@robbeverhelst/do 1.301.0 → 1.303.0

package/dist/do.js

@@ -5174,6 +5174,8 @@ var guestLists = pgTable("guest_lists", {
   finalInfoKeyDateId: text("final_info_key_date_id").references(() => keyDates.id, {
     onDelete: "set null"
   }),
+  siteUrl: text("site_url"),
+  sitePassword: text("site_password"),
   createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
   updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
 }, (t) => [uniqueIndex("guest_lists_project_uniq").on(t.tenantId, t.projectId)]);
@@ -5236,6 +5238,7 @@ var rsvpLinks = pgTable("rsvp_links", {
   tokenHash: text("token_hash").notNull().unique(),
   mode: rsvpLinkMode("mode").notNull().default("full"),
   tokenSealed: text("token_sealed"),
+  shortCodeHash: text("short_code_hash").unique(),
   expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
   revokedAt: timestamp("revoked_at", { withTimezone: true }),
   lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
@@ -6052,6 +6055,12 @@ var healthLabAnalytes = pgTable("health_lab_analytes", {
   note: text("note"),
   updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
 }, (t) => [primaryKey({ columns: [t.tenantId, t.userId, t.analyte] })]);
+var healthDataKeys = pgTable("health_data_keys", {
+  tenantId: text("tenant_id").notNull().references(() => tenants.id),
+  userId: text("user_id").notNull().references(() => users.id),
+  sealedKey: text("sealed_key").notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (t) => [primaryKey({ columns: [t.tenantId, t.userId] })]);
 
 // ../../packages/schema/src/db/journal.ts
 var journalDayStatus = pgEnum("journal_day_status", ["open", "summarised", "reviewed"]);
@@ -19905,6 +19914,12 @@ var linkGoogleInputSchema = object({
   state: string2().min(1)
 });
 
+// ../../packages/schema/src/contracts/pagination.ts
+var paginationQuerySchema = object({
+  limit: exports_coerce.number().int().positive().optional(),
+  cursor: string2().min(1).optional()
+});
+
 // ../../packages/schema/src/contracts/changes.ts
 var changeOpSchema = _enum2(["created", "updated", "deleted"]);
 var CHANGE_ENTITY_SCOPES = {
@@ -20763,7 +20778,8 @@ var metricSourceSchema = _enum2([
   "agent",
   "google_fit",
   "google_health",
-  "health_connect"
+  "health_connect",
+  "withings"
 ]);
 var loggedMetricSourceSchema = _enum2(["manual", "device", "agent"]);
 var metricPointSchema = object({
@@ -23214,6 +23230,14 @@ var updateHealthProfileInputSchema = object({
   primaryGpContactId: ulidSchema.nullish()
 }).strict();
 var grantHealthConsentInputSchema = object({ version: literal(HEALTH_CONSENT_VERSION) }).strict();
+var HEALTH_ERASE_PHRASE = "delete my health data";
+var eraseHealthDataInputSchema = object({ confirm: literal(HEALTH_ERASE_PHRASE) }).strict();
+var healthErasureSchema = object({
+  records: number2().int().nonnegative(),
+  files: number2().int().nonnegative(),
+  keyShredded: boolean3(),
+  consent: healthConsentStateSchema
+});
 var healthEpisodeListQuerySchema = object({
   status: healthEpisodeStatusSchema.optional()
 });
@@ -23478,7 +23502,8 @@ var FILE_SOURCES = [
   "doccle",
   "doccle_zip",
   "scan",
-  "game_save"
+  "game_save",
+  "google_photos"
 ];
 var fileSourceSchema = union([
   _enum2(FILE_SOURCES),
@@ -27684,6 +27709,7 @@ var guestListViewSchema = guestListSchema.extend({
   finalInfoFrom: keyDateDaySchema.nullable().default(null),
   projectDay: keyDateDaySchema.nullable().default(null)
 });
+var siteUrlSchema = string2().trim().max(200).regex(/^https:\/\/[^\s/?#]+(\/[^\s?#]*)?$/, "expected an https:// address without ? or #").transform((u) => u.replace(/\/+$/, ""));
 var createGuestListInputSchema = object({
   id: ulidSchema,
   projectId: ulidSchema,
@@ -27691,7 +27717,9 @@ var createGuestListInputSchema = object({
   caps: capsSchema.optional(),
   sides: array(sideSchema).max(4).optional(),
   rsvpBy: keyDateDaySchema.nullish(),
-  finalInfoFrom: keyDateDaySchema.nullish()
+  finalInfoFrom: keyDateDaySchema.nullish(),
+  siteUrl: siteUrlSchema.nullish(),
+  sitePassword: string2().trim().min(1).max(64).nullish()
 }).strict();
 var updateGuestListInputSchema = createGuestListInputSchema.omit({ id: true, projectId: true }).partial().strict();
 var guestListsQuerySchema = object({ projectId: ulidSchema.optional() });
@@ -27789,6 +27817,11 @@ var guestListOverviewSchema = object({
   })
 });
 var RSVP_TOKEN_RE = /^rsvp_[A-Za-z0-9_-]{43}$/;
+var RSVP_CODE_ALPHABET = "23456789ABCDEFGHJKMNPQRSTWXYZ";
+var RSVP_CODE_LENGTH = 6;
+var RSVP_CODE_RE = new RegExp(`^[${RSVP_CODE_ALPHABET}]{${RSVP_CODE_LENGTH}}$`);
+var resolveRsvpCodeInputSchema = object({ code: string2().max(32) }).strict();
+var resolvedRsvpCodeSchema = object({ token: string2().regex(RSVP_TOKEN_RE) });
 var RSVP_LINK_MODES = ["address", "full"];
 var rsvpLinkModeSchema = _enum2(RSVP_LINK_MODES);
 var rsvpLinkSchema = object({
@@ -27806,7 +27839,8 @@ var rsvpLinkSchema = object({
 });
 var mintedRsvpLinkSchema = rsvpLinkSchema.extend({
