@devdogsuga/backstage 0.1.6 → 0.1.8

package/README.md

@@ -49,6 +49,7 @@ pnpm backstage export stars --from 2026-08-17   # audited under your gh login
 | `deploy plan`, `deploy migrate`                  | Dry-run the migrations into the job summary; apply them to `DB_URL`.                   |
 | `deploy smoke --tier <t> [--app]`                | Public routes answer 200, the auth redirect works, this deploy's Sentry release shows. |
 | `deploy reconcile --tier <t>`                    | The platform's config reconcile, after the deploy (`CRON_SECRET`).                     |
+| `deploy prune-monitors --tier <t> [--app]`       | Deletes the app's Sentry Crons monitors it no longer declares (production only).       |
 | `env pull\|push\|audit --target <t>`             | One env file per target, synced to Bitwarden and GitHub. `audit` lists orphans.        |
 | `planner status\|create\|reset-password\|drop`   | The `migration_planner` role the preflight tier holds.                                 |
 | `graphics [graphic…]`                            | Club images from `@devdogsuga/brand`: `brand/*`, `app/*`, `event/*`.                   |
@@ -77,8 +78,7 @@ DevDogsUGA, as a `smoke` field on each app's entry in `workers.json`:
       "protectedPath": "/console/permissions",
       "protectedRedirectPrefix": "/auth"
     }
-  },
-  "apps/sandbox"
+  }
 ]
 ```
 
@@ -234,7 +234,8 @@ stderr, and every confirmation needs `--yes`. Against staging or production a
 command that is not read-only asks once first (`--yes` answers it).
 
 Each command checks for the secrets it uses up front: `deploy <app>` for
-`CLOUDFLARE_API_TOKEN`, `deploy reconcile` for `CRON_SECRET`, `env` for the
+`CLOUDFLARE_API_TOKEN`, `deploy reconcile` for `CRON_SECRET`, `deploy
+prune-monitors` for `SENTRY_MONITORS_TOKEN` (skipped without it), `env` for the
 Secrets Manager token (flag, environment, then the Bitwarden vault, which `env`
 signs in to and unlocks itself, then asking).
 

package/dist/{catalog-Dke7bQVz.js → catalog-BWtUtxMF.js}

@@ -1,6 +1,6 @@
-import { A as YES, D as DRY_RUN, O as JSON_FLAG, j as createCatalog, k as SCOPES, v as noteRan, w as findRepoRoot } from "./telemetry-Bjoz29Hl.js";
-import { n as isDryRun } from "./dry-run-3IxPmCtW.js";
-import { o as unwrap } from "./ui-CdKo8mLw.js";
+import { A as YES, D as DRY_RUN, O as JSON_FLAG, j as createCatalog, k as SCOPES, v as noteRan, w as findRepoRoot } from "./telemetry-Be_lbB5c.js";
+import { n as isDryRun } from "./dry-run-CFCZUpjb.js";
+import { o as unwrap } from "./ui-Bb69ZfVv.js";
 import { n as positionals } from "./args-Cjr_Iqts.js";
 import { t as EXPORTS } from "./queries-DeEwfe2c.js";
 import { r as qrCatalogOptions } from "./options-DCaqm8BI.js";
@@ -1099,7 +1099,6 @@ const deployCommand = {
 	subcommands: [
 		app("platform"),
 		app("schedule-builder"),
-		app("sandbox"),
 		{
 			name: "write-env",
 			summary: "Compose .env.<DEPLOY_ENV> from the GitHub environment.",
@@ -1143,6 +1142,16 @@ const deployCommand = {
 			summary: "Run the platform's config reconcile after a deploy.",
 			hint: "needs CRON_SECRET",
 			options: [DEPLOY_TIER, SMOKE_APP]
+		},
+		{
+			name: "prune-monitors",
+			summary: "Delete the Sentry Crons monitors an app no longer declares.",
+			hint: "needs SENTRY_MONITORS_TOKEN; production only",
+			options: [
+				DEPLOY_TIER,
+				SMOKE_APP,
+				DRY_RUN
+			]
 		}
 	]
 };

package/dist/{cli-Do2nWD7W.js → cli-D6swhEN-.js}

@@ -1,6 +1,6 @@
-import { C as discoverRepoRoot, p as isNonInteractive } from "./telemetry-Bjoz29Hl.js";
+import { C as discoverRepoRoot, p as isNonInteractive } from "./telemetry-Be_lbB5c.js";
 import { t as nonEmpty } from "./connection-D3XsOE3S.js";
-import { a as explainError, i as explain, o as unwrap, t as UsageError } from "./ui-CdKo8mLw.js";
+import { a as explainError, i as explain, o as unwrap, t as UsageError } from "./ui-Bb69ZfVv.js";
 import { t as EnvDocument } from "./document-DumoZXoO.js";
 import { resolve } from "node:path";
 import { confirm, log, text } from "@clack/prompts";
@@ -31,7 +31,7 @@ async function readProductionKey(key) {
 		const value = nonEmpty(EnvDocument.parse(text).get(key));
 		if (value) return value;
 	} catch {}
-	const { listSecrets, projectIdFor } = await import("./client-DwDGjalU.js");
+	const { listSecrets, projectIdFor } = await import("./client-A6pJcxSE.js");
 	const secrets = await listSecrets(await projectIdFor(PRODUCTION_PROJECT));
 	return nonEmpty(secrets.find((s) => s.key === key)?.value);
 }

package/dist/{cli-BhZ4je2D.js → cli-J_avqnlu.js}

