@go-labs-sg/gosh 1.0.0 → 1.2.0

package/README.md

@@ -65,6 +65,17 @@ Before requesting approval, login verifies write/read/delete capability with a u
 
 See the [shared authentication contract](../../cli-auth/README.md) for recovery and verification limits.
 
+## Realtime watch reconciliation
+
+`gosh player watch` and `gosh submission watch` continue to emit newline-delimited
+JSON. On a v2-enabled server, process-local changes can arrive immediately;
+cross-process changes are reconciled through the existing 15-second resync
+cadence while a watch is active. A player `resync` message or submission
+`resynced: true` message means fetch the current authorized state again, not that
+a complete business-event replay was delivered. Command names, arguments and
+permission checks are unchanged. Browser clients use scoped v2 subscriptions
+instead of this compatibility cadence.
+
 ## Authentication
 
 ```bash
@@ -99,6 +110,53 @@ Commands use `--input '<json>'` for the exact validated tRPC input object. This
 
 The command registry exposes the supported GOSH tRPC procedures across organizer and global-admin operations, organization invitations and membership, player workflows, public results/login procedures, uploads, and realtime subscriptions. Update the registry alongside API changes, then run `bun --filter @go-labs-sg/gosh generate:commands` from the repository root to regenerate the manifest, reference, and typed operations.
 
+### Messages after submitting
+
+`gosh mission create` and `gosh mission update` accept optional `revealMessage`
+plain text (up to 2,000 characters, with line breaks) in `--input`. It is hidden
+from players until their team/player has a submission, regardless of review
+status. Skipping a mission does not reveal it. The player submit response includes
+`revealMessage`, including already-completed submissions; station and map reads
+include it only on submitted missions.
+
+```bash
+gosh mission create \
+  --input '{"stationId":"station-id","name":"Pavilion materials","type":"FILL_IN_THE_BLANK","points":10,"correctAnswer":"grocery bags","revealMessage":"The pavilion is clad with grocery bags.\nNotice how everyday materials are reused."}' \
+  --target station-id \
+  --allow-state-change
+```
+
+For updates, send the existing mission editor fields (including option IDs and
+answer keys) together with `missionId` and `revealMessage`. Omitting
+`revealMessage` preserves it; `"revealMessage":""` clears it. The message is
+display-only and can change during a live event without changing grading or
+saved playthroughs. Templates, station clones and event versions preserve it.
+
+### Multiple accepted text answers
+
+Fill-in-the-blank missions accept the primary `correctAnswer` or any of up to 50
+`acceptedAnswers` (each trimmed, non-empty and at most 200 characters). Case and
+repeated whitespace are ignored; no fuzzy or partial matching is used. Duplicate
+alternatives are removed after normalization. Alternatives require a primary
+answer and cannot be used for other mission types.
+
+```bash
+gosh mission create --input '{"stationId":"station-id","name":"Climbing plants","type":"FILL_IN_THE_BLANK","correctAnswer":"Mesh","acceptedAnswers":["Trellis","Scaffolding"]}'
+gosh mission update --input '{"missionId":"mission-id","name":"Climbing plants","type":"FILL_IN_THE_BLANK","correctAnswer":"Mesh","acceptedAnswers":["Trellis","Frame","Scaffolding"]}'
+```
+
+When updating, omit `acceptedAnswers` to preserve the saved list or pass `[]` to
+clear it. Alternative-answer changes affect future submissions only: stored
+answers and awarded points are never re-graded. Existing restrictions on changing
+the primary answer, mission type and choice options after submissions still apply.
+Templates, station clones and saved event versions preserve alternatives. Answer
+keys are visible to authorized admins/reviewers, never in player mission reads.
+
+Deploy prerequisite: apply the additive GOSH database schema changes for both
+`Mission.acceptedAnswers` and `GoshTemplateMission.acceptedAnswers`, each defaulting
+to `[]`, before deploying the updated server. Older event snapshots restore an
+empty list. Client generation alone does not apply these database changes.
+
 ### Templates and organization scope
 
 Template commands use the selected organization as their scope. Provide its ID in
@@ -183,10 +241,14 @@ value in that template team's `order` field:
 Events default to `OPEN` progression, which keeps the existing open-play flow.
 Sequential progression starts each team or individual on an ordered station
 route. Group routing is available only for `TEAM` play mode. Create teams and
-assign them to routing groups before launching the event; sequential setup
-freezes when play starts. Grouped OPEN events lock only a started team's group
-assignment, a started group's route and the gameplay settings. A group shares its ordered station route, while each team keeps
-independent progress through that route.
+assign them to routing groups before launching the event. Routes, stations
+and missions stay editable after play starts: each edit re-syncs every started
+team's saved progress in the same transaction. Played stations keep their
+progress and order, while unplayed stations follow the new route. An edit that
+would remove the station a team is in the middle of fails with a conflict and
+changes nothing. A started team's group assignment, team creation, play mode
+and progression settings stay locked. A group shares its ordered station route,
+while each team keeps independent progress through that route.
 
 Configure gameplay, then manage the event's routing groups and their complete
 station lists:
@@ -281,7 +343,7 @@ gosh player mission skip \
 ```
 
