@robbeverhelst/do 1.300.0 → 1.302.0

package/dist/do.js

@@ -4438,6 +4438,20 @@ var documents = pgTable("documents", {
   createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
   updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
 }, (t) => [index("documents_tenant_kind_idx").on(t.tenantId, t.kind)]);
+var paperShares = pgTable("paper_shares", {
+  id: text("id").primaryKey(),
+  tenantId: text("tenant_id").notNull().references(() => tenants.id),
+  userId: text("user_id").notNull().references(() => users.id),
+  label: text("label").notNull(),
+  nodeIds: text("node_ids").array().notNull().default(sql`'{}'::text[]`),
+  snapshot: jsonb("snapshot").notNull(),
+  tokenHash: text("token_hash").notNull().unique(),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  revokedAt: timestamp("revoked_at", { withTimezone: true }),
+  opens: integer("opens").notNull().default(0),
+  lastOpenedAt: timestamp("last_opened_at", { withTimezone: true }),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (t) => [index("paper_shares_user_idx").on(t.tenantId, t.userId, t.createdAt)]);
 
 // ../../packages/schema/src/db/incidents.ts
 var incidentKind = pgEnum("incident_kind", [
@@ -5222,6 +5236,7 @@ var rsvpLinks = pgTable("rsvp_links", {
   tokenHash: text("token_hash").notNull().unique(),
   mode: rsvpLinkMode("mode").notNull().default("full"),
   tokenSealed: text("token_sealed"),
+  shortCodeHash: text("short_code_hash").unique(),
   expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
   revokedAt: timestamp("revoked_at", { withTimezone: true }),
   lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
@@ -6038,6 +6053,12 @@ var healthLabAnalytes = pgTable("health_lab_analytes", {
   note: text("note"),
   updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
 }, (t) => [primaryKey({ columns: [t.tenantId, t.userId, t.analyte] })]);
+var healthDataKeys = pgTable("health_data_keys", {
+  tenantId: text("tenant_id").notNull().references(() => tenants.id),
+  userId: text("user_id").notNull().references(() => users.id),
+  sealedKey: text("sealed_key").notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (t) => [primaryKey({ columns: [t.tenantId, t.userId] })]);
 
 // ../../packages/schema/src/db/journal.ts
 var journalDayStatus = pgEnum("journal_day_status", ["open", "summarised", "reviewed"]);
@@ -22455,6 +22476,28 @@ var houseUpkeepYearSchema = object({
 });
 var houseUpkeepYearQuerySchema = object({ year: exports_coerce.number().int().min(2000).max(2100).optional() }).strict();
 
+// ../../packages/schema/src/receipt-kinds.ts
+var MONEY_RECEIPT_NODE_TYPE = "money_transaction";
+var RECEIPT_KINDS = {
+  document: { about: [] },
+  health_episode: { about: ["red_flags"] },
+  journal_day: { about: ["saved"] },
+  time_block: { about: [] },
+  meal_log: { about: [] },
+  collection_item: { about: [] },
+  person_note: { about: [] },
+  health_encounter: { about: [] },
+  animal: { about: ["vet_visit"] },
+  [MONEY_RECEIPT_NODE_TYPE]: { about: ["ask", "bill"] },
+  planning_rule: { about: [] }
+};
+var NODE_RECEIPT_ABOUT_VALUES = [
+  ...RECEIPT_KINDS.health_episode.about,
+  ...RECEIPT_KINDS.journal_day.about,
+  ...RECEIPT_KINDS.animal.about
+];
+var MONEY_RECEIPT_ABOUT_VALUES = RECEIPT_KINDS[MONEY_RECEIPT_NODE_TYPE].about;
+
 // ../../packages/schema/src/contracts/agent-chat.ts
 var agentConnectionSourceSchema = _enum2(["space", "env"]);
 var agentGatewayStatusSchema = _enum2(["connected", "offline", "not_connected"]);
@@ -22691,7 +22734,7 @@ var postRunSchema = object({
   status: runStatusSchema,
   steps: array(runStepSchema).max(12).optional()
 });
-var POST_RECEIPT_ABOUT_VALUES = ["red_flags", "saved", "vet_visit"];
+var POST_RECEIPT_ABOUT_VALUES = NODE_RECEIPT_ABOUT_VALUES;
 var POST_RECEIPT_SOURCE_MAX = 80;
 var postNodeReceiptInputSchema = object({
   nodeId: ulidSchema,
@@ -22700,7 +22743,7 @@ var postNodeReceiptInputSchema = object({
   source: string2().trim().min(1).max(POST_RECEIPT_SOURCE_MAX).optional(),
   personNotes: array(ulidSchema).min(1).max(10).optional()
 }).strict();
-var POST_MONEY_RECEIPT_ABOUT_VALUES = ["ask", "bill"];
+var POST_MONEY_RECEIPT_ABOUT_VALUES = MONEY_RECEIPT_ABOUT_VALUES;
 var webUrlSchema = string2().url().max(2000).refine((url) => /^https?:\/\//i.test(url), "must be an http(s) link");
 var postMoneyReceiptInputSchema = object({
   transactionId: ulidSchema,
@@ -23178,6 +23221,14 @@ var updateHealthProfileInputSchema = object({
   primaryGpContactId: ulidSchema.nullish()
 }).strict();
 var grantHealthConsentInputSchema = object({ version: literal(HEALTH_CONSENT_VERSION) }).strict();
+var HEALTH_ERASE_PHRASE = "delete my health data";
+var eraseHealthDataInputSchema = object({ confirm: literal(HEALTH_ERASE_PHRASE) }).strict();
+var healthErasureSchema = object({
+  records: number2().int().nonnegative(),
+  files: number2().int().nonnegative(),
+  keyShredded: boolean3(),
+  consent: healthConsentStateSchema
+});
 var healthEpisodeListQuerySchema = object({
   status: healthEpisodeStatusSchema.optional()
 });
@@ -23442,7 +23493,8 @@ var FILE_SOURCES = [
   "doccle",
   "doccle_zip",
   "scan",
-  "game_save"
+  "game_save",
+  "google_photos"
 ];
 var fileSourceSchema = union([
   _enum2(FILE_SOURCES),
@@ -23615,6 +23667,20 @@ var journalSearchSchema = object({
   days: array(journalDayListItemSchema).max(JOURNAL_SEARCH_LIMIT),
   understood: journalSearchUnderstoodSchema.nullable().default(null)
 });
+var JOURNAL_LIKE_LIMIT = 10;
+var journalLikeQuerySchema = object({
+  limit: exports_coerce.number().int().min(1).max(JOURNAL_LIKE_LIMIT).default(5)
+});
+var journalLikeDaySchema = journalDayListItemSchema.extend({
+  shared: array(string2()),
+  sharedTags: array(string2())
+});
+var journalLikeSchema = object({
+  date: journalDateSchema,
+  timezone: string2().min(1),
+  words: array(string2()),
+  days: array(journalLikeDaySchema).max(JOURNAL_LIKE_LIMIT)
+});
 var journalLinkInputSchema = object({
   kind: string2().trim().regex(/^[a-z][a-z_]{0,31}$/, "a link kind is a short lowercase word"),
   nodeId: ulidSchema
@@ -27486,6 +27552,104 @@ var familyTreeMatchDecisionResultSchema = object({
   matches: array(familyTreeMatchViewSchema)
 });
 
+// ../../packages/schema/src/contracts/rsvp-questions.ts
+var RSVP_QUESTION_KINDS = ["choice", "multi", "text", "number", "yes_no"];
+var rsvpQuestionKindSchema = _enum2(RSVP_QUESTION_KINDS);
+var rsvpQuestionScopeSchema = _enum2(["household", "guest"]);
+var RSVP_QUESTION_PRESETS = ["diet", "diet_other", "message"];
+var rsvpQuestionPresetSchema = _enum2(RSVP_QUESTION_PRESETS);
+var RSVP_SHOW_IF_MAX = 5;
+var rsvpTextSchema = (max) => object({
+  nl: string2().trim().min(1).max(max).optional(),
+  pt: string2().trim().min(1).max(max).optional()
+}).strict().refine((t) => t.nl !== undefined || t.pt !== undefined, "give it in NL or PT");
+var keySchema = string2().regex(/^[a-z][a-z0-9_]{0,31}$/, "expected a short lower-case word (vegan, civil)");