@@ -1,13 +1,13 @@
-import { C as discoverRepoRoot, T as cliName, b as ownPackageDir, c as reportDevtoolsError, f as isNoEnv, l as reportDevtoolsFailure, n as captureDevtoolsError, o as initDevtoolsTelemetry, p as isNonInteractive, w as findRepoRoot, x as ownVersion } from "./telemetry-Bjoz29Hl.js";
-import { a as recordEnteredTier, f as helpPath, i as beginInvocation, l as dbPush, m as renderHelp, n as bareGroupStartPath, o as recordResolved, p as renderCommandList, r as runMenu, s as reproducibleCommand, t as catalog, u as dbPushDryRun } from "./catalog-Dke7bQVz.js";
-import { a as repoPeerUrl, n as loadEnv, r as loadEnvLoad, t as getEnvSync } from "./peers-B0KDkI6a.js";
+import { C as discoverRepoRoot, T as cliName, b as ownPackageDir, c as reportDevtoolsError, f as isNoEnv, l as reportDevtoolsFailure, n as captureDevtoolsError, o as initDevtoolsTelemetry, p as isNonInteractive, w as findRepoRoot, x as ownVersion } from "./telemetry-Be_lbB5c.js";
+import { a as recordEnteredTier, f as helpPath, i as beginInvocation, l as dbPush, m as renderHelp, n as bareGroupStartPath, o as recordResolved, p as renderCommandList, r as runMenu, s as reproducibleCommand, t as catalog, u as dbPushDryRun } from "./catalog-BWtUtxMF.js";
+import { a as repoPeerUrl, n as loadEnv, r as loadEnvLoad, t as getEnvSync } from "./peers-u1zxe-Ub.js";
 import { t as nonEmpty } from "./connection-D3XsOE3S.js";
-import { a as wouldRunLine, n as isDryRun, t as dryRunKind } from "./dry-run-3IxPmCtW.js";
-import { a as explainError, i as explain, n as bail, o as unwrap, r as errorMessage } from "./ui-CdKo8mLw.js";
+import { a as wouldRunLine, n as isDryRun, t as dryRunKind } from "./dry-run-CFCZUpjb.js";
+import { a as explainError, i as explain, n as bail, o as unwrap, r as errorMessage } from "./ui-Bb69ZfVv.js";
 import { n as positionals, t as flagValue } from "./args-Cjr_Iqts.js";
 import { t as DONE } from "./dispatch-D048O65I.js";
 import { t as EnvDocument } from "./document-DumoZXoO.js";
-import { a as listSecrets$1, c as updateSecret, i as createSecret, o as projectIdFor, r as byKey, s as setExplicitAccessToken } from "./client-B_MY9kVI.js";
+import { a as listSecrets$1, c as updateSecret, i as createSecret, o as projectIdFor, r as byKey, s as setExplicitAccessToken } from "./client-NuoKMQmV.js";
 import { register } from "node:module";
 import { pathToFileURL } from "node:url";
 import { appendFileSync, existsSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
@@ -249,16 +249,12 @@ async function importRepoTs(absolutePath) {
 * Most workspace packages declare nothing, so "no env.ts found" means
 * not-a-manifest rather than an error.
 *
-* ⚠️ `apps/sandbox` was once listed here as having no manifest ON PURPOSE, on
-* the grounds that a Worker reads bindings that arrive as a function argument
-* rather than `process.env`. That premise is still true and the conclusion
-* drawn from it was still wrong: a manifest is also the only thing that routes
-* a credential to a deployed environment and the only thing that tells
-* `env audit` a Worker secret is supposed to be there. Without one,
-* `SANDBOX_PROXY_TOKEN`, minted at deploy time and therefore in no Bitwarden
-* project by design, was reported as an orphan, i.e. as safe for the §3.6 prune
-* path to delete. `apps/sandbox/env.ts` exists now, and states that reasoning
-* at length.
+* ⚠️ A Worker still needs a manifest, even though its bindings arrive as a
+* function argument rather than `process.env`: a manifest is the only thing
+* that routes a credential to a deployed environment and the only thing that
+* tells `env audit` a Worker secret is supposed to be there. Without one, a
+* minted secret (in no Bitwarden project by design) is reported as an orphan,
+* i.e. as safe for the §3.6 prune path to delete.
 */
 /**
 * The single in-flight (or settled) load.
@@ -553,6 +549,116 @@ async function runDeployMigrate(env = process.env, push = (url) => dbPush(url, {
 	say(["deploy migrate: migrations applied."]);
 }
 //#endregion
+//#region src/deploy/monitors.ts
+/**
+* `deploy prune-monitors`: deletes the Sentry Crons monitors an app no longer
+* declares.
+*
+* Sentry creates a monitor the first time a job checks in, and never removes
+* one. Rename or drop a `monitorSlug` and the old monitor keeps expecting
+* check-ins that will never come, opening a "missed check-in" issue every
+* period until someone deletes it by hand (PLATFORM-2: the Discord role sync
+* folded into the fifteen-minute cron, and its ten-minute monitor alerted
+* every ten minutes after the deploy).
