@devdogsuga/backstage 0.1.4 → 0.1.6

package/dist/commands-CLSxKz-l.js

@@ -0,0 +1,352 @@
+import { n as isDryRun } from "./dry-run-3IxPmCtW.js";
+import { r as errorMessage, t as UsageError } from "./ui-CdKo8mLw.js";
+import { t as DONE } from "./dispatch-D048O65I.js";
+import { a as reportFailure, d as withConnection, i as readInputFile, n as confirmWrite, o as say, r as plural, t as canPrompt, u as requireProductionKey } from "./cli-Do2nWD7W.js";
+import { a as createAccounts, i as createAccountFor, n as accountFinder, o as readAccounts, t as parseCsv } from "./read-B-aJJewb.js";
+import { parseArgs } from "node:util";
+//#region src/involvement/csv.ts
+/**
+* Reading the UGA Involvement Network's "Organization Roster" export.
+*
+* The export is not a plain CSV. It opens with a title line, a blank line and
+* an `Organization,date` line before the header, hides most columns as
+* `(Hidden)`, and lists a person once per position they hold, so an officer
+* appears as both `Member` and `President`. The header is found rather than
+* assumed to be the first line, which is what broke the platform's upload: it
+* took `Organization Roster` for the header and found no rows.
+*/
+var RosterFormatError = class extends Error {
+	name = "RosterFormatError";
+};
+/** Header names for each field, the first one present wins. */
+const COLUMNS = {
+	firstName: ["first name"],
+	lastName: ["last name"],
+	email: ["campus email", "email"],
+	organization: ["organization name"],
+	position: ["position name"]
+};
+function columnIndex(header, names) {
+	const normalized = header.map((h) => h.trim().toLowerCase());
+	for (const name of names) {
+		const i = normalized.indexOf(name);
+		if (i >= 0) return i;
+	}
+	return -1;
+}
+function clean(value) {
+	const v = (value ?? "").trim();
+	return v === "(Hidden)" ? "" : v;
+}
+function parseRoster(text) {
+	const rows = parseCsv(text);
+	const headerAt = rows.findIndex((r) => columnIndex(r, COLUMNS.firstName) >= 0 && columnIndex(r, COLUMNS.lastName) >= 0 && columnIndex(r, COLUMNS.email) >= 0);
+	if (headerAt < 0) throw new RosterFormatError("No header row with \"First Name\", \"Last Name\" and \"Campus Email\". Export the roster from the Involvement Network's Roster page (Export → Organization Roster) and pass that file.");
+	const header = rows[headerAt];
+	const at = {
+		firstName: columnIndex(header, COLUMNS.firstName),
+		lastName: columnIndex(header, COLUMNS.lastName),
+		email: columnIndex(header, COLUMNS.email),
+		organization: columnIndex(header, COLUMNS.organization),
+		position: columnIndex(header, COLUMNS.position)
+	};
+	const byEmail = /* @__PURE__ */ new Map();
+	const organizations = /* @__PURE__ */ new Set();
+	const skippedLines = [];
+	const conflicting = /* @__PURE__ */ new Set();
+	rows.slice(headerAt + 1).forEach((row, i) => {
+		if (row.every((cell) => cell.trim() === "")) return;
+		const email = clean(row[at.email]).toLowerCase();
+		const firstName = clean(row[at.firstName]);
+		const lastName = clean(row[at.lastName]);
+		if (!email.includes("@") || !firstName || !lastName) {
+			skippedLines.push(headerAt + i + 2);
+			return;
+		}
+		if (at.organization >= 0) {
+			const org = clean(row[at.organization]);
+			if (org) organizations.add(org);
+		}
+		const position = at.position >= 0 ? clean(row[at.position]) : "";
+		const existing = byEmail.get(email);
+		if (existing) {
+			if (existing.firstName !== firstName || existing.lastName !== lastName) conflicting.add(email);
+			if (position && !existing.positions.includes(position)) existing.positions.push(position);
+			return;
+		}
+		byEmail.set(email, {
+			email,
+			firstName,
+			lastName,
+			positions: position ? [position] : []
+		});
+	});
+	return {
+		members: [...byEmail.values()],
+		organizations: [...organizations],
+		skippedLines,
+		conflictingNames: [...conflicting]
+	};
+}
+//#endregion
+//#region src/involvement/plan.ts
+/**
+* What an import would do, worked out before anything is written.
