the whole day.
+
+### `import involvement`
+
+Replaces the platform's `/console/verification` upload. Export the roster from
+the UGA Involvement Network (Roster → Export → Organization Roster) and pass the
+file as it downloads: the title lines above the header, the `(Hidden)` columns
+and the one-row-per-position layout are all expected. A roster for another
+organization is refused.
+
+The roster is the whole truth: everyone on it is verified, and everyone
+verified who is not on it loses that status. A roster email finds its account
+by the profile's UGA email first, then the sign-in address; with no account,
+one is created (confirmed, no invite email) so the member is verified the first
+time they sign in. Every run previews the counts, who is newly verified, who
+loses verification, and whose preferred name differs from the roster, then
+asks; `--dry-run` stops there, `--yes` answers with no terminal. Preferred
+names are never changed. Rerunning the same export changes nothing.
+
+### `import attendance`
+
+Records a meeting's attendance from a sign-in sheet, for members who could not
+check in on the platform. The sheet is a Google or Microsoft Forms response
+export or a hand-made spreadsheet, saved as CSV; one sheet is one meeting,
+named with `--meeting` (its day, slug, config id or id; a day with two meetings
+asks for the slug). The header and columns are found, not assumed: the email
+column is the one holding UGA addresses, the name is "First/Last Name" or a
+column mentioning "name", and `--email-column`/`--name-column` override
+either. A sheet with no header is read as every address in it. Only UGA
+addresses count; anything else is listed and skipped.
+
+Check-ins are written with method `import`, stamped with the meeting's start,
+and count for stars like any other. A member's own check-in is never touched.
+Someone with no account gets one (confirmed, no invite), named from the sheet;
+with no name on the sheet they are listed and skipped. Cancelled and future
+meetings are refused. Rerunning a sheet records nothing new; `--replace`
+makes the sheet the meeting's whole imported set, removing earlier imported
+rows it no longer lists. Every run previews, then asks (`--dry-run`, `--yes`).
+
+### `export stars|attendance|reflections`
+
+The platform's three CSVs, columns unchanged: `stars` (one row per earned
+star), `attendance` (one row per check-in; `--meeting` for one night) and
+`reflections` (each member's current text). Each export writes a
+`platform.exportAudit` row before reading anything, attributed to the
+platform account linked to the GitHub login `gh` is signed in as, and refuses
+to run when there is none. The file goes to `./<kind>….csv` (owner-readable
+only, never over an existing file without `--yes`) or stdout with `--out -`.
+
 No secret value reaches stdout, stderr, the failure log, Sentry, an error
 message or argv: values go to `bw` as base64 JSON on stdin, every error is
 scrubbed of every value read so far (`src/creds/secrets.ts`), and the clipboard