+*
+* The declared set is every `monitorSlug` on the entries of the app's
+* `cloudflare/scheduled.ts` exports `CRON_ROUTES` and `WORKFLOW_CRONS`. Every
+* monitor in the app's Sentry project that is not in it, and whose slug
+* starts with `<app>-`, is deleted. The prefix keeps a monitor someone made
+* by hand in the Sentry UI out of reach.
+*
+* Delete, not disable. Sentry drops every check-in sent to a disabled monitor
+* and never re-enables one from a check-in, so a slug that came back would
+* report nowhere. A deleted one is recreated by the next check-in that
+* carries its config (each `withMonitor`/`captureCheckIn` here does), and the
+* delete renames the old slug first, so the name is free at once.
+*
+* Production only. Monitors belong to a project, not a tier, and staging
+* deploys `main`, which can be ahead of production: a monitor `main` dropped
+* still has a production job checking in to it.
+*
+* `SENTRY_MONITORS_TOKEN`, not `SENTRY_AUTH_TOKEN`: the deploy token is an
+* organization token (`org:ci`), which Sentry lets neither list nor delete
+* monitors. This one needs `alerts:write` (`alerts:read` to list), and is
+* held in this step's `env:` alone. Absent, the step is skipped with a
+* notice, the same as the Sentry release check.
+*/
+const SENTRY_API$1 = "https://sentry.io/api/0";
+/** Only the field read here; the exports' own shapes are devtools' to check. */
+const Declarations = z.record(z.string(), z.object({ monitorSlug: z.string().min(1).optional() }));
+const MonitorList = z.array(z.object({ slug: z.string() }));
+/**
+* Every `monitorSlug` the app's `cloudflare/scheduled.ts` declares, or
+* `undefined` when the app has no such file (no crons, nothing to prune).
+*/
+async function declaredMonitorSlugs(app, root = findRepoRoot()) {
+	const path = join(root, "apps", app, "cloudflare", "scheduled.ts");
+	if (!existsSync(path)) return void 0;
+	const mod = await import(pathToFileURL(path).href);
+	const slugs = /* @__PURE__ */ new Set();
+	for (const name of ["CRON_ROUTES", "WORKFLOW_CRONS"]) {
+		const parsed = Declarations.safeParse(mod[name] ?? {});
+		if (!parsed.success) throw new DeployError(`${path}: ${name} is not a map of entries.`);
+		for (const entry of Object.values(parsed.data)) if (entry.monitorSlug) slugs.add(entry.monitorSlug);
+	}
+	return slugs;
+}
+/** The `rel="next"` URL of a Sentry `Link` header, when it has results. */
+function nextPage(link) {
+	for (const part of link?.split(",") ?? []) if (part.includes("rel=\"next\"") && part.includes("results=\"true\"")) return /<([^>]+)>/.exec(part)?.[1];
+}
+async function listMonitorSlugs(org, project, headers, fetchImpl) {
+	const slugs = [];
+	let url = `${SENTRY_API$1}/organizations/${org}/monitors/?project=${encodeURIComponent(project)}`;
+	while (url) {
+		const response = await fetchImpl(url, { headers });
+		if (!response.ok) throw new DeployError(`Listing Sentry monitors: HTTP ${response.status}.`, ["SENTRY_MONITORS_TOKEN needs alerts:read and alerts:write."]);
+		slugs.push(...MonitorList.parse(await response.json()).map((m) => m.slug));
+		url = nextPage(response.headers.get("link"));
+	}
+	return slugs;
+}
+/** Returns the slugs it deleted (or would have, on a dry run). */
+async function runPruneMonitors(options) {
+	const env = options.env ?? process.env;
+	const { app } = options;
+	if (options.tier !== "production") {
+		say([`prune-monitors: skipped on ${options.tier}; monitors are pruned against production only.`]);
+		return [];
+	}
+	const token = env.SENTRY_MONITORS_TOKEN;
+	if (!token) {
+		say(["::notice::Sentry monitor pruning skipped -- SENTRY_MONITORS_TOKEN is not configured."]);
+		return [];
+	}
+	if (!env.SENTRY_ORG) throw new DeployError("SENTRY_ORG is not set.");
+	const declared = options.declared ?? await declaredMonitorSlugs(app);
+	if (!declared) {
+		say([`prune-monitors: ${app} has no cloudflare/scheduled.ts; nothing to prune.`]);
+		return [];
+	}
+	const headers = { authorization: `Bearer ${token}` };
+	const fetchImpl = options.fetchImpl ?? fetch;
+	const orphans = (await listMonitorSlugs(env.SENTRY_ORG, app, headers, fetchImpl)).filter((slug) => slug.startsWith(`${app}-`) && !declared.has(slug));
+	if (orphans.length === 0) {
+		say([`prune-monitors: every ${app} monitor is declared.`]);
+		return [];
+	}
+	for (const slug of orphans) {
+		if (options.dryRun) {
+			say([`Would delete Sentry monitor ${slug}`]);
+			continue;
+		}
+		const response = await fetchImpl(`${SENTRY_API$1}/projects/${env.SENTRY_ORG}/${app}/monitors/${encodeURIComponent(slug)}/`, {
+			method: "DELETE",
+			headers
+		});
+		if (!response.ok && response.status !== 404) throw new DeployError(`Deleting Sentry monitor ${slug}: HTTP ${response.status}.`);
+		say([`Deleted Sentry monitor ${slug}`]);
+	}
+	return orphans;
+}
+//#endregion
 //#region src/deploy/preflight.ts
 /**
 * `pnpm devtools deploy preflight`
@@ -737,8 +843,7 @@ async function runPreflight(deps = {}) {
 * ## Minted keys are refused, not filled
 *
 * A `secrecy: "secret"` key `storableKeys()` excludes is "minted": signed at
-* deploy time rather than stored anywhere, which is what `SANDBOX_PROXY_TOKEN`
-* is declared as. This has no minter of its own — there is nothing in
+* deploy time rather than stored anywhere. This has no minter of its own — there is nothing in
 * this repository that produces one — so a declared minted key is always a
 * hard failure here rather than a silent omission: a Worker that expects a
 * value substituted fails loudly at the file it never got, not at whatever
@@ -1551,13 +1656,13 @@ function renderWriteEnvReport(result) {
 * which leaves a Wrangler "config redirect" at `.wrangler/deploy/config.json`
 * pointing at the generated `dist/server/wrangler.json`; a bare `wrangler
 * deploy` from the app dir resolves through it with no `--config` needed.