 Player actions require event enrollment and the configured team submission
-permissions. A skipped mission is irreversible and earns zero points; it resolves only that mission,
+permissions. A player cannot undo a skip: it earns zero points and resolves only that mission,
 preserves points from the station's other submitted missions, and advances the
 route once all station missions are submitted or skipped. The station timer
 runs from check-in/start through the final mission submission or skip. It
@@ -289,6 +351,34 @@ measures mission work only: travel between stations and staff review time are
 excluded. Existing leaderboard and results commands include the resulting
 timing information.
 
+A host with `reviewSubmissions` can reopen one submitted or skipped mission for
+a team (`teamId`) or individual player (`eventPlayerId`) on a fixed-order route
+while the event is live:
+
+```bash
+gosh mission reopen \
+  --input '{"eventId":"event-id","missionId":"mission-1","teamId":"team-1"}' \
+  --target team-1 \
+  --allow-state-change
+```
+
+The earlier submission's points keep counting until the team submits again;
+then only the new submission counts, up or down. Station times and the team's
+finish time are kept, and a finished station accepts the reopened mission
+until it is resolved. Pending submissions must be reviewed first, and a
+reopened mission that still holds earlier points cannot be skipped.
+
+When reviewing, pass the submission's `updatedAt` from the review queue as
+`expectedUpdatedAt`. If the team resubmitted after you read it, the review is
+refused with `CONFLICT` instead of scoring the new answer blind:
+
+```bash
+gosh submission review \
+  --input '{"eventId":"event-id","organizationId":"org-id","submissionId":"submission-1","status":"APPROVED","expectedUpdatedAt":"2026-10-14T07:00:00.000Z"}' \
+  --target submission-1 \
+  --allow-state-change
+```
+
 ### Artwork requirements (no login required)
 
 Read the bundled upload policy before preparing station, mission, or branding artwork:

package/command-manifest.json

@@ -791,7 +791,7 @@
 		"path": ["mission", "create"],
 		"procedure": "event.createMission",
 		"requiresAuth": true,
-		"summary": "Create a mission in a station.",
+		"summary": "Create a mission in a station. Fill-in-the-blank inputs support correctAnswer and acceptedAnswers (up to 50 alternatives). Optional revealMessage (up to 2,000 characters) is shown only after submitting.",
 		"targetKeys": [
 			"id",
 			"memberId",
@@ -823,7 +823,7 @@
 		"path": ["mission", "update"],
 		"procedure": "event.updateMission",
 		"requiresAuth": true,
-		"summary": "Update a mission.",
+		"summary": "Update a mission. Fill-in-the-blank inputs support acceptedAnswers; omit to preserve or pass [] to clear. Existing submissions are not re-graded. Edit revealMessage during live play; omit it to preserve or use an empty string to clear.",
 		"targetKeys": [
 			"id",
 			"memberId",
@@ -1622,6 +1622,16 @@
 			"name"
 		]
 	},
+	{
+		"effects": ["state-change"],
+		"input": "json",
+		"operation": "mutation",
+		"path": ["mission", "reopen"],
+		"procedure": "event.reopenMission",
+		"requiresAuth": true,
+		"summary": "Reopen a submitted or skipped mission for one team (teamId) or player (eventPlayerId) on a fixed-order route. Earlier points count until they resubmit; then only the new submission counts. Finish times are kept.",
+		"targetKeys": ["teamId", "eventPlayerId", "missionId"]
+	},
 	{
 		"effects": ["state-change"],
 		"input": "json",
@@ -2305,7 +2315,7 @@
 		"path": ["player", "mission", "submit"],
 		"procedure": "event.submitMission",
 		"requiresAuth": true,
-		"summary": "Submit a mission response.",
+		"summary": "Submit a mission response and return revealMessage, including already-completed submissions.",
 		"targetKeys": [
 			"id",
 			"memberId",

package/command-reference.md

@@ -332,7 +332,7 @@ Reorder shared stations, or a selected team's station route when scopeTeamId is
 
 ## `gosh mission create`
 
-Create a mission in a station.
+Create a mission in a station. Fill-in-the-blank inputs support correctAnswer and acceptedAnswers (up to 50 alternatives). Optional revealMessage (up to 2,000 characters) is shown only after submitting.
 
