@go-labs-sg/event-tech 1.0.0 → 1.2.0

package/README.md

@@ -99,6 +99,68 @@ et lucky-draw participants list --event-id <id> --page 1 --per-page 100
 
 Commands emit deterministic JSON envelopes. Authentication credentials are never included in successful output, and bearer credentials are redacted from errors.
 
+### Event Passport
+
+`et passport` uses the same typed procedures and event permissions as the web app.
+Read `et --help` for all commands. Examples below use illustrative IDs and are not
+an instruction to change a live event:
+
+```sh
+et passport overview --event-id <id>
+et passport login-options --event-id <id>
+et passport mine --event-id <id>
+et passport station upsert --event-id <id> --station-json '{"name":"Balance trail","collection":{"collectionMode":"STAFF_SCORE","maxPoints":20}}'
+et passport station print-get --event-id <id> --station-id <id>
+et passport station print-issue --event-id <id> --station-id <id> --expected-printed-qr-version <last-read-version>
+et passport station print-revoke --event-id <id> --station-id <id> --expected-printed-qr-version <last-read-version> --allow-state-change --target <same-event-id>
+et passport collect --event-id <id> --station-id <id> --profile-code <participant-code> --points 15
+et passport claim --event-id <id> --code <station-code>
+et passport participant detail --event-id <id> --participant-id <id>
+et passport export --event-id <id>
+```
+
+Station collection modes are `SELF_SCAN`, `STAFF_SCAN` and `STAFF_SCORE`.
+`SELF_SCAN` uses a reusable printable QR; `STAFF_SCAN` is stamp-only; only
+`STAFF_SCORE` accepts `collection.maxPoints` and a collection `--points` value.
+Zero is valid. Repeat collection returns the original receipt without changing
+points. Omit `collection` on an existing station edit to preserve its current
+mode, including the legacy rotating-QR mode. Issuing/revoking printed codes uses
+the last observed version to reject stale writes. Issue/rotation requires setup
+permission; any event Operator can collect at any station.
+
+`settings update --settings-json <json>` replaces the reward settings, so read
+and copy the existing link, thresholds and redemption cap rather than clearing
+them accidentally. Its JSON requires `linkedDrawEventId`,
+`luckyDrawStampThreshold`, `prizeStampThreshold` and
+`maxRedemptionsPerParticipant`; optional `loginMethods` is
+`{"emailOtp":true,"google":false,"guest":true}`. Omit `loginMethods` to preserve
+it. At least email OTP or Google must remain enabled for recovery, and enabling
+Google requires configured provider credentials. Points never replace the
+existing stamp-based reward thresholds.
+
+`stamp correct`, `redemption reverse`, station/prize archive and print revocation
+require `--allow-state-change --target <same-event-id>`; correction/reversal also
+require a reason. Scored corrections accept `--points` and preserve historical
+scores on revocation. Prize setup and redemption commands remain in `et --help`.
+Participant reads/exports include points and nullable guest contact emails; do
+not treat a null contact as an account lookup key.
+
+Guest enrollment/account linking is browser-only: it requires the original guest
+cookie and verified email/Google authentication. `mine` can read only the passport
+owned by the current CLI identity; it cannot recover a guest by name or assume a
+participant ID. No CLI auth transport or organiser access boundary is bypassed.
+See the [Passport workflow and rollout gates](../../../docs/design/event-tech-passport-event-type.md).
+
+### Deprecated event types
+
+Scavenger Hunt (Amazing Race) and Gardens by the Bay are deprecated and frozen.
+Existing `event list`, `event get` and appearance commands retain their contracts
+and can still return historical `SCAVENGER_HUNT` / `GARDENS_BY_THE_BAY` values.
+The CLI has no event-create, duplicate, type-change or scavenger-specific commands;
+no replacement commands or scavenger read-shape parity will be added. The server
+blocks new creation, duplication and changes into these types, including requests
+from older/custom clients. See the [retirement policy](../../../docs/agents/event-tech-deprecated-scavenger.md).
+
 ### Event appearance and Photo Wall display
 
 `event appearance get` returns the canonical appearance, its optimistic-lock

package/dist/index.js

@@ -35,16 +35,16 @@ var __toESM = (mod, isNodeMode, target) => {
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
 var __require = import.meta.require;
 