   token: string2().regex(RSVP_TOKEN_RE),
-  path: string2()
+  path: string2(),
+  shortCode: string2().regex(RSVP_CODE_RE).nullable()
 });
 var createRsvpLinksInputSchema = object({
   guestListId: ulidSchema,
@@ -27837,6 +27871,23 @@ var publicRsvpEventSchema = object({
   dressCode: object({ nl: string2().optional(), pt: string2().optional() }).nullable(),
   note: object({ nl: string2().optional(), pt: string2().optional() }).nullable()
 }).strict();
+var publicTextSchema = object({ nl: string2().optional(), pt: string2().optional() });
+var publicRsvpQuestionSchema = object({
+  id: ulidSchema,
+  kind: rsvpQuestionKindSchema,
+  label: publicTextSchema,
+  options: array(object({ key: string2(), label: publicTextSchema }).strict()),
+  scope: rsvpQuestionScopeSchema,
+  eventKey: string2().nullable(),
+  required: boolean3(),
+  showIf: array(rsvpShowIfConditionSchema),
+  preset: rsvpQuestionPresetSchema.nullable()
+}).strict();
+var publicRsvpAnswerSchema = object({
+  questionId: ulidSchema,
+  guestId: ulidSchema.nullable(),
+  value: rsvpAnswerValueSchema
+}).strict();
 var publicRsvpViewSchema = object({
   mode: rsvpLinkModeSchema,
   language: rsvpLanguageSchema,
@@ -27846,6 +27897,8 @@ var publicRsvpViewSchema = object({
   finalInfoFrom: keyDateDaySchema.nullable().default(null),
   tiers: array(guestTierSchema),
   events: array(publicRsvpEventSchema).default([]),
+  questions: array(publicRsvpQuestionSchema).default([]),
+  answers: array(publicRsvpAnswerSchema).default([]),
   guests: array(publicRsvpGuestSchema),
   address: householdAddressSchema.nullable(),
   answeredAt: exports_coerce.date().nullable()
@@ -27931,7 +27984,14 @@ var createSeatingProposalInputSchema = object({
   return new Set(ids).size === ids.length;
 }, { message: "a guest can sit at one table only", path: ["tables"] });
 var seatingProposalsQuerySchema = object({ guestListId: ulidSchema });
-var GUEST_EXPORT_KINDS = ["caterer", "venue", "floor-plan", "church", "answers"];
+var GUEST_EXPORT_KINDS = [
+  "caterer",
+  "venue",
+  "floor-plan",
+  "church",
+  "answers",
+  "invitations"
+];
 var guestExportKindSchema = _enum2(GUEST_EXPORT_KINDS);
 var thankYouGiftSchema = object({
   momentId: ulidSchema,
@@ -29564,6 +29624,241 @@ function toCollectionTypeSummary(config) {
 }
 var COLLECTION_TYPE_SUMMARIES = COLLECTION_TYPE_LIST.map(toCollectionTypeSummary);
 
+// ../../packages/schema/src/operations/crud.ts
+function crudOperations(r) {
+  const base = `/${r.segment}`;
+  const one = `/${r.segment}/{id}`;
+  const event = r.eventBase ?? r.noun.replace(/ /g, ".");
+  return {
+    list: {
+      method: "get",
+      path: base,
+      scopes: [r.read],
+      tag: r.tag,
+      summary: `List ${r.noun}s`,
+      description: `Every ${r.noun} in the key's Space${r.paginated ? ", newest first" : ""}.`,
+      query: r.listQuery,
+      querySchema: r.listQuerySchema,
+      paginated: r.paginated,
+      status: 200,
+      response: { description: `The Space's ${r.noun}s.`, list: true, view: r.view }
+    },
+    get: {
+      method: "get",
+      path: one,
+      scopes: [r.read],
+      tag: r.tag,
+      summary: `Get a ${r.noun}`,
+      description: `Fetch one ${r.noun} by id.`,
+      status: 200,
+      response: { description: `The ${r.noun}.`, view: r.view },
+      errors: { 404: true }
+    },
+    create: {
+      method: "post",
+      path: base,
+      scopes: [r.write],
+      tag: r.tag,
+      summary: `Create a ${r.noun}`,
+      description: `Create a ${r.noun}; fires the \`${event}.created\` webhook.`,
+      body: r.create,
+      status: 201,
+      response: { description: `The created ${r.noun}.`, view: r.view },
+      errors: { 400: true, 409: true },
+      webhook: `${event}.created`
+    },
+    update: {
+      method: "patch",
+      path: one,
+      scopes: [r.write],
+      tag: r.tag,
+      summary: `Update a ${r.noun}`,
+      description: `Patch a ${r.noun}; fires the \`${event}.updated\` webhook.`,
+      body: r.update,
+      status: 200,
+      response: { description: `The updated ${r.noun}.`, view: r.view },
+      errors: { 400: true, 404: true, 409: true },
+      webhook: `${event}.updated`
+    },
+    remove: {
+      method: "delete",
+      path: one,
+      scopes: [r.write],
+      tag: r.tag,
+      summary: `Delete a ${r.noun}`,
+      description: `Delete a ${r.noun}; fires the \`${event}.deleted\` webhook.`,
+      status: 204,
+      response: { description: "Deleted." },
+      errors: { 404: true },
+      webhook: `${event}.deleted`
+    }
+  };
+}
+
+// ../../packages/schema/src/operations/define.ts
+function defineOperations(table) {
+  return table;
+}
+var PUBLIC_API_PREFIX = "/api/v1";
+function pathOf(op, params = {}) {
+  return op.path.replace(/\{([A-Za-z0-9_]+)\}/g, (_, name) => {
+    const value = params[name];
+    if (value === undefined)
+      throw new Error(`pathOf: no value for {${name}} in ${op.path}`);
+    return encodeURIComponent(value);
