@devdogsuga/backstage 0.1.7 → 0.1.9

package/README.md

@@ -37,29 +37,30 @@ pnpm backstage creds renew                       # extend every Send 30 days
 pnpm backstage import involvement --file OrganizationRoster.csv  # verify members; previews, then asks
 pnpm backstage import attendance --meeting 2026-09-09 --file sign-in.csv
 pnpm backstage export stars --from 2026-08-17   # audited under your gh login
+pnpm backstage export attendance --meeting 2026-09-09 --format bevy,involvement
 ```
 
 ## Commands
 
-| Command                                          | What it does                                                                           |
-| ------------------------------------------------ | -------------------------------------------------------------------------------------- |
-| `deploy <app> --tier <t>`                        | Checks `CLOUDFLARE_API_TOKEN`, writes the Worker's secrets file, deploys, removes it.  |
-| `deploy write-env`                               | Composes `.env.<DEPLOY_ENV>` from the GitHub environment.                              |
-| `deploy preflight`                               | Classifies the project: paused (skip) or broken (fail).                                |
-| `deploy plan`, `deploy migrate`                  | Dry-run the migrations into the job summary; apply them to `DB_URL`.                   |
-| `deploy smoke --tier <t> [--app]`                | Public routes answer 200, the auth redirect works, this deploy's Sentry release shows. |
-| `deploy reconcile --tier <t>`                    | The platform's config reconcile, after the deploy (`CRON_SECRET`).                     |
-| `deploy prune-monitors --tier <t> [--app]`       | Deletes the app's Sentry Crons monitors it no longer declares (production only).       |
-| `env pull\|push\|audit --target <t>`             | One env file per target, synced to Bitwarden and GitHub. `audit` lists orphans.        |
-| `planner status\|create\|reset-password\|drop`   | The `migration_planner` role the preflight tier holds.                                 |
-| `graphics [graphic…]`                            | Club images from `@devdogsuga/brand`: `brand/*`, `app/*`, `event/*`.                   |
-| `qr <text>`                                      | QR codes with every option of `/console/qr`.                                           |
-| `github rulesets\|settings`                      | Diff (and with `--apply` write) GitHub config, through `gh`.                           |
-| `newsletter render\|draft\|send <issue…>`        | Changelog issues as files, mailbox drafts, or a send.                                  |
-| `creds send\|add\|renew\|list\|report`           | Club logins from Bitwarden as email-verified Sends, and the Linear report.             |
-| `import involvement --file <csv>`                | Verifies the members on the Involvement Network roster, unverifies everyone else.      |
-| `import attendance --meeting <day> --file <csv>` | Records a meeting's attendance from a sign-in sheet (method `import`).                 |
-| `export stars\|attendance\|reflections`          | Member data as CSV, each export audited under the officer's gh login.                  |
+| Command                                            | What it does                                                                           |
+| -------------------------------------------------- | -------------------------------------------------------------------------------------- |
+| `deploy <app> --tier <t>`                          | Checks `CLOUDFLARE_API_TOKEN`, writes the Worker's secrets file, deploys, removes it.  |
+| `deploy write-env`                                 | Composes `.env.<DEPLOY_ENV>` from the GitHub environment.                              |
+| `deploy preflight`                                 | Classifies the project: paused (skip) or broken (fail).                                |
+| `deploy plan`, `deploy migrate`                    | Dry-run the migrations into the job summary; apply them to `DB_URL`.                   |
+| `deploy smoke --tier <t> [--app]`                  | Public routes answer 200, the auth redirect works, this deploy's Sentry release shows. |
+| `deploy reconcile --tier <t>`                      | The platform's config reconcile, after the deploy (`CRON_SECRET`).                     |
+| `deploy prune-monitors --tier <t> [--app]`         | Deletes the app's Sentry Crons monitors it no longer declares (production only).       |
+| `env pull\|push\|audit --target <t>`               | One env file per target, synced to Bitwarden and GitHub. `audit` lists orphans.        |
+| `planner status\|create\|reset-password\|drop`     | The `migration_planner` role the preflight tier holds.                                 |
+| `graphics [graphic…]`                              | Club images from `@devdogsuga/brand`: `brand/*`, `app/*`, `event/*`.                   |
+| `qr <text>`                                        | QR codes with every option of `/console/qr`.                                           |
+| `github rulesets\|settings`                        | Diff (and with `--apply` write) GitHub config, through `gh`.                           |
+| `newsletter render\|draft\|send <issue…>`          | Changelog issues as files, mailbox drafts, or a send.                                  |
+| `creds send\|add\|renew\|list\|report`             | Club logins from Bitwarden as email-verified Sends, and the Linear report.             |
+| `import involvement --file <csv>`                  | Verifies the members on the Involvement Network roster, unverifies everyone else.      |
+| `import attendance --meeting <day> --file <csv>`   | Records a meeting's attendance from a sign-in sheet (method `import`).                 |
+| `export stars\|attendance\|reflections\|responses` | Member data as CSV, each export audited under the officer's gh login.                  |
 
 `smoke` and `reconcile` replace DevDogsUGA's `packages/deploy-checks`. The
 per-app data (hosts, public paths, the protected path and its redirect) stays in
@@ -78,8 +79,7 @@ DevDogsUGA, as a `smoke` field on each app's entry in `workers.json`:
       "protectedPath": "/console/permissions",
       "protectedRedirectPrefix": "/auth"
     }
-  },
-  "apps/sandbox"
+  }
 ]
 ```
 
