@go-labs-sg/event-tech 0.12.0 → 1.1.0

package/README.md

@@ -93,10 +93,22 @@ et event appearance update --event-id <id> --appearance-version <n> --appearance
 et event appearance reset --event-id <id> --appearance-version <n>
 et event appearance upload --event-id <id> --file ./background.mp4 --media-type video --content-type video/mp4
 et event photo-wall display-items --event-id <id> --limit 30
+et lucky-draw participants replace --event-id <id> --participants '[{"luckyDrawId":"illustrative-001","name":"Example Person","email":"example@example.test"}]' --allow-state-change --target <id>
+et lucky-draw participants list --event-id <id> --page 1 --per-page 100
 ```
 
 Commands emit deterministic JSON envelopes. Authentication credentials are never included in successful output, and bearer credentials are redacted from errors.
 
+### Deprecated event types
+
+Scavenger Hunt (Amazing Race) and Gardens by the Bay are deprecated and frozen.
+Existing `event list`, `event get` and appearance commands retain their contracts
+and can still return historical `SCAVENGER_HUNT` / `GARDENS_BY_THE_BAY` values.
+The CLI has no event-create, duplicate, type-change or scavenger-specific commands;
+no replacement commands or scavenger read-shape parity will be added. The server
+blocks new creation, duplication and changes into these types, including requests
+from older/custom clients. See the [retirement policy](../../../docs/agents/event-tech-deprecated-scavenger.md).
+
 ### Event appearance and Photo Wall display
 
 `event appearance get` returns the canonical appearance, its optimistic-lock
@@ -167,6 +179,65 @@ bun run packages/event-tech/cli/src/index.ts help
 
 Building is not publication or permission to mutate live data. Use focused temporary business-behavior tests and the final pre-push gate from the shared workflow. Use this package's actual scripts; do not assume it has a command-artifact generator.
 
+## Lucky draw participant source import
+
+The participant import is an API-first rollout: use a deployment that includes
+the replacement/readback API. It replaces the source-imported roster; it does
+not append rows and does not evaluate eligibility, produce results, or discover
+a draw. `pre-draw` commits winners, so do not use it for discovery.
+
+Supply one JSON array either inline or from a file (the file form avoids roster
+values in shell history). The identities in this example are illustrative only:
+
+```sh
+et lucky-draw participants replace \
+  --event-id event-123 \
+  --participants-file ./illustrative-participants.json \
+  --allow-state-change \
+  --target event-123
+```
+
+```json
+[
+  {
+    "luckyDrawId": "illustrative-001",
+    "name": "Example Person",
+    "email": "example@example.test"
+  }
+]
+```
+
+`--allow-state-change` must be a bare, explicit acknowledgement, and `--target`
+must exactly match `--event-id`; the CLI rejects either guard before accessing
+native credentials or calling the API. The CLI does not trim or normalize IDs;
+the API validates the roster: it must contain 1–20,000 participants, and
+source IDs must be nonblank and unique as exact strings. The API also enforces name/email limits
+and applies the replacement in one transaction.
+
+The authenticated caller needs `event.setup`. The successful replacement
+envelope preserves the API's additive readback:
+`participants { id, luckyDrawId, name, email, luckyDrawPrizeId }`, plus a
+`summary { added, updated, removed, unchanged, total, replay }` and a matching
+human-readable `message`. Repeating an
+unchanged import changes no participant rows and preserves participant row IDs
+(it records one `lucky_draw_participants_replayed` activity-log entry). If any prize is
+already assigned, including one held by a passport-linked or archived
+participant, only the identical current imported roster is accepted.
+Archived and passport-linked identity collisions conflict. This does not claim
+that historical draws are frozen: existing unassign corrections remain
+unchanged.
+
+List the roster with the API's paginated readback:
+
+```sh
+et lucky-draw participants list --event-id event-123 --page 1 --per-page 100
+```
+
+`page` defaults to 1 and `per-page` defaults to 100 (range 1–100). Inspect all
+pages: the response preserves `participants`, `pageCount`, and `totalCount`.
+Listing can include passport-linked people outside the imported roster. It does
+not create a draw, mutate it, or perform a pre-draw probe.
+
 ## Lucky draw pre-draw
 
 ```sh

package/dist/index.js

@@ -35,31 +35,31 @@ var __toESM = (mod, isNodeMode, target) => {
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
 var __require = import.meta.require;
 