+*
+* The roster is the whole truth about who is involved: everyone on it is
+* verified, and everyone verified who is not on it loses that status. So the
+* plan is four lists, and the preview prints them before the confirmation.
+*
+* Preferred names are never changed: the roster's spelling may not be the
+* name a member goes by, and the preferred name is what the site shows. A
+* difference is listed for an officer to follow up on.
+*
+* A roster email finds its account the way `production/accounts.ts` says:
+* the profile's `ugaEmail` first, then the sign-in address.
+*/
+function nonBlank(value) {
+	const v = value?.trim();
+	if (!v) return void 0;
+	return v;
+}
+function planImport(members, accounts) {
+	const find = accountFinder(accounts);
+	const plan = {
+		create: [],
+		verify: [],
+		keep: [],
+		drop: [],
+		sharedAccounts: [],
+		nameDiffers: []
+	};
+	const claimed = /* @__PURE__ */ new Set();
+	for (const member of members) {
+		const account = find(member.email);
+		if (!account) {
+			plan.create.push(member);
+			continue;
+		}
+		if (claimed.has(account.userId)) {
+			plan.sharedAccounts.push({
+				email: member.email,
+				userId: account.userId
+			});
+			continue;
+		}
+		claimed.add(account.userId);
+		const match = {
+			member,
+			userId: account.userId,
+			hasProfile: account.hasProfile,
+			preferredName: account.preferredName
+		};
+		const rosterName = `${member.firstName} ${member.lastName}`.toLowerCase();
+		if (account.hasProfile && account.preferredName?.trim().toLowerCase() !== rosterName) plan.nameDiffers.push(match);
+		if (account.involvementFirstName != null) plan.keep.push(match);
+		else plan.verify.push(match);
+	}
+	for (const account of accounts) {
+		if (account.involvementFirstName == null || claimed.has(account.userId)) continue;
+		plan.drop.push({
+			userId: account.userId,
+			name: nonBlank(account.preferredName) ?? `${account.involvementFirstName} ${account.involvementLastName ?? ""}`.trim()
+		});
+	}
+	plan.drop.sort((a, b) => a.name.localeCompare(b.name));
+	return plan;
+}
+/** Everyone the import writes a profile for, created accounts excluded. */
+function matches(plan) {
+	return [...plan.verify, ...plan.keep];
+}
+//#endregion
+//#region src/involvement/store.ts
+/**
+* The write half of `import involvement`, after `plan.ts` has matched the
+* roster against production's accounts (`production/accounts.ts`) and any
+* missing accounts have been created.
+*
+* Accounts are created before this transaction, because Auth is a separate
+* service. If the transaction then fails, those accounts exist without
+* profiles; the next run finds them by sign-in address and inserts the
+* profiles, so a rerun is the recovery.
+*/
+/**
+* Upserts every roster member's profile, then clears involvement from every
+* profile not among them, in one transaction.
+*
+* A new profile takes the roster's name as its preferred name; an existing
+* one keeps its own (see `plan.ts`). The durable identity columns (`ugaEmail`, `legal*`,
+* `identitySourcedAt`) are written for everyone on the roster and never
+* cleared, so missing one export does not erase who someone is.