@@ -202,15 +202,32 @@ meetings are refused. Rerunning a sheet records nothing new; `--replace`
 makes the sheet the meeting's whole imported set, removing earlier imported
 rows it no longer lists. Every run previews, then asks (`--dry-run`, `--yes`).
 
-### `export stars|attendance|reflections`
+### `export stars|attendance|reflections|responses`
 
 The platform's three CSVs, columns unchanged: `stars` (one row per earned
 star), `attendance` (one row per check-in; `--meeting` for one night) and
-`reflections` (each member's current text). Each export writes a
+`reflections` (each member's current text). `responses` is the check-in
+survey: one row per answer, worded with each question's current labels
+beside the stored value. With `--meeting` it is that meeting's answers plus
+its attendees' member answers as they stood when it ended (from the answer
+history); `--format wide` writes one meeting as one row per person and one
+column per question. Each export writes a
 `platform.exportAudit` row before reading anything, attributed to the
 platform account linked to the GitHub login `gh` is signed in as, and refuses
-to run when there is none. The file goes to `./<kind>….csv` (owner-readable
-only, never over an existing file without `--yes`) or stdout with `--out -`.
+to run when there is none.
+
+`attendance` can also be written as a Bevy attendee import (GDG's
+gdg.community.dev; one row per person, checked in, with a `survey:` column
+for each question mapped to one in `questions.json` that anyone answered) and
+an Involvement Network
+list (one MyID email per line), both for one `--meeting`. `--format
+platform,bevy,involvement` picks any of them, written from one read with an
+audit row each; at a terminal it is asked. At a terminal each file's
+destination is asked for too, with path completion (Tab completes the
+highlighted suggestion; a folder means the suggested name inside it).
+Otherwise files go to `./<kind>…[-<format>].<ext>`, or `--out` (a file, a
+folder for several, or `-` for stdout). Files are owner-readable only and
+never replace an existing file without `--yes` or a yes at the prompt.
 
 No secret value reaches stdout, stderr, the failure log, Sentry, an error
 message or argv: values go to `bw` as base64 JSON on stdin, every error is

