@go-labs-sg/rsvp 1.7.0 → 1.9.0

package/README.md

@@ -85,6 +85,30 @@ The installed command uses the same portable Bun launcher as the other Go Labs C
 
 Global administrators can update another account's global role from the web user manager or with `rsvp user role update --allow-state-change --target <user-id> --payload '{"userId":"<user-id>","role":"admin"}'`. Administrators cannot remove their own global admin role.
 
+## Participant waitlist offers
+
+```sh
+rsvp waitlist mine --ack-sensitive-data --payload '{"eventSlug":"event-slug","formSlug":"form-slug"}'
+rsvp waitlist offer respond --allow-state-change --target 11111111-1111-4111-8111-111111111111 --payload '{"eventSlug":"event-slug","formSlug":"form-slug","action":"DECLINE","expectedRegistrationVersion":3,"idempotencyKey":"11111111-1111-4111-8111-111111111111"}'
+```
+
+`formSlug` is optional. Both commands forward typed JSON to the shared participant
+tRPC handlers; there is no CLI-specific selection or cancellation logic. `mine`
+returns the unique active registration, or `registration: null` when only history
+remains, with the existing time-zone field. `offer respond` accepts `ACCEPT` or
+`DECLINE` and retains its payment/registration ID/version/status JSON output.
+Obtain the expected version from `mine` and generate a fresh UUID for a new action;
+reuse the exact same payload/key only when retrying that action. Keep the existing
+sensitive-data acknowledgement and state-change/target guards.
+
+Decline closes the live offer and releases active ownership, credentials and
+remaining reservations atomically, while preserving response/audit history. An
+identical retry remains a read-only receipt replay even after cancellation or a
+fresh registration; changed payloads using the same key conflict. Historical rows
+are never used as a current offer. Registration-again recovery still requires the
+existing organizer archive/unarchive policy, not automatic readmission or restore.
+No command, payload schema, effect guard, provider action or data repair is added.
+
 ## Personal seating drafts
 
 `event seating draft get`, `save`, `preview`, and `publish` use the same server-owned
@@ -776,6 +800,50 @@ population. Non-operational statuses remain excluded, and permissions, payment
 gates, duplicate protection, and undo behavior are unchanged. The web panel's
 realtime connection and manual refresh controls do not add a CLI subscription.
 
+### GOSH teams from check-in
+
+A registration form can create a GOSH team and route the first time anyone
+from the registration checks in. The first email is the registrant (captain);
+the rest come from each attendee's email answer, in attendee order. RSVP saves
+the request with the check-in and the worker sends it to GOSH afterwards, so
+check-in never waits on GOSH. The crew screen shows **Pending team
+assignment**, then the route and team name, or a failure to follow up.
+
+The binding is off by default. Set it up in GOSH first (`gosh rsvp-check-in
+binding set`), then link the RSVP form to the GOSH binding ID:
+
+```sh
+rsvp check-in gosh binding set \
+  --allow-state-change \
+  --target form_123 \
+  --payload '{"organizationId":"org_123","eventId":"evt_123","flowId":"form_123","goshBindingId":"gosh_binding_id","memberEmailOutputKey":"teammate_email","enabled":true}'
+rsvp check-in gosh list --payload '{"organizationId":"org_123","eventId":"evt_123","filter":"DELIVERY_FAILED"}'
+rsvp check-in gosh retry --allow-state-change --target reg_123 \
+  --payload '{"organizationId":"org_123","eventId":"evt_123","registrationId":"reg_123"}'
+rsvp check-in gosh reconcile --allow-state-change --target evt_123 \
+  --payload '{"organizationId":"org_123","eventId":"evt_123","dryRun":false,"retryFailed":true}'
+```
+
+The worker needs `RSVP_GOSH_API_URL`, `RSVP_GOSH_CHECK_IN_KEY_ID` and
+`RSVP_GOSH_CHECK_IN_SECRET` (the same `whsec_` secret GOSH holds under that key
+ID). Without them, deliveries fail with a configuration error instead of
+retrying forever.
+
+- Only the first check-in of a registration sends a team. Teammates checking in
+  later, or at the same moment, do not create another team.
+- Undoing the last check-in keeps the GOSH team and route but flags it for
+  review. Checking in again reuses the same team.
+- Retry and reconcile reuse the same delivery ID, so GOSH returns the team it
+  already created. Reconcile defaults to `dryRun: true` and never rescans QR
+  codes or moves teams.
+- A registration without a registrant email is rejected with
+  `CAPTAIN_EMAIL_MISSING` instead of making a teammate captain. Add the email,
+  then retry.
+- Turning the binding off stops queued deliveries too; they show `PAUSED` and
+  attendance is kept. To resume, turn it back on, then run reconcile with
+  `"dryRun": false, "retryFailed": true`. Check-ins made while it was off are
+  picked up by the same reconcile.
+
 Set `registrationMasterList.includeAttendanceSheets: true` with an approved
 `event setup step update` (`section: "REGISTRATION_RULES"`) to add response-based
 **Attending**, **Not attending** (explicit declines only), and **All** tabs,
@@ -1109,6 +1177,24 @@ Confirmation and seat-change emails send from the server default
   `rsvp event email sender-domains`. Invalid local parts, a missing half of the
   pair or an unverified domain are rejected.
 
