@robbeverhelst/do 1.301.0 → 1.302.0

package/dist/do.js

@@ -5236,6 +5236,7 @@ var rsvpLinks = pgTable("rsvp_links", {
   tokenHash: text("token_hash").notNull().unique(),
   mode: rsvpLinkMode("mode").notNull().default("full"),
   tokenSealed: text("token_sealed"),
+  shortCodeHash: text("short_code_hash").unique(),
   expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
   revokedAt: timestamp("revoked_at", { withTimezone: true }),
   lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
@@ -6052,6 +6053,12 @@ var healthLabAnalytes = pgTable("health_lab_analytes", {
   note: text("note"),
   updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
 }, (t) => [primaryKey({ columns: [t.tenantId, t.userId, t.analyte] })]);
+var healthDataKeys = pgTable("health_data_keys", {
+  tenantId: text("tenant_id").notNull().references(() => tenants.id),
+  userId: text("user_id").notNull().references(() => users.id),
+  sealedKey: text("sealed_key").notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (t) => [primaryKey({ columns: [t.tenantId, t.userId] })]);
 
 // ../../packages/schema/src/db/journal.ts
 var journalDayStatus = pgEnum("journal_day_status", ["open", "summarised", "reviewed"]);
@@ -23214,6 +23221,14 @@ var updateHealthProfileInputSchema = object({
   primaryGpContactId: ulidSchema.nullish()
 }).strict();
 var grantHealthConsentInputSchema = object({ version: literal(HEALTH_CONSENT_VERSION) }).strict();
+var HEALTH_ERASE_PHRASE = "delete my health data";
+var eraseHealthDataInputSchema = object({ confirm: literal(HEALTH_ERASE_PHRASE) }).strict();
+var healthErasureSchema = object({
+  records: number2().int().nonnegative(),
+  files: number2().int().nonnegative(),
+  keyShredded: boolean3(),
+  consent: healthConsentStateSchema
+});
 var healthEpisodeListQuerySchema = object({
   status: healthEpisodeStatusSchema.optional()
 });
@@ -23478,7 +23493,8 @@ var FILE_SOURCES = [
   "doccle",
   "doccle_zip",
   "scan",
-  "game_save"
+  "game_save",
+  "google_photos"
 ];
 var fileSourceSchema = union([
   _enum2(FILE_SOURCES),
@@ -27789,6 +27805,11 @@ var guestListOverviewSchema = object({
   })
 });
 var RSVP_TOKEN_RE = /^rsvp_[A-Za-z0-9_-]{43}$/;
+var RSVP_CODE_ALPHABET = "23456789ABCDEFGHJKMNPQRSTWXYZ";
+var RSVP_CODE_LENGTH = 6;
+var RSVP_CODE_RE = new RegExp(`^[${RSVP_CODE_ALPHABET}]{${RSVP_CODE_LENGTH}}$`);
+var resolveRsvpCodeInputSchema = object({ code: string2().max(32) }).strict();
+var resolvedRsvpCodeSchema = object({ token: string2().regex(RSVP_TOKEN_RE) });
 var RSVP_LINK_MODES = ["address", "full"];
 var rsvpLinkModeSchema = _enum2(RSVP_LINK_MODES);
 var rsvpLinkSchema = object({
@@ -27806,7 +27827,8 @@ var rsvpLinkSchema = object({
 });
 var mintedRsvpLinkSchema = rsvpLinkSchema.extend({
   token: string2().regex(RSVP_TOKEN_RE),
-  path: string2()
+  path: string2(),
+  shortCode: string2().regex(RSVP_CODE_RE).nullable()
 });
 var createRsvpLinksInputSchema = object({
   guestListId: ulidSchema,
@@ -29564,6 +29586,102 @@ function toCollectionTypeSummary(config) {
 }
 var COLLECTION_TYPE_SUMMARIES = COLLECTION_TYPE_LIST.map(toCollectionTypeSummary);
 
+// ../../packages/schema/src/operations/define.ts
+function defineOperations(table) {
+  return table;
+}
+var PUBLIC_API_PREFIX = "/api/v1";
+function pathOf(op, params = {}) {
+  return op.path.replace(/\{([A-Za-z0-9_]+)\}/g, (_, name) => {
+    const value = params[name];
+    if (value === undefined)
+      throw new Error(`pathOf: no value for {${name}} in ${op.path}`);
+    return encodeURIComponent(value);
+  });
+}
+function routeOf(op) {
+  return `${op.method.toUpperCase()} ${PUBLIC_API_PREFIX}${op.path}`;
+}
+
+// ../../packages/schema/src/operations/tap-tags.ts
+var READ = ["habits:read", "routines:read"];
+var WRITE = ["habits:write", "routines:write"];
+var pathParams = { id: "The tag's id: the ULID the sticker's link carries (`/t/{id}`)." };
