@go-labs-sg/rsvp 1.2.0 → 1.4.0

package/README.md

@@ -108,7 +108,7 @@ rsvp event seating draft preview --organization-id org_123 --event-id evt_123 \
   --expected-version 1 --ack-sensitive-data
 rsvp event seating draft publish --organization-id org_123 --event-id evt_123 \
   --expected-version 1 --request-id 123e4567-e89b-42d3-a456-426614174000 \
-  --reason 'Seat the confirmed guest' --allow-state-change --target evt_123
+  --reason 'Seat the confirmed guest' --allow-state-change --allow-email --target evt_123
 ```
 
 Save and Publish require the latest `expectedVersion`. A successful Publish applies
@@ -116,12 +116,37 @@ all changed guests atomically and clears only that version of your draft. Resolv
 preview issues before publishing; conflicts leave all bookings and the draft intact.
 For an unknown outcome, retry the same UUID `requestId`, version, reason and email
 choice: the durable receipt returns the previous counts without sending again or
-clearing a newer draft. A different intent needs a new request ID. Email defaults
-off. To opt in, use `--allow-email` and a full JSON payload including organizationId,
-eventId, expectedVersion, requestId, reason and `sendSeatChangeEmail: true`. Do not
-combine `--payload` with command-local version/reason/request flags;
-the server additionally requires notice permission and enabled recipient policy.
-Preview counts recipient registrations, not guests. On realtime-enabled servers,
+clearing a newer draft. A different intent needs a new request ID. Preserve the
+exact `seatChangeEmailRegistrationIds` set on retry (order is immaterial); changing
+it, including changing between omitted and `[]`, rejects reuse of the request ID.
+
+Preview returns `noticeRecipients`: one row per affected registration, with a
+registration ID, a grant-scoped name, `eligible`, and an `ineligibleReason` when
+unavailable. No email addresses are exposed by this seating response. Review both
+eligible and ineligible rows before choosing who receives mail; several moving
+party members still produce only one recipient registration.
+
+Use `seatChangeEmailRegistrationIds` in a full `--payload` to choose the exact
+eligible affected registrations. Leave a registration out to publish its seat
+changes without email. `[]` explicitly sends no email, **including when the event
+has automatic seat-change notifications**. Selecting an unaffected registration,
+an ineligible recipient or duplicate IDs is rejected before publishing. The API
+rechecks permissions and eligibility under the publish transaction, not just in
+preview. Sending requires notice permission. An explicit empty array does not.
+
+```sh
+rsvp event seating draft publish --allow-state-change --allow-email --target evt_123 \
+  --payload '{"organizationId":"org_123","eventId":"evt_123","expectedVersion":1,"requestId":"123e4567-e89b-42d3-a456-426614174000","reason":"Seat the confirmed party","sendSeatChangeEmail":true,"seatChangeEmailRegistrationIds":["reg_123"]}'
+```
+
+Do not combine `--payload` with command-local version/reason/request flags. If the
+recipient field is omitted, existing behavior remains: `sendSeatChangeEmail: true`
+requests all affected registrations, otherwise the automatic event policy still
+applies. Every draft publish conservatively requires CLI `--allow-email` (or the
+interactive effects confirmation), even for explicit `[]`; it approves an effect
+but does not enable sending. Use the matching server/client revision for explicit
+recipient choices; older servers reject the new field rather than silently
+ignoring it. Preview counts recipient registrations, not guests. On realtime-enabled servers,
 free new targets require validated per-registration holds at Publish, supplied as
 `seatHolds: [{registrationId, holds: [{seatMapId, clientId, holdToken}]}]` in the
 payload. Acquire these through the existing organizer hold-token flow; Stage never
@@ -377,7 +402,11 @@ including tax. Omitted tax remains compatible with legacy no-tax configuration.
 Read `payment event get` back with the same scope to verify the saved policy.
 
 `payment mine get` exposes the attempt's saved tax quote and subtotal/tax/final
-total. `payment event list` exposes each attempt's original `quote` plus
+total, plus `capturedAttempt`: the selected attempt when it is captured;
+otherwise the latest captured attempt, including refunded ones. `payment mine receipt get` (`eventSlug`, optional `formSlug`,
+`paymentAttemptId`) reads the provider's current hosted receipt link for the
+caller's own captured attempt; links expire, so read it when needed rather than
+storing it. `payment event list` exposes each attempt's original `quote` plus
 `refundBreakdown` (cumulative refunded subtotal, tax and total). Pending refunds
 are not confirmed refunded amounts. These are payment breakdowns, not statutory
 tax invoices. Organizers choose applicable settings; configuration does not
@@ -533,6 +562,56 @@ it for the active registration/edit definition. Deploy the updated server before
 saving these settings because older validators discard unsupported fields.
 No database schema migration or attendee backfill is required.
 
+## Confirmation email layout, name, QR codes and attachments
+
+In the form builder's **Flow settings → Confirmation email layout**, or through
+`definition.communications.participant.email` with `event flow draft save`,
+customise the participant confirmation email for every outcome of the form:
+
+```json
+{
+  "communications": {
+    "participant": {
+      "email": {
+        "heading": "Hello {{name}}!",
+        "eventLine": null,
+        "confirmationButtonLabel": "View my Quest pass",
+        "supportFooter": "Questions? Email quest@example.com",
+        "showEventDetails": false,
+        "includeCheckInQrCodes": true,
+        "attachments": []
+      }
+    }
+  }
+}
+```
+
+- `{{name}}` works in template `subject`, `body`, `bodyRichText` and every
+  text field above. It uses the primary attendee's name, then the invitee's
+  name, and falls back to `there`.