-// ../../../node_modules/.bun/dotenv@18.0.7/node_modules/dotenv/dist/index.cjs
+// ../../../node_modules/.bun/dotenv@18.0.8/node_modules/dotenv/dist/index.cjs
 var require_dist = __commonJS(function(exports, module) {
-  var k = (e, n) => () => {
+  var j = (e, n) => () => {
     try {
       return n || e((n = { exports: {} }).exports, n), n.exports;
     } catch (t) {
       throw n = 0, t;
     }
   };
-  var I = k((xe, U) => {
+  var k = j((xe, U) => {
     function G(e) {
       return typeof e == "string" ? !["false", "0", "no", "off", ""].includes(e.toLowerCase()) : !!e;
     }
@@ -58,8 +58,8 @@ var require_dist = __commonJS(function(exports, module) {
     }
     U.exports = { parseBoolean: G, optionsFromEnv: Y };
   });
-  var N = k((ye, x) => {
-    var z = __require("fs"), S = __require("path"), Z = __require("os"), { URL: ee, fileURLToPath: te } = __require("url"), { parseBoolean: $, optionsFromEnv: B } = I(), re = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"])*"|\s*`(?:\\`|[^`])*`|[^#\r\n]+)?\s*(?:#.*)?(?:$|$)/mg, b = new Uint8Array(256);
+  var N = j((ye, x) => {
+    var z = __require("fs"), I = __require("path"), Z = __require("os"), { URL: ee, fileURLToPath: te } = __require("url"), { parseBoolean: $, optionsFromEnv: B } = k(), re = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"])*"|\s*`(?:\\`|[^`])*`|[^#\r\n]+)?\s*(?:#.*)?(?:$|$)/mg, b = new Uint8Array(256);
     for (let e = 48;e <= 57; e++)
       b[e] = 1;
     for (let e = 65;e <= 90; e++)
@@ -124,7 +124,7 @@ var require_dist = __commonJS(function(exports, module) {
             r++;
           continue;
         }
-        let p = t.slice(l, r), f = r;
+        let h = t.slice(l, r), f = r;
         if (r >= o && (d = 0), w(d))
           do
             r++, d = r < o ? t.charCodeAt(r) : 0;
@@ -141,8 +141,8 @@ var require_dist = __commonJS(function(exports, module) {
         let c = r, a = r;
         for (;a < o && w(t.charCodeAt(a)); )
           a++;
-        let h = t.charCodeAt(a), g, y = false;
-        if (h === 39 || h === 34 || h === 96) {
+        let g = t.charCodeAt(a), p, y = false;
+        if (g === 39 || g === 34 || g === 96) {
           let v = t[a], u = t.indexOf(v, a + 1), m = -1, C = -1;
           for (;u !== -1; ) {
             let O = t.charCodeAt(u - 1) === 92, E = u + 1;
@@ -153,7 +153,7 @@ var require_dist = __commonJS(function(exports, module) {
             u = t.indexOf(v, u + 1);
           }
           if (m !== -1) {
-            if (g = t.slice(a + 1, m), r = C, t.charCodeAt(r) === 35)
+            if (p = t.slice(a + 1, m), r = C, t.charCodeAt(r) === 35)
               for (;r < o && !q(t.charCodeAt(r)); )
                 r++;
             y = true;
@@ -175,12 +175,12 @@ var require_dist = __commonJS(function(exports, module) {
           for (;C > m && w(t.charCodeAt(C - 1)); )
             C--;
           let O = t.charCodeAt(m);
-          if (C - m >= 2 && (O === 39 || O === 34 || O === 96) && t.charCodeAt(C - 1) === O ? g = t.slice(m + 1, C - 1) : g = t.slice(m, C), r = u, u < v)
+          if (p = t.slice(m, C), p.includes("\u2028") || p.includes("\u2029") ? p = p.replace(/^(['"`])([\s\S]*)\1$/mg, "$2") : C - m >= 2 && (O === 39 || O === 34 || O === 96) && t.charCodeAt(C - 1) === O && (p = t.slice(m + 1, C - 1)), r = u, u < v)
             for (;r < o && !q(t.charCodeAt(r)); )
               r++;
         }
-        h === 34 && (y || a < r) && g.indexOf("\\") !== -1 && (g = g.replace(/\\n/g, `
-`).replace(/\\r/g, "\r")), n[p] = g;
+        g === 34 && (y || a < r) && p.indexOf("\\") !== -1 && (p = p.replace(/\\n/g, `
+`).replace(/\\r/g, "\r")), n[h] = p;
       }
       return n;
     }
@@ -194,7 +194,7 @@ var require_dist = __commonJS(function(exports, module) {
       console.error(`\u25C7 ${e}`);
     }
     function V(e) {
-      return e[0] === "~" ? S.join(Z.homedir(), e.slice(1)) : e;
+      return e[0] === "~" ? I.join(Z.homedir(), e.slice(1)) : e;
     }
     function ce(e = {}) {
       let n = { ...e };
@@ -204,7 +204,7 @@ var require_dist = __commonJS(function(exports, module) {
     }
     function ae(e) {
       e = ce(e);
-      let n = S.resolve(process.cwd(), ".env"), t = "utf8", o = process.env;
+      let n = I.resolve(process.cwd(), ".env"), t = "utf8", o = process.env;
       e && e.processEnv != null && (o = e.processEnv);
       let r = $(e && e.debug);
       e && e.encoding ? t = e.encoding : r && T("no encoding is specified (UTF-8 is used by default)");
@@ -225,15 +225,15 @@ var require_dist = __commonJS(function(exports, module) {
         } catch (a) {
           r && T(`failed to load ${c} ${a.message}`), i = a;
         }
-      let p = A.populate(o, l, e), f = $(Object.prototype.hasOwnProperty.call(e, "quiet") ? e.quiet : B(o).quiet);
+      let h = A.populate(o, l, e), f = $(Object.prototype.hasOwnProperty.call(e, "quiet") ? e.quiet : B(o).quiet);
       if (r || !f) {
-        let c = Object.keys(p).length, a = [];
-        for (let h of s)
+        let c = Object.keys(h).length, a = [];
+        for (let g of s)
           try {
-            let g = S.relative(process.cwd(), h instanceof ee ? te(h) : h);
-            a.push(g);
-          } catch (g) {
-            r && T(`failed to load ${h} ${g.message}`), i = g;
+            let p = I.relative(process.cwd(), g instanceof ee ? te(g) : g);
+            a.push(p);
+          } catch (p) {
+            r && T(`failed to load ${g} ${p.message}`), i = p;
           }
         ie(`injected env (${c}) from ${a.join(",")}`);
       }
@@ -259,7 +259,7 @@ var require_dist = __commonJS(function(exports, module) {
     x.exports.populate = A.populate;
     x.exports = A;
   });
-  var M = k((Te, W) => {