+var tapTagOperations = defineOperations({
+  list: {
+    method: "get",
+    path: "/tap-tags",
+    scopes: READ,
+    tag: "Habits",
+    summary: "List tap tags",
+    description: "The Space's NFC stickers: where each is (`label`), what a tap does (`habit`: check it in; `routine`: mark today's run done), its target's title and its link's `path`.",
+    status: 200,
+    response: { description: "Every tag.", list: true },
+    errors: { 403: true }
+  },
+  create: {
+    method: "post",
+    path: "/tap-tags",
+    scopes: WRITE,
+    tag: "Habits",
+    summary: "Make a tap tag",
+    description: "Bind a new sticker id (a client-minted ULID) to a live habit or routine of the Space, of the tag's kind. Write `https://<your do>/t/{id}` onto an NFC sticker.",
+    body: createTapTagInputSchema,
+    status: 201,
+    response: { description: "The tag." },
+    errors: { 400: true, 403: true }
+  },
+  get: {
+    method: "get",
+    path: "/tap-tags/{id}",
+    pathParams,
+    scopes: READ,
+    tag: "Habits",
+    summary: "Get a tap tag",
+    description: "One tag.",
+    status: 200,
+    response: { description: "The tag." },
+    errors: { 404: true }
+  },
+  update: {
+    method: "patch",
+    path: "/tap-tags/{id}",
+    pathParams,
+    scopes: WRITE,
+    tag: "Habits",
+    summary: "Rename or rebind a tap tag",
+    description: "Change its `label`, or bind it to another habit or routine (`kind` and `targetId` together): the sticker stays as it is.",
+    body: updateTapTagInputSchema,
+    status: 200,
+    response: { description: "The tag." },
+    errors: { 400: true, 404: true }
+  },
+  remove: {
+    method: "delete",
+    path: "/tap-tags/{id}",
+    pathParams,
+    scopes: WRITE,
+    tag: "Habits",
+    summary: "Delete a tap tag",
+    description: "The sticker's link stops doing anything.",
+    status: 204,
+    response: { description: "Deleted." },
+    errors: { 404: true }
+  },
+  tap: {
+    method: "post",
+    path: "/tap-tags/{id}/tap",
+    pathParams,
+    scopes: WRITE,
+    tag: "Habits",
+    summary: "Tap a tap tag",
+    description: "What the sticker does, as the key's member: check the habit in, or take today's run of the routine. Returns the receipt (`line`) and its `undo` (the check-in's `habitId` + `entryId`, or the run's `runId` + `stepRunIds` for `POST /routines/runs/{runId}/undo`). The same member's second tap within 30 s does nothing (`outcome: \"already\"`). The key must act for a member.",
+    status: 200,
+    response: { description: "The tap's receipt." },
+    errors: { 403: "A scope is missing, or the key acts for no member.", 404: true }
+  }
+});
+
 // ../../node_modules/ulidx/dist/node/index.js
 import crypto from "crypto";
 
@@ -29816,7 +29934,7 @@ function parseCapture2(input, now) {
 
 // src/meta.ts
 var CLI_NAME = "do";
-var VERSION = "1.301.0";
+var VERSION = "1.302.0";
 var API_PREFIX = "/api/v1";
 var DEFAULT_API_URL = "http://localhost:3001";
 
@@ -30045,7 +30163,7 @@ function resolveConfig(io, flags) {
 }
 
 // src/contacts-commands.ts
-var WRITE = ["contacts:write"];
+var WRITE2 = ["contacts:write"];
 var FIELD_FLAGS = [
   { name: "name", type: "string", description: "The display name (or pass it as the argument)." },
   { name: "kind", type: "string", description: "person (the default) or organization." },
@@ -30088,7 +30206,7 @@ var CONTACT_COMMAND_SPECS = [
     summary: "Add a contact: a person or an organisation, with their details.",
     args: [{ name: "name", required: false, description: "The display name." }],
     flags: FIELD_FLAGS,
-    scopes: WRITE,
+    scopes: WRITE2,
     returns: "ContactView",
     notes: 'Flags build a CreateContactInput; --data adds any other field (a flag wins). The id is minted when omitted. e.g. `do contacts create "Sam Peters" --email sam@example.com --birthday 1990-04-12 --circles <id>`.'