-* Sandbox (plain Worker) always used this shape, so all three apps share one
-* deploy step.
+* Both apps share one deploy step.
 *
-* Steps (`write-env`, `preflight`, `plan`, `migrate`, `smoke`, `reconcile`) are
-* individually addressable for jobs that run only one. The ones that hold a
-* single credential in the job's own `env:` block and compose no env file
-* (`preflight`, `plan`, `migrate`, `smoke`, `reconcile`), and `write-env`,
+* Steps (`write-env`, `preflight`, `plan`, `migrate`, `smoke`, `reconcile`,
+* `prune-monitors`) are individually addressable for jobs that run only one.
+* The ones that hold a single credential in the job's own `env:` block and
+* compose no env file (`preflight`, `plan`, `migrate`, `smoke`, `reconcile`,
+* `prune-monitors`), and `write-env`,
 * which CREATES the file tier resolution would otherwise insist on reading,
 * run with `--no-env`.
 */
@@ -1707,6 +1812,14 @@ async function runStep(sub, rest) {
 		});
 		return true;
 	}
+	if (sub === "prune-monitors") {
+		await runPruneMonitors({
+			app: flagValue(rest, "--app") ?? "platform",
+			tier: requireTier(rest),
+			dryRun: rest.includes("--dry-run")
+		});
+		return true;
+	}
 	if (sub === "write-env") {
 		await loadRegistry();
 		const index = rest.indexOf("--source");
@@ -2619,9 +2732,9 @@ async function listWorkerSecrets(target) {
 *
 * The expected set is derived from the app's own manifest: every key it
 * declares with `secrecy: "secret"`. That deliberately includes the MINTED
-* ones. `SANDBOX_PROXY_TOKEN` has no copy in Bitwarden or GitHub by design, and
-* an audit that reasoned from stored copies alone would report the live proxy
-* credential as safe to delete. (`env audit` had exactly that bug; see
+* ones. A minted key has no copy in Bitwarden or GitHub by design, and an
+* audit that reasoned from stored copies alone would report a live credential
+* as safe to delete. (`env audit` had exactly that bug; see
 * `EnvMeta.minted`.)
 *
 * ## Report always, prune almost never (security plan §3.6)
@@ -5267,12 +5380,12 @@ const HANDLERS = {
 	},
 	completions: handleCompletions,
 	github: handleGithub,
-	graphics: async (rest) => (await import("./commands-Dv5TXjvb.js")).handleGraphics(rest),
-	qr: async (rest) => (await import("./commands-Sx1fDNNn.js")).handleQr(rest),
-	newsletter: async (rest) => (await import("./commands-D345F-Od.js")).handleNewsletter(rest),
-	creds: async (rest) => (await import("./commands-zPSnOGzH.js")).handleCreds(rest),
-	import: async (rest) => (await import("./commands-DzALVX5g.js")).handleImport(rest),
-	export: async (rest) => (await import("./commands-5Ou8xJw5.js")).handleExport(rest)
+	graphics: async (rest) => (await import("./commands-CQ-vbNe9.js")).handleGraphics(rest),
+	qr: async (rest) => (await import("./commands-DQYH_m6i.js")).handleQr(rest),
+	newsletter: async (rest) => (await import("./commands-35rBJ1R0.js")).handleNewsletter(rest),
+	creds: async (rest) => (await import("./commands-BF5eptEi.js")).handleCreds(rest),
+	import: async (rest) => (await import("./commands-zApyD2Rk.js")).handleImport(rest),
+	export: async (rest) => (await import("./commands-D4FcDQuh.js")).handleExport(rest)
 };
 /**
 * Names that were commands of the contributor CLI, refused with where they

package/dist/client-A6pJcxSE.js

@@ -0,0 +1,2 @@
+import { a as listSecrets, o as projectIdFor } from "./client-NuoKMQmV.js";
+export { listSecrets, projectIdFor };

package/dist/{client-B_MY9kVI.js → client-NuoKMQmV.js}

@@ -1,8 +1,8 @@
-import { w as findRepoRoot } from "./telemetry-Bjoz29Hl.js";
-import { n as loadEnv } from "./peers-B0KDkI6a.js";
-import { o as unwrap } from "./ui-CdKo8mLw.js";
+import { w as findRepoRoot } from "./telemetry-Be_lbB5c.js";
+import { n as loadEnv } from "./peers-u1zxe-Ub.js";
+import { o as unwrap } from "./ui-Bb69ZfVv.js";
 import { t as EnvDocument } from "./document-DumoZXoO.js";
-import { a as readTokenFromVault, o as saveTokenToVault, t as VAULT_ITEM_NAME } from "./vault-CsBC-1Mq.js";
+import { a as readTokenFromVault, o as saveTokenToVault, t as VAULT_ITEM_NAME } from "./vault-DFV0zjbT.js";
