@robbeverhelst/do 1.306.1 → 1.307.0

package/dist/do.js

@@ -5646,6 +5646,35 @@ var foodWeekReads = pgTable("food_week_reads", {
   weekStart: text("week_start").notNull()
 }, (t) => [unique("food_week_reads_owner_week_uniq").on(t.tenantId, t.ownerUserId, t.weekStart)]);
 
+// ../../packages/schema/src/db/api-keys.ts
+var apiKeys = pgTable("api_keys", {
+  id: text("id").primaryKey(),
+  tenantId: text("tenant_id").notNull().references(() => tenants.id),
+  userId: text("user_id").references(() => users.id),
+  agentId: text("agent_id").references(() => agents.id),
+  name: text("name").notNull(),
+  prefix: text("prefix").notNull(),
+  keyHash: text("key_hash").notNull().unique(),
+  scopes: text("scopes").array().notNull().default([]),
+  lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
+  revokedAt: timestamp("revoked_at", { withTimezone: true }),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+}, (t) => [index("api_keys_tenant_idx").on(t.tenantId)]);
+var apiKeyChanges = pgTable("api_key_changes", {
+  id: text("id").primaryKey(),
+  tenantId: text("tenant_id").notNull().references(() => tenants.id),
+  apiKeyId: text("api_key_id").notNull().references(() => apiKeys.id),
+  actorUserId: text("actor_user_id").references(() => users.id),
+  actorApiKeyId: text("actor_api_key_id").references(() => apiKeys.id),
+  actorAgentId: text("actor_agent_id").references(() => agents.id),
+  beforeName: text("before_name").notNull(),
+  afterName: text("after_name").notNull(),
+  beforeScopes: text("before_scopes").array().notNull(),
+  afterScopes: text("after_scopes").array().notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (t) => [index("api_key_changes_key_idx").on(t.apiKeyId, t.createdAt)]);
+
 // ../../packages/schema/src/db/webhooks.ts
 var webhookSubscriptions = pgTable("webhook_subscriptions", {
   id: text("id").primaryKey(),
@@ -19899,6 +19928,9 @@ var loginResultSchema = object({
   tenantId: ulidSchema,
   onboardingCompleted: boolean3()
 });
+var googleIdTokenInputSchema = object({
+  idToken: string2().min(1)
+});
 var registerInputSchema = object({
   email: string2().email(),
   password: string2().min(8)
@@ -24797,6 +24829,56 @@ var reviewDayStatSchema = object({
 });
 var reviewStatsSchema = array(reviewDayStatSchema);
 
+// ../../packages/schema/src/contracts/reads.ts
+var readWindowQuerySchema = object({
+  from: instantQuerySchema.optional(),
+  to: instantQuerySchema.optional()
+});
+var nowQuerySchema = readWindowQuerySchema.extend({
+  for: taskWaitingOnInputSchema.optional()
+});
+var nowResponseSchema = object({
+  from: exports_coerce.date(),
+  to: exports_coerce.date(),
+  for: actorRefSchema,
+  waitingOnYou: array(taskViewSchema),
+  readyForYou: array(taskViewSchema).default([]),
+  timeline: todayResponseSchema
+});
+var landedByActorSchema = object({
+  actor: actorRefSchema.nullable(),
+  count: number2().int().nonnegative()
+});
+var landedResponseSchema = object({
+  from: exports_coerce.date(),
+  to: exports_coerce.date(),
+  total: number2().int().nonnegative(),
+  byActor: array(landedByActorSchema),
+  tasks: array(taskViewSchema)
+});
+var searchNodeTypeSchema = _enum2([
+  "task",
+  "project",
+  "area",
+  "note",
+  "habit",
+  "routine",
+  "contact",
+  "collection_item"
+]);
+var searchQuerySchema = object({
+  q: string2().trim().min(1).max(200),
+  type: preprocess((raw) => (Array.isArray(raw) ? raw : [raw]).flatMap((v) => typeof v === "string" ? v.split(",") : [v]).map((v) => typeof v === "string" ? v.trim() : v).filter((v) => v !== ""), array(searchNodeTypeSchema).min(1)).optional(),
+  limit: exports_coerce.number().int().min(1).max(50).default(20)
+});
+var searchHitSchema = object({
+  id: string2(),
+  type: searchNodeTypeSchema,
+  title: string2(),
+  snippet: string2().nullable(),
+  updatedAt: exports_coerce.date()
+});
+
 // ../../packages/schema/src/contracts/progress.ts
 var progressDateSchema = string2().regex(/^\d{4}-\d{2}-\d{2}$/, "expected YYYY-MM-DD");
 var progressRangeDays = [7, 30, 90];
@@ -28865,6 +28947,83 @@ var planCreateResultSchema = planViewSchema.extend({
 });
 
 // ../../packages/schema/src/contracts/api-key-scopes.ts
+var API_KEY_SCOPE_VALUES = [
+  "webhooks:read",
+  "webhooks:write",
+  "tasks:read",
+  "tasks:write",
+  "habits:read",
+  "habits:write",
+  "occurrences:read",
+  "occurrences:write",
+  "shopping:read",
+  "shopping:write",
+  "inventory:read",
+  "inventory:write",
+  "meals:read",
+  "meals:write",
+  "notes:read",
+  "notes:write",
+  "contacts:read",
+  "contacts:write",
+  "projects:read",
+  "projects:write",
+  "areas:read",
+  "areas:write",
+  "routines:read",
+  "routines:write",
+  "settings:read",
+  "settings:write",
+  "calendar:read",
+  "calendar:write",
+  "members:read",
+  "members:write",
+  "sharing:read",
+  "sharing:write",
+  "comments:read",
+  "comments:write",
+  "roles:read",
+  "links:read",
+  "links:write",
+  "collections:read",
+  "collections:write",
+  "presets:read",
+  "presets:install",
+  "export:read",
+  "orca:read",
+  "orca:write",
+  "places:read",
+  "places:write",
+  "agents:read",
+  "agents:write",
+  "agents:converse",
+  "files:read",
+  "files:write",
+  "key-dates:read",
+  "key-dates:write",
+  "documents:read",
+  "documents:write",
+  "periods:read",
+  "periods:write",
+  "planning:read",
+  "planning:write",
+  "animals:read",
+  "animals:write",
+  "keys:read",
+  "keys:write",
+  "health:read",
+  "health:write",
+  "health:export",
+  "journal:read",
+  "journal:write",
+  "journal:export",
+  "documents:private",
+  "finance:read",
+  "finance:write",
+  "people:family-tree",
+  "private:*",
+  "*"
+];
 var FULL_ACCESS_SCOPE = "*";
 function scopeGranted(granted, required) {
   if (granted.includes(required))
@@ -28876,6 +29035,67 @@ function scopeGranted(granted, required) {
   return granted.includes(FULL_ACCESS_SCOPE);
 }
 