+  var M = j((Te, W) => {
     var _ = __require("child_process"), ue = __require("fs"), L = __require("path");
     function de(e) {
       let n = ['"'], t = 0;
@@ -291,10 +291,10 @@ var require_dist = __commonJS(function(exports, module) {
       let o = (P(n, "PATHEXT") || ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean), s = o.some((l) => e.toLowerCase().endsWith(l.toLowerCase())) ? ["", ...o] : [...o, ""], i = /[\\/]/.test(e) ? [t] : [t, ...(P(n, "PATH") || "").split(";")];
       for (let l of i)
         for (let d of s) {
-          let p = L.resolve(t, l.replace(/^"|"$/g, ""), e + d);
+          let h = L.resolve(t, l.replace(/^"|"$/g, ""), e + d);
           try {
-            if (ue.statSync(p).isFile())
-              return p;
+            if (ue.statSync(h).isFile())
+              return h;
           } catch {}
         }
     }
@@ -312,18 +312,18 @@ var require_dist = __commonJS(function(exports, module) {
     }
     W.exports = he;
   });
-  var X = k(($e, F) => {
-    var ge = __require("fs"), me = __require("os"), Q = __require("path"), ve = __require("child_process"), Ce = M(), R = N(), { optionsFromEnv: J } = I();
+  var X = j(($e, F) => {
+    var ge = __require("fs"), me = __require("os"), Q = __require("path"), ve = __require("child_process"), Ce = M(), R = N(), { optionsFromEnv: J } = k();
     function D() {
       console.log(["Usage: dotenv run [--help] [-q|--quiet] [--debug] [--override] [--fast] [-f|--file <paths>] [--] <command> [args...]", "", "Run a command with environment variables from a .env file.", "Place dotenv options before the command; all following arguments go to the command.", "", "Options:", "  -f, --file <paths>  .env paths, comma-separated or repeated (default: .env)", "  -q, --quiet suppress the injected env message", "  --debug     enable debug logging", "  --override  override existing environment variables", "  --fast      use the faster character-scanner parser", "", "Environment variables (DOTENV_CONFIG_* names remain as fallbacks):", "  DOTENV_PATH, DOTENV_ENCODING, DOTENV_QUIET,", "  DOTENV_DEBUG, DOTENV_OVERRIDE,", "  DOTENV_FAST"].join(`
 `));
     }
     function we(e) {
       let n = [], t = false, o, r, s, i, l = -1;
-      for (let p = 0;p < e.length; p++) {
-        let f = e[p];
+      for (let h = 0;h < e.length; h++) {
+        let f = e[h];
         if (f === "--") {
-          l = p + 1;
+          l = h + 1;
           break;
         }
         if (f === "--help" || f === "-h")
@@ -345,18 +345,18 @@ var require_dist = __commonJS(function(exports, module) {
           continue;
         }
         if (f === "-f" || f === "--file" || f.startsWith("-f=") || f.startsWith("--file=")) {
-          let c = f.indexOf("="), a = c === -1 ? f : f.slice(0, c), h = c === -1 ? e[++p] : f.slice(c + 1);
-          if (!h || h === "--")
+          let c = f.indexOf("="), a = c === -1 ? f : f.slice(0, c), g = c === -1 ? e[++h] : f.slice(c + 1);
+          if (!g || g === "--")
             return { error: `${a} requires a path` };
-          let g = h.split(",").map((y) => y.trim()).filter(Boolean);
-          if (g.length === 0)
+          let p = g.split(",").map((y) => y.trim()).filter(Boolean);
+          if (p.length === 0)
             return { error: `${a} requires a path` };
-          n.push(...g), t = true;
+          n.push(...p), t = true;
           continue;
         }
         if (f.startsWith("-"))
           return { error: `unknown option: ${f}` };
-        l = p;
+        l = h;
         break;
       }
       let d = l === -1 ? [] : e.slice(l);
@@ -410,15 +410,15 @@ var require_dist = __commonJS(function(exports, module) {
       try {
         let c = be(o);
         if (!(o.quiet == null ? J().quiet : o.quiet)) {
-          let h = `\u25C7 injected env (${Object.keys(c.injected).length})`;
-          c.loadedPaths.length > 0 && (h += ` from ${c.loadedPaths.join(", ")}`), console.error(h);
+          let g = `\u25C7 injected env (${Object.keys(c.injected).length})`;
+          c.loadedPaths.length > 0 && (g += ` from ${c.loadedPaths.join(", ")}`), console.error(g);
         }
       } catch (c) {
         console.error(`dotenv: ${c.message}`), process.exitCode = 1;
         return;
       }
       let r = !!process.stdin.isTTY, s = process.platform !== "win32" && !r, i = Ce(t.command[0], t.command.slice(1), { stdio: "inherit", detached: s }), l = new Map, d = 0;
-      function p(c) {
+      function h(c) {
         if (!(!i.pid || i.exitCode !== null || i.signalCode !== null)) {
           if (process.platform === "win32") {
             ve.spawnSync("taskkill", ["/pid", String(i.pid), "/T", "/F"], { stdio: "ignore" });
@@ -442,11 +442,11 @@ var require_dist = __commonJS(function(exports, module) {
             if (d++, r && process.platform !== "win32" && d === 1)
               return;
             if (d > 1) {
-              p(d === 2 ? "SIGTERM" : "SIGKILL");
+              h(d === 2 ? "SIGTERM" : "SIGKILL");
               return;
             }
           }
-          p(c);
+          h(c);
         };
         l.set(c, a), process.on(c, a);
       }
@@ -459,13 +459,13 @@ var require_dist = __commonJS(function(exports, module) {
     F.exports = K;
     F === __require.main && K(process.argv.slice(2));
   });
-  var j = N();
+  var S = N();
   var qe = X();
-  module.exports = j;
-  module.exports.config = j.config;
-  module.exports.configDotenv = j.configDotenv;
-  module.exports.parse = j.parse;
-  module.exports.populate = j.populate;
+  module.exports = S;
+  module.exports.config = S.config;
+  module.exports.configDotenv = S.configDotenv;
+  module.exports.parse = S.parse;
+  module.exports.populate = S.populate;
 });
 
