@go-labs-sg/gosh 1.2.0 → 1.3.0

package/README.md

@@ -246,9 +246,22 @@ and missions stay editable after play starts: each edit re-syncs every started
 team's saved progress in the same transaction. Played stations keep their
 progress and order, while unplayed stations follow the new route. An edit that
 would remove the station a team is in the middle of fails with a conflict and
-changes nothing. A started team's group assignment, team creation, play mode
-and progression settings stay locked. A group shares its ordered station route,
-while each team keeps independent progress through that route.
+changes nothing. A started team's group assignment, play mode and progression
+settings stay locked. A group shares its ordered station route, while each team
+keeps independent progress through that route.
+
+Late teams can join a live group-routed event. `team create` must then include
+a `groupId`, so the team starts on that group's route behind its release gate
+(a held or scheduled group stays closed to it). Restoring an archived team
+while group routing is live works only if the team never played and still has
+a group. Without group routing, team creation still locks once play starts.
+
+```bash
+gosh team create \
+  --input '{"eventId":"event-id","name":"Walk-in team","groupId":"group-id"}' \
+  --target event-id \
+  --allow-state-change
+```
 
 Configure gameplay, then manage the event's routing groups and their complete
 station lists:
@@ -379,6 +392,44 @@ gosh submission review \
   --allow-state-change
 ```
 
+### RSVP check-in teams
+
+An RSVP form can create a GOSH team on its first successful check-in. RSVP
+signs the request; GOSH creates the team from the registration's emails (the
+first email is the captain, the rest are members), picks the least-loaded
+route group that still has room, and returns the route. This also works
+while the event is live, so a newly checked-in team can start playing.
+
+The binding is off by default. Set the signing secret in the GOSH environment
+as `GOSH_RSVP_CHECK_IN_WEBHOOK_SECRETS=<keyId>:whsec_...` (comma separated
+during rotation). The secret is never stored in the binding.
+
+```bash
+gosh rsvp-check-in binding set \
+  --input '{"eventId":"event-id","sourceOrganizationId":"rsvp-org-id","sourceEventId":"rsvp-event-id","sourceFormId":"rsvp-form-id","keyId":"farm-2026","enabled":true,"groups":[{"groupId":"group-a","teamCapacity":125},{"groupId":"group-b","teamCapacity":125},{"groupId":"group-c","teamCapacity":125},{"groupId":"group-d","teamCapacity":125}],"totalTeamCapacity":500,"maxRosterSize":2}' \
+  --target event-id \
+  --allow-state-change
+gosh rsvp-check-in binding get --input '{"eventId":"event-id"}'
+gosh rsvp-check-in links list --input '{"eventId":"event-id","filter":"REVIEW"}'
+```
+
+- Group load counts every non-archived team in the group, including teams
+  assigned by hand. While the binding is enabled, `routing-group assign-team`
+  and restoring an archived team are refused if they would exceed a group's
+  capacity or the total limit.
+- Groups with equal load are filled in the order listed in `groups`.
+- When every route is full, GOSH creates no team and RSVP shows
+  `CAPACITY_FULL`. The attendee stays checked in.
+- Email addresses are matched case-insensitively. Repeated addresses are
+  counted once. An invalid address, a suspended account, a player removed
+  from the event, or a player already on another team rejects the whole
+  team, and nothing is created.
+- New accounts are not marked verified, and GOSH sends no email. Players sign
+  in later with the normal email code.
+- Undoing the last RSVP check-in keeps the team and route but flags the team
+  for review. Clear the flag with `gosh rsvp-check-in review resolve`. A later
+  check-in reuses the same team.
+
 ### Artwork requirements (no login required)
 
 Read the bundled upload policy before preparing station, mission, or branding artwork:

package/command-manifest.json

@@ -1239,9 +1239,47 @@
 		"path": ["routing-group", "assign-team"],
 		"procedure": "team.assignTeamRoutingGroup",
 		"requiresAuth": true,
-		"summary": "Assign a team to a routing group, or clear its assignment with groupId null, before play starts.",
+		"summary": "Assign a team to a routing group, or clear its assignment with groupId null, before play starts. Groups covered by an enabled RSVP check-in binding reject moves that exceed their team capacity.",
 		"targetKeys": ["teamId"]
 	},
+	{
+		"effects": [],
+		"input": "json",
+		"operation": "query",
+		"path": ["rsvp-check-in", "binding", "get"],
+		"procedure": "team.getRsvpCheckInBinding",
+		"requiresAuth": true,
+		"summary": "Show the RSVP check-in team binding for an event: source RSVP organization/event/form, key ID, enabled flag, ordered routing groups with team capacity and current load, total limit and roster size limit. Secrets are never stored or shown. Requires editSetup."
