@robbeverhelst/do 1.302.0 → 1.304.0

package/dist/do.js

@@ -4949,6 +4949,20 @@ var moneyRecurring = pgTable("money_recurring", {
   check("money_recurring_amount", sql`${t.expectedAmount} > 0`),
   check("money_recurring_business_share", sql`${t.businessShare} BETWEEN 0 AND 100`)
 ]);
+var moneySnapshotSource = pgEnum("money_snapshot_source", ["balance", "ledger", "manual"]);
+var moneySnapshots = pgTable("money_snapshots", {
+  id: text("id").primaryKey(),
+  tenantId: text("tenant_id").notNull().references(() => tenants.id),
+  accountId: text("account_id").notNull().references(() => moneyAccounts.id, { onDelete: "cascade" }),
+  month: char("month", { length: 7 }).notNull(),
+  value: numeric("value", { precision: 14, scale: 2 }).notNull(),
+  source: moneySnapshotSource("source").notNull().default("balance"),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+}, (t) => [
+  unique("money_snapshots_account_month_key").on(t.tenantId, t.accountId, t.month),
+  check("money_snapshots_month", sql`${t.month} ~ '^[0-9]{4}-(0[1-9]|1[0-2])$'`)
+]);
 
 // ../../packages/schema/src/db/money-connections.ts
 var moneyConnectionStatus = pgEnum("money_connection_status", [
@@ -5174,6 +5188,8 @@ var guestLists = pgTable("guest_lists", {
   finalInfoKeyDateId: text("final_info_key_date_id").references(() => keyDates.id, {
     onDelete: "set null"
   }),
+  siteUrl: text("site_url"),
+  sitePassword: text("site_password"),
   createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
   updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
 }, (t) => [uniqueIndex("guest_lists_project_uniq").on(t.tenantId, t.projectId)]);
@@ -5630,6 +5646,18 @@ var foodWeekReads = pgTable("food_week_reads", {
   weekStart: text("week_start").notNull()
 }, (t) => [unique("food_week_reads_owner_week_uniq").on(t.tenantId, t.ownerUserId, t.weekStart)]);
 
+// ../../packages/schema/src/db/webhooks.ts
+var webhookSubscriptions = pgTable("webhook_subscriptions", {
+  id: text("id").primaryKey(),
+  tenantId: text("tenant_id").notNull().references(() => tenants.id),
+  url: text("url").notNull(),
+  events: text("events").array().notNull().default([]),
+  secret: text("secret").notNull(),
+  active: boolean("active").notNull().default(true),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+}, (t) => [index("webhook_subscriptions_tenant_idx").on(t.tenantId)]);
+
 // ../../packages/schema/src/db/collaboration.ts
 var capability = pgEnum("collab_capability", ["view", "comment", "edit", "admin"]);
 var grantSubjectType = pgEnum("grant_subject_type", ["member", "role"]);
@@ -19912,6 +19940,12 @@ var linkGoogleInputSchema = object({
   state: string2().min(1)
 });
 
+// ../../packages/schema/src/contracts/pagination.ts
+var paginationQuerySchema = object({
+  limit: exports_coerce.number().int().positive().optional(),
+  cursor: string2().min(1).optional()
+});
+
 // ../../packages/schema/src/contracts/changes.ts
 var changeOpSchema = _enum2(["created", "updated", "deleted"]);
 var CHANGE_ENTITY_SCOPES = {
@@ -20501,6 +20535,21 @@ var collectionCoverBackfillResultSchema = object({
   found: number2().int().min(0),
   colored: number2().int().min(0).default(0)
 });
+function normalizeTag(raw) {
+  return raw.trim().toLowerCase().replace(/\s+/g, " ");
+}
+function normalizeTags(raw) {
+  const seen = new Set;
+  const out = [];
+  for (const r of raw) {
+    const tag = normalizeTag(r);
+    if (!tag || seen.has(tag))
+      continue;
+    seen.add(tag);
+    out.push(tag);
+  }
+  return out;
+}
 var collectionSavedViewSchema = object({
   id: string2().min(1),
   name: string2().min(1),
@@ -20539,6 +20588,53 @@ var collectionLogResultSchema = object({
   item: collectionItemDetailSchema
 });
 
+// ../../packages/schema/src/contracts/list-filters.ts
+function csvList(item) {
+  return preprocess((raw) => (Array.isArray(raw) ? raw : [raw]).flatMap((v) => typeof v === "string" ? v.split(",") : [v]).map((v) => typeof v === "string" ? v.trim() : v).filter((v) => v !== ""), array(item).min(1));
+}
+var booleanQuerySchema = _enum2(["true", "false", "1", "0"]).transform((v) => v === "true" || v === "1");
+var instantQuerySchema = union([exports_iso.datetime({ offset: true }), exports_iso.date()]).transform((s) => new Date(s));
+var tagListSchema = csvList(string2().min(1)).transform((tags, ctx) => {
+  const normalized = normalizeTags(tags.map((t) => t.replace(/^#/, "")));
+  if (normalized.length === 0) {
+    ctx.addIssue({ code: "custom", message: "must name at least one tag" });
+    return NEVER;
+  }
+  return normalized;
+});
+function partyFilterSchema(party) {
+  return union([_enum2(["any", "none"]), party]);
+}
+var taskListQuerySchema = object({
+  areaId: ulidSchema.optional(),
+  projectId: ulidSchema.optional(),
+  status: csvList(taskStatusSchema).optional(),
+  tag: tagListSchema.optional(),
+  updatedSince: instantQuerySchema.optional(),
+  dueBefore: instantQuerySchema.optional(),
+  owner: partyFilterSchema(taskOwnerInputSchema).optional(),
+  waitingOn: partyFilterSchema(taskWaitingOnInputSchema).optional(),
+  completedSince: instantQuerySchema.optional(),
+  completedBefore: instantQuerySchema.optional(),
+  proposed: booleanQuerySchema.optional(),
+  ready: booleanQuerySchema.optional(),
+  drifted: booleanQuerySchema.optional()
+});
+var projectListQuerySchema = object({
+  areaId: ulidSchema.optional(),
+  status: csvList(projectStatusSchema).optional(),
+  updatedSince: instantQuerySchema.optional(),
+  dueBefore: instantQuerySchema.optional()
+});
+var habitListQuerySchema = object({
+  areaId: ulidSchema.optional(),
+  updatedSince: instantQuerySchema.optional(),
+  retired: _enum2(["true", "false"]).transform((v) => v === "true").optional()
+});
+var areaListQuerySchema = object({
+  archived: _enum2(["true", "false"]).transform((v) => v === "true").optional()
+});
+
 // ../../packages/schema/src/contracts/habit-sources.ts
 var habitSourceSchema = _enum2(["manual", "google_fit", "strava", "github"]);
 
@@ -20770,7 +20866,8 @@ var metricSourceSchema = _enum2([
   "agent",
   "google_fit",
   "google_health",
-  "health_connect"
+  "health_connect",
+  "withings"
 ]);
 var loggedMetricSourceSchema = _enum2(["manual", "device", "agent"]);
 var metricPointSchema = object({
@@ -24656,6 +24753,50 @@ var dayRecordUndoResultSchema = object({
 });
 var STATUS_QUARTER_MS = RECORD_ROUND_MINUTES * 60000;
 
+// ../../packages/schema/src/contracts/today.ts
+var occurrenceViewSchema = occurrenceSchema.extend({
+  title: string2(),
+  templateKind: _enum2(["task", "habit", "routine"]),
+  measurementType: habitMeasurementTypeSchema.nullable()
+});
+var todayResponseSchema = object({
+  from: exports_coerce.date(),
+  to: exports_coerce.date(),
+  scheduledTasks: array(taskViewSchema),
+  dueOccurrences: array(occurrenceViewSchema),
+  overdueTasks: array(taskViewSchema),
+  overdueOccurrences: array(occurrenceViewSchema)
+});
+var rolloverInputSchema = object({
+  taskIds: array(string2().min(1)).default([]),
+  occurrenceIds: array(string2().min(1)).default([]),
+  action: _enum2(["reschedule", "someday", "drop"]),
+  to: exports_coerce.date().optional()
+}).refine((v) => v.action !== "reschedule" || v.to !== undefined, {
+  message: "`to` is required when action is `reschedule`",
+  path: ["to"]
+});
+var rolloverResultSchema = object({
+  tasks: number2().int().nonnegative(),
+  occurrences: number2().int().nonnegative()
+});
+var fromEarlierQuerySchema = object({
+  from: instantQuerySchema.optional(),
+  areaId: ulidSchema.optional()
+});
+var fromEarlierResponseSchema = object({
+  from: exports_coerce.date(),
+  since: exports_coerce.date(),
+  laterThisWeek: exports_coerce.date(),
+  tasks: array(taskViewSchema)
+});
+var reviewDayStatSchema = object({
+  date: string2(),
+  completedTasks: number2().int().nonnegative(),
+  completedOccurrences: number2().int().nonnegative()
+});
+var reviewStatsSchema = array(reviewDayStatSchema);
+
 // ../../packages/schema/src/contracts/insights.ts
 var insightsActivityPointSchema = object({
   day: string2(),
@@ -27240,6 +27381,51 @@ var steamSyncResultSchema = object({
   games: array(steamGameSyncSchema)
 });
 