+*/
+const APPLY_UPSERT = `
+insert into "platform"."profile" as p (
+  "userId", "preferredName",
+  "involvementFirstName", "involvementLastName", "involvementImportedAt",
+  "ugaEmail", "legalFirstName", "legalLastName", "identitySourcedAt"
+)
+select t.u, t.f || ' ' || t.l, t.f, t.l, now(), t.e, t.f, t.l, now()
+from unnest($1::uuid[], $2::text[], $3::text[], $4::text[]) as t(u, f, l, e)
+on conflict ("userId") do update set
+  "involvementFirstName" = excluded."involvementFirstName",
+  "involvementLastName" = excluded."involvementLastName",
+  "involvementImportedAt" = excluded."involvementImportedAt",
+  "ugaEmail" = excluded."ugaEmail",
+  "legalFirstName" = excluded."legalFirstName",
+  "legalLastName" = excluded."legalLastName",
+  "identitySourcedAt" = excluded."identitySourcedAt"
+`;
+const APPLY_CLEAR = `
+update "platform"."profile"
+set "involvementFirstName" = null,
+    "involvementLastName" = null,
+    "involvementImportedAt" = null
+where not ("userId" = any($1::uuid[]))
+  and ("involvementFirstName" is not null or "involvementImportedAt" is not null)
+`;
+function applyImportFor(url) {
+	return (writes) => {
+		const ids = writes.map((w) => w.userId);
+		return withConnection(url, "The import was rolled back", (sql) => sql.begin(async (tx) => {
+			const upserted = await tx.unsafe(APPLY_UPSERT, [
+				ids,
+				writes.map((w) => w.firstName),
+				writes.map((w) => w.lastName),
+				writes.map((w) => w.email)
+			]);
+			const cleared = await tx.unsafe(APPLY_CLEAR, [ids]);
+			return {
+				written: upserted.count,
+				cleared: cleared.count
+			};
+		}));
+	};
+}
+//#endregion
+//#region src/involvement/commands.ts
+/**
+* `backstage import involvement --file <OrganizationRoster.csv>`: verify the
+* members on the UGA Involvement Network roster.
+*
+* Replaces the platform's /console/verification upload. Officers export the
+* roster from the Involvement Network (Roster → Export → Organization Roster)
+* and run this against production:
+*
+* 1. read and check the export (`csv.ts`): its organization must be DevDogs;
+* 2. read every account and plan the import (`plan.ts`);
+* 3. print who is newly verified, who loses verification, and how many
+*    accounts would be created, then ask;
+* 4. create the missing accounts and write the profiles (`store.ts`).
+*
+* `--dry-run` stops after the preview. Production's `DB_URL`, `API_URL` and
+* `SECRET_KEY` come from the checkout's `.env.production`, else Secrets
+* Manager, so it runs under `pnpm dlx` with no checkout.
+*
+* Preferred names are never changed, so the homepage's officer board (which
+* caches them) needs no invalidation.
+*/
+/** The organization a roster must be for. Compared case-insensitively. */
+const ORGANIZATION = "DevDogs";
+function parse(argv) {
+	try {
+		return parseArgs({
+			args: [...argv],
+			options: {
+				file: { type: "string" },
+				yes: { type: "boolean" },
+				"dry-run": { type: "boolean" }
+			},
+			allowPositionals: false,
+			strict: true
+		}).values;
+	} catch (err) {
+		throw new UsageError(errorMessage(err));
+	}
+}
+/** The preview: what changes, by whom. Never lists every kept member. */
+function describePlan(plan, members) {
+	const lines = [
+		`${plural(members, "member")} on the roster:`,
+		`  ${plan.keep.length} already verified`,
+		`  ${plan.verify.length} newly verified (have an account)`,
+		`  ${plan.create.length} without an account, to be created and verified`,
+		`  ${plan.drop.length} verified now but not on the roster, to lose verification`
+	];
+	if (plan.verify.length > 0) lines.push("", "Newly verified:", ...plan.verify.map((m) => `  ${m.member.firstName} ${m.member.lastName} <${m.member.email}>`));
+	if (plan.drop.length > 0) lines.push("", "Losing verification:", ...plan.drop.map((d) => `  ${d.name}`));
+	if (plan.nameDiffers.length > 0) lines.push("", "Preferred name differs from the roster (left as is):", ...plan.nameDiffers.map((m) => `  ${m.preferredName ?? "(none)"}: roster says ${m.member.firstName} ${m.member.lastName}`));