+	},
+	{
+		"effects": ["state-change"],
+		"input": "json",
+		"operation": "mutation",
+		"path": ["rsvp-check-in", "binding", "set"],
+		"procedure": "team.upsertRsvpCheckInBinding",
+		"requiresAuth": true,
+		"summary": "Create or replace the RSVP check-in team binding: {eventId, sourceOrganizationId, sourceEventId, sourceFormId, keyId, enabled, groups:[{groupId, teamCapacity}] in tie-break order, totalTeamCapacity, maxRosterSize}. Disabled by default; the signing secret is set in the GOSH_RSVP_CHECK_IN_WEBHOOK_SECRETS environment variable under keyId. Requires launchEvent.",
+		"targetKeys": ["eventId", "sourceFormId"]
+	},
+	{
+		"effects": [],
+		"input": "json",
+		"operation": "query",
+		"path": ["rsvp-check-in", "links", "list"],
+		"procedure": "team.listRsvpCheckInLinks",
+		"requiresAuth": true,
+		"summary": "List RSVP registrations linked to check-in teams with route, applied revision, review flag and rejection code. filter ALL, REVIEW (undone check-ins) or REJECTED. Requires editSetup."
+	},
+	{
+		"effects": ["state-change"],
+		"input": "json",
+		"operation": "mutation",
+		"path": ["rsvp-check-in", "review", "resolve"],
+		"procedure": "team.resolveRsvpCheckInReview",
+		"requiresAuth": true,
+		"summary": "Clear the review flag on an RSVP check-in team after crew follow-up. The team and its route are unchanged. Requires editSetup.",
+		"targetKeys": ["linkId"]
+	},
 	{
 		"effects": [],
 		"input": "json",
@@ -1964,6 +2002,79 @@
 			"name"
 		]
 	},
+	{
+		"effects": ["state-change"],
+		"input": "json",
+		"operation": "mutation",
+		"path": ["station", "update-check-in"],
+		"procedure": "event.updateStationCheckIn",
+		"requiresAuth": true,
+		"summary": "Set how players unlock a station: open, location, QR, or both.",
+		"targetKeys": [
+			"id",
+			"memberId",
+			"invitationId",
+			"broadcastId",
+			"rewardId",
+			"submissionId",
+			"participantId",
+			"participantIds",
+			"missionId",
+			"stationId",
+			"teamId",
+			"templateId",
+			"eventId",
+			"organizationId",
+			"userId",
+			"key",
+			"uploadId",
+			"email",
+			"joinCode",
+			"slug",
+			"name"
+		]
+	},
+	{
+		"effects": [],
+		"input": "json",
+		"operation": "query",
+		"path": ["station", "qr-codes"],
+		"procedure": "event.getStationQrCodes",
+		"requiresAuth": true,
+		"summary": "List printable QR codes and manual codes for QR-enabled stations."