 // src/load-env.ts
@@ -512,7 +512,7 @@ var createPkcePair = () => {
     verifier
   };
 };
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/util.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/util.js
 function getEnumValues(entries) {
   const numericValues = Object.values(entries).filter((v) => typeof v === "number");
   const values = Object.entries(entries).filter(([k, _]) => numericValues.indexOf(+k) === -1).map(([_, v]) => v);
@@ -858,6 +858,18 @@ function prefixIssues(path, issues) {
 function unwrapMessage(message) {
   return typeof message === "string" ? message : message?.message;
 }
+function sizeCaps(defChecks) {
+  const caps = [];
+  for (const ch of defChecks ?? []) {
+    const d = ch._zod.def;
+    if (!/_(length|size)$|_equals$/.test(d.check))
+      break;
+    const max = d.maximum ?? d.length ?? d.size;
+    if (max >= 0)
+      caps.push([max, ch]);
+  }
+  return caps;
+}
 function attachSchema(issues, start, inst) {
   var _a;
   for (let i = start;i < issues.length; i++) {
@@ -1055,7 +1067,7 @@ function constantCatch(value) {
   return fn;
 }
 
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/core.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/core.js
 var _a;
 var _zodDesc = { value: undefined, enumerable: false };
 var _E = "captureStackTrace" in Error ? Error : null;
@@ -1173,7 +1185,7 @@ function config2(newConfig) {
     Object.assign(globalConfig, newConfig);
   return globalConfig;
 }
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/errors.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/errors.js
 function _getMessage() {
   const internals = this._zod;
   internals.message ?? (internals.message = JSON.stringify(internals.def, jsonStringifyReplacer, 2));
@@ -1288,7 +1300,7 @@ function formatError(error, mapper = (issue) => issue.message) {
   return fieldErrors;
 }
 
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/parse.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/parse.js
 function finalizeParams(callee, params) {
   return { callee: params?.callee ?? callee, Err: params?.Err };
 }
@@ -1435,7 +1447,7 @@ var _safeEncodeAsync = (_Err) => async (schema, value, _ctx) => {
 var _safeDecodeAsync = (_Err) => async (schema, value, _ctx) => {
   return _safeParseAsync(_Err)(schema, value, _ctx);
 };
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/regexes.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/regexes.js
 var cuid = /^[cC][0-9a-z]{6,}$/;
 var cuid2 = /^[0-9a-z]+$/;
 var ulid = /^[0-7][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{25}$/;
@@ -1493,7 +1505,7 @@ var _null = /^null$/i;
 var lowercase = /^[^A-Z]*$/;
 var uppercase = /^[^a-z]*$/;
 
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/checks.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/checks.js
 var $ZodCheck = /* @__PURE__ */ $constructor("$ZodCheck", (inst, def) => {
   var _a;
   inst._zod ?? (inst._zod = {});
@@ -1809,7 +1821,7 @@ var $ZodCheckOverwrite = /* @__PURE__ */ $constructor("$ZodCheckOverwrite", (ins
   };
 });
 
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/doc.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/doc.js
 class Doc {
   constructor(args = [], closed = {}) {
     this.content = [];
@@ -1851,14 +1863,14 @@ ${content.join(`
   }
 }
 
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/versions.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/versions.js
 var version = {
   major: 4,
   minor: 6,
-  patch: 5
+  patch: 7
 };
 