+  });
+}
+function routeOf(op) {
+  return `${op.method.toUpperCase()} ${PUBLIC_API_PREFIX}${op.path}`;
+}
+
+// ../../packages/schema/src/operations/inventory-items.ts
+var inventoryItemOperations = defineOperations({
+  ...crudOperations({
+    segment: "inventory-items",
+    tag: "Inventory",
+    noun: "inventory item",
+    read: "inventory:read",
+    write: "inventory:write",
+    create: createInventoryItemInputSchema,
+    update: updateInventoryItemInputSchema,
+    paginated: true,
+    listQuerySchema: paginationQuerySchema
+  })
+});
+
+// ../../packages/schema/src/operations/meal-plans.ts
+var mealPlanOperations = defineOperations({
+  ...crudOperations({
+    segment: "meal-plans",
+    tag: "Meals",
+    noun: "meal plan",
+    read: "meals:read",
+    write: "meals:write",
+    create: createMealPlanInputSchema,
+    update: updateMealPlanInputSchema
+  })
+});
+
+// ../../packages/schema/src/operations/periods.ts
+var periodOperations = defineOperations({
+  ...crudOperations({
+    segment: "periods",
+    tag: "Periods",
+    noun: "period",
+    read: "periods:read",
+    write: "periods:write",
+    create: createPeriodInputSchema,
+    update: updatePeriodInputSchema,
+    listQuery: [
+      { name: "nodeId", description: "Only the periods on this node." },
+      {
+        name: "kind",
+        description: "Only this kind (`hibernation`, `quarantine`, `away`, `treatment_course`, `withdrawal`, \u2026)."
+      },
+      {
+        name: "active",
+        description: "`true`: only running periods; `false`: only ended or not yet started."
+      }
+    ],
+    listQuerySchema: periodsQuerySchema
+  })
+});
+
+// ../../packages/schema/src/operations/shopping-lists.ts
+var shoppingListOperations = defineOperations({
+  ...crudOperations({
+    segment: "shopping-lists",
+    tag: "Shopping",
+    noun: "shopping list",
+    read: "shopping:read",
+    write: "shopping:write",
+    create: createShoppingListInputSchema,
+    update: updateShoppingListInputSchema,
+    paginated: true,
+    listQuerySchema: paginationQuerySchema
+  })
+});
+
+// ../../packages/schema/src/operations/tap-tags.ts
+var READ = ["habits:read", "routines:read"];
+var WRITE = ["habits:write", "routines:write"];
+var pathParams = { id: "The tag's id: the ULID the sticker's link carries (`/t/{id}`)." };
+var tapTagOperations = defineOperations({
+  list: {
+    method: "get",
+    path: "/tap-tags",
+    scopes: READ,
+    tag: "Habits",
+    summary: "List tap tags",
+    description: "The Space's NFC stickers: where each is (`label`), what a tap does (`habit`: check it in; `routine`: mark today's run done), its target's title and its link's `path`.",
+    status: 200,
+    response: { description: "Every tag.", list: true },
+    errors: { 403: true }
+  },
+  create: {
+    method: "post",
+    path: "/tap-tags",
+    scopes: WRITE,
+    tag: "Habits",
+    summary: "Make a tap tag",
+    description: "Bind a new sticker id (a client-minted ULID) to a live habit or routine of the Space, of the tag's kind. Write `https://<your do>/t/{id}` onto an NFC sticker.",
+    body: createTapTagInputSchema,
+    status: 201,
+    response: { description: "The tag." },
+    errors: { 400: true, 403: true }
+  },
+  get: {
+    method: "get",
+    path: "/tap-tags/{id}",
+    pathParams,
+    scopes: READ,
+    tag: "Habits",
+    summary: "Get a tap tag",
+    description: "One tag.",
+    status: 200,
+    response: { description: "The tag." },
+    errors: { 404: true }
+  },
+  update: {
+    method: "patch",
+    path: "/tap-tags/{id}",
+    pathParams,
+    scopes: WRITE,
+    tag: "Habits",
+    summary: "Rename or rebind a tap tag",
+    description: "Change its `label`, or bind it to another habit or routine (`kind` and `targetId` together): the sticker stays as it is.",
+    body: updateTapTagInputSchema,
+    status: 200,
+    response: { description: "The tag." },
+    errors: { 400: true, 404: true }
+  },
+  remove: {
+    method: "delete",
+    path: "/tap-tags/{id}",
+    pathParams,
+    scopes: WRITE,
+    tag: "Habits",
+    summary: "Delete a tap tag",
+    description: "The sticker's link stops doing anything.",
+    status: 204,
+    response: { description: "Deleted." },
+    errors: { 404: true }
+  },
+  tap: {
+    method: "post",
+    path: "/tap-tags/{id}/tap",
+    pathParams,
+    scopes: WRITE,
+    tag: "Habits",
+    summary: "Tap a tap tag",
+    description: "What the sticker does, as the key's member: check the habit in, or take today's run of the routine. Returns the receipt (`line`) and its `undo` (the check-in's `habitId` + `entryId`, or the run's `runId` + `stepRunIds` for `POST /routines/runs/{runId}/undo`). The same member's second tap within 30 s does nothing (`outcome: \"already\"`). The key must act for a member.",
+    status: 200,
+    response: { description: "The tap's receipt." },
+    errors: { 403: "A scope is missing, or the key acts for no member.", 404: true }