+### Pending check-in details
+
+While the check-in QR release is pending (scheduled or hidden), confirmation
+and resent confirmation emails show a "Check-in details" section with the
+release message and each attendee's name and type. Set
+`"showPendingCheckInDetails": false` in `registrationEmail` to omit that section
+when the event's own email copy already explains when QR codes arrive. Omitting
+the key, or setting `true`, keeps the section. After release the email shows
+check-in details, reference codes and attached QR codes as usual, whatever the
+setting. Seat-change emails have no check-in section and are unaffected.
+
+```sh
+rsvp event setup step update \
+  --allow-state-change \
+  --target evt_123 \
+  --payload '{"organizationId":"org_123","eventId":"evt_123","version":7,"section":"REGISTRATION_RULES","registrationEmail":{"layout":"GROUPED","showPendingCheckInDetails":false}}'
+```
+
 `registrationEmail` replaces the whole presentation object, so read the current
 event first and resend every key you want to keep. Reply-to and support email
 are unchanged. If a saved domain is later unverified in Resend, those emails

package/dist/index.js

@@ -10130,7 +10130,8 @@ var registrationEmailPresentationSchema = strictObject({
   seatingDisclaimer: string2().trim().min(1).max(2000).optional(),
   useResubmissionFooter: boolean2().default(false),
   supportEmail: email2().optional(),
-  showLuckyDrawId: boolean2().optional()
+  showLuckyDrawId: boolean2().optional(),
+  showPendingCheckInDetails: boolean2().optional()
 }).superRefine((value, ctx) => {
   if (Boolean(value.senderLocalPart) !== Boolean(value.senderDomain))
     ctx.addIssue({
@@ -11134,6 +11135,33 @@ var requestExportInputSchema = eventScopeSchema3.extend({
 var getExportDownloadInputSchema = eventScopeSchema3.extend({
   exportJobId: string2().min(1)
 });
+// ../validators/src/gosh-check-in.ts
+var id = string2().trim().min(1).max(128);
+var upsertGoshCheckInBindingInputSchema = organizationEventByIdInputSchema.extend({
+  enabled: boolean2(),
+  flowId: id,
+  goshBindingId: id,
+  memberEmailOutputKey: string2().trim().min(1).max(120).nullable()
+});
+var getGoshCheckInStatusInputSchema = organizationEventByIdInputSchema.extend({ registrationId: id });
+var listGoshCheckInSyncsInputSchema = organizationEventByIdInputSchema.extend({
+  cursor: id.optional(),
+  filter: _enum([
+    "ALL",
+    "PENDING",
+    "ASSIGNED",
+    "REJECTED",
+    "DELIVERY_FAILED",
+    "PAUSED"
+  ]).default("ALL"),
+  limit: number2().int().min(1).max(100).default(50)
+});
+var retryGoshCheckInDeliveryInputSchema = organizationEventByIdInputSchema.extend({ registrationId: id });
+var reconcileGoshCheckInInputSchema = organizationEventByIdInputSchema.extend({
+  dryRun: boolean2().default(true),
+  limit: number2().int().min(1).max(500).default(200),
+  retryFailed: boolean2().default(false)
+});
 // ../validators/src/workflow.ts
 var verifyRegistrationIdentityInputSchema = object({
   eventSlug: eventSlugSchema,
@@ -12273,6 +12301,42 @@ var commands = {
     payloadOnly: true,
     summary: "Check in by attendee reference (--payload JSON)."
   },
+  "check-in gosh binding list": {
+    effects: [],
+    operation: (api, input) => api.event.getGoshCheckInBindings.query(input),
+    payloadOnly: true,
+    summary: "List GOSH check-in team bindings for an event (--payload JSON). Requires event.manage."
+  },
+  "check-in gosh binding set": {
+    effects: ["state-change"],
+    operation: (api, input) => api.event.upsertGoshCheckInBinding.mutate(input),
+    payloadOnly: true,
+    summary: "Create or update the GOSH check-in team binding for a registration form: {organizationId, eventId, flowId, goshBindingId, memberEmailOutputKey, enabled} (--payload JSON). Disabled by default. Signing keys live in the RSVP worker environment, never in the binding."