+- `heading`, `eventLine`, `confirmationButtonLabel` and `supportFooter`: omit to
+  keep the built-in text, `null` to hide that part, or a string to replace it.
+  A custom or hidden `supportFooter` also replaces the resubmission footer.
+- `showEventDetails` (default `true`) controls the When/Where lines.
+- `includeCheckInQrCodes` (default `false`) embeds each attendee's check-in QR
+  image once the event's check-in QR codes are released; before release the
+  email keeps the release message.
+- `attachments`: up to 5 PDF, PNG or JPEG files, 10 MB each and 15 MB total.
+  Create an upload with `event flow confirmation attachment upload create`
+  (`organizationId`, `eventId`, `filename`, `contentType`, `byteSize`), `PUT`
+  the file unchanged to the returned `uploadUrl` with its `Content-Type`, then
+  add the returned `attachment` object to the list. Preview/publish reject keys
+  not uploaded for the same event, and publish verifies each uploaded object's
+  type and size.
+
+Merge these fields into the complete current definition and publish as for
+other form settings. Omitting `email` keeps existing emails unchanged. Deploy
+the updated server before saving these settings. No database migration is
+required.
+
+`event flow preview` sends the definition as a POST body so large formatted
+emails no longer exceed URL limits; it requires a server with this change.
+
 ## Administrator registration for an invitee
 
 Organizers can register someone on their behalf at any time, including after
@@ -908,8 +987,34 @@ configuration version. Configurable copy is
 `definition.communications.participant.seatChange: {enabled, subject, body}`;
 merge into the complete named draft, preview, save with its revision, read back,
 then publish only with separate approval. Existing responses use their saved
-published version. Both default disabled/blank; missing copy never falls back to
-confirmation copy. No event-specific copy is supplied or enabled by this change.
+published version **unless** the event explicitly opts into the current automatic
+policy. Both default disabled/blank; missing copy never falls back to confirmation
+copy.
+
+An event can opt into automatic notices using current event metadata
+`seatChangeNotification: {automatic: true, enabled: true, subject, body}` through
+that same revision-checked `REGISTRATION_RULES` update. It covers historical form
+versions without rewriting responses or sending anything retroactively. Successful
+draft publishes and direct organizer moves/swaps then atomically queue one notice
+per affected registration even when the client checkbox is false or omitted.
+Non-seating edits, drafts, no-ops and rejected saves do not queue notices. Existing
+notification permissions, deduplication and stale-version delivery checks remain.
+Omitting `automatic` from a settings update preserves its saved value; explicitly
+send `automatic: false` to turn it off.
+
+Because event policy may send automatically, registration updates containing
+`seats`, all swaps and all draft publishes now require `--allow-email` (or the
+existing interactive effects confirmation). This conservative CLI guard also
+applies to events without automatic notices; approval does not itself turn on
+notifications. Profile/menu-only updates and draft save/discard retain their
+previous effects.
+
+Optional `registrationEmail` and `registrationMasterList` presentation settings
+are also written through `REGISTRATION_RULES`; omitted settings are preserved.
+See `examples/amgen-rsvp-copy/registration-presentation-patch.json` and its README
+for a reviewed activation fragment, output-key semantics, receipt/header behavior
+and the separate deployment/configuration/live-send approval gates. No event
+settings are activated by installing the code or reading this example.
 
 ## Audience tiers
 

package/dist/index.js

@@ -7195,7 +7195,8 @@ var logoutCliSession = async ({
 // src/api-client.ts
 import {
   createTRPCProxyClient,
-  httpBatchLink
+  httpBatchLink,
+  splitLink
 } from "@trpc/client";
 import SuperJSON from "superjson";
 
@@ -7213,18 +7214,28 @@ var normalizeApiBaseUrl = (value) => {
 var getApiBaseUrl = (override) => normalizeApiBaseUrl(override ?? process.env.RSVP_API_URL ?? DEFAULT_RSVP_API_BASE_URL);
 
 // src/api-client.ts
-var createRsvpClient = (apiBaseUrl = getApiBaseUrl(), accessToken) => createTRPCProxyClient({
-  links: [
-    httpBatchLink({
-      headers: () => accessToken ? {
-        authorization: `Bearer ${accessToken}`,