package/dist/{catalog-BiXI0wyi.js → catalog-COleRgQD.js}

@@ -1,8 +1,8 @@
-import { A as YES, D as DRY_RUN, O as JSON_FLAG, j as createCatalog, k as SCOPES, v as noteRan, w as findRepoRoot } from "./telemetry-Bjoz29Hl.js";
-import { n as isDryRun } from "./dry-run-3IxPmCtW.js";
-import { o as unwrap } from "./ui-CdKo8mLw.js";
+import { A as YES, D as DRY_RUN, O as JSON_FLAG, j as createCatalog, k as SCOPES, v as noteRan, w as findRepoRoot } from "./telemetry-Be_lbB5c.js";
+import { n as isDryRun } from "./dry-run-CFCZUpjb.js";
+import { o as unwrap } from "./ui-Bb69ZfVv.js";
 import { n as positionals } from "./args-Cjr_Iqts.js";
-import { t as EXPORTS } from "./queries-DeEwfe2c.js";
+import { t as EXPORTS } from "./queries-CaAe3cve.js";
 import { r as qrCatalogOptions } from "./options-DCaqm8BI.js";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
@@ -1099,7 +1099,6 @@ const deployCommand = {
 	subcommands: [
 		app("platform"),
 		app("schedule-builder"),
-		app("sandbox"),
 		{
 			name: "write-env",
 			summary: "Compose .env.<DEPLOY_ENV> from the GitHub environment.",
@@ -1243,8 +1242,8 @@ const TO = {
 };
 const OUT = {
 	flag: "--out",
-	value: "<path|->",
-	summary: "Where to write. Defaults to ./<kind>….csv; - for stdout."
+	value: "<path|dir|->",
+	summary: "Where to write (a folder for several files; - for stdout). Asked at a terminal."
 };
 function exportOf(kind, extra = []) {
 	return {
@@ -1262,18 +1261,28 @@ function exportOf(kind, extra = []) {
 		]
 	};
 }
+const MEETING = {
+	flag: "--meeting",
+	value: "<meeting>",
+	summary: "One meeting: its day (2026-09-09), slug, config id or id."
+};
 const exportCommand = {
 	name: "export",
-	summary: "Member data as CSV: stars, attendance, reflections. Audited.",
+	summary: "Member data as CSV: stars, attendance, reflections, survey responses. Audited.",
 	hint: "production database; your gh login is recorded",
 	subcommands: [
 		exportOf("stars"),
-		exportOf("attendance", [{
-			flag: "--meeting",
-			value: "<meeting>",
-			summary: "One meeting: its day (2026-09-09), slug, config id or id."
+		exportOf("attendance", [MEETING, {
+			flag: "--format",
+			value: "<formats>",
+			summary: "platform, bevy (GDG attendee import), involvement (MyID emails); comma-separated. Asked at a terminal."
 		}]),
-		exportOf("reflections")
+		exportOf("reflections"),
+		exportOf("responses", [MEETING, {
+			flag: "--format",
+			value: "<formats>",
+			summary: "platform (one row per answer), wide (one row per person; needs --meeting). Asked at a terminal."
+		}])
 	]
 };
 //#endregion