+// ../../packages/schema/src/contracts/money-net-worth.ts
+var amount5 = string2();
+var moneySnapshotSourceSchema = _enum2(moneySnapshotSource.enumValues);
+var moneyNetWorthQuerySchema = object({
+  scope: moneyBudgetScopeSchema.optional(),
+  months: exports_coerce.number().int().min(2).max(60).optional()
+});
+var moneyNetWorthPointSchema = object({
+  month: moneyMonthSchema,
+  total: amount5.nullable(),
+  have: amount5.nullable(),
+  owe: amount5.nullable()
+});
+var moneyNetWorthAccountSchema = object({
+  accountId: ulidSchema,
+  title: string2(),
+  kind: moneyAccountKindSchema,
+  visibility: _enum2(NODE_VISIBILITY_VALUES),
+  currency: string2(),
+  value: amount5,
+  source: moneySnapshotSourceSchema,
+  month: moneyMonthSchema
+});
+var moneyNetWorthSchema = object({
+  scope: moneyBudgetScopeSchema,
+  month: moneyMonthSchema,
+  total: amount5,
+  have: amount5,
+  owe: amount5,
+  points: array(moneyNetWorthPointSchema),
+  accounts: array(moneyNetWorthAccountSchema)
+});
+var setMoneyNetWorthValueInputSchema = object({
+  accountId: ulidSchema,
+  value: moneyAmountSchema,
+  month: moneyMonthSchema.optional()
+}).strict();
+var moneySnapshotSchema = object({
+  id: ulidSchema,
+  accountId: ulidSchema,
+  month: moneyMonthSchema,
+  value: amount5,
+  source: moneySnapshotSourceSchema
+});
+
 // ../../packages/schema/src/contracts/money-splits.ts
 var moneyPartySchema = union([
   object({ userId: ulidSchema }).strict(),
@@ -27700,6 +27886,7 @@ var guestListViewSchema = guestListSchema.extend({
   finalInfoFrom: keyDateDaySchema.nullable().default(null),
   projectDay: keyDateDaySchema.nullable().default(null)
 });
+var siteUrlSchema = string2().trim().max(200).regex(/^https:\/\/[^\s/?#]+(\/[^\s?#]*)?$/, "expected an https:// address without ? or #").transform((u) => u.replace(/\/+$/, ""));
 var createGuestListInputSchema = object({
   id: ulidSchema,
   projectId: ulidSchema,
@@ -27707,7 +27894,9 @@ var createGuestListInputSchema = object({
   caps: capsSchema.optional(),
   sides: array(sideSchema).max(4).optional(),
   rsvpBy: keyDateDaySchema.nullish(),
-  finalInfoFrom: keyDateDaySchema.nullish()
+  finalInfoFrom: keyDateDaySchema.nullish(),
+  siteUrl: siteUrlSchema.nullish(),
+  sitePassword: string2().trim().min(1).max(64).nullish()
 }).strict();
 var updateGuestListInputSchema = createGuestListInputSchema.omit({ id: true, projectId: true }).partial().strict();
 var guestListsQuerySchema = object({ projectId: ulidSchema.optional() });
@@ -27859,6 +28048,23 @@ var publicRsvpEventSchema = object({
   dressCode: object({ nl: string2().optional(), pt: string2().optional() }).nullable(),
   note: object({ nl: string2().optional(), pt: string2().optional() }).nullable()
 }).strict();
+var publicTextSchema = object({ nl: string2().optional(), pt: string2().optional() });
+var publicRsvpQuestionSchema = object({
+  id: ulidSchema,
+  kind: rsvpQuestionKindSchema,
+  label: publicTextSchema,
+  options: array(object({ key: string2(), label: publicTextSchema }).strict()),
+  scope: rsvpQuestionScopeSchema,
+  eventKey: string2().nullable(),
+  required: boolean3(),
+  showIf: array(rsvpShowIfConditionSchema),
+  preset: rsvpQuestionPresetSchema.nullable()
+}).strict();
+var publicRsvpAnswerSchema = object({
+  questionId: ulidSchema,
+  guestId: ulidSchema.nullable(),
+  value: rsvpAnswerValueSchema
+}).strict();
 var publicRsvpViewSchema = object({
   mode: rsvpLinkModeSchema,
   language: rsvpLanguageSchema,
@@ -27868,6 +28074,8 @@ var publicRsvpViewSchema = object({
   finalInfoFrom: keyDateDaySchema.nullable().default(null),
   tiers: array(guestTierSchema),
   events: array(publicRsvpEventSchema).default([]),
+  questions: array(publicRsvpQuestionSchema).default([]),
+  answers: array(publicRsvpAnswerSchema).default([]),
   guests: array(publicRsvpGuestSchema),
   address: householdAddressSchema.nullable(),
   answeredAt: exports_coerce.date().nullable()
@@ -27953,7 +28161,15 @@ var createSeatingProposalInputSchema = object({
   return new Set(ids).size === ids.length;
 }, { message: "a guest can sit at one table only", path: ["tables"] });
 var seatingProposalsQuerySchema = object({ guestListId: ulidSchema });
-var GUEST_EXPORT_KINDS = ["caterer", "venue", "floor-plan", "church", "answers"];
+var GUEST_EXPORT_KINDS = [
+  "caterer",
+  "venue",
+  "floor-plan",
+  "church",
+  "answers",
+  "invitations",
+  "printer"
+];
 var guestExportKindSchema = _enum2(GUEST_EXPORT_KINDS);
 var thankYouGiftSchema = object({
   momentId: ulidSchema,
@@ -28538,6 +28754,209 @@ function scopeGranted(granted, required) {
   return granted.includes(FULL_ACCESS_SCOPE);
 }
 
+// ../../packages/schema/src/net/ssrf.ts
+var BLOCKED_HOST_SUFFIXES = [".internal", ".local", ".localhost"];
+var BLOCKED_HOSTNAMES = new Set(["localhost"]);
+function parseIpv4(host) {
+  const parts = host.split(".");
+  if (parts.length !== 4)
+    return null;
+  let value = 0;
+  for (const part of parts) {
+    if (!/^\d{1,3}$/.test(part))
+      return null;
+    const octet = Number(part);
+    if (octet > 255)
+      return null;
+    value = value * 256 + octet;
+  }
+  return value >>> 0;
+}
+function isBlockedIpv4(ip) {
+  const inRange = (base, bits) => {
+    const baseIp = parseIpv4(base);
+    if (baseIp === null)
+      return false;
+    const mask = bits === 0 ? 0 : 4294967295 << 32 - bits >>> 0;
+    return (ip & mask) === (baseIp & mask);
+  };
+  return inRange("0.0.0.0", 8) || inRange("10.0.0.0", 8) || inRange("100.64.0.0", 10) || inRange("127.0.0.0", 8) || inRange("169.254.0.0", 16) || inRange("172.16.0.0", 12) || inRange("192.0.0.0", 24) || inRange("192.0.2.0", 24) || inRange("192.168.0.0", 16) || inRange("198.18.0.0", 15) || inRange("224.0.0.0", 4) || inRange("240.0.0.0", 4);
+}
+function parseIpv6(host) {
+  let text = host;
+  const zone = text.indexOf("%");
+  if (zone !== -1)
+    text = text.slice(0, zone);
+  if (!text.includes(":"))
+    return null;
+  const lastColon = text.lastIndexOf(":");
+  const tail = text.slice(lastColon + 1);
+  if (tail.includes(".")) {
+    const v4 = parseIpv4(tail);
+    if (v4 === null)
+      return null;
+    const hex = `${(v4 >>> 16 & 65535).toString(16)}:${(v4 & 65535).toString(16)}`;
+    text = text.slice(0, lastColon + 1) + hex;
+  }
+  const halves = text.split("::");
+  if (halves.length > 2)
+    return null;
+  const toGroups = (segment) => {
+    if (segment === "")
+      return [];
+    const out = [];
+    for (const g of segment.split(":")) {
+      if (!/^[0-9a-fA-F]{1,4}$/.test(g))
+        return null;
+      out.push(Number.parseInt(g, 16));
+    }
+    return out;
+  };
+  const head = toGroups(halves[0] ?? "");
+  if (head === null)
+    return null;
+  let groups;
+  if (halves.length === 2) {
+    const back = toGroups(halves[1] ?? "");
+    if (back === null)
+      return null;
+    const fill = 8 - head.length - back.length;
+    if (fill < 0)
+      return null;
+    groups = [...head, ...Array(fill).fill(0), ...back];
+  } else {
+    groups = head;
+  }
+  return groups.length === 8 ? groups : null;
+}
+function isBlockedIpv6(groups) {
+  const isZero = groups.every((g) => g === 0);
+  if (isZero)
+    return true;
+  if (groups.slice(0, 7).every((g) => g === 0) && groups[7] === 1)
+    return true;
+  const isV4Mapped = groups.slice(0, 5).every((g) => g === 0) && groups[5] === 65535;
+  const isV4Compat = groups.slice(0, 6).every((g) => g === 0);
+  if (isV4Mapped || isV4Compat) {
+    const v4 = ((groups[6] ?? 0) << 16 | (groups[7] ?? 0)) >>> 0;
+    return isBlockedIpv4(v4);
+  }
+  const first = groups[0] ?? 0;
+  if ((first & 65024) === 64512)
+    return true;
+  if ((first & 65472) === 65152)
+    return true;
+  if ((first & 65280) === 65280)
+    return true;
+  return false;
+}
+function isBlockedIp(host) {
+  const bare = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+  const v4 = parseIpv4(bare);
+  if (v4 !== null)
+    return isBlockedIpv4(v4);
+  const v6 = parseIpv6(bare);
+  if (v6 !== null)
+    return isBlockedIpv6(v6);
+  return false;
+}
+
+class BlockedWebhookUrlError extends Error {
+  constructor(reason) {
+    super(`webhook url rejected: ${reason}`);
+    this.name = "BlockedWebhookUrlError";
+  }
+}
+function bareHost(hostname) {
+  return hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+}
+function isInternalHost(hostname) {
+  const host = hostname.toLowerCase();
+  if (BLOCKED_HOSTNAMES.has(host) || BLOCKED_HOST_SUFFIXES.some((s) => host.endsWith(s))) {
+    return true;
+  }
+  return isBlockedIp(host);
+}
+function assertSafeEgressUrl(rawUrl, policy) {
+  let url;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    throw policy.fail("not a valid URL");
+  }
+  if (!policy.protocols.includes(url.protocol)) {
+    const allowsHttp = policy.protocols.includes("http:");
+    throw policy.fail(`only ${allowsHttp ? "http(s)" : "https"} URLs are allowed`);
+  }
+  if (url.username || url.password) {
+    throw policy.fail("credentials in the URL are not allowed");
+  }
+  if (isInternalHost(url.hostname)) {
+    const kind = isBlockedIp(url.hostname) ? "a private or reserved address" : "internal";
+    throw policy.fail(`host '${url.hostname}' is ${kind}`);
+  }
+  return url;
+}
+function webhookUrlAllowlistFromEnv() {
+  const env = globalThis.process?.env;
+  const raw = env?.WEBHOOK_URL_ALLOWLIST;
+  if (!raw)
+    return [];
+  return raw.split(",").map((h) => h.trim().toLowerCase()).filter(Boolean);
+}
+function isAllowlistedHost(hostname, allowedHosts) {
+  const host = hostname.toLowerCase();
+  const bare = bareHost(host);
+  return allowedHosts.some((h) => h === host || h === bare);
+}
+function assertSafeWebhookUrl(rawUrl, opts = {}) {
+  let url;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    throw new BlockedWebhookUrlError("not a valid URL");
+  }
+  const allowedHosts = opts.allowedHosts ?? webhookUrlAllowlistFromEnv();
+  if (isAllowlistedHost(url.hostname, allowedHosts)) {
+    return url;
+  }
+  return assertSafeEgressUrl(rawUrl, {
+    protocols: ["https:"],
+    fail: (reason) => new BlockedWebhookUrlError(reason)
+  });
+}
+
+// ../../packages/schema/src/contracts/webhooks.ts
+var webhookUrlSchema = string2().superRefine((value, ctx) => {
+  try {
+    assertSafeWebhookUrl(value);
+  } catch (err) {
+    ctx.addIssue({
+      code: ZodIssueCode.custom,
+      message: err instanceof BlockedWebhookUrlError ? err.message : "invalid webhook url"
+    });
+  }
+});
+var webhookEventSchema = string2().min(1).max(120).regex(/^[a-z0-9]+(\.[a-z0-9]+)+$/, "must be a dotted event name like 'task.created'");
+var webhookSubscriptionSchema = createSelectSchema(webhookSubscriptions, {
+  events: array(webhookEventSchema),
+  createdAt: exports_coerce.date(),
+  updatedAt: exports_coerce.date()
+});
+var webhookSubscriptionPublicSchema = webhookSubscriptionSchema.omit({ secret: true });
+var createWebhookSubscriptionInputSchema = createInsertSchema(webhookSubscriptions, {
+  url: webhookUrlSchema,
+  events: array(webhookEventSchema).min(1),
+  secret: string2().min(16).max(200).optional()
+}).omit({ id: true, tenantId: true, active: true, createdAt: true, updatedAt: true }).strict();
+var createWebhookSubscriptionResultSchema = webhookSubscriptionPublicSchema.extend({
+  secret: string2()
+});
+var updateWebhookSubscriptionInputSchema = createUpdateSchema(webhookSubscriptions, {
+  url: webhookUrlSchema.optional(),
+  events: array(webhookEventSchema).min(1).optional()
+}).omit({ id: true, tenantId: true, secret: true, createdAt: true, updatedAt: true }).strict();
+
 // ../../packages/schema/src/contracts/roles.ts
 var permissionSetSchema = createSelectSchema(permissionSets, {
   createdAt: exports_coerce.date(),
@@ -29603,10 +30022,592 @@ function routeOf(op) {
   return `${op.method.toUpperCase()} ${PUBLIC_API_PREFIX}${op.path}`;
 }
 