-        "x-trpc-source": "rsvp-cli"
-      } : { "x-trpc-source": "rsvp-cli" },
-      transformer: SuperJSON,
-      url: `${apiBaseUrl}/api/trpc`
-    })
-  ]
-});
+var POST_QUERY_PATHS = new Set([
+  "eventFlow.preview"
+]);
+var createRsvpClient = (apiBaseUrl = getApiBaseUrl(), accessToken) => {
+  const linkOptions = {
+    headers: () => accessToken ? {
+      authorization: `Bearer ${accessToken}`,
+      "x-trpc-source": "rsvp-cli"
+    } : { "x-trpc-source": "rsvp-cli" },
+    transformer: SuperJSON,
+    url: `${apiBaseUrl}/api/trpc`
+  };
+  return createTRPCProxyClient({
+    links: [
+      splitLink({
+        condition: (op) => POST_QUERY_PATHS.has(op.path),
+        true: httpBatchLink({ ...linkOptions, methodOverride: "POST" }),
+        false: httpBatchLink(linkOptions)
+      })
+    ]
+  });
+};
 
 // ../validators/src/assign-guests.ts
 var assignGuestFiltersInputSchema = object({
@@ -7565,6 +7576,45 @@ var magicLinkSignInInputSchema = object({
   email: email2({ error: "Enter a valid email address" }).trim(),
   callbackURL: string2().min(1).optional()
 });
+// ../../utils/src/rich-text.ts
+var richTextJsonShape = object({
+  json: custom(),
+  html: string2()
+});
+var htmlEntityMap = {
+  amp: "&",
+  apos: "'",
+  cent: "\xA2",
+  copy: "\xA9",
+  emsp: " ",
+  ensp: " ",
+  gt: ">",
+  lt: "<",
+  nbsp: " ",
+  ndash: "\u2013",
+  quot: '"',
+  reg: "\xAE",
+  thinsp: " "
+};
+var decodeHtmlEntity = (entity) => {
+  const fromCodePoint = (codePoint) => Number.isInteger(codePoint) && codePoint >= 0 && codePoint <= 1114111 ? String.fromCodePoint(codePoint) : " ";
+  const normalizedEntity = entity.toLowerCase();
+  if (normalizedEntity.startsWith("#x")) {
+    const codePoint = Number.parseInt(normalizedEntity.slice(2), 16);
+    return fromCodePoint(codePoint);
+  }
+  if (normalizedEntity.startsWith("#")) {
+    const codePoint = Number.parseInt(normalizedEntity.slice(1), 10);
+    return fromCodePoint(codePoint);
+  }
+  return htmlEntityMap[normalizedEntity] ?? `&${entity};`;
+};
+var stripHtmlToText = (html) => html.replace(/<style[\s\S]*?<\/style>/gi, " ").replace(/<script[\s\S]*?<\/script>/gi, " ").replace(/<!--[\s\S]*?-->/g, " ").replace(/<[^>]+>/g, " ").replace(/&(#\d+|#x[\da-f]+|[a-z][a-z0-9]+);/gi, (_, entity) => decodeHtmlEntity(entity)).replace(/[\u200B-\u200D\uFEFF]/g, "").replace(/\s+/g, " ").trim();
+var extractTextFromRichText = (richText, fallback = "Untitled") => {
+  const text = stripHtmlToText(richText?.html ?? "");
+  return text || fallback;
+};
+
 // ../validators/src/flow.ts
 var eventFlowDateAnswerSchema = exports_iso.date();
 var eventFlowDateTimeAnswerSchema = exports_iso.datetime({
@@ -7697,6 +7747,7 @@ var customFieldValidationSchema = object({
 });
 var customFieldBaseShape = {
   helpText: string2().trim().max(500).optional(),
+  hideLabel: boolean2().optional(),
   label: string2().trim().min(1).max(240),
   outputKey: flowIdentifierSchema,
   required: boolean2().default(false),
@@ -7903,9 +7954,16 @@ var defaultEventSeatChangeNotification = {
 };
 var eventSeatChangeNotificationSchema = object({
   body: string2().trim().max(1e4).default(""),
+  automatic: boolean2().optional(),
   enabled: boolean2().default(false),
   subject: string2().trim().max(240).default("")
 }).superRefine((notification, ctx) => {
+  if (notification.automatic && !notification.enabled)
+    ctx.addIssue({
+      code: "custom",
+      message: "Automatic seat-change notifications must be enabled.",
+      path: ["enabled"]
+    });
   if (notification.enabled && !notification.subject) {
     ctx.addIssue({
       code: "custom",
@@ -7921,7 +7979,115 @@ var eventSeatChangeNotificationSchema = object({
     });
   }
 });
+var getEventFlowConfirmationBodyText = (richText) => {
+  const text = (node) => {
+    if (node.type === "text")
+      return node.text ?? "";
+    if (node.type === "hardBreak")
+      return `
+`;
+    const content = (node.content ?? []).map(text).join("");
+    return ["paragraph", "heading", "listItem"].includes(node.type ?? "") ? `${content}
+` : content;
+  };
+  return text(richText.json).trim();
+};
+var confirmationBodyRichTextSchema = unknown().superRefine((value, ctx) => {
+  const ancestors = new Set;
+  const withinDepth = (nested, depth) => {
+    if (depth > 32)
+      return false;
+    if (typeof nested !== "object" || nested === null)
+      return true;
+    if (ancestors.has(nested))
+      return false;
+    ancestors.add(nested);
+    const valid = Object.values(nested).every((child) => withinDepth(child, depth + 1));