+	if (plan.sharedAccounts.length > 0) lines.push("", "Skipped, their account already matched another roster email:", ...plan.sharedAccounts.map((s) => `  ${s.email}`));
+	return lines.join("\n");
+}
+async function runInvolvement(argv, deps = {}) {
+	const interactive = deps.interactive ?? canPrompt();
+	try {
+		const values = parse(argv);
+		const dryRun = values["dry-run"] === true || isDryRun();
+		const roster = parseRoster(await readInputFile(values.file, {
+			interactive,
+			message: "Path to the Involvement Network roster export",
+			placeholder: "OrganizationRoster.csv",
+			read: deps.readFile
+		}));
+		const wrongOrg = roster.organizations.filter((o) => o.toLowerCase() !== ORGANIZATION.toLowerCase());
+		if (wrongOrg.length > 0) throw new UsageError(`This roster is for ${wrongOrg.join(", ")}, not ${ORGANIZATION}.`);
+		if (roster.members.length === 0) throw new UsageError("The roster has no members with a name and email.");
+		if (roster.skippedLines.length > 0) say(`Skipped ${plural(roster.skippedLines.length, "row")} missing a name or email (lines ${roster.skippedLines.join(", ")}).`, "warn");
+		if (roster.conflictingNames.length > 0) say(`Listed under two names, kept the first: ${roster.conflictingNames.join(", ")}.`, "warn");
+		const dbUrl = deps.accounts ? void 0 : await requireProductionKey("DB_URL");
+		const accounts = await (deps.accounts ?? (() => readAccounts(dbUrl)))();
+		const plan = planImport(roster.members, accounts);
+		process.stderr.write(`${describePlan(plan, roster.members.length)}\n`);
+		if (dryRun) {
+			say("Dry run: nothing written.");
+			return;
+		}
+		if (plan.create.length === 0 && plan.verify.length === 0 && plan.drop.length === 0 && plan.keep.length === 0) {
+			say("Nothing to import.");
+			return;
+		}
+		const question = `Import into production: create ${plural(plan.create.length, "account")}, verify ${plan.verify.length}, unverify ${plan.drop.length}?`;
+		if (!await confirmWrite(question, {
+			yes: values.yes === true,
+			interactive
+		})) {
+			say("Nothing written.");
+			return;
+		}
+		let create = deps.createAccount;
+		if (!create && plan.create.length > 0) create = createAccountFor(await requireProductionKey("API_URL"), await requireProductionKey("SECRET_KEY"));
+		const { created: createdIds, failed } = create ? await createAccounts(plan.create.map((m) => m.email), create) : {
+			created: /* @__PURE__ */ new Map(),
+			failed: []
+		};
+		const created = plan.create.flatMap((m) => {
+			const userId = createdIds.get(m.email);
+			return userId ? [{
+				userId,
+				email: m.email,
+				firstName: m.firstName,
+				lastName: m.lastName
+			}] : [];
+		});
+		if (failed.length > 0) say(`Could not create ${plural(failed.length, "account")}; they stay unverified until the next import:\n${failed.map((f) => `  ${f.email}: ${f.reason}`).join("\n")}`, "warn");
+		const writes = [...matches(plan).map((m) => ({
+			userId: m.userId,
+			email: m.member.email,
+			firstName: m.member.firstName,
+			lastName: m.member.lastName
+		})), ...created];
+		const { written, cleared } = await (deps.apply ?? applyImportFor(dbUrl))(writes);
+		say(`Imported: ${plural(written, "profile")} verified (${plural(created.length, "new account")}), ${cleared} unverified.`, "success");
+		if (failed.length > 0) process.exitCode = 1;
+	} catch (err) {
+		reportFailure("import involvement", err, [RosterFormatError]);
+	}
+}
+const handleInvolvement = async (rest) => {
+	await runInvolvement(rest);
+	return process.exitCode ? null : DONE;
+};
+//#endregion
+export { handleInvolvement };

package/dist/commands-DzALVX5g.js

@@ -0,0 +1,12 @@
+import { i as explain } from "./ui-CdKo8mLw.js";
+//#region src/import/commands.ts
+const handleImport = async (rest) => {
+	const [what, ...args] = rest;
+	if (what === "involvement") return (await import("./commands-CLSxKz-l.js")).handleInvolvement(args);
+	if (what === "attendance") return (await import("./commands-BQ2NIqub.js")).handleAttendance(args);
+	explain(what ? `Unknown import "${what}". Try involvement or attendance.` : "Name the import: involvement or attendance.", "");