+// ../../packages/schema/src/operations/agents.ts
+var agentOperations = defineOperations({
+  list: {
+    method: "get",
+    path: "/agents",
+    scopes: ["agents:read"],
+    tag: "Agents",
+    summary: "List agents",
+    description: "The Space's live Agents (`id`, `name`), oldest first, to resolve an Agent by name.",
+    status: 200,
+    response: { description: "The Space's Agents.", list: true }
+  }
+});
+
+// ../../packages/schema/src/operations/crud.ts
+function crudOperations(r) {
+  const base = `/${r.segment}`;
+  const one = `/${r.segment}/{id}`;
+  const event = r.eventBase ?? r.noun.replace(/ /g, ".");
+  return {
+    list: {
+      method: "get",
+      path: base,
+      scopes: [r.read],
+      tag: r.tag,
+      summary: `List ${r.noun}s`,
+      description: `Every ${r.noun} in the key's Space${r.paginated ? ", newest first" : ""}.`,
+      query: r.listQuery,
+      querySchema: r.listQuerySchema,
+      paginated: r.paginated,
+      status: 200,
+      response: { description: `The Space's ${r.noun}s.`, list: true, view: r.view }
+    },
+    get: {
+      method: "get",
+      path: one,
+      scopes: [r.read],
+      tag: r.tag,
+      summary: `Get a ${r.noun}`,
+      description: `Fetch one ${r.noun} by id.`,
+      status: 200,
+      response: { description: `The ${r.noun}.`, view: r.view },
+      errors: { 404: true }
+    },
+    create: {
+      method: "post",
+      path: base,
+      scopes: [r.write],
+      tag: r.tag,
+      summary: `Create a ${r.noun}`,
+      description: `Create a ${r.noun}; fires the \`${event}.created\` webhook.`,
+      body: r.create,
+      status: 201,
+      response: { description: `The created ${r.noun}.`, view: r.view },
+      errors: { 400: true, 409: true },
+      webhook: `${event}.created`
+    },
+    update: {
+      method: "patch",
+      path: one,
+      scopes: [r.write],
+      tag: r.tag,
+      summary: `Update a ${r.noun}`,
+      description: `Patch a ${r.noun}; fires the \`${event}.updated\` webhook.`,
+      body: r.update,
+      status: 200,
+      response: { description: `The updated ${r.noun}.`, view: r.view },
+      errors: { 400: true, 404: true, 409: true },
+      webhook: `${event}.updated`
+    },
+    remove: {
+      method: "delete",
+      path: one,
+      scopes: [r.write],
+      tag: r.tag,
+      summary: `Delete a ${r.noun}`,
+      description: `Delete a ${r.noun}; fires the \`${event}.deleted\` webhook.`,
+      status: 204,
+      response: { description: "Deleted." },
+      errors: { 404: true },
+      webhook: `${event}.deleted`
+    }
+  };
+}
+
+// ../../packages/schema/src/operations/block-templates.ts
+var crud = crudOperations({
+  segment: "block-templates",
+  tag: "Calendar",
+  noun: "block template",
+  read: "calendar:read",
+  write: "calendar:write",
+  create: createBlockTemplateInputSchema,
+  update: updateBlockTemplateInputSchema,
+  listQuery: []
+});
+var blockTemplateOperations = defineOperations({
+  ...crud,
+  create: { ...crud.create, webhook: undefined },
+  update: { ...crud.update, webhook: undefined },
+  remove: { ...crud.remove, webhook: undefined },
+  week: {
+    method: "get",
+    path: "/block-templates/week",
+    scopes: ["calendar:read"],
+    tag: "Calendar",
+    summary: "Lay out a week from the block templates",
+    description: "Every life block the key's member's templates lay out for the week starting `start` (a Monday), in time order, on their wall clock: `{ templateId, lifeKind, title, startAt, endAt, routineId }`. Writes nothing; this is what Sunday planning proposes.",
+    query: [{ name: "start", description: "The week's Monday (YYYY-MM-DD).", format: "date" }],
+    querySchema: blockTemplateWeekQuerySchema,
+    status: 200,
+    response: { description: "The week's blocks." },
+    errors: { 400: true }
+  },
+  defaults: {
+    method: "post",
+    path: "/block-templates/defaults",
+    scopes: ["calendar:write"],
+    tag: "Calendar",
+    summary: "Seed the default week",
+    description: "Give a member with no block templates the default week: sleep, the morning, reading, two work blocks, lunch and dinner with clean-up, a buffer, a free evening and a wind-down. A member who has templates keeps them; the call then returns them unchanged.",
+    status: 200,
+    response: { description: "The member's templates." }
+  }
+});
+
+// ../../packages/schema/src/operations/collection-upkeep.ts
+var collectionUpkeepOperations = defineOperations({
+  list: {
+    method: "get",
+    path: "/collection/{id}/upkeep",
+    scopes: ["collections:read"],
+    tag: "Collection",
+    summary: "List an asset's upkeep and repairs",
+    description: "The Tasks that look after this asset: `upkeep` (`maintains` \u2014 usually recurring, e.g. every 4 weeks from the last time) and `repairs` (one-off fix-it Tasks), open ones first. 404 unless the item is a live `asset`. Returns `{ itemId, upkeep, repairs }`.",
+    status: 200,
+    response: { description: "The asset's Tasks." },
+    errors: { 404: true }
+  },
+  link: {
+    method: "post",
+    path: "/collection/{id}/upkeep",
+    scopes: ["collections:write"],
+    tag: "Collection",
+    summary: "Tie a Task to an asset",
+    description: 'Tie a Task in the Space to this asset as its upkeep (`kind: "maintains"`, the default) or a repair (`"repairs"`). Make the Task (its recurrence, Place, Area) through the tasks API first. When a tied Task is finished \u2014 a one-off marked done, or one occurrence of a recurring one checked off \u2014 the asset gets a `service` / `repair` Entry with the Task on it, once per day, and upkeep moves its `lastServicedAt` forward. Returns the asset\'s Tasks.',
+    body: linkAssetTaskInputSchema,
+    status: 201,
+    response: { description: "The asset's Tasks." },
+    errors: { 400: true, 404: true }
+  },
+  unlink: {
+    method: "delete",
+    path: "/collection/{id}/upkeep/{taskId}",
+    pathParams: { taskId: "The Task's ULID." },
+    scopes: ["collections:write"],
+    tag: "Collection",
+    summary: "Untie a Task from an asset",
+    description: "Untie the Task from this asset; the Task itself stays. Returns the asset's Tasks.",
+    status: 200,
+    response: { description: "The asset's Tasks." },
+    errors: { 404: true }
+  }
+});
+
+// ../../packages/schema/src/operations/google-contacts.ts
+var googleContactsOperations = defineOperations({
+  list: {
+    method: "get",
+    path: "/people/google-contacts",
+    scopes: ["contacts:read"],
+    tag: "People",
+    summary: "Your Google Contacts, to pick from",
+    description: "The key's member's Google Contacts link (`status`: `available`, `mode`, `connected`, `account`) and the people in it matching `q` (a name or an email; everyone without), each with `resourceName`, `name`, `emails`, `phones`, `birthday` (`yearKnown: false` for a day and month only), the contact in do they'd merge into (`match`: by `email`, `phone` or a unique `name`; never a company) and what importing adds (`adds`). Not connected: no candidates. Connecting needs a browser (People \u2192 Import). A key with no member is a 403. Off until `GOOGLE_CONTACTS_API` is `fake` or `live`.",
+    query: [{ name: "q", description: "A name or email to narrow to." }],
+    querySchema: googleContactsQuerySchema,
+    status: 200,
+    response: { description: "The link and the candidates." },
+    errors: { 403: "Not a member's key." }
+  },
+  import: {
+    method: "post",
+    path: "/people/google-contacts/import",
+    scopes: ["contacts:write"],
+    tag: "People",
+    summary: "Import the people you picked from Google Contacts",
+    description: "Only the picked people (`resourceNames`, Google's `people/\u2026` ids, at most 200). Each merges into the contact it matches and fills in only a missing email, phone or birthday (a key date that becomes a Task), else becomes a new contact, so importing twice never duplicates anyone. Returns `{ created, merged (with what each got: added), missing }`. Not connected is a 409; off until `GOOGLE_CONTACTS_API` is set (403).",
+    body: importGoogleContactsInputSchema,
+    status: 200,
+    response: { description: "What the import did." },
+    errors: {
+      400: true,
+      403: "Off, or not a member's key.",
+      409: "Google Contacts isn't connected (or asks to sign in again)."
+    }
+  }
+});
+
+// ../../packages/schema/src/operations/google-health.ts
+var googleHealthOperations = defineOperations({
+  status: {
+    method: "get",
+    path: "/health/google-health",
+    scopes: ["health:read"],
+    tag: "Health",
+    summary: "Get the Google Health link",
+    description: "The key's member's Google Health link (connected in the app, Settings \u2192 Health): `available` and `mode` (off \xB7 fake \xB7 live, the server's switch), `connected`, the Google `account`, `lastSyncAt` and each resource's (sleep, resting_heart_rate, hrv, steps, workouts), and `failure` (`reauth` \xB7 `not_linked` \xB7 `unavailable` \xB7 `other`, with a title and a hint) when the sync stopped, and `nutrition` (writing the member's food back to Google Health, opt-in in the app: `enabled`, `granted` (the link has the write scope), `lastWrittenDay`, `failure`). Never another member's.",
+    status: 200,
+    response: { description: "The link's status." },
+    errors: { 403: true }
+  },
+  sync: {
+    method: "post",
+    path: "/health/google-health/sync",
+    scopes: ["health:write"],
+    tag: "Health",
+    summary: "Sync Google Health now",
+    description: "As the key's member, one sync of their Google Health, as the 07:30 morning sync does: last night's sleep (on the wake day, joining the Sleep and Bedtime Metrics), the day's resting heart rate and HRV, steps and workouts (joining the sessions) onto their own ledger, nothing twice. Returns written and skipped per resource and the status after it; a sync that stops answers 200 with `status.failure`. 409 before the member connected, 403 while the server has Google Health off.",
+    status: 200,
+    response: { description: "What came in, and the status after it." },
+    errors: { 403: true, 409: true }
+  }
+});
+
+// ../../packages/schema/src/operations/inventory-items.ts
+var inventoryItemOperations = defineOperations({
+  ...crudOperations({
+    segment: "inventory-items",
+    tag: "Inventory",
+    noun: "inventory item",
+    read: "inventory:read",
+    write: "inventory:write",
+    create: createInventoryItemInputSchema,
+    update: updateInventoryItemInputSchema,
+    paginated: true,
+    listQuerySchema: paginationQuerySchema
+  })
+});
+
+// ../../packages/schema/src/operations/mail-campaigns.ts
+var pathParams = { id: "The campaign's ULID." };
+var mailCampaignOperations = defineOperations({
+  list: {
+    method: "get",
+    path: "/mail-campaigns",
+    scopes: ["contacts:read"],
+    tag: "Guests",
+    summary: "List a guest list's mail campaigns",
+    description: "Its drafted and sent mails, newest first.",
+    query: [{ name: "guestListId", description: "The guest list (required)." }],
+    querySchema: mailCampaignsQuerySchema,
+    status: 200,
+    response: { description: "The campaigns." },
+    errors: { 400: true }
+  },
+  create: {
+    method: "post",
+    path: "/mail-campaigns",
+    scopes: ["contacts:write"],
+    tag: "Guests",
+    summary: "Draft a mail campaign",
+    description: "A draft for a guest list's households: its `kind` (`message`, `save_the_date` or `invitation`), the template's `data` (the copy per language, Dutch required) and an optional reply address. A key can draft, preview and edit, never test or send: only a member's own session sends.",
+    body: createMailCampaignInputSchema,
+    status: 201,
+    response: { description: "The draft." },
+    errors: { 400: true, 404: true }
+  },
+  get: {
+    method: "get",
+    path: "/mail-campaigns/{id}",
+    pathParams,
+    scopes: ["contacts:read"],
+    tag: "Guests",
+    summary: "Get a mail campaign",
+    description: "",
+    status: 200,
+    response: { description: "The campaign." },
+    errors: { 404: true }
+  },
+  update: {
+    method: "patch",
+    path: "/mail-campaigns/{id}",
+    pathParams,
+    scopes: ["contacts:write"],
+    tag: "Guests",
+    summary: "Edit a draft",
+    description: "Change its kind, data or reply address. Any edit makes the last test stale: a new test is needed before it can be sent.",
+    body: updateMailCampaignInputSchema,
+    status: 200,
+    response: { description: "The draft." },
+    errors: { 400: true, 404: true }
+  },
+  preview: {
+    method: "get",
+    path: "/mail-campaigns/{id}/preview",
+    pathParams,
+    scopes: ["contacts:read"],
+    tag: "Guests",
+    summary: "Preview a mail campaign",
+    description: "The mail as a household would get it in one language (`nl` by default, or `pt`): its subject and rendered body.",
+    query: [{ name: "language", description: "`nl` (default) or `pt`." }],