+// ../../packages/schema/src/contracts/api-keys.ts
+var apiKeyScopeSchema = _enum2(API_KEY_SCOPE_VALUES);
+var apiKeyScopesInputSchema = array(apiKeyScopeSchema).refine((scopes) => !scopes.includes(PRIVATE_ACCESS_SCOPE) || scopes.includes(FULL_ACCESS_SCOPE), {
+  message: `"${PRIVATE_ACCESS_SCOPE}" is only granted together with "${FULL_ACCESS_SCOPE}"`
+});
+var apiKeySchema = createSelectSchema(apiKeys, {
+  scopes: array(apiKeyScopeSchema),
+  agentId: string2().nullable().default(null),
+  lastUsedAt: exports_coerce.date().nullable(),
+  revokedAt: exports_coerce.date().nullable(),
+  createdAt: exports_coerce.date(),
+  updatedAt: exports_coerce.date()
+});
+var apiKeyPublicSchema = apiKeySchema.omit({ keyHash: true });
+var createApiKeyInputSchema = createInsertSchema(apiKeys, {
+  name: string2().min(1).max(120),
+  scopes: apiKeyScopesInputSchema.optional(),
+  agentId: ulidSchema.nullish()
+}).omit({
+  id: true,
+  tenantId: true,
+  userId: true,
+  prefix: true,
+  keyHash: true,
+  lastUsedAt: true,
+  revokedAt: true,
+  createdAt: true,
+  updatedAt: true
+}).strict();
+var createApiKeyResultSchema = apiKeyPublicSchema.extend({ key: string2() });
+var updateApiKeyInputSchema = object({
+  name: string2().min(1).max(120).optional(),
+  scopes: apiKeyScopesInputSchema.optional()
+}).strict().refine((input) => input.name !== undefined || input.scopes !== undefined, {
+  message: "change the name, the scopes, or both"
+});
+var apiKeyChangeSchema = object({
+  id: string2(),
+  at: exports_coerce.date(),
+  by: object({
+    userId: string2().nullable(),
+    apiKeyId: string2().nullable(),
+    apiKeyName: string2().nullable(),
+    agentId: string2().nullable(),
+    agentName: string2().nullable()
+  }),
+  before: object({ name: string2(), scopes: array(apiKeyScopeSchema) }),
+  after: object({ name: string2(), scopes: array(apiKeyScopeSchema) })
+});
+var apiKeyListItemSchema = apiKeyPublicSchema.extend({
+  mine: boolean3().default(false),
+  changes: array(apiKeyChangeSchema).default([])
+});
+var apiKeyContextSchema = object({
+  apiKeyId: string2(),
+  tenantId: string2(),
+  userId: string2().nullable(),
+  agentId: string2().nullable(),
+  scopes: array(apiKeyScopeSchema)
+});
+
 // ../../packages/schema/src/net/ssrf.ts
 var BLOCKED_HOST_SUFFIXES = [".internal", ".local", ".localhost"];
 var BLOCKED_HOSTNAMES = new Set(["localhost"]);
@@ -30144,6 +30364,45 @@ function routeOf(op) {
   return `${op.method.toUpperCase()} ${PUBLIC_API_PREFIX}${op.path}`;
 }
 
+// ../../packages/schema/src/operations/agent-connection.ts
+var notManager = "The key's member doesn't run the Space (`canManageSpace`: owner or admin).";
+var agentConnectionOperations = defineOperations({
+  get: {
+    method: "get",
+    path: "/agent/connection",
+    scopes: ["agents:read"],
+    tag: "Agents",
+    summary: "Get the agent connection",
+    description: "The agent runtime the agent panel's chat goes to (`connected: false` when none). Never returns the key: `hasKey` says whether one is set.",
+    status: 200,
+    response: { description: "The connection, without its key." }
+  },
+  save: {
+    method: "put",
+    path: "/agent/connection",
+    scopes: ["agents:write"],
+    tag: "Agents",
+    summary: "Set the agent connection",
+    description: "Create or replace the Space's connection: `endpoint`, optional `model`, `agentId` and `autoFile`. An absent `apiKey` keeps the stored key, `null` clears it; the key is write-only. Owner/admin only (`canManageSpace`); 404 for an `agentId` that isn't a live Agent of the Space.",
+    body: saveAgentConnectionInputSchema,
+    status: 200,
+    response: { description: "The saved connection, without its key." },
+    errors: { 400: true, 403: notManager, 404: true },
+    mcp: false
+  },
+  remove: {
+    method: "delete",
+    path: "/agent/connection",
+    scopes: ["agents:write"],
+    tag: "Agents",
+    summary: "Remove the agent connection",
+    description: "Forget the Space's connection (the deployment's env connection, if any, applies again). Owner/admin only (`canManageSpace`). An Agent's key waits for the member's confirmation (428 `confirmation_required`).",
+    status: 204,
+    response: { description: "Removed." },
+    errors: { 403: notManager }
+  }
+});
+
 // ../../packages/schema/src/operations/agents.ts
 var agentOperations = defineOperations({
   list: {
@@ -30737,6 +30996,182 @@ var calendarOperations = defineOperations({
   }
 });
 