+	process.exitCode = 1;
+	return null;
+};
+//#endregion
+export { handleImport };

package/dist/{commands-Bk7IbhPD.js → commands-Sx1fDNNn.js}

@@ -1,6 +1,7 @@
 import { p as isNonInteractive } from "./telemetry-Bjoz29Hl.js";
-import { i as qrParseOptions, n as QR_FLAGS, o as isDryRun, t as QR_EXTRA_FLAGS } from "./options-BTjOf5KP.js";
+import { n as isDryRun } from "./dry-run-3IxPmCtW.js";
 import { a as explainError, o as unwrap, t as UsageError } from "./ui-CdKo8mLw.js";
+import { i as qrParseOptions, n as QR_FLAGS, t as QR_EXTRA_FLAGS } from "./options-DCaqm8BI.js";
 import { t as DONE } from "./dispatch-D048O65I.js";
 import { dirname, extname, relative, resolve } from "node:path";
 import { log, text } from "@clack/prompts";

package/dist/{commands-Dl3UlhBf.js → commands-zPSnOGzH.js}

@@ -1,10 +1,11 @@
 import { C as discoverRepoRoot, p as isNonInteractive } from "./telemetry-Bjoz29Hl.js";
 import { t as nonEmpty } from "./connection-D3XsOE3S.js";
 import { a as explainError, i as explain, o as unwrap, r as errorMessage, t as UsageError } from "./ui-CdKo8mLw.js";
-import { c as EnvDocument, i as readPasswordFromVault, n as bwArgs, r as openVault, s as bwCommand } from "./vault-C8LYJFOQ.js";
 import { t as DONE } from "./dispatch-D048O65I.js";
+import { t as EnvDocument } from "./document-DumoZXoO.js";
+import { i as readPasswordFromVault, n as bwArgs, r as openVault, s as bwCommand } from "./vault-CsBC-1Mq.js";
 import { resolve } from "node:path";
-import { confirm, log, multiselect, note, password, text } from "@clack/prompts";
+import { confirm, log, multiselect, note, password, select, text } from "@clack/prompts";
 import { readFile } from "node:fs/promises";
 import { spawn } from "node:child_process";
 import { parseArgs } from "node:util";
@@ -51,12 +52,12 @@ var CredsError = class extends Error {
 //#endregion
 //#region src/creds/item.ts
 /**
-* A shared account as `creds` sees it: a Bitwarden item in the Shared Accounts
-* collection, plus the custom fields that record who has it.
+* A shared account as `creds` sees it: a login or secure note in the DevDogs
+* Bitwarden organization, plus the custom fields that record who has it.
 *
 * Those fields are the only access record. The Send, the Linear report and
 * every "who has Canva?" answer are generated from them, so they are plain
-* text fields anyone in the collection can read and correct in Bitwarden
+* text fields anyone with the item can read and correct in Bitwarden
 * itself:
 *
 *   Recipients    comma-separated UGA emails, the Send's `--emails` list
@@ -194,8 +195,8 @@ function isoDay(date) {
 //#endregion
 //#region src/creds/bitwarden.ts
 /**
-* The Shared Accounts collection and the Sends made from it, through the
-* bundled `bw` on the officer's personal session (`bws/vault.ts`).
+* The DevDogs Bitwarden organization's items and the Sends made from them,
+* through the bundled `bw` on the officer's personal session (`bws/vault.ts`).
 *
 * Sends belong to the account that creates them, not to the organization, so
 * this always runs as a person and never on CI.
@@ -203,20 +204,23 @@ function isoDay(date) {
 * ## Secret handling
 *
 * * Every value travels to `bw` on **stdin**, base64 JSON as `bw create`,
-*   `bw edit` and `bw send create|edit` document. argv carries only ids,
-*   the collection id and the session key `bwArgs` already passes.
+*   `bw edit` and `bw send create|edit` document. argv carries only ids and
+*   the session key `bwArgs` already passes.
 * * `bw`'s stdout is parsed and never printed: an item or a Send read back
 *   holds the password.
 * * `bw`'s stderr is only shown through `CredsError`, which scrubs every value
 *   registered so far.
 *
-* ## The collection fence
+* ## The organization fence
 *
-* `creds` reads and writes items in ONE collection, found by name. An item
-* that is not in it (a personal login, a production secret) is never listed,
-* never edited and never sent; `updateItem` re-checks before every write.