+var rsvpQuestionOptionSchema = object({ key: keySchema, label: rsvpTextSchema(120) }).strict();
+var rsvpShowIfConditionSchema = union([
+  object({
+    questionId: ulidSchema,
+    equals: union([string2().max(200), number2(), boolean3()])
+  }).strict(),
+  object({ eventKey: keySchema.optional(), rsvp: literal("yes") }).strict()
+]);
+var rsvpAnswerValueSchema = union([
+  string2().max(2000),
+  array(string2().max(32)).max(20),
+  number2(),
+  boolean3()
+]);
+var rsvpQuestionSchema = createSelectSchema(rsvpQuestions, {
+  label: object({ nl: string2().optional(), pt: string2().optional() }),
+  options: array(object({
+    key: string2(),
+    label: object({ nl: string2().optional(), pt: string2().optional() })
+  })),
+  showIf: array(rsvpShowIfConditionSchema),
+  preset: rsvpQuestionPresetSchema.nullable(),
+  createdAt: exports_coerce.date(),
+  updatedAt: exports_coerce.date()
+});
+var rsvpAnswerSchema = createSelectSchema(rsvpAnswers, {
+  value: rsvpAnswerValueSchema,
+  createdAt: exports_coerce.date(),
+  updatedAt: exports_coerce.date()
+});
+function rsvpOptionsProblem(kind, options) {
+  if (kind === "choice" || kind === "multi") {
+    if (options.length < 2)
+      return `a ${kind} question needs two options or more`;
+    if (new Set(options.map((o) => o.key)).size !== options.length)
+      return "each option needs its own key";
+    return null;
+  }
+  return options.length > 0 ? `a ${kind} question has no options` : null;
+}
+var questionFields = {
+  label: rsvpTextSchema(300),
+  options: array(rsvpQuestionOptionSchema).max(30).optional(),
+  scope: rsvpQuestionScopeSchema.optional(),
+  eventKey: keySchema.nullish(),
+  required: boolean3().optional(),
+  sort: number2().int().min(0).max(1e4).optional(),
+  showIf: array(rsvpShowIfConditionSchema).max(RSVP_SHOW_IF_MAX).optional()
+};
+var createRsvpQuestionInputSchema = object({
+  id: ulidSchema,
+  guestListId: ulidSchema,
+  kind: rsvpQuestionKindSchema,
+  ...questionFields
+}).strict().superRefine((q, ctx) => {
+  const problem = rsvpOptionsProblem(q.kind, q.options ?? []);
+  if (problem)
+    ctx.addIssue({ code: "custom", message: problem, path: ["options"] });
+  if (q.showIf?.some((c) => ("questionId" in c) && c.questionId === q.id))
+    ctx.addIssue({
+      code: "custom",
+      message: "a question can't depend on itself",
+      path: ["showIf"]
+    });
+});
+var updateRsvpQuestionInputSchema = object(questionFields).partial().strict();
+var rsvpQuestionsQuerySchema = object({ guestListId: ulidSchema });
+var rsvpAnswerInputSchema = object({
+  questionId: ulidSchema,
+  guestId: ulidSchema.nullish(),
+  value: rsvpAnswerValueSchema.nullable()
+}).strict();
+var setRsvpAnswersInputSchema = object({
+  guestListId: ulidSchema,
+  householdId: ulidSchema,
+  answers: array(rsvpAnswerInputSchema).min(1).max(200)
+}).strict();
+var rsvpAnswersQuerySchema = object({
+  guestListId: ulidSchema,
+  householdId: ulidSchema.optional()
+});
+var addRsvpPresetsInputSchema = object({
+  guestListId: ulidSchema,
+  presets: array(_enum2(["diet", "message"])).min(1).max(2)
+}).strict();
+
 // ../../packages/schema/src/contracts/guests.ts
 var guestAnswerSchema = _enum2(["yes", "no", "maybe"]);
 var guestStateSchema = _enum2(["yes", "no", "maybe", "waiting"]);
@@ -27641,6 +27805,11 @@ var guestListOverviewSchema = object({
   })
 });
 var RSVP_TOKEN_RE = /^rsvp_[A-Za-z0-9_-]{43}$/;
+var RSVP_CODE_ALPHABET = "23456789ABCDEFGHJKMNPQRSTWXYZ";
+var RSVP_CODE_LENGTH = 6;
+var RSVP_CODE_RE = new RegExp(`^[${RSVP_CODE_ALPHABET}]{${RSVP_CODE_LENGTH}}$`);
+var resolveRsvpCodeInputSchema = object({ code: string2().max(32) }).strict();
+var resolvedRsvpCodeSchema = object({ token: string2().regex(RSVP_TOKEN_RE) });
 var RSVP_LINK_MODES = ["address", "full"];
 var rsvpLinkModeSchema = _enum2(RSVP_LINK_MODES);
 var rsvpLinkSchema = object({
@@ -27658,7 +27827,8 @@ var rsvpLinkSchema = object({
 });
 var mintedRsvpLinkSchema = rsvpLinkSchema.extend({
   token: string2().regex(RSVP_TOKEN_RE),
-  path: string2()
+  path: string2(),
+  shortCode: string2().regex(RSVP_CODE_RE).nullable()
 });
 var createRsvpLinksInputSchema = object({
   guestListId: ulidSchema,
@@ -27711,10 +27881,10 @@ var submitRsvpInputSchema = object({
     email: string2().trim().email().max(254).nullish()
   }).strict()).max(30).default([]),
   address: householdAddressSchema.nullish(),
-  language: rsvpLanguageSchema.optional()
-}).strict().refine((i) => i.guests.length > 0 || !!i.address || !!i.language, {
-  message: "nothing to send: answers, an address or a language"
-});
+  language: rsvpLanguageSchema.optional(),
+  answers: array(rsvpAnswerInputSchema).max(200).optional(),
+  dietConsent: boolean3().optional()
+}).strict().refine((i) => i.guests.length > 0 || (i.answers?.length ?? 0) > 0 || !!i.address || !!i.language, { message: "nothing to send: answers, an address or a language" });
 var eventTextSchema = (max) => object({
   nl: string2().trim().min(1).max(max).optional(),
   pt: string2().trim().min(1).max(max).optional()
@@ -27983,104 +28153,6 @@ var mailCampaignViewSchema = mailCampaignSchema.extend({
   readyToSend: boolean3()
 });
 
-// ../../packages/schema/src/contracts/rsvp-questions.ts
-var RSVP_QUESTION_KINDS = ["choice", "multi", "text", "number", "yes_no"];
-var rsvpQuestionKindSchema = _enum2(RSVP_QUESTION_KINDS);
-var rsvpQuestionScopeSchema = _enum2(["household", "guest"]);
-var RSVP_QUESTION_PRESETS = ["diet", "diet_other", "message"];
-var rsvpQuestionPresetSchema = _enum2(RSVP_QUESTION_PRESETS);
-var RSVP_SHOW_IF_MAX = 5;
-var rsvpTextSchema = (max) => object({
-  nl: string2().trim().min(1).max(max).optional(),
-  pt: string2().trim().min(1).max(max).optional()
-}).strict().refine((t) => t.nl !== undefined || t.pt !== undefined, "give it in NL or PT");
-var keySchema = string2().regex(/^[a-z][a-z0-9_]{0,31}$/, "expected a short lower-case word (vegan, civil)");
-var rsvpQuestionOptionSchema = object({ key: keySchema, label: rsvpTextSchema(120) }).strict();
-var rsvpShowIfConditionSchema = union([
-  object({
-    questionId: ulidSchema,
-    equals: union([string2().max(200), number2(), boolean3()])
-  }).strict(),
-  object({ eventKey: keySchema.optional(), rsvp: literal("yes") }).strict()
-]);
-var rsvpAnswerValueSchema = union([
-  string2().max(2000),
-  array(string2().max(32)).max(20),
-  number2(),
-  boolean3()
-]);
-var rsvpQuestionSchema = createSelectSchema(rsvpQuestions, {
-  label: object({ nl: string2().optional(), pt: string2().optional() }),
-  options: array(object({
-    key: string2(),
-    label: object({ nl: string2().optional(), pt: string2().optional() })
-  })),
-  showIf: array(rsvpShowIfConditionSchema),
-  preset: rsvpQuestionPresetSchema.nullable(),
-  createdAt: exports_coerce.date(),
-  updatedAt: exports_coerce.date()
-});
-var rsvpAnswerSchema = createSelectSchema(rsvpAnswers, {
-  value: rsvpAnswerValueSchema,
-  createdAt: exports_coerce.date(),
-  updatedAt: exports_coerce.date()
-});