 import { dirname, join, resolve } from "node:path";
 import { log, password, select, text } from "@clack/prompts";
 import { mkdir, readFile, writeFile } from "node:fs/promises";

package/dist/{commands-D345F-Od.js → commands-35rBJ1R0.js}

@@ -1,5 +1,5 @@
-import { p as isNonInteractive } from "./telemetry-Bjoz29Hl.js";
-import { a as explainError, o as unwrap, r as errorMessage, t as UsageError } from "./ui-CdKo8mLw.js";
+import { p as isNonInteractive } from "./telemetry-Be_lbB5c.js";
+import { a as explainError, o as unwrap, r as errorMessage, t as UsageError } from "./ui-Bb69ZfVv.js";
 import { t as DONE } from "./dispatch-D048O65I.js";
 import { dirname, join, resolve } from "node:path";
 import { confirm, log, multiselect, spinner, text } from "@clack/prompts";

package/dist/{commands-zPSnOGzH.js → commands-BF5eptEi.js}

@@ -1,9 +1,9 @@
-import { C as discoverRepoRoot, p as isNonInteractive } from "./telemetry-Bjoz29Hl.js";
+import { C as discoverRepoRoot, p as isNonInteractive } from "./telemetry-Be_lbB5c.js";
 import { t as nonEmpty } from "./connection-D3XsOE3S.js";
-import { a as explainError, i as explain, o as unwrap, r as errorMessage, t as UsageError } from "./ui-CdKo8mLw.js";
+import { a as explainError, i as explain, o as unwrap, r as errorMessage, t as UsageError } from "./ui-Bb69ZfVv.js";
 import { t as DONE } from "./dispatch-D048O65I.js";
 import { t as EnvDocument } from "./document-DumoZXoO.js";
-import { i as readPasswordFromVault, n as bwArgs, r as openVault, s as bwCommand } from "./vault-CsBC-1Mq.js";
+import { i as readPasswordFromVault, n as bwArgs, r as openVault, s as bwCommand } from "./vault-DFV0zjbT.js";
 import { resolve } from "node:path";
 import { confirm, log, multiselect, note, password, select, text } from "@clack/prompts";
 import { readFile } from "node:fs/promises";
@@ -632,7 +632,7 @@ async function readCheckoutDbUrl() {
 	}
 }
 async function readSecretsManagerDbUrl() {
-	const { listSecrets, projectIdFor } = await import("./client-DwDGjalU.js");
+	const { listSecrets, projectIdFor } = await import("./client-A6pJcxSE.js");
 	const secrets = await listSecrets(await projectIdFor(PRODUCTION_PROJECT));
 	return nonEmpty(secrets.find((s) => s.key === "DB_URL")?.value);
 }

package/dist/{commands-Dv5TXjvb.js → commands-CQ-vbNe9.js}

@@ -1,5 +1,5 @@
-import { p as isNonInteractive } from "./telemetry-Bjoz29Hl.js";
-import { a as explainError, o as unwrap, r as errorMessage, t as UsageError } from "./ui-CdKo8mLw.js";
+import { p as isNonInteractive } from "./telemetry-Be_lbB5c.js";
+import { a as explainError, o as unwrap, r as errorMessage, t as UsageError } from "./ui-Bb69ZfVv.js";
 import { n as positionals } from "./args-Cjr_Iqts.js";
 import { t as DONE } from "./dispatch-D048O65I.js";
 import { dirname, relative, resolve } from "node:path";

package/dist/{commands-BQ2NIqub.js → commands-D-sNogNX.js}

@@ -1,9 +1,9 @@
-import { n as isDryRun } from "./dry-run-3IxPmCtW.js";
-import { o as unwrap, r as errorMessage, t as UsageError } from "./ui-CdKo8mLw.js";
+import { n as isDryRun } from "./dry-run-CFCZUpjb.js";
+import { o as unwrap, r as errorMessage, t as UsageError } from "./ui-Bb69ZfVv.js";
 import { t as DONE } from "./dispatch-D048O65I.js";
-import { a as reportFailure, c as connect, d as withConnection, i as readInputFile, n as confirmWrite, o as say, r as plural, s as ProductionError, t as canPrompt, u as requireProductionKey } from "./cli-Do2nWD7W.js";
-import { a as createAccounts, i as createAccountFor, n as accountFinder, r as accountsWith, t as parseCsv } from "./read-B-aJJewb.js";
-import { n as findMeetingsWith, r as pickMeeting, t as describeMeeting } from "./meetings-DfU867eV.js";
+import { a as reportFailure, c as connect, d as withConnection, i as readInputFile, n as confirmWrite, o as say, r as plural, s as ProductionError, t as canPrompt, u as requireProductionKey } from "./cli-D6swhEN-.js";
+import { a as createAccounts, i as createAccountFor, n as accountFinder, r as accountsWith, t as parseCsv } from "./read-BLyKoe4l.js";