+    querySchema: mailPreviewQuerySchema,
+    status: 200,
+    response: { description: "The rendered mail." },
+    errors: { 400: true, 404: true }
+  }
+});
+
+// ../../packages/schema/src/operations/meal-plans.ts
+var mealPlanOperations = defineOperations({
+  ...crudOperations({
+    segment: "meal-plans",
+    tag: "Meals",
+    noun: "meal plan",
+    read: "meals:read",
+    write: "meals:write",
+    create: createMealPlanInputSchema,
+    update: updateMealPlanInputSchema
+  })
+});
+
+// ../../packages/schema/src/operations/occurrences.ts
+var occurrenceOperations = defineOperations({
+  list: {
+    method: "get",
+    path: "/occurrences",
+    scopes: ["occurrences:read"],
+    tag: "Occurrences",
+    summary: "List a template's occurrences",
+    description: "Occurrences of one task/habit template, oldest-first.",
+    query: [{ name: "templateId", description: "The task/habit template's ULID.", required: true }],
+    querySchema: object({ templateId: ulidSchema }),
+    status: 200,
+    response: { description: "The template's occurrences." },
+    errors: { 400: true }
+  },
+  update: {
+    method: "patch",
+    path: "/occurrences/{id}",
+    scopes: ["occurrences:write"],
+    tag: "Occurrences",
+    summary: "Override an occurrence",
+    description: 'Reschedule/skip one occurrence ("edit this"); fires `occurrence.updated`.',
+    body: updateOccurrenceInputSchema,
+    status: 200,
+    response: { description: "The overridden occurrence." },
+    errors: { 400: true, 404: true },
+    webhook: "occurrence.updated"
+  },
+  complete: {
+    method: "post",
+    path: "/occurrences/{id}/complete",
+    scopes: ["occurrences:write"],
+    tag: "Occurrences",
+    summary: "Complete an occurrence",
+    description: "Mark an occurrence done; fires `occurrence.completed`.",
+    status: 201,
+    response: { description: "The completed occurrence." },
+    errors: { 404: true },
+    webhook: "occurrence.completed"
+  }
+});
+
+// ../../packages/schema/src/operations/periods.ts
+var periodOperations = defineOperations({
+  ...crudOperations({
+    segment: "periods",
+    tag: "Periods",
+    noun: "period",
+    read: "periods:read",
+    write: "periods:write",
+    create: createPeriodInputSchema,
+    update: updatePeriodInputSchema,
+    listQuery: [
+      { name: "nodeId", description: "Only the periods on this node." },
+      {
+        name: "kind",
+        description: "Only this kind (`hibernation`, `quarantine`, `away`, `treatment_course`, `withdrawal`, \u2026)."
+      },
+      {
+        name: "active",
+        description: "`true`: only running periods; `false`: only ended or not yet started."
+      }
+    ],
+    listQuerySchema: periodsQuerySchema
+  })
+});
+
+// ../../packages/schema/src/operations/planning-rules.ts
+var planningRuleOperations = defineOperations({
+  ...crudOperations({
+    segment: "planning/rules",
+    tag: "Planning rules",
+    noun: "planning rule",
+    read: "planning:read",
+    write: "planning:write",
+    create: createPlanningRuleInputSchema,
+    update: updatePlanningRuleInputSchema,
+    listQuery: [
+      { name: "forUserId", description: "Only this member's rules." },
+      {
+        name: "kind",
+        description: "Only this kind (`fixed_time`, `keep_free`, `meaning`, `whose`, `limit`, `note`)."
+      }
+    ],
+    listQuerySchema: planningRulesQuerySchema
+  })
+});
+
+// ../../packages/schema/src/operations/plans.ts
+function decision(path, verb, what) {
+  return {
+    method: "post",
+    path,
+    scopes: ["tasks:write"],
+    tag: "Plans",
+    summary: `${verb[0]?.toUpperCase()}${verb.slice(1)} plan items`,
+    description: `${what} \`itemIds\` narrows it to those items; absent (or an empty body) answers every item it applies to. An unknown item id is a 404.`,
+    body: planDecisionInputSchema,
+    bodyOptional: true,
+    status: 200,
+    response: { description: "The plan, after.", view: "Plan" },
+    errors: { 400: true, 404: true }
+  };
+}
+var planOperations = defineOperations({
+  list: {
+    method: "get",
+    path: "/plans",
+    scopes: ["tasks:read"],
+    tag: "Plans",
+    summary: "List plans",
+    description: "The Space's plan proposals, newest first (the latest 20), each with its items and each item's task as it is now. `status`: `open` (an item waits for an answer), `settled` (none does) or `replaced` (a newer plan for the same week or day took its place).",
+    query: [
+      { name: "kind", description: "`week` or `day`." },
+      { name: "status", description: "`open`, `settled` or `replaced`." },
+      { name: "startsOn", description: "The week's Monday, or the day (`YYYY-MM-DD`)." },
+      { name: "forUserId", description: "Only this member's plans." }
+    ],
+    querySchema: planListQuerySchema.extend({ forUserId: string2().min(1).optional() }),
+    status: 200,
+    response: { description: "The plans.", list: true, view: "Plan" },
+    errors: { 400: true }
+  },
+  create: {
+    method: "post",
+    path: "/plans",
+    scopes: ["tasks:write"],
+    tag: "Plans",
+    summary: "Propose a plan",
+    description: "The agent proposes a week (`kind: week`, `startsOn` a Monday) or a day for a member (`forUserId`, default the member the key acts for). Each item is about one open task: `plan` it on a `day` (all-day, in the member's zone) or `at` a time (with `durationMinutes` when known), take it back to `someday`, or `let_go`. `reason` is the line shown with it. Nothing is written to a task until the member accepts; a newer plan for the same week or day replaces an open one. An Agent's own work joins only while it waits on the member. A block that is already there (a task, a life block or an event on that day with a similar title) is folded in, not added twice: a task is planned into the block's time, anything else is left out, and `merged` lists each with a hint; `onDuplicate: reject` refuses the plan with those hints instead.",
+    body: createPlanInputSchema,
+    status: 201,
+    response: {
+      description: "The plan, open, with the duplicates it folded in.",
+      view: "PlanCreateResult"
+    },
+    errors: { 400: true }
+  },
+  get: {
+    method: "get",
+    path: "/plans/{id}",
+    scopes: ["tasks:read"],
+    tag: "Plans",
+    summary: "Get a plan",
+    description: "One plan with its items.",
+    status: 200,
+    response: { description: "The plan.", view: "Plan" },
+    errors: { 404: true }
+  },
+  accept: {
+    ...decision("/plans/{id}/accept", "accept", "Accept proposed items: each task is written as the item says (a planned day or time, Someday, or cancelled for Let go; a task still Proposed by the agent joins the plan too), and the item keeps what it replaced for Undo. An item whose task has closed since is dismissed instead."),
+    errors: { 400: true, 404: true, 409: "A newer plan replaced this one." }
+  },
+  dismiss: decision("/plans/{id}/dismiss", "dismiss", "Leave proposed items out. Nothing is written to a task."),
+  undo: decision("/plans/{id}/undo", "undo", "Undo answered items: an accepted item's task is put back as it was before; a dismissed item simply waits again. Both read as proposed afterwards.")
+});
+
+// ../../packages/schema/src/operations/rsvp-answers.ts
+var rsvpAnswerOperations = defineOperations({
+  list: {
+    method: "get",
+    path: "/rsvp-answers",
+    scopes: ["contacts:read"],
+    tag: "Guests",
+    summary: "List RSVP answers",
+    description: "A guest list's answers to its RSVP questions (`guestListId`, required), or one household's (`householdId`): `{ questionId, householdId, guestId, value }`, `guestId` null for the household's own.",
+    query: [
+      { name: "guestListId", description: "The guest list (required)." },
+      { name: "householdId", description: "Only this household's answers." }
+    ],
+    querySchema: rsvpAnswersQuerySchema,
+    status: 200,
+    response: { description: "The answers." },
+    errors: { 400: true, 404: true }
+  },
+  set: {
+    method: "put",
+    path: "/rsvp-answers",
+    scopes: ["contacts:write"],
+    tag: "Guests",
+    summary: "Set a household's RSVP answers",
+    description: "Lays `answers` over the household's stored ones (`value: null` clears one; answers left out stay) and returns what stands. An unknown question, a guest not in the household, a per-guest question without a guest, an event the guest isn't invited to, or a value that doesn't fit the kind is a 422; an answer whose question no longer shows (its `showIf`) is dropped. Fires `rsvp.answers.updated`.",
+    body: setRsvpAnswersInputSchema,
+    status: 200,
+    response: { description: "The household's answers after." },
+    errors: { 400: true, 404: true, 422: "An answer that can't be given (see the message)." },
+    webhook: "rsvp.answers.updated"
+  }
+});
+
+// ../../packages/schema/src/operations/rsvp-questions.ts
+var rsvpQuestionOperations = defineOperations({
+  ...crudOperations({
+    segment: "rsvp-questions",
+    tag: "Guests",
+    noun: "RSVP question",
+    eventBase: "rsvp.question",
+    read: "contacts:read",
+    write: "contacts:write",
+    create: createRsvpQuestionInputSchema,
+    update: updateRsvpQuestionInputSchema,
+    listQuery: [{ name: "guestListId", description: "The guest list (required)." }],
+    listQuerySchema: rsvpQuestionsQuerySchema
+  }),
+  presets: {
+    method: "post",
+    path: "/rsvp-questions/presets",
+    scopes: ["contacts:write"],
+    tag: "Guests",
+    summary: "Add the built-in RSVP questions",
+    description: "Adds the preset questions after the list's own (`diet`: per guest, shown to a guest who said yes to anything, with vegetarian \xB7 vegan \xB7 gluten-free \xB7 lactose-free \xB7 nut allergy \xB7 other, and a text line shown when other is picked; `message`: the household's, once). A preset the list already has stays as it is. Returns the list's questions; fires `rsvp.question.created`.",
+    body: addRsvpPresetsInputSchema,
+    status: 200,
+    response: { description: "The list's questions." },
+    errors: { 400: true, 404: true },
+    webhook: "rsvp.question.created"
+  }
+});
+
+// ../../packages/schema/src/operations/settings.ts
+var settingsOperations = defineOperations({
+  get: {
+    method: "get",
+    path: "/settings",
+    scopes: ["settings:read"],
+    tag: "Settings",
+    summary: "Get settings",
+    description: "The caller's settings (lazily created). The key must carry a user identity.",
+    status: 200,
+    response: { description: "The caller's settings." }
+  },
+  update: {
+    method: "patch",
+    path: "/settings",
+    scopes: ["settings:write"],
+    tag: "Settings",
+    summary: "Update settings",
+    description: "Patch the caller's settings; fires `settings.updated`.",
+    body: updateUserSettingsInputSchema,
+    status: 200,
+    response: { description: "The updated settings." },
+    errors: { 400: true },
+    webhook: "settings.updated"
+  }
+});
+
+// ../../packages/schema/src/operations/shopping-lists.ts
+var shoppingListOperations = defineOperations({
+  ...crudOperations({
+    segment: "shopping-lists",
+    tag: "Shopping",
+    noun: "shopping list",
+    read: "shopping:read",
+    write: "shopping:write",
+    create: createShoppingListInputSchema,
+    update: updateShoppingListInputSchema,
+    paginated: true,
+    listQuerySchema: paginationQuerySchema
+  })
+});
+
 // ../../packages/schema/src/operations/tap-tags.ts
 var READ = ["habits:read", "routines:read"];
 var WRITE = ["habits:write", "routines:write"];
-var pathParams = { id: "The tag's id: the ULID the sticker's link carries (`/t/{id}`)." };
+var pathParams2 = { id: "The tag's id: the ULID the sticker's link carries (`/t/{id}`)." };
 var tapTagOperations = defineOperations({
   list: {
     method: "get",
@@ -29634,7 +30635,7 @@ var tapTagOperations = defineOperations({
   get: {
     method: "get",
     path: "/tap-tags/{id}",
-    pathParams,
+    pathParams: pathParams2,
     scopes: READ,
     tag: "Habits",
     summary: "Get a tap tag",
@@ -29646,7 +30647,7 @@ var tapTagOperations = defineOperations({
   update: {
     method: "patch",
     path: "/tap-tags/{id}",
-    pathParams,
+    pathParams: pathParams2,
     scopes: WRITE,
     tag: "Habits",
     summary: "Rename or rebind a tap tag",
@@ -29659,7 +30660,7 @@ var tapTagOperations = defineOperations({
   remove: {
     method: "delete",
     path: "/tap-tags/{id}",
-    pathParams,
+    pathParams: pathParams2,
     scopes: WRITE,
     tag: "Habits",
     summary: "Delete a tap tag",
@@ -29671,7 +30672,7 @@ var tapTagOperations = defineOperations({
   tap: {
     method: "post",
     path: "/tap-tags/{id}/tap",
-    pathParams,
+    pathParams: pathParams2,
     scopes: WRITE,
     tag: "Habits",
     summary: "Tap a tap tag",
@@ -29682,6 +30683,103 @@ var tapTagOperations = defineOperations({
   }
 });
 