-function rsvpOptionsProblem(kind, options) {
-  if (kind === "choice" || kind === "multi") {
-    if (options.length < 2)
-      return `a ${kind} question needs two options or more`;
-    if (new Set(options.map((o) => o.key)).size !== options.length)
-      return "each option needs its own key";
-    return null;
-  }
-  return options.length > 0 ? `a ${kind} question has no options` : null;
-}
-var questionFields = {
-  label: rsvpTextSchema(300),
-  options: array(rsvpQuestionOptionSchema).max(30).optional(),
-  scope: rsvpQuestionScopeSchema.optional(),
-  eventKey: keySchema.nullish(),
-  required: boolean3().optional(),
-  sort: number2().int().min(0).max(1e4).optional(),
-  showIf: array(rsvpShowIfConditionSchema).max(RSVP_SHOW_IF_MAX).optional()
-};
-var createRsvpQuestionInputSchema = object({
-  id: ulidSchema,
-  guestListId: ulidSchema,
-  kind: rsvpQuestionKindSchema,
-  ...questionFields
-}).strict().superRefine((q, ctx) => {
-  const problem = rsvpOptionsProblem(q.kind, q.options ?? []);
-  if (problem)
-    ctx.addIssue({ code: "custom", message: problem, path: ["options"] });
-  if (q.showIf?.some((c) => ("questionId" in c) && c.questionId === q.id))
-    ctx.addIssue({
-      code: "custom",
-      message: "a question can't depend on itself",
-      path: ["showIf"]
-    });
-});
-var updateRsvpQuestionInputSchema = object(questionFields).partial().strict();
-var rsvpQuestionsQuerySchema = object({ guestListId: ulidSchema });
-var rsvpAnswerInputSchema = object({
-  questionId: ulidSchema,
-  guestId: ulidSchema.nullish(),
-  value: rsvpAnswerValueSchema.nullable()
-}).strict();
-var setRsvpAnswersInputSchema = object({
-  guestListId: ulidSchema,
-  householdId: ulidSchema,
-  answers: array(rsvpAnswerInputSchema).min(1).max(200)
-}).strict();
-var rsvpAnswersQuerySchema = object({
-  guestListId: ulidSchema,
-  householdId: ulidSchema.optional()
-});
-var addRsvpPresetsInputSchema = object({
-  guestListId: ulidSchema,
-  presets: array(_enum2(["diet", "message"])).min(1).max(2)
-}).strict();
-
 // ../../packages/schema/src/contracts/google-contacts.ts
 var googleContactsModeSchema = _enum2(["off", "fake", "live"]);
 var googleContactsStatusSchema = object({
@@ -29514,6 +29586,102 @@ function toCollectionTypeSummary(config) {
 }
 var COLLECTION_TYPE_SUMMARIES = COLLECTION_TYPE_LIST.map(toCollectionTypeSummary);
 
+// ../../packages/schema/src/operations/define.ts
+function defineOperations(table) {
+  return table;
+}
+var PUBLIC_API_PREFIX = "/api/v1";
+function pathOf(op, params = {}) {
+  return op.path.replace(/\{([A-Za-z0-9_]+)\}/g, (_, name) => {
+    const value = params[name];
+    if (value === undefined)
+      throw new Error(`pathOf: no value for {${name}} in ${op.path}`);
+    return encodeURIComponent(value);
+  });
+}
+function routeOf(op) {
+  return `${op.method.toUpperCase()} ${PUBLIC_API_PREFIX}${op.path}`;
+}
+
+// ../../packages/schema/src/operations/tap-tags.ts
+var READ = ["habits:read", "routines:read"];
+var WRITE = ["habits:write", "routines:write"];
+var pathParams = { id: "The tag's id: the ULID the sticker's link carries (`/t/{id}`)." };
+var tapTagOperations = defineOperations({
+  list: {
+    method: "get",
+    path: "/tap-tags",
+    scopes: READ,
+    tag: "Habits",
+    summary: "List tap tags",
+    description: "The Space's NFC stickers: where each is (`label`), what a tap does (`habit`: check it in; `routine`: mark today's run done), its target's title and its link's `path`.",
+    status: 200,
+    response: { description: "Every tag.", list: true },
+    errors: { 403: true }
+  },
+  create: {
+    method: "post",
+    path: "/tap-tags",
+    scopes: WRITE,
+    tag: "Habits",
+    summary: "Make a tap tag",
+    description: "Bind a new sticker id (a client-minted ULID) to a live habit or routine of the Space, of the tag's kind. Write `https://<your do>/t/{id}` onto an NFC sticker.",
+    body: createTapTagInputSchema,
+    status: 201,
+    response: { description: "The tag." },
+    errors: { 400: true, 403: true }
+  },
+  get: {
+    method: "get",
+    path: "/tap-tags/{id}",
+    pathParams,
+    scopes: READ,
+    tag: "Habits",
+    summary: "Get a tap tag",
+    description: "One tag.",
+    status: 200,
+    response: { description: "The tag." },
+    errors: { 404: true }
+  },
+  update: {
+    method: "patch",
+    path: "/tap-tags/{id}",
+    pathParams,
+    scopes: WRITE,
+    tag: "Habits",
+    summary: "Rename or rebind a tap tag",
+    description: "Change its `label`, or bind it to another habit or routine (`kind` and `targetId` together): the sticker stays as it is.",
+    body: updateTapTagInputSchema,
+    status: 200,
+    response: { description: "The tag." },
+    errors: { 400: true, 404: true }
+  },
+  remove: {
+    method: "delete",
+    path: "/tap-tags/{id}",
+    pathParams,
+    scopes: WRITE,
+    tag: "Habits",
+    summary: "Delete a tap tag",
+    description: "The sticker's link stops doing anything.",
+    status: 204,
+    response: { description: "Deleted." },
+    errors: { 404: true }
+  },
+  tap: {
+    method: "post",
+    path: "/tap-tags/{id}/tap",
+    pathParams,
+    scopes: WRITE,
+    tag: "Habits",
+    summary: "Tap a tap tag",
+    description: "What the sticker does, as the key's member: check the habit in, or take today's run of the routine. Returns the receipt (`line`) and its `undo` (the check-in's `habitId` + `entryId`, or the run's `runId` + `stepRunIds` for `POST /routines/runs/{runId}/undo`). The same member's second tap within 30 s does nothing (`outcome: \"already\"`). The key must act for a member.",
+    status: 200,
+    response: { description: "The tap's receipt." },
+    errors: { 403: "A scope is missing, or the key acts for no member.", 404: true }
+  }
+});
+
 // ../../node_modules/ulidx/dist/node/index.js
 import crypto from "crypto";
 
@@ -29766,7 +29934,7 @@ function parseCapture2(input, now) {
 
 // src/meta.ts
 var CLI_NAME = "do";
-var VERSION = "1.300.0";
+var VERSION = "1.302.0";
 var API_PREFIX = "/api/v1";
 var DEFAULT_API_URL = "http://localhost:3001";
 
@@ -29995,7 +30163,7 @@ function resolveConfig(io, flags) {
 }
 
 // src/contacts-commands.ts
-var WRITE = ["contacts:write"];
+var WRITE2 = ["contacts:write"];
 var FIELD_FLAGS = [
   { name: "name", type: "string", description: "The display name (or pass it as the argument)." },
   { name: "kind", type: "string", description: "person (the default) or organization." },
@@ -30038,7 +30206,7 @@ var CONTACT_COMMAND_SPECS = [
     summary: "Add a contact: a person or an organisation, with their details.",
     args: [{ name: "name", required: false, description: "The display name." }],
     flags: FIELD_FLAGS,
-    scopes: WRITE,
+    scopes: WRITE2,
     returns: "ContactView",
     notes: 'Flags build a CreateContactInput; --data adds any other field (a flag wins). The id is minted when omitted. e.g. `do contacts create "Sam Peters" --email sam@example.com --birthday 1990-04-12 --circles <id>`.'