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/schemas.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/schemas.js
 var $ZodType = /* @__PURE__ */ $constructor("$ZodType", (inst, def) => {
   var _a;
   inst ?? (inst = {});
@@ -2424,6 +2436,29 @@ var $ZodNever = /* @__PURE__ */ $constructor("$ZodNever", (inst, def) => {
     return payload;
   };
 });
+function capSize(inst, size) {
+  const caps = sizeCaps(inst._zod.def.checks);
+  if (!caps.length)
+    return;
+  const cap = Math.min(...caps.map((c) => c[0]));
+  const parse = inst._zod.parse;
+  inst._zod.parse = (payload, ctx) => {
+    const n = size(payload.value);
+    if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+      for (const [max, ch] of sizeCaps(inst._zod.def.checks)) {
+        if (n > max && ch._zod.def.when(payload)) {
+          const start = payload.issues.length;
+          ch._zod.check(payload);
+          payload.issues[start].continue = false;
+          attachSchema(payload.issues, start, inst);
+          return payload;
+        }
+      }
+    }
+    return parse(payload, ctx);
+  };
+}
+var arraySize = (input) => Array.isArray(input) ? input.length : -1;
 function handleArrayResult(result, final, index) {
   if (result.issues.length) {
     final.issues.push(...prefixIssues(index, result.issues));
@@ -2467,6 +2502,7 @@ var $ZodArray = /* @__PURE__ */ $constructor("$ZodArray", (inst, def) => {
     }
     return payload;
   };
+  capSize(inst, arraySize);
 });
 function handlePropertyResult(result, final, key, input, optin, optout) {
   const isPresent = key in input;
@@ -3249,7 +3285,7 @@ function handleRefineResult(result, payload, input, inst) {
     payload.issues.push(issue(_iss));
   }
 }
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/memoizer.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/memoizer.js
 class $ZodCyclicError extends Error {
   constructor() {
     super(`Cannot parse a reference cycle that closes through a transform`);
@@ -3518,7 +3554,7 @@ function isBackEdge(ctx, value) {
   const backEdges = ctx[STATE]?.backEdges;
   return backEdges !== undefined && isRef(value) && backEdges.has(value);
 }
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/locales/en.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/locales/en.js
 var error = () => {
   const Sizable = {
     string: { unit: "characters", verb: "to have" },
@@ -3640,7 +3676,7 @@ function en_default() {
     localeError: error()
   };
 }
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/registries.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/registries.js
 var _a2;
 class $ZodRegistry {
   constructor() {
@@ -3687,7 +3723,7 @@ function registry() {
 }
 (_a2 = globalThis).__zod_globalRegistry ?? (_a2.__zod_globalRegistry = registry());
 var globalRegistry = globalThis.__zod_globalRegistry;
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/api.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/api.js
 function snapshotChecks(def) {
   if (def.checks)
     def.checks = [...def.checks];
@@ -4141,7 +4177,7 @@ function _check(fn, params) {
   ch._zod.check = fn;
   return ch;
 }
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/to-json-schema.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/to-json-schema.js
 function assignProps(target, ...sources) {
   for (const source of sources) {
     for (const key of Reflect.ownKeys(source)) {
@@ -4664,7 +4700,7 @@ var createStandardJSONSchemaMethod = (schema, io, processors = {}) => (params) =
   extractDefs(ctx, schema);
   return finalize(ctx, schema);
 };
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/json-schema-processors.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/json-schema-processors.js
 var narrowMin = (agg, key, value) => {
   if (agg[key] === undefined || value > agg[key])
     agg[key] = value;
@@ -5093,7 +5129,7 @@ var optionalProcessor = (schema, ctx, _json, params) => {
   const seen = ctx.seen.get(schema);
   seen.ref = def.innerType;
 };
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/classic/errors.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/classic/errors.js
 var _installedErrorProtos = /* @__PURE__ */ new WeakSet([Object.prototype, Error.prototype]);
 function _lazyMethod(proto, key, make) {
   Object.defineProperty(proto, key, {
@@ -5138,7 +5174,7 @@ var ZodRealError = /* @__PURE__ */ $constructor("ZodError", initializer2, undefi
   Parent: Error
 });
 
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/classic/parse.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/classic/parse.js
 var parse2 = /* @__PURE__ */ _parse(ZodRealError);
 var parseAsync = /* @__PURE__ */ _parseAsync(ZodRealError);
 var safeParse = /* @__PURE__ */ _safeParse(ZodRealError);
@@ -5152,7 +5188,7 @@ var safeDecode = /* @__PURE__ */ _safeDecode(ZodRealError);
 var safeEncodeAsync = /* @__PURE__ */ _safeEncodeAsync(ZodRealError);
 var safeDecodeAsync = /* @__PURE__ */ _safeDecodeAsync(ZodRealError);
 
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/classic/schemas.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/classic/schemas.js
 function _ensureDefaultLocale() {
   if (!globalConfig.localeError)
     config2(en_default());
@@ -6827,6 +6863,45 @@ Usage:
   et lucky-draw pre-draw --event-id <id> --prize-count <n>
   et lucky-draw participants replace --event-id <id> (--participants <json-array> | --participants-file <path>) --allow-state-change --target <same-event-id>
   et lucky-draw participants list --event-id <id> [--page <n>] [--per-page <n>]
+  et passport overview --event-id <id>
+  et passport mine --event-id <id>
+  et passport login-options --event-id <id>
+  et passport export --event-id <id>
+  et passport settings update --event-id <id> --settings-json <json>
+  et passport station upsert --event-id <id> --station-json <json>
+  et passport station hidden --event-id <id> --station-id <id> --hidden <true|false>
+  et passport station archive --event-id <id> --station-id <id> --allow-state-change --target <same-event-id>
+  et passport station print-get --event-id <id> --station-id <id>
+  et passport station print-issue --event-id <id> --station-id <id> --expected-printed-qr-version <n>
+  et passport station print-revoke --event-id <id> --station-id <id> --expected-printed-qr-version <n> --allow-state-change --target <same-event-id>
+  et passport station start-qr --event-id <id> --station-id <id>
+  et passport station qr-status --event-id <id> --session-id <id>
+  et passport collect --event-id <id> --station-id <id> --profile-code <code> [--points <n>]
+  et passport claim --event-id <id> --code <code>
+  et passport participant search --event-id <id> [--query <text>]
+  et passport participant detail --event-id <id> --participant-id <id>
+  et passport stamp correct --event-id <id> --station-id <id> --participant-id <id> --stamped <true|false> --reason <text> [--points <n>] --allow-state-change --target <same-event-id>
+  et passport prize upsert --event-id <id> --prize-json <json>
+  et passport prize archive --event-id <id> --prize-id <id> --allow-state-change --target <same-event-id>
+  et passport redemption create --event-id <id> --participant-id <id> --prize-id <id>
+  et passport redemption reverse --event-id <id> --redemption-id <id> --reason <text> --allow-state-change --target <same-event-id>
+
+Event Passport:
+  Uses the same typed procedures and event permissions as the web app.
+  Station collection modes: SELF_SCAN, STAFF_SCAN, STAFF_SCORE.
+  Include collection.maxPoints only for STAFF_SCORE; zero is a valid score.
+  Omit collection on an existing station to preserve its current mode.
+  Station JSON supports id/name/description/location/imageKey/order/opensAt/closesAt/collection.
+  Date-time fields are ISO strings or null; order defaults to zero.
+  Settings JSON requires linkedDrawEventId, luckyDrawStampThreshold, prizeStampThreshold,
+  maxRedemptionsPerParticipant; optional loginMethods is {emailOtp,google,guest}.
+  Keep email OTP or Google enabled for guest recovery. Omit loginMethods to preserve it.
+  Printed QR issue/revoke requires the last observed print version; stale versions conflict.
+  claim scans a station QR; collect scans a participant profile QR as an event operator.
+  Repeat scans never add a second stamp or change its original points.
+  Destructive corrections, archive, reverse and print revoke require explicit target confirmation.
+  Points are scores only; existing stamp-based Lucky Draw and prize thresholds still apply.
+  Guest enrollment and account-linking require the browser; CLI uses existing device-approved auth.
 