+  }
+});
+
 // ../../node_modules/ulidx/dist/node/index.js
 import crypto from "crypto";
 
@@ -29816,7 +30111,7 @@ function parseCapture2(input, now) {
 
 // src/meta.ts
 var CLI_NAME = "do";
-var VERSION = "1.301.0";
+var VERSION = "1.303.0";
 var API_PREFIX = "/api/v1";
 var DEFAULT_API_URL = "http://localhost:3001";
 
@@ -30045,7 +30340,7 @@ function resolveConfig(io, flags) {
 }
 
 // src/contacts-commands.ts
-var WRITE = ["contacts:write"];
+var WRITE2 = ["contacts:write"];
 var FIELD_FLAGS = [
   { name: "name", type: "string", description: "The display name (or pass it as the argument)." },
   { name: "kind", type: "string", description: "person (the default) or organization." },
@@ -30088,7 +30383,7 @@ var CONTACT_COMMAND_SPECS = [
     summary: "Add a contact: a person or an organisation, with their details.",
     args: [{ name: "name", required: false, description: "The display name." }],
     flags: FIELD_FLAGS,
-    scopes: WRITE,
+    scopes: WRITE2,
     returns: "ContactView",
     notes: 'Flags build a CreateContactInput; --data adds any other field (a flag wins). The id is minted when omitted. e.g. `do contacts create "Sam Peters" --email sam@example.com --birthday 1990-04-12 --circles <id>`.'
   },
@@ -30097,7 +30392,7 @@ var CONTACT_COMMAND_SPECS = [
     summary: "Change a contact's details.",
     args: [{ name: "id", required: true, description: "The contact's id." }],
     flags: FIELD_FLAGS,
-    scopes: WRITE,
+    scopes: WRITE2,
     returns: "ContactView",
     notes: "Only the flags you pass change. `none` clears a field (--email none, --birthday none). --birthday keeps the contact's other dates; --roles, --circles and --tags replace the list (a role it already has keeps its details)."
   }
@@ -30202,6 +30497,38 @@ var DUE_BEFORE_FLAG = {
   description: "only rows due strictly before this instant (ISO 8601 or YYYY-MM-DD)",
   query: "dueBefore"
 };
+function entityFromOperations(ops, spec) {
+  const path = ops.list.path;
+  const sameScopes = (a, b) => [...a.scopes].sort().join() === [...b.scopes].sort().join();
+  const reads = [ops.list, ops.get].filter((op) => op !== undefined);
+  const writes = [ops.create, ops.update, ops.remove].filter((op) => op !== undefined);
+  const problems = [
+    ...[ops.create].filter((op) => op && (op.method !== "post" || op.path !== path)),
+    ...[ops.get, ops.update, ops.remove].filter((op) => op && op.path !== `${path}/{id}`),
+    ...reads.filter((op) => !sameScopes(op, ops.list)),
+    ...writes.filter((op) => writes[0] && !sameScopes(op, writes[0]))
+  ];
+  if (problems.length > 0) {
+    throw new Error(`entityFromOperations(${spec.name}): ${problems.map((op) => op?.summary).join("; ")} don't fit the entity verbs`);
+  }
+  const [firstWrite] = writes;
+  return {
+    name: spec.name,
+    path,
+    readScopes: [...ops.list.scopes],
+    returns: spec.returns,
+    canGet: ops.get !== undefined,
+    listFlags: spec.listFlags,
+    ...firstWrite ? {
+      write: {
+        scopes: [...firstWrite.scopes],
+        ...ops.create ? { createSchema: ops.create.body, createInput: spec.createInput } : {},
+        ...ops.update ? { updateSchema: ops.update.body, updateInput: spec.updateInput } : {},
+        canDelete: ops.remove !== undefined
+      }
+    } : {}
+  };
+}
 var ENTITIES = [
   {
     name: "tasks",
@@ -30693,12 +31020,9 @@ var ENTITIES = [
       canDelete: true
     }
   },
-  {
+  entityFromOperations(periodOperations, {
     name: "periods",
-    path: "/periods",
-    readScopes: ["periods:read"],
     returns: "PeriodView",
-    canGet: true,
     listFlags: [
       { name: "node", description: "only the periods on this node id", query: "nodeId" },
       {
@@ -30712,31 +31036,16 @@ var ENTITIES = [
         query: "active"
       }
     ],
-    write: {
-      scopes: ["periods:write"],
-      createSchema: createPeriodInputSchema,
-      createInput: "CreatePeriodInput",
-      updateSchema: updatePeriodInputSchema,
-      updateInput: "UpdatePeriodInput",
-      canDelete: true
-    }
-  },
-  {
+    createInput: "CreatePeriodInput",
+    updateInput: "UpdatePeriodInput"
+  }),
+  entityFromOperations(tapTagOperations, {
     name: "tap-tags",
-    path: "/tap-tags",
-    readScopes: ["habits:read", "routines:read"],
     returns: "TapTagView",
-    canGet: true,
     listFlags: [],
-    write: {
-      scopes: ["habits:write", "routines:write"],
-      createSchema: createTapTagInputSchema,
-      createInput: "CreateTapTagInput",
-      updateSchema: updateTapTagInputSchema,
-      updateInput: "UpdateTapTagInput",
-      canDelete: true
-    }
-  },
+    createInput: "CreateTapTagInput",
+    updateInput: "UpdateTapTagInput"
+  }),
   {
     name: "animals",
     path: "/animals",
@@ -30791,38 +31100,20 @@ var ENTITIES = [
       canDelete: true
     }
   },
-  {
+  entityFromOperations(shoppingListOperations, {
     name: "shopping-lists",
-    path: "/shopping-lists",