   },
@@ -30047,7 +30215,7 @@ var CONTACT_COMMAND_SPECS = [
     summary: "Change a contact's details.",
     args: [{ name: "id", required: true, description: "The contact's id." }],
     flags: FIELD_FLAGS,
-    scopes: WRITE,
+    scopes: WRITE2,
     returns: "ContactView",
     notes: "Only the flags you pass change. `none` clears a field (--email none, --birthday none). --birthday keeps the contact's other dates; --roles, --circles and --tags replace the list (a role it already has keeps its details)."
   }
@@ -30152,11 +30320,43 @@ var DUE_BEFORE_FLAG = {
   description: "only rows due strictly before this instant (ISO 8601 or YYYY-MM-DD)",
   query: "dueBefore"
 };
+function entityFromOperations(ops, spec) {
+  const path = ops.list.path;
+  const sameScopes = (a, b) => [...a.scopes].sort().join() === [...b.scopes].sort().join();
+  const reads = [ops.list, ops.get].filter((op) => op !== undefined);
+  const writes = [ops.create, ops.update, ops.remove].filter((op) => op !== undefined);
+  const problems = [
+    ...[ops.create].filter((op) => op && (op.method !== "post" || op.path !== path)),
+    ...[ops.get, ops.update, ops.remove].filter((op) => op && op.path !== `${path}/{id}`),
+    ...reads.filter((op) => !sameScopes(op, ops.list)),
+    ...writes.filter((op) => writes[0] && !sameScopes(op, writes[0]))
+  ];
+  if (problems.length > 0) {
+    throw new Error(`entityFromOperations(${spec.name}): ${problems.map((op) => op?.summary).join("; ")} don't fit the entity verbs`);
+  }
+  const [firstWrite] = writes;
+  return {
+    name: spec.name,
+    path,
+    readScopes: [...ops.list.scopes],
+    returns: spec.returns,
+    canGet: ops.get !== undefined,
+    listFlags: spec.listFlags,
+    ...firstWrite ? {
+      write: {
+        scopes: [...firstWrite.scopes],
+        ...ops.create ? { createSchema: ops.create.body, createInput: spec.createInput } : {},
+        ...ops.update ? { updateSchema: ops.update.body, updateInput: spec.updateInput } : {},
+        canDelete: ops.remove !== undefined
+      }
+    } : {}
+  };
+}
 var ENTITIES = [
   {
     name: "tasks",
     path: "/tasks",
-    readScope: "tasks:read",
+    readScopes: ["tasks:read"],
     returns: "Task",
     canGet: true,
     listFlags: [
@@ -30201,7 +30401,7 @@ var ENTITIES = [
       }
     ],
     write: {
-      scope: "tasks:write",
+      scopes: ["tasks:write"],
       createSchema: createTaskInputSchema,
       createInput: "CreateTaskInput",
       updateSchema: updateTaskInputSchema,
@@ -30212,7 +30412,7 @@ var ENTITIES = [
   {
     name: "habits",
     path: "/habits",
-    readScope: "habits:read",
+    readScopes: ["habits:read"],
     returns: "HabitSummary",
     canGet: true,
     listFlags: [
@@ -30224,7 +30424,7 @@ var ENTITIES = [
       }
     ],
     write: {
-      scope: "habits:write",
+      scopes: ["habits:write"],
       createSchema: createHabitInputSchema,
       createInput: "CreateHabitInput",
       updateSchema: updateHabitInputSchema,
@@ -30235,7 +30435,7 @@ var ENTITIES = [
   {
     name: "projects",
     path: "/projects",
-    readScope: "projects:read",
+    readScopes: ["projects:read"],
     returns: "ProjectView",
     canGet: true,
     listFlags: [
@@ -30248,7 +30448,7 @@ var ENTITIES = [
       DUE_BEFORE_FLAG
     ],
     write: {
-      scope: "projects:write",
+      scopes: ["projects:write"],
       createSchema: createProjectInputSchema,
       createInput: "CreateProjectInput",
       updateSchema: updateProjectInputSchema,
@@ -30259,7 +30459,7 @@ var ENTITIES = [
   {
     name: "areas",
     path: "/areas",
-    readScope: "areas:read",
+    readScopes: ["areas:read"],
     returns: "AreaView",
     canGet: true,
     listFlags: [
@@ -30272,7 +30472,7 @@ var ENTITIES = [
       { name: "archived", description: "only archived areas", query: "archived", sends: "true" }
     ],
     write: {
-      scope: "areas:write",
+      scopes: ["areas:write"],
       createSchema: createAreaInputSchema,
       createInput: "CreateAreaInput",
       updateSchema: updateAreaInputSchema,
@@ -30283,12 +30483,12 @@ var ENTITIES = [
   {
     name: "places",
     path: "/places",
-    readScope: "places:read",
+    readScopes: ["places:read"],
     returns: "PlaceView",
     canGet: true,
     listFlags: [],
     write: {
-      scope: "places:write",
+      scopes: ["places:write"],
       createSchema: createPlaceInputSchema,
       createInput: "CreatePlaceInput",
       updateSchema: updatePlaceInputSchema,
@@ -30299,12 +30499,12 @@ var ENTITIES = [
   {
     name: "routines",
     path: "/routines",
-    readScope: "routines:read",
+    readScopes: ["routines:read"],
     returns: "RoutineView",
     canGet: true,
     listFlags: [],
     write: {
-      scope: "routines:write",
+      scopes: ["routines:write"],
       createSchema: createRoutineInputSchema,
       createInput: "CreateRoutineInput",
       updateSchema: updateRoutineInputSchema,
@@ -30315,7 +30515,7 @@ var ENTITIES = [
   {
     name: "notes",
     path: "/notes",
-    readScope: "notes:read",
+    readScopes: ["notes:read"],
     returns: "Note",
     canGet: true,
     listFlags: [
@@ -30324,7 +30524,7 @@ var ENTITIES = [
       { name: "tag", description: "filter to notes carrying this tag", query: "tag" }
     ],
     write: {
-      scope: "notes:write",
+      scopes: ["notes:write"],
       createSchema: createNoteInputSchema,
       createInput: "CreateNoteInput",
       updateSchema: updateNoteInputSchema,
@@ -30335,7 +30535,7 @@ var ENTITIES = [
   {
     name: "contacts",
     path: "/contacts",
-    readScope: "contacts:read",
+    readScopes: ["contacts:read"],
     returns: "Contact",
     canGet: true,
     listFlags: [
@@ -30353,7 +30553,7 @@ var ENTITIES = [
       }
     ],
     write: {
-      scope: "contacts:write",
+      scopes: ["contacts:write"],
       createSchema: createContactInputSchema,
       createInput: "CreateContactInput",
       updateSchema: updateContactInputSchema,
@@ -30364,7 +30564,7 @@ var ENTITIES = [
   {
     name: "contact-moments",
     path: "/contact-moments",
-    readScope: "contacts:read",
+    readScopes: ["contacts:read"],
     returns: "ContactMomentView",
     canGet: true,
     listFlags: [
@@ -30375,7 +30575,7 @@ var ENTITIES = [
       { name: "limit", description: "at most this many, newest first", query: "limit" }
     ],
     write: {
-      scope: "contacts:write",
+      scopes: ["contacts:write"],
       createSchema: createContactMomentInputSchema,
       createInput: "CreateContactMomentInput",
       updateSchema: updateContactMomentInputSchema,
@@ -30386,7 +30586,7 @@ var ENTITIES = [
   {
     name: "gift-ideas",
     path: "/gift-ideas",
-    readScope: "contacts:read",
+    readScopes: ["contacts:read"],
     returns: "GiftIdeaView",
     canGet: true,
     listFlags: [
@@ -30403,7 +30603,7 @@ var ENTITIES = [
       }
     ],
     write: {
-      scope: "contacts:write",
+      scopes: ["contacts:write"],
       createSchema: createGiftIdeaInputSchema,
       createInput: "CreateGiftIdeaInput",
       updateSchema: updateGiftIdeaInputSchema,
@@ -30414,12 +30614,12 @@ var ENTITIES = [
   {
     name: "circles",
     path: "/circles",
-    readScope: "contacts:read",