   },
@@ -30097,7 +30215,7 @@ var CONTACT_COMMAND_SPECS = [
     summary: "Change a contact's details.",
     args: [{ name: "id", required: true, description: "The contact's id." }],
     flags: FIELD_FLAGS,
-    scopes: WRITE,
+    scopes: WRITE2,
     returns: "ContactView",
     notes: "Only the flags you pass change. `none` clears a field (--email none, --birthday none). --birthday keeps the contact's other dates; --roles, --circles and --tags replace the list (a role it already has keeps its details)."
   }
@@ -30202,6 +30320,38 @@ var DUE_BEFORE_FLAG = {
   description: "only rows due strictly before this instant (ISO 8601 or YYYY-MM-DD)",
   query: "dueBefore"
 };
+function entityFromOperations(ops, spec) {
+  const path = ops.list.path;
+  const sameScopes = (a, b) => [...a.scopes].sort().join() === [...b.scopes].sort().join();
+  const reads = [ops.list, ops.get].filter((op) => op !== undefined);
+  const writes = [ops.create, ops.update, ops.remove].filter((op) => op !== undefined);
+  const problems = [
+    ...[ops.create].filter((op) => op && (op.method !== "post" || op.path !== path)),
+    ...[ops.get, ops.update, ops.remove].filter((op) => op && op.path !== `${path}/{id}`),
+    ...reads.filter((op) => !sameScopes(op, ops.list)),
+    ...writes.filter((op) => writes[0] && !sameScopes(op, writes[0]))
+  ];
+  if (problems.length > 0) {
+    throw new Error(`entityFromOperations(${spec.name}): ${problems.map((op) => op?.summary).join("; ")} don't fit the entity verbs`);
+  }
+  const [firstWrite] = writes;
+  return {
+    name: spec.name,
+    path,
+    readScopes: [...ops.list.scopes],
+    returns: spec.returns,
+    canGet: ops.get !== undefined,
+    listFlags: spec.listFlags,
+    ...firstWrite ? {
+      write: {
+        scopes: [...firstWrite.scopes],
+        ...ops.create ? { createSchema: ops.create.body, createInput: spec.createInput } : {},
+        ...ops.update ? { updateSchema: ops.update.body, updateInput: spec.updateInput } : {},
+        canDelete: ops.remove !== undefined
+      }
+    } : {}
+  };
+}
 var ENTITIES = [
   {
     name: "tasks",
@@ -30721,22 +30871,13 @@ var ENTITIES = [
       canDelete: true
     }
   },
-  {
+  entityFromOperations(tapTagOperations, {
     name: "tap-tags",
-    path: "/tap-tags",
-    readScopes: ["habits:read", "routines:read"],
     returns: "TapTagView",
-    canGet: true,
     listFlags: [],
-    write: {
-      scopes: ["habits:write", "routines:write"],
-      createSchema: createTapTagInputSchema,
-      createInput: "CreateTapTagInput",
-      updateSchema: updateTapTagInputSchema,
-      updateInput: "UpdateTapTagInput",
-      canDelete: true
-    }
-  },
+    createInput: "CreateTapTagInput",
+    updateInput: "UpdateTapTagInput"
+  }),
   {
     name: "animals",
     path: "/animals",
@@ -30933,8 +31074,8 @@ function entityOperations(e) {
 }
 
 // src/health-commands.ts
-var READ = ["health:read"];
-var WRITE2 = ["health:write"];
+var READ2 = ["health:read"];
+var WRITE3 = ["health:write"];
 var DATA_FLAG = {
   name: "data",
   type: "string",
@@ -30948,7 +31089,7 @@ function recordSpecs(plural, singular, noun, returns, createInput, updateInput,
       summary: `List your health ${noun}s.`,