-// ../../../node_modules/.bun/dotenv@18.0.6/node_modules/dotenv/dist/index.cjs
+// ../../../node_modules/.bun/dotenv@18.0.8/node_modules/dotenv/dist/index.cjs
 var require_dist = __commonJS(function(exports, module) {
-  var S = (e, o) => () => {
+  var j = (e, n) => () => {
     try {
-      return o || e((o = { exports: {} }).exports, o), o.exports;
+      return n || e((n = { exports: {} }).exports, n), n.exports;
     } catch (t) {
-      throw o = 0, t;
+      throw n = 0, t;
     }
   };
-  var j = S((xe, U) => {
+  var k = j((xe, U) => {
     function G(e) {
       return typeof e == "string" ? !["false", "0", "no", "off", ""].includes(e.toLowerCase()) : !!e;
     }
-    function X(e = process.env) {
-      let o = {};
+    function Y(e = process.env) {
+      let n = {};
       for (let t of ["ENCODING", "PATH", "QUIET", "DEBUG", "OVERRIDE", "FAST"]) {
-        let n = e[`DOTENV_${t}`] != null ? e[`DOTENV_${t}`] : e[`DOTENV_CONFIG_${t}`];
-        n != null && (o[t.toLowerCase()] = t === "ENCODING" || t === "PATH" ? n : G(n));
+        let o = e[`DOTENV_${t}`] != null ? e[`DOTENV_${t}`] : e[`DOTENV_CONFIG_${t}`];
+        o != null && (n[t.toLowerCase()] = t === "ENCODING" || t === "PATH" ? o : G(o));
       }
-      return o;
+      return n;
     }
-    U.exports = { parseBoolean: G, optionsFromEnv: X };
+    U.exports = { parseBoolean: G, optionsFromEnv: Y };
   });
-  var N = S((ye, x) => {
-    var Y = __require("fs"), k = __require("path"), z = __require("os"), { URL: Z, fileURLToPath: ee } = __require("url"), { parseBoolean: $, optionsFromEnv: B } = j(), te = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"])*"|\s*`(?:\\`|[^`])*`|[^#\r\n]+)?\s*(?:#.*)?(?:$|$)/mg, b = new Uint8Array(256);
+  var N = j((ye, x) => {
+    var z = __require("fs"), I = __require("path"), Z = __require("os"), { URL: ee, fileURLToPath: te } = __require("url"), { parseBoolean: $, optionsFromEnv: B } = k(), re = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"])*"|\s*`(?:\\`|[^`])*`|[^#\r\n]+)?\s*(?:#.*)?(?:$|$)/mg, b = new Uint8Array(256);
     for (let e = 48;e <= 57; e++)
       b[e] = 1;
     for (let e = 65;e <= 90; e++)
@@ -69,92 +69,92 @@ var require_dist = __commonJS(function(exports, module) {
     b[45] = 1;
     b[46] = 1;
     b[95] = 1;
-    function re(e) {
-      let o = {}, t = e.toString();
+    function ne(e) {
+      let n = {}, t = e.toString();
       t = t.replace(/\r\n?/mg, `
 `);
-      let n;
-      for (;(n = te.exec(t)) != null; ) {
-        let r = n[1], s = n[2] || "";
+      let o;
+      for (;(o = re.exec(t)) != null; ) {
+        let r = o[1], s = o[2] || "";
         s = s.trim();
         let i = s[0];
         s = s.replace(/^(['"`])([\s\S]*)\1$/mg, "$2"), i === '"' && (s = s.replace(/\\n/g, `
-`), s = s.replace(/\\r/g, "\r")), o[r] = s;
+`), s = s.replace(/\\r/g, "\r")), n[r] = s;
       }
-      return o;
+      return n;
     }
     function w(e) {
       return e <= 32 ? e === 32 || e >= 9 && e <= 13 : e >= 160 && (e === 160 || e === 5760 || e >= 8192 && e <= 8202 || e === 8232 || e === 8233 || e === 8239 || e === 8287 || e === 12288 || e === 65279);
     }
-    function O(e) {
+    function q(e) {
       return e === 10 || e === 8232 || e === 8233;
     }
     function oe(e) {
-      let o = {}, t = typeof e == "string" ? e : e.toString();
+      let n = {}, t = typeof e == "string" ? e : e.toString();
       t.indexOf("\r") !== -1 && (t = t.replace(/\r\n?/g, `
 `));
-      let n = t.length, r = 0;
-      for (;r < n; ) {
+      let o = t.length, r = 0;
+      for (;r < o; ) {
         let s = t.charCodeAt(r);
-        for (;r < n && w(s); )
+        for (;r < o && w(s); )
           r++, s = t.charCodeAt(r);
-        if (r >= n)
+        if (r >= o)
           break;
         if (s === 35) {
-          for (;r < n && !O(t.charCodeAt(r)); )
+          for (;r < o && !q(t.charCodeAt(r)); )
             r++;
           continue;
         }
         let i = -1;
-        if (s === 101 && r + 6 < n && t.charCodeAt(r + 1) === 120 && t.charCodeAt(r + 2) === 112 && t.charCodeAt(r + 3) === 111 && t.charCodeAt(r + 4) === 114 && t.charCodeAt(r + 5) === 116) {
+        if (s === 101 && r + 6 < o && t.charCodeAt(r + 1) === 120 && t.charCodeAt(r + 2) === 112 && t.charCodeAt(r + 3) === 111 && t.charCodeAt(r + 4) === 114 && t.charCodeAt(r + 5) === 116) {
           let v = t.charCodeAt(r + 6);
           if (w(v)) {
             let u = r + 7;
-            for (;u < n && w(t.charCodeAt(u)); )
+            for (;u < o && w(t.charCodeAt(u)); )
               u++;
             b[t.charCodeAt(u)] && (i = r + 6, r = u);
           } else
             s = t.charCodeAt(r);
         }
         let l = r, d = 0;
-        for (;r < n && (d = t.charCodeAt(r), b[d]); )
+        for (;r < o && (d = t.charCodeAt(r), b[d]); )
           r++;
         if (r === l) {
-          for (;r < n && !O(t.charCodeAt(r)); )
+          for (;r < o && !q(t.charCodeAt(r)); )
             r++;
           continue;
         }
-        let p = t.slice(l, r), f = r;
-        if (r >= n && (d = 0), w(d))
+        let h = t.slice(l, r), f = r;
+        if (r >= o && (d = 0), w(d))
           do
-            r++, d = r < n ? t.charCodeAt(r) : 0;
+            r++, d = r < o ? t.charCodeAt(r) : 0;
           while (w(d));
         if (d === 61)
           r++;
-        else if (d === 58 && r === f && r + 1 < n && w(t.charCodeAt(r + 1)))
+        else if (d === 58 && r === f && r + 1 < o && w(t.charCodeAt(r + 1)))
           r += 2;
         else {
-          for (r = i === -1 ? f : i;r < n && !O(t.charCodeAt(r)); )
+          for (r = i === -1 ? f : i;r < o && !q(t.charCodeAt(r)); )
             r++;
           continue;
         }
         let c = r, a = r;
-        for (;a < n && w(t.charCodeAt(a)); )
+        for (;a < o && w(t.charCodeAt(a)); )
           a++;
-        let g = t.charCodeAt(a), h, y = false;
+        let g = t.charCodeAt(a), p, y = false;
         if (g === 39 || g === 34 || g === 96) {
           let v = t[a], u = t.indexOf(v, a + 1), m = -1, C = -1;
           for (;u !== -1; ) {