+import { n as findMeetingsWith, r as pickMeeting, t as describeMeeting } from "./meetings-CtBMT_25.js";
 import { text } from "@clack/prompts";
 import { parseArgs } from "node:util";
 //#region src/attendance/plan.ts

package/dist/{commands-5Ou8xJw5.js → commands-D4FcDQuh.js}

@@ -1,9 +1,9 @@
-import { n as isDryRun } from "./dry-run-3IxPmCtW.js";
-import { r as errorMessage, t as UsageError } from "./ui-CdKo8mLw.js";
+import { n as isDryRun } from "./dry-run-CFCZUpjb.js";
+import { r as errorMessage, t as UsageError } from "./ui-Bb69ZfVv.js";
 import { i as exportParams, n as EXPORT_KINDS, r as auditFilters, t as EXPORTS } from "./queries-DeEwfe2c.js";
 import { t as DONE } from "./dispatch-D048O65I.js";
-import { a as reportFailure, c as connect, l as dbError, o as say, r as plural, s as ProductionError, u as requireProductionKey } from "./cli-Do2nWD7W.js";
-import { i as parseBound, n as findMeetingsWith, r as pickMeeting, t as describeMeeting } from "./meetings-DfU867eV.js";
+import { a as reportFailure, c as connect, l as dbError, o as say, r as plural, s as ProductionError, u as requireProductionKey } from "./cli-D6swhEN-.js";
+import { i as parseBound, n as findMeetingsWith, r as pickMeeting, t as describeMeeting } from "./meetings-CtBMT_25.js";
 import { open, rm } from "node:fs/promises";
 import { execFile } from "node:child_process";
 import { parseArgs, promisify } from "node:util";

package/dist/{commands-Sx1fDNNn.js → commands-DQYH_m6i.js}

@@ -1,6 +1,6 @@
-import { p as isNonInteractive } from "./telemetry-Bjoz29Hl.js";
-import { n as isDryRun } from "./dry-run-3IxPmCtW.js";
-import { a as explainError, o as unwrap, t as UsageError } from "./ui-CdKo8mLw.js";
+import { p as isNonInteractive } from "./telemetry-Be_lbB5c.js";
+import { n as isDryRun } from "./dry-run-CFCZUpjb.js";
+import { a as explainError, o as unwrap, t as UsageError } from "./ui-Bb69ZfVv.js";
 import { i as qrParseOptions, n as QR_FLAGS, t as QR_EXTRA_FLAGS } from "./options-DCaqm8BI.js";
 import { t as DONE } from "./dispatch-D048O65I.js";
 import { dirname, extname, relative, resolve } from "node:path";

package/dist/{commands-CLSxKz-l.js → commands-Dwr4_CSu.js}

@@ -1,8 +1,8 @@
-import { n as isDryRun } from "./dry-run-3IxPmCtW.js";
-import { r as errorMessage, t as UsageError } from "./ui-CdKo8mLw.js";
+import { n as isDryRun } from "./dry-run-CFCZUpjb.js";
+import { r as errorMessage, t as UsageError } from "./ui-Bb69ZfVv.js";
 import { t as DONE } from "./dispatch-D048O65I.js";
-import { a as reportFailure, d as withConnection, i as readInputFile, n as confirmWrite, o as say, r as plural, t as canPrompt, u as requireProductionKey } from "./cli-Do2nWD7W.js";
-import { a as createAccounts, i as createAccountFor, n as accountFinder, o as readAccounts, t as parseCsv } from "./read-B-aJJewb.js";
+import { a as reportFailure, d as withConnection, i as readInputFile, n as confirmWrite, o as say, r as plural, t as canPrompt, u as requireProductionKey } from "./cli-D6swhEN-.js";
+import { a as createAccounts, i as createAccountFor, n as accountFinder, o as readAccounts, t as parseCsv } from "./read-BLyKoe4l.js";
 import { parseArgs } from "node:util";
 //#region src/involvement/csv.ts
 /**

package/dist/{commands-DzALVX5g.js → commands-zApyD2Rk.js}

@@ -1,9 +1,9 @@
-import { i as explain } from "./ui-CdKo8mLw.js";
+import { i as explain } from "./ui-Bb69ZfVv.js";
 //#region src/import/commands.ts
 const handleImport = async (rest) => {
 	const [what, ...args] = rest;
-	if (what === "involvement") return (await import("./commands-CLSxKz-l.js")).handleInvolvement(args);
-	if (what === "attendance") return (await import("./commands-BQ2NIqub.js")).handleAttendance(args);
+	if (what === "involvement") return (await import("./commands-Dwr4_CSu.js")).handleInvolvement(args);
+	if (what === "attendance") return (await import("./commands-D-sNogNX.js")).handleAttendance(args);
 	explain(what ? `Unknown import "${what}". Try involvement or attendance.` : "Name the import: involvement or attendance.", "");