package/dist/{cli-Cz8faASC.js → cli-CMThHZgV.js}

@@ -1,13 +1,13 @@
-import { C as discoverRepoRoot, T as cliName, b as ownPackageDir, c as reportDevtoolsError, f as isNoEnv, l as reportDevtoolsFailure, n as captureDevtoolsError, o as initDevtoolsTelemetry, p as isNonInteractive, w as findRepoRoot, x as ownVersion } from "./telemetry-Bjoz29Hl.js";
-import { a as recordEnteredTier, f as helpPath, i as beginInvocation, l as dbPush, m as renderHelp, n as bareGroupStartPath, o as recordResolved, p as renderCommandList, r as runMenu, s as reproducibleCommand, t as catalog, u as dbPushDryRun } from "./catalog-BiXI0wyi.js";
-import { a as repoPeerUrl, n as loadEnv, r as loadEnvLoad, t as getEnvSync } from "./peers-B0KDkI6a.js";
+import { C as discoverRepoRoot, T as cliName, b as ownPackageDir, c as reportDevtoolsError, f as isNoEnv, l as reportDevtoolsFailure, n as captureDevtoolsError, o as initDevtoolsTelemetry, p as isNonInteractive, w as findRepoRoot, x as ownVersion } from "./telemetry-Be_lbB5c.js";
+import { a as recordEnteredTier, f as helpPath, i as beginInvocation, l as dbPush, m as renderHelp, n as bareGroupStartPath, o as recordResolved, p as renderCommandList, r as runMenu, s as reproducibleCommand, t as catalog, u as dbPushDryRun } from "./catalog-COleRgQD.js";
+import { a as repoPeerUrl, n as loadEnv, r as loadEnvLoad, t as getEnvSync } from "./peers-u1zxe-Ub.js";
 import { t as nonEmpty } from "./connection-D3XsOE3S.js";
-import { a as wouldRunLine, n as isDryRun, t as dryRunKind } from "./dry-run-3IxPmCtW.js";
-import { a as explainError, i as explain, n as bail, o as unwrap, r as errorMessage } from "./ui-CdKo8mLw.js";
+import { a as wouldRunLine, n as isDryRun, t as dryRunKind } from "./dry-run-CFCZUpjb.js";
+import { a as explainError, i as explain, n as bail, o as unwrap, r as errorMessage } from "./ui-Bb69ZfVv.js";
 import { n as positionals, t as flagValue } from "./args-Cjr_Iqts.js";
 import { t as DONE } from "./dispatch-D048O65I.js";
 import { t as EnvDocument } from "./document-DumoZXoO.js";
-import { a as listSecrets$1, c as updateSecret, i as createSecret, o as projectIdFor, r as byKey, s as setExplicitAccessToken } from "./client-B_MY9kVI.js";
+import { a as listSecrets$1, c as updateSecret, i as createSecret, o as projectIdFor, r as byKey, s as setExplicitAccessToken } from "./client-NuoKMQmV.js";
 import { register } from "node:module";
 import { pathToFileURL } from "node:url";
 import { appendFileSync, existsSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
@@ -249,16 +249,12 @@ async function importRepoTs(absolutePath) {
 * Most workspace packages declare nothing, so "no env.ts found" means
 * not-a-manifest rather than an error.
 *
-* ⚠️ `apps/sandbox` was once listed here as having no manifest ON PURPOSE, on
-* the grounds that a Worker reads bindings that arrive as a function argument
-* rather than `process.env`. That premise is still true and the conclusion
-* drawn from it was still wrong: a manifest is also the only thing that routes
-* a credential to a deployed environment and the only thing that tells
-* `env audit` a Worker secret is supposed to be there. Without one,
-* `SANDBOX_PROXY_TOKEN`, minted at deploy time and therefore in no Bitwarden
-* project by design, was reported as an orphan, i.e. as safe for the §3.6 prune
-* path to delete. `apps/sandbox/env.ts` exists now, and states that reasoning
-* at length.
+* ⚠️ A Worker still needs a manifest, even though its bindings arrive as a
+* function argument rather than `process.env`: a manifest is the only thing
+* that routes a credential to a deployed environment and the only thing that
+* tells `env audit` a Worker secret is supposed to be there. Without one, a
+* minted secret (in no Bitwarden project by design) is reported as an orphan,
+* i.e. as safe for the §3.6 prune path to delete.
 */
 /**
 * The single in-flight (or settled) load.
@@ -847,8 +843,7 @@ async function runPreflight(deps = {}) {
 * ## Minted keys are refused, not filled
 *
 * A `secrecy: "secret"` key `storableKeys()` excludes is "minted": signed at
-* deploy time rather than stored anywhere, which is what `SANDBOX_PROXY_TOKEN`
-* is declared as. This has no minter of its own — there is nothing in
+* deploy time rather than stored anywhere. This has no minter of its own — there is nothing in
 * this repository that produces one — so a declared minted key is always a
 * hard failure here rather than a silent omission: a Worker that expects a
 * value substituted fails loudly at the file it never got, not at whatever
@@ -1661,8 +1656,7 @@ function renderWriteEnvReport(result) {
 * which leaves a Wrangler "config redirect" at `.wrangler/deploy/config.json`
 * pointing at the generated `dist/server/wrangler.json`; a bare `wrangler
 * deploy` from the app dir resolves through it with no `--config` needed.
-* Sandbox (plain Worker) always used this shape, so all three apps share one
-* deploy step.
+* Both apps share one deploy step.
 *
 * Steps (`write-env`, `preflight`, `plan`, `migrate`, `smoke`, `reconcile`,
 * `prune-monitors`) are individually addressable for jobs that run only one.
@@ -2738,9 +2732,9 @@ async function listWorkerSecrets(target) {
 *
 * The expected set is derived from the app's own manifest: every key it
 * declares with `secrecy: "secret"`. That deliberately includes the MINTED
-* ones. `SANDBOX_PROXY_TOKEN` has no copy in Bitwarden or GitHub by design, and
-* an audit that reasoned from stored copies alone would report the live proxy
-* credential as safe to delete. (`env audit` had exactly that bug; see
+* ones. A minted key has no copy in Bitwarden or GitHub by design, and an
+* audit that reasoned from stored copies alone would report a live credential
+* as safe to delete. (`env audit` had exactly that bug; see
 * `EnvMeta.minted`.)
 *
 * ## Report always, prune almost never (security plan §3.6)
@@ -5386,12 +5380,12 @@ const HANDLERS = {
 	},
 	completions: handleCompletions,
 	github: handleGithub,
-	graphics: async (rest) => (await import("./commands-Dv5TXjvb.js")).handleGraphics(rest),
-	qr: async (rest) => (await import("./commands-Sx1fDNNn.js")).handleQr(rest),
-	newsletter: async (rest) => (await import("./commands-D345F-Od.js")).handleNewsletter(rest),
-	creds: async (rest) => (await import("./commands-zPSnOGzH.js")).handleCreds(rest),
-	import: async (rest) => (await import("./commands-DzALVX5g.js")).handleImport(rest),
-	export: async (rest) => (await import("./commands-5Ou8xJw5.js")).handleExport(rest)
+	graphics: async (rest) => (await import("./commands-jJcS7D2a.js")).handleGraphics(rest),
+	qr: async (rest) => (await import("./commands-DQYH_m6i.js")).handleQr(rest),
+	newsletter: async (rest) => (await import("./commands-35rBJ1R0.js")).handleNewsletter(rest),
+	creds: async (rest) => (await import("./commands-BF5eptEi.js")).handleCreds(rest),
+	import: async (rest) => (await import("./commands-CuYIkHeU.js")).handleImport(rest),
+	export: async (rest) => (await import("./commands-CaSixDwT.js")).handleExport(rest)
 };
 /**
 * Names that were commands of the contributor CLI, refused with where they