package/dist/{catalog-BuNLUu08.js → catalog-Dke7bQVz.js}

@@ -1,7 +1,9 @@
 import { A as YES, D as DRY_RUN, O as JSON_FLAG, j as createCatalog, k as SCOPES, v as noteRan, w as findRepoRoot } from "./telemetry-Bjoz29Hl.js";
-import { o as isDryRun, r as qrCatalogOptions } from "./options-BTjOf5KP.js";
+import { n as isDryRun } from "./dry-run-3IxPmCtW.js";
 import { o as unwrap } from "./ui-CdKo8mLw.js";
 import { n as positionals } from "./args-Cjr_Iqts.js";
+import { t as EXPORTS } from "./queries-DeEwfe2c.js";
+import { r as qrCatalogOptions } from "./options-DCaqm8BI.js";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { confirm, note, select, text } from "@clack/prompts";
@@ -928,9 +930,9 @@ const completionsCommand = {
 const ITEM = {
 	flag: "--item",
 	value: "<name>",
-	summary: "A Shared Accounts item, by name or id. Repeat for several."
+	summary: "A DevDogs organization item, by name or id. Repeat for several."
 };
-const TO = {
+const TO$1 = {
 	flag: "--to",
 	value: "<a@uga.edu,…>",
 	summary: "Recipients, comma-separated. Replaces the item's current list."
@@ -970,7 +972,7 @@ const credsCommand = {
 			hint: "pick accounts, then officers",
 			options: [
 				ITEM,
-				TO,
+				TO$1,
 				ROLE,
 				ALLOW_EMAIL,
 				DB_URL$1,
@@ -982,7 +984,7 @@ const credsCommand = {
 		{
 			name: "add",
 			envFree: true,
-			summary: "Save a new shared login to the collection, then send it.",
+			summary: "Save a new login to the DevDogs organization, then send it.",
 			options: [
 				{
 					flag: "--name",
@@ -1004,11 +1006,16 @@ const credsCommand = {
 					value: "<name>",
 					summary: "The officer responsible for the account."
 				},
+				{
+					flag: "--collection",
+					value: "<name>",
+					summary: "Where to save it, when you can see more than one."
+				},
 				{
 					flag: "--password-stdin",
 					summary: "Read the password from stdin, for scripts."
 				},
-				TO,
+				TO$1,
 				ROLE,
 				ALLOW_EMAIL,
 				DB_URL$1,
@@ -1205,6 +1212,61 @@ const envCommand = {
 	]
 };
 //#endregion
+//#region src/export/catalog.ts
+/**
+* `export`'s place in the command tree: declaration only, nothing here runs.
+* The handler lives in `commands.ts` beside it.
+*
+* `envFree` like `involvement`: production's `DB_URL` comes from the
+* checkout's `.env.production` or Secrets Manager, and the audit identity from
+* `gh`, so it runs under `pnpm dlx`.
+*/
+const FROM = {
+	flag: "--from",
+	value: "<day>",
+	summary: "From this Eastern day (or ISO timestamp), inclusive."
+};
+const TO = {
+	flag: "--to",
+	value: "<day>",
+	summary: "Through this Eastern day (or before this ISO timestamp)."
+};
+const OUT = {
+	flag: "--out",
+	value: "<path|->",
+	summary: "Where to write. Defaults to ./<kind>….csv; - for stdout."
+};
+function exportOf(kind, extra = []) {
+	return {
+		name: kind,
+		envFree: true,
+		dryRun: "handled",
+		summary: EXPORTS[kind].summary,
+		options: [
+			FROM,
+			TO,
+			...extra,
+			OUT,
+			DRY_RUN,
+			YES
+		]
+	};
+}
+const exportCommand = {
+	name: "export",
+	summary: "Member data as CSV: stars, attendance, reflections. Audited.",
+	hint: "production database; your gh login is recorded",
+	subcommands: [
+		exportOf("stars"),
+		exportOf("attendance", [{
+			flag: "--meeting",
+			value: "<meeting>",
+			summary: "One meeting: its day (2026-09-09), slug, config id or id."
+		}]),
+		exportOf("reflections")
+	]
+};
+//#endregion
 //#region src/github/catalog.ts
 /**
 * `github`'s place in the command tree: declaration only, nothing here runs.
@@ -1298,6 +1360,63 @@ const graphicsCommand = {
 	]
 };
 //#endregion
+//#region src/import/catalog.ts
+const importCommand = {
+	name: "import",
+	summary: "Member data in: the Involvement roster, a meeting's sign-in sheet.",
+	hint: "production database; previews, then asks",
+	subcommands: [{
+		name: "involvement",
+		envFree: true,
+		dryRun: "handled",
+		summary: "Import an Organization Roster export: verify everyone on it, unverify everyone else.",
+		hint: "previews, then asks",
+		options: [
+			{
+				flag: "--file",
+				value: "<csv>",
+				summary: "The roster export (Involvement Network → Roster → Export → Organization Roster)."
+			},
+			DRY_RUN,
+			YES
+		]
+	}, {
+		name: "attendance",
+		envFree: true,
+		dryRun: "handled",
+		summary: "Import a sign-in sheet (form responses or a spreadsheet, as CSV) for one meeting.",
+		hint: "previews, then asks",
+		options: [
+			{
+				flag: "--meeting",
+				value: "<meeting>",
+				summary: "The meeting: its day (2026-09-09), slug, config id or id."
+			},
+			{
+				flag: "--file",
+				value: "<csv>",
+				summary: "The sign-in sheet, saved as CSV."
+			},
+			{
+				flag: "--email-column",
+				value: "<header>",
+				summary: "The column of UGA addresses, when there are several."
+			},
+			{
+				flag: "--name-column",
+				value: "<header>",
+				summary: "The column of names, used for new accounts."
+			},
+			{
+				flag: "--replace",
+				summary: "Make this sheet the meeting's whole imported set: remove earlier imported rows it lacks."
+			},
+			DRY_RUN,
+			YES
+		]
+	}]
+};
+//#endregion
 //#region src/newsletter/catalog.ts
 /**
 * `newsletter`'s place in the command tree: declaration only, nothing here
@@ -1453,8 +1572,12 @@ const catalog = createCatalog({
 			commands: [envCommand]
 		},
 		{
-			title: "Database roles",
-			commands: [plannerCommand]
+			title: "Production database",
+			commands: [
+				plannerCommand,
+				importCommand,
+				exportCommand
+			]
 		},
 		{
 			title: "Graphics & QR codes (no credentials)",