+// ../../packages/schema/src/operations/changes.ts
+var changesOperations = defineOperations({
+  list: {
+    method: "get",
+    path: "/changes",
+    scopes: [],
+    tag: "Changes",
+    summary: "Read the change feed",
+    description: "What was created, updated or deleted in the Space after `since`, oldest first \u2014 the main sync mechanism. Store `nextCursor` and pass it back as `since`; ask again right away while `hasMore`. Each entry names the entity kind, id and op (a soft delete is `deleted`); refetch the entity from its own resource. `since=now` returns no changes and a fresh cursor (take it, then do the initial full read); omit `since` to read the whole log. The feed never skips a change that commits later. No scope of its own: a key sees the kinds its `*:read` scopes cover (`tasks:read` \u2192 `task`, `collections:read` \u2192 `collection_item`, a full-access key sees all), and gets a 403 when it covers none or asks for a kind it can't read.",
+    query: [
+      { name: "since", description: "A `nextCursor` from a prior page, or `now`." },
+      {
+        name: "limit",
+        description: "Page size, 1\u2013500 (default 100; larger values are capped).",
+        type: "integer",
+        minimum: 1
+      },
+      {
+        name: "entity",
+        description: "Comma-separated kinds to keep: `task`, `project`, `area`, `routine`, `habit`, `occurrence`, `note`, `contact`, `collection_item`, `inventory_item`, `shopping_list`, `recipe`, `meal_plan`, `event`."
+      }
+    ],
+    querySchema: changesQuerySchema,
+    status: 200,
+    response: { description: "One page of changes.", view: "ChangesPage" },
+    errors: { 400: true, 403: "The key can't read any feed kind, or one it asked for." },
+    operationId: "read_changes"
+  }
+});
+
+// ../../packages/schema/src/operations/collection.ts
+var READ2 = ["collections:read"];
+var WRITE2 = ["collections:write"];
+var entryParams = { entryId: "The entry's ULID." };
+var collectionOperations = defineOperations({
+  ...crudOperations({
+    segment: "collection",
+    tag: "Collection",
+    noun: "collection item",
+    read: "collections:read",
+    write: "collections:write",
+    eventBase: "collection.item",
+    create: createCollectionItemInputSchema,
+    update: updateCollectionItemInputSchema,
+    paginated: true,
+    listQuery: [
+      {
+        name: "type",
+        description: "Only items of this Type (`book`, `game`, \u2026; see `/collection/types`)."
+      },
+      { name: "status", description: "Only items in this status of their Type." },
+      { name: "tag", description: "Only items carrying this tag." },
+      {
+        name: "q",
+        description: "Only items whose title contains this text (case-insensitive): find an item by name."
+      },
+      { name: "title", description: "Only items with exactly this title (case-insensitive)." }
+    ],
+    listQuerySchema: paginationQuerySchema.extend({
+      type: string2().optional(),
+      status: string2().optional(),
+      tag: string2().optional(),
+      q: string2().optional(),
+      title: string2().optional()
+    })
+  }),
+  log: {
+    method: "post",
+    path: "/collection/log",
+    scopes: WRITE2,
+    tag: "Collection",
+    summary: "Log a collection entry by title",
+    description: 'Log an Entry ("finished Hades, 4 stars") against the item with exactly this `title` (case-insensitive), narrowed by `type` when given. With no such item and a `type`, the item is added first; without a `type`, a 404 names the closest titles. Several items with the title are a 409 that names them (ask which, or log against one by id). `status` also moves the item to that status of its Type (`want`, `have`, `doing`, `done` or `dropped`; e.g. `done` for "finished"). `rating` is 0.5\u20135 in half steps; the day defaults to today in the member\'s timezone. Returns `{ created, entryId, item }`; fires `collection.entry.created`.',
+    body: collectionLogInputSchema,
+    status: 201,
+    response: { description: "`{ created, entryId, item }`." },
+    errors: { 400: true, 404: true, 409: "Several items have this title; the message names them." },
+    webhook: "collection.entry.created"
+  },
+  types: {
+    method: "get",
+    path: "/collection/types",
+    scopes: READ2,
+    tag: "Collection",
+    summary: "List Collection Types",
+    description: "The code-defined Type registry (Books, Films, \u2026) as summaries.",
+    status: 200,
+    response: { description: "The Type registry." }
+  },
+  backfillCovers: {
+    method: "post",
+    path: "/collection/covers",
+    scopes: WRITE2,
+    tag: "Collection",
+    summary: "Backfill covers",
+    description: "Find covers for books and games that have none (Open Library; IGDB, then Steam), fetched into do's own media store. Works through up to 25 items per call; call again for more. Returns how many were tried and how many now have a cover.",
+    status: 200,
+    response: { description: "`{ checked, found }`." }
+  },
+  cover: {
+    method: "post",
+    path: "/collection/{id}/cover",
+    scopes: WRITE2,
+    tag: "Collection",
+    summary: "Find or replace an item's cover",
+    description: "With no `url`, find the next cover from the providers (books: Open Library; games: IGDB, then Steam) and replace the current one: the one showing and the ones passed over before are skipped, so asking again moves on; `found: false` when no other is left. With a `url`, fetch that image into do's media store and use it (422 when it can't be fetched). Covers are never hotlinked. Returns `{ found, item }`; fires `collection.item.updated`.",
+    body: collectionCoverInputSchema,
+    status: 200,
+    response: { description: "`{ found, item }`." },
+    errors: { 400: true, 404: true, 422: "The given image couldn't be fetched." },
+    webhook: "collection.item.updated"
+  },
+  coverCandidates: {
+    method: "get",
+    path: "/collection/{id}/cover/candidates",
+    scopes: READ2,
+    tag: "Collection",
+    summary: "List other covers for an item",
+    description: "Other covers to pick from, best first (at most 6): the providers' image URLs (books: Open Library, then Google Books; games: IGDB, then Steam) without the one showing and the ones an earlier replace passed over. Nothing is fetched yet; post one as `url` to `/api/v1/collection/{id}/cover` to use it (it's stored by do, and the cover it replaces is passed over from then on). Empty for a Type without automatic covers. Returns `{ candidates: [{ url }] }`.",
+    status: 200,
+    response: { description: "`{ candidates: [{ url }] }`." },
+    errors: { 404: true }
+  },
+  listEntries: {
+    method: "get",
+    path: "/collection/{id}/entries",
+    scopes: READ2,
+    tag: "Collection",
+    summary: "List an item's entries",
+    description: "The item's dated Entry log (ratings/notes).",
+    status: 200,
+    response: { description: "The item's entries." },
+    errors: { 404: true }
+  },
+  addEntry: {
+    method: "post",
+    path: "/collection/{id}/entries",
+    scopes: WRITE2,
+    tag: "Collection",
+    summary: "Append an entry",
+    description: "Append an Entry (a rating and/or note) to the item with this id; `id` and `occurredOn` are optional (the server mints one and uses today in the member's timezone). To log by title instead, use `POST /api/v1/collection/log`. Returns the item with its recomputed headline rating; fires `collection.entry.created`.",
+    body: createCollectionEntryInputSchema,
+    status: 201,
+    response: { description: "The updated item detail." },
+    errors: { 400: true, 404: true },
+    webhook: "collection.entry.created"
+  },
+  editEntry: {
+    method: "patch",
+    path: "/collection/{id}/entries/{entryId}",
+    pathParams: entryParams,
+    scopes: WRITE2,
+    tag: "Collection",
+    summary: "Edit a collection entry",
+    description: "Fix an Entry's day, rating or note (`null` clears the rating or note); returns the item with its recomputed headline rating; fires `collection.entry.updated`.",
+    body: updateCollectionEntryInputSchema,
+    status: 200,
+    response: { description: "The updated item detail." },
+    errors: { 400: true, 404: true },
+    webhook: "collection.entry.updated"
+  },
+  removeEntry: {
+    method: "delete",
+    path: "/collection/{id}/entries/{entryId}",
+    pathParams: entryParams,
+    scopes: WRITE2,
+    tag: "Collection",
+    summary: "Delete an entry",
+    description: "Remove one Entry; fires `collection.entry.deleted`.",
+    status: 204,
+    response: { description: "Deleted." },
+    errors: { 404: true },
+    webhook: "collection.entry.deleted"
+  }
+});
+
 // ../../packages/schema/src/operations/collection-upkeep.ts
 var collectionUpkeepOperations = defineOperations({
   list: {
@@ -30776,6 +31211,34 @@ var collectionUpkeepOperations = defineOperations({
   }
 });
 
+// ../../packages/schema/src/operations/comments.ts
+var commentOperations = defineOperations({
+  list: {
+    method: "get",
+    path: "/comments",
+    scopes: ["comments:read"],
+    tag: "Collaboration",
+    summary: "List a node's comments",
+    description: "A node's comment thread (`?nodeId=`).",
+    query: [{ name: "nodeId", description: "The node's ULID.", required: true }],
+    status: 200,
+    response: { description: "The node's comments." }
+  },
+  create: {
+    method: "post",
+    path: "/comments",
+    scopes: ["comments:write"],
+    tag: "Collaboration",
+    summary: "Post a comment",
+    description: "Add a comment to a node's thread; fires `comment.created`.",
+    body: createCommentInputSchema,
+    status: 201,
+    response: { description: "The created comment." },
+    errors: { 400: true },
+    webhook: "comment.created"
+  }
+});
+
 // ../../packages/schema/src/operations/days.ts
 var pathParams = {
   date: {
@@ -31629,15 +32092,15 @@ var habitOperations = defineOperations({
 });
 