-            let q = t.charCodeAt(u - 1) === 92, E = u + 1;
-            for (;E < n && !O(t.charCodeAt(E)) && w(t.charCodeAt(E)); )
+            let O = t.charCodeAt(u - 1) === 92, E = u + 1;
+            for (;E < o && !q(t.charCodeAt(E)) && w(t.charCodeAt(E)); )
               E++;
-            if ((E === n || O(t.charCodeAt(E)) || t.charCodeAt(E) === 35) && (m = u, C = E), !q)
+            if ((E === o || q(t.charCodeAt(E)) || t.charCodeAt(E) === 35) && (m = u, C = E), !O)
               break;
             u = t.indexOf(v, u + 1);
           }
           if (m !== -1) {
-            if (h = t.slice(a + 1, m), r = C, t.charCodeAt(r) === 35)
-              for (;r < n && !O(t.charCodeAt(r)); )
+            if (p = t.slice(a + 1, m), r = C, t.charCodeAt(r) === 35)
+              for (;r < o && !q(t.charCodeAt(r)); )
                 r++;
             y = true;
           }
@@ -162,9 +162,9 @@ var require_dist = __commonJS(function(exports, module) {
         if (!y) {
           let v = t.indexOf(`
 `, c);
-          v === -1 && (v = n);
+          v === -1 && (v = o);
           let u;
-          if (n < 4096)
+          if (o < 4096)
             u = t.indexOf("#", c), (u === -1 || u > v) && (u = v);
           else
             for (u = c;u < v && t.charCodeAt(u) !== 35; )
@@ -174,38 +174,41 @@ var require_dist = __commonJS(function(exports, module) {
             m++;
           for (;C > m && w(t.charCodeAt(C - 1)); )
             C--;
-          let q = t.charCodeAt(m);
-          if (C - m >= 2 && (q === 39 || q === 34 || q === 96) && t.charCodeAt(C - 1) === q ? h = t.slice(m + 1, C - 1) : h = t.slice(m, C), r = u, u < v)
-            for (;r < n && !O(t.charCodeAt(r)); )
+          let O = t.charCodeAt(m);
+          if (p = t.slice(m, C), p.includes("\u2028") || p.includes("\u2029") ? p = p.replace(/^(['"`])([\s\S]*)\1$/mg, "$2") : C - m >= 2 && (O === 39 || O === 34 || O === 96) && t.charCodeAt(C - 1) === O && (p = t.slice(m + 1, C - 1)), r = u, u < v)
+            for (;r < o && !q(t.charCodeAt(r)); )
               r++;
         }
-        g === 34 && (y || a < r) && h.indexOf("\\") !== -1 && (h = h.replace(/\\n/g, `
-`).replace(/\\r/g, "\r")), o[p] = h;
+        g === 34 && (y || a < r) && p.indexOf("\\") !== -1 && (p = p.replace(/\\n/g, `
+`).replace(/\\r/g, "\r")), n[h] = p;
       }
-      return o;
+      return n;
     }
-    function ne(e, o) {
-      return o && $(o.fast) ? oe(e) : re(e);
+    function se(e, n) {
+      return n && $(n.fast) ? oe(e) : ne(e);
     }
     function T(e) {
       console.log(`\u2506 ${e}`);
     }
-    function se(e) {
+    function ie(e) {
       console.error(`\u25C7 ${e}`);
     }
     function V(e) {
-      return e[0] === "~" ? k.join(z.homedir(), e.slice(1)) : e;
+      return e[0] === "~" ? I.join(Z.homedir(), e.slice(1)) : e;
     }
-    function ie(e = {}) {
-      return { ...B(), ...e };
+    function ce(e = {}) {
+      let n = { ...e };
+      for (let t of Object.keys(n))
+        n[t] === undefined && delete n[t];
+      return { ...B(), ...n };
     }
-    function ce(e) {
-      e = ie(e);
-      let o = k.resolve(process.cwd(), ".env"), t = "utf8", n = process.env;
-      e && e.processEnv != null && (n = e.processEnv);
+    function ae(e) {
+      e = ce(e);
+      let n = I.resolve(process.cwd(), ".env"), t = "utf8", o = process.env;
+      e && e.processEnv != null && (o = e.processEnv);
       let r = $(e && e.debug);
       e && e.encoding ? t = e.encoding : r && T("no encoding is specified (UTF-8 is used by default)");
-      let s = [o];
+      let s = [n];
       if (e && e.path)
         if (!Array.isArray(e.path))
           s = [V(e.path)];
@@ -217,116 +220,116 @@ var require_dist = __commonJS(function(exports, module) {
       let i, l = {}, d = { fast: e.fast };
       for (let c of s)
         try {
-          let a = A.parse(Y.readFileSync(c, { encoding: t }), d);
+          let a = A.parse(z.readFileSync(c, { encoding: t }), d);
           A.populate(l, a, e);
         } catch (a) {
           r && T(`failed to load ${c} ${a.message}`), i = a;
         }
-      let p = A.populate(n, l, e), f = $(Object.prototype.hasOwnProperty.call(e, "quiet") ? e.quiet : B(n).quiet);
+      let h = A.populate(o, l, e), f = $(Object.prototype.hasOwnProperty.call(e, "quiet") ? e.quiet : B(o).quiet);
       if (r || !f) {
-        let c = Object.keys(p).length, a = [];
+        let c = Object.keys(h).length, a = [];
         for (let g of s)
           try {
-            let h = k.relative(process.cwd(), g instanceof Z ? ee(g) : g);
-            a.push(h);
-          } catch (h) {
-            r && T(`failed to load ${g} ${h.message}`), i = h;
+            let p = I.relative(process.cwd(), g instanceof ee ? te(g) : g);
+            a.push(p);
+          } catch (p) {
+            r && T(`failed to load ${g} ${p.message}`), i = p;
           }
-        se(`injected env (${c}) from ${a.join(",")}`);
+        ie(`injected env (${c}) from ${a.join(",")}`);
       }
       return i ? { parsed: l, error: i } : { parsed: l };
     }
-    function ae(e) {
+    function le(e) {
       return A.configDotenv(e);
     }
-    function le(e, o, t = {}) {
-      let n = $(t && t.debug), r = $(t && t.override), s = {};
-      if (e === null || typeof e != "object" || o === null || typeof o != "object") {
+    function fe(e, n, t = {}) {
+      let o = $(t && t.debug), r = $(t && t.override), s = {};
+      if (e === null || typeof e != "object" || n === null || typeof n != "object") {
         let i = new Error("OBJECT_REQUIRED: Please check the processEnv argument being passed to populate");
         throw i.code = "OBJECT_REQUIRED", i;
       }
-      for (let i of Object.keys(o))
-        Object.prototype.hasOwnProperty.call(e, i) ? (r === true && (e[i] = o[i], s[i] = o[i]), n && T(r === true ? `"${i}" is already defined and WAS overwritten` : `"${i}" is already defined and was NOT overwritten`)) : (e[i] = o[i], s[i] = o[i]);
+      for (let i of Object.keys(n))