+* `creds` reads and writes the logins and secure notes of ONE organization,
+* found by name. Anything else the account can see (a personal login, another
+* organization's item) is never listed, never edited and never sent;
+* `updateItem` re-checks before every write. Production secrets are not
+* vault items at all: they live in Secrets Manager, which `bw` cannot read.
 */
-const COLLECTION_NAME = "Shared Accounts";
+/** Matched case-insensitively against the organizations the account belongs to. */
+const ORGANIZATION_NAME = "DevDogs";
 function encode(value) {
 	return Buffer.from(JSON.stringify(value)).toString("base64");
 }
@@ -249,7 +253,7 @@ function spawnRunner(key) {
 	});
 }
 let runnerOverride;
-/** Opens the vault (asking first) and the Shared Accounts collection in it. */
+/** Opens the vault (asking first) and finds the DevDogs organization in it. */
 async function connectSharedVault() {
 	let runner = runnerOverride;
 	if (!runner) {
@@ -259,7 +263,7 @@ async function connectSharedVault() {
 	}
 	const shared = new SharedVault(runner);
 	await shared.sync();
-	await shared.collection();
+	await shared.organization();
 	return shared;
 }
 var SharedVault = class {
@@ -287,34 +291,45 @@ var SharedVault = class {
 	async account() {
 		return (await this.json(["status"])).userEmail ?? "unknown";
 	}
-	/** The one collection named {@link COLLECTION_NAME} this account can see. */
-	async collection() {
+	/** The one organization named like {@link ORGANIZATION_NAME} this account belongs to. */
+	async organization() {
 		if (this.found) return this.found;
-		const matches = (await this.json(["list", "collections"])).filter((c) => c.name === COLLECTION_NAME);
-		if (matches.length !== 1) throw new CredsError(matches.length === 0 ? `No "${COLLECTION_NAME}" collection is visible to your Bitwarden account. Ask a DevDogs organization admin to create it or give you access.` : `${matches.length} collections are called "${COLLECTION_NAME}"; rename the extras so \`creds\` cannot pick the wrong one.`);
+		const matches = (await this.json(["list", "organizations"])).filter((o) => o.name.toLowerCase().includes(ORGANIZATION_NAME.toLowerCase()));
+		if (matches.length !== 1) throw new CredsError(matches.length === 0 ? `Your Bitwarden account is not in the ${ORGANIZATION_NAME} organization. Ask an organization admin to invite you.` : `Your Bitwarden account is in ${matches.length} organizations named like "${ORGANIZATION_NAME}" (${matches.map((o) => o.name).join(", ")}); creds cannot tell which one to use.`);
 		this.found = matches[0];
 		return this.found;
 	}
-	inCollection(raw, collection) {
-		return raw.organizationId === collection.organizationId && (raw.collectionIds ?? []).includes(collection.id);
+	shareable(raw, org) {
+		return raw.organizationId === org.id && (raw.type === ITEM_TYPE.login || raw.type === ITEM_TYPE.secureNote);
 	}
-	/** Every item in the collection, by name. */
+	/** Every login and secure note in the organization, by name. */
 	async listItems() {
-		const collection = await this.collection();
+		const org = await this.organization();
 		return (await this.json([
 			"list",
 			"items",
-			"--collectionid",
-			collection.id
-		])).filter((item) => this.inCollection(item, collection)).map(parseItem).sort((a, b) => a.name.localeCompare(b.name));
+			"--organizationid",
+			org.id
+		])).filter((item) => this.shareable(item, org)).map(parseItem).sort((a, b) => a.name.localeCompare(b.name));
 	}
-	/** A new login, owned by the organization and placed in the collection. */
+	/** The organization's collections this account can see, by name. */
+	async collections() {
+		const org = await this.organization();
+		return (await this.json([
+			"list",
+			"collections",
+			"--organizationid",
+			org.id
+		])).filter((c) => c.organizationId === org.id).sort((a, b) => a.name.localeCompare(b.name));
+	}