+    ancestors.delete(nested);
+    return valid;
+  };
+  let valid = withinDepth(value, 0);
+  try {
+    valid = valid && new TextEncoder().encode(JSON.stringify(value)).byteLength <= 250000;
+  } catch {
+    valid = false;
+  }
+  if (!valid)
+    ctx.addIssue({
+      code: "custom",
+      message: "Confirmation body is too large or nested too deeply"
+    });
+}).pipe(richTextJsonShape).superRefine((value, ctx) => {
+  const validNode = (node) => {
+    if (!node || typeof node !== "object" || !("type" in node) || typeof node.type !== "string")
+      return false;
+    if ("text" in node && typeof node.text !== "string")
+      return false;
+    if ("marks" in node && (!Array.isArray(node.marks) || !node.marks.every((mark) => mark && typeof mark === "object" && typeof mark.type === "string")))
+      return false;
+    return !("content" in node) || Array.isArray(node.content) && node.content.every(validNode);
+  };
+  if (!validNode(value.json) || value.json.type !== "doc") {
+    ctx.addIssue({
+      code: "custom",
+      message: "Confirmation body must be an editor document"
+    });
+    return;
+  }
+  const length = getEventFlowConfirmationBodyText(value).length;
+  if (length === 0 || length > 1e4)
+    ctx.addIssue({
+      code: "custom",
+      message: "Confirmation body must contain 1\u201310,000 characters"
+    });
+});
+var eventFlowConfirmationAttachmentContentTypes = [
+  "application/pdf",
+  "image/jpeg",
+  "image/png"
+];
+var maxEventFlowConfirmationAttachmentCount = 5;
+var maxEventFlowConfirmationAttachmentSize = 10 * 1024 * 1024;
+var maxEventFlowConfirmationAttachmentTotalSize = 15 * 1024 * 1024;
+var eventFlowConfirmationAttachmentFilenameSchema = string2().trim().min(1).max(120).regex(/^[^\\/:*?"<>|\r\n\t]+$/, "Attachment file names cannot contain path or control characters");
+var eventFlowConfirmationAttachmentSchema = strictObject({
+  byteSize: number2().int().positive().max(maxEventFlowConfirmationAttachmentSize),
+  contentType: _enum(eventFlowConfirmationAttachmentContentTypes),
+  filename: eventFlowConfirmationAttachmentFilenameSchema,
+  key: string2().trim().min(1).max(300)
+});
+var editableEmailCopySchema = (maxLength) => string2().trim().min(1).max(maxLength).nullable().optional();
+var eventFlowParticipantConfirmationEmailSchema = strictObject({
+  attachments: array(eventFlowConfirmationAttachmentSchema).max(maxEventFlowConfirmationAttachmentCount).default([]),
+  confirmationButtonLabel: editableEmailCopySchema(60),
+  eventLine: editableEmailCopySchema(500),
+  heading: editableEmailCopySchema(120),
+  includeCheckInQrCodes: boolean2().default(false),
+  showEventDetails: boolean2().default(true),
+  supportFooter: editableEmailCopySchema(1000)
+}).superRefine((email, ctx) => {
+  const totalSize = email.attachments.reduce((total, attachment) => total + attachment.byteSize, 0);
+  if (totalSize > maxEventFlowConfirmationAttachmentTotalSize) {
+    ctx.addIssue({
+      code: "custom",
+      message: "Confirmation attachments must total 15 MB or less",
+      path: ["attachments"]
+    });
+  }
+  const keys = new Set;
+  for (const [index, attachment] of email.attachments.entries()) {
+    if (keys.has(attachment.key)) {
+      ctx.addIssue({
+        code: "custom",
+        message: "Each confirmation attachment can be added only once",
+        path: ["attachments", index, "key"]
+      });
+    }
+    keys.add(attachment.key);
+  }
+});
 var participantConfirmationSchema = object({
+  email: eventFlowParticipantConfirmationEmailSchema.optional(),
   enabled: boolean2(),
   includeResponseDetails: boolean2().default(false),
   replyTo: email2().optional(),
@@ -7929,6 +8095,7 @@ var participantConfirmationSchema = object({
   supportEmail: email2(),
   templates: array(object({
     body: string2().trim().min(1).max(1e4),
+    bodyRichText: confirmationBodyRichTextSchema.optional(),
     outcomeId: eventFlowEntityIdSchema,
     subject: string2().trim().min(1).max(240)
   })).max(50)
@@ -9942,44 +10109,28 @@ var PUBLIC_EVENT_VALIDATED_FONT_FAMILIES = [
   "Zilla Slab Highlight"
 ];
 
-// ../../utils/src/rich-text.ts
-var richTextJsonShape = object({
-  json: custom(),
-  html: string2()
+// ../validators/src/registration-email-presentation.ts
+var registrationEmailPresentationSchema = strictObject({
+  layout: _enum(["DEFAULT", "GROUPED"]).default("DEFAULT"),
+  senderName: string2().trim().min(1).max(120).regex(/^[^<>\r\n]+$/).optional(),
+  introText: string2().trim().min(1).max(1e4).optional(),