+	},
+	{
+		"effects": ["state-change"],
+		"input": "json",
+		"operation": "mutation",
+		"path": ["station", "regenerate-qr"],
+		"procedure": "event.regenerateStationQr",
+		"requiresAuth": true,
+		"summary": "Regenerate a station QR. Earlier prints stop working.",
+		"targetKeys": [
+			"id",
+			"memberId",
+			"invitationId",
+			"broadcastId",
+			"rewardId",
+			"submissionId",
+			"participantId",
+			"participantIds",
+			"missionId",
+			"stationId",
+			"teamId",
+			"templateId",
+			"eventId",
+			"organizationId",
+			"userId",
+			"key",
+			"uploadId",
+			"email",
+			"joinCode",
+			"slug",
+			"name"
+		]
+	},
 	{
 		"effects": ["state-change"],
 		"input": "json",
@@ -2288,6 +2399,38 @@
 			"name"
 		]
 	},
+	{
+		"effects": ["state-change"],
+		"input": "json",
+		"operation": "mutation",
+		"path": ["player", "station-qr-check-in"],
+		"procedure": "event.createStationQrCheckInProof",
+		"requiresAuth": true,
+		"summary": "Check in to a station with its scanned QR or manual code.",
+		"targetKeys": [
+			"id",
+			"memberId",
+			"invitationId",
+			"broadcastId",
+			"rewardId",
+			"submissionId",
+			"participantId",
+			"participantIds",
+			"missionId",
+			"stationId",
+			"teamId",
+			"templateId",
+			"eventId",
+			"organizationId",
+			"userId",
+			"key",
+			"uploadId",
+			"email",
+			"joinCode",
+			"slug",
+			"name"
+		]
+	},
 	{
 		"effects": ["state-change"],
 		"input": "json",

package/command-reference.md

@@ -500,7 +500,39 @@ Replace a group's complete station route in the supplied order before play start
 
 ## `gosh routing-group assign-team`
 
-Assign a team to a routing group, or clear its assignment with groupId null, before play starts.
+Assign a team to a routing group, or clear its assignment with groupId null, before play starts. Groups covered by an enabled RSVP check-in binding reject moves that exceed their team capacity.
+
+- Authentication: browser-authenticated CLI session required
+- Input: `--input '<json>'` required
+- Effects: state-change
+
+## `gosh rsvp-check-in binding get`
+
+Show the RSVP check-in team binding for an event: source RSVP organization/event/form, key ID, enabled flag, ordered routing groups with team capacity and current load, total limit and roster size limit. Secrets are never stored or shown. Requires editSetup.
+
+- Authentication: browser-authenticated CLI session required
+- Input: `--input '<json>'` required
+- Effects: read-only
+
+## `gosh rsvp-check-in binding set`
+
+Create or replace the RSVP check-in team binding: {eventId, sourceOrganizationId, sourceEventId, sourceFormId, keyId, enabled, groups:[{groupId, teamCapacity}] in tie-break order, totalTeamCapacity, maxRosterSize}. Disabled by default; the signing secret is set in the GOSH_RSVP_CHECK_IN_WEBHOOK_SECRETS environment variable under keyId. Requires launchEvent.
+
+- Authentication: browser-authenticated CLI session required
+- Input: `--input '<json>'` required
+- Effects: state-change
+
+## `gosh rsvp-check-in links list`
+
+List RSVP registrations linked to check-in teams with route, applied revision, review flag and rejection code. filter ALL, REVIEW (undone check-ins) or REJECTED. Requires editSetup.
+
+- Authentication: browser-authenticated CLI session required
+- Input: `--input '<json>'` required
+- Effects: read-only
+
+## `gosh rsvp-check-in review resolve`
+
+Clear the review flag on an RSVP check-in team after crew follow-up. The team and its route are unchanged. Requires editSetup.
 
 - Authentication: browser-authenticated CLI session required
 - Input: `--input '<json>'` required
@@ -778,6 +810,30 @@ Update station location and geofence settings.
 - Input: `--input '<json>'` required
 - Effects: state-change
 
+## `gosh station update-check-in`
+
+Set how players unlock a station: open, location, QR, or both.
+
+- Authentication: browser-authenticated CLI session required
+- Input: `--input '<json>'` required
+- Effects: state-change
+
+## `gosh station qr-codes`
+
+List printable QR codes and manual codes for QR-enabled stations.
+
+- Authentication: browser-authenticated CLI session required
+- Input: `--input '<json>'` required
+- Effects: read-only
+
+## `gosh station regenerate-qr`
+
+Regenerate a station QR. Earlier prints stop working.
+
+- Authentication: browser-authenticated CLI session required
+- Input: `--input '<json>'` required
+- Effects: state-change
+
 ## `gosh event save-as-template`
 
 Save an event as a template.
@@ -922,6 +978,14 @@ Create an expiring station check-in proof.
