@devdogsuga/backstage 0.1.5 → 0.1.7

package/README.md

@@ -14,7 +14,8 @@ match. The two flags matter outside a DevDogsUGA checkout, where the workspace's
 `pnpm backstage` is the script).
 
 It **starts without a checkout**. Help, `version`, `completions`, the tools
-below that need no secrets (`graphics`, `qr`, `github`, `newsletter`, `creds`) and
+below that need no secrets (`graphics`, `qr`, `github`, `newsletter`, `creds`),
+`import`, `export` and
 anything run with `--no-env` never look for one; a command that reads a checkout says
 "run this from inside a DevDogsUGA clone" and exits 1. The DevDogsUGA libraries
 it reads (`@devdogsuga/env`, `@devdogsuga/db`) are optional peers, resolved
@@ -33,25 +34,32 @@ pnpm backstage qr https://devdogsuga.org --format svg,png,webp --logo acm
 pnpm backstage newsletter send 3.0.1 --to a@uga.edu   # asks first; --yes with no terminal
 pnpm backstage creds                             # share a club login with officers, as a Bitwarden Send
 pnpm backstage creds renew                       # extend every Send 30 days
+pnpm backstage import involvement --file OrganizationRoster.csv  # verify members; previews, then asks
+pnpm backstage import attendance --meeting 2026-09-09 --file sign-in.csv
+pnpm backstage export stars --from 2026-08-17   # audited under your gh login
 ```
 
 ## Commands
 
-| Command                                        | What it does                                                                           |
-| ---------------------------------------------- | -------------------------------------------------------------------------------------- |
-| `deploy <app> --tier <t>`                      | Checks `CLOUDFLARE_API_TOKEN`, writes the Worker's secrets file, deploys, removes it.  |
-| `deploy write-env`                             | Composes `.env.<DEPLOY_ENV>` from the GitHub environment.                              |
-| `deploy preflight`                             | Classifies the project: paused (skip) or broken (fail).                                |
-| `deploy plan`, `deploy migrate`                | Dry-run the migrations into the job summary; apply them to `DB_URL`.                   |
-| `deploy smoke --tier <t> [--app]`              | Public routes answer 200, the auth redirect works, this deploy's Sentry release shows. |
-| `deploy reconcile --tier <t>`                  | The platform's config reconcile, after the deploy (`CRON_SECRET`).                     |
-| `env pull\|push\|audit --target <t>`           | One env file per target, synced to Bitwarden and GitHub. `audit` lists orphans.        |
-| `planner status\|create\|reset-password\|drop` | The `migration_planner` role the preflight tier holds.                                 |
-| `graphics [graphic…]`                          | Club images from `@devdogsuga/brand`: `brand/*`, `app/*`, `event/*`.                   |
-| `qr <text>`                                    | QR codes with every option of `/console/qr`.                                           |
-| `github rulesets\|settings`                    | Diff (and with `--apply` write) GitHub config, through `gh`.                           |
-| `newsletter render\|draft\|send <issue…>`      | Changelog issues as files, mailbox drafts, or a send.                                  |
-| `creds send\|add\|renew\|list\|report`         | Club logins from Bitwarden as email-verified Sends, and the Linear report.             |
+| Command                                          | What it does                                                                           |
+| ------------------------------------------------ | -------------------------------------------------------------------------------------- |
+| `deploy <app> --tier <t>`                        | Checks `CLOUDFLARE_API_TOKEN`, writes the Worker's secrets file, deploys, removes it.  |
+| `deploy write-env`                               | Composes `.env.<DEPLOY_ENV>` from the GitHub environment.                              |
+| `deploy preflight`                               | Classifies the project: paused (skip) or broken (fail).                                |
+| `deploy plan`, `deploy migrate`                  | Dry-run the migrations into the job summary; apply them to `DB_URL`.                   |
+| `deploy smoke --tier <t> [--app]`                | Public routes answer 200, the auth redirect works, this deploy's Sentry release shows. |
+| `deploy reconcile --tier <t>`                    | The platform's config reconcile, after the deploy (`CRON_SECRET`).                     |
+| `deploy prune-monitors --tier <t> [--app]`       | Deletes the app's Sentry Crons monitors it no longer declares (production only).       |
+| `env pull\|push\|audit --target <t>`             | One env file per target, synced to Bitwarden and GitHub. `audit` lists orphans.        |