 // ../../packages/schema/src/operations/house.ts
-var READ2 = ["collections:read"];
-var WRITE2 = ["collections:write"];
+var READ3 = ["collections:read"];
+var WRITE3 = ["collections:write"];
 var WRITE_WITH_TASKS = ["collections:write", "tasks:write"];
 var receipt = "Returns `{ item, receipt }`: the asset now, and a receipt naming everything made or changed (`itemId`, `created`, `before`, `taskIds`, `entryIds`, `files`). Post the receipt to `/api/v1/house/undo` to take it all back.";
 var houseOperations = defineOperations({
   overview: {
     method: "get",
     path: "/house",
-    scopes: READ2,
+    scopes: READ3,
     tag: "House",
     summary: "The House home",
     description: "What's broken (assets in condition `broken` or with an open repair Task), upkeep coming up (open upkeep Tasks with the day each is next due, soonest first), the top-level Places with how many things live in each, and `thingCount` / `upkeepCount` / `toolCount` / `animalCount` (the animals living here, groups counted once).",
@@ -31647,7 +32110,7 @@ var houseOperations = defineOperations({
   value: {
     method: "get",
     path: "/house/value",
-    scopes: READ2,
+    scopes: READ3,
     tag: "House",
     summary: "The value inventory",
     description: "What's in the house, for the contents insurance and a claim: every owned asset with its Place, `bought` (purchase, else install day), `paid`, `now` (+ `nowSource`), `proof` (`receipt_photo` \xB7 `receipt` \xB7 `photo` \xB7 `none`: a receipt/warranty Document that `covers` it or a non-image File on it; an image File on it or its cover), `excluded` (`insure: false`, say a borrowed thing: listed, not summed) and `visibility`. `totals` sums now and paid; `policy` is the active home insurance Document with an `insuredValue`, or null. Another member's Only me things never show.",
@@ -31657,7 +32120,7 @@ var houseOperations = defineOperations({
   year: {
     method: "get",
     path: "/house/upkeep",
-    scopes: READ2,
+    scopes: READ3,
     tag: "House",
     summary: "The upkeep year",
     description: "Every upkeep routine (a Task tied to an asset as `maintains`) across one year: `routines[].months` holds twelve marks, January first \u2014 `done` (an occurrence done, or a `service` Entry for the Task), `late` (skipped or slipped past), `due` (this month, not done), `planned` (coming, projected from the rule past what's materialized) or null. `needs` lists the Supply parts that fit an asset with a routine in `needsMonth` (next month), with `low` at or below the restock level; `spent` sums this year's costs on asset Entries (repairs + faults, services).",
@@ -31672,7 +32135,7 @@ var houseOperations = defineOperations({
   asset: {
     method: "get",
     path: "/house/assets/{id}",
-    scopes: READ2,
+    scopes: READ3,
     tag: "House",
     summary: "One asset's House page",
     description: "The asset as a House page: `item` (the Item with its Entries), `trail` (the Places it sits in, outermost first), `parts` (the Supply items that fit it, kind `fits`), and `linked` (every other node tied to it either way \u2014 a Document that `covers` it, a Task, an Event \u2014 plus the Contacts on its Entries as `serviced_by`), `warrantyUntil` (the latest warranty end among the warranty papers and receipts that cover it, or null; upkeep and repair Tasks are read from `/api/v1/collection/{id}/upkeep`). Only me rows of other members never show.",
@@ -31683,7 +32146,7 @@ var houseOperations = defineOperations({
   linkPart: {
     method: "post",
     path: "/house/assets/{id}/parts",
-    scopes: WRITE2,
+    scopes: WRITE3,
     tag: "House",
     summary: "Tie a part to an asset",
     description: "Tie a Supply item to the asset as a part that fits it (a filter, a door rope, a spare battery). Idempotent. Returns the asset page.",
@@ -31696,7 +32159,7 @@ var houseOperations = defineOperations({
     method: "delete",
     path: "/house/assets/{id}/parts/{inventoryItemId}",
     pathParams: { inventoryItemId: "The Supply item's ULID." },
-    scopes: WRITE2,
+    scopes: WRITE3,
     tag: "House",
     summary: "Untie a part from an asset",
     description: "The Supply item stays; only the link goes. Returns the asset page.",
@@ -31707,7 +32170,7 @@ var houseOperations = defineOperations({
   lend: {
     method: "post",
     path: "/house/assets/{id}/lend",
-    scopes: WRITE2,
+    scopes: WRITE3,
     tag: "House",
     summary: "Lend a thing, or note one borrowed (asset_lend)",
     description: "Sets the Item's `loan` \u2014 `direction` `lent` (to someone) or `borrowed` (from them), `who`, an optional `contactId`, `since` (default today), `dueBack`, `note` \u2014 and logs a `lent` Entry. Works on any Collection Item. 409 while it's already out.",
@@ -31719,7 +32182,7 @@ var houseOperations = defineOperations({
   giveBack: {
     method: "post",
     path: "/house/assets/{id}/return",
-    scopes: WRITE2,
+    scopes: WRITE3,
     tag: "House",
     summary: "It's back (asset_return)",
     description: "Clears the Item's `loan` and logs a `returned` Entry (`on` default today, optional `note`). 409 when it isn't out.",
@@ -31796,6 +32259,73 @@ var inventoryItemOperations = defineOperations({
   })
 });
 
+// ../../packages/schema/src/operations/invites.ts
+var inviteOperations = defineOperations({
+  list: {
+    method: "get",
+    path: "/invites",
+    scopes: ["members:read"],
+    tag: "Collaboration",
+    summary: "List invites",
+    description: "The Space's pending invitations.",
+    status: 200,
+    response: { description: "The invites." }
+  },
+  create: {
+    method: "post",
+    path: "/invites",
+    scopes: ["members:write"],
+    tag: "Collaboration",
+    summary: "Create an invite",
+    description: "Invite someone to the Space; fires `invite.created`.",
+    body: createInviteInputSchema,
+    status: 201,
+    response: { description: "The created invite." },
+    errors: { 400: true },
+    webhook: "invite.created"
+  },
+  revoke: {
+    method: "delete",
+    path: "/invites/{id}",
+    scopes: ["members:write"],
+    tag: "Collaboration",
+    summary: "Revoke an invite",
+    description: "Revoke a pending invitation; fires `invite.revoked`.",
+    status: 204,
+    response: { description: "Revoked." },
+    errors: { 404: true },
+    webhook: "invite.revoked"
+  }
+});
+
+// ../../packages/schema/src/operations/keys.ts
+var keyOperations = defineOperations({
+  list: {
+    method: "get",
+    path: "/keys",
+    scopes: ["keys:read"],
+    tag: "Identity",
+    summary: "List your API keys",
+    description: "The keys the member behind this key minted (never a secret), newest first, each with its recorded changes.",
+    status: 200,
+    response: { description: "The keys." },
+    errors: { 403: true }
+  },
+  update: {
+    method: "patch",
+    path: "/keys/{id}",
+    scopes: ["keys:write"],
+    tag: "Identity",
+    summary: "Change a key's name or scopes",
+    description: "In place: the key keeps its id and secret. Only the member's own keys, and never more than the calling key holds: it can't widen its own scopes or change a key that reaches further (403). `private:*` only rides on `*`. Recorded on the key, before \u2192 after.",
+    body: updateApiKeyInputSchema,
+    status: 200,
+    response: { description: "The key, changed." },
+    errors: { 400: true, 403: true, 404: true },
+    throttle: "strict"
+  }
+});
+
 // ../../packages/schema/src/operations/mail-campaigns.ts
 var pathParams2 = { id: "The campaign's ULID." };
 var mailCampaignOperations = defineOperations({
@@ -31878,6 +32408,45 @@ var mealPlanOperations = defineOperations({
   })
 });
 
+// ../../packages/schema/src/operations/members.ts
+var memberOperations = defineOperations({
+  list: {
+    method: "get",
+    path: "/members",
+    scopes: ["members:read"],
+    tag: "Collaboration",
+    summary: "List members",
+    description: "The Space roster.",
+    status: 200,
+    response: { description: "The members." }
+  },
+  setRole: {
+    method: "patch",
+    path: "/members/{id}/role",
+    scopes: ["members:write"],
+    tag: "Collaboration",
+    summary: "Set a member's role",
+    description: "Change a member's role; fires `member.role.updated`.",
+    body: setMemberRoleInputSchema,
+    status: 200,
+    response: { description: "The updated member." },
+    errors: { 400: true, 404: true },
+    webhook: "member.role.updated"
+  },
+  remove: {
+    method: "delete",
+    path: "/members/{id}",
+    scopes: ["members:write"],
+    tag: "Collaboration",
+    summary: "Remove a member",
+    description: "Remove a member from the Space; fires `member.removed`.",
+    status: 204,
+    response: { description: "Removed." },
+    errors: { 404: true },
+    webhook: "member.removed"
+  }
+});
+
 // ../../packages/schema/src/operations/metrics.ts
 var NO_MEMBER2 = "The key acts for no member.";
 var metricOperations = defineOperations({
@@ -31944,6 +32513,51 @@ var metricOperations = defineOperations({
   }
 });
 