       args: [],
       flags: listFlags,
-      scopes: READ,
+      scopes: READ2,
       returns
     },
     {
@@ -30956,7 +31097,7 @@ function recordSpecs(plural, singular, noun, returns, createInput, updateInput,
       summary: `Show one health ${noun}.`,
       args: [id],
       flags: [],
-      scopes: READ,
+      scopes: READ2,
       returns
     },
     {
@@ -30964,7 +31105,7 @@ function recordSpecs(plural, singular, noun, returns, createInput, updateInput,
       summary: `Add a health ${noun} (--data '${createInput}').`,
       args: [],
       flags: [DATA_FLAG, ...addFlags],
-      scopes: WRITE2,
+      scopes: WRITE3,
       returns,
       notes: `Body: ${createInput}. Always private to you; subjectNodeId names who it is about (absent = you).`
     },
@@ -30973,7 +31114,7 @@ function recordSpecs(plural, singular, noun, returns, createInput, updateInput,
       summary: `Change a health ${noun} (--data '${updateInput}').`,
       args: [id],
       flags: [DATA_FLAG],
-      scopes: WRITE2,
+      scopes: WRITE3,
       returns,
       notes: `Body: ${updateInput}. null clears a field.`
     },
@@ -30982,7 +31123,7 @@ function recordSpecs(plural, singular, noun, returns, createInput, updateInput,
       summary: `Delete a health ${noun}.`,
       args: [id],
       flags: [],
-      scopes: WRITE2,
+      scopes: WRITE3,
       returns: "Deleted",
       notes: "Destructive: needs --allow-destructive. An Agent's delete waits on your confirmation."
     }
@@ -30994,7 +31135,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Show whether Health is on (only you turn it on or off, in do).",
     args: [],
     flags: [],
-    scopes: READ,
+    scopes: READ2,
     returns: "HealthConsentState",
     notes: "`granted` is on at today's consent text (`currentVersion`); `renewalNeeded` means you agreed to an older text, so writes wait until you agree again in do. `aiProvider` names who processes what the agent reads (null when this deployment names none)."
   },
@@ -31003,7 +31144,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Show your health profile: blood group, allergies, lifestyle, notes, emergency contact, GP.",
     args: [],
     flags: [],
-    scopes: READ,
+    scopes: READ2,
     returns: "HealthProfile"
   },
   {
@@ -31011,7 +31152,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Show your Medical ID: name, blood group, allergies, current medications, height, emergency contact.",
     args: [],
     flags: [],
-    scopes: READ,
+    scopes: READ2,
     returns: "HealthMedicalId",
     notes: "The few facts someone helping in an emergency needs. The emergency contact comes with their name and phone; a field not set is null. Each read by a key is logged for the member."
   },
@@ -31032,7 +31173,7 @@ var HEALTH_COMMAND_SPECS = [
         description: `Sex, in your words, for the doctor's page ("female"); "" clears it.`
       }
     ],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthProfile",
     notes: "Body: UpdateHealthProfileInput. An absent key keeps a field; null clears it. Lifestyle is `alcohol`, `smoking`, `exercise`, and `notes` anything else: the member's own words. Notes go on For the doctor's background; `sex` on its patient line."