 - Authentication: browser-authenticated CLI session required
 - Input: `--input '<json>'` required
@@ -340,7 +340,7 @@ Create a mission in a station.
 
 ## `gosh mission update`
 
-Update a mission.
+Update a mission. Fill-in-the-blank inputs support acceptedAnswers; omit to preserve or pass [] to clear. Existing submissions are not re-graded. Edit revealMessage during live play; omit it to preserve or use an empty string to clear.
 
 - Authentication: browser-authenticated CLI session required
 - Input: `--input '<json>'` required
@@ -618,6 +618,14 @@ Review a mission submission.
 - Input: `--input '<json>'` required
 - Effects: state-change
 
+## `gosh mission reopen`
+
+Reopen a submitted or skipped mission for one team (teamId) or player (eventPlayerId) on a fixed-order route. Earlier points count until they resubmit; then only the new submission counts. Finish times are kept.
+
+- Authentication: browser-authenticated CLI session required
+- Input: `--input '<json>'` required
+- Effects: state-change
+
 ## `gosh results-share regenerate`
 
 Create a new results portal share token.
@@ -932,7 +940,7 @@ Permanently skip one unresolved mission for zero points when enabled; retain oth
 
 ## `gosh player mission submit`
 
-Submit a mission response.
+Submit a mission response and return revealMessage, including already-completed submissions.
 
 - Authentication: browser-authenticated CLI session required
 - Input: `--input '<json>'` required

package/dist/index.js

@@ -35,16 +35,16 @@ var __toESM = (mod, isNodeMode, target) => {
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
 var __require = import.meta.require;
 