+    readScopes: ["contacts:read"],
     returns: "CircleView",
     canGet: true,
     listFlags: [],
     write: {
-      scope: "contacts:write",
+      scopes: ["contacts:write"],
       createSchema: createCircleInputSchema,
       createInput: "CreateCircleInput",
       updateSchema: updateCircleInputSchema,
@@ -30430,12 +30630,12 @@ var ENTITIES = [
   {
     name: "contact-relations",
     path: "/contact-relations",
-    readScope: "contacts:read",
+    readScopes: ["contacts:read"],
     returns: "ContactRelation",
     canGet: true,
     listFlags: [{ name: "contact", description: "only this contact id", query: "contactId" }],
     write: {
-      scope: "contacts:write",
+      scopes: ["contacts:write"],
       createSchema: createContactRelationInputSchema,
       createInput: "CreateContactRelationInput",
       updateSchema: updateContactRelationInputSchema,
@@ -30446,7 +30646,7 @@ var ENTITIES = [
   {
     name: "households",
     path: "/households",
-    readScope: "contacts:read",
+    readScopes: ["contacts:read"],
     returns: "HouseholdView",
     canGet: true,
     listFlags: [
@@ -30457,7 +30657,7 @@ var ENTITIES = [
       }
     ],
     write: {
-      scope: "contacts:write",
+      scopes: ["contacts:write"],
       createSchema: createHouseholdInputSchema,
       createInput: "CreateHouseholdInput",
       updateSchema: updateHouseholdInputSchema,
@@ -30468,12 +30668,12 @@ var ENTITIES = [
   {
     name: "guest-lists",
     path: "/guest-lists",
-    readScope: "contacts:read",
+    readScopes: ["contacts:read"],
     returns: "GuestListView",
     canGet: true,
     listFlags: [{ name: "project", description: "only this project's list", query: "projectId" }],
     write: {
-      scope: "contacts:write",
+      scopes: ["contacts:write"],
       createSchema: createGuestListInputSchema,
       createInput: "CreateGuestListInput",
       updateSchema: updateGuestListInputSchema,
@@ -30484,14 +30684,14 @@ var ENTITIES = [
   {
     name: "guest-list-events",
     path: "/guest-list-events",
-    readScope: "contacts:read",
+    readScopes: ["contacts:read"],
     returns: "GuestListEvent",
     canGet: true,
     listFlags: [
       { name: "list", description: "the guest list's id (required)", query: "guestListId" }
     ],
     write: {
-      scope: "contacts:write",
+      scopes: ["contacts:write"],
       createSchema: createGuestListEventInputSchema,
       createInput: "CreateGuestListEventInput",
       updateSchema: updateGuestListEventInputSchema,
@@ -30502,14 +30702,14 @@ var ENTITIES = [
   {
     name: "guest-tables",
     path: "/guest-tables",
-    readScope: "contacts:read",
+    readScopes: ["contacts:read"],
     returns: "GuestTableView",
     canGet: true,
     listFlags: [
       { name: "list", description: "the guest list's id (required)", query: "guestListId" }
     ],
     write: {
-      scope: "contacts:write",
+      scopes: ["contacts:write"],
       createSchema: createGuestTableInputSchema,
       createInput: "CreateGuestTableInput",
       updateSchema: updateGuestTableInputSchema,
@@ -30520,14 +30720,14 @@ var ENTITIES = [
   {
     name: "rsvp-questions",
     path: "/rsvp-questions",
-    readScope: "contacts:read",
+    readScopes: ["contacts:read"],
     returns: "RsvpQuestion",
     canGet: true,
     listFlags: [
       { name: "list", description: "the guest list's id (required)", query: "guestListId" }
     ],
     write: {
-      scope: "contacts:write",
+      scopes: ["contacts:write"],
       createSchema: createRsvpQuestionInputSchema,
       createInput: "CreateRsvpQuestionInput",
       updateSchema: updateRsvpQuestionInputSchema,
@@ -30538,7 +30738,7 @@ var ENTITIES = [
   {
     name: "guests",
     path: "/guests",
-    readScope: "contacts:read",
+    readScopes: ["contacts:read"],
     returns: "GuestView",
     canGet: true,
     listFlags: [
@@ -30547,7 +30747,7 @@ var ENTITIES = [
       { name: "state", description: "yes, no, maybe or waiting (overall)", query: "state" }
     ],
     write: {
-      scope: "contacts:write",
+      scopes: ["contacts:write"],
       createSchema: createGuestInputSchema,
       createInput: "CreateGuestInput",
       updateSchema: updateGuestInputSchema,
@@ -30558,7 +30758,7 @@ var ENTITIES = [
   {
     name: "key-dates",
     path: "/key-dates",
-    readScope: "key-dates:read",
+    readScopes: ["key-dates:read"],
     returns: "KeyDateView",
     canGet: true,
     listFlags: [
@@ -30580,7 +30780,7 @@ var ENTITIES = [
       }
     ],
     write: {
-      scope: "key-dates:write",
+      scopes: ["key-dates:write"],
       createSchema: createKeyDateInputSchema,
       createInput: "CreateKeyDateInput",
       updateSchema: updateKeyDateInputSchema,
@@ -30591,7 +30791,7 @@ var ENTITIES = [
   {
     name: "documents",
     path: "/documents",
-    readScope: "documents:read",
+    readScopes: ["documents:read"],
     returns: "DocumentView",
     canGet: true,
     listFlags: [
@@ -30612,7 +30812,7 @@ var ENTITIES = [
       }
     ],
     write: {
-      scope: "documents:write",
+      scopes: ["documents:write"],
       createSchema: createDocumentInputSchema,
       createInput: "CreateDocumentInput",
       updateSchema: updateDocumentInputSchema,
@@ -30623,7 +30823,7 @@ var ENTITIES = [
   {
     name: "incidents",
     path: "/incidents",
-    readScope: "documents:read",
+    readScopes: ["documents:read"],
     returns: "IncidentView",
     canGet: true,
     listFlags: [
@@ -30635,7 +30835,7 @@ var ENTITIES = [
       }
     ],
     write: {
-      scope: "documents:write",
+      scopes: ["documents:write"],
       createSchema: createIncidentInputSchema,
       createInput: "CreateIncidentInput",
       updateSchema: updateIncidentInputSchema,
@@ -30646,7 +30846,7 @@ var ENTITIES = [
   {
     name: "periods",
     path: "/periods",
-    readScope: "periods:read",
+    readScopes: ["periods:read"],
     returns: "PeriodView",
     canGet: true,
     listFlags: [
@@ -30663,7 +30863,7 @@ var ENTITIES = [
       }
     ],
     write: {
-      scope: "periods:write",
+      scopes: ["periods:write"],
       createSchema: createPeriodInputSchema,
       createInput: "CreatePeriodInput",
       updateSchema: updatePeriodInputSchema,
@@ -30671,26 +30871,17 @@ var ENTITIES = [
       canDelete: true
     }
   },
-  {
+  entityFromOperations(tapTagOperations, {
     name: "tap-tags",
-    path: "/tap-tags",
-    readScope: "habits:read",
     returns: "TapTagView",
-    canGet: true,
     listFlags: [],
-    write: {
-      scope: "habits:write",
-      createSchema: createTapTagInputSchema,
-      createInput: "CreateTapTagInput",
-      updateSchema: updateTapTagInputSchema,
-      updateInput: "UpdateTapTagInput",
-      canDelete: true
-    }
-  },
+    createInput: "CreateTapTagInput",
+    updateInput: "UpdateTapTagInput"
+  }),
   {
     name: "animals",
     path: "/animals",
-    readScope: "animals:read",
+    readScopes: ["animals:read"],
     returns: "AnimalView",
     canGet: true,
     listFlags: [
@@ -30709,7 +30900,7 @@ var ENTITIES = [
       }
     ],
     write: {
-      scope: "animals:write",
+      scopes: ["animals:write"],
       createSchema: createAnimalInputSchema,