+| `planner status\|create\|reset-password\|drop`   | The `migration_planner` role the preflight tier holds.                                 |
+| `graphics [graphic…]`                            | Club images from `@devdogsuga/brand`: `brand/*`, `app/*`, `event/*`.                   |
+| `qr <text>`                                      | QR codes with every option of `/console/qr`.                                           |
+| `github rulesets\|settings`                      | Diff (and with `--apply` write) GitHub config, through `gh`.                           |
+| `newsletter render\|draft\|send <issue…>`        | Changelog issues as files, mailbox drafts, or a send.                                  |
+| `creds send\|add\|renew\|list\|report`           | Club logins from Bitwarden as email-verified Sends, and the Linear report.             |
+| `import involvement --file <csv>`                | Verifies the members on the Involvement Network roster, unverifies everyone else.      |
+| `import attendance --meeting <day> --file <csv>` | Records a meeting's attendance from a sign-in sheet (method `import`).                 |
+| `export stars\|attendance\|reflections`          | Member data as CSV, each export audited under the officer's gh login.                  |
 
 `smoke` and `reconcile` replace DevDogsUGA's `packages/deploy-checks`. The
 per-app data (hosts, public paths, the protected path and its redirect) stays in
@@ -148,6 +156,62 @@ checkout, else Secrets Manager. The Linear key: `--linear-token`, then
 `LINEAR_API_KEY`, then the vault item "DevDogs Linear API key (backstage)", then
 a prompt; it is never saved.
 
+## Member data: `import` and `export`
+
+These replace the platform's `/console/verification` upload and
+`/console/exports` downloads. They read and write production only:
+`DB_URL`, `API_URL` and `SECRET_KEY` come from `.env.production` in a checkout,
+else Secrets Manager. There is no `--db-url`, since a database override would
+leave account creation pointed at production. Days (`--meeting 2026-09-09`,
+`--from`, `--to`) are Eastern, and `--to` includes the whole day.
+
+### `import involvement`
+
+Replaces the platform's `/console/verification` upload. Export the roster from
+the UGA Involvement Network (Roster → Export → Organization Roster) and pass the
+file as it downloads: the title lines above the header, the `(Hidden)` columns
+and the one-row-per-position layout are all expected. A roster for another
+organization is refused.
+
+The roster is the whole truth: everyone on it is verified, and everyone
+verified who is not on it loses that status. A roster email finds its account
+by the profile's UGA email first, then the sign-in address; with no account,
+one is created (confirmed, no invite email) so the member is verified the first
+time they sign in. Every run previews the counts, who is newly verified, who
+loses verification, and whose preferred name differs from the roster, then
+asks; `--dry-run` stops there, `--yes` answers with no terminal. Preferred
+names are never changed. Rerunning the same export changes nothing.
+
+### `import attendance`
+
+Records a meeting's attendance from a sign-in sheet, for members who could not
+check in on the platform. The sheet is a Google or Microsoft Forms response
+export or a hand-made spreadsheet, saved as CSV; one sheet is one meeting,
+named with `--meeting` (its day, slug, config id or id; a day with two meetings
+asks for the slug). The header and columns are found, not assumed: the email
+column is the one holding UGA addresses, the name is "First/Last Name" or a
+column mentioning "name", and `--email-column`/`--name-column` override
+either. A sheet with no header is read as every address in it. Only UGA
+addresses count; anything else is listed and skipped.
+
+Check-ins are written with method `import`, stamped with the meeting's start,
+and count for stars like any other. A member's own check-in is never touched.
+Someone with no account gets one (confirmed, no invite), named from the sheet;
+with no name on the sheet they are listed and skipped. Cancelled and future
+meetings are refused. Rerunning a sheet records nothing new; `--replace`
+makes the sheet the meeting's whole imported set, removing earlier imported
+rows it no longer lists. Every run previews, then asks (`--dry-run`, `--yes`).
+
+### `export stars|attendance|reflections`
+
+The platform's three CSVs, columns unchanged: `stars` (one row per earned
+star), `attendance` (one row per check-in; `--meeting` for one night) and
+`reflections` (each member's current text). Each export writes a
+`platform.exportAudit` row before reading anything, attributed to the
+platform account linked to the GitHub login `gh` is signed in as, and refuses
+to run when there is none. The file goes to `./<kind>….csv` (owner-readable
+only, never over an existing file without `--yes`) or stdout with `--out -`.