-// ../../../node_modules/.bun/dotenv@18.0.7/node_modules/dotenv/dist/index.cjs
+// ../../../node_modules/.bun/dotenv@18.0.8/node_modules/dotenv/dist/index.cjs
 var require_dist = __commonJS(function(exports, module) {
-  var k = (e, n) => () => {
+  var j = (e, n) => () => {
     try {
       return n || e((n = { exports: {} }).exports, n), n.exports;
     } catch (t) {
       throw n = 0, t;
     }
   };
-  var I = k((xe, U) => {
+  var k = j((xe, U) => {
     function G(e) {
       return typeof e == "string" ? !["false", "0", "no", "off", ""].includes(e.toLowerCase()) : !!e;
     }
@@ -58,8 +58,8 @@ var require_dist = __commonJS(function(exports, module) {
     }
     U.exports = { parseBoolean: G, optionsFromEnv: Y };
   });
-  var N = k((ye, x) => {
-    var z = __require("fs"), S = __require("path"), Z = __require("os"), { URL: ee, fileURLToPath: te } = __require("url"), { parseBoolean: $, optionsFromEnv: B } = I(), re = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"])*"|\s*`(?:\\`|[^`])*`|[^#\r\n]+)?\s*(?:#.*)?(?:$|$)/mg, b = new Uint8Array(256);
+  var N = j((ye, x) => {
+    var z = __require("fs"), I = __require("path"), Z = __require("os"), { URL: ee, fileURLToPath: te } = __require("url"), { parseBoolean: $, optionsFromEnv: B } = k(), re = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"])*"|\s*`(?:\\`|[^`])*`|[^#\r\n]+)?\s*(?:#.*)?(?:$|$)/mg, b = new Uint8Array(256);
     for (let e = 48;e <= 57; e++)
       b[e] = 1;
     for (let e = 65;e <= 90; e++)
@@ -124,7 +124,7 @@ var require_dist = __commonJS(function(exports, module) {
             r++;
           continue;
         }
-        let p = t.slice(l, r), f = r;
+        let h = t.slice(l, r), f = r;
         if (r >= o && (d = 0), w(d))
           do
             r++, d = r < o ? t.charCodeAt(r) : 0;
@@ -141,8 +141,8 @@ var require_dist = __commonJS(function(exports, module) {
         let c = r, a = r;
         for (;a < o && w(t.charCodeAt(a)); )
           a++;
-        let h = t.charCodeAt(a), g, y = false;
-        if (h === 39 || h === 34 || h === 96) {
+        let g = t.charCodeAt(a), p, y = false;
+        if (g === 39 || g === 34 || g === 96) {
           let v = t[a], u = t.indexOf(v, a + 1), m = -1, C = -1;
           for (;u !== -1; ) {
             let O = t.charCodeAt(u - 1) === 92, E = u + 1;
@@ -153,7 +153,7 @@ var require_dist = __commonJS(function(exports, module) {
             u = t.indexOf(v, u + 1);
           }
           if (m !== -1) {
-            if (g = t.slice(a + 1, m), r = C, t.charCodeAt(r) === 35)
+            if (p = t.slice(a + 1, m), r = C, t.charCodeAt(r) === 35)
               for (;r < o && !q(t.charCodeAt(r)); )
                 r++;
             y = true;
@@ -175,12 +175,12 @@ var require_dist = __commonJS(function(exports, module) {
           for (;C > m && w(t.charCodeAt(C - 1)); )
             C--;
           let O = t.charCodeAt(m);
-          if (C - m >= 2 && (O === 39 || O === 34 || O === 96) && t.charCodeAt(C - 1) === O ? g = t.slice(m + 1, C - 1) : g = t.slice(m, C), r = u, u < v)
+          if (p = t.slice(m, C), p.includes("\u2028") || p.includes("\u2029") ? p = p.replace(/^(['"`])([\s\S]*)\1$/mg, "$2") : C - m >= 2 && (O === 39 || O === 34 || O === 96) && t.charCodeAt(C - 1) === O && (p = t.slice(m + 1, C - 1)), r = u, u < v)
             for (;r < o && !q(t.charCodeAt(r)); )
               r++;
         }
-        h === 34 && (y || a < r) && g.indexOf("\\") !== -1 && (g = g.replace(/\\n/g, `
-`).replace(/\\r/g, "\r")), n[p] = g;
+        g === 34 && (y || a < r) && p.indexOf("\\") !== -1 && (p = p.replace(/\\n/g, `
+`).replace(/\\r/g, "\r")), n[h] = p;
       }
       return n;
     }
@@ -194,7 +194,7 @@ var require_dist = __commonJS(function(exports, module) {
       console.error(`\u25C7 ${e}`);
     }
     function V(e) {
-      return e[0] === "~" ? S.join(Z.homedir(), e.slice(1)) : e;
+      return e[0] === "~" ? I.join(Z.homedir(), e.slice(1)) : e;
     }
     function ce(e = {}) {
       let n = { ...e };
@@ -204,7 +204,7 @@ var require_dist = __commonJS(function(exports, module) {
     }
     function ae(e) {
       e = ce(e);
-      let n = S.resolve(process.cwd(), ".env"), t = "utf8", o = process.env;
+      let n = I.resolve(process.cwd(), ".env"), t = "utf8", o = process.env;
       e && e.processEnv != null && (o = e.processEnv);
       let r = $(e && e.debug);
       e && e.encoding ? t = e.encoding : r && T("no encoding is specified (UTF-8 is used by default)");
@@ -225,15 +225,15 @@ var require_dist = __commonJS(function(exports, module) {
         } catch (a) {
           r && T(`failed to load ${c} ${a.message}`), i = a;
         }
-      let p = A.populate(o, l, e), f = $(Object.prototype.hasOwnProperty.call(e, "quiet") ? e.quiet : B(o).quiet);
+      let h = A.populate(o, l, e), f = $(Object.prototype.hasOwnProperty.call(e, "quiet") ? e.quiet : B(o).quiet);
       if (r || !f) {
-        let c = Object.keys(p).length, a = [];
-        for (let h of s)
+        let c = Object.keys(h).length, a = [];
+        for (let g of s)
           try {
-            let g = S.relative(process.cwd(), h instanceof ee ? te(h) : h);
-            a.push(g);
-          } catch (g) {
-            r && T(`failed to load ${h} ${g.message}`), i = g;
+            let p = I.relative(process.cwd(), g instanceof ee ? te(g) : g);
+            a.push(p);
+          } catch (p) {
+            r && T(`failed to load ${g} ${p.message}`), i = p;
           }
         ie(`injected env (${c}) from ${a.join(",")}`);
       }
@@ -259,7 +259,7 @@ var require_dist = __commonJS(function(exports, module) {
     x.exports.populate = A.populate;
     x.exports = A;
   });
-  var M = k((Te, W) => {