+// ../../packages/schema/src/operations/nodes.ts
+var pathParams3 = { id: "The owner node's ULID (any node type)." };
+var ineligible = "The node is unknown, deleted, hidden from this Space, or can't carry a note (a `note` or `event` node).";
+var nodeOperations = defineOperations({
+  getNotes: {
+    method: "get",
+    path: "/nodes/{id}/notes",
+    pathParams: pathParams3,
+    scopes: ["notes:read"],
+    tag: "Notes",
+    summary: "Get a node's attached note",
+    description: "The attached note of any node as `{ nodeId, noteId, body, updatedAt }`; a node with no note yet returns nulls.",
+    status: 200,
+    response: { description: "The attached-note view." },
+    errors: { 404: ineligible }
+  },
+  setNotes: {
+    method: "put",
+    path: "/nodes/{id}/notes",
+    pathParams: pathParams3,
+    scopes: ["notes:write"],
+    tag: "Notes",
+    summary: "Set a node's attached note",
+    description: "Upsert the node's attached note and return the attached-note view; fires `note.created` when this creates the note, else `note.updated`, with the Note's standard view. A blank body clears the note (fires `note.deleted` if one existed).",
+    body: setAttachedNoteInputSchema,
+    status: 200,
+    response: { description: "The attached-note view." },
+    errors: { 400: true, 404: ineligible },
+    webhook: "note.updated"
+  },
+  clearNotes: {
+    method: "delete",
+    path: "/nodes/{id}/notes",
+    pathParams: pathParams3,
+    scopes: ["notes:write"],
+    tag: "Notes",
+    summary: "Clear a node's attached note",
+    description: "Remove the node's attached note; fires `note.deleted` with the cleared note's id. Idempotent \u2014 a node with no note is a no-op.",
+    status: 204,
+    response: { description: "Cleared." },
+    errors: { 404: ineligible },
+    webhook: "note.deleted"
+  }
+});
+
 // ../../packages/schema/src/operations/occurrences.ts
 var occurrenceOperations = defineOperations({
   list: {
@@ -31986,6 +32600,78 @@ var occurrenceOperations = defineOperations({
   }
 });
 
+// ../../packages/schema/src/operations/orca.ts
+var host = "The Orca host (e.g. `theseus`).";
+var handle = "The session's handle (`term_\u2026`).";
+var notConnected = "Orca isn't connected to this Space, or the bridge doesn't know that host or session.";
+var unavailable = "Orca unreachable: the orca-bridge didn't answer.";
+var orcaOperations = defineOperations({
+  overview: {
+    method: "get",
+    path: "/orca",
+    scopes: ["orca:read"],
+    tag: "Orca",
+    summary: "List Orca worktrees",
+    description: "Every host's worktrees with status (`running` / `idle` / `waiting`), the last line, sessions and the linked Task or Project, plus linked worktrees that have ended; `state` is `ok`, `unreachable` or `not_configured`.",
+    status: 200,
+    response: { description: "The Orca overview." }
+  },
+  output: {
+    method: "get",
+    path: "/orca/hosts/{host}/terminals/{handle}/output",
+    pathParams: { host, handle },
+    scopes: ["orca:read"],
+    tag: "Orca",
+    summary: "Read an Orca session",
+    description: "A session's live output; pass `nextCursor` back as `cursor` for only what's new, or `screen=true` for the rendered frame.",
+    query: [
+      { name: "cursor", description: "Read from this cursor (a prior `nextCursor`)." },
+      { name: "limit", description: "At most this many lines (1\u20132000).", type: "integer" },
+      { name: "screen", description: "`true` reads the rendered screen instead of the stream." }
+    ],
+    querySchema: orcaReadOutputQuerySchema,
+    status: 200,
+    response: { description: "The output." },
+    errors: { 400: true, 404: notConnected, 503: unavailable }
+  },
+  send: {
+    method: "post",
+    path: "/orca/hosts/{host}/terminals/{handle}/messages",
+    pathParams: { host, handle },
+    scopes: ["orca:write"],
+    tag: "Orca",
+    summary: "Send to an Orca session",
+    description: "Type a message into a session (`enter` submits it, default true). An Agent's send waits for the member: a 428 `confirmation_required` until they confirm it in the agent panel, which replays it.",
+    body: orcaSendMessageInputSchema,
+    status: 200,
+    response: { description: "Orca accepted the input." },
+    errors: {
+      400: true,
+      404: notConnected,
+      428: "`confirmation_required`: the member must confirm an Agent's send.",
+      503: unavailable
+    }
+  },
+  restart: {
+    method: "post",
+    path: "/orca/hosts/{host}/sessions",
+    pathParams: { host },
+    scopes: ["orca:write"],
+    tag: "Orca",
+    summary: "Restart an Orca session",
+    description: "Start the agent afresh in a worktree: a new session running `claude` or `codex` (an allowlist, never a free command); the old session is left as it was. Gated like a send: an Agent's restart waits for the member's confirmation (428 `confirmation_required`).",
+    body: orcaRestartSessionInputSchema,
+    status: 200,
+    response: { description: "Orca started the session; its new `handle`." },
+    errors: {
+      400: true,
+      404: notConnected,
+      428: "`confirmation_required`: the member must confirm an Agent's restart.",
+      503: unavailable
+    }
+  }
+});
+
 // ../../packages/schema/src/operations/periods.ts
 var periodOperations = defineOperations({
   ...crudOperations({
@@ -32249,6 +32935,149 @@ var progressOperations = defineOperations({
   }
 });
 