+        Object.prototype.hasOwnProperty.call(e, i) ? (r === true && (e[i] = n[i], s[i] = n[i]), o && T(r === true ? `"${i}" is already defined and WAS overwritten` : `"${i}" is already defined and was NOT overwritten`)) : (e[i] = n[i], s[i] = n[i]);
       return s;
     }
-    var A = { configDotenv: ce, config: ae, parse: ne, populate: le };
+    var A = { configDotenv: ae, config: le, parse: se, populate: fe };
     x.exports.configDotenv = A.configDotenv;
     x.exports.config = A.config;
     x.exports.parse = A.parse;
     x.exports.populate = A.populate;
     x.exports = A;
   });
-  var M = S((Te, W) => {
-    var _ = __require("child_process"), fe = __require("fs"), L = __require("path");
-    function ue(e) {
-      let o = ['"'], t = 0;
-      for (let n of e) {
-        if (n === "\\") {
+  var M = j((Te, W) => {
+    var _ = __require("child_process"), ue = __require("fs"), L = __require("path");
+    function de(e) {
+      let n = ['"'], t = 0;
+      for (let o of e) {
+        if (o === "\\") {
           t++;
           continue;
         }
-        n === '"' ? o.push("\\".repeat(t * 2 + 1), '"') : o.push("\\".repeat(t), n), t = 0;
+        o === '"' ? n.push("\\".repeat(t * 2 + 1), '"') : n.push("\\".repeat(t), o), t = 0;
       }
-      return o.push("\\".repeat(t * 2), '"'), o.join("");
+      return n.push("\\".repeat(t * 2), '"'), n.join("");
     }
-    function H(e, o = 1) {
-      for (let t = 0;t < o; t++) {
-        let n = [];
+    function H(e, n = 1) {
+      for (let t = 0;t < n; t++) {
+        let o = [];
         for (let r of e) {
           let s = r.charCodeAt(0), i = s >= 48 && s <= 57 || s >= 65 && s <= 90 || s >= 97 && s <= 122, l = "\\/:._-".includes(r);
-          !i && !l && s < 128 && n.push("^"), n.push(r);
+          !i && !l && s < 128 && o.push("^"), o.push(r);
         }
-        e = n.join("");
+        e = o.join("");
       }
       return e;
     }
-    function P(e, o) {
-      let t = Object.keys(e).reverse().find((n) => n.toUpperCase() === o);
+    function P(e, n) {
+      let t = Object.keys(e).reverse().find((o) => o.toUpperCase() === n);
       return t === undefined ? undefined : e[t];
     }
-    function de(e, o, t) {
-      let n = (P(o, "PATHEXT") || ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean), s = n.some((l) => e.toLowerCase().endsWith(l.toLowerCase())) ? ["", ...n] : [...n, ""], i = /[\\/]/.test(e) ? [t] : [t, ...(P(o, "PATH") || "").split(";")];
+    function pe(e, n, t) {
+      let o = (P(n, "PATHEXT") || ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean), s = o.some((l) => e.toLowerCase().endsWith(l.toLowerCase())) ? ["", ...o] : [...o, ""], i = /[\\/]/.test(e) ? [t] : [t, ...(P(n, "PATH") || "").split(";")];
       for (let l of i)
         for (let d of s) {
-          let p = L.resolve(t, l.replace(/^"|"$/g, ""), e + d);
+          let h = L.resolve(t, l.replace(/^"|"$/g, ""), e + d);
           try {
-            if (fe.statSync(p).isFile())
-              return p;
+            if (ue.statSync(h).isFile())
+              return h;
           } catch {}
         }
     }
-    function pe(e, o, t) {
+    function he(e, n, t) {
       if (process.platform !== "win32")
-        return _.spawn(e, o, t);
-      let n = t.env || process.env, r = de(e, n, t.cwd || process.cwd());
+        return _.spawn(e, n, t);
+      let o = t.env || process.env, r = pe(e, o, t.cwd || process.cwd());
       if (r && /\.(?:exe|com)$/i.test(r))
-        return _.spawn(r, o, t);
+        return _.spawn(r, n, t);
       let s = /\.(?:bat|cmd)$/i.test(r || e), i = [H(L.normalize(r || e))];
-      for (let d of o)
-        i.push(H(ue(d), s ? 2 : 1));
+      for (let d of n)
+        i.push(H(de(d), s ? 2 : 1));
       let l = i.join(" ");
-      return _.spawn(P(n, "COMSPEC") || "cmd.exe", ["/d", "/v:off", "/s", "/c", `"${l}"`], { ...t, windowsVerbatimArguments: true });
+      return _.spawn(P(o, "COMSPEC") || "cmd.exe", ["/d", "/v:off", "/s", "/c", `"${l}"`], { ...t, windowsVerbatimArguments: true });
     }
-    W.exports = pe;
+    W.exports = he;
   });
-  var K = S(($e, F) => {
-    var he = __require("fs"), ge = __require("os"), Q = __require("path"), me = __require("child_process"), ve = M(), R = N(), { optionsFromEnv: Ce } = j();
+  var X = j(($e, F) => {
+    var ge = __require("fs"), me = __require("os"), Q = __require("path"), ve = __require("child_process"), Ce = M(), R = N(), { optionsFromEnv: J } = k();
     function D() {
       console.log(["Usage: dotenv run [--help] [-q|--quiet] [--debug] [--override] [--fast] [-f|--file <paths>] [--] <command> [args...]", "", "Run a command with environment variables from a .env file.", "Place dotenv options before the command; all following arguments go to the command.", "", "Options:", "  -f, --file <paths>  .env paths, comma-separated or repeated (default: .env)", "  -q, --quiet suppress the injected env message", "  --debug     enable debug logging", "  --override  override existing environment variables", "  --fast      use the faster character-scanner parser", "", "Environment variables (DOTENV_CONFIG_* names remain as fallbacks):", "  DOTENV_PATH, DOTENV_ENCODING, DOTENV_QUIET,", "  DOTENV_DEBUG, DOTENV_OVERRIDE,", "  DOTENV_FAST"].join(`
 `));
     }
     function we(e) {
-      let o = [], t = false, n, r, s, i, l = -1;
-      for (let p = 0;p < e.length; p++) {
-        let f = e[p];
+      let n = [], t = false, o, r, s, i, l = -1;
+      for (let h = 0;h < e.length; h++) {
+        let f = e[h];
         if (f === "--") {
-          l = p + 1;
+          l = h + 1;
           break;
         }
         if (f === "--help" || f === "-h")
           return { help: true };
         if (f === "--quiet" || f === "-q") {
-          n = true;
+          o = true;
           continue;
         }
         if (f === "--debug") {
@@ -342,51 +345,51 @@ var require_dist = __commonJS(function(exports, module) {
           continue;
         }
         if (f === "-f" || f === "--file" || f.startsWith("-f=") || f.startsWith("--file=")) {
-          let c = f.indexOf("="), a = c === -1 ? f : f.slice(0, c), g = c === -1 ? e[++p] : f.slice(c + 1);