+// ../../packages/schema/src/operations/today.ts
+var todayOperations = defineOperations({
+  fromEarlier: {
+    method: "get",
+    path: "/today/from-earlier",
+    scopes: ["tasks:read"],
+    tag: "Reads",
+    summary: "From earlier",
+    description: 'The planned tasks that slipped (#888): open, non-recurring tasks whose all-day planned day falls in the 14 days before `from`, newest plan first. Timed tasks, tasks placed in a past time block and agent-owned work never roll; older plans simply leave the list (nothing is rewritten). A Space back from 21+ days away gets no pile. Also names `laterThisWeek`, the quietest later day this week (Monday-first; tomorrow on a Sunday) that "Later this week" lands on. Answer with `POST /api/v1/today/rollover`.',
+    query: [
+      {
+        name: "from",
+        description: "Your local day start, an ISO instant (or a bare date, read as UTC midnight). Defaults to the current UTC day."
+      },
+      { name: "areaId", description: "Only tasks in this Area (own or their Project's)." }
+    ],
+    querySchema: fromEarlierQuerySchema,
+    status: 200,
+    response: { description: "From earlier.", view: "FromEarlierResponse" },
+    errors: { 400: true }
+  },
+  rollover: {
+    method: "post",
+    path: "/today/rollover",
+    scopes: ["tasks:write"],
+    tag: "Tasks",
+    summary: "Answer From earlier",
+    description: 'Answer many tasks (and habit/routine occurrences) at once: `reschedule` to `to` (all-day; From earlier\'s Today and Later this week), `someday` (clear the planned day, keep the Area or Project; occurrences untouched), or `drop` ("Let go": tasks cancelled, occurrences skipped; a cancelled task never counts as Landed). Only open tasks and unresolved occurrences change; unknown ids are skipped. Returns how many of each moved. Occurrence ids need `habits:write` too.',
+    body: rolloverInputSchema,
+    status: 201,
+    response: { description: "How many tasks and occurrences changed." },
+    errors: { 400: true }
+  }
+});
+
+// ../../packages/schema/src/operations/webhooks.ts
+var webhookOperations = defineOperations({
+  list: {
+    method: "get",
+    path: "/webhooks",
+    scopes: ["webhooks:read"],
+    tag: "Webhooks",
+    summary: "List webhook subscriptions",
+    description: "The Space's outbound webhook endpoints (secrets omitted), newest first.",
+    querySchema: paginationQuerySchema,
+    paginated: true,
+    status: 200,
+    response: { description: "The subscriptions." }
+  },
+  create: {
+    method: "post",
+    path: "/webhooks",
+    scopes: ["webhooks:write"],
+    tag: "Webhooks",
+    summary: "Register a webhook subscription",
+    description: "Register an endpoint + events; returns the signing secret once.",
+    body: createWebhookSubscriptionInputSchema,
+    status: 201,
+    response: { description: "The created subscription (with its one-time secret)." },
+    errors: { 400: true }
+  },
+  get: {
+    method: "get",
+    path: "/webhooks/{id}",
+    scopes: ["webhooks:read"],
+    tag: "Webhooks",
+    summary: "Get a webhook subscription",
+    description: "One subscription (secret omitted).",
+    status: 200,
+    response: { description: "The subscription." },
+    errors: { 404: true }
+  },
+  update: {
+    method: "patch",
+    path: "/webhooks/{id}",
+    scopes: ["webhooks:write"],
+    tag: "Webhooks",
+    summary: "Update a webhook subscription",
+    description: "Patch url/events, or pause with `active: false`.",
+    body: updateWebhookSubscriptionInputSchema,
+    status: 200,
+    response: { description: "The updated subscription." },
+    errors: { 400: true, 404: true }
+  },
+  remove: {
+    method: "delete",
+    path: "/webhooks/{id}",
+    scopes: ["webhooks:write"],
+    tag: "Webhooks",
+    summary: "Delete a webhook subscription",
+    description: "Remove an endpoint.",
+    status: 204,
+    response: { description: "Deleted." },
+    errors: { 404: true }
+  }
+});
+
 // ../../node_modules/ulidx/dist/node/index.js
 import crypto from "crypto";
 