+  menuDetailOutputKeys: array(string2().trim().min(1).max(120)).max(100).default([]),
+  submittedConsentOutputKeys: array(string2().trim().min(1).max(120)).max(100).default([]),
+  seatingDisclaimer: string2().trim().min(1).max(2000).optional(),
+  useResubmissionFooter: boolean2().default(false),
+  supportEmail: email2().optional(),
+  showLuckyDrawId: boolean2().optional()
 });
-var htmlEntityMap = {
-  amp: "&",
-  apos: "'",
-  cent: "\xA2",
-  copy: "\xA9",
-  emsp: " ",
-  ensp: " ",
-  gt: ">",
-  lt: "<",
-  nbsp: " ",
-  ndash: "\u2013",
-  quot: '"',
-  reg: "\xAE",
-  thinsp: " "
-};
-var decodeHtmlEntity = (entity) => {
-  const fromCodePoint = (codePoint) => Number.isInteger(codePoint) && codePoint >= 0 && codePoint <= 1114111 ? String.fromCodePoint(codePoint) : " ";
-  const normalizedEntity = entity.toLowerCase();
-  if (normalizedEntity.startsWith("#x")) {
-    const codePoint = Number.parseInt(normalizedEntity.slice(2), 16);
-    return fromCodePoint(codePoint);
-  }
-  if (normalizedEntity.startsWith("#")) {
-    const codePoint = Number.parseInt(normalizedEntity.slice(1), 10);
-    return fromCodePoint(codePoint);
-  }
-  return htmlEntityMap[normalizedEntity] ?? `&${entity};`;
-};
-var stripHtmlToText = (html) => html.replace(/<style[\s\S]*?<\/style>/gi, " ").replace(/<script[\s\S]*?<\/script>/gi, " ").replace(/<!--[\s\S]*?-->/g, " ").replace(/<[^>]+>/g, " ").replace(/&(#\d+|#x[\da-f]+|[a-z][a-z0-9]+);/gi, (_, entity) => decodeHtmlEntity(entity)).replace(/[\u200B-\u200D\uFEFF]/g, "").replace(/\s+/g, " ").trim();
-var extractTextFromRichText = (richText, fallback = "Untitled") => {
-  const text = stripHtmlToText(richText?.html ?? "");
-  return text || fallback;
-};
+
+// ../validators/src/registration-master-list-presentation.ts
+var outputKeysSchema = array(string2().min(1).max(160).regex(/^[A-Za-z][A-Za-z0-9_.:-]*$/)).max(100).refine((keys) => new Set(keys).size === keys.length, {
+  message: "Output keys must be unique"
+});
+var eventRegistrationMasterListSchema = object({
+  omittedOutputKeys: outputKeysSchema.default([]),
+  finalOutputKeys: outputKeysSchema.default([]),
+  showEligibilityCutoffInHeading: boolean2().default(false)
+}).strict().refine((config) => !config.finalOutputKeys.some((key) => config.omittedOutputKeys.includes(key)), { message: "Omitted output keys cannot also be final output keys" });
 
 // ../validators/src/event.ts
 var eventStatusSchema = _enum(EventStatus);
@@ -10296,7 +10447,10 @@ var eventTablePaginationSchema = object({
 var listEventInviteesInputSchema = organizationEventByIdInputSchema.extend({
   ...eventTablePaginationSchema.shape,
   audienceTierId: string2().min(1).nullable().optional(),
-  status: _enum(InviteeStatus).optional()
+  status: _enum(InviteeStatus).optional(),
+  statuses: array(_enum(InviteeStatus)).min(1).max(7).optional(),
+  cursor: string2().min(1).max(64).optional(),
+  direction: _enum(["NEXT", "PREVIOUS"]).default("NEXT")
 });
 var listEventRegistrationsInputSchema = organizationEventByIdInputSchema.extend({
   archive: _enum(["ACTIVE", "ARCHIVED", "ALL"]).default("ACTIVE"),
@@ -10474,6 +10628,8 @@ var updateEventRegistrationRulesInputSchema = setupStepScopeSchema.extend({
   capacityLimit: eventCapacityLimitSchema.nullable(),
   guestPolicy: guestPolicySchema,
   seatChangeNotification: eventSeatChangeNotificationSchema.optional(),
+  registrationEmail: registrationEmailPresentationSchema.optional(),
+  registrationMasterList: eventRegistrationMasterListSchema.optional(),
   waitlistEnabled: boolean2(),
   waitlistOfferTtlMinutes: number2().int().min(5).max(10080)
 }).refine((value) => !value.rsvpOpensAt || !value.rsvpClosesAt || value.rsvpOpensAt < value.rsvpClosesAt, {
@@ -10769,6 +10925,11 @@ var createEventFlowImageAssetUploadInputSchema = organizationEventByIdInputSchem
   byteSize: number2().int().positive().max(maxEventFlowImageAssetSize),
   mimeType: eventFlowImageAssetMimeTypeSchema
 });
+var createEventFlowConfirmationAttachmentUploadInputSchema = organizationEventByIdInputSchema.extend({
+  byteSize: number2().int().positive().max(maxEventFlowConfirmationAttachmentSize),
+  contentType: _enum(eventFlowConfirmationAttachmentContentTypes),
+  filename: eventFlowConfirmationAttachmentFilenameSchema
+});
 var finalizeEventFlowImageAssetInputSchema = organizationEventByIdInputSchema.extend({
   assetId: eventFlowImageAssetIdSchema
 });
@@ -10872,6 +11033,10 @@ var createEventFlowConsentVersionInputSchema = organizationEventByIdInputSchema.