+  },
+  "check-in gosh status": {
+    effects: [],
+    operation: (api, input) => api.event.getGoshCheckInStatus.query(input),
+    payloadOnly: true,
+    summary: "Show a registration's GOSH team route: NOT_CONFIGURED, PENDING, ASSIGNED, REJECTED, DELIVERY_FAILED, PAUSED or UNASSIGNED (--payload JSON). No emails are returned."
+  },
+  "check-in gosh list": {
+    effects: [],
+    operation: (api, input) => api.event.listGoshCheckInSyncs.query(input),
+    payloadOnly: true,
+    summary: "List registrations synced to GOSH teams with revision and status; filter ALL, PENDING, ASSIGNED, REJECTED, DELIVERY_FAILED or PAUSED (--payload JSON)."
+  },
+  "check-in gosh retry": {
+    effects: ["state-change"],
+    operation: (api, input) => api.event.retryGoshCheckInDelivery.mutate(input),
+    payloadOnly: true,
+    summary: "Requeue a registration's latest GOSH team assignment with the same webhook ID, so GOSH returns the stored team rather than creating another (--payload JSON)."
+  },
+  "check-in gosh reconcile": {
+    effects: ["state-change"],
+    operation: (api, input) => api.event.reconcileGoshCheckIn.mutate(input),
+    payloadOnly: true,
+    summary: "Find checked-in registrations missing a GOSH team assignment and enqueue them; retryFailed also requeues failed deliveries. dryRun defaults to true (--payload JSON)."
+  },
   "check-in manual": {
     effects: ["state-change"],
     operation: (api, input) => api.event.manualCheckIn.mutate(input),
@@ -12567,7 +12631,7 @@ Object.assign(commands, {
   "event mine list": payloadCommand((api, input) => api.event.listMyEvents.query(input), "List the caller's events (--payload JSON)."),
   "event reminder list": payloadCommand((api, input) => api.event.listReminderSegments.query(input), "List reminder segments (--payload JSON).", ["sensitive-data"]),
   "event rsvp submit": payloadCommand((api, input) => api.event.submitRsvp.mutate(input), "Submit the caller's registration (--payload JSON).", ["sensitive-data", "state-change"]),
-  "event setup step update": payloadCommand((api, input) => api.event.updateSetupStep.mutate(input), "Update one revision-checked event setup step (--payload JSON). REGISTRATION_RULES accepts registrationEmail presentation (including senderName and a senderLocalPart+senderDomain address on a verified Resend sending domain), registrationMasterList output-key ordering/omissions and includeAttendanceSheets, and seatChangeNotification automatic/includeTablemates/includeFloorPlanImage policy (tablemate names default off; floor-plan image defaults on); omitted settings are preserved.", ["state-change"]),
+  "event setup step update": payloadCommand((api, input) => api.event.updateSetupStep.mutate(input), "Update one revision-checked event setup step (--payload JSON). REGISTRATION_RULES accepts registrationEmail presentation (including senderName, a senderLocalPart+senderDomain address on a verified Resend sending domain, and showPendingCheckInDetails: false to omit the confirmation email's Check-in details section until the check-in QR release; released QR emails are unaffected), registrationMasterList output-key ordering/omissions and includeAttendanceSheets, and seatChangeNotification automatic/includeTablemates/includeFloorPlanImage policy (tablemate names default off; floor-plan image defaults on); omitted settings are preserved.", ["state-change"]),
   "event page update": payloadCommand((api, input) => api.event.updateSetupStep.mutate({
     ...input,
     section: "DETAILS_PAGE"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@go-labs-sg/rsvp",
-  "version": "1.7.0",
+  "version": "1.9.0",
   "description": "RSVP CLI for authorized event operations.",
   "type": "module",
   "main": "./dist/index.js",