package/dist/{cli-BI5Vn9sR.js → cli-BhZ4je2D.js}

@@ -1,13 +1,13 @@
 import { C as discoverRepoRoot, T as cliName, b as ownPackageDir, c as reportDevtoolsError, f as isNoEnv, l as reportDevtoolsFailure, n as captureDevtoolsError, o as initDevtoolsTelemetry, p as isNonInteractive, w as findRepoRoot, x as ownVersion } from "./telemetry-Bjoz29Hl.js";
-import { a as recordEnteredTier, f as helpPath, i as beginInvocation, l as dbPush, m as renderHelp, n as bareGroupStartPath, o as recordResolved, p as renderCommandList, r as runMenu, s as reproducibleCommand, t as catalog, u as dbPushDryRun } from "./catalog-BuNLUu08.js";
+import { a as recordEnteredTier, f as helpPath, i as beginInvocation, l as dbPush, m as renderHelp, n as bareGroupStartPath, o as recordResolved, p as renderCommandList, r as runMenu, s as reproducibleCommand, t as catalog, u as dbPushDryRun } from "./catalog-Dke7bQVz.js";
 import { a as repoPeerUrl, n as loadEnv, r as loadEnvLoad, t as getEnvSync } from "./peers-B0KDkI6a.js";
 import { t as nonEmpty } from "./connection-D3XsOE3S.js";
-import { a as dryRunKind, l as wouldRunLine, o as isDryRun } from "./options-BTjOf5KP.js";
+import { a as wouldRunLine, n as isDryRun, t as dryRunKind } from "./dry-run-3IxPmCtW.js";
 import { a as explainError, i as explain, n as bail, o as unwrap, r as errorMessage } from "./ui-CdKo8mLw.js";
 import { n as positionals, t as flagValue } from "./args-Cjr_Iqts.js";
-import { a as listSecrets$1, c as updateSecret, i as createSecret, o as projectIdFor, r as byKey, s as setExplicitAccessToken } from "./client-B7HhuTaA.js";
-import { c as EnvDocument } from "./vault-C8LYJFOQ.js";
 import { t as DONE } from "./dispatch-D048O65I.js";
+import { t as EnvDocument } from "./document-DumoZXoO.js";
+import { a as listSecrets$1, c as updateSecret, i as createSecret, o as projectIdFor, r as byKey, s as setExplicitAccessToken } from "./client-B_MY9kVI.js";
 import { register } from "node:module";
 import { pathToFileURL } from "node:url";
 import { appendFileSync, existsSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
@@ -17,9 +17,9 @@ import { chmod, readFile, writeFile } from "node:fs/promises";
 import { execFile, execFileSync, spawn } from "node:child_process";
 import { promisify } from "node:util";
 import { tmpdir } from "node:os";
+import postgres from "postgres";
 import { z } from "zod";
 import { randomBytes } from "node:crypto";
-import postgres from "postgres";
 //#region ../cli-core/src/completions.ts
 /**
 * Groups all paths by their parent prefix to build per-parent completion lists.
@@ -5268,9 +5268,11 @@ const HANDLERS = {
 	completions: handleCompletions,
 	github: handleGithub,
 	graphics: async (rest) => (await import("./commands-Dv5TXjvb.js")).handleGraphics(rest),
-	qr: async (rest) => (await import("./commands-Bk7IbhPD.js")).handleQr(rest),
+	qr: async (rest) => (await import("./commands-Sx1fDNNn.js")).handleQr(rest),
 	newsletter: async (rest) => (await import("./commands-D345F-Od.js")).handleNewsletter(rest),
-	creds: async (rest) => (await import("./commands-Dl3UlhBf.js")).handleCreds(rest)
+	creds: async (rest) => (await import("./commands-zPSnOGzH.js")).handleCreds(rest),
+	import: async (rest) => (await import("./commands-DzALVX5g.js")).handleImport(rest),
+	export: async (rest) => (await import("./commands-5Ou8xJw5.js")).handleExport(rest)
 };
 /**
 * Names that were commands of the contributor CLI, refused with where they