+
 No secret value reaches stdout, stderr, the failure log, Sentry, an error
 message or argv: values go to `bw` as base64 JSON on stdin, every error is
 scrubbed of every value read so far (`src/creds/secrets.ts`), and the clipboard
@@ -171,7 +235,8 @@ stderr, and every confirmation needs `--yes`. Against staging or production a
 command that is not read-only asks once first (`--yes` answers it).
 
 Each command checks for the secrets it uses up front: `deploy <app>` for
-`CLOUDFLARE_API_TOKEN`, `deploy reconcile` for `CRON_SECRET`, `env` for the
+`CLOUDFLARE_API_TOKEN`, `deploy reconcile` for `CRON_SECRET`, `deploy
+prune-monitors` for `SENTRY_MONITORS_TOKEN` (skipped without it), `env` for the
 Secrets Manager token (flag, environment, then the Bitwarden vault, which `env`
 signs in to and unlocks itself, then asking).
 

package/dist/{catalog-BUOwCd2Q.js → catalog-BiXI0wyi.js}

@@ -1,7 +1,9 @@
 import { A as YES, D as DRY_RUN, O as JSON_FLAG, j as createCatalog, k as SCOPES, v as noteRan, w as findRepoRoot } from "./telemetry-Bjoz29Hl.js";
-import { o as isDryRun, r as qrCatalogOptions } from "./options-BTjOf5KP.js";
+import { n as isDryRun } from "./dry-run-3IxPmCtW.js";
 import { o as unwrap } from "./ui-CdKo8mLw.js";
 import { n as positionals } from "./args-Cjr_Iqts.js";
+import { t as EXPORTS } from "./queries-DeEwfe2c.js";
+import { r as qrCatalogOptions } from "./options-DCaqm8BI.js";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { confirm, note, select, text } from "@clack/prompts";
@@ -930,7 +932,7 @@ const ITEM = {
 	value: "<name>",
 	summary: "A DevDogs organization item, by name or id. Repeat for several."
 };
-const TO = {
+const TO$1 = {
 	flag: "--to",
 	value: "<a@uga.edu,…>",
 	summary: "Recipients, comma-separated. Replaces the item's current list."
@@ -970,7 +972,7 @@ const credsCommand = {
 			hint: "pick accounts, then officers",
 			options: [
 				ITEM,
-				TO,
+				TO$1,
 				ROLE,
 				ALLOW_EMAIL,
 				DB_URL$1,
@@ -1013,7 +1015,7 @@ const credsCommand = {
 					flag: "--password-stdin",
 					summary: "Read the password from stdin, for scripts."
 				},
-				TO,
+				TO$1,
 				ROLE,
 				ALLOW_EMAIL,
 				DB_URL$1,
@@ -1141,6 +1143,16 @@ const deployCommand = {
 			summary: "Run the platform's config reconcile after a deploy.",
 			hint: "needs CRON_SECRET",
 			options: [DEPLOY_TIER, SMOKE_APP]
+		},
+		{
+			name: "prune-monitors",
+			summary: "Delete the Sentry Crons monitors an app no longer declares.",
+			hint: "needs SENTRY_MONITORS_TOKEN; production only",
+			options: [
+				DEPLOY_TIER,
+				SMOKE_APP,
+				DRY_RUN
+			]
 		}
 	]
 };
@@ -1210,6 +1222,61 @@ const envCommand = {
 	]
 };
 //#endregion
+//#region src/export/catalog.ts
+/**
+* `export`'s place in the command tree: declaration only, nothing here runs.
+* The handler lives in `commands.ts` beside it.
+*
+* `envFree` like `involvement`: production's `DB_URL` comes from the
+* checkout's `.env.production` or Secrets Manager, and the audit identity from
+* `gh`, so it runs under `pnpm dlx`.
+*/
+const FROM = {
+	flag: "--from",
+	value: "<day>",
+	summary: "From this Eastern day (or ISO timestamp), inclusive."
+};
+const TO = {
+	flag: "--to",
+	value: "<day>",
+	summary: "Through this Eastern day (or before this ISO timestamp)."
+};
+const OUT = {
+	flag: "--out",
+	value: "<path|->",
+	summary: "Where to write. Defaults to ./<kind>….csv; - for stdout."