 var setEventFlowGroupPasscodeInputSchema = organizationEventFlowInputSchema.extend({
   passcode: string2().trim().min(8).max(160)
 });
+var getEventFlowSeatCategoryColorsInputSchema = eventBySlugInputSchema.extend({
+  flowVersionId: flowVersionIdSchema,
+  seatMapId: flowVersionIdSchema
+}).strict();
 var issueEventFlowSeatHoldTokenInputSchema = eventBySlugInputSchema.extend({
   clientId: uuid2(),
   flowVersionId: flowVersionIdSchema,
@@ -11360,6 +11525,9 @@ var createPaymentCheckoutInputSchema = object({
   idempotencyKey: uuid2()
 });
 var getMyPaymentInputSchema = object({ eventSlug: eventSlugSchema });
+var getMyPaymentReceiptInputSchema = getMyPaymentInputSchema.extend({
+  paymentAttemptId: string2().min(1)
+});
 var listEventPaymentsInputSchema = eventScopeSchema4.extend({
   cursor: string2().min(1).optional(),
   limit: number2().int().min(1).max(100).default(50)
@@ -11862,6 +12030,9 @@ var publishSeatingDraftInputSchema = seatingDraftScopeSchema.extend({
   requestId: uuid2(),
   reason: string2().trim().min(1).max(500),
   sendSeatChangeEmail: boolean2().default(false),
+  seatChangeEmailRegistrationIds: array(string2().min(1)).max(100).refine((ids) => new Set(ids).size === ids.length, {
+    message: "Each recipient registration may appear only once."
+  }).optional(),
   seatHolds: array(object({
     registrationId: string2().min(1),
     holds: array(object({
@@ -11949,7 +12120,7 @@ var commands = {
     effects: [],
     operation: (api, input) => api.eventFlow.preview.query(input),
     payloadOnly: true,
-    summary: "Validate and preview an event flow, including date-limit messages (--payload JSON)."
+    summary: "Validate and preview an event flow, including date-limit messages; the definition is sent as a POST body (--payload JSON)."
   },
   "event flow draft get": {
     effects: [],
@@ -12304,6 +12475,7 @@ Object.assign(commands, {
   "audit list": payloadCommand((api, input) => api.audit.listEventActivity.query(input), "List event audit activity (--payload JSON).", ["sensitive-data"]),
   "event check-in qr": payloadCommand((api, input) => api.event.checkInByQr.mutate(input), "Check in using a QR token (--payload JSON).", ["state-change"]),
   "event flow image upload create": payloadCommand((api, input) => api.eventFlow.createImageAssetUpload.mutate(input), "Create an event-local registration-flow image upload URL (--payload JSON).", ["external-write", "state-change"], "eventId"),
+  "event flow confirmation attachment upload create": payloadCommand((api, input) => api.eventFlow.createConfirmationAttachmentUpload.mutate(input), "Create a confirmation-email attachment upload URL for a PDF, PNG or JPEG up to 10 MB (filename, contentType, byteSize); PUT the file there, then add the returned attachment to communications.participant.email.attachments (--payload JSON).", ["external-write", "state-change"], "eventId"),
   "event flow image finalize": payloadCommand((api, input) => api.eventFlow.finalizeImageAsset.mutate(input), "Finalize an event-local registration-flow image after the external upload (--payload JSON).", ["state-change"], "assetId"),
   "event logo upload create": payloadCommand((api, input) => api.event.createLogoUpload.mutate(input), "Create an event-logo upload URL (--payload JSON).", ["external-write", "state-change"], "eventId"),
   "event logo update": payloadCommand((api, input) => api.event.updateLogo.mutate(input), "Set or clear the event logo (--payload JSON).", ["state-change"], "eventId"),
@@ -12339,13 +12511,14 @@ Object.assign(commands, {
   "event seating occupants list": payloadCommand((api, input) => api.event.getLiveSeatingOccupants.query(input), "List permitted occupants by seatMapId, tableId, department, categoryValue and query; follow nextCursor (--payload JSON).", ["sensitive-data"]),
   "people registration edit get": payloadCommand((api, input) => api.event.getRegistrationForEdit.query(input), "Get current revision, permitted attendees, eligible seats and notification readiness; mode RESTORE loads seat maps and previous seats for a cancelled registration (--payload JSON).", ["sensitive-data"]),
   "people registration update": {
-    ...payloadCommand((api, input) => api.event.updateRegistration.mutate(input), "Save organizer edits with expectedVersion and reason; seating requires full-party seats and configured holds. Optional seatChangeNotice queues a seat-change notice atomically with a seat-only save (--payload JSON).", ["sensitive-data", "state-change"], "registrationId"),
+    ...payloadCommand((api, input) => api.event.updateRegistration.mutate(input), "Save organizer edits with expectedVersion and reason; seating requires full-party seats, configured holds and --allow-email because event policy may automatically queue notices. Optional seatChangeNotice queues a notice with a seat-only save (--payload JSON).", ["sensitive-data", "state-change"], "registrationId"),
     conditionalEffects: [
-      { effect: "email", whenPayloadField: "seatChangeNotice" }
+      { effect: "email", whenPayloadField: "seatChangeNotice" },
+      { effect: "email", whenPayloadField: "seats" }
     ]
   },
   "event seating swap": {
-    ...payloadCommand((api, input) => api.event.swapAttendeeSeats.mutate(input), "Swap the seats of two seated attendees in one save, given each attendee's current seatId and a reason. Optional seatChangeNotice queues a seat-change notice for each registration involved (--payload JSON).", ["sensitive-data", "state-change"]),