package/dist/cli-Do2nWD7W.js

@@ -0,0 +1,136 @@
+import { C as discoverRepoRoot, p as isNonInteractive } from "./telemetry-Bjoz29Hl.js";
+import { t as nonEmpty } from "./connection-D3XsOE3S.js";
+import { a as explainError, i as explain, o as unwrap, t as UsageError } from "./ui-CdKo8mLw.js";
+import { t as EnvDocument } from "./document-DumoZXoO.js";
+import { resolve } from "node:path";
+import { confirm, log, text } from "@clack/prompts";
+import { readFile } from "node:fs/promises";
+import postgres from "postgres";
+//#region src/production/access.ts
+/**
+* Production access for the commands that read or write member data
+* (`involvement`, `attendance`, `export`).
+*
+* Every key comes from one place, so a run never splits across two projects:
+* the checkout's `.env.production`, else the production Secrets Manager
+* project. There is deliberately no `--db-url`; a database override would
+* leave account creation (which goes through Auth with `API_URL`) pointed at
+* production.
+*/
+/** A failure already worded for the officer. Safe to print. */
+var ProductionError = class extends Error {
+	name = "ProductionError";
+};
+/** The production project in Secrets Manager (see `creds/roster.ts`). */
+const PRODUCTION_PROJECT = "production";
+/** `.env.production` in a checkout, else the production Secrets Manager project. */
+async function readProductionKey(key) {
+	const root = discoverRepoRoot();
+	if (root) try {
+		const text = await readFile(resolve(root, ".env.production"), "utf8");
+		const value = nonEmpty(EnvDocument.parse(text).get(key));
+		if (value) return value;
+	} catch {}
+	const { listSecrets, projectIdFor } = await import("./client-DwDGjalU.js");
+	const secrets = await listSecrets(await projectIdFor(PRODUCTION_PROJECT));
+	return nonEmpty(secrets.find((s) => s.key === key)?.value);
+}
+async function requireProductionKey(key) {
+	const value = await readProductionKey(key);
+	if (!value) throw new ProductionError(`Could not find production's ${key}. Run \`backstage env pull --target production\` in a checkout, or sign in to Secrets Manager.`);
+	return value;
+}
+/**
+* A database failure, described without the connection string: postgres.js
+* can quote the host, and the URL carries the password. A server error
+* (a five-character SQLSTATE) is the server's own message, which never does.
+*/
+function dbError(what, err) {
+	const e = err;
+	return new ProductionError(`${what}: ${(e.code && /^[0-9A-Z]{5}$/.test(e.code) ? e.message : e.code) ?? "connection failed"}.`);
+}
+/** One short-lived connection; callers `end()` it. */
+function connect(url) {
+	return postgres(url, {
+		max: 1,
+		prepare: false,
+		connect_timeout: 15
+	});
+}
+/** Runs `fn` on a fresh connection and closes it, rewording failures. */
+async function withConnection(url, what, fn) {
+	const sql = connect(url);
+	try {
+		return await fn(sql);
+	} catch (err) {
+		if (err instanceof ProductionError) throw err;
+		throw dbError(what, err);
+	} finally {
+		await sql.end({ timeout: 5 });
+	}
+}
+//#endregion
+//#region src/production/cli.ts
+/**
+* The terminal half shared by the member-data commands: progress lines, the