+  var M = j((Te, W) => {
     var _ = __require("child_process"), ue = __require("fs"), L = __require("path");
     function de(e) {
       let n = ['"'], t = 0;
@@ -291,10 +291,10 @@ var require_dist = __commonJS(function(exports, module) {
       let o = (P(n, "PATHEXT") || ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean), s = o.some((l) => e.toLowerCase().endsWith(l.toLowerCase())) ? ["", ...o] : [...o, ""], i = /[\\/]/.test(e) ? [t] : [t, ...(P(n, "PATH") || "").split(";")];
       for (let l of i)
         for (let d of s) {
-          let p = L.resolve(t, l.replace(/^"|"$/g, ""), e + d);
+          let h = L.resolve(t, l.replace(/^"|"$/g, ""), e + d);
           try {
-            if (ue.statSync(p).isFile())
-              return p;
+            if (ue.statSync(h).isFile())
+              return h;
           } catch {}
         }
     }
@@ -312,18 +312,18 @@ var require_dist = __commonJS(function(exports, module) {
     }
     W.exports = he;
   });
-  var X = k(($e, F) => {
-    var ge = __require("fs"), me = __require("os"), Q = __require("path"), ve = __require("child_process"), Ce = M(), R = N(), { optionsFromEnv: J } = I();
+  var X = j(($e, F) => {
+    var ge = __require("fs"), me = __require("os"), Q = __require("path"), ve = __require("child_process"), Ce = M(), R = N(), { optionsFromEnv: J } = k();
     function D() {
       console.log(["Usage: dotenv run [--help] [-q|--quiet] [--debug] [--override] [--fast] [-f|--file <paths>] [--] <command> [args...]", "", "Run a command with environment variables from a .env file.", "Place dotenv options before the command; all following arguments go to the command.", "", "Options:", "  -f, --file <paths>  .env paths, comma-separated or repeated (default: .env)", "  -q, --quiet suppress the injected env message", "  --debug     enable debug logging", "  --override  override existing environment variables", "  --fast      use the faster character-scanner parser", "", "Environment variables (DOTENV_CONFIG_* names remain as fallbacks):", "  DOTENV_PATH, DOTENV_ENCODING, DOTENV_QUIET,", "  DOTENV_DEBUG, DOTENV_OVERRIDE,", "  DOTENV_FAST"].join(`
 `));
     }
     function we(e) {
       let n = [], t = false, o, r, s, i, l = -1;
-      for (let p = 0;p < e.length; p++) {
-        let f = e[p];
+      for (let h = 0;h < e.length; h++) {
+        let f = e[h];
         if (f === "--") {
-          l = p + 1;
+          l = h + 1;
           break;
         }
         if (f === "--help" || f === "-h")
@@ -345,18 +345,18 @@ var require_dist = __commonJS(function(exports, module) {
           continue;
         }
         if (f === "-f" || f === "--file" || f.startsWith("-f=") || f.startsWith("--file=")) {
-          let c = f.indexOf("="), a = c === -1 ? f : f.slice(0, c), h = c === -1 ? e[++p] : f.slice(c + 1);
-          if (!h || h === "--")
+          let c = f.indexOf("="), a = c === -1 ? f : f.slice(0, c), g = c === -1 ? e[++h] : f.slice(c + 1);
+          if (!g || g === "--")
             return { error: `${a} requires a path` };
-          let g = h.split(",").map((y) => y.trim()).filter(Boolean);
-          if (g.length === 0)
+          let p = g.split(",").map((y) => y.trim()).filter(Boolean);
+          if (p.length === 0)
             return { error: `${a} requires a path` };
-          n.push(...g), t = true;
+          n.push(...p), t = true;
           continue;
         }
         if (f.startsWith("-"))
           return { error: `unknown option: ${f}` };
-        l = p;
+        l = h;
         break;
       }
       let d = l === -1 ? [] : e.slice(l);
@@ -410,15 +410,15 @@ var require_dist = __commonJS(function(exports, module) {
       try {
         let c = be(o);
         if (!(o.quiet == null ? J().quiet : o.quiet)) {
-          let h = `\u25C7 injected env (${Object.keys(c.injected).length})`;
-          c.loadedPaths.length > 0 && (h += ` from ${c.loadedPaths.join(", ")}`), console.error(h);
+          let g = `\u25C7 injected env (${Object.keys(c.injected).length})`;
+          c.loadedPaths.length > 0 && (g += ` from ${c.loadedPaths.join(", ")}`), console.error(g);
         }
       } catch (c) {
         console.error(`dotenv: ${c.message}`), process.exitCode = 1;
         return;
       }
       let r = !!process.stdin.isTTY, s = process.platform !== "win32" && !r, i = Ce(t.command[0], t.command.slice(1), { stdio: "inherit", detached: s }), l = new Map, d = 0;
-      function p(c) {
+      function h(c) {
         if (!(!i.pid || i.exitCode !== null || i.signalCode !== null)) {
           if (process.platform === "win32") {
             ve.spawnSync("taskkill", ["/pid", String(i.pid), "/T", "/F"], { stdio: "ignore" });
@@ -442,11 +442,11 @@ var require_dist = __commonJS(function(exports, module) {
             if (d++, r && process.platform !== "win32" && d === 1)
               return;
             if (d > 1) {
-              p(d === 2 ? "SIGTERM" : "SIGKILL");
+              h(d === 2 ? "SIGTERM" : "SIGKILL");
               return;
             }
           }
-          p(c);
+          h(c);
         };
         l.set(c, a), process.on(c, a);
       }
@@ -459,13 +459,13 @@ var require_dist = __commonJS(function(exports, module) {
     F.exports = K;
     F === __require.main && K(process.argv.slice(2));
   });
-  var j = N();
+  var S = N();
   var qe = X();
-  module.exports = j;
-  module.exports.config = j.config;
-  module.exports.configDotenv = j.configDotenv;
-  module.exports.parse = j.parse;
-  module.exports.populate = j.populate;
+  module.exports = S;
+  module.exports.config = S.config;
+  module.exports.configDotenv = S.configDotenv;
+  module.exports.parse = S.parse;
+  module.exports.populate = S.populate;
 });
 