+};
+function exportOf(kind, extra = []) {
+	return {
+		name: kind,
+		envFree: true,
+		dryRun: "handled",
+		summary: EXPORTS[kind].summary,
+		options: [
+			FROM,
+			TO,
+			...extra,
+			OUT,
+			DRY_RUN,
+			YES
+		]
+	};
+}
+const exportCommand = {
+	name: "export",
+	summary: "Member data as CSV: stars, attendance, reflections. Audited.",
+	hint: "production database; your gh login is recorded",
+	subcommands: [
+		exportOf("stars"),
+		exportOf("attendance", [{
+			flag: "--meeting",
+			value: "<meeting>",
+			summary: "One meeting: its day (2026-09-09), slug, config id or id."
+		}]),
+		exportOf("reflections")
+	]
+};
+//#endregion
 //#region src/github/catalog.ts
 /**
 * `github`'s place in the command tree: declaration only, nothing here runs.
@@ -1303,6 +1370,63 @@ const graphicsCommand = {
 	]
 };
 //#endregion
+//#region src/import/catalog.ts
+const importCommand = {
+	name: "import",
+	summary: "Member data in: the Involvement roster, a meeting's sign-in sheet.",
+	hint: "production database; previews, then asks",
+	subcommands: [{
+		name: "involvement",
+		envFree: true,
+		dryRun: "handled",
+		summary: "Import an Organization Roster export: verify everyone on it, unverify everyone else.",
+		hint: "previews, then asks",
+		options: [
+			{
+				flag: "--file",
+				value: "<csv>",
+				summary: "The roster export (Involvement Network → Roster → Export → Organization Roster)."
+			},
+			DRY_RUN,
+			YES
+		]
+	}, {
+		name: "attendance",
+		envFree: true,
+		dryRun: "handled",
+		summary: "Import a sign-in sheet (form responses or a spreadsheet, as CSV) for one meeting.",
+		hint: "previews, then asks",
+		options: [
+			{
+				flag: "--meeting",
+				value: "<meeting>",
+				summary: "The meeting: its day (2026-09-09), slug, config id or id."
+			},
+			{
+				flag: "--file",
+				value: "<csv>",
+				summary: "The sign-in sheet, saved as CSV."
+			},
+			{
+				flag: "--email-column",
+				value: "<header>",
+				summary: "The column of UGA addresses, when there are several."
+			},
+			{
+				flag: "--name-column",
+				value: "<header>",
+				summary: "The column of names, used for new accounts."
+			},
+			{
+				flag: "--replace",
+				summary: "Make this sheet the meeting's whole imported set: remove earlier imported rows it lacks."
+			},
+			DRY_RUN,
+			YES
+		]
+	}]
+};
+//#endregion
 //#region src/newsletter/catalog.ts
 /**
 * `newsletter`'s place in the command tree: declaration only, nothing here
@@ -1458,8 +1582,12 @@ const catalog = createCatalog({
 			commands: [envCommand]
 		},
 		{
-			title: "Database roles",
-			commands: [plannerCommand]
+			title: "Production database",
+			commands: [
+				plannerCommand,
+				importCommand,
+				exportCommand
+			]
 		},
 		{
 			title: "Graphics & QR codes (no credentials)",

package/dist/{cli-B2S6gw9o.js → cli-Cz8faASC.js}

@@ -1,13 +1,13 @@
 import { C as discoverRepoRoot, T as cliName, b as ownPackageDir, c as reportDevtoolsError, f as isNoEnv, l as reportDevtoolsFailure, n as captureDevtoolsError, o as initDevtoolsTelemetry, p as isNonInteractive, w as findRepoRoot, x as ownVersion } from "./telemetry-Bjoz29Hl.js";
-import { a as recordEnteredTier, f as helpPath, i as beginInvocation, l as dbPush, m as renderHelp, n as bareGroupStartPath, o as recordResolved, p as renderCommandList, r as runMenu, s as reproducibleCommand, t as catalog, u as dbPushDryRun } from "./catalog-BUOwCd2Q.js";
+import { a as recordEnteredTier, f as helpPath, i as beginInvocation, l as dbPush, m as renderHelp, n as bareGroupStartPath, o as recordResolved, p as renderCommandList, r as runMenu, s as reproducibleCommand, t as catalog, u as dbPushDryRun } from "./catalog-BiXI0wyi.js";
 import { a as repoPeerUrl, n as loadEnv, r as loadEnvLoad, t as getEnvSync } from "./peers-B0KDkI6a.js";
 import { t as nonEmpty } from "./connection-D3XsOE3S.js";