+    ...payloadCommand((api, input) => api.event.swapAttendeeSeats.mutate(input), "Swap the seats of two seated attendees in one save, given each attendee's current seatId and a reason. Requires --allow-email because event policy may automatically queue one notice per affected registration; optional seatChangeNotice also requests notices (--payload JSON).", ["sensitive-data", "state-change", "email"]),
     conditionalEffects: [
       { effect: "email", whenPayloadField: "seatChangeNotice" }
     ]
@@ -12363,7 +12536,7 @@ Object.assign(commands, {
   "event mine list": payloadCommand((api, input) => api.event.listMyEvents.query(input), "List the caller's events (--payload JSON)."),
   "event reminder list": payloadCommand((api, input) => api.event.listReminderSegments.query(input), "List reminder segments (--payload JSON).", ["sensitive-data"]),
   "event rsvp submit": payloadCommand((api, input) => api.event.submitRsvp.mutate(input), "Submit the caller's registration (--payload JSON).", ["sensitive-data", "state-change"]),
-  "event setup step update": payloadCommand((api, input) => api.event.updateSetupStep.mutate(input), "Update one event setup step (--payload JSON).", ["state-change"]),
+  "event setup step update": payloadCommand((api, input) => api.event.updateSetupStep.mutate(input), "Update one revision-checked event setup step (--payload JSON). REGISTRATION_RULES accepts registrationEmail presentation, registrationMasterList output-key ordering/omissions and seatChangeNotification automatic policy; omitted settings are preserved.", ["state-change"]),
   "event page update": payloadCommand((api, input) => api.event.updateSetupStep.mutate({
     ...input,
     section: "DETAILS_PAGE"
@@ -12376,6 +12549,7 @@ Object.assign(commands, {
 Object.assign(commands, {
   "payment event get": payloadCommand((api, input) => api.payment.getEventPayment.query(input), "Get event payment configuration (--payload JSON).", ["financial-write"]),
   "payment mine get": payloadCommand((api, input) => api.payment.getMyPayment.query(input), "Get the caller's payment with its saved subtotal, tax and final total breakdown (--payload JSON).", ["financial-write", "sensitive-data"]),
+  "payment mine receipt get": payloadCommand((api, input) => api.payment.getMyPaymentReceipt.query(input), "Get the provider's current hosted receipt link for the caller's captured payment attempt; receiptUrl is null when unavailable (--payload JSON).", ["financial-write", "sensitive-data"]),
   "payment event list": payloadCommand((api, input) => api.payment.listEventPayments.query(input), "List event payments with original quote and cumulative refunded subtotal/tax/total, including verified external refunds (--payload JSON).", ["financial-write", "sensitive-data"]),
   "payment exception list": payloadCommand((api, input) => api.payment.listPaymentExceptions.query(input), "List payment exceptions (--payload JSON).", ["financial-write", "sensitive-data"]),
   "payment exception resolve": payloadCommand((api, input) => api.payment.resolvePaymentException.mutate(input), "Resolve a payment exception (--payload JSON).", ["financial-write", "sensitive-data", "state-change"]),
@@ -12440,11 +12614,11 @@ Object.assign(commands, {
       "--expected-version": { key: "expectedVersion", type: "number" }
     },
     operation: (api, input) => api.event.getSeatingDraftPreview.query(getSeatingDraftPreviewInputSchema.parse(input)),
-    summary: "Check a saved draft against fresh live seats, grants and notification policy; --expected-version is required."
+    summary: "Check fresh seats, grants and notification policy. Returns noticeRecipients: one eligible/ineligible row per affected registration with grant-scoped names, never email addresses; --expected-version is required."
   },
   "event seating draft publish": {
     scope: "event",
-    effects: ["state-change"],
+    effects: ["state-change", "email"],
     targetKey: "eventId",
     conditionalEffects: [
       { effect: "email", whenPayloadField: "sendSeatChangeEmail" }
@@ -12456,7 +12630,7 @@ Object.assign(commands, {
     },
     validateInput: (input) => validateSeatingDraftInput(publishSeatingDraftInputSchema, input),
     operation: (api, input) => api.event.publishSeatingDraft.mutate(publishSeatingDraftInputSchema.parse(input)),
-    summary: "Atomically publish all draft changes with expectedVersion, UUID requestId and reason. Email defaults off; retries reuse the requestId and intent. Realtime-enabled free targets need per-registration seatHolds (--payload JSON)."
+    summary: "Atomically publish with expectedVersion, UUID requestId and reason. Optional seatChangeEmailRegistrationIds in --payload chooses exact affected eligible registration recipients; [] sends none, including automatic policy. Omit to retain sendSeatChangeEmail/event-policy behavior. Requires --allow-email. Retry the same requestId and exact recipient set. Realtime free targets need per-registration seatHolds."
   }
 });
 var getCommandManifest = () => ({

package/examples/amgen-rsvp-copy/README.md

@@ -76,3 +76,75 @@ rsvp event setup update \
 ```
 
 This command is documented for later use and was not executed for this task.
+
+## Receipt, master-list and automatic seat-change presentation (#1657)
+
+`registration-presentation-patch.json` is a **configuration fragment**, not an
+executable mutation payload. It contains reusable event settings with Amgen copy
+and confirmed output keys. No staff-exclusion filter is needed or included.