 - Input: `--input '<json>'` required
 - Effects: state-change
 
+## `gosh player station-qr-check-in`
+
+Check in to a station with its scanned QR or manual code.
+
+- Authentication: browser-authenticated CLI session required
+- Input: `--input '<json>'` required
+- Effects: state-change
+
 ## `gosh player station start`
 
 Start the current sequential station's shared mission timer and reveal its missions; required check-in still applies.

package/dist/index.js

@@ -7520,6 +7520,22 @@ var typedOperations = {
     kind: "mutation",
     invoke: (client, input) => client.team.assignTeamRoutingGroup.mutate(input)
   },
+  "team.getRsvpCheckInBinding": {
+    kind: "query",
+    invoke: (client, input) => client.team.getRsvpCheckInBinding.query(input)
+  },
+  "team.upsertRsvpCheckInBinding": {
+    kind: "mutation",
+    invoke: (client, input) => client.team.upsertRsvpCheckInBinding.mutate(input)
+  },
+  "team.listRsvpCheckInLinks": {
+    kind: "query",
+    invoke: (client, input) => client.team.listRsvpCheckInLinks.query(input)
+  },
+  "team.resolveRsvpCheckInReview": {
+    kind: "mutation",
+    invoke: (client, input) => client.team.resolveRsvpCheckInReview.mutate(input)
+  },
   "template.list": {
     kind: "query",
     invoke: (client, input) => client.template.list.query(input)
@@ -7656,6 +7672,18 @@ var typedOperations = {
     kind: "mutation",
     invoke: (client, input) => client.event.updateStationLocation.mutate(input)
   },
+  "event.updateStationCheckIn": {
+    kind: "mutation",
+    invoke: (client, input) => client.event.updateStationCheckIn.mutate(input)
+  },
+  "event.getStationQrCodes": {
+    kind: "query",
+    invoke: (client, input) => client.event.getStationQrCodes.query(input)
+  },
+  "event.regenerateStationQr": {
+    kind: "mutation",
+    invoke: (client, input) => client.event.regenerateStationQr.mutate(input)
+  },
   "event.saveAsTemplate": {
     kind: "mutation",
     invoke: (client, input) => client.event.saveAsTemplate.mutate(input)
@@ -7728,6 +7756,10 @@ var typedOperations = {
     kind: "mutation",
     invoke: (client, input) => client.event.createStationCheckInProof.mutate(input)
   },
+  "event.createStationQrCheckInProof": {
+    kind: "mutation",
+    invoke: (client, input) => client.event.createStationQrCheckInProof.mutate(input)
+  },
   "event.startStation": {
     kind: "mutation",
     invoke: (client, input) => client.event.startStation.mutate(input)
@@ -7923,6 +7955,8 @@ var mutationTargetKeys = {
   "team.deleteRoutingGroup": ["groupId"],
   "team.setRoutingGroupStations": ["groupId"],
   "team.assignTeamRoutingGroup": ["teamId"],
+  "team.upsertRsvpCheckInBinding": ["eventId", "sourceFormId"],
+  "team.resolveRsvpCheckInReview": ["linkId"],
   "event.startStation": ["stationId"],
   "event.skipMission": ["missionId"],
   "event.reopenMission": ["teamId", "eventPlayerId", "missionId"],
@@ -8042,7 +8076,11 @@ var commands = [
   mutation(["routing-group", "rename"], "team.renameRoutingGroup", "Rename an event's routing group before play starts.", ["state-change"]),
   mutation(["routing-group", "delete"], "team.deleteRoutingGroup", "Delete an unassigned routing group before play starts.", ["state-change", "delete"]),
   mutation(["routing-group", "set-stations"], "team.setRoutingGroupStations", "Replace a group's complete station route in the supplied order before play starts.", ["state-change"]),
-  mutation(["routing-group", "assign-team"], "team.assignTeamRoutingGroup", "Assign a team to a routing group, or clear its assignment with groupId null, before play starts.", ["state-change"]),
+  mutation(["routing-group", "assign-team"], "team.assignTeamRoutingGroup", "Assign a team to a routing group, or clear its assignment with groupId null, before play starts. Groups covered by an enabled RSVP check-in binding reject moves that exceed their team capacity.", ["state-change"]),
+  query(["rsvp-check-in", "binding", "get"], "team.getRsvpCheckInBinding", "Show the RSVP check-in team binding for an event: source RSVP organization/event/form, key ID, enabled flag, ordered routing groups with team capacity and current load, total limit and roster size limit. Secrets are never stored or shown. Requires editSetup."),