+	/** A new login, owned by the organization and placed in `collection`. */
 	async createLogin(input) {
 		registerSecret(input.password);
-		const collection = await this.collection();
+		const org = await this.organization();
+		if (input.collection.organizationId !== org.id) throw new CredsError(`The "${input.collection.name}" collection is not in the ${org.name} organization.`);
 		const item = {
-			organizationId: collection.organizationId,
-			collectionIds: [collection.id],
+			organizationId: org.id,
+			collectionIds: [input.collection.id],
 			folderId: null,
 			type: 1,
 			name: input.name,
@@ -338,10 +353,10 @@ var SharedVault = class {
 		};
 		return parseItem(await this.json(["create", "item"], encode(item)));
 	}
-	/** Saves `raw`, which must still be an item of the collection. */
+	/** Saves `raw`, which must still be a login or secure note of the organization. */
 	async updateItem(raw) {
-		const collection = await this.collection();
-		if (!this.inCollection(raw, collection)) throw new CredsError(`"${raw.name}" is not in the ${COLLECTION_NAME} collection; creds will not change it.`);
+		const org = await this.organization();
+		if (!this.shareable(raw, org)) throw new CredsError(`"${raw.name}" is not a login or secure note of the ${org.name} organization; creds will not change it.`);
 		return parseItem(await this.json([
 			"edit",
 			"item",
@@ -420,7 +435,7 @@ function sendName(item) {
 }
 /** Private to the sender: how to find the item this Send came from. */
 function sendNotes(item) {
-	return `Made by backstage creds from the ${COLLECTION_NAME} item "${item.name}" (${item.id}).`;
+	return `Made by backstage creds from the ${ORGANIZATION_NAME} item "${item.name}" (${item.id}).`;
 }
 function deletionDate(now) {
 	return new Date(now.getTime() + 2592e6).toISOString();
@@ -617,7 +632,7 @@ async function readCheckoutDbUrl() {
 	}
 }
 async function readSecretsManagerDbUrl() {
-	const { listSecrets, projectIdFor } = await import("./client-DzXQHd58.js");
+	const { listSecrets, projectIdFor } = await import("./client-DwDGjalU.js");
 	const secrets = await listSecrets(await projectIdFor(PRODUCTION_PROJECT));
 	return nonEmpty(secrets.find((s) => s.key === "DB_URL")?.value);
 }
@@ -653,17 +668,18 @@ function cell(text) {
 /** The document's markdown. Pure: `now` decides the statuses. */
 function renderReport(items, now, roster) {
 	const lines = [
-		"> Generated by `backstage creds` from the Shared Accounts collection in the DevDogs Bitwarden organization. Manual edits are overwritten on the next run; change the item's fields in Bitwarden, or run `backstage creds send`.",
+		"> Generated by `backstage creds` from the DevDogs Bitwarden organization: every item shared as a Send. Manual edits are overwritten on the next run; change the item's fields in Bitwarden, or run `backstage creds send`.",
 		"",
 		`Last generated ${now.toISOString().slice(0, 16).replace("T", " ")} UTC. Sends are deleted 30 days after they were last renewed; **Expires Soon** means within 7 days, so run \`backstage creds renew\`.`,
 		""
 	];
-	if (items.length === 0) {
-		lines.push("No shared accounts in the collection yet.");
+	const shared = items.filter((i) => i.recipients.length > 0 || i.send !== void 0);
+	if (shared.length === 0) {
+		lines.push("Nothing has been shared yet.");
 		return `${lines.join("\n")}\n`;
 	}
 	lines.push("| Credential | Account | Recipients | Owner | Status | Expires | Send |", "| --- | --- | --- | --- | --- | --- | --- |");
-	for (const item of items) {
+	for (const item of shared) {
 		const recipients = item.recipients.length > 0 ? item.recipients.map((e) => describeRecipient(roster, e)).join(", ") : "—";
 		const link = item.send?.link ? `[Open](${item.send.link})` : "—";
 		lines.push(`| ${[
@@ -729,7 +745,7 @@ async function writeReport(token, documentId, content, fetchImpl = fetch) {
 * shared as Bitwarden Sends that only the officers they name can open.