-import { a as dryRunKind, l as wouldRunLine, o as isDryRun } from "./options-BTjOf5KP.js";
+import { a as wouldRunLine, n as isDryRun, t as dryRunKind } from "./dry-run-3IxPmCtW.js";
 import { a as explainError, i as explain, n as bail, o as unwrap, r as errorMessage } from "./ui-CdKo8mLw.js";
 import { n as positionals, t as flagValue } from "./args-Cjr_Iqts.js";
-import { a as listSecrets$1, c as updateSecret, i as createSecret, o as projectIdFor, r as byKey, s as setExplicitAccessToken } from "./client-B7HhuTaA.js";
-import { c as EnvDocument } from "./vault-C8LYJFOQ.js";
 import { t as DONE } from "./dispatch-D048O65I.js";
+import { t as EnvDocument } from "./document-DumoZXoO.js";
+import { a as listSecrets$1, c as updateSecret, i as createSecret, o as projectIdFor, r as byKey, s as setExplicitAccessToken } from "./client-B_MY9kVI.js";
 import { register } from "node:module";
 import { pathToFileURL } from "node:url";
 import { appendFileSync, existsSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
@@ -17,9 +17,9 @@ import { chmod, readFile, writeFile } from "node:fs/promises";
 import { execFile, execFileSync, spawn } from "node:child_process";
 import { promisify } from "node:util";
 import { tmpdir } from "node:os";
+import postgres from "postgres";
 import { z } from "zod";
 import { randomBytes } from "node:crypto";
-import postgres from "postgres";
 //#region ../cli-core/src/completions.ts
 /**
 * Groups all paths by their parent prefix to build per-parent completion lists.
@@ -553,6 +553,116 @@ async function runDeployMigrate(env = process.env, push = (url) => dbPush(url, {
 	say(["deploy migrate: migrations applied."]);
 }
 //#endregion
+//#region src/deploy/monitors.ts
+/**
+* `deploy prune-monitors`: deletes the Sentry Crons monitors an app no longer
+* declares.
+*
+* Sentry creates a monitor the first time a job checks in, and never removes
+* one. Rename or drop a `monitorSlug` and the old monitor keeps expecting
+* check-ins that will never come, opening a "missed check-in" issue every
+* period until someone deletes it by hand (PLATFORM-2: the Discord role sync
+* folded into the fifteen-minute cron, and its ten-minute monitor alerted
+* every ten minutes after the deploy).
+*
+* The declared set is every `monitorSlug` on the entries of the app's
+* `cloudflare/scheduled.ts` exports `CRON_ROUTES` and `WORKFLOW_CRONS`. Every
+* monitor in the app's Sentry project that is not in it, and whose slug
+* starts with `<app>-`, is deleted. The prefix keeps a monitor someone made
+* by hand in the Sentry UI out of reach.
+*
+* Delete, not disable. Sentry drops every check-in sent to a disabled monitor
+* and never re-enables one from a check-in, so a slug that came back would
+* report nowhere. A deleted one is recreated by the next check-in that
+* carries its config (each `withMonitor`/`captureCheckIn` here does), and the
+* delete renames the old slug first, so the name is free at once.
+*
+* Production only. Monitors belong to a project, not a tier, and staging
+* deploys `main`, which can be ahead of production: a monitor `main` dropped
+* still has a production job checking in to it.
+*
+* `SENTRY_MONITORS_TOKEN`, not `SENTRY_AUTH_TOKEN`: the deploy token is an
+* organization token (`org:ci`), which Sentry lets neither list nor delete
+* monitors. This one needs `alerts:write` (`alerts:read` to list), and is
+* held in this step's `env:` alone. Absent, the step is skipped with a
+* notice, the same as the Sentry release check.
+*/
+const SENTRY_API$1 = "https://sentry.io/api/0";
+/** Only the field read here; the exports' own shapes are devtools' to check. */
+const Declarations = z.record(z.string(), z.object({ monitorSlug: z.string().min(1).optional() }));
+const MonitorList = z.array(z.object({ slug: z.string() }));
+/**
+* Every `monitorSlug` the app's `cloudflare/scheduled.ts` declares, or
+* `undefined` when the app has no such file (no crons, nothing to prune).