+// ../../packages/schema/src/operations/projects.ts
+var INSTANT = "an ISO 8601 datetime with offset, or a bare `YYYY-MM-DD` (UTC midnight)";
+var projectOperations = defineOperations({
+  ...crudOperations({
+    segment: "projects",
+    tag: "Projects",
+    noun: "project",
+    read: "projects:read",
+    write: "projects:write",
+    create: createProjectInputSchema,
+    update: updateProjectInputSchema,
+    paginated: true,
+    listQuery: [
+      { name: "areaId", description: "Only rows in this Area (ULID)." },
+      {
+        name: "status",
+        description: `Only rows in any of these statuses (comma list or repeated key): ${projectStatusSchema.options.map((v) => `\`${v}\``).join(", ")}.`
+      },
+      {
+        name: "updatedSince",
+        description: `Only rows whose \`updatedAt\` is at or after this instant \u2014 ${INSTANT}.`,
+        format: "date-time"
+      },
+      {
+        name: "dueBefore",
+        description: `Only rows due strictly before this instant (undated rows are excluded) \u2014 ${INSTANT}.`,
+        format: "date-time"
+      }
+    ],
+    listQuerySchema: projectListQuerySchema.extend(paginationQuerySchema.shape)
+  }),
+  attachTask: {
+    method: "post",
+    path: "/projects/{id}/tasks",
+    scopes: ["projects:write"],
+    tag: "Projects",
+    summary: "Attach a task",
+    description: "Attach an existing task to the project; fires `project.task.attached`.",
+    body: attachTaskInputSchema,
+    status: 204,
+    response: { description: "Attached." },
+    errors: { 400: true, 404: true },
+    webhook: "project.task.attached"
+  },
+  detachTask: {
+    method: "delete",
+    path: "/projects/{id}/tasks/{taskId}",
+    pathParams: { taskId: "The task's ULID." },
+    scopes: ["projects:write"],
+    tag: "Projects",
+    summary: "Detach a task",
+    description: "Detach a task from the project; fires `project.task.detached`.",
+    status: 204,
+    response: { description: "Detached." },
+    errors: { 404: true },
+    webhook: "project.task.detached"
+  }
+});
+
+// ../../packages/schema/src/operations/reads.ts
+var INSTANT2 = "an ISO 8601 datetime with offset, or a bare `YYYY-MM-DD` (UTC midnight)";
+var windowParams = [
+  {
+    name: "from",
+    description: `Window start \u2014 ${INSTANT2}. Default: today's start, UTC.`,
+    format: "date-time"
+  },
+  {
+    name: "to",
+    description: `Window end (exclusive) \u2014 ${INSTANT2}. Default: a day after \`from\`.`,
+    format: "date-time"
+  }
+];
+var readOperations = defineOperations({
+  now: {
+    method: "get",
+    path: "/now",
+    scopes: ["tasks:read"],
+    tag: "Reads",
+    summary: "What needs me now",
+    description: "The open tasks waiting on `for` (default `me`, the key's own member or Agent), longest-waiting first and leaving out ones snoozed past now, plus the window's timeline (scheduled, due and overdue \u2014 the app's Today).",
+    query: [
+      {
+        name: "for",
+        description: "Whose waiting list: `me` (default), `member:<id|email>` or `agent:<id|name>`."
+      },
+      ...windowParams
+    ],
+    querySchema: nowQuerySchema,
+    status: 200,
+    response: { description: "The Now read.", view: "NowResponse" },
+    errors: { 400: true },
+    operationId: "get_now"
+  },
+  landed: {
+    method: "get",
+    path: "/landed",
+    scopes: ["tasks:read"],
+    tag: "Reads",
+    summary: "What landed",
+    description: "What got done in the window by `completedAt` (cancelled tasks never count): the total, a per-Actor split (who finished each \u2014 a member or an Agent), and the tasks, most recently finished first.",
+    query: windowParams,
+    querySchema: readWindowQuerySchema,
+    status: 200,
+    response: { description: "The Landed read.", view: "LandedResponse" },
+    operationId: "get_landed"
+  },
+  review: {
+    method: "get",
+    path: "/review",
+    scopes: ["tasks:read"],
+    tag: "Reads",
+    summary: "Review tallies",
+    description: "Per-day completion tallies over the window: tasks (by `completedAt`) and habit/routine occurrences.",
+    query: windowParams,
+    querySchema: readWindowQuerySchema,
+    status: 200,
+    response: { description: "One entry per day of the window." },
+    operationId: "get_review"
+  },
+  search: {
+    method: "get",
+    path: "/search",
+    scopes: [],
+    tag: "Reads",
+    summary: "Search the Space",
+    description: "Case-insensitive search over live node titles and note bodies; title hits first, then newest. No scope of its own: a key sees the node types its `*:read` scopes cover (`tasks:read` \u2192 `task`, `notes:read` \u2192 `note`, \u2026 a full-access key sees all), and gets a 403 when it covers none of the requested types.",
+    query: [
+      { name: "q", description: "The text to find (1\u2013200 chars)." },
+      {
+        name: "type",
+        description: "Only these node types (comma list): `task`, `project`, `area`, `note`, `habit`, `routine`, `contact`, `collection_item`."
+      },
+      { name: "limit", description: "Max hits, 1\u201350 (default 20).", type: "integer", minimum: 1 }
+    ],
+    querySchema: searchQuerySchema,
+    status: 200,
+    response: { description: "The hits.", list: true, view: "SearchHit" },
+    errors: { 400: true, 403: "The key can read none of the requested node types." },
+    operationId: "search"
+  }
+});
+
 // ../../packages/schema/src/operations/recipes.ts
 var recipe = { id: "The recipe's ULID." };
 var recipeOperations = defineOperations({
@@ -32303,6 +33132,40 @@ var recipeOperations = defineOperations({
   }
 });
 
+// ../../packages/schema/src/operations/roles.ts
+var roleOperations = defineOperations({
+  listPermissionSets: {
+    method: "get",
+    path: "/roles/permission-sets",
+    scopes: ["roles:read"],
+    tag: "Collaboration",
+    summary: "List permission sets",
+    description: "The Space's permission sets.",
+    status: 200,
+    response: { description: "The permission sets." }
+  },
+  listMembers: {
+    method: "get",
+    path: "/roles/members",
+    scopes: ["roles:read"],
+    tag: "Collaboration",
+    summary: "List role assignments",
+    description: "Each member's role assignment.",
+    status: 200,
+    response: { description: "The role assignments." }
+  },
+  list: {
+    method: "get",
+    path: "/roles",
+    scopes: ["roles:read"],
+    tag: "Collaboration",
+    summary: "List roles",
+    description: "The Space's roles.",
+    status: 200,
+    response: { description: "The roles." }
+  }
+});
+
 // ../../packages/schema/src/operations/routines.ts
 var routineOperations = defineOperations({
   getRun: {
@@ -32621,6 +33484,210 @@ var rsvpQuestionOperations = defineOperations({
   }
 });
 