       createInput: "CreateAnimalInput",
       updateSchema: updateAnimalInputSchema,
@@ -30720,7 +30911,7 @@ var ENTITIES = [
   {
     name: "runs",
     path: "/runs",
-    readScope: "collections:read",
+    readScopes: ["collections:read"],
     returns: "RunView",
     canGet: true,
     listFlags: [
@@ -30733,7 +30924,7 @@ var ENTITIES = [
       { name: "theme", description: "only this theme pack (skyrim, pokemon, \u2026)", query: "theme" }
     ],
     write: {
-      scope: "collections:write",
+      scopes: ["collections:write"],
       createSchema: createRunInputSchema,
       createInput: "CreateRunInput",
       updateSchema: updateRunInputSchema,
@@ -30744,12 +30935,12 @@ var ENTITIES = [
   {
     name: "shopping-lists",
     path: "/shopping-lists",
-    readScope: "shopping:read",
+    readScopes: ["shopping:read"],
     returns: "ShoppingList",
     canGet: true,
     listFlags: [],
     write: {
-      scope: "shopping:write",
+      scopes: ["shopping:write"],
       createSchema: createShoppingListInputSchema,
       createInput: "CreateShoppingListInput",
       updateSchema: updateShoppingListInputSchema,
@@ -30760,12 +30951,12 @@ var ENTITIES = [
   {
     name: "inventory-items",
     path: "/inventory-items",
-    readScope: "inventory:read",
+    readScopes: ["inventory:read"],
     returns: "InventoryItem",
     canGet: true,
     listFlags: [],
     write: {
-      scope: "inventory:write",
+      scopes: ["inventory:write"],
       createSchema: createInventoryItemInputSchema,
       createInput: "CreateInventoryItemInput",
       updateSchema: updateInventoryItemInputSchema,
@@ -30776,12 +30967,12 @@ var ENTITIES = [
   {
     name: "recipes",
     path: "/recipes",
-    readScope: "meals:read",
+    readScopes: ["meals:read"],
     returns: "Recipe",
     canGet: true,
     listFlags: [],
     write: {
-      scope: "meals:write",
+      scopes: ["meals:write"],
       createSchema: createRecipeInputSchema,
       createInput: "CreateRecipeInput",
       updateSchema: updateRecipeInputSchema,
@@ -30792,12 +30983,12 @@ var ENTITIES = [
   {
     name: "meal-plans",
     path: "/meal-plans",
-    readScope: "meals:read",
+    readScopes: ["meals:read"],
     returns: "MealPlan",
     canGet: true,
     listFlags: [],
     write: {
-      scope: "meals:write",
+      scopes: ["meals:write"],
       createSchema: createMealPlanInputSchema,
       createInput: "CreateMealPlanInput",
       updateSchema: updateMealPlanInputSchema,
@@ -30808,7 +30999,7 @@ var ENTITIES = [
   {
     name: "occurrences",
     path: "/occurrences",
-    readScope: "occurrences:read",
+    readScopes: ["occurrences:read"],
     returns: "Occurrence",
     canGet: false,
     listFlags: [
@@ -30823,7 +31014,7 @@ var ENTITIES = [
   {
     name: "time-blocks",
     path: "/time-blocks",
-    readScope: "calendar:read",
+    readScopes: ["calendar:read"],
     returns: "TimeBlockView",
     canGet: true,
     listFlags: [
@@ -30835,7 +31026,7 @@ var ENTITIES = [
       { name: "kind", description: "only blocks of this kind: task, focus or life" }
     ],
     write: {
-      scope: "calendar:write",
+      scopes: ["calendar:write"],
       createSchema: createTimeBlockInputSchema,
       createInput: "CreateTimeBlockInput",
       updateSchema: updateTimeBlockInputSchema,
@@ -30846,12 +31037,12 @@ var ENTITIES = [
   {
     name: "block-templates",
     path: "/block-templates",
-    readScope: "calendar:read",
+    readScopes: ["calendar:read"],
     returns: "BlockTemplateView",
     canGet: true,
     listFlags: [],
     write: {
-      scope: "calendar:write",
+      scopes: ["calendar:write"],
       createSchema: createBlockTemplateInputSchema,
       createInput: "CreateBlockTemplateInput",
       updateSchema: updateBlockTemplateInputSchema,
@@ -30862,7 +31053,7 @@ var ENTITIES = [
   {
     name: "webhooks",
     path: "/webhooks",
-    readScope: "webhooks:read",
+    readScopes: ["webhooks:read"],
     returns: "WebhookSubscription",
     canGet: true,
     listFlags: []
@@ -30883,8 +31074,8 @@ function entityOperations(e) {
 }
 
 // src/health-commands.ts
-var READ = ["health:read"];
-var WRITE2 = ["health:write"];
+var READ2 = ["health:read"];
+var WRITE3 = ["health:write"];
 var DATA_FLAG = {
   name: "data",
   type: "string",
@@ -30898,7 +31089,7 @@ function recordSpecs(plural, singular, noun, returns, createInput, updateInput,
       summary: `List your health ${noun}s.`,
       args: [],
       flags: listFlags,
-      scopes: READ,
+      scopes: READ2,
       returns
     },
     {
@@ -30906,7 +31097,7 @@ function recordSpecs(plural, singular, noun, returns, createInput, updateInput,
       summary: `Show one health ${noun}.`,
       args: [id],
       flags: [],
-      scopes: READ,
+      scopes: READ2,
       returns
     },
     {
@@ -30914,7 +31105,7 @@ function recordSpecs(plural, singular, noun, returns, createInput, updateInput,
       summary: `Add a health ${noun} (--data '${createInput}').`,
       args: [],
       flags: [DATA_FLAG, ...addFlags],
-      scopes: WRITE2,
+      scopes: WRITE3,
       returns,
       notes: `Body: ${createInput}. Always private to you; subjectNodeId names who it is about (absent = you).`
     },
@@ -30923,7 +31114,7 @@ function recordSpecs(plural, singular, noun, returns, createInput, updateInput,
       summary: `Change a health ${noun} (--data '${updateInput}').`,
       args: [id],
       flags: [DATA_FLAG],
-      scopes: WRITE2,
+      scopes: WRITE3,
       returns,
       notes: `Body: ${updateInput}. null clears a field.`
     },
@@ -30932,7 +31123,7 @@ function recordSpecs(plural, singular, noun, returns, createInput, updateInput,
       summary: `Delete a health ${noun}.`,
       args: [id],
       flags: [],
-      scopes: WRITE2,
+      scopes: WRITE3,
       returns: "Deleted",
       notes: "Destructive: needs --allow-destructive. An Agent's delete waits on your confirmation."
     }
@@ -30944,7 +31135,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Show whether Health is on (only you turn it on or off, in do).",
     args: [],
     flags: [],
-    scopes: READ,
+    scopes: READ2,
     returns: "HealthConsentState",
     notes: "`granted` is on at today's consent text (`currentVersion`); `renewalNeeded` means you agreed to an older text, so writes wait until you agree again in do. `aiProvider` names who processes what the agent reads (null when this deployment names none)."
   },
@@ -30953,7 +31144,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Show your health profile: blood group, allergies, lifestyle, notes, emergency contact, GP.",
     args: [],
     flags: [],
-    scopes: READ,
+    scopes: READ2,
     returns: "HealthProfile"
   },
   {
@@ -30961,7 +31152,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Show your Medical ID: name, blood group, allergies, current medications, height, emergency contact.",
     args: [],
     flags: [],
-    scopes: READ,
+    scopes: READ2,
     returns: "HealthMedicalId",
     notes: "The few facts someone helping in an emergency needs. The emergency contact comes with their name and phone; a field not set is null. Each read by a key is logged for the member."