+*/
+async function declaredMonitorSlugs(app, root = findRepoRoot()) {
+	const path = join(root, "apps", app, "cloudflare", "scheduled.ts");
+	if (!existsSync(path)) return void 0;
+	const mod = await import(pathToFileURL(path).href);
+	const slugs = /* @__PURE__ */ new Set();
+	for (const name of ["CRON_ROUTES", "WORKFLOW_CRONS"]) {
+		const parsed = Declarations.safeParse(mod[name] ?? {});
+		if (!parsed.success) throw new DeployError(`${path}: ${name} is not a map of entries.`);
+		for (const entry of Object.values(parsed.data)) if (entry.monitorSlug) slugs.add(entry.monitorSlug);
+	}
+	return slugs;
+}
+/** The `rel="next"` URL of a Sentry `Link` header, when it has results. */
+function nextPage(link) {
+	for (const part of link?.split(",") ?? []) if (part.includes("rel=\"next\"") && part.includes("results=\"true\"")) return /<([^>]+)>/.exec(part)?.[1];
+}
+async function listMonitorSlugs(org, project, headers, fetchImpl) {
+	const slugs = [];
+	let url = `${SENTRY_API$1}/organizations/${org}/monitors/?project=${encodeURIComponent(project)}`;
+	while (url) {
+		const response = await fetchImpl(url, { headers });
+		if (!response.ok) throw new DeployError(`Listing Sentry monitors: HTTP ${response.status}.`, ["SENTRY_MONITORS_TOKEN needs alerts:read and alerts:write."]);
+		slugs.push(...MonitorList.parse(await response.json()).map((m) => m.slug));
+		url = nextPage(response.headers.get("link"));
+	}
+	return slugs;
+}
+/** Returns the slugs it deleted (or would have, on a dry run). */
+async function runPruneMonitors(options) {
+	const env = options.env ?? process.env;
+	const { app } = options;
+	if (options.tier !== "production") {
+		say([`prune-monitors: skipped on ${options.tier}; monitors are pruned against production only.`]);
+		return [];
+	}
+	const token = env.SENTRY_MONITORS_TOKEN;
+	if (!token) {
+		say(["::notice::Sentry monitor pruning skipped -- SENTRY_MONITORS_TOKEN is not configured."]);
+		return [];
+	}
+	if (!env.SENTRY_ORG) throw new DeployError("SENTRY_ORG is not set.");
+	const declared = options.declared ?? await declaredMonitorSlugs(app);
+	if (!declared) {
+		say([`prune-monitors: ${app} has no cloudflare/scheduled.ts; nothing to prune.`]);
+		return [];
+	}
+	const headers = { authorization: `Bearer ${token}` };
+	const fetchImpl = options.fetchImpl ?? fetch;
+	const orphans = (await listMonitorSlugs(env.SENTRY_ORG, app, headers, fetchImpl)).filter((slug) => slug.startsWith(`${app}-`) && !declared.has(slug));
+	if (orphans.length === 0) {
+		say([`prune-monitors: every ${app} monitor is declared.`]);
+		return [];
+	}
+	for (const slug of orphans) {
+		if (options.dryRun) {
+			say([`Would delete Sentry monitor ${slug}`]);
+			continue;
+		}
+		const response = await fetchImpl(`${SENTRY_API$1}/projects/${env.SENTRY_ORG}/${app}/monitors/${encodeURIComponent(slug)}/`, {
+			method: "DELETE",
+			headers
+		});
+		if (!response.ok && response.status !== 404) throw new DeployError(`Deleting Sentry monitor ${slug}: HTTP ${response.status}.`);
+		say([`Deleted Sentry monitor ${slug}`]);
+	}
+	return orphans;
+}
+//#endregion
 //#region src/deploy/preflight.ts
 /**
 * `pnpm devtools deploy preflight`
@@ -1554,10 +1664,11 @@ function renderWriteEnvReport(result) {
 * Sandbox (plain Worker) always used this shape, so all three apps share one
 * deploy step.
 *
-* Steps (`write-env`, `preflight`, `plan`, `migrate`, `smoke`, `reconcile`) are
-* individually addressable for jobs that run only one. The ones that hold a
-* single credential in the job's own `env:` block and compose no env file
-* (`preflight`, `plan`, `migrate`, `smoke`, `reconcile`), and `write-env`,
+* Steps (`write-env`, `preflight`, `plan`, `migrate`, `smoke`, `reconcile`,
+* `prune-monitors`) are individually addressable for jobs that run only one.