 	process.exitCode = 1;
 	return null;

package/dist/{dry-run-3IxPmCtW.js → dry-run-CFCZUpjb.js}

@@ -1,4 +1,4 @@
-import { T as cliName } from "./telemetry-Bjoz29Hl.js";
+import { T as cliName } from "./telemetry-Be_lbB5c.js";
 //#region ../cli-core/src/dry-run.ts
 const DRY_RUN_FLAG = "--dry-run";
 /** Commands that forward everything after their name to another tool. */

package/dist/launch.js

@@ -1,9 +1,9 @@
-import { C as discoverRepoRoot, E as setCliName, S as RepoNotFoundError, T as cliName, _ as installFailureLog, d as hasYes, g as stripTierFlag, h as stripNoEnvFlag, m as setNoEnv, n as captureDevtoolsError, o as initDevtoolsTelemetry, p as isNonInteractive, s as lastSentryEventId } from "./telemetry-Bjoz29Hl.js";
-import { c as setMenuEnvHook, d as formatCommand, f as helpPath, n as bareGroupStartPath, t as catalog } from "./catalog-Dke7bQVz.js";
-import { i as loadEnvSession, r as loadEnvLoad } from "./peers-B0KDkI6a.js";
+import { C as discoverRepoRoot, E as setCliName, S as RepoNotFoundError, T as cliName, _ as installFailureLog, d as hasYes, g as stripTierFlag, h as stripNoEnvFlag, m as setNoEnv, n as captureDevtoolsError, o as initDevtoolsTelemetry, p as isNonInteractive, s as lastSentryEventId } from "./telemetry-Be_lbB5c.js";
+import { c as setMenuEnvHook, d as formatCommand, f as helpPath, n as bareGroupStartPath, t as catalog } from "./catalog-BWtUtxMF.js";
+import { i as loadEnvSession, r as loadEnvLoad } from "./peers-u1zxe-Ub.js";
 import { t as nonEmpty } from "./connection-D3XsOE3S.js";
-import { i as setDryRun, n as isDryRun, r as resolveDryRun } from "./dry-run-3IxPmCtW.js";
-import { o as unwrap, r as errorMessage } from "./ui-CdKo8mLw.js";
+import { i as setDryRun, n as isDryRun, r as resolveDryRun } from "./dry-run-CFCZUpjb.js";
+import { o as unwrap, r as errorMessage } from "./ui-Bb69ZfVv.js";
 import { confirm } from "@clack/prompts";
 //#region ../cli-core/src/pipes.ts
 /**
@@ -322,7 +322,7 @@ async function launchWith(argv, options) {
 */
 async function launch(argv) {
 	await launchWith(argv, { dispatch: async (args) => {
-		const { main } = await import("./cli-BhZ4je2D.js");
+		const { main } = await import("./cli-J_avqnlu.js");
 		await main(args);
 	} });
 }

package/dist/{meetings-DfU867eV.js → meetings-CtBMT_25.js}

@@ -1,5 +1,5 @@
-import { t as UsageError } from "./ui-CdKo8mLw.js";
-import "./cli-Do2nWD7W.js";
+import { t as UsageError } from "./ui-Bb69ZfVv.js";
+import "./cli-D6swhEN-.js";
 //#region src/production/time.ts
 /**
 * Dates as officers type them. Meetings happen in Athens, so a bare

package/dist/{peers-B0KDkI6a.js → peers-u1zxe-Ub.js}

@@ -1,4 +1,4 @@
-import { S as RepoNotFoundError, w as findRepoRoot } from "./telemetry-Bjoz29Hl.js";
+import { S as RepoNotFoundError, w as findRepoRoot } from "./telemetry-Be_lbB5c.js";
 import { createRequire } from "node:module";
 import { pathToFileURL } from "node:url";
 import { existsSync, readFileSync, readdirSync } from "node:fs";

package/dist/{read-B-aJJewb.js → read-BLyKoe4l.js}

@@ -1,5 +1,5 @@
-import { r as errorMessage } from "./ui-CdKo8mLw.js";
-import { d as withConnection, s as ProductionError } from "./cli-Do2nWD7W.js";
+import { r as errorMessage } from "./ui-Bb69ZfVv.js";
+import { d as withConnection, s as ProductionError } from "./cli-D6swhEN-.js";
 //#region src/production/accounts.ts
 /**
 * Production accounts: reading them, finding one by email, and creating the

package/dist/{telemetry-Bjoz29Hl.js → telemetry-Be_lbB5c.js}

@@ -438,8 +438,8 @@ function isNoEnv() {
 //#region ../cli-core/src/telemetry.ts
 /**
 * devtools' own Sentry wiring — the CLI is a consumer of
-* `@devdogsuga/telemetry` like `apps/platform`, `apps/schedule-builder`, and
-* `apps/sandbox`, but on `@sentry/node` rather than a framework SDK: a CLI
+* `@devdogsuga/telemetry` like `apps/platform` and `apps/schedule-builder`,
+* but on `@sentry/node` rather than a framework SDK: a CLI
 * process starts, runs one command, and exits, with none of a server's
 * request lifecycle for a framework integration to hook into.