 Lucky draw:
   pre-draw immediately saves winners for the next unassigned prizes in order.
@@ -6897,6 +6972,334 @@ var writeError = (runtime, error) => {
   runtime.stderr.write(serialize({ ok: false, error: { code: errorCode(error), message } }));
 };
 
+// src/commands/passport.ts
+var flag = (flags, name, required = true) => {
+  const value = flags.get(name);
+  if (value === true || required && !value)
+    throw new CliUsageError(`--${name} requires a value.`);
+  return value;
+};
+var requiredFlag = (flags, name) => {
+  const value = flag(flags, name);
+  if (!value)
+    throw new CliUsageError(`--${name} is required.`);
+  return value;
+};
+var integer2 = (value, name, minimum = 0) => {
+  const parsed = typeof value === "string" && value.trim() !== "" ? Number(value) : value;
+  if (typeof parsed !== "number" || !Number.isSafeInteger(parsed) || parsed < minimum || parsed > 2147483647) {
+    throw new CliUsageError(`${name} must be a whole number from ${minimum} to 2147483647.`);
+  }
+  return parsed;
+};
+var boolean3 = (value, name) => {
+  if (value === true || value === "true")
+    return true;
+  if (value === false || value === "false")
+    return false;
+  throw new CliUsageError(`${name} must be true or false.`);
+};
+var text = (value, name, maximum) => {
+  if (typeof value !== "string" || !value.trim() || value.trim().length > maximum)
+    throw new CliUsageError(`${name} must be a non-empty string of at most ${maximum} characters.`);
+  return value.trim();
+};
+var nullableText = (value, name, maximum) => {
+  if (value == null)
+    return null;
+  if (typeof value !== "string" || value.trim().length > maximum)
+    throw new CliUsageError(`${name} must be a string of at most ${maximum} characters or null.`);
+  return value.trim();
+};
+var object2 = (value, name) => {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    throw new CliUsageError(`${name} must be an object.`);
+  return Object.fromEntries(Object.entries(value));
+};
+var json = (value, name) => {
+  try {
+    const parsed = JSON.parse(value);
+    return object2(parsed, name);
+  } catch (error) {
+    if (error instanceof CliUsageError)
+      throw error;
+    throw new CliUsageError(`${name} must be valid JSON.`);
+  }
+};
+var keys = (value, allowed, name) => {
+  if (Object.keys(value).some((key) => !allowed.includes(key)))
+    throw new CliUsageError(`${name} contains unsupported fields.`);
+};
+var date2 = (value, name) => {
+  if (value == null)
+    return null;
+  if (typeof value !== "string" || !/^\d{4}-\d\d-\d\dT/.test(value))
+    throw new CliUsageError(`${name} must be an ISO date-time or null.`);
+  const parsed = new Date(value);
+  if (Number.isNaN(parsed.getTime()))
+    throw new CliUsageError(`${name} must be a valid ISO date-time.`);
+  return parsed;
+};
+var parsePassportStationInput = (raw, eventId) => {
+  const value = json(raw, "--station-json");
+  keys(value, [
+    "id",
+    "name",
+    "description",
+    "location",
+    "imageKey",
+    "order",
+    "opensAt",
+    "closesAt",
+    "collection"
+  ], "Station");
+  let collection;
+  if (value.collection !== undefined) {
+    const item = object2(value.collection, "collection");
+    if (item.collectionMode === "STAFF_SCORE") {
+      keys(item, ["collectionMode", "maxPoints"], "collection");
+      collection = {
+        collectionMode: "STAFF_SCORE",
+        maxPoints: integer2(item.maxPoints, "maxPoints")
+      };
+    } else if (item.collectionMode === "SELF_SCAN" || item.collectionMode === "STAFF_SCAN") {
+      keys(item, ["collectionMode"], "collection");
+      collection = { collectionMode: item.collectionMode };
+    } else
+      throw new CliUsageError("collectionMode must be SELF_SCAN, STAFF_SCAN or STAFF_SCORE.");
+  }
+  return {
+    eventId,
+    ...value.id === undefined ? {} : { id: text(value.id, "id", 200) },
+    name: text(value.name, "name", 100),
+    description: nullableText(value.description, "description", 1000),
+    location: nullableText(value.location, "location", 200),
+    imageKey: nullableText(value.imageKey, "imageKey", 2048),
+    order: integer2(value.order ?? 0, "order"),
+    opensAt: date2(value.opensAt, "opensAt"),
+    closesAt: date2(value.closesAt, "closesAt"),
+    ...collection ? { collection } : {}
+  };
+};
+var parsePassportSettingsInput = (raw, eventId) => {
+  const value = json(raw, "--settings-json");
+  keys(value, [
+    "luckyDrawStampThreshold",
+    "prizeStampThreshold",
+    "maxRedemptionsPerParticipant",
+    "linkedDrawEventId",
+    "loginMethods"
+  ], "Settings");
+  const threshold = (item, name) => item === null ? null : integer2(item, name, 1);
+  let loginMethods;
+  if (value.loginMethods !== undefined) {
+    const methods = object2(value.loginMethods, "loginMethods");