 *
 *   send    pick shared accounts and officers; create or update one Send each
-*   add     save a new login into the Shared Accounts collection, then send it
+*   add     save a new login to the DevDogs organization, then send it
 *   renew   push every Send's deletion 30 days out and re-sync its recipients
 *   list    what is shared with whom, until when
 *   report  regenerate the Shared Accounts Linear document
@@ -738,8 +754,8 @@ async function writeReport(token, documentId, content, fetchImpl = fetch) {
 *
 * ## Where things live
 *
-* The values live only in the DevDogs Bitwarden organization's Shared
-* Accounts collection. Each item's custom fields record its recipients and its
+* The values live only in the DevDogs Bitwarden organization: any login or
+* secure note in it can be shared. Each item's custom fields record its recipients and its
 * Send (`item.ts`); the Linear document is generated from them (`report.ts`);
 * the roster of who may receive one is read live from production
 * (`roster.ts`).
@@ -790,6 +806,7 @@ function parse(argv) {
 				url: { type: "string" },
 				username: { type: "string" },
 				owner: { type: "string" },
+				collection: { type: "string" },
 				"password-stdin": { type: "boolean" },
 				document: { type: "string" },
 				"dry-run": { type: "boolean" }
@@ -831,7 +848,7 @@ function findItem(items, typed) {
 }
 async function pickItems(items, typed, message) {
 	if (typed && typed.length > 0) return typed.map((t) => findItem(items, t));
-	if (items.length === 0) throw new UsageError("The Shared Accounts collection is empty. Add one with `backstage creds add`.");
+	if (items.length === 0) throw new UsageError("The DevDogs organization has no logins you can see. Add one with `backstage creds add`.");
 	if (!interactive()) throw new UsageError("Name the accounts with --item <name>.");
 	const ids = unwrap(await multiselect({
 		message,
@@ -1023,17 +1040,40 @@ async function ask(given, message, required) {
 		validate: required ? (v) => v?.trim() ? void 0 : "Required." : void 0
 	}))?.trim() || void 0;
 }
+/** `--collection`, the only one there is, or a choice. Every organization item needs one. */
+async function pickCollection(vault, typed) {
+	const all = await vault.collections();
+	if (typed !== void 0) {
+		const needle = typed.trim().toLowerCase();
+		const match = all.find((c) => c.name.toLowerCase() === needle);
+		if (!match) throw new UsageError(`No collection called "${typed}" that you can see. There are: ${all.map((c) => c.name).join(", ") || "none"}.`);
+		return match;
+	}
+	if (all.length === 0) throw new UsageError("You cannot see any collection in the DevDogs organization to save to. Ask an organization admin for access to one.");
+	if (all.length === 1) return all[0];
+	if (!interactive()) throw new UsageError(`Name the collection with --collection: ${all.map((c) => c.name).join(", ")}.`);
+	const id = unwrap(await select({
+		message: "Which collection?",
+		options: all.map((c) => ({
+			value: c.id,
+			label: c.name
+		}))
+	}));
+	return all.find((c) => c.id === id);
+}
 async function runAdd(vault, values, deps) {
 	const existing = await vault.listItems();
 	const name = await ask(values.name, "Name? (e.g. Instagram)", true);
-	if (existing.some((i) => i.name.toLowerCase() === name.toLowerCase())) throw new UsageError(`"${name}" is already in the collection. Use \`backstage creds send --item "${name}"\`.`);
+	if (existing.some((i) => i.name.toLowerCase() === name.toLowerCase())) throw new UsageError(`"${name}" is already in the organization. Use \`backstage creds send --item "${name}"\`.`);
 	const url = await ask(values.url, "Login page URL? (optional)", false);
 	const username = await ask(values.username, "Username or email? (optional)", false);
 	const password = await readPassword(values, deps);
 	registerSecret(password);
 	const notes = interactive() ? await ask(void 0, "Notes for recipients? (optional, never printed)", false) : void 0;
 	const owner = await ask(values.owner, "Owner? (the officer responsible)", false);
+	const collection = await pickCollection(vault, values.collection);
 	const item = await vault.createLogin({
+		collection,
 		name,
 		url,
 		username,
@@ -1041,7 +1081,7 @@ async function runAdd(vault, values, deps) {
 		notes,
 		owner
 	});
-	say(`Saved ${item.name} to the Shared Accounts collection.`, "success");
+	say(`Saved ${item.name} to the ${collection.name} collection.`, "success");
 	await sendItems(vault, [item], values, deps);
 }
 async function runRenew(vault, values, deps) {