   },
@@ -31041,7 +31182,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Log one health message: find or start the Episode, add a symptom and/or a dose.",
     args: [],
     flags: [DATA_FLAG],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthReceipt",
     notes: 'Body: LogHealthInput, e.g. {"episode":{"title":"Sprained ankle","bodyRegion":"ankle_l"},"symptom":{"symptom":"worse on the stairs","severity":6,"severityGuessed":true},"dose":{"medication":"Ibuprofen"}}. The receipt lists each part with a line, what was guessed, and its undo. With "thread":{"slug":"<agent>"} (only an agent key that converses) the receipt card is posted there too, and postId names it.'
   },
@@ -31050,7 +31191,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: `Correct a symptom entry and get a receipt (--data '{"bodyRegion":"ankle_l"}').`,
     args: [{ name: "entry", required: true, description: "The entry's id (its latest version)." }],
     flags: [DATA_FLAG],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthReceipt"
   },
   {
@@ -31061,7 +31202,7 @@ var HEALTH_COMMAND_SPECS = [
       { name: "trend", required: true, description: "better|same|worse, against yesterday." }
     ],
     flags: [],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthReceipt",
     notes: "One a day: a second check-in the same day corrects the first. The receipt carries its undo."
   },
@@ -31078,7 +31219,7 @@ var HEALTH_COMMAND_SPECS = [
         description: "Post the confirmation card in this thread (by slug); the agent's key only."
       }
     ],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthRedFlagsResult",
     notes: "Flags: fever, vomiting, black_stools, blood, weight_loss, night_pain, chest_pain, short_of_breath. Answers merge into those asked before; the Episode is marked checked today, and For the doctor shows it."
   },
@@ -31090,7 +31231,7 @@ var HEALTH_COMMAND_SPECS = [
       { name: "id", required: true, description: "The id from the receipt's undo." }
     ],
     flags: [],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthUndoResult",
     notes: "A POST, so an Agent's undo never waits on a confirmation."
   },
@@ -31099,7 +31240,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Find the open Episode a complaint belongs to, or start one (--data UpsertHealthEpisodeInput).",
     args: [],
     flags: [DATA_FLAG],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthEpisodeUpsert"
   },
   {
@@ -31109,7 +31250,7 @@ var HEALTH_COMMAND_SPECS = [
     flags: [
       { name: "episode", type: "string", description: "The Episode; default the latest open one." }
     ],
-    scopes: READ,
+    scopes: READ2,
     returns: "HealthSummary"
   },
   {
@@ -31132,7 +31273,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Your For-the-doctor links: sections, expiry, opens; never the secret.",
     args: [],
     flags: [],
-    scopes: READ,
+    scopes: READ2,
     returns: "HealthShare[]",
     notes: "Only the member makes a share, in do; a key can list and take one back."
   },
@@ -31141,7 +31282,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Take a For-the-doctor link back: it stops opening.",
     args: [{ name: "id", required: true, description: "The share's id." }],
     flags: [],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthShare"
   },
   ...recordSpecs("conditions", "condition", "condition", "HealthConditionView", "CreateHealthConditionInput", "UpdateHealthConditionInput"),
@@ -31159,7 +31300,7 @@ var HEALTH_COMMAND_SPECS = [
         description: 'Their role on it, in your words ("dermatologist").'
       }
     ],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthConditionView",
     notes: "A cared_by link (condition \u2192 contact). Adding one already on it sets the role. The condition's page, the Health home's Care team and For the doctor list them."
   },
@@ -31171,7 +31312,7 @@ var HEALTH_COMMAND_SPECS = [
       { name: "contact", required: true, description: "The Contact's id." }
     ],
     flags: [],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthConditionView",
     notes: "An Agent's removal waits on your confirmation, like a delete."