+* The ones that hold a single credential in the job's own `env:` block and
+* compose no env file (`preflight`, `plan`, `migrate`, `smoke`, `reconcile`,
+* `prune-monitors`), and `write-env`,
 * which CREATES the file tier resolution would otherwise insist on reading,
 * run with `--no-env`.
 */
@@ -1707,6 +1818,14 @@ async function runStep(sub, rest) {
 		});
 		return true;
 	}
+	if (sub === "prune-monitors") {
+		await runPruneMonitors({
+			app: flagValue(rest, "--app") ?? "platform",
+			tier: requireTier(rest),
+			dryRun: rest.includes("--dry-run")
+		});
+		return true;
+	}
 	if (sub === "write-env") {
 		await loadRegistry();
 		const index = rest.indexOf("--source");
@@ -5268,9 +5387,11 @@ const HANDLERS = {
 	completions: handleCompletions,
 	github: handleGithub,
 	graphics: async (rest) => (await import("./commands-Dv5TXjvb.js")).handleGraphics(rest),
-	qr: async (rest) => (await import("./commands-Bk7IbhPD.js")).handleQr(rest),
+	qr: async (rest) => (await import("./commands-Sx1fDNNn.js")).handleQr(rest),
 	newsletter: async (rest) => (await import("./commands-D345F-Od.js")).handleNewsletter(rest),
-	creds: async (rest) => (await import("./commands-BMQ1OZIr.js")).handleCreds(rest)
+	creds: async (rest) => (await import("./commands-zPSnOGzH.js")).handleCreds(rest),
+	import: async (rest) => (await import("./commands-DzALVX5g.js")).handleImport(rest),
+	export: async (rest) => (await import("./commands-5Ou8xJw5.js")).handleExport(rest)
 };
 /**
 * Names that were commands of the contributor CLI, refused with where they

package/dist/cli-Do2nWD7W.js

@@ -0,0 +1,136 @@
+import { C as discoverRepoRoot, p as isNonInteractive } from "./telemetry-Bjoz29Hl.js";
+import { t as nonEmpty } from "./connection-D3XsOE3S.js";
+import { a as explainError, i as explain, o as unwrap, t as UsageError } from "./ui-CdKo8mLw.js";
+import { t as EnvDocument } from "./document-DumoZXoO.js";
+import { resolve } from "node:path";
+import { confirm, log, text } from "@clack/prompts";
+import { readFile } from "node:fs/promises";
+import postgres from "postgres";
+//#region src/production/access.ts
+/**
+* Production access for the commands that read or write member data
+* (`involvement`, `attendance`, `export`).
+*
+* Every key comes from one place, so a run never splits across two projects:
+* the checkout's `.env.production`, else the production Secrets Manager
+* project. There is deliberately no `--db-url`; a database override would
+* leave account creation (which goes through Auth with `API_URL`) pointed at
+* production.
+*/
+/** A failure already worded for the officer. Safe to print. */
+var ProductionError = class extends Error {
+	name = "ProductionError";
+};
+/** The production project in Secrets Manager (see `creds/roster.ts`). */
+const PRODUCTION_PROJECT = "production";
+/** `.env.production` in a checkout, else the production Secrets Manager project. */
+async function readProductionKey(key) {
+	const root = discoverRepoRoot();
+	if (root) try {
+		const text = await readFile(resolve(root, ".env.production"), "utf8");
+		const value = nonEmpty(EnvDocument.parse(text).get(key));
+		if (value) return value;
+	} catch {}
+	const { listSecrets, projectIdFor } = await import("./client-DwDGjalU.js");
+	const secrets = await listSecrets(await projectIdFor(PRODUCTION_PROJECT));
+	return nonEmpty(secrets.find((s) => s.key === key)?.value);
+}
+async function requireProductionKey(key) {
+	const value = await readProductionKey(key);
+	if (!value) throw new ProductionError(`Could not find production's ${key}. Run \`backstage env pull --target production\` in a checkout, or sign in to Secrets Manager.`);
+	return value;
+}
+/**
+* A database failure, described without the connection string: postgres.js
+* can quote the host, and the URL carries the password. A server error
+* (a five-character SQLSTATE) is the server's own message, which never does.