+    keys(methods, ["emailOtp", "google", "guest"], "loginMethods");
+    if (typeof methods.emailOtp !== "boolean" || typeof methods.google !== "boolean" || typeof methods.guest !== "boolean")
+      throw new CliUsageError("loginMethods values must be JSON booleans.");
+    loginMethods = {
+      emailOtp: methods.emailOtp,
+      google: methods.google,
+      guest: methods.guest
+    };
+    if (!loginMethods.emailOtp && !loginMethods.google)
+      throw new CliUsageError("Keep email OTP or Google available for recovery.");
+  }
+  if (value.linkedDrawEventId === undefined)
+    throw new CliUsageError("linkedDrawEventId is required (use null to disable).");
+  return {
+    eventId,
+    luckyDrawStampThreshold: threshold(value.luckyDrawStampThreshold, "luckyDrawStampThreshold"),
+    prizeStampThreshold: threshold(value.prizeStampThreshold, "prizeStampThreshold"),
+    maxRedemptionsPerParticipant: integer2(value.maxRedemptionsPerParticipant, "maxRedemptionsPerParticipant", 1),
+    linkedDrawEventId: value.linkedDrawEventId === null ? null : text(value.linkedDrawEventId, "linkedDrawEventId", 200),
+    ...loginMethods ? { loginMethods } : {}
+  };
+};
+var runPassportCommand = async (input) => {
+  const { flags, positionals } = input;
+  const action = positionals.slice(1).join(" ");
+  const allowed = ["event-id"];
+  const eventId = requiredFlag(flags, "event-id");
+  const event = { eventId };
+  const station = () => ({
+    eventId,
+    stationId: requiredFlag(flags, "station-id")
+  });
+  const version = () => integer2(requiredFlag(flags, "expected-printed-qr-version"), "--expected-printed-qr-version");
+  const confirm = () => {
+    allowed.push("allow-state-change", "target");
+    if (flags.get("allow-state-change") !== true || requiredFlag(flags, "target") !== eventId)
+      throw new CliUsageError("This operation requires --allow-state-change and --target exactly equal to --event-id.");
+  };
+  let operation;
+  switch (action) {
+    case "overview":
+      operation = () => api2.event.passport.getPassportOverview.query(event);
+      break;
+    case "mine":
+      operation = () => api2.event.passport.getMyPassport.query(event);
+      break;
+    case "login-options":
+      operation = () => api2.event.passport.getPassportLoginOptions.query(event);
+      break;
+    case "export":
+      operation = () => api2.event.passport.getPassportExportData.query(event);
+      break;
+    case "settings update": {
+      allowed.push("settings-json");
+      const payload = parsePassportSettingsInput(requiredFlag(flags, "settings-json"), eventId);
+      operation = () => api2.event.passport.updatePassportSettings.mutate(payload);
+      break;
+    }
+    case "station upsert": {
+      allowed.push("station-json");
+      const payload = parsePassportStationInput(requiredFlag(flags, "station-json"), eventId);
+      operation = () => api2.event.passport.upsertPassportStation.mutate(payload);
+      break;
+    }
+    case "station print-get": {
+      allowed.push("station-id");
+      const payload = station();
+      operation = () => api2.event.passport.getStationPrintQr.query(payload);
+      break;
+    }
+    case "station print-issue":
+    case "station print-revoke": {
+      allowed.push("station-id", "expected-printed-qr-version");
+      const payload = { ...station(), expectedPrintedQrVersion: version() };
+      if (action === "station print-revoke")
+        confirm();
+      operation = action === "station print-issue" ? () => api2.event.passport.issueStationPrintQr.mutate(payload) : () => api2.event.passport.revokeStationPrintQr.mutate(payload);
+      break;
+    }
+    case "station archive": {
+      allowed.push("station-id");
+      confirm();
+      const payload = station();
+      operation = () => api2.event.passport.archivePassportStation.mutate(payload);
+      break;
+    }
+    case "station hidden": {
+      allowed.push("station-id", "hidden");
+      const payload = {
+        ...station(),
+        hidden: boolean3(requiredFlag(flags, "hidden"), "--hidden")
+      };
+      operation = () => api2.event.passport.setPassportStationHidden.mutate(payload);
+      break;
+    }
+    case "station start-qr": {
+      allowed.push("station-id");
+      const payload = station();
+      operation = () => api2.event.passport.startStationQr.mutate(payload);
+      break;
+    }
+    case "station qr-status": {
+      allowed.push("session-id");
+      const payload = { eventId, sessionId: requiredFlag(flags, "session-id") };
+      operation = () => api2.event.passport.getStationQrStatus.query(payload);
+      break;
+    }
+    case "collect": {
+      allowed.push("station-id", "profile-code", "points");
+      const points = flag(flags, "points", false);
+      const payload = {