   },
@@ -31208,7 +31349,7 @@ var HEALTH_COMMAND_SPECS = [
       { name: "at", type: "string", description: "When it happened (ISO); defaults to now." },
       { name: "note", type: "string", description: "A free-text note." }
     ],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthSymptomEntry",
     notes: "An Agent's entry is source chat. For qualifiers, send --data with LogHealthSymptomInput."
   },
@@ -31224,7 +31365,7 @@ var HEALTH_COMMAND_SPECS = [
       }
     ],
     flags: [DATA_FLAG],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthSymptomEntry",
     notes: "Body: CorrectHealthSymptomInput; fields not named are copied. The history stays."
   },
@@ -31236,7 +31377,7 @@ var HEALTH_COMMAND_SPECS = [
       { name: "entry", required: true, description: "The entry's id." }
     ],
     flags: [],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "Deleted"
   },
   ...recordSpecs("visits", "visit", "visit", "HealthEncounterView", "CreateHealthEncounterInput", "UpdateHealthEncounterInput"),
@@ -31246,7 +31387,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "List the doses of a Medication, latest first.",
     args: [{ name: "med", required: true, description: "The Medication's id." }],
     flags: [],
-    scopes: READ,
+    scopes: READ2,
     returns: "HealthMedicationDose"
   },
   {
@@ -31260,7 +31401,7 @@ var HEALTH_COMMAND_SPECS = [
       { name: "at", type: "string", description: "When (ISO); defaults to now." },
       { name: "note", type: "string", description: "A free-text note." }
     ],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthMedicationDose"
   },
   {
@@ -31271,7 +31412,7 @@ var HEALTH_COMMAND_SPECS = [
       { name: "dose", required: true, description: "The dose's id." }
     ],
     flags: [DATA_FLAG],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthMedicationDose",
     notes: "Body: UpdateHealthDoseInput."
   },
@@ -31283,7 +31424,7 @@ var HEALTH_COMMAND_SPECS = [
       { name: "dose", required: true, description: "The dose's id." }
     ],
     flags: [],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "Deleted"
   },
   ...recordSpecs("labs", "lab", "lab draw", "HealthLabPanelView", "CreateHealthLabPanelInput", "UpdateHealthLabPanelInput"),
@@ -31305,7 +31446,7 @@ var HEALTH_COMMAND_SPECS = [
         description: "The file's media type, when its name doesn't say."
       }
     ],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthLabImportResult",
     notes: "The draw stays a draft (status draft, source import) until the member checks it; the report is kept as its original. A report with no lab value in it is a 422."
   },
@@ -31314,7 +31455,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "The canonical analytes: key, printed name, group, unit, LOINC and aliases.",
     args: [],
     flags: [],
-    scopes: READ,
+    scopes: READ2,
     returns: "LabAnalyteDef[]",
     notes: 'A result is written under the canonical key its analyte or name stands for ("ALAT" \u2192 alt, "25-OH vitamin D" \u2192 vitamin_d); a name that matches none keeps its slug and comes back in the draw\'s `unmatched`.'
   },
@@ -31329,7 +31470,7 @@ var HEALTH_COMMAND_SPECS = [
         description: "Required: only report, change nothing."
       }
     ],
-    scopes: READ,
+    scopes: READ2,
     returns: "HealthLabNormalizeReport",
     notes: "Nothing is rewritten: trends already read old keys as their canonical one. Lists each result's from \u2192 to, and the keys that match no canonical analyte."
   },
@@ -31338,7 +31479,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Every analyte your draws measured, each with its trend, grouped as a lab sheet.",
     args: [],
     flags: [],
-    scopes: READ,
+    scopes: READ2,
     returns: "HealthLabOverview"
   },
   {
@@ -31346,7 +31487,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Whether your Google Health is connected, the last sync, and what stops it.",
     args: [],
     flags: [],
-    scopes: READ,
+    scopes: READ2,
     returns: "GoogleHealthStatus",
     notes: "GET /api/v1/health/google-health. Connecting needs Google's consent in a browser: Settings \u2192 Health in do. `failure` (reauth, not_linked, unavailable, other) says what stops the sync, with a title and a hint. `nutrition` says whether your food is written back to Google Health (turned on in do; each settled day once, one entry per meal type) and the last day written."