+  mutation(["rsvp-check-in", "binding", "set"], "team.upsertRsvpCheckInBinding", "Create or replace the RSVP check-in team binding: {eventId, sourceOrganizationId, sourceEventId, sourceFormId, keyId, enabled, groups:[{groupId, teamCapacity}] in tie-break order, totalTeamCapacity, maxRosterSize}. Disabled by default; the signing secret is set in the GOSH_RSVP_CHECK_IN_WEBHOOK_SECRETS environment variable under keyId. Requires launchEvent.", ["state-change"]),
+  query(["rsvp-check-in", "links", "list"], "team.listRsvpCheckInLinks", "List RSVP registrations linked to check-in teams with route, applied revision, review flag and rejection code. filter ALL, REVIEW (undone check-ins) or REJECTED. Requires editSetup."),
+  mutation(["rsvp-check-in", "review", "resolve"], "team.resolveRsvpCheckInReview", "Clear the review flag on an RSVP check-in team after crew follow-up. The team and its route are unchanged. Requires editSetup.", ["state-change"]),
   query(["template", "list"], "template.list", "List templates visible in an organization; global admins can include every organization."),
   query(["template", "get"], "template.getById", "Get a template visible in the requested organization; global admins can get any template."),
   mutation(["template", "create"], "template.create", "Create an organization template, including shared stations with optional per-team route order.", ["state-change"]),
@@ -8080,6 +8118,9 @@ var commands = [
   mutation(["station", "update-availability"], "event.updateStationAvailability", "Update station availability.", ["state-change"]),
   mutation(["station", "update-image"], "event.updateStationImage", "Update a station image.", ["state-change"]),
   mutation(["station", "update-location"], "event.updateStationLocation", "Update station location and geofence settings.", ["state-change"]),
+  mutation(["station", "update-check-in"], "event.updateStationCheckIn", "Set how players unlock a station: open, location, QR, or both.", ["state-change"]),
+  query(["station", "qr-codes"], "event.getStationQrCodes", "List printable QR codes and manual codes for QR-enabled stations."),
+  mutation(["station", "regenerate-qr"], "event.regenerateStationQr", "Regenerate a station QR. Earlier prints stop working.", ["state-change"]),
   mutation(["event", "save-as-template"], "event.saveAsTemplate", "Save an event as a template.", ["state-change"]),
   query(["player", "event"], "event.getJoinDetails", "Get the current player's event details."),
   query(["player", "leaderboard", "page"], "event.getPaginatedPlayerLeaderboard", "Get a page of the player leaderboard."),
@@ -8100,6 +8141,7 @@ var commands = [
   mutation(["player", "display-name", "update"], "event.updatePlayerDisplayName", "Update the player's display name.", ["state-change"]),
   mutation(["player", "resolve-join-code"], "event.resolveJoinCode", "Resolve an event or team join code.", []),
   mutation(["player", "station-check-in"], "event.createStationCheckInProof", "Create an expiring station check-in proof.", ["state-change"]),
+  mutation(["player", "station-qr-check-in"], "event.createStationQrCheckInProof", "Check in to a station with its scanned QR or manual code.", ["state-change"]),
   mutation(["player", "station", "start"], "event.startStation", "Start the current sequential station's shared mission timer and reveal its missions; required check-in still applies.", ["state-change"]),
   mutation(["player", "mission", "skip"], "event.skipMission", "Permanently skip one unresolved mission for zero points when enabled; retain other points and elapsed station time.", ["state-change"]),
   mutation(["player", "mission", "submit"], "event.submitMission", "Submit a mission response and return revealMessage, including already-completed submissions.", ["state-change"]),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@go-labs-sg/gosh",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "GOSH CLI for organizers and AI agents — manage organizations, events, teams, stations, missions, templates, and live operations through the GOSH API.",
   "type": "module",
   "main": "./dist/index.js",