+        ...station(),
+        profileCode: requiredFlag(flags, "profile-code"),
+        ...points === undefined ? {} : { points: integer2(points, "--points") }
+      };
+      operation = () => api2.event.passport.collectPassportStampByStaff.mutate(payload);
+      break;
+    }
+    case "claim": {
+      allowed.push("code");
+      const payload = { eventId, code: requiredFlag(flags, "code") };
+      operation = () => api2.event.passport.claimPassportStamp.mutate(payload);
+      break;
+    }
+    case "stamp correct": {
+      allowed.push("station-id", "participant-id", "stamped", "reason", "points");
+      confirm();
+      const points = flag(flags, "points", false);
+      const payload = {
+        ...station(),
+        participantId: requiredFlag(flags, "participant-id"),
+        stamped: boolean3(requiredFlag(flags, "stamped"), "--stamped"),
+        reason: requiredFlag(flags, "reason"),
+        ...points === undefined ? {} : { points: integer2(points, "--points") }
+      };
+      operation = () => api2.event.passport.correctPassportStamp.mutate(payload);
+      break;
+    }
+    case "participant detail": {
+      allowed.push("participant-id");
+      const payload = {
+        eventId,
+        participantId: requiredFlag(flags, "participant-id")
+      };
+      operation = () => api2.event.passport.getPassportParticipantDetail.query(payload);
+      break;
+    }
+    case "participant search": {
+      allowed.push("query");
+      const payload = { eventId, query: flag(flags, "query", false) ?? "" };
+      operation = () => api2.event.passport.searchPassportParticipants.query(payload);
+      break;
+    }
+    case "prize upsert": {
+      allowed.push("prize-json");
+      const value = json(requiredFlag(flags, "prize-json"), "--prize-json");
+      keys(value, ["id", "name", "description", "stock", "order"], "Prize");
+      const payload = {
+        eventId,
+        ...value.id === undefined ? {} : { id: text(value.id, "id", 200) },
+        name: text(value.name, "name", 100),
+        description: nullableText(value.description, "description", 1000),
+        stock: integer2(value.stock, "stock"),
+        order: integer2(value.order ?? 0, "order")
+      };
+      operation = () => api2.event.passport.upsertPassportPrize.mutate(payload);
+      break;
+    }
+    case "prize archive": {
+      allowed.push("prize-id");
+      confirm();
+      const payload = { eventId, prizeId: requiredFlag(flags, "prize-id") };
+      operation = () => api2.event.passport.archivePassportPrize.mutate(payload);
+      break;
+    }
+    case "redemption create": {
+      allowed.push("prize-id", "participant-id");
+      const payload = {
+        eventId,
+        prizeId: requiredFlag(flags, "prize-id"),
+        participantId: requiredFlag(flags, "participant-id")
+      };
+      operation = () => api2.event.passport.redeemPassportPrize.mutate(payload);
+      break;
+    }
+    case "redemption reverse": {
+      allowed.push("redemption-id", "reason");
+      confirm();
+      const payload = {
+        eventId,
+        redemptionId: requiredFlag(flags, "redemption-id"),
+        reason: requiredFlag(flags, "reason")
+      };
+      operation = () => api2.event.passport.reversePassportRedemption.mutate(payload);
+      break;
+    }
+    default:
+      throw new CliUsageError("Unknown passport command. Run et --help for supported commands.");
+  }
+  const unknown = [...flags.keys()].filter((key) => key !== "api-url" && !allowed.includes(key));
+  if (unknown.length)
+    throw new CliUsageError(`Unknown option(s): ${unknown.map((key) => `--${key}`).join(", ")}.`);
+  await input.authenticate();
+  writeSuccess(input.runtime, await operation());
+};
+
 // src/cli.ts
 var getInstalledCliVersion = () => {
   try {
@@ -7119,6 +7522,15 @@ var runCommand = async (parsed, runtime, credentialStore, apiBaseUrl, configureA
     writeSuccess(runtime, { version: cliVersion });
     return;
   }
+  if (group === "passport") {
+    await runPassportCommand({
+      positionals: parsed.positionals,
+      flags: parsed.flags,
+      runtime,
+      authenticate: ensureAuthentication
+    });
+    return;
+  }
   if (group === "auth" && action === "login" && subAction === undefined) {
     assertPositionalCount(parsed, 2);
     assertOnlyFlags(parsed, ["no-browser"]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@go-labs-sg/event-tech",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "description": "Event Tech CLI for managing Event Tech resources through the Go Labs API.",
   "type": "module",
   "main": "./dist/index.js",
@@ -17,7 +17,7 @@
   ],
   "dependencies": {
     "@trpc/client": "^11.19.0",
-    "dotenv": "^18.0.7",
+    "dotenv": "^18.0.8",
     "superjson": "^2.2.6"
   },
   "engines": {