   },
@@ -30982,7 +31173,7 @@ var HEALTH_COMMAND_SPECS = [
         description: `Sex, in your words, for the doctor's page ("female"); "" clears it.`
       }
     ],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthProfile",
     notes: "Body: UpdateHealthProfileInput. An absent key keeps a field; null clears it. Lifestyle is `alcohol`, `smoking`, `exercise`, and `notes` anything else: the member's own words. Notes go on For the doctor's background; `sex` on its patient line."
   },
@@ -30991,7 +31182,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Log one health message: find or start the Episode, add a symptom and/or a dose.",
     args: [],
     flags: [DATA_FLAG],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthReceipt",
     notes: 'Body: LogHealthInput, e.g. {"episode":{"title":"Sprained ankle","bodyRegion":"ankle_l"},"symptom":{"symptom":"worse on the stairs","severity":6,"severityGuessed":true},"dose":{"medication":"Ibuprofen"}}. The receipt lists each part with a line, what was guessed, and its undo. With "thread":{"slug":"<agent>"} (only an agent key that converses) the receipt card is posted there too, and postId names it.'
   },
@@ -31000,7 +31191,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: `Correct a symptom entry and get a receipt (--data '{"bodyRegion":"ankle_l"}').`,
     args: [{ name: "entry", required: true, description: "The entry's id (its latest version)." }],
     flags: [DATA_FLAG],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthReceipt"
   },
   {
@@ -31011,7 +31202,7 @@ var HEALTH_COMMAND_SPECS = [
       { name: "trend", required: true, description: "better|same|worse, against yesterday." }
     ],
     flags: [],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthReceipt",
     notes: "One a day: a second check-in the same day corrects the first. The receipt carries its undo."
   },
@@ -31028,7 +31219,7 @@ var HEALTH_COMMAND_SPECS = [
         description: "Post the confirmation card in this thread (by slug); the agent's key only."
       }
     ],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthRedFlagsResult",
     notes: "Flags: fever, vomiting, black_stools, blood, weight_loss, night_pain, chest_pain, short_of_breath. Answers merge into those asked before; the Episode is marked checked today, and For the doctor shows it."
   },
@@ -31040,7 +31231,7 @@ var HEALTH_COMMAND_SPECS = [
       { name: "id", required: true, description: "The id from the receipt's undo." }
     ],
     flags: [],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthUndoResult",
     notes: "A POST, so an Agent's undo never waits on a confirmation."
   },
@@ -31049,7 +31240,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Find the open Episode a complaint belongs to, or start one (--data UpsertHealthEpisodeInput).",
     args: [],
     flags: [DATA_FLAG],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthEpisodeUpsert"
   },
   {
@@ -31059,7 +31250,7 @@ var HEALTH_COMMAND_SPECS = [
     flags: [
       { name: "episode", type: "string", description: "The Episode; default the latest open one." }
     ],
-    scopes: READ,
+    scopes: READ2,
     returns: "HealthSummary"
   },
   {
@@ -31082,7 +31273,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Your For-the-doctor links: sections, expiry, opens; never the secret.",
     args: [],
     flags: [],
-    scopes: READ,
+    scopes: READ2,
     returns: "HealthShare[]",
     notes: "Only the member makes a share, in do; a key can list and take one back."
   },
@@ -31091,7 +31282,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Take a For-the-doctor link back: it stops opening.",
     args: [{ name: "id", required: true, description: "The share's id." }],
     flags: [],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthShare"
   },
   ...recordSpecs("conditions", "condition", "condition", "HealthConditionView", "CreateHealthConditionInput", "UpdateHealthConditionInput"),
@@ -31109,7 +31300,7 @@ var HEALTH_COMMAND_SPECS = [
         description: 'Their role on it, in your words ("dermatologist").'
       }
     ],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthConditionView",
     notes: "A cared_by link (condition \u2192 contact). Adding one already on it sets the role. The condition's page, the Health home's Care team and For the doctor list them."
   },
@@ -31121,7 +31312,7 @@ var HEALTH_COMMAND_SPECS = [
       { name: "contact", required: true, description: "The Contact's id." }
     ],
     flags: [],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthConditionView",
     notes: "An Agent's removal waits on your confirmation, like a delete."
   },
@@ -31158,7 +31349,7 @@ var HEALTH_COMMAND_SPECS = [
       { name: "at", type: "string", description: "When it happened (ISO); defaults to now." },
       { name: "note", type: "string", description: "A free-text note." }
     ],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthSymptomEntry",
     notes: "An Agent's entry is source chat. For qualifiers, send --data with LogHealthSymptomInput."
   },
@@ -31174,7 +31365,7 @@ var HEALTH_COMMAND_SPECS = [
       }
     ],
     flags: [DATA_FLAG],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthSymptomEntry",
     notes: "Body: CorrectHealthSymptomInput; fields not named are copied. The history stays."
   },
@@ -31186,7 +31377,7 @@ var HEALTH_COMMAND_SPECS = [
       { name: "entry", required: true, description: "The entry's id." }
     ],
     flags: [],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "Deleted"
   },
   ...recordSpecs("visits", "visit", "visit", "HealthEncounterView", "CreateHealthEncounterInput", "UpdateHealthEncounterInput"),
@@ -31196,7 +31387,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "List the doses of a Medication, latest first.",
     args: [{ name: "med", required: true, description: "The Medication's id." }],
     flags: [],
-    scopes: READ,
+    scopes: READ2,
     returns: "HealthMedicationDose"
   },
   {
@@ -31210,7 +31401,7 @@ var HEALTH_COMMAND_SPECS = [
       { name: "at", type: "string", description: "When (ISO); defaults to now." },
       { name: "note", type: "string", description: "A free-text note." }
     ],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthMedicationDose"
   },
   {
@@ -31221,7 +31412,7 @@ var HEALTH_COMMAND_SPECS = [
       { name: "dose", required: true, description: "The dose's id." }
     ],
     flags: [DATA_FLAG],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthMedicationDose",
     notes: "Body: UpdateHealthDoseInput."
   },
@@ -31233,7 +31424,7 @@ var HEALTH_COMMAND_SPECS = [
       { name: "dose", required: true, description: "The dose's id." }
     ],
     flags: [],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "Deleted"
   },
   ...recordSpecs("labs", "lab", "lab draw", "HealthLabPanelView", "CreateHealthLabPanelInput", "UpdateHealthLabPanelInput"),
@@ -31255,7 +31446,7 @@ var HEALTH_COMMAND_SPECS = [
         description: "The file's media type, when its name doesn't say."
       }
     ],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthLabImportResult",
     notes: "The draw stays a draft (status draft, source import) until the member checks it; the report is kept as its original. A report with no lab value in it is a 422."
   },
@@ -31264,7 +31455,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "The canonical analytes: key, printed name, group, unit, LOINC and aliases.",
     args: [],
     flags: [],
-    scopes: READ,
+    scopes: READ2,
     returns: "LabAnalyteDef[]",
     notes: 'A result is written under the canonical key its analyte or name stands for ("ALAT" \u2192 alt, "25-OH vitamin D" \u2192 vitamin_d); a name that matches none keeps its slug and comes back in the draw\'s `unmatched`.'
   },
@@ -31279,7 +31470,7 @@ var HEALTH_COMMAND_SPECS = [
         description: "Required: only report, change nothing."
       }
     ],
-    scopes: READ,
+    scopes: READ2,
     returns: "HealthLabNormalizeReport",
     notes: "Nothing is rewritten: trends already read old keys as their canonical one. Lists each result's from \u2192 to, and the keys that match no canonical analyte."