-    readScopes: ["shopping:read"],
     returns: "ShoppingList",
-    canGet: true,
     listFlags: [],
-    write: {
-      scopes: ["shopping:write"],
-      createSchema: createShoppingListInputSchema,
-      createInput: "CreateShoppingListInput",
-      updateSchema: updateShoppingListInputSchema,
-      updateInput: "UpdateShoppingListInput",
-      canDelete: true
-    }
-  },
-  {
+    createInput: "CreateShoppingListInput",
+    updateInput: "UpdateShoppingListInput"
+  }),
+  entityFromOperations(inventoryItemOperations, {
     name: "inventory-items",
-    path: "/inventory-items",
-    readScopes: ["inventory:read"],
     returns: "InventoryItem",
-    canGet: true,
     listFlags: [],
-    write: {
-      scopes: ["inventory:write"],
-      createSchema: createInventoryItemInputSchema,
-      createInput: "CreateInventoryItemInput",
-      updateSchema: updateInventoryItemInputSchema,
-      updateInput: "UpdateInventoryItemInput",
-      canDelete: true
-    }
-  },
+    createInput: "CreateInventoryItemInput",
+    updateInput: "UpdateInventoryItemInput"
+  }),
   {
     name: "recipes",
     path: "/recipes",
@@ -30839,22 +31130,13 @@ var ENTITIES = [
       canDelete: true
     }
   },
-  {
+  entityFromOperations(mealPlanOperations, {
     name: "meal-plans",
-    path: "/meal-plans",
-    readScopes: ["meals:read"],
     returns: "MealPlan",
-    canGet: true,
     listFlags: [],
-    write: {
-      scopes: ["meals:write"],
-      createSchema: createMealPlanInputSchema,
-      createInput: "CreateMealPlanInput",
-      updateSchema: updateMealPlanInputSchema,
-      updateInput: "UpdateMealPlanInput",
-      canDelete: true
-    }
-  },
+    createInput: "CreateMealPlanInput",
+    updateInput: "UpdateMealPlanInput"
+  }),
   {
     name: "occurrences",
     path: "/occurrences",
@@ -30933,8 +31215,8 @@ function entityOperations(e) {
 }
 
 // src/health-commands.ts
-var READ = ["health:read"];
-var WRITE2 = ["health:write"];
+var READ2 = ["health:read"];
+var WRITE3 = ["health:write"];
 var DATA_FLAG = {
   name: "data",
   type: "string",
@@ -30948,7 +31230,7 @@ function recordSpecs(plural, singular, noun, returns, createInput, updateInput,
       summary: `List your health ${noun}s.`,
       args: [],
       flags: listFlags,
-      scopes: READ,
+      scopes: READ2,
       returns
     },
     {
@@ -30956,7 +31238,7 @@ function recordSpecs(plural, singular, noun, returns, createInput, updateInput,
       summary: `Show one health ${noun}.`,
       args: [id],
       flags: [],
-      scopes: READ,
+      scopes: READ2,
       returns
     },
     {
@@ -30964,7 +31246,7 @@ function recordSpecs(plural, singular, noun, returns, createInput, updateInput,
       summary: `Add a health ${noun} (--data '${createInput}').`,
       args: [],
       flags: [DATA_FLAG, ...addFlags],
-      scopes: WRITE2,
+      scopes: WRITE3,
       returns,
       notes: `Body: ${createInput}. Always private to you; subjectNodeId names who it is about (absent = you).`
     },
@@ -30973,7 +31255,7 @@ function recordSpecs(plural, singular, noun, returns, createInput, updateInput,
       summary: `Change a health ${noun} (--data '${updateInput}').`,
       args: [id],
       flags: [DATA_FLAG],
-      scopes: WRITE2,
+      scopes: WRITE3,
       returns,
       notes: `Body: ${updateInput}. null clears a field.`
     },
@@ -30982,7 +31264,7 @@ function recordSpecs(plural, singular, noun, returns, createInput, updateInput,
       summary: `Delete a health ${noun}.`,
       args: [id],
       flags: [],
-      scopes: WRITE2,
+      scopes: WRITE3,
       returns: "Deleted",
       notes: "Destructive: needs --allow-destructive. An Agent's delete waits on your confirmation."
     }
@@ -30994,7 +31276,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Show whether Health is on (only you turn it on or off, in do).",
     args: [],
     flags: [],
-    scopes: READ,
+    scopes: READ2,
     returns: "HealthConsentState",
     notes: "`granted` is on at today's consent text (`currentVersion`); `renewalNeeded` means you agreed to an older text, so writes wait until you agree again in do. `aiProvider` names who processes what the agent reads (null when this deployment names none)."
   },
@@ -31003,7 +31285,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Show your health profile: blood group, allergies, lifestyle, notes, emergency contact, GP.",
     args: [],
     flags: [],
-    scopes: READ,
+    scopes: READ2,
     returns: "HealthProfile"
   },
   {
@@ -31011,7 +31293,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Show your Medical ID: name, blood group, allergies, current medications, height, emergency contact.",
     args: [],
     flags: [],
-    scopes: READ,
+    scopes: READ2,
     returns: "HealthMedicalId",
     notes: "The few facts someone helping in an emergency needs. The emergency contact comes with their name and phone; a field not set is null. Each read by a key is logged for the member."