package/dist/{cli-Do2nWD7W.js → cli-DjIwbjnx.js}

@@ -1,6 +1,6 @@
-import { C as discoverRepoRoot, p as isNonInteractive } from "./telemetry-Bjoz29Hl.js";
+import { C as discoverRepoRoot, p as isNonInteractive } from "./telemetry-Be_lbB5c.js";
 import { t as nonEmpty } from "./connection-D3XsOE3S.js";
-import { a as explainError, i as explain, o as unwrap, t as UsageError } from "./ui-CdKo8mLw.js";
+import { a as explainError, i as explain, o as unwrap, t as UsageError } from "./ui-Bb69ZfVv.js";
 import { t as EnvDocument } from "./document-DumoZXoO.js";
 import { resolve } from "node:path";
 import { confirm, log, text } from "@clack/prompts";
@@ -31,7 +31,7 @@ async function readProductionKey(key) {
 		const value = nonEmpty(EnvDocument.parse(text).get(key));
 		if (value) return value;
 	} catch {}
-	const { listSecrets, projectIdFor } = await import("./client-DwDGjalU.js");
+	const { listSecrets, projectIdFor } = await import("./client-A6pJcxSE.js");
 	const secrets = await listSecrets(await projectIdFor(PRODUCTION_PROJECT));
 	return nonEmpty(secrets.find((s) => s.key === key)?.value);
 }
@@ -133,4 +133,4 @@ function reportFailure(command, err, worded = []) {
 	explainError(`${command} failed.`, err);
 }
 //#endregion
-export { reportFailure as a, connect as c, withConnection as d, readInputFile as i, dbError as l, confirmWrite as n, say as o, plural as r, ProductionError as s, canPrompt as t, requireProductionKey as u };
+export { readInputFile as a, ProductionError as c, requireProductionKey as d, withConnection as f, plural as i, connect as l, confirmWrite as n, reportFailure as o, expandHome as r, say as s, canPrompt as t, dbError as u };