 // src/load-env.ts
@@ -515,7 +515,7 @@ var createPkcePair = () => {
     verifier
   };
 };
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/util.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/util.js
 function getEnumValues(entries) {
   const numericValues = Object.values(entries).filter((v) => typeof v === "number");
   const values = Object.entries(entries).filter(([k, _]) => numericValues.indexOf(+k) === -1).map(([_, v]) => v);
@@ -861,6 +861,18 @@ function prefixIssues(path, issues) {
 function unwrapMessage(message) {
   return typeof message === "string" ? message : message?.message;
 }
+function sizeCaps(defChecks) {
+  const caps = [];
+  for (const ch of defChecks ?? []) {
+    const d = ch._zod.def;
+    if (!/_(length|size)$|_equals$/.test(d.check))
+      break;
+    const max = d.maximum ?? d.length ?? d.size;
+    if (max >= 0)
+      caps.push([max, ch]);
+  }
+  return caps;
+}
 function attachSchema(issues, start, inst) {
   var _a;
   for (let i = start;i < issues.length; i++) {
@@ -1058,7 +1070,7 @@ function constantCatch(value) {
   return fn;
 }
 
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/core.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/core.js
 var _a;
 var _zodDesc = { value: undefined, enumerable: false };
 var _E = "captureStackTrace" in Error ? Error : null;
@@ -1176,7 +1188,7 @@ function config2(newConfig) {
     Object.assign(globalConfig, newConfig);
   return globalConfig;
 }
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/errors.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/errors.js
 function _getMessage() {
   const internals = this._zod;
   internals.message ?? (internals.message = JSON.stringify(internals.def, jsonStringifyReplacer, 2));
@@ -1291,7 +1303,7 @@ function formatError(error, mapper = (issue) => issue.message) {
   return fieldErrors;
 }
 
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/parse.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/parse.js
 function finalizeParams(callee, params) {
   return { callee: params?.callee ?? callee, Err: params?.Err };
 }
@@ -1438,7 +1450,7 @@ var _safeEncodeAsync = (_Err) => async (schema, value, _ctx) => {
 var _safeDecodeAsync = (_Err) => async (schema, value, _ctx) => {
   return _safeParseAsync(_Err)(schema, value, _ctx);
 };
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/regexes.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/regexes.js
 var cuid = /^[cC][0-9a-z]{6,}$/;
 var cuid2 = /^[0-9a-z]+$/;
 var ulid = /^[0-7][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{25}$/;
@@ -1496,7 +1508,7 @@ var _null = /^null$/i;
 var lowercase = /^[^A-Z]*$/;
 var uppercase = /^[^a-z]*$/;
 
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/checks.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/checks.js
 var $ZodCheck = /* @__PURE__ */ $constructor("$ZodCheck", (inst, def) => {
   var _a;
   inst._zod ?? (inst._zod = {});
@@ -1812,7 +1824,7 @@ var $ZodCheckOverwrite = /* @__PURE__ */ $constructor("$ZodCheckOverwrite", (ins
   };
 });
 
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/doc.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/doc.js
 class Doc {
   constructor(args = [], closed = {}) {
     this.content = [];
@@ -1854,14 +1866,14 @@ ${content.join(`
   }
 }
 
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/versions.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/versions.js
 var version = {
   major: 4,
   minor: 6,
-  patch: 5
+  patch: 7
 };
 