 *

package/dist/telemetry.js

@@ -1,2 +1,2 @@
-import { a as hasRealCaller, c as reportDevtoolsError, i as devtoolsTelemetryEnabled, l as reportDevtoolsFailure, n as captureDevtoolsError, o as initDevtoolsTelemetry, r as devtoolsEnvironment, s as lastSentryEventId, t as captureDevtoolsDeprecation, u as resolveDevtoolsDsn } from "./telemetry-Bjoz29Hl.js";
+import { a as hasRealCaller, c as reportDevtoolsError, i as devtoolsTelemetryEnabled, l as reportDevtoolsFailure, n as captureDevtoolsError, o as initDevtoolsTelemetry, r as devtoolsEnvironment, s as lastSentryEventId, t as captureDevtoolsDeprecation, u as resolveDevtoolsDsn } from "./telemetry-Be_lbB5c.js";
 export { captureDevtoolsDeprecation, captureDevtoolsError, devtoolsEnvironment, devtoolsTelemetryEnabled, hasRealCaller, initDevtoolsTelemetry, lastSentryEventId, reportDevtoolsError, reportDevtoolsFailure, resolveDevtoolsDsn };

package/dist/{ui-CdKo8mLw.js → ui-Bb69ZfVv.js}

@@ -1,4 +1,4 @@
-import { c as reportDevtoolsError, p as isNonInteractive, y as suppressFailureLog } from "./telemetry-Bjoz29Hl.js";
+import { c as reportDevtoolsError, p as isNonInteractive, y as suppressFailureLog } from "./telemetry-Be_lbB5c.js";
 import { cancel, isCancel, log, note } from "@clack/prompts";
 //#region ../cli-core/src/ui.ts
 /**

package/dist/{vault-CsBC-1Mq.js → vault-DFV0zjbT.js}

@@ -1,4 +1,4 @@
-import { o as unwrap } from "./ui-CdKo8mLw.js";
+import { o as unwrap } from "./ui-Bb69ZfVv.js";
 import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
 import { confirm, log, spinner } from "@clack/prompts";

package/env.ts

@@ -96,7 +96,22 @@ declare({
       doc:
         "A Sentry organization auth token. Deploys use it to create each " +
         "release and upload its source maps, and the smoke test uses it to " +
-        "read cron check-ins. One token serves every environment.",
+        "confirm the release landed. One token serves every environment.",
+      scope: "environment",
+      secrecy: "secret",
+      commented: true,
+    }),
+    // Read only by `deploy prune-monitors`, in its own step's `env:`: an
+    // organization token (above) can neither list nor delete Crons monitors,
+    // and one that can delete monitors and alert rules org-wide should not
+    // sit in every step of the deploy job. Without it, pruning is skipped
+    // with a notice.
+    SENTRY_MONITORS_TOKEN: define(z.string().min(1).optional(), {
+      doc:
+        "A Sentry internal integration token with Alerts: Read & Write and " +
+        "nothing else. The production deploy uses it to delete the Crons " +
+        "monitors an app no longer declares, which would otherwise alert " +
+        "on missed check-ins forever.",
       scope: "environment",
       secrecy: "secret",
       commented: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devdogsuga/backstage",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "private": false,
   "type": "module",
   "description": "Officer and production CLI for DevDogsUGA: deploys, env sync with Bitwarden and GitHub, the migration planner role, club graphics and QR codes, GitHub rulesets and settings, and the newsletter. Ships built JS; run it anywhere with `pnpm dlx @devdogsuga/backstage` (no checkout needed to start; commands that read a checkout say so).",
@@ -40,10 +40,10 @@
     "tsx": "^4.23.12",
     "typescript": "^6.0.3",
     "zod": "4.4.3",
-    "@devdogsuga/brand": "0.1.5",
+    "@devdogsuga/events": "0.1.5",
     "@devdogsuga/newsletter": "0.1.10",
-    "@devdogsuga/telemetry": "0.1.3",
-    "@devdogsuga/events": "0.1.5"
+    "@devdogsuga/brand": "0.1.5",
+    "@devdogsuga/telemetry": "0.1.4"
   },
   "peerDependencies": {
     "@devdogsuga/db": "*",
@@ -66,8 +66,8 @@
     "vitest": "^4.1.11",
     "@devdogsuga/config": "0.1.2",
     "@devdogsuga/db": "0.1.3",
-    "@devdogsuga/env": "0.1.5",
-    "@devdogsuga/cli-core": "0.0.0"
+    "@devdogsuga/cli-core": "0.0.0",
+    "@devdogsuga/env": "0.1.5"
   },
   "scripts": {
     "build": "tsdown && node scripts/write-build-info.mjs && node ../../scripts/check-bundle-imports.mjs",

package/dist/client-DwDGjalU.js

@@ -1,2 +0,0 @@
-import { a as listSecrets, o as projectIdFor } from "./client-B_MY9kVI.js";
-export { listSecrets, projectIdFor };