@@ -29934,7 +31032,7 @@ function parseCapture2(input, now) {
 
 // src/meta.ts
 var CLI_NAME = "do";
-var VERSION = "1.302.0";
+var VERSION = "1.304.0";
 var API_PREFIX = "/api/v1";
 var DEFAULT_API_URL = "http://localhost:3001";
 
@@ -30717,24 +31815,15 @@ var ENTITIES = [
       canDelete: true
     }
   },
-  {
+  entityFromOperations(rsvpQuestionOperations, {
     name: "rsvp-questions",
-    path: "/rsvp-questions",
-    readScopes: ["contacts:read"],
     returns: "RsvpQuestion",
-    canGet: true,
     listFlags: [
       { name: "list", description: "the guest list's id (required)", query: "guestListId" }
     ],
-    write: {
-      scopes: ["contacts:write"],
-      createSchema: createRsvpQuestionInputSchema,
-      createInput: "CreateRsvpQuestionInput",
-      updateSchema: updateRsvpQuestionInputSchema,
-      updateInput: "UpdateRsvpQuestionInput",
-      canDelete: true
-    }
-  },
+    createInput: "CreateRsvpQuestionInput",
+    updateInput: "UpdateRsvpQuestionInput"
+  }),
   {
     name: "guests",
     path: "/guests",
@@ -30843,12 +31932,9 @@ var ENTITIES = [
       canDelete: true
     }
   },
-  {
+  entityFromOperations(periodOperations, {
     name: "periods",
-    path: "/periods",
-    readScopes: ["periods:read"],
     returns: "PeriodView",
-    canGet: true,
     listFlags: [
       { name: "node", description: "only the periods on this node id", query: "nodeId" },
       {
@@ -30862,15 +31948,9 @@ var ENTITIES = [
         query: "active"
       }
     ],
-    write: {
-      scopes: ["periods:write"],
-      createSchema: createPeriodInputSchema,
-      createInput: "CreatePeriodInput",
-      updateSchema: updatePeriodInputSchema,
-      updateInput: "UpdatePeriodInput",
-      canDelete: true
-    }
-  },
+    createInput: "CreatePeriodInput",
+    updateInput: "UpdatePeriodInput"
+  }),
   entityFromOperations(tapTagOperations, {
     name: "tap-tags",
     returns: "TapTagView",
@@ -30932,38 +32012,20 @@ var ENTITIES = [
       canDelete: true
     }
   },
-  {
+  entityFromOperations(shoppingListOperations, {
     name: "shopping-lists",
-    path: "/shopping-lists",
-    readScopes: ["shopping:read"],
     returns: "ShoppingList",
-    canGet: true,
     listFlags: [],
-    write: {
-      scopes: ["shopping:write"],
-      createSchema: createShoppingListInputSchema,
-      createInput: "CreateShoppingListInput",
-      updateSchema: updateShoppingListInputSchema,
-      updateInput: "UpdateShoppingListInput",
-      canDelete: true
-    }
-  },
-  {
+    createInput: "CreateShoppingListInput",
+    updateInput: "UpdateShoppingListInput"
+  }),
+  entityFromOperations(inventoryItemOperations, {
     name: "inventory-items",
-    path: "/inventory-items",
-    readScopes: ["inventory:read"],
     returns: "InventoryItem",
-    canGet: true,
     listFlags: [],
-    write: {
-      scopes: ["inventory:write"],
-      createSchema: createInventoryItemInputSchema,
-      createInput: "CreateInventoryItemInput",
-      updateSchema: updateInventoryItemInputSchema,
-      updateInput: "UpdateInventoryItemInput",
-      canDelete: true
-    }
-  },
+    createInput: "CreateInventoryItemInput",
+    updateInput: "UpdateInventoryItemInput"
+  }),
   {
     name: "recipes",
     path: "/recipes",
@@ -30980,28 +32042,16 @@ var ENTITIES = [
       canDelete: true
     }
   },
-  {
+  entityFromOperations(mealPlanOperations, {
     name: "meal-plans",
-    path: "/meal-plans",
-    readScopes: ["meals:read"],
     returns: "MealPlan",
-    canGet: true,
     listFlags: [],
-    write: {
-      scopes: ["meals:write"],
-      createSchema: createMealPlanInputSchema,
-      createInput: "CreateMealPlanInput",
-      updateSchema: updateMealPlanInputSchema,
-      updateInput: "UpdateMealPlanInput",
-      canDelete: true
-    }
-  },
-  {
+    createInput: "CreateMealPlanInput",
+    updateInput: "UpdateMealPlanInput"
+  }),
+  entityFromOperations({ list: occurrenceOperations.list }, {
     name: "occurrences",
-    path: "/occurrences",
-    readScopes: ["occurrences:read"],
     returns: "Occurrence",
-    canGet: false,
     listFlags: [
       {
         name: "template-id",
@@ -31010,7 +32060,7 @@ var ENTITIES = [
         query: "templateId"
       }
     ]
-  },
+  }),
   {
     name: "time-blocks",
     path: "/time-blocks",
@@ -31034,30 +32084,14 @@ var ENTITIES = [
       canDelete: true
     }
   },
-  {
+  entityFromOperations(blockTemplateOperations, {
     name: "block-templates",
-    path: "/block-templates",
-    readScopes: ["calendar:read"],
     returns: "BlockTemplateView",
-    canGet: true,
     listFlags: [],
-    write: {
-      scopes: ["calendar:write"],
-      createSchema: createBlockTemplateInputSchema,
-      createInput: "CreateBlockTemplateInput",
-      updateSchema: updateBlockTemplateInputSchema,
-      updateInput: "UpdateBlockTemplateInput",
-      canDelete: true
-    }
-  },
-  {
-    name: "webhooks",
-    path: "/webhooks",
-    readScopes: ["webhooks:read"],
-    returns: "WebhookSubscription",
-    canGet: true,
-    listFlags: []
-  }
+    createInput: "CreateBlockTemplateInput",
+    updateInput: "UpdateBlockTemplateInput"
+  }),
+  entityFromOperations({ list: webhookOperations.list, get: webhookOperations.get }, { name: "webhooks", returns: "WebhookSubscription", listFlags: [] })
 ];
 var entityByName = (name) => ENTITIES.find((e) => e.name === name);
 function entityOperations(e) {
@@ -31487,18 +32521,36 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Whether your Google Health is connected, the last sync, and what stops it.",
     args: [],
     flags: [],
-    scopes: READ2,
+    scopes: [...googleHealthOperations.status.scopes],
     returns: "GoogleHealthStatus",
-    notes: "GET /api/v1/health/google-health. Connecting needs Google's consent in a browser: Settings \u2192 Health in do. `failure` (reauth, not_linked, unavailable, other) says what stops the sync, with a title and a hint. `nutrition` says whether your food is written back to Google Health (turned on in do; each settled day once, one entry per meal type) and the last day written."
+    notes: `${routeOf(googleHealthOperations.status)}. Connecting needs Google's consent in a browser: Settings \u2192 Health in do. \`failure\` (reauth, not_linked, unavailable, other) says what stops the sync, with a title and a hint. \`nutrition\` says whether your food is written back to Google Health (turned on in do; each settled day once, one entry per meal type) and the last day written.`
   },
   {
     path: ["health", "google", "sync"],
     summary: "Sync your Google Health now (sleep, resting heart rate, HRV, steps, workouts), as the morning sync does.",
     args: [],
     flags: [],
-    scopes: WRITE3,
+    scopes: [...googleHealthOperations.sync.scopes],
     returns: "GoogleHealthSyncResult",
-    notes: "POST /api/v1/health/google-health/sync. Written and skipped per resource, and the status after it; a sync that stops answers 200 with `status.failure`. 409 before Google Health is connected, 403 while the server has it switched off."
+    notes: `${routeOf(googleHealthOperations.sync)}. Written and skipped per resource, and the status after it; a sync that stops answers 200 with \`status.failure\`. 409 before Google Health is connected, 403 while the server has it switched off.`
+  },
+  {
+    path: ["health", "withings", "status"],
+    summary: "Whether your Withings scale is connected, the last sync, and what stops it.",
+    args: [],
+    flags: [],
+    scopes: READ2,
+    returns: "WithingsStatus",
+    notes: "GET /api/v1/health/withings. Connecting needs Withings' consent in a browser: Settings \u2192 Health in do. `failure` (reauth, unavailable, other) says what stops the sync, with a title and a hint."
+  },
+  {
+    path: ["health", "withings", "sync"],
+    summary: "Sync your Withings weigh-ins now, as the morning sync does.",
+    args: [],
+    flags: [],
+    scopes: WRITE3,
+    returns: "WithingsSyncResult",
+    notes: "POST /api/v1/health/withings/sync. Written and skipped, and the status after it; a sync that stops answers 200 with `status.failure`. 409 before Withings is connected, 403 while the server has it switched off."
   },
   {
     path: ["health", "analyte"],
@@ -31764,9 +32816,9 @@ var COMMAND_SPECS = [
     summary: "From earlier: planned tasks of the last 14 days that weren't done, newest first, and the day Later this week lands on.",
     args: [],
     flags: [{ name: "area", type: "string", description: "Only tasks in this Area (id)." }],
-    scopes: ["tasks:read"],
+    scopes: [...todayOperations.fromEarlier.scopes],
     returns: "FromEarlierResponse",
-    notes: "GET /api/v1/today/from-earlier, from your local day. Nothing here is late: timed tasks, time blocks and agents' work never roll, and a plan older than 14 days just waits where it was filed. Answer with `do today answer`."
+    notes: `${routeOf(todayOperations.fromEarlier)}, from your local day. Nothing here is late: timed tasks, time blocks and agents' work never roll, and a plan older than 14 days just waits where it was filed. Answer with \`do today answer\`.`
   },
   {
     path: ["today", "answer"],
@@ -32276,18 +33328,18 @@ var COMMAND_SPECS = [
     flags: [
       { name: "start", type: "string", description: "The week's Monday (YYYY-MM-DD). Required." }
     ],
-    scopes: ["calendar:read"],
+    scopes: [...blockTemplateOperations.week.scopes],
     returns: "BlockTemplateInstance[]",
-    notes: "GET /api/v1/block-templates/week?start= (plan vs record, phase 1)."
+    notes: `${routeOf(blockTemplateOperations.week)}?start= (plan vs record, phase 1).`
   },
   {
     path: ["block-templates", "defaults"],
     summary: "Give a member with no block templates the default week (sleep, morning, work, meals, a free evening). A no-op when they have templates.",
     args: [],
     flags: [],
-    scopes: ["calendar:write"],
+    scopes: [...blockTemplateOperations.defaults.scopes],
     returns: "BlockTemplateView[]",
-    notes: "POST /api/v1/block-templates/defaults (plan vs record, phase 1)."
+    notes: `${routeOf(blockTemplateOperations.defaults)} (plan vs record, phase 1).`
   },
   {
     path: ["time-blocks", "record"],
@@ -32425,18 +33477,18 @@ var COMMAND_SPECS = [
       },
       { name: "for", type: "string", description: "Only this member's plans (user id)." }
     ],
-    scopes: ["tasks:read"],
+    scopes: [...planOperations.list.scopes],
     returns: "Plan[]",
-    notes: "GET /api/v1/plans (#912): the latest 20."
+    notes: `${routeOf(planOperations.list)} (#912): the latest 20.`
   },
   {
     path: ["plans", "get"],
     summary: "One plan proposal with its items and each item's task as it is now.",
     args: [{ name: "id", required: true, description: "Plan id." }],
     flags: [],
-    scopes: ["tasks:read"],
+    scopes: [...planOperations.get.scopes],
     returns: "Plan",
-    notes: "GET /api/v1/plans/{id} (#912)."
+    notes: `${routeOf(planOperations.get)} (#912).`
   },
   {
     path: ["plans", "propose"],
@@ -32449,9 +33501,9 @@ var COMMAND_SPECS = [
         description: 'The CreatePlanInput as JSON: {"kind":"week","startsOn":"2026-10-19","note":"\u2026","items":[{"taskId":"\u2026","day":"2026-10-20","reason":"Deadline Friday"},{"taskId":"\u2026","at":"2026-10-21T09:00:00Z","durationMinutes":45},{"taskId":"\u2026","action":"someday"},{"taskId":"\u2026","action":"let_go"}],"blocks":[{"templateId":"\u2026","lifeKind":"meal","startAt":"2026-10-19T10:30:00Z","endAt":"2026-10-19T11:30:00Z"}]}. Blocks are life blocks (lay a week out with `do block-templates week`); a plan needs at least one item or block.'
       }
     ],
-    scopes: ["tasks:write"],
+    scopes: [...planOperations.create.scopes],
     returns: "Plan",
-    notes: "POST /api/v1/plans (#912). A week starts on a Monday; days are the member's, times are ISO instants inside the week. `forUserId` names the member (default: the member the key acts for). A newer plan for the same week or day replaces the open one."
+    notes: `${routeOf(planOperations.create)} (#912). A week starts on a Monday; days are the member's, times are ISO instants inside the week. \`forUserId\` names the member (default: the member the key acts for). A newer plan for the same week or day replaces the open one.`
   },
   {
     path: ["plans", "accept"],
@@ -32461,9 +33513,9 @@ var COMMAND_SPECS = [
       { name: "items", required: false, description: "Item ids (default: every proposed item)." }
     ],
     flags: [],
-    scopes: ["tasks:write"],
+    scopes: [...planOperations.accept.scopes],
     returns: "Plan",
-    notes: "POST /api/v1/plans/{id}/accept (#912). Undo with `do plans undo`."
+    notes: `${routeOf(planOperations.accept)} (#912). Undo with \`do plans undo\`.`
   },
   {
     path: ["plans", "dismiss"],
@@ -32473,9 +33525,9 @@ var COMMAND_SPECS = [
       { name: "items", required: false, description: "Item ids (default: every proposed item)." }
     ],
     flags: [],
-    scopes: ["tasks:write"],
+    scopes: [...planOperations.dismiss.scopes],
     returns: "Plan",
-    notes: "POST /api/v1/plans/{id}/dismiss (#912). Nothing is written to a task."
+    notes: `${routeOf(planOperations.dismiss)} (#912). Nothing is written to a task.`
   },
   {
     path: ["plans", "undo"],
@@ -32485,9 +33537,9 @@ var COMMAND_SPECS = [
       { name: "items", required: false, description: "Item ids (default: every answered item)." }
     ],
     flags: [],