+* input file, and the one confirmation before production is written.
+*/
+/** Progress for a person; plain stderr lines when nobody is watching a terminal. */
+function say(message, level = "info") {
+	if (isNonInteractive()) process.stderr.write(`${message}\n`);
+	else log[level](message);
+}
+function plural(n, one, many = `${one}s`) {
+	return `${n} ${n === 1 ? one : many}`;
+}
+/** Whether a person can answer a prompt. */
+function canPrompt() {
+	return !isNonInteractive() && process.stdin.isTTY === true;
+}
+function expandHome(path) {
+	return path.startsWith("~/") ? `${process.env.HOME ?? "~"}${path.slice(1)}` : path;
+}
+/** `--file`, else asked for at a terminal; then read. */
+async function readInputFile(file, options) {
+	let path = file;
+	if (!path) {
+		if (!options.interactive) throw new UsageError(`Pass the file with --file <${options.placeholder}>.`);
+		path = unwrap(await text({
+			message: options.message,
+			placeholder: options.placeholder,
+			validate: (v) => v?.trim() ? void 0 : "A path, please."
+		})).trim();
+	}
+	const full = expandHome(path);
+	try {
+		return await (options.read ?? ((p) => readFile(p, "utf8")))(full);
+	} catch {
+		throw new UsageError(`Could not read ${full}.`);
+	}
+}
+/**
+* The one question before production is written. `--yes` answers it; with no
+* terminal and no `--yes`, the command stops rather than guess. Defaults to no.
+*/
+async function confirmWrite(question, options) {
+	if (options.yes) return true;
+	if (!options.interactive) throw new UsageError(`${question} Pass --yes to answer yes without a terminal.`);
+	return unwrap(await confirm({
+		message: question,
+		initialValue: false
+	}));
+}
+/**
+* The shared `catch`: a worded failure is explained and the run exits 1; any
+* other error is unexpected and goes to Sentry with the command's name.
+*/
+function reportFailure(command, err, worded = []) {
+	process.exitCode = 1;
+	if (err instanceof UsageError || err instanceof ProductionError || worded.some((kind) => err instanceof kind)) {
+		explain(err.message, "");
+		return;
+	}
+	explainError(`${command} failed.`, err);
+}
+//#endregion
+export { reportFailure as a, connect as c, withConnection as d, readInputFile as i, dbError as l, confirmWrite as n, say as o, plural as r, ProductionError as s, canPrompt as t, requireProductionKey as u };

package/dist/{client-B7HhuTaA.js → client-B_MY9kVI.js}

@@ -1,7 +1,8 @@
 import { w as findRepoRoot } from "./telemetry-Bjoz29Hl.js";
 import { n as loadEnv } from "./peers-B0KDkI6a.js";
 import { o as unwrap } from "./ui-CdKo8mLw.js";
-import { a as readTokenFromVault, c as EnvDocument, o as saveTokenToVault, t as VAULT_ITEM_NAME } from "./vault-C8LYJFOQ.js";
+import { t as EnvDocument } from "./document-DumoZXoO.js";
+import { a as readTokenFromVault, o as saveTokenToVault, t as VAULT_ITEM_NAME } from "./vault-CsBC-1Mq.js";
 import { dirname, join, resolve } from "node:path";
 import { log, password, select, text } from "@clack/prompts";
 import { mkdir, readFile, writeFile } from "node:fs/promises";

package/dist/client-DwDGjalU.js

@@ -0,0 +1,2 @@
+import { a as listSecrets, o as projectIdFor } from "./client-B_MY9kVI.js";
+export { listSecrets, projectIdFor };