   },
@@ -31288,7 +31479,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Every analyte your draws measured, each with its trend, grouped as a lab sheet.",
     args: [],
     flags: [],
-    scopes: READ,
+    scopes: READ2,
     returns: "HealthLabOverview"
   },
   {
@@ -31296,16 +31487,16 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Whether your Google Health is connected, the last sync, and what stops it.",
     args: [],
     flags: [],
-    scopes: READ,
+    scopes: READ2,
     returns: "GoogleHealthStatus",
-    notes: "GET /api/v1/health/google-health. Connecting needs Google's consent in a browser: Settings \u2192 Health in do. `failure` (reauth, not_linked, unavailable, other) says what stops the sync, with a title and a hint."
+    notes: "GET /api/v1/health/google-health. Connecting needs Google's consent in a browser: Settings \u2192 Health in do. `failure` (reauth, not_linked, unavailable, other) says what stops the sync, with a title and a hint. `nutrition` says whether your food is written back to Google Health (turned on in do; each settled day once, one entry per meal type) and the last day written."
   },
   {
     path: ["health", "google", "sync"],
     summary: "Sync your Google Health now (sleep, resting heart rate, HRV, steps, workouts), as the morning sync does.",
     args: [],
     flags: [],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "GoogleHealthSyncResult",
     notes: "POST /api/v1/health/google-health/sync. Written and skipped per resource, and the status after it; a sync that stops answers 200 with `status.failure`. 409 before Google Health is connected, 403 while the server has it switched off."
   },
@@ -31314,7 +31505,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "One analyte's trend across draws (do health analyte vitamin_d).",
     args: [{ name: "analyte", required: true, description: "The analyte key (vitamin_d)." }],
     flags: [],
-    scopes: READ,
+    scopes: READ2,
     returns: "HealthLabAnalyteView"
   },
   {
@@ -31322,7 +31513,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: `Keep a target band or the supplement for an analyte (--data '{"targetLow":40,"targetHigh":60}').`,
     args: [{ name: "analyte", required: true, description: "The analyte key (vitamin_d)." }],
     flags: [DATA_FLAG],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthLabAnalyteView",
     notes: "Body: SetHealthLabAnalyteInput. An absent key keeps a field; null clears it."
   }
@@ -31713,6 +31904,21 @@ var COMMAND_SPECS = [
     returns: "JournalRecall",
     notes: "GET /api/v1/journal/recall (journal_recall) \u2014 your own days only, dated so an answer can cite them; another member's days never answer. --around can't be combined with --from/--to. journal:read is a sensitive scope."
   },
+  {
+    path: ["journal", "like"],
+    summary: 'Days like this one: your other days that share the most with a day (its words, tags and rating), for "when did I feel like this before?".',
+    args: [{ name: "date", required: true, description: "The day, YYYY-MM-DD." }],
+    flags: [
+      {
+        name: "limit",
+        type: "string",
+        description: "At most this many days (1\u201310, 5 by default)."
+      }
+    ],
+    scopes: ["journal:read"],
+    returns: "JournalLike",
+    notes: "GET /api/v1/journal/days/{date}/like (journal_like) \u2014 your own days only, by Postgres full text over the one-liner, highlights, tags, summary and entries (the day's own words, with a few that mean the same), then shared tags and a close rating. Words, not meanings: no embeddings. A day hidden from memories is never offered. journal:read is a sensitive scope."
+  },
   {
     path: ["journal", "digest"],
     summary: "The last 7 days of your Journal as a short digest: each day's line and rating, and the milestones a week either side.",
@@ -32647,9 +32853,9 @@ var COMMAND_SPECS = [
     summary: "Tap a tag as if the phone read its sticker: check its habit in, or mark today's run of its routine done.",
     args: [{ name: "id", required: true, description: "The tag id (the ULID in /t/<id>)." }],
     flags: [],
-    scopes: ["habits:write", "routines:write"],
+    scopes: [...tapTagOperations.tap.scopes],
     returns: "TapResult",
-    notes: "POST /api/v1/tap-tags/{id}/tap. Acts as the key's member; a second tap within 30 s does nothing (outcome already). The receipt's undo names the check-in (DELETE /habits/{habitId}/entries/{entryId}) or the run's steps (POST /routines/runs/{runId}/undo)."
+    notes: `${routeOf(tapTagOperations.tap)}. Acts as the key's member; a second tap within 30 s does nothing (outcome already). The receipt's undo names the check-in (DELETE /habits/{habitId}/entries/{entryId}) or the run's steps (POST /routines/runs/{runId}/undo).`
   },
   {
     path: ["metrics", "list"],
@@ -35867,12 +36073,12 @@ var COMMAND_SPECS = [
   },
   {
     path: ["rsvp-links", "token"],
-    summary: "Show a live RSVP link again: the same token it was minted with.",
+    summary: "Show a live RSVP link again: the same token it was minted with, and a whole-form link's short code.",
     args: [{ name: "id", required: true, description: "The link's id." }],
     flags: [],
     scopes: ["contacts:write"],
     returns: "MintedRsvpLink",
-    notes: "The mail and the paper QR carry this one link. A revoked or expired link is gone; one minted before tokens were kept can't be shown: replace it."
+    notes: "The mail and the paper QR carry this one link; `shortCode` (six characters) is printed on the paper invitation and typed at the site's /code. A revoked or expired link is gone; one minted before tokens were kept can't be shown: replace it."
   },
   {
     path: ["rsvp-links", "replace"],
@@ -36249,8 +36455,8 @@ function buildManifest() {
       name: e.name,
       operations: entityOperations(e),
       path: `${API_PREFIX}${e.path}`,
-      readScope: e.readScope,
-      ...e.write ? { writeScope: e.write.scope } : {},
+      readScopes: e.readScopes,
+      ...e.write ? { writeScopes: e.write.scopes } : {},
       ...e.write?.createInput || e.write?.updateInput ? {
         inputs: {
           ...e.write.createInput ? { create: e.write.createInput } : {},
@@ -37388,6 +37594,24 @@ function renderJournalRecall(data, mode) {
   return out.join(`
 `);
 }
+function renderJournalLike(data, mode) {
+  const d = data;
+  const out = [paint(mode, "dim", `Like ${d.date ?? "this day"}: ${(d.words ?? []).join(" \xB7 ")}`)];
+  const days = d.days ?? [];
+  if (days.length === 0) {
+    out.push(paint(mode, "dim", "(no other day shares enough with it)"));
+    return out.join(`
+`);
+  }
+  for (const day of days) {
+    const rating = day.metrics?.rating;
+    const meta = rating === undefined ? "" : paint(mode, "dim", `  ${rating}/10`);
+    const shared = [...day.shared ?? [], ...(day.sharedTags ?? []).map((t) => `#${t}`)];
+    out.push(`${day.date}  ${day.title ?? paint(mode, "dim", "(no entry)")}${meta}${shared.length ? paint(mode, "dim", `  \xB7 ${shared.join(", ")}`) : ""}`);
+  }
+  return out.join(`
+`);
+}
 function renderJournalDigest(data) {
   return data.text ?? "";
 }
@@ -38569,6 +38793,18 @@ var HANDLERS = {
       render: renderJournalRecall
     };
   },
+  "journal like": async ({ args, flags, requireClient }) => {
+    const [date] = args;
+    if (!date)
+      throw usageError("journal like needs the day, YYYY-MM-DD");
+    parseInput(journalDateSchema, date);
+    const limit = flagString(flags, "limit");
+    parseInput(journalLikeQuerySchema, limit === undefined ? {} : { limit });
+    return {
+      data: await requireClient().get(`/journal/days/${date}/like`, { query: { limit } }),
+      render: renderJournalLike
+    };
+  },
   "journal digest": async ({ requireClient }) => ({
     data: await requireClient().get("/journal/digest"),
     render: renderJournalDigest
@@ -39699,7 +39935,7 @@ var HANDLERS = {
   "tap-tags tap": async ({ args, requireClient }) => {
     const id = requireArg(args, 0, "tag id");
     return {
-      data: await requireClient().post(`/tap-tags/${encodeURIComponent(id)}/tap`, {}),
+      data: await requireClient().post(pathOf(tapTagOperations.tap, { id }), {}),
       render: renderRecord
     };
   },