+// ../../packages/schema/src/operations/runs.ts
+var READ4 = ["collections:read"];
+var WRITE4 = ["collections:write"];
+var runOperations = defineOperations({
+  list: {
+    method: "get",
+    path: "/runs",
+    scopes: READ4,
+    tag: "Runs",
+    summary: "List game runs",
+    description: "The Space's runs, last touched first, each with its game, its facets, `lastPlayedOn` and `sessionCount`.",
+    query: [
+      { name: "gameId", description: "Only the runs of this game (a Collection Item id)." },
+      {
+        name: "status",
+        description: "`planned`, `playing`, `paused`, `blocked`, `finished` or `dropped`."
+      },
+      {
+        name: "theme",
+        description: "Only runs skinned by this theme pack (`skyrim`, `pokemon`, \u2026)."
+      }
+    ],
+    querySchema: runsQuerySchema,
+    status: 200,
+    response: { description: "The runs." }
+  },
+  create: {
+    method: "post",
+    path: "/runs",
+    scopes: WRITE4,
+    tag: "Runs",
+    summary: "Start a game run",
+    description: "A playthrough under a game Item (`gameId`, 400 when it isn't a game). The client mints `id`; `status` defaults to `playing`; `facet` holds the sections (character, arc, orderOfPlay, quests, nextSteps, choices, homes, people, mounts, team, checklists, uniques, achievements, install). Fires `run.created`.",
+    body: createRunInputSchema,
+    status: 201,
+    response: { description: "The run." },
+    errors: { 400: true, 404: true },
+    webhook: "run.created"
+  },
+  steamStatus: {
+    method: "get",
+    path: "/runs/steam",
+    scopes: READ4,
+    tag: "Runs",
+    summary: "Get the Steam achievements link",
+    description: "Whether the key's member has linked Steam (from Settings in the app; the Steam ID and Web API key are never returned), how many games carry a `steamAppId` and `lastSyncedAt`, the newest sync on a run. 403 for a key no member minted.",
+    status: 200,
+    response: { description: "The link's status." },
+    errors: { 403: true }
+  },
+  steamSync: {
+    method: "post",
+    path: "/runs/steam/sync",
+    scopes: WRITE4,
+    tag: "Runs",
+    summary: "Sync Steam achievements now",
+    description: "As the key's member, read Steam's achievements for every game with a `steamAppId` (or only `gameId`) and write them into each run of that game whose achievements come from Steam or aren't kept yet (`source: steam`, `total`, `unlocked` with the day, `locked`, `syncedAt`); runs kept by hand are left alone. The daily sync does the same. Per game: outcome (ok \xB7 failed), runs written, unlocked, total and the error (`unauthorized`, `private`, `no_stats`, `unavailable`, `bad_response`). 409 before the member has linked Steam.",
+    body: steamSyncInputSchema,
+    status: 200,
+    response: { description: "What the sync did, game by game." },
+    errors: { 400: true, 403: true, 409: true }
+  },
+  get: {
+    method: "get",
+    path: "/runs/{id}",
+    scopes: READ4,
+    tag: "Runs",
+    summary: "Get a game run",
+    description: "The run with its sessions, newest first; each session has its recap (`note`), `minutes` and the agent's change `batches`.",
+    status: 200,
+    response: { description: "The run." },
+    errors: { 404: true }
+  },
+  update: {
+    method: "patch",
+    path: "/runs/{id}",
+    scopes: WRITE4,
+    tag: "Runs",
+    summary: "Edit a game run",
+    description: "Rename it, move its status, or replace `facet` whole. For one change at a time use `/changes`. Fires `run.updated`.",
+    body: updateRunInputSchema,
+    status: 200,
+    response: { description: "The run." },
+    errors: { 400: true, 404: true },
+    webhook: "run.updated"
+  },
+  remove: {
+    method: "delete",
+    path: "/runs/{id}",
+    scopes: WRITE4,
+    tag: "Runs",
+    summary: "Delete a game run",
+    description: "Soft-deletes the run. Fires `run.deleted`.",
+    status: 204,
+    response: { description: "Deleted." },
+    errors: { 404: true },
+    webhook: "run.deleted"
+  },
+  applyChanges: {
+    method: "post",
+    path: "/runs/{id}/changes",
+    scopes: WRITE4,
+    tag: "Runs",
+    summary: "Apply a run chat update",
+    description: 'What the agent sends for "<game> update: \u2026": `changes`, each `{ op: "set"|"merge", section, value }` for a one-value section, `{ op: "upsert", section, value }` / `{ op: "remove", section, match }` for a list section (matched by its name field, case ignored), or `{ op: "tick", section: "checklists", key, ids, done? }` to tick many checklist ids at once; `message` is quoted on the receipt. The batch goes on `sessionId`, else the last session if it was active in the last 6 hours, else a new one (`newSession` forces one); `recap` writes the session\'s recap. A change that leaves the run invalid is a 400 and nothing is written. Returns `{ run, sessionId, batch }`, the batch\'s `changes` carrying one receipt `label` each. Fires `run.updated`.',
+    body: applyRunChangesInputSchema,
+    status: 201,
+    response: { description: "`{ run, sessionId, batch }`." },
+    errors: { 400: true, 404: true },
+    webhook: "run.updated"
+  },
+  undo: {
+    method: "post",
+    path: "/runs/{id}/undo",
+    scopes: WRITE4,
+    tag: "Runs",
+    summary: "Undo a run chat update",
+    description: "Puts the sections a batch changed back as they were and marks it undone: `batchId`, else the latest batch not yet undone (404 when there is none; 400 when it was already undone). Returns the run; fires `run.updated`.",
+    body: undoRunChangesInputSchema,
+    status: 200,
+    response: { description: "The run." },
+    errors: { 400: true, 404: true },
+    webhook: "run.updated"
+  },
+  uploadSaveHeader: {
+    method: "post",
+    path: "/runs/{id}/save-header",
+    scopes: WRITE4,
+    tag: "Runs",
+    summary: "Send a game save's header to a run",
+    description: "The save sync (run tracker phase 4): the header of the newest save as `@do/skyrim-save` reads it on the gaming PC (name, level, location, race, sex, play time, saved at, the in-game date, plugins, General Stats) and its screenshot as a base64 PNG. It becomes the run's `save` section and its character's level, as one update with a receipt and Undo; the screenshot is a file on the run (`source: game_save`), replacing the last save's. The same save again (number, file and time) changes nothing: `unchanged: true`. Needs a member's key. Returns `{ run, unchanged, sessionId, batch }`; fires `run.updated`.",
+    body: uploadRunSaveHeaderInputSchema,
+    status: 200,
+    response: { description: "`{ run, unchanged, sessionId, batch }`." },
+    errors: { 400: true, 403: "A read-only key, or a key with no member.", 404: true },
+    webhook: "run.updated"
+  },
+  tickChecklist: {
+    method: "post",
+    path: "/runs/{id}/checklists/{key}/tick",
+    pathParams: { key: "The checklist's key (`dex`, `masks`)." },
+    scopes: WRITE4,
+    tag: "Runs",
+    summary: "Tick a run checklist in bulk",
+    description: "Tick many ids on one checklist in one call, e.g. backfilling a Pok\xE9dex (`ids` are national numbers): `done: false` unticks. A checklist the run doesn't have yet is made from its theme pack's catalog of that key (404 when there's neither). Recorded like a chat update, with a receipt and Undo. Returns `{ run, sessionId, batch }`; fires `run.updated`.",
+    body: tickRunChecklistInputSchema,
+    status: 201,
+    response: { description: "`{ run, sessionId, batch }`." },
+    errors: { 400: true, 404: true },
+    webhook: "run.updated"
+  },
+  listSessions: {
+    method: "get",
+    path: "/runs/{id}/sessions",
+    scopes: READ4,
+    tag: "Runs",
+    summary: "List a run's sessions",
+    description: "Newest first, each with its recap, minutes and change batches.",
+    status: 200,
+    response: { description: "The sessions." },
+    errors: { 404: true }
+  },
+  addSession: {
+    method: "post",
+    path: "/runs/{id}/sessions",
+    scopes: WRITE4,
+    tag: "Runs",
+    summary: "Log a run session",
+    description: "A sitting with the game: `occurredOn` (default today, UTC), `recap` (second person, a few sentences) and `minutes`. Returns the run; fires `run.session.created`.",
+    body: createRunSessionInputSchema,
+    status: 201,
+    response: { description: "The run." },
+    errors: { 400: true, 404: true },
+    webhook: "run.session.created"
+  },
+  updateSession: {
+    method: "patch",
+    path: "/runs/{id}/sessions/{sessionId}",
+    pathParams: { sessionId: "The session's ULID." },
+    scopes: WRITE4,
+    tag: "Runs",
+    summary: "Edit a run session",
+    description: "Fix its day, recap or minutes (`null` clears the recap or minutes). Returns the run; fires `run.session.updated`.",
+    body: updateRunSessionInputSchema,
+    status: 200,
+    response: { description: "The run." },
+    errors: { 400: true, 404: true },
+    webhook: "run.session.updated"
+  },
+  removeSession: {
+    method: "delete",
+    path: "/runs/{id}/sessions/{sessionId}",
+    pathParams: { sessionId: "The session's ULID." },
+    scopes: WRITE4,
+    tag: "Runs",
+    summary: "Delete a run session",
+    description: "Its changes stay applied. Fires `run.session.deleted`.",
+    status: 204,
+    response: { description: "Deleted." },
+    errors: { 404: true },
+    webhook: "run.session.deleted"
+  }
+});
+
 // ../../packages/schema/src/operations/seating-proposals.ts
 var proposal = { id: "The proposal's ULID." };
 var seatingProposalOperations = defineOperations({
@@ -32823,6 +33890,141 @@ var settingsOperations = defineOperations({
   }
 });
 