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/schemas.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/schemas.js
 var $ZodType = /* @__PURE__ */ $constructor("$ZodType", (inst, def) => {
   var _a;
   inst ?? (inst = {});
@@ -2427,6 +2439,29 @@ var $ZodNever = /* @__PURE__ */ $constructor("$ZodNever", (inst, def) => {
     return payload;
   };
 });
+function capSize(inst, size) {
+  const caps = sizeCaps(inst._zod.def.checks);
+  if (!caps.length)
+    return;
+  const cap = Math.min(...caps.map((c) => c[0]));
+  const parse = inst._zod.parse;
+  inst._zod.parse = (payload, ctx) => {
+    const n = size(payload.value);
+    if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+      for (const [max, ch] of sizeCaps(inst._zod.def.checks)) {
+        if (n > max && ch._zod.def.when(payload)) {
+          const start = payload.issues.length;
+          ch._zod.check(payload);
+          payload.issues[start].continue = false;
+          attachSchema(payload.issues, start, inst);
+          return payload;
+        }
+      }
+    }
+    return parse(payload, ctx);
+  };
+}
+var arraySize = (input) => Array.isArray(input) ? input.length : -1;
 function handleArrayResult(result, final, index) {
   if (result.issues.length) {
     final.issues.push(...prefixIssues(index, result.issues));
@@ -2470,6 +2505,7 @@ var $ZodArray = /* @__PURE__ */ $constructor("$ZodArray", (inst, def) => {
     }
     return payload;
   };
+  capSize(inst, arraySize);
 });
 function handlePropertyResult(result, final, key, input, optin, optout) {
   const isPresent = key in input;
@@ -3252,7 +3288,7 @@ function handleRefineResult(result, payload, input, inst) {
     payload.issues.push(issue(_iss));
   }
 }
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/memoizer.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/memoizer.js
 class $ZodCyclicError extends Error {
   constructor() {
     super(`Cannot parse a reference cycle that closes through a transform`);
@@ -3521,7 +3557,7 @@ function isBackEdge(ctx, value) {
   const backEdges = ctx[STATE]?.backEdges;
   return backEdges !== undefined && isRef(value) && backEdges.has(value);
 }
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/locales/en.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/locales/en.js
 var error = () => {
   const Sizable = {
     string: { unit: "characters", verb: "to have" },
@@ -3643,7 +3679,7 @@ function en_default() {
     localeError: error()
   };
 }
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/registries.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/registries.js
 var _a2;
 class $ZodRegistry {
   constructor() {
@@ -3690,7 +3726,7 @@ function registry() {
 }
 (_a2 = globalThis).__zod_globalRegistry ?? (_a2.__zod_globalRegistry = registry());
 var globalRegistry = globalThis.__zod_globalRegistry;
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/api.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/api.js
 function snapshotChecks(def) {
   if (def.checks)
     def.checks = [...def.checks];
@@ -4144,7 +4180,7 @@ function _check(fn, params) {
   ch._zod.check = fn;
   return ch;
 }
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/to-json-schema.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/to-json-schema.js
 function assignProps(target, ...sources) {
   for (const source of sources) {
     for (const key of Reflect.ownKeys(source)) {
@@ -4667,7 +4703,7 @@ var createStandardJSONSchemaMethod = (schema, io, processors = {}) => (params) =
   extractDefs(ctx, schema);
   return finalize(ctx, schema);
 };
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/json-schema-processors.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/json-schema-processors.js
 var narrowMin = (agg, key, value) => {
   if (agg[key] === undefined || value > agg[key])
     agg[key] = value;
@@ -5096,7 +5132,7 @@ var optionalProcessor = (schema, ctx, _json, params) => {
   const seen = ctx.seen.get(schema);
   seen.ref = def.innerType;
 };
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/classic/errors.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/classic/errors.js
 var _installedErrorProtos = /* @__PURE__ */ new WeakSet([Object.prototype, Error.prototype]);
 function _lazyMethod(proto, key, make) {
   Object.defineProperty(proto, key, {
@@ -5141,7 +5177,7 @@ var ZodRealError = /* @__PURE__ */ $constructor("ZodError", initializer2, undefi
   Parent: Error
 });
 
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/classic/parse.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/classic/parse.js
 var parse2 = /* @__PURE__ */ _parse(ZodRealError);
 var parseAsync = /* @__PURE__ */ _parseAsync(ZodRealError);
 var safeParse = /* @__PURE__ */ _safeParse(ZodRealError);
@@ -5155,7 +5191,7 @@ var safeDecode = /* @__PURE__ */ _safeDecode(ZodRealError);
 var safeEncodeAsync = /* @__PURE__ */ _safeEncodeAsync(ZodRealError);
 var safeDecodeAsync = /* @__PURE__ */ _safeDecodeAsync(ZodRealError);
 