   },
@@ -31355,7 +31496,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Sync your Google Health now (sleep, resting heart rate, HRV, steps, workouts), as the morning sync does.",
     args: [],
     flags: [],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "GoogleHealthSyncResult",
     notes: "POST /api/v1/health/google-health/sync. Written and skipped per resource, and the status after it; a sync that stops answers 200 with `status.failure`. 409 before Google Health is connected, 403 while the server has it switched off."
   },
@@ -31364,7 +31505,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "One analyte's trend across draws (do health analyte vitamin_d).",
     args: [{ name: "analyte", required: true, description: "The analyte key (vitamin_d)." }],
     flags: [],
-    scopes: READ,
+    scopes: READ2,
     returns: "HealthLabAnalyteView"
   },
   {
@@ -31372,7 +31513,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: `Keep a target band or the supplement for an analyte (--data '{"targetLow":40,"targetHigh":60}').`,
     args: [{ name: "analyte", required: true, description: "The analyte key (vitamin_d)." }],
     flags: [DATA_FLAG],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthLabAnalyteView",
     notes: "Body: SetHealthLabAnalyteInput. An absent key keeps a field; null clears it."
   }
@@ -32712,9 +32853,9 @@ var COMMAND_SPECS = [
     summary: "Tap a tag as if the phone read its sticker: check its habit in, or mark today's run of its routine done.",
     args: [{ name: "id", required: true, description: "The tag id (the ULID in /t/<id>)." }],
     flags: [],
-    scopes: ["habits:write", "routines:write"],
+    scopes: [...tapTagOperations.tap.scopes],
     returns: "TapResult",
-    notes: "POST /api/v1/tap-tags/{id}/tap. Acts as the key's member; a second tap within 30 s does nothing (outcome already). The receipt's undo names the check-in (DELETE /habits/{habitId}/entries/{entryId}) or the run's steps (POST /routines/runs/{runId}/undo)."
+    notes: `${routeOf(tapTagOperations.tap)}. Acts as the key's member; a second tap within 30 s does nothing (outcome already). The receipt's undo names the check-in (DELETE /habits/{habitId}/entries/{entryId}) or the run's steps (POST /routines/runs/{runId}/undo).`
   },
   {
     path: ["metrics", "list"],
@@ -35932,12 +36073,12 @@ var COMMAND_SPECS = [
   },
   {
     path: ["rsvp-links", "token"],
-    summary: "Show a live RSVP link again: the same token it was minted with.",
+    summary: "Show a live RSVP link again: the same token it was minted with, and a whole-form link's short code.",
     args: [{ name: "id", required: true, description: "The link's id." }],
     flags: [],
     scopes: ["contacts:write"],
     returns: "MintedRsvpLink",
-    notes: "The mail and the paper QR carry this one link. A revoked or expired link is gone; one minted before tokens were kept can't be shown: replace it."
+    notes: "The mail and the paper QR carry this one link; `shortCode` (six characters) is printed on the paper invitation and typed at the site's /code. A revoked or expired link is gone; one minted before tokens were kept can't be shown: replace it."
   },
   {
     path: ["rsvp-links", "replace"],
@@ -39794,7 +39935,7 @@ var HANDLERS = {
   "tap-tags tap": async ({ args, requireClient }) => {
     const id = requireArg(args, 0, "tag id");
     return {
-      data: await requireClient().post(`/tap-tags/${encodeURIComponent(id)}/tap`, {}),
+      data: await requireClient().post(pathOf(tapTagOperations.tap, { id }), {}),
       render: renderRecord
     };
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@robbeverhelst/do",
-  "version": "1.301.0",
+  "version": "1.302.0",
   "private": false,
   "description": "do — the agent-drivable CLI over the public /api/v1 surface",
   "homepage": "https://github.com/robbeverhelst/do/tree/main/apps/cli",