+// ../../packages/schema/src/operations/share-links.ts
+var shareLinkOperations = defineOperations({
+  listForNode: {
+    method: "get",
+    path: "/share-links/node/{nodeId}",
+    pathParams: { nodeId: "The node's ULID." },
+    scopes: ["links:read"],
+    tag: "Collaboration",
+    summary: "List a node's share-links",
+    description: "Public, scoped links minted for a node.",
+    status: 200,
+    response: { description: "The node's share-links." },
+    errors: { 404: true }
+  },
+  get: {
+    method: "get",
+    path: "/share-links/{id}",
+    scopes: ["links:read"],
+    tag: "Collaboration",
+    summary: "Get a share-link",
+    description: "One share-link by id.",
+    status: 200,
+    response: { description: "The share-link." },
+    errors: { 404: true }
+  },
+  create: {
+    method: "post",
+    path: "/share-links",
+    scopes: ["links:write"],
+    tag: "Collaboration",
+    summary: "Mint a share-link",
+    description: "Mint a public, scoped link to a node; fires `share-link.created`.",
+    body: createShareLinkInputSchema,
+    status: 201,
+    response: { description: "The created share-link." },
+    errors: { 400: true },
+    webhook: "share-link.created"
+  },
+  revoke: {
+    method: "delete",
+    path: "/share-links/{id}",
+    scopes: ["links:write"],
+    tag: "Collaboration",
+    summary: "Revoke a share-link",
+    description: "Revoke a public share-link; fires `share-link.revoked`.",
+    status: 204,
+    response: { description: "Revoked." },
+    errors: { 404: true },
+    webhook: "share-link.revoked"
+  }
+});
+
+// ../../packages/schema/src/operations/sharing.ts
+var nodeId = "The node's ULID.";
+var grantId = "The grant's ULID.";
+var sharingOperations = defineOperations({
+  listSubjects: {
+    method: "get",
+    path: "/sharing/subjects",
+    scopes: ["sharing:read"],
+    tag: "Collaboration",
+    summary: "List grantable subjects",
+    description: "The members/roles a node can be shared with.",
+    status: 200,
+    response: { description: "The subjects." }
+  },
+  listGrants: {
+    method: "get",
+    path: "/sharing/nodes/{nodeId}/grants",
+    pathParams: { nodeId },
+    scopes: ["sharing:read"],
+    tag: "Collaboration",
+    summary: "List a node's grants",
+    description: "Who a node is shared with, and at what level.",
+    status: 200,
+    response: { description: "The node's grants." },
+    errors: { 404: true }
+  },
+  createGrant: {
+    method: "post",
+    path: "/sharing/nodes/{nodeId}/grants",
+    pathParams: { nodeId },
+    scopes: ["sharing:write"],
+    tag: "Collaboration",
+    summary: "Grant access to a node",
+    description: "Share a node with a member/role; fires `node.grant.created`.",
+    body: createNodeGrantInputSchema,
+    status: 201,
+    response: { description: "The created grant." },
+    errors: { 400: true, 404: true },
+    webhook: "node.grant.created"
+  },
+  updateGrant: {
+    method: "patch",
+    path: "/sharing/nodes/{nodeId}/grants/{grantId}",
+    pathParams: { nodeId, grantId },
+    scopes: ["sharing:write"],
+    tag: "Collaboration",
+    summary: "Update a grant",
+    description: "Change a grant's access level; fires `node.grant.updated`.",
+    body: updateNodeGrantInputSchema,
+    status: 200,
+    response: { description: "The updated grant." },
+    errors: { 400: true, 404: true },
+    webhook: "node.grant.updated"
+  },
+  revokeGrant: {
+    method: "delete",
+    path: "/sharing/nodes/{nodeId}/grants/{grantId}",
+    pathParams: { nodeId, grantId },
+    scopes: ["sharing:write"],
+    tag: "Collaboration",
+    summary: "Revoke a grant",
+    description: "Revoke a node grant; fires `node.grant.revoked`.",
+    status: 204,
+    response: { description: "Revoked." },
+    errors: { 404: true },
+    webhook: "node.grant.revoked"
+  },
+  assign: {
+    method: "put",
+    path: "/sharing/nodes/{nodeId}/assignee",
+    pathParams: { nodeId },
+    scopes: ["sharing:write"],
+    tag: "Collaboration",
+    summary: "Assign a node",
+    description: "Set a node's assignee; fires `node.assigned`.",
+    body: assignNodeInputSchema,
+    status: 200,
+    response: { description: "The assignment grant." },
+    errors: { 400: true, 404: true },
+    webhook: "node.assigned"
+  }
+});
+
 // ../../packages/schema/src/operations/shopping-lists.ts
 var shoppingListOperations = defineOperations({
   ...crudOperations({
@@ -32839,14 +34041,14 @@ var shoppingListOperations = defineOperations({
 });
 
 // ../../packages/schema/src/operations/tap-tags.ts
-var READ3 = ["habits:read", "routines:read"];
-var WRITE3 = ["habits:write", "routines:write"];
-var pathParams3 = { id: "The tag's id: the ULID the sticker's link carries (`/t/{id}`)." };
+var READ5 = ["habits:read", "routines:read"];
+var WRITE5 = ["habits:write", "routines:write"];
+var pathParams4 = { id: "The tag's id: the ULID the sticker's link carries (`/t/{id}`)." };
 var tapTagOperations = defineOperations({
   list: {
     method: "get",
     path: "/tap-tags",
-    scopes: READ3,
+    scopes: READ5,
     tag: "Habits",
     summary: "List tap tags",
     description: "The Space's NFC stickers: where each is (`label`), what a tap does (`habit`: check it in; `routine`: mark today's run done), its target's title and its link's `path`.",
@@ -32857,7 +34059,7 @@ var tapTagOperations = defineOperations({
   create: {
     method: "post",
     path: "/tap-tags",
-    scopes: WRITE3,
+    scopes: WRITE5,
     tag: "Habits",
     summary: "Make a tap tag",
     description: "Bind a new sticker id (a client-minted ULID) to a live habit or routine of the Space, of the tag's kind. Write `https://<your do>/t/{id}` onto an NFC sticker.",
@@ -32869,8 +34071,8 @@ var tapTagOperations = defineOperations({
   get: {
     method: "get",
     path: "/tap-tags/{id}",
-    pathParams: pathParams3,
-    scopes: READ3,
+    pathParams: pathParams4,
+    scopes: READ5,
     tag: "Habits",
     summary: "Get a tap tag",
     description: "One tag.",
@@ -32881,8 +34083,8 @@ var tapTagOperations = defineOperations({
   update: {
     method: "patch",
     path: "/tap-tags/{id}",
-    pathParams: pathParams3,
-    scopes: WRITE3,
+    pathParams: pathParams4,
+    scopes: WRITE5,
     tag: "Habits",
     summary: "Rename or rebind a tap tag",
     description: "Change its `label`, or bind it to another habit or routine (`kind` and `targetId` together): the sticker stays as it is.",
@@ -32894,8 +34096,8 @@ var tapTagOperations = defineOperations({
   remove: {
     method: "delete",
     path: "/tap-tags/{id}",
-    pathParams: pathParams3,
-    scopes: WRITE3,
+    pathParams: pathParams4,
+    scopes: WRITE5,
     tag: "Habits",
     summary: "Delete a tap tag",
     description: "The sticker's link stops doing anything.",
@@ -32906,8 +34108,8 @@ var tapTagOperations = defineOperations({
   tap: {
     method: "post",
     path: "/tap-tags/{id}/tap",
-    pathParams: pathParams3,
-    scopes: WRITE3,
+    pathParams: pathParams4,
+    scopes: WRITE5,
     tag: "Habits",
     summary: "Tap a tap tag",
     description: "What the sticker does, as the key's member: check the habit in, or take today's run of the routine. Returns the receipt (`line`) and its `undo` (the check-in's `habitId` + `entryId`, or the run's `runId` + `stepRunIds` for `POST /routines/runs/{runId}/undo`). The same member's second tap within 30 s does nothing (`outcome: \"already\"`). The key must act for a member.",
@@ -33107,7 +34309,7 @@ var taskOperations = defineOperations({
 });
 
 // ../../packages/schema/src/operations/time-blocks.ts
-var INSTANT = "an ISO 8601 datetime with offset, or a bare `YYYY-MM-DD` (UTC midnight)";
+var INSTANT3 = "an ISO 8601 datetime with offset, or a bare `YYYY-MM-DD` (UTC midnight)";
 var timeBlockOperations = defineOperations({
   ...crudOperations({
     segment: "time-blocks",
@@ -33120,12 +34322,12 @@ var timeBlockOperations = defineOperations({
     listQuery: [
       {
         name: "from",
-        description: `Start of the window (inclusive) \u2014 ${INSTANT}. With \`to\`; both default to the next day.`,
+        description: `