-    scopes: ["tasks:write"],
+    scopes: [...planOperations.undo.scopes],
     returns: "Plan",
-    notes: "POST /api/v1/plans/{id}/undo (#912). The items read as proposed again."
+    notes: `${routeOf(planOperations.undo)} (#912). The items read as proposed again.`
   },
   {
     path: ["plan", "rules", "list"],
@@ -32501,9 +33553,9 @@ var COMMAND_SPECS = [
         description: "fixed_time, keep_free, meaning, whose, limit or note."
       }
     ],
-    scopes: ["planning:read"],
+    scopes: [...planningRuleOperations.list.scopes],
     returns: "PlanningRule[]",
-    notes: "GET /api/v1/planning/rules. Oldest first; `addedByAgent` marks the ones an agent added."
+    notes: `${routeOf(planningRuleOperations.list)}. Oldest first; \`addedByAgent\` marks the ones an agent added.`
   },
   {
     path: ["plan", "rules", "add"],
@@ -32521,9 +33573,9 @@ var COMMAND_SPECS = [
         description: "The member it is for (user id; default: the member the key acts for)."
       }
     ],
-    scopes: ["planning:write"],
+    scopes: [...planningRuleOperations.create.scopes],
     returns: "PlanningRule",
-    notes: "POST /api/v1/planning/rules. `forUserId` (--for) names the member; a rule without --rule is a note."
+    notes: `${routeOf(planningRuleOperations.create)}. \`forUserId\` (--for) names the member; a rule without --rule is a note.`
   },
   {
     path: ["plan", "rules", "update"],
@@ -32537,18 +33589,18 @@ var COMMAND_SPECS = [
         description: "The new structured part as JSON (see `plan rules add`), or `none` to make it a note."
       }
     ],
-    scopes: ["planning:write"],
+    scopes: [...planningRuleOperations.update.scopes],
     returns: "PlanningRule",
-    notes: "PATCH /api/v1/planning/rules/{id}."
+    notes: `${routeOf(planningRuleOperations.update)}.`
   },
   {
     path: ["plan", "rules", "remove"],
     summary: "Remove a planning rule (to the trash).",
     args: [{ name: "id", required: true, description: "Rule id." }],
     flags: [],
-    scopes: ["planning:write"],
+    scopes: [...planningRuleOperations.remove.scopes],
     returns: "void",
-    notes: "DELETE /api/v1/planning/rules/{id}. Destructive: needs --allow-destructive."
+    notes: `${routeOf(planningRuleOperations.remove)}. Destructive: needs --allow-destructive.`
   },
   {
     path: ["tasks", "ready"],
@@ -33669,7 +34721,7 @@ var COMMAND_SPECS = [
     summary: "List the Space's Agents (id + name).",
     args: [],
     flags: [],
-    scopes: ["agents:read"],
+    scopes: [...agentOperations.list.scopes],
     returns: "AgentSummary",
     notes: "Creating an Agent and minting its keys stays a member's job in the app."
   },
@@ -33986,7 +35038,7 @@ var COMMAND_SPECS = [
     summary: "Show the caller's settings for the Space.",
     args: [],
     flags: [],
-    scopes: ["settings:read"],
+    scopes: [...settingsOperations.get.scopes],
     returns: "UserSettings",
     notes: "Needs a key minted while logged in (it carries the user identity)."
   },
@@ -33995,7 +35047,7 @@ var COMMAND_SPECS = [
     summary: "Patch the caller's settings.",
     args: [],
     flags: [{ name: "data", type: "string", description: "JSON of fields to change." }],
-    scopes: ["settings:write"],
+    scopes: [...settingsOperations.update.scopes],
     returns: "UserSettings"
   },
   {
@@ -34153,9 +35205,9 @@ var COMMAND_SPECS = [
     summary: "An asset's upkeep and repair Tasks, open ones first.",
     args: [{ name: "id", required: true, description: "Asset (Collection Item) ULID." }],
     flags: [],
-    scopes: ["collections:read"],
+    scopes: [...collectionUpkeepOperations.list.scopes],
     returns: "AssetUpkeep",
-    notes: "GET /api/v1/collection/{id}/upkeep (LifeOS House). Returns { itemId, upkeep, repairs }."
+    notes: `${routeOf(collectionUpkeepOperations.list)} (LifeOS House). Returns { itemId, upkeep, repairs }.`
   },
   {
     path: ["collection", "link-task"],
@@ -34165,9 +35217,9 @@ var COMMAND_SPECS = [
       { name: "taskId", required: true, description: "Task ULID." }
     ],
     flags: [{ name: "repair", type: "boolean", description: "A one-off repair, not upkeep." }],
-    scopes: ["collections:write"],
+    scopes: [...collectionUpkeepOperations.link.scopes],
     returns: "AssetUpkeep",
-    notes: "POST /api/v1/collection/{id}/upkeep. Make the Task (recurrence, Place, Area) first. Finishing it writes the asset's service / repair Entry by itself."
+    notes: `${routeOf(collectionUpkeepOperations.link)}. Make the Task (recurrence, Place, Area) first. Finishing it writes the asset's service / repair Entry by itself.`
   },
   {
     path: ["collection", "unlink-task"],
@@ -34177,7 +35229,7 @@ var COMMAND_SPECS = [
       { name: "taskId", required: true, description: "Task ULID." }
     ],
     flags: [],
-    scopes: ["collections:write"],
+    scopes: [...collectionUpkeepOperations.unlink.scopes],
     returns: "AssetUpkeep"
   },
   {
@@ -35024,6 +36076,35 @@ var COMMAND_SPECS = [
     returns: "MoneyYear",
     notes: "GET /api/v1/money/year. totals (income, spent, saved) and lastYear (the same months a year earlier, null with nothing booked then); months Jan\u2013Dec; spending and income by category, biggest first, each with lastYear; recurring streams with thisYear, lastYear and change (new \xB7 stopped \xB7 up \xB7 down \xB7 same); goals with what went toward them this year. A year under way counts to this month (through)."
   },
+  {
+    path: ["money", "net-worth"],
+    summary: "Net worth now and its month-end line (the accounts that count in it).",
+    args: [],
+    flags: [
+      { name: "scope", type: "string", description: "all (default) | space | owner." },
+      {
+        name: "months",
+        type: "string",
+        description: "How many months the line covers (2\u201360, default 12)."
+      }
+    ],
+    scopes: ["finance:read"],
+    returns: "MoneyNetWorth",
+    notes: "GET /api/v1/money/net-worth. total, have and owe this month; points per month (oldest first, total null before any value); accounts biggest first with value, source (balance \xB7 ledger \xB7 manual) and the month it's from. A loan or a card always counts as owed."
+  },
+  {
+    path: ["money", "net-worth-set"],
+    summary: "Set an account's value for a month by hand (a house, a car); again replaces it.",
+    args: [{ name: "accountId", required: true, description: "Account ULID." }],
+    flags: [
+      { name: "value", type: "string", description: "The value, e.g. 310000 or 1234.56." },
+      { name: "month", type: "string", description: "The month, YYYY-MM (default this month)." },
+      { name: "data", type: "string", description: "SetMoneyNetWorthValueInput JSON instead." }
+    ],
+    scopes: ["finance:write"],
+    returns: "MoneySnapshot",
+    notes: "PUT /api/v1/money/net-worth/values. A month ahead is refused. This month's value also becomes the account's balance unless a bank link keeps it. `do money net-worth-set <accountId> --value 310000`."
+  },
   {
     path: ["money", "goals"],
     summary: "List money goals: what's saved toward each, soonest first.",
@@ -35773,7 +36854,7 @@ var COMMAND_SPECS = [
     summary: "Your Google Contacts, to pick from: who they'd merge into and what importing adds.",
     args: [],
     flags: [{ name: "q", type: "string", description: "A name or email to narrow to." }],
-    scopes: ["contacts:read"],
+    scopes: [...googleContactsOperations.list.scopes],
     returns: "GoogleContactsList",
     notes: "Connecting needs a browser (People \u2192 Import). Not connected: candidates is empty and status.connected false. A key with no member is forbidden."
   },
@@ -35788,7 +36869,7 @@ var COMMAND_SPECS = [
       }
     ],
     flags: [],
-    scopes: ["contacts:write"],
+    scopes: [...googleContactsOperations.import.scopes],
     returns: "GoogleContactsImportResult",
     notes: "Each merges into the contact it matches (email, then phone, then a unique name) and fills in only a missing email, phone or birthday; the rest become new contacts. Ids Google no longer has come back as missing. Not connected is a conflict."
   },
@@ -35897,7 +36978,7 @@ var COMMAND_SPECS = [
         description: 'JSON AddRsvpPresetsInput, e.g. {"guestListId":"01\u2026","presets":["diet","message"]}'
       }
     ],
-    scopes: ["contacts:write"],
+    scopes: [...rsvpQuestionOperations.presets.scopes],
     returns: "RsvpQuestion"
   },
   {
@@ -35908,7 +36989,7 @@ var COMMAND_SPECS = [
       { name: "list", type: "string", description: "The guest list's id (required)." },
       { name: "household", type: "string", description: "Only this household's answers." }
     ],
-    scopes: ["contacts:read"],
+    scopes: [...rsvpAnswerOperations.list.scopes],
     returns: "RsvpAnswer"
   },
   {
@@ -35922,7 +37003,7 @@ var COMMAND_SPECS = [
         description: 'JSON SetRsvpAnswersInput, e.g. {"guestListId":"01\u2026","householdId":"01\u2026","answers":[{"questionId":"01\u2026","value":true},{"questionId":"01\u2026","guestId":"01\u2026","value":["vegan"]}]}'
       }
     ],
-    scopes: ["contacts:write"],
+    scopes: [...rsvpAnswerOperations.set.scopes],
     returns: "RsvpAnswer"
   },
   {
@@ -35969,7 +37050,7 @@ var COMMAND_SPECS = [
     summary: "A guest list's mail campaigns (save-the-dates, invitations), newest first.",
     args: [],
     flags: [{ name: "list", type: "string", description: "The guest list's id (required)." }],
-    scopes: ["contacts:read"],
+    scopes: [...mailCampaignOperations.list.scopes],
     returns: "MailCampaignView",
     notes: "Each campaign carries the households it reaches (a draft: who it would go to) with their status, its mails by status, and readyToSend."
   },
@@ -35978,7 +37059,7 @@ var COMMAND_SPECS = [
     summary: "One mail campaign, with its households and how far it got.",
     args: [{ name: "id", required: true, description: "The campaign's id." }],
     flags: [],
-    scopes: ["contacts:read"],
+    scopes: [...mailCampaignOperations.get.scopes],
     returns: "MailCampaignView"
   },
   {
@@ -35992,7 +37073,7 @@ var COMMAND_SPECS = [
         description: 'JSON CreateMailCampaignInput, e.g. {"guestListId":"01\u2026","kind":"save_the_date","template":"message","data":{"nl":{"subject":"\u2026","heading":"\u2026","paragraphs":["\u2026"]},"pt":{\u2026},"footer":{"deleteBy":"2027-12-31"}},"replyTo":"hallo@example.com"}'
       }
     ],
-    scopes: ["contacts:write"],
+    scopes: [...mailCampaignOperations.create.scopes],
     returns: "MailCampaignView",
     notes: "Drafting only: a member previews it, sends a test to the Space's members and sends it from the Mail tab. An agent can never test or send."
   },
@@ -36007,7 +37088,7 @@ var COMMAND_SPECS = [
         description: 'JSON UpdateMailCampaignInput, e.g. {"data":{"nl":{\u2026}}}'
       }
     ],
-    scopes: ["contacts:write"],
+    scopes: [...mailCampaignOperations.update.scopes],
     returns: "MailCampaignView",
     notes: "Only a draft changes (409 otherwise); an edit makes the last test stale."
   },
@@ -36016,7 +37097,7 @@ var COMMAND_SPECS = [
     summary: "Draw a campaign's mail as its first household would get it.",
     args: [{ name: "id", required: true, description: "The campaign's id." }],
     flags: [{ name: "language", type: "string", description: "nl (default) or pt." }],
-    scopes: ["contacts:read"],
+    scopes: [...mailCampaignOperations.preview.scopes],
     returns: "MailPreview"
   },
   {
@@ -36030,23 +37111,23 @@ var COMMAND_SPECS = [
   },
   {
     path: ["guest-lists", "export"],
-    summary: "Export for the caterer, the venue, the church or the RSVP answers (CSV) to stdout, or save the floor plan (PDF) to a file.",
+    summary: "Export for the caterer, the venue, the church or the RSVP answers (CSV) to stdout, or save the floor plan or the paper invitations (PDF) to a file.",
     args: [{ name: "id", required: true, description: "The guest list's id." }],
     flags: [
       {
         name: "kind",
         type: "string",
-        description: "caterer (meals and diets per table), venue (who sits where), church (who comes to the ceremony), answers (every RSVP answer, a row per guest) or floor-plan (PDF)."
+        description: "caterer (meals and diets per table), venue (who sits where), church (who comes to the ceremony), answers (every RSVP answer, a row per guest), floor-plan (PDF), invitations (PDF: a card per household with a live RSVP link, its QR and code) or printer (CSV of those cards: household, address lines, country, language, code, URL)."
       },
       {
         name: "out",
         type: "string",
-        description: "Where to save the floor plan (default: the name the API gives it)."
+        description: "Where to save a PDF (default: the name the API gives it)."
       }
     ],
     scopes: ["contacts:read"],
     returns: "string",
-    notes: "A CSV goes to stdout (`> tables.csv`); the floor plan is saved: `do guest-lists export <id> --kind floor-plan --out plan.pdf`."
+    notes: "A CSV goes to stdout (`> tables.csv`); a PDF is saved: `do guest-lists export <id> --kind invitations --out invitations.pdf`. Mint the links first (`do rsvp-links create`); the QR opens the list's `siteUrl` + /i/<token>, and its `sitePassword` is printed only when set."
   },
   {
     path: ["rsvp-links", "list"],
@@ -38608,7 +39689,7 @@ var HANDLERS = {
   "today earlier": async ({ flags, io, requireClient }) => {
     const area = flagString(flags, "area");
     return {