   },
@@ -31032,7 +31314,7 @@ var HEALTH_COMMAND_SPECS = [
         description: `Sex, in your words, for the doctor's page ("female"); "" clears it.`
       }
     ],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthProfile",
     notes: "Body: UpdateHealthProfileInput. An absent key keeps a field; null clears it. Lifestyle is `alcohol`, `smoking`, `exercise`, and `notes` anything else: the member's own words. Notes go on For the doctor's background; `sex` on its patient line."
   },
@@ -31041,7 +31323,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Log one health message: find or start the Episode, add a symptom and/or a dose.",
     args: [],
     flags: [DATA_FLAG],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthReceipt",
     notes: 'Body: LogHealthInput, e.g. {"episode":{"title":"Sprained ankle","bodyRegion":"ankle_l"},"symptom":{"symptom":"worse on the stairs","severity":6,"severityGuessed":true},"dose":{"medication":"Ibuprofen"}}. The receipt lists each part with a line, what was guessed, and its undo. With "thread":{"slug":"<agent>"} (only an agent key that converses) the receipt card is posted there too, and postId names it.'
   },
@@ -31050,7 +31332,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: `Correct a symptom entry and get a receipt (--data '{"bodyRegion":"ankle_l"}').`,
     args: [{ name: "entry", required: true, description: "The entry's id (its latest version)." }],
     flags: [DATA_FLAG],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthReceipt"
   },
   {
@@ -31061,7 +31343,7 @@ var HEALTH_COMMAND_SPECS = [
       { name: "trend", required: true, description: "better|same|worse, against yesterday." }
     ],
     flags: [],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthReceipt",
     notes: "One a day: a second check-in the same day corrects the first. The receipt carries its undo."
   },
@@ -31078,7 +31360,7 @@ var HEALTH_COMMAND_SPECS = [
         description: "Post the confirmation card in this thread (by slug); the agent's key only."
       }
     ],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthRedFlagsResult",
     notes: "Flags: fever, vomiting, black_stools, blood, weight_loss, night_pain, chest_pain, short_of_breath. Answers merge into those asked before; the Episode is marked checked today, and For the doctor shows it."
   },
@@ -31090,7 +31372,7 @@ var HEALTH_COMMAND_SPECS = [
       { name: "id", required: true, description: "The id from the receipt's undo." }
     ],
     flags: [],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthUndoResult",
     notes: "A POST, so an Agent's undo never waits on a confirmation."
   },
@@ -31099,7 +31381,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Find the open Episode a complaint belongs to, or start one (--data UpsertHealthEpisodeInput).",
     args: [],
     flags: [DATA_FLAG],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthEpisodeUpsert"
   },
   {
@@ -31109,7 +31391,7 @@ var HEALTH_COMMAND_SPECS = [
     flags: [
       { name: "episode", type: "string", description: "The Episode; default the latest open one." }
     ],
-    scopes: READ,
+    scopes: READ2,
     returns: "HealthSummary"
   },
   {
@@ -31132,7 +31414,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Your For-the-doctor links: sections, expiry, opens; never the secret.",
     args: [],
     flags: [],
-    scopes: READ,
+    scopes: READ2,
     returns: "HealthShare[]",
     notes: "Only the member makes a share, in do; a key can list and take one back."
   },
@@ -31141,7 +31423,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Take a For-the-doctor link back: it stops opening.",
     args: [{ name: "id", required: true, description: "The share's id." }],
     flags: [],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthShare"
   },
   ...recordSpecs("conditions", "condition", "condition", "HealthConditionView", "CreateHealthConditionInput", "UpdateHealthConditionInput"),
@@ -31159,7 +31441,7 @@ var HEALTH_COMMAND_SPECS = [
         description: 'Their role on it, in your words ("dermatologist").'
       }
     ],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthConditionView",
     notes: "A cared_by link (condition \u2192 contact). Adding one already on it sets the role. The condition's page, the Health home's Care team and For the doctor list them."
   },
@@ -31171,7 +31453,7 @@ var HEALTH_COMMAND_SPECS = [
       { name: "contact", required: true, description: "The Contact's id." }
     ],
     flags: [],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthConditionView",
     notes: "An Agent's removal waits on your confirmation, like a delete."
   },
@@ -31208,7 +31490,7 @@ var HEALTH_COMMAND_SPECS = [
       { name: "at", type: "string", description: "When it happened (ISO); defaults to now." },
       { name: "note", type: "string", description: "A free-text note." }
     ],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthSymptomEntry",
     notes: "An Agent's entry is source chat. For qualifiers, send --data with LogHealthSymptomInput."
   },
@@ -31224,7 +31506,7 @@ var HEALTH_COMMAND_SPECS = [
       }
     ],
     flags: [DATA_FLAG],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthSymptomEntry",
     notes: "Body: CorrectHealthSymptomInput; fields not named are copied. The history stays."