+
+After the compatible API/web/CLI release and **separate approval**, refresh the
+test event first. Build a `REGISTRATION_RULES` input for
+`rsvp event setup step update` with its current `organizationId`, `eventId`,
+`version: configurationVersion`, `rsvpOpensAt`, `rsvpClosesAt`, `dietaryClosesAt`,
+`capacityLimit`, `guestPolicy`, `waitlistEnabled` and
+`waitlistOfferTtlMinutes`. Merge the fragment's three top-level keys into that
+input; retain every other current setting. Do not send the fragment to the
+full `event setup update` endpoint. Review the exact payload before writing,
+read the same event back afterwards, and verify each key. Repeat independently
+for the official event only after test-event acceptance and approval. Do not
+reuse cached version numbers, event IDs or schedules. No commands in this
+section have been executed.
+
+- **Receipt:** `registrationEmail` groups check-in, Table Seating, Menu Selection
+  and other responses. The current presentation can update old receipts without
+  changing their saved form, outcome or answers. Accepted `indemnityAccepted`
+  displays “Submitted”; false/missing values do not become accepted. Saved
+  `confirmation.showLuckyDrawId: false` remains authoritative; the event may
+  additionally hide IDs, but cannot reveal IDs a saved form hid. The display name
+  becomes “ASM DND Registration” while retaining the configured verified sender
+  address/domain. The one footer derives the event's current registration URL
+  and named form slug at delivery, so the test event cannot point to the official
+  form by copying an example URL. This fragment replaces the old free-text body
+  with one short introduction, avoiding duplicate acknowledgement/footer copy.
+- **Export:** `registrationMasterList.omittedOutputKeys: ["menu:diet"]` omits only
+  the derived Vegetarian/non-vegetarian classification. The actual employee/guest
+  menus and dietary answers remain. `finalOutputKeys: ["indemnityAccepted"]`
+  moves consent after operational columns. The cutoff heading uses the event's
+  existing lucky-draw cutoff/timezone; this fragment does **not** change it. The
+  cached approved cutoff is 27 November 2026, 8pm Asia/Singapore; verify it afresh.
+- **Automatic notices:** event metadata `seatChangeNotification.automatic: true`
+  deliberately enables the current policy for historical form versions too.
+  It does not migrate stored forms, responses, or seating. Draft publish and
+  direct committed organizer move/swap queue one minimal notice per affected
+  registration in the same transaction, regardless of a manual checkbox. The
+  current registration email and committed seats are re-read at delivery. A
+  failed/denied operation, no-op or non-seating edit does not queue a notice;
+  retries do not queue another notice for the same committed request. Existing
+  stale-version delivery suppression remains. Enabling this policy **does not
+  enqueue or resend anything retroactively**.
+
+The fragment's seat-change copy and subject are a proposed activation payload;
+review them before a live write. The support address `events@getout.sg` is
+confirmed. Sender/recipient/contact and active policy must be verified with a
+controlled test send only after separate email approval. Queue acceptance is
+not provider delivery.
+
+`confirmation.resend` permission is still required when an automatic notice
+would be queued. A seating edit without that permission fails atomically rather
+than silently skipping the notice. Registration-settings clients that omit the
+new `automatic` property retain the stored value; explicitly set `automatic:
+false` when turning the policy off. An automatic policy cannot be disabled merely
+by saving `enabled: false` without explicitly clearing `automatic`.
+
+CLI safety remains separate from the automatic policy: direct registration
+updates containing `seats`, all swaps, and all seating-draft publishes require
+`--allow-email` (or the existing interactive effects confirmation), even when
+`sendSeatChangeEmail` is false or omitted. This conservative guard also applies
+to events without automatic notices; the flag grants approval but does not
+itself enable sending. Non-seating profile/menu updates and saving or discarding
+a draft do not acquire an email effect.
+
+Production deployment, event configuration writes, live submissions/reseating,
+export jobs, resends and any real provider send require explicit approval and
+readback. Local HTML/XLSX and synthetic browser checks are not live acceptance.

package/examples/amgen-rsvp-copy/registration-presentation-patch.json

@@ -0,0 +1,29 @@
+{
+	"registrationEmail": {
+		"layout": "GROUPED",
+		"senderName": "ASM DND Registration",
+		"introText": "Thank you for your response.",
+		"menuDetailOutputKeys": [
+			"hasDietaryRestrictions",
+			"dietaryRestrictions",
+			"guestHasDietaryRestrictions",
+			"guestDietaryRestrictions"
+		],
+		"submittedConsentOutputKeys": ["indemnityAccepted"],
+		"seatingDisclaimer": "Table seating is subject to changes based on the discretion of the organisation committee, due to seating capacity and to accommodate all guests.",
+		"useResubmissionFooter": true,
+		"supportEmail": "events@getout.sg",
+		"showLuckyDrawId": false
+	},
+	"registrationMasterList": {
+		"omittedOutputKeys": ["menu:diet"],
+		"finalOutputKeys": ["indemnityAccepted"],
+		"showEligibilityCutoffInHeading": true
+	},
+	"seatChangeNotification": {
+		"automatic": true,
+		"enabled": true,
+		"subject": "ASM Dinner and Dance 2026 — seating updated",
+		"body": "Your table seating for ASM Dinner and Dance 2026 has been updated. Please refer to your current seat assignments below.\n\nTable seating is subject to changes based on the discretion of the organisation committee, due to seating capacity and to accommodate all guests.\n\nFor further queries, please contact events@getout.sg."
+	}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@go-labs-sg/rsvp",
-  "version": "1.2.0",
+  "version": "1.4.0",
   "description": "RSVP CLI for authorized event operations.",
   "type": "module",
   "main": "./dist/index.js",