+          let c = f.indexOf("="), a = c === -1 ? f : f.slice(0, c), g = c === -1 ? e[++h] : f.slice(c + 1);
           if (!g || g === "--")
             return { error: `${a} requires a path` };
-          let h = g.split(",").map((y) => y.trim()).filter(Boolean);
-          if (h.length === 0)
+          let p = g.split(",").map((y) => y.trim()).filter(Boolean);
+          if (p.length === 0)
             return { error: `${a} requires a path` };
-          o.push(...h), t = true;
+          n.push(...p), t = true;
           continue;
         }
         if (f.startsWith("-"))
           return { error: `unknown option: ${f}` };
-        l = p;
+        l = h;
         break;
       }
       let d = l === -1 ? [] : e.slice(l);
-      return { paths: o, pathSet: t, quiet: n, debug: r, override: s, fast: i, command: d };
+      return { paths: n, pathSet: t, quiet: o, debug: r, override: s, fast: i, command: d };
     }
     function Ae(e) {
-      return e[0] === "~" ? Q.join(ge.homedir(), e.slice(1)) : e;
+      return e[0] === "~" ? Q.join(me.homedir(), e.slice(1)) : e;
     }
     function Ee(e) {
-      let o = Ce(), t = { encoding: o.encoding || "utf8", quiet: o.quiet === true, debug: o.debug === true, override: o.override === true, fast: o.fast === true, paths: [".env"], defaultPath: true };
-      return o.path != null && (t.paths = [o.path], t.defaultPath = false), e.pathSet && (t.paths = e.paths, t.defaultPath = false), e.quiet != null && (t.quiet = e.quiet), e.debug != null && (t.debug = e.debug), e.override != null && (t.override = e.override), e.fast != null && (t.fast = e.fast), t;
+      let n = J(), t = { encoding: n.encoding || "utf8", quiet: n.quiet, debug: n.debug === true, override: n.override === true, fast: n.fast === true, paths: [".env"], defaultPath: true };
+      return n.path != null && (t.paths = [n.path], t.defaultPath = false), e.pathSet && (t.paths = e.paths, t.defaultPath = false), e.quiet != null && (t.quiet = e.quiet), e.debug != null && (t.debug = e.debug), e.override != null && (t.override = e.override), e.fast != null && (t.fast = e.fast), t;
     }
     function be(e) {
-      let o = {}, t = [], n = { override: e.override, debug: e.debug };
+      let n = {}, t = [], o = { override: e.override, debug: e.debug };
       for (let s of e.paths) {
         let i = Q.resolve(process.cwd(), Ae(s));
         try {
-          let l = R.parse(he.readFileSync(i, { encoding: e.encoding }), { fast: e.fast });
-          R.populate(o, l, n), t.push(s);
+          let l = R.parse(ge.readFileSync(i, { encoding: e.encoding }), { fast: e.fast });
+          R.populate(n, l, o), t.push(s);
         } catch (l) {
           if (e.debug && console.log(`\u2506 failed to load ${s} ${l.message}`), !(e.defaultPath && l.code === "ENOENT"))
             throw l;
         }
       }
-      return { injected: R.populate(process.env, o, n), loadedPaths: t };
+      return { injected: R.populate(process.env, n, o), loadedPaths: t };
     }
-    function J(e) {
-      let o = e[0];
-      if (o === "--help" || o === "-h") {
+    function K(e) {
+      let n = e[0];
+      if (n === "--help" || n === "-h") {
         D();
         return;
       }
-      if (o !== "run") {
+      if (n !== "run") {
         D(), process.exitCode = 1;
         return;
       }
@@ -403,22 +406,22 @@ var require_dist = __commonJS(function(exports, module) {
         D(), process.exitCode = 1;
         return;
       }
-      let n = Ee(t);
+      let o = Ee(t);
       try {
-        let c = be(n);
-        if (!n.quiet) {
-          let a = `\u25C7 injected env (${Object.keys(c.injected).length})`;
-          c.loadedPaths.length > 0 && (a += ` from ${c.loadedPaths.join(", ")}`), console.error(a);
+        let c = be(o);
+        if (!(o.quiet == null ? J().quiet : o.quiet)) {
+          let g = `\u25C7 injected env (${Object.keys(c.injected).length})`;
+          c.loadedPaths.length > 0 && (g += ` from ${c.loadedPaths.join(", ")}`), console.error(g);
         }
       } catch (c) {
         console.error(`dotenv: ${c.message}`), process.exitCode = 1;
         return;
       }
-      let r = !!process.stdin.isTTY, s = process.platform !== "win32" && !r, i = ve(t.command[0], t.command.slice(1), { stdio: "inherit", detached: s }), l = new Map, d = 0;
-      function p(c) {
+      let r = !!process.stdin.isTTY, s = process.platform !== "win32" && !r, i = Ce(t.command[0], t.command.slice(1), { stdio: "inherit", detached: s }), l = new Map, d = 0;
+      function h(c) {
         if (!(!i.pid || i.exitCode !== null || i.signalCode !== null)) {
           if (process.platform === "win32") {
-            me.spawnSync("taskkill", ["/pid", String(i.pid), "/T", "/F"], { stdio: "ignore" });
+            ve.spawnSync("taskkill", ["/pid", String(i.pid), "/T", "/F"], { stdio: "ignore" });
             return;
           }
           try {
@@ -439,11 +442,11 @@ var require_dist = __commonJS(function(exports, module) {
             if (d++, r && process.platform !== "win32" && d === 1)
               return;
             if (d > 1) {
-              p(d === 2 ? "SIGTERM" : "SIGKILL");
+              h(d === 2 ? "SIGTERM" : "SIGKILL");
               return;
             }
           }
-          p(c);
+          h(c);
         };
         l.set(c, a), process.on(c, a);
       }
@@ -453,16 +456,16 @@ var require_dist = __commonJS(function(exports, module) {
         f(), typeof c == "number" ? process.exit(c) : (setInterval(() => {}, 1000), process.kill(process.pid, a));
       });
     }
-    F.exports = J;
-    F === __require.main && J(process.argv.slice(2));
+    F.exports = K;
+    F === __require.main && K(process.argv.slice(2));
   });
-  var I = N();
-  var Oe = K();
-  module.exports = I;
-  module.exports.config = I.config;
-  module.exports.configDotenv = I.configDotenv;
-  module.exports.parse = I.parse;
-  module.exports.populate = I.populate;
+  var S = N();
+  var qe = X();
+  module.exports = S;
+  module.exports.config = S.config;
+  module.exports.configDotenv = S.configDotenv;
+  module.exports.parse = S.parse;
+  module.exports.populate = S.populate;
 });
 