   },
@@ -31236,7 +31518,7 @@ var HEALTH_COMMAND_SPECS = [
       { name: "entry", required: true, description: "The entry's id." }
     ],
     flags: [],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "Deleted"
   },
   ...recordSpecs("visits", "visit", "visit", "HealthEncounterView", "CreateHealthEncounterInput", "UpdateHealthEncounterInput"),
@@ -31246,7 +31528,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "List the doses of a Medication, latest first.",
     args: [{ name: "med", required: true, description: "The Medication's id." }],
     flags: [],
-    scopes: READ,
+    scopes: READ2,
     returns: "HealthMedicationDose"
   },
   {
@@ -31260,7 +31542,7 @@ var HEALTH_COMMAND_SPECS = [
       { name: "at", type: "string", description: "When (ISO); defaults to now." },
       { name: "note", type: "string", description: "A free-text note." }
     ],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthMedicationDose"
   },
   {
@@ -31271,7 +31553,7 @@ var HEALTH_COMMAND_SPECS = [
       { name: "dose", required: true, description: "The dose's id." }
     ],
     flags: [DATA_FLAG],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthMedicationDose",
     notes: "Body: UpdateHealthDoseInput."
   },
@@ -31283,7 +31565,7 @@ var HEALTH_COMMAND_SPECS = [
       { name: "dose", required: true, description: "The dose's id." }
     ],
     flags: [],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "Deleted"
   },
   ...recordSpecs("labs", "lab", "lab draw", "HealthLabPanelView", "CreateHealthLabPanelInput", "UpdateHealthLabPanelInput"),
@@ -31305,7 +31587,7 @@ var HEALTH_COMMAND_SPECS = [
         description: "The file's media type, when its name doesn't say."
       }
     ],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthLabImportResult",
     notes: "The draw stays a draft (status draft, source import) until the member checks it; the report is kept as its original. A report with no lab value in it is a 422."
   },
@@ -31314,7 +31596,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "The canonical analytes: key, printed name, group, unit, LOINC and aliases.",
     args: [],
     flags: [],
-    scopes: READ,
+    scopes: READ2,
     returns: "LabAnalyteDef[]",
     notes: 'A result is written under the canonical key its analyte or name stands for ("ALAT" \u2192 alt, "25-OH vitamin D" \u2192 vitamin_d); a name that matches none keeps its slug and comes back in the draw\'s `unmatched`.'
   },
@@ -31329,7 +31611,7 @@ var HEALTH_COMMAND_SPECS = [
         description: "Required: only report, change nothing."
       }
     ],
-    scopes: READ,
+    scopes: READ2,
     returns: "HealthLabNormalizeReport",
     notes: "Nothing is rewritten: trends already read old keys as their canonical one. Lists each result's from \u2192 to, and the keys that match no canonical analyte."
   },
@@ -31338,7 +31620,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Every analyte your draws measured, each with its trend, grouped as a lab sheet.",
     args: [],
     flags: [],
-    scopes: READ,
+    scopes: READ2,
     returns: "HealthLabOverview"
   },
   {
@@ -31346,7 +31628,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Whether your Google Health is connected, the last sync, and what stops it.",
     args: [],
     flags: [],
-    scopes: READ,
+    scopes: READ2,
     returns: "GoogleHealthStatus",
     notes: "GET /api/v1/health/google-health. Connecting needs Google's consent in a browser: Settings \u2192 Health in do. `failure` (reauth, not_linked, unavailable, other) says what stops the sync, with a title and a hint. `nutrition` says whether your food is written back to Google Health (turned on in do; each settled day once, one entry per meal type) and the last day written."
   },
@@ -31355,16 +31637,34 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Sync your Google Health now (sleep, resting heart rate, HRV, steps, workouts), as the morning sync does.",
     args: [],
     flags: [],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "GoogleHealthSyncResult",
     notes: "POST /api/v1/health/google-health/sync. Written and skipped per resource, and the status after it; a sync that stops answers 200 with `status.failure`. 409 before Google Health is connected, 403 while the server has it switched off."
   },
+  {
+    path: ["health", "withings", "status"],
+    summary: "Whether your Withings scale is connected, the last sync, and what stops it.",
+    args: [],
+    flags: [],
+    scopes: READ2,
+    returns: "WithingsStatus",
+    notes: "GET /api/v1/health/withings. Connecting needs Withings' consent in a browser: Settings \u2192 Health in do. `failure` (reauth, unavailable, other) says what stops the sync, with a title and a hint."
+  },
+  {
+    path: ["health", "withings", "sync"],
+    summary: "Sync your Withings weigh-ins now, as the morning sync does.",
+    args: [],
+    flags: [],
+    scopes: WRITE3,
+    returns: "WithingsSyncResult",
+    notes: "POST /api/v1/health/withings/sync. Written and skipped, and the status after it; a sync that stops answers 200 with `status.failure`. 409 before Withings is connected, 403 while the server has it switched off."
+  },
   {
     path: ["health", "analyte"],
     summary: "One analyte's trend across draws (do health analyte vitamin_d).",
     args: [{ name: "analyte", required: true, description: "The analyte key (vitamin_d)." }],
     flags: [],
-    scopes: READ,
+    scopes: READ2,
     returns: "HealthLabAnalyteView"
   },
   {
@@ -31372,7 +31672,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: `Keep a target band or the supplement for an analyte (--data '{"targetLow":40,"targetHigh":60}').`,
     args: [{ name: "analyte", required: true, description: "The analyte key (vitamin_d)." }],
     flags: [DATA_FLAG],
-    scopes: WRITE2,
+    scopes: WRITE3,
     returns: "HealthLabAnalyteView",
     notes: "Body: SetHealthLabAnalyteInput. An absent key keeps a field; null clears it."