+*/
+function dbError(what, err) {
+	const e = err;
+	return new ProductionError(`${what}: ${(e.code && /^[0-9A-Z]{5}$/.test(e.code) ? e.message : e.code) ?? "connection failed"}.`);
+}
+/** One short-lived connection; callers `end()` it. */
+function connect(url) {
+	return postgres(url, {
+		max: 1,
+		prepare: false,
+		connect_timeout: 15
+	});
+}
+/** Runs `fn` on a fresh connection and closes it, rewording failures. */
+async function withConnection(url, what, fn) {
+	const sql = connect(url);
+	try {
+		return await fn(sql);
+	} catch (err) {
+		if (err instanceof ProductionError) throw err;
+		throw dbError(what, err);
+	} finally {
+		await sql.end({ timeout: 5 });
+	}
+}
+//#endregion
+//#region src/production/cli.ts
+/**
+* The terminal half shared by the member-data commands: progress lines, the
+* input file, and the one confirmation before production is written.
+*/
+/** Progress for a person; plain stderr lines when nobody is watching a terminal. */
+function say(message, level = "info") {
+	if (isNonInteractive()) process.stderr.write(`${message}\n`);
+	else log[level](message);
+}
+function plural(n, one, many = `${one}s`) {
+	return `${n} ${n === 1 ? one : many}`;
+}
+/** Whether a person can answer a prompt. */
+function canPrompt() {
+	return !isNonInteractive() && process.stdin.isTTY === true;
+}
+function expandHome(path) {
+	return path.startsWith("~/") ? `${process.env.HOME ?? "~"}${path.slice(1)}` : path;
+}
+/** `--file`, else asked for at a terminal; then read. */
+async function readInputFile(file, options) {
+	let path = file;
+	if (!path) {
+		if (!options.interactive) throw new UsageError(`Pass the file with --file <${options.placeholder}>.`);
+		path = unwrap(await text({
+			message: options.message,
+			placeholder: options.placeholder,
+			validate: (v) => v?.trim() ? void 0 : "A path, please."
+		})).trim();
+	}
+	const full = expandHome(path);
+	try {
+		return await (options.read ?? ((p) => readFile(p, "utf8")))(full);
+	} catch {
+		throw new UsageError(`Could not read ${full}.`);
+	}
+}
+/**
+* The one question before production is written. `--yes` answers it; with no
+* terminal and no `--yes`, the command stops rather than guess. Defaults to no.
+*/
+async function confirmWrite(question, options) {
+	if (options.yes) return true;
+	if (!options.interactive) throw new UsageError(`${question} Pass --yes to answer yes without a terminal.`);
+	return unwrap(await confirm({
+		message: question,
+		initialValue: false
+	}));
+}
+/**
+* The shared `catch`: a worded failure is explained and the run exits 1; any
+* other error is unexpected and goes to Sentry with the command's name.
+*/
+function reportFailure(command, err, worded = []) {
+	process.exitCode = 1;
+	if (err instanceof UsageError || err instanceof ProductionError || worded.some((kind) => err instanceof kind)) {
+		explain(err.message, "");
+		return;
+	}
+	explainError(`${command} failed.`, err);
+}
+//#endregion
+export { reportFailure as a, connect as c, withConnection as d, readInputFile as i, dbError as l, confirmWrite as n, say as o, plural as r, ProductionError as s, canPrompt as t, requireProductionKey as u };

package/dist/{client-B7HhuTaA.js → client-B_MY9kVI.js}

@@ -1,7 +1,8 @@
 import { w as findRepoRoot } from "./telemetry-Bjoz29Hl.js";
 import { n as loadEnv } from "./peers-B0KDkI6a.js";
 import { o as unwrap } from "./ui-CdKo8mLw.js";
-import { a as readTokenFromVault, c as EnvDocument, o as saveTokenToVault, t as VAULT_ITEM_NAME } from "./vault-C8LYJFOQ.js";
+import { t as EnvDocument } from "./document-DumoZXoO.js";
+import { a as readTokenFromVault, o as saveTokenToVault, t as VAULT_ITEM_NAME } from "./vault-CsBC-1Mq.js";
 import { dirname, join, resolve } from "node:path";
 import { log, password, select, text } from "@clack/prompts";
 import { mkdir, readFile, writeFile } from "node:fs/promises";

package/dist/client-DwDGjalU.js

@@ -0,0 +1,2 @@
+import { a as listSecrets, o as projectIdFor } from "./client-B_MY9kVI.js";
+export { listSecrets, projectIdFor };