-// ../../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/classic/schemas.js
+// ../../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/classic/schemas.js
 function _ensureDefaultLocale() {
   if (!globalConfig.localeError)
     config2(en_default());
@@ -7540,6 +7576,10 @@ var typedOperations = {
     kind: "mutation",
     invoke: (client, input) => client.event.reviewSubmission.mutate(input)
   },
+  "event.reopenMission": {
+    kind: "mutation",
+    invoke: (client, input) => client.event.reopenMission.mutate(input)
+  },
   "event.regenerateResultsPortalShare": {
     kind: "mutation",
     invoke: (client, input) => client.event.regenerateResultsPortalShare.mutate(input)
@@ -7885,6 +7925,7 @@ var mutationTargetKeys = {
   "team.assignTeamRoutingGroup": ["teamId"],
   "event.startStation": ["stationId"],
   "event.skipMission": ["missionId"],
+  "event.reopenMission": ["teamId", "eventPlayerId", "missionId"],
   "event.create": ["organizationId", "name"],
   "event.createFromTemplate": ["organizationId", "templateId"],
   "event.requestLoginEmailOtp": ["eventId", "email"],
@@ -7976,10 +8017,8 @@ var commands = [
   mutation(["station", "clone"], "event.cloneStation", "Clone a station and its missions.", ["state-change"]),
   mutation(["station", "archive"], "event.archiveStation", "Archive a station.", ["state-change", "delete"]),
   mutation(["station", "reorder"], "event.reorderStations", "Reorder shared stations, or a selected team's station route when scopeTeamId is supplied.", ["state-change"]),
-  mutation(["mission", "create"], "event.createMission", "Create a mission in a station.", ["state-change"]),
-  mutation(["mission", "update"], "event.updateMission", "Update a mission.", [
-    "state-change"
-  ]),
+  mutation(["mission", "create"], "event.createMission", "Create a mission in a station. Fill-in-the-blank inputs support correctAnswer and acceptedAnswers (up to 50 alternatives). Optional revealMessage (up to 2,000 characters) is shown only after submitting.", ["state-change"]),
+  mutation(["mission", "update"], "event.updateMission", "Update a mission. Fill-in-the-blank inputs support acceptedAnswers; omit to preserve or pass [] to clear. Existing submissions are not re-graded. Edit revealMessage during live play; omit it to preserve or use an empty string to clear.", ["state-change"]),
   mutation(["mission", "archive"], "event.archiveMission", "Archive a mission.", ["state-change", "delete"]),
   mutation(["mission", "reorder"], "event.reorderMissions", "Reorder missions within a station.", ["state-change"]),
   query(["team", "list"], "team.list", "List teams and their current members."),
@@ -8021,6 +8060,7 @@ var commands = [
   mutation(["reward", "update"], "event.updateReward", "Update an event reward.", ["state-change"]),
   mutation(["score", "adjust"], "event.createScoreAdjustment", "Create a manual score adjustment.", ["state-change"]),
   mutation(["submission", "review"], "event.reviewSubmission", "Review a mission submission.", ["state-change"]),
+  mutation(["mission", "reopen"], "event.reopenMission", "Reopen a submitted or skipped mission for one team (teamId) or player (eventPlayerId) on a fixed-order route. Earlier points count until they resubmit; then only the new submission counts. Finish times are kept.", ["state-change"]),
   mutation(["results-share", "regenerate"], "event.regenerateResultsPortalShare", "Create a new results portal share token.", ["state-change"]),
   mutation(["results-share", "revoke"], "event.revokeResultsPortalShare", "Revoke the current results portal share token.", ["state-change", "delete"]),
   query(["event", "analytics-shell"], "event.getAdminAnalyticsShell", "Get the organizer analytics shell."),
@@ -8062,7 +8102,7 @@ var commands = [
   mutation(["player", "station-check-in"], "event.createStationCheckInProof", "Create an expiring station check-in proof.", ["state-change"]),
   mutation(["player", "station", "start"], "event.startStation", "Start the current sequential station's shared mission timer and reveal its missions; required check-in still applies.", ["state-change"]),
   mutation(["player", "mission", "skip"], "event.skipMission", "Permanently skip one unresolved mission for zero points when enabled; retain other points and elapsed station time.", ["state-change"]),
-  mutation(["player", "mission", "submit"], "event.submitMission", "Submit a mission response.", ["state-change"]),
+  mutation(["player", "mission", "submit"], "event.submitMission", "Submit a mission response and return revealMessage, including already-completed submissions.", ["state-change"]),
   query(["public", "event-login"], "event.getPublicLoginDetails", "Get public event login details.", { requiresAuth: false }),
   query(["public", "results"], "event.getResultsPortal", "Get a shared public results portal.", { requiresAuth: false }),
   mutation(["public", "request-login-code"], "event.requestLoginEmailOtp", "Send an event login email code.", ["email", "external-write"], { requiresAuth: false }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@go-labs-sg/gosh",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "description": "GOSH CLI for organizers and AI agents — manage organizations, events, teams, stations, missions, templates, and live operations through the GOSH API.",
   "type": "module",
   "main": "./dist/index.js",
@@ -19,7 +19,7 @@
   ],
   "dependencies": {
     "@trpc/client": "^11.19.0",
-    "dotenv": "^18.0.7",
+    "dotenv": "^18.0.8",
     "superjson": "^2.2.6"
   },
   "engines": {