-      data: await requireClient().get("/today/from-earlier", {
+      data: await requireClient().get(pathOf(todayOperations.fromEarlier), {
         query: { from: localDayStart(io.now()).toISOString(), areaId: area }
       }),
       render: renderFromEarlier
@@ -39548,12 +40629,12 @@ var HANDLERS = {
     if (start === undefined)
       throw usageError("block-templates week needs --start");
     return {
-      data: await requireClient().get("/block-templates/week", { query: { start } }),
+      data: await requireClient().get(pathOf(blockTemplateOperations.week), { query: { start } }),
       render: renderRecord
     };
   },
   "block-templates defaults": async ({ requireClient }) => ({
-    data: await requireClient().post("/block-templates/defaults", {}),
+    data: await requireClient().post(pathOf(blockTemplateOperations.defaults), {}),
     render: renderRecord
   }),
   "time-blocks record": async ({ args, requireClient }) => {
@@ -39638,7 +40719,7 @@ var HANDLERS = {
     };
   },
   "plans list": async ({ flags, requireClient }) => {
-    const plans = await requireClient().get("/plans", {
+    const plans = await requireClient().get(pathOf(planOperations.list), {
       query: {
         kind: flagString(flags, "kind"),
         status: flagString(flags, "status"),
@@ -39650,19 +40731,25 @@ var HANDLERS = {
   },
   "plans get": async ({ args, requireClient }) => {
     const id = requireArg(args, 0, "plan id");
-    return { data: await requireClient().get(`/plans/${id}`), render: renderPlan };
+    return {
+      data: await requireClient().get(pathOf(planOperations.get, { id })),
+      render: renderPlan
+    };
   },
   "plans propose": async ({ flags, requireClient }) => {
     if (flagString(flags, "data") === undefined)
       throw usageError("plans propose needs --data");
     const body = parseInput(createPlanInputSchema, readDataFlag(flags));
-    return { data: await requireClient().post("/plans", body), render: renderPlan };
+    return {
+      data: await requireClient().post(pathOf(planOperations.create), body),
+      render: renderPlan
+    };
   },
   "plans accept": async (ctx) => planDecision(ctx, "accept"),
   "plans dismiss": async (ctx) => planDecision(ctx, "dismiss"),
   "plans undo": async (ctx) => planDecision(ctx, "undo"),
   "plan rules list": async ({ flags, requireClient }) => {
-    const rules = await requireClient().get("/planning/rules", {
+    const rules = await requireClient().get(pathOf(planningRuleOperations.list), {
       query: { forUserId: flagString(flags, "for"), kind: flagString(flags, "kind") }
     });
     return { data: rules, render: renderPlanningRules };
@@ -39679,7 +40766,7 @@ var HANDLERS = {
       ...flagString(flags, "for") ? { forUserId: flagString(flags, "for") } : {}
     });
     return {
-      data: await requireClient().post("/planning/rules", body),
+      data: await requireClient().post(pathOf(planningRuleOperations.create), body),
       render: renderPlanningRule
     };
   },
@@ -39691,14 +40778,14 @@ var HANDLERS = {
       ...rule !== undefined ? { rule } : {}
     });
     return {
-      data: await requireClient().patch(`/planning/rules/${id}`, body),
+      data: await requireClient().patch(pathOf(planningRuleOperations.update, { id }), body),
       render: renderPlanningRule
     };
   },
   "plan rules remove": async ({ args, flags, requireClient }) => {
     const id = requireArg(args, 0, "rule id");
     assertDestructiveAllowed(flags, "remove a planning rule");
-    await requireClient().delete(`/planning/rules/${id}`);
+    await requireClient().delete(pathOf(planningRuleOperations.remove, { id }));
     return { data: { id, removed: true }, render: () => `Removed rule ${id}.` };
   },
   "tasks ready": async ({ args, flags, requireClient }) => {
@@ -39940,7 +41027,7 @@ var HANDLERS = {
     };
   },
   "agents list": async ({ requireClient }) => ({
-    data: await requireClient().getPage("/agents"),
+    data: await requireClient().getPage(pathOf(agentOperations.list)),
     render: renderList
   }),
   "agent connection get": async ({ requireClient }) => ({
@@ -40056,12 +41143,15 @@ var HANDLERS = {
     };
   },
   "settings get": async ({ requireClient }) => ({
-    data: await requireClient().get("/settings"),
+    data: await requireClient().get(pathOf(settingsOperations.get)),
     render: renderRecord
   }),
   "settings update": async ({ flags, requireClient }) => {
     const body = parseInput(updateUserSettingsInputSchema, readDataFlag(flags));
-    return { data: await requireClient().patch("/settings", body), render: renderRecord };
+    return {
+      data: await requireClient().patch(pathOf(settingsOperations.update), body),
+      render: renderRecord
+    };
   },
   "modules list": async ({ requireClient }) => {
     const settings = await requireClient().get("/settings");
@@ -40155,7 +41245,10 @@ var HANDLERS = {
   },
   "collection upkeep": async ({ args, requireClient }) => {
     const id = requireArg(args, 0, "item id");
-    return { data: await requireClient().get(`/collection/${id}/upkeep`), render: renderRecord };
+    return {
+      data: await requireClient().get(pathOf(collectionUpkeepOperations.list, { id })),
+      render: renderRecord
+    };
   },
   "collection link-task": async ({ args, flags, requireClient }) => {
     const id = requireArg(args, 0, "item id");
@@ -40165,7 +41258,7 @@ var HANDLERS = {
       kind: flagBool(flags, "repair") ? "repairs" : "maintains"
     });
     return {
-      data: await requireClient().post(`/collection/${id}/upkeep`, body),
+      data: await requireClient().post(pathOf(collectionUpkeepOperations.link, { id }), body),
       render: renderRecord
     };
   },
@@ -40173,7 +41266,7 @@ var HANDLERS = {
     const id = requireArg(args, 0, "item id");
     const taskId = requireArg(args, 1, "task id");
     return {
-      data: await requireClient().delete(`/collection/${id}/upkeep/${taskId}`),
+      data: await requireClient().delete(pathOf(collectionUpkeepOperations.unlink, { id, taskId })),
       render: renderRecord
     };
   },
@@ -40738,6 +41831,23 @@ var HANDLERS = {
     });
     return { data: await requireClient().post("/money/budget/copy", body), render: renderRecord };
   },
+  "money net-worth": async ({ flags, requireClient }) => ({
+    data: await requireClient().get("/money/net-worth", {
+      query: { scope: flagString(flags, "scope"), months: flagString(flags, "months") }
+    }),
+    render: renderRecord
+  }),
+  "money net-worth-set": async ({ args, flags, requireClient }) => {
+    const body = flagString(flags, "data") !== undefined ? parseInput(setMoneyNetWorthValueInputSchema, readDataFlag(flags)) : parseInput(setMoneyNetWorthValueInputSchema, {
+      accountId: requireArg(args, 0, "account id"),
+      value: requireFlag(flags, "value", "money net-worth-set needs --value <amount>"),
+      month: flagString(flags, "month")
+    });
+    return {
+      data: await requireClient().put("/money/net-worth/values", body),
+      render: renderRecord
+    };
+  },
   "money goals": async ({ requireClient }) => ({
     data: await requireClient().get("/money/goals"),
     render: renderList
@@ -41192,12 +42302,20 @@ var HANDLERS = {
     data: await requireClient().delete(`/health/shares/${requireArg(args, 0, "id")}`),
     render: renderRecord
   }),
+  "health withings status": async ({ requireClient }) => ({
+    data: await requireClient().get("/health/withings"),
+    render: renderRecord
+  }),
+  "health withings sync": async ({ requireClient }) => ({
+    data: await requireClient().post("/health/withings/sync", {}),
+    render: renderRecord
+  }),
   "health google status": async ({ requireClient }) => ({
-    data: await requireClient().get("/health/google-health"),
+    data: await requireClient().get(pathOf(googleHealthOperations.status)),
     render: renderRecord
   }),
   "health google sync": async ({ requireClient }) => ({
-    data: await requireClient().post("/health/google-health/sync", {}),
+    data: await requireClient().post(pathOf(googleHealthOperations.sync), {}),
     render: renderRecord
   }),
   "health consent": async ({ requireClient }) => ({
@@ -41428,7 +42546,9 @@ var HANDLERS = {
   "people google": async ({ flags, requireClient }) => {
     const q = flagString(flags, "q");
     return {
-      data: await requireClient().get("/people/google-contacts", { query: q ? { q } : {} }),
+      data: await requireClient().get(pathOf(googleContactsOperations.list), {
+        query: q ? { q } : {}
+      }),
       render: renderRecord
     };
   },
@@ -41438,7 +42558,7 @@ var HANDLERS = {
     }
     const body = parseInput(importGoogleContactsInputSchema, { resourceNames: args });
     return {
-      data: await requireClient().post("/people/google-contacts/import", body),
+      data: await requireClient().post(pathOf(googleContactsOperations.import), body),
       render: renderRecord
     };
   },
@@ -41586,7 +42706,7 @@ var HANDLERS = {
   "rsvp-questions presets": async ({ flags, requireClient }) => {
     const body = parseInput(addRsvpPresetsInputSchema, readDataFlag(flags));
     return {
-      data: await requireClient().post("/rsvp-questions/presets", body),
+      data: await requireClient().post(pathOf(rsvpQuestionOperations.presets), body),
       render: renderRecord
     };
   },
@@ -41599,11 +42719,17 @@ var HANDLERS = {
       guestListId: list,
       ...household ? { householdId: household } : {}
     });
-    return { data: await requireClient().get("/rsvp-answers", { query }), render: renderRecord };
+    return {
+      data: await requireClient().get(pathOf(rsvpAnswerOperations.list), { query }),
+      render: renderRecord
+    };
   },
   "rsvp-answers set": async ({ flags, requireClient }) => {
     const body = parseInput(setRsvpAnswersInputSchema, readDataFlag(flags));
-    return { data: await requireClient().put("/rsvp-answers", body), render: renderRecord };
+    return {
+      data: await requireClient().put(pathOf(rsvpAnswerOperations.set), body),
+      render: renderRecord
+    };
   },
   "seating-proposals list": async ({ flags, requireClient }) => {
     const list = flagString(flags, "list");
@@ -41642,23 +42768,31 @@ var HANDLERS = {
       throw usageError("mail-campaigns list needs --list <guest list id>");
     parseInput(mailCampaignsQuerySchema, { guestListId: list });
     return {
-      data: await requireClient().get("/mail-campaigns", { query: { guestListId: list } }),
+      data: await requireClient().get(pathOf(mailCampaignOperations.list), {
+        query: { guestListId: list }
+      }),
       render: renderRecord
     };
   },
   "mail-campaigns get": async ({ args, requireClient }) => {
     const id = requireArg(args, 0, "campaign id");
-    return { data: await requireClient().get(`/mail-campaigns/${id}`), render: renderRecord };
+    return {
+      data: await requireClient().get(pathOf(mailCampaignOperations.get, { id })),
+      render: renderRecord
+    };
   },
   "mail-campaigns create": async ({ flags, requireClient }) => {
     const body = parseInput(createMailCampaignInputSchema, { id: ulid3(), ...readDataFlag(flags) });
-    return { data: await requireClient().post("/mail-campaigns", body), render: renderRecord };
+    return {
+      data: await requireClient().post(pathOf(mailCampaignOperations.create), body),
+      render: renderRecord
+    };
   },
   "mail-campaigns update": async ({ args, flags, requireClient }) => {
     const id = requireArg(args, 0, "campaign id");
     const body = parseInput(updateMailCampaignInputSchema, readDataFlag(flags));
     return {
-      data: await requireClient().patch(`/mail-campaigns/${id}`, body),
+      data: await requireClient().patch(pathOf(mailCampaignOperations.update, { id }), body),
       render: renderRecord
     };
   },
@@ -41668,7 +42802,7 @@ var HANDLERS = {
       language: flagString(flags, "language") ?? "nl"
     });
     return {
-      data: await requireClient().get(`/mail-campaigns/${id}/preview`, { query }),
+      data: await requireClient().get(pathOf(mailCampaignOperations.preview, { id }), { query }),
       render: renderRecord
     };
   },
@@ -41683,9 +42817,9 @@ var HANDLERS = {
     const id = requireArg(args, 0, "guest list id");
     const kind = parseInput(guestExportKindSchema, flagString(flags, "kind") ?? "venue");
     const path = `/guest-lists/${id}/exports/${kind}`;
-    if (kind === "floor-plan") {
+    if (kind === "floor-plan" || kind === "invitations") {
       const file = await requireClient().getBytes(path);
-      const out = flagString(flags, "out") ?? basename2(file.name ?? "floor-plan.pdf");
+      const out = flagString(flags, "out") ?? basename2(file.name ?? `${kind}.pdf`);
       writeFileSync2(out, file.bytes);
       return {
         data: { id, kind, saved: out, size: file.bytes.byteLength, type: file.contentType },
@@ -42143,7 +43277,10 @@ async function planDecision({ args, requireClient }, verb) {
   const id = requireArg(args, 0, "plan id");
   const itemIds = args.slice(1);
   const body = parseInput(planDecisionInputSchema, itemIds.length > 0 ? { itemIds } : {});
-  return { data: await requireClient().post(`/plans/${id}/${verb}`, body), render: renderPlan };
+  return {
+    data: await requireClient().post(pathOf(planOperations[verb], { id }), body),
+    render: renderPlan
+  };
 }
 function parseInput(schema, value) {
   const result = schema.safeParse(value);