 // src/load-env.ts
@@ -509,7 +512,7 @@ var createPkcePair = () => {
     verifier
   };
 };
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/util.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/util.js
 function getEnumValues(entries) {
   const numericValues = Object.values(entries).filter((v) => typeof v === "number");
   const values = Object.entries(entries).filter(([k, _]) => numericValues.indexOf(+k) === -1).map(([_, v]) => v);
@@ -855,6 +858,18 @@ function prefixIssues(path, issues) {
 function unwrapMessage(message) {
   return typeof message === "string" ? message : message?.message;
 }
+function sizeCaps(defChecks) {
+  const caps = [];
+  for (const ch of defChecks ?? []) {
+    const d = ch._zod.def;
+    if (!/_(length|size)$|_equals$/.test(d.check))
+      break;
+    const max = d.maximum ?? d.length ?? d.size;
+    if (max >= 0)
+      caps.push([max, ch]);
+  }
+  return caps;
+}
 function attachSchema(issues, start, inst) {
   var _a;
   for (let i = start;i < issues.length; i++) {
@@ -1052,7 +1067,7 @@ function constantCatch(value) {
   return fn;
 }
 
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/core.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/core.js
 var _a;
 var _zodDesc = { value: undefined, enumerable: false };
 var _E = "captureStackTrace" in Error ? Error : null;
@@ -1170,7 +1185,7 @@ function config2(newConfig) {
     Object.assign(globalConfig, newConfig);
   return globalConfig;
 }
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/errors.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/errors.js
 function _getMessage() {
   const internals = this._zod;
   internals.message ?? (internals.message = JSON.stringify(internals.def, jsonStringifyReplacer, 2));
@@ -1285,7 +1300,7 @@ function formatError(error, mapper = (issue) => issue.message) {
   return fieldErrors;
 }
 