package/dist/client-A6pJcxSE.js

@@ -0,0 +1,2 @@
+import { a as listSecrets, o as projectIdFor } from "./client-NuoKMQmV.js";
+export { listSecrets, projectIdFor };

package/dist/{client-B_MY9kVI.js → client-NuoKMQmV.js}

@@ -1,8 +1,8 @@
-import { w as findRepoRoot } from "./telemetry-Bjoz29Hl.js";
-import { n as loadEnv } from "./peers-B0KDkI6a.js";
-import { o as unwrap } from "./ui-CdKo8mLw.js";
+import { w as findRepoRoot } from "./telemetry-Be_lbB5c.js";
+import { n as loadEnv } from "./peers-u1zxe-Ub.js";
+import { o as unwrap } from "./ui-Bb69ZfVv.js";
 import { t as EnvDocument } from "./document-DumoZXoO.js";
-import { a as readTokenFromVault, o as saveTokenToVault, t as VAULT_ITEM_NAME } from "./vault-CsBC-1Mq.js";
+import { a as readTokenFromVault, o as saveTokenToVault, t as VAULT_ITEM_NAME } from "./vault-DFV0zjbT.js";
 import { dirname, join, resolve } from "node:path";
 import { log, password, select, text } from "@clack/prompts";
 import { mkdir, readFile, writeFile } from "node:fs/promises";

package/dist/{commands-D345F-Od.js → commands-35rBJ1R0.js}

@@ -1,5 +1,5 @@
-import { p as isNonInteractive } from "./telemetry-Bjoz29Hl.js";
-import { a as explainError, o as unwrap, r as errorMessage, t as UsageError } from "./ui-CdKo8mLw.js";
+import { p as isNonInteractive } from "./telemetry-Be_lbB5c.js";
+import { a as explainError, o as unwrap, r as errorMessage, t as UsageError } from "./ui-Bb69ZfVv.js";
 import { t as DONE } from "./dispatch-D048O65I.js";
 import { dirname, join, resolve } from "node:path";
 import { confirm, log, multiselect, spinner, text } from "@clack/prompts";

package/dist/{commands-zPSnOGzH.js → commands-BF5eptEi.js}

@@ -1,9 +1,9 @@
-import { C as discoverRepoRoot, p as isNonInteractive } from "./telemetry-Bjoz29Hl.js";
+import { C as discoverRepoRoot, p as isNonInteractive } from "./telemetry-Be_lbB5c.js";
 import { t as nonEmpty } from "./connection-D3XsOE3S.js";
-import { a as explainError, i as explain, o as unwrap, r as errorMessage, t as UsageError } from "./ui-CdKo8mLw.js";
+import { a as explainError, i as explain, o as unwrap, r as errorMessage, t as UsageError } from "./ui-Bb69ZfVv.js";
 import { t as DONE } from "./dispatch-D048O65I.js";
 import { t as EnvDocument } from "./document-DumoZXoO.js";
-import { i as readPasswordFromVault, n as bwArgs, r as openVault, s as bwCommand } from "./vault-CsBC-1Mq.js";
+import { i as readPasswordFromVault, n as bwArgs, r as openVault, s as bwCommand } from "./vault-DFV0zjbT.js";
 import { resolve } from "node:path";
 import { confirm, log, multiselect, note, password, select, text } from "@clack/prompts";
 import { readFile } from "node:fs/promises";
@@ -632,7 +632,7 @@ async function readCheckoutDbUrl() {
 	}
 }
 async function readSecretsManagerDbUrl() {
-	const { listSecrets, projectIdFor } = await import("./client-DwDGjalU.js");
+	const { listSecrets, projectIdFor } = await import("./client-A6pJcxSE.js");
 	const secrets = await listSecrets(await projectIdFor(PRODUCTION_PROJECT));
 	return nonEmpty(secrets.find((s) => s.key === "DB_URL")?.value);
 }