   }
@@ -32712,9 +33012,9 @@ var COMMAND_SPECS = [
     summary: "Tap a tag as if the phone read its sticker: check its habit in, or mark today's run of its routine done.",
     args: [{ name: "id", required: true, description: "The tag id (the ULID in /t/<id>)." }],
     flags: [],
-    scopes: ["habits:write", "routines:write"],
+    scopes: [...tapTagOperations.tap.scopes],
     returns: "TapResult",
-    notes: "POST /api/v1/tap-tags/{id}/tap. Acts as the key's member; a second tap within 30 s does nothing (outcome already). The receipt's undo names the check-in (DELETE /habits/{habitId}/entries/{entryId}) or the run's steps (POST /routines/runs/{runId}/undo)."
+    notes: `${routeOf(tapTagOperations.tap)}. Acts as the key's member; a second tap within 30 s does nothing (outcome already). The receipt's undo names the check-in (DELETE /habits/{habitId}/entries/{entryId}) or the run's steps (POST /routines/runs/{runId}/undo).`
   },
   {
     path: ["metrics", "list"],
@@ -35889,23 +36189,23 @@ var COMMAND_SPECS = [
   },
   {
     path: ["guest-lists", "export"],
-    summary: "Export for the caterer, the venue, the church or the RSVP answers (CSV) to stdout, or save the floor plan (PDF) to a file.",
+    summary: "Export for the caterer, the venue, the church or the RSVP answers (CSV) to stdout, or save the floor plan or the paper invitations (PDF) to a file.",
     args: [{ name: "id", required: true, description: "The guest list's id." }],
     flags: [
       {
         name: "kind",
         type: "string",
-        description: "caterer (meals and diets per table), venue (who sits where), church (who comes to the ceremony), answers (every RSVP answer, a row per guest) or floor-plan (PDF)."
+        description: "caterer (meals and diets per table), venue (who sits where), church (who comes to the ceremony), answers (every RSVP answer, a row per guest), floor-plan (PDF) or invitations (PDF: a card per household with a live RSVP link, its QR and code)."
       },
       {
         name: "out",
         type: "string",
-        description: "Where to save the floor plan (default: the name the API gives it)."
+        description: "Where to save a PDF (default: the name the API gives it)."
       }
     ],
     scopes: ["contacts:read"],
     returns: "string",
-    notes: "A CSV goes to stdout (`> tables.csv`); the floor plan is saved: `do guest-lists export <id> --kind floor-plan --out plan.pdf`."
+    notes: "A CSV goes to stdout (`> tables.csv`); a PDF is saved: `do guest-lists export <id> --kind invitations --out invitations.pdf`. Mint the links first (`do rsvp-links create`); the QR opens the list's `siteUrl` + /i/<token>, and its `sitePassword` is printed only when set."
   },
   {
     path: ["rsvp-links", "list"],
@@ -35932,12 +36232,12 @@ var COMMAND_SPECS = [
   },
   {
     path: ["rsvp-links", "token"],
-    summary: "Show a live RSVP link again: the same token it was minted with.",
+    summary: "Show a live RSVP link again: the same token it was minted with, and a whole-form link's short code.",
     args: [{ name: "id", required: true, description: "The link's id." }],
     flags: [],
     scopes: ["contacts:write"],
     returns: "MintedRsvpLink",
-    notes: "The mail and the paper QR carry this one link. A revoked or expired link is gone; one minted before tokens were kept can't be shown: replace it."
+    notes: "The mail and the paper QR carry this one link; `shortCode` (six characters) is printed on the paper invitation and typed at the site's /code. A revoked or expired link is gone; one minted before tokens were kept can't be shown: replace it."
   },
   {
     path: ["rsvp-links", "replace"],
@@ -39794,7 +40094,7 @@ var HANDLERS = {
   "tap-tags tap": async ({ args, requireClient }) => {
     const id = requireArg(args, 0, "tag id");
     return {
-      data: await requireClient().post(`/tap-tags/${encodeURIComponent(id)}/tap`, {}),
+      data: await requireClient().post(pathOf(tapTagOperations.tap, { id }), {}),
       render: renderRecord
     };
   },
@@ -41051,6 +41351,14 @@ var HANDLERS = {
     data: await requireClient().delete(`/health/shares/${requireArg(args, 0, "id")}`),
     render: renderRecord
   }),
+  "health withings status": async ({ requireClient }) => ({
+    data: await requireClient().get("/health/withings"),
+    render: renderRecord
+  }),
+  "health withings sync": async ({ requireClient }) => ({
+    data: await requireClient().post("/health/withings/sync", {}),
+    render: renderRecord
+  }),
   "health google status": async ({ requireClient }) => ({
     data: await requireClient().get("/health/google-health"),
     render: renderRecord
@@ -41542,9 +41850,9 @@ var HANDLERS = {
     const id = requireArg(args, 0, "guest list id");
     const kind = parseInput(guestExportKindSchema, flagString(flags, "kind") ?? "venue");
     const path = `/guest-lists/${id}/exports/${kind}`;
-    if (kind === "floor-plan") {
+    if (kind === "floor-plan" || kind === "invitations") {
       const file = await requireClient().getBytes(path);
-      const out = flagString(flags, "out") ?? basename2(file.name ?? "floor-plan.pdf");
+      const out = flagString(flags, "out") ?? basename2(file.name ?? `${kind}.pdf`);
       writeFileSync2(out, file.bytes);
       return {
         data: { id, kind, saved: out, size: file.bytes.byteLength, type: file.contentType },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@robbeverhelst/do",
-  "version": "1.301.0",
+  "version": "1.303.0",
   "private": false,
   "description": "do — the agent-drivable CLI over the public /api/v1 surface",
   "homepage": "https://github.com/robbeverhelst/do/tree/main/apps/cli",