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/parse.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/parse.js
 function finalizeParams(callee, params) {
   return { callee: params?.callee ?? callee, Err: params?.Err };
 }
@@ -1432,7 +1447,7 @@ var _safeEncodeAsync = (_Err) => async (schema, value, _ctx) => {
 var _safeDecodeAsync = (_Err) => async (schema, value, _ctx) => {
   return _safeParseAsync(_Err)(schema, value, _ctx);
 };
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/regexes.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/regexes.js
 var cuid = /^[cC][0-9a-z]{6,}$/;
 var cuid2 = /^[0-9a-z]+$/;
 var ulid = /^[0-7][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{25}$/;
@@ -1490,7 +1505,7 @@ var _null = /^null$/i;
 var lowercase = /^[^A-Z]*$/;
 var uppercase = /^[^a-z]*$/;
 
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/checks.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/checks.js
 var $ZodCheck = /* @__PURE__ */ $constructor("$ZodCheck", (inst, def) => {
   var _a;
   inst._zod ?? (inst._zod = {});
@@ -1806,7 +1821,7 @@ var $ZodCheckOverwrite = /* @__PURE__ */ $constructor("$ZodCheckOverwrite", (ins
   };
 });
 
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/doc.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/doc.js
 class Doc {
   constructor(args = [], closed = {}) {
     this.content = [];
@@ -1848,14 +1863,14 @@ ${content.join(`
   }
 }
 
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/versions.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/versions.js
 var version = {
   major: 4,
   minor: 6,
-  patch: 5
+  patch: 7
 };
 
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/schemas.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/schemas.js
 var $ZodType = /* @__PURE__ */ $constructor("$ZodType", (inst, def) => {
   var _a;
   inst ?? (inst = {});
@@ -2421,6 +2436,29 @@ var $ZodNever = /* @__PURE__ */ $constructor("$ZodNever", (inst, def) => {
     return payload;
   };
 });
+function capSize(inst, size) {
+  const caps = sizeCaps(inst._zod.def.checks);
+  if (!caps.length)
+    return;
+  const cap = Math.min(...caps.map((c) => c[0]));
+  const parse = inst._zod.parse;
+  inst._zod.parse = (payload, ctx) => {
+    const n = size(payload.value);
+    if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+      for (const [max, ch] of sizeCaps(inst._zod.def.checks)) {
+        if (n > max && ch._zod.def.when(payload)) {
+          const start = payload.issues.length;
+          ch._zod.check(payload);
+          payload.issues[start].continue = false;
+          attachSchema(payload.issues, start, inst);
+          return payload;
+        }
+      }
+    }
+    return parse(payload, ctx);
+  };
+}
+var arraySize = (input) => Array.isArray(input) ? input.length : -1;
 function handleArrayResult(result, final, index) {
   if (result.issues.length) {
     final.issues.push(...prefixIssues(index, result.issues));
@@ -2464,6 +2502,7 @@ var $ZodArray = /* @__PURE__ */ $constructor("$ZodArray", (inst, def) => {
     }
     return payload;
   };
+  capSize(inst, arraySize);
 });
 function handlePropertyResult(result, final, key, input, optin, optout) {
   const isPresent = key in input;
@@ -3246,7 +3285,7 @@ function handleRefineResult(result, payload, input, inst) {
     payload.issues.push(issue(_iss));
   }
 }
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/memoizer.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/memoizer.js
 class $ZodCyclicError extends Error {
   constructor() {
     super(`Cannot parse a reference cycle that closes through a transform`);
@@ -3515,7 +3554,7 @@ function isBackEdge(ctx, value) {
   const backEdges = ctx[STATE]?.backEdges;
   return backEdges !== undefined && isRef(value) && backEdges.has(value);
 }
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/locales/en.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/locales/en.js
 var error = () => {
   const Sizable = {
     string: { unit: "characters", verb: "to have" },
@@ -3637,7 +3676,7 @@ function en_default() {
     localeError: error()
   };
 }
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/registries.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/registries.js
 var _a2;
 class $ZodRegistry {
   constructor() {
@@ -3684,7 +3723,7 @@ function registry() {
 }
 (_a2 = globalThis).__zod_globalRegistry ?? (_a2.__zod_globalRegistry = registry());
 var globalRegistry = globalThis.__zod_globalRegistry;
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/api.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/api.js
 function snapshotChecks(def) {
   if (def.checks)
     def.checks = [...def.checks];
@@ -4138,7 +4177,7 @@ function _check(fn, params) {
   ch._zod.check = fn;
   return ch;
 }
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/to-json-schema.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/to-json-schema.js
 function assignProps(target, ...sources) {
   for (const source of sources) {
     for (const key of Reflect.ownKeys(source)) {
@@ -4661,7 +4700,7 @@ var createStandardJSONSchemaMethod = (schema, io, processors = {}) => (params) =
   extractDefs(ctx, schema);
   return finalize(ctx, schema);
 };
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/json-schema-processors.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/json-schema-processors.js
 var narrowMin = (agg, key, value) => {
   if (agg[key] === undefined || value > agg[key])
     agg[key] = value;
@@ -5090,7 +5129,7 @@ var optionalProcessor = (schema, ctx, _json, params) => {
   const seen = ctx.seen.get(schema);
   seen.ref = def.innerType;
 };
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/classic/errors.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/classic/errors.js
 var _installedErrorProtos = /* @__PURE__ */ new WeakSet([Object.prototype, Error.prototype]);
 function _lazyMethod(proto, key, make) {
   Object.defineProperty(proto, key, {
@@ -5135,7 +5174,7 @@ var ZodRealError = /* @__PURE__ */ $constructor("ZodError", initializer2, undefi
   Parent: Error
 });
 
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/classic/parse.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/classic/parse.js
 var parse2 = /* @__PURE__ */ _parse(ZodRealError);
 var parseAsync = /* @__PURE__ */ _parseAsync(ZodRealError);
 var safeParse = /* @__PURE__ */ _safeParse(ZodRealError);
@@ -5149,7 +5188,7 @@ var safeDecode = /* @__PURE__ */ _safeDecode(ZodRealError);
 var safeEncodeAsync = /* @__PURE__ */ _safeEncodeAsync(ZodRealError);
 var safeDecodeAsync = /* @__PURE__ */ _safeDecodeAsync(ZodRealError);
 
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/classic/schemas.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/classic/schemas.js
 function _ensureDefaultLocale() {
   if (!globalConfig.localeError)
     config2(en_default());
@@ -6822,10 +6861,15 @@ Usage:
   et event appearance upload --event-id <id> --file <path> --media-type <image|video> --content-type <mime>
   et event photo-wall display-items --event-id <id> [--limit <n>] [--cursor <json>] [--retained-ids <json>]
   et lucky-draw pre-draw --event-id <id> --prize-count <n>
+  et lucky-draw participants replace --event-id <id> (--participants <json-array> | --participants-file <path>) --allow-state-change --target <same-event-id>
+  et lucky-draw participants list --event-id <id> [--page <n>] [--per-page <n>]
 
 Lucky draw:
   pre-draw immediately saves winners for the next unassigned prizes in order.
   Uses the live draw random selection and participant filters in the backend.
+  participants replace replaces the imported source roster; it is not an append.
+  It requires --allow-state-change and --target exactly equal to --event-id.
+  participants list defaults to page 1 with 100 results per page; inspect every page.
 
 Global options:
   --api-url <url>           Override EVENT_TECH_API_URL.
@@ -7027,6 +7071,50 @@ var parseRetainedIds = (value) => {
   }
   return parsed;
 };
+var luckyDrawParticipantFields = new Set(["email", "luckyDrawId", "name"]);
+var parseLuckyDrawParticipants = (value) => {
+  let parsed;
+  try {
+    parsed = JSON.parse(value);
+  } catch {
+    throw new CliUsageError("--participants must be valid JSON.");
+  }
+  if (!Array.isArray(parsed)) {
+    throw new CliUsageError("--participants must be a JSON array.");
+  }
+  return parsed.map((participant, index) => {
+    if (typeof participant !== "object" || participant === null || Array.isArray(participant)) {
+      throw new CliUsageError(`--participants[${index}] must be an object.`);
+    }
+    if (Object.keys(participant).some((key) => !luckyDrawParticipantFields.has(key))) {
+      throw new CliUsageError(`--participants[${index}] contains an unsupported field.`);
+    }
+    const luckyDrawId = "luckyDrawId" in participant ? participant.luckyDrawId : undefined;
+    const name = "name" in participant ? participant.name : undefined;
+    const email = "email" in participant ? participant.email : undefined;
+    if (typeof luckyDrawId !== "string") {
+      throw new CliUsageError(`--participants[${index}].luckyDrawId must be a string.`);
+    }
+    if (name !== undefined && typeof name !== "string") {
+      throw new CliUsageError(`--participants[${index}].name must be a string.`);
+    }
+    if (email !== undefined && email !== null && typeof email !== "string") {
+      throw new CliUsageError(`--participants[${index}].email must be a string or null.`);
+    }
+    return {
+      luckyDrawId,
+      ...name === undefined ? {} : { name },
+      ...email === undefined ? {} : { email }
+    };
+  });
+};
+var readParticipantsFile = async (path) => {
+  try {
+    return await readFile2(path, "utf8");
+  } catch {
+    throw new CliUsageError("--participants-file could not be read.");
+  }
+};
 var parseAppearanceMediaType = (value) => {
   if (value === "image" || value === "video")
     return value;
@@ -7261,6 +7349,47 @@ Waiting for approval\u2026
     writeSuccess(runtime, await api2.event.luckyDraw.preDrawPrizes.mutate(input));
     return;
   }
+  if (group === "lucky-draw" && action === "participants" && subAction === "replace") {
+    assertPositionalCount(parsed, 3);
+    assertOnlyFlags(parsed, [
+      "event-id",
+      "participants",
+      "participants-file",
+      "allow-state-change",
+      "target"
+    ]);
+    if (parsed.flags.get("allow-state-change") !== true) {
+      throw new CliUsageError("--allow-state-change is required as an explicit acknowledgement.");
+    }
+    const eventId = getRequiredFlag(parsed, "event-id");
+    if (getRequiredFlag(parsed, "target") !== eventId) {
+      throw new CliUsageError("--target must exactly match --event-id.");
+    }
+    const participantsValue = getOptionalFlag(parsed, "participants");
+    const participantsFile = getOptionalFlag(parsed, "participants-file");
+    if (participantsValue === undefined === (participantsFile === undefined)) {
+      throw new CliUsageError("Provide exactly one of --participants or --participants-file.");
+    }
+    const input = {
+      eventId,
+      participants: parseLuckyDrawParticipants(participantsValue ?? await readParticipantsFile(getRequiredFlag(parsed, "participants-file")))
+    };
+    await ensureAuthentication();
+    writeSuccess(runtime, await api2.event.luckyDraw.createLuckyDrawParticipant.mutate(input));
+    return;
+  }
+  if (group === "lucky-draw" && action === "participants" && subAction === "list") {
+    assertPositionalCount(parsed, 3);
+    assertOnlyFlags(parsed, ["event-id", "page", "per-page"]);
+    const input = {
+      eventId: getRequiredFlag(parsed, "event-id"),
+      page: parsePositiveInteger(getOptionalFlag(parsed, "page") ?? "1", "page"),
+      perPage: parseBoundedInteger(getOptionalFlag(parsed, "per-page") ?? "100", "per-page", 1, 100)
+    };
+    await ensureAuthentication();
+    writeSuccess(runtime, await api2.event.luckyDraw.getLuckyDrawParticipantsByEventId.query(input));
+    return;
+  }
   throw new CliUsageError("Unknown command. Run `et --help` for available commands.");
 };
 var runCli = async (args, runtime = processRuntime, credentialStore = createBunCredentialStore({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@go-labs-sg/event-tech",
-  "version": "0.12.0",
+  "version": "1.1.0",
   "description": "Event Tech CLI for managing Event Tech resources through the Go Labs API.",
   "type": "module",
   "main": "./dist/index.js",
@@ -17,7 +17,7 @@
   ],
   "dependencies": {
     "@trpc/client": "^11.19.0",
-    "dotenv": "^18.0.6",
+    "dotenv": "^18.0.8",
     "superjson": "^2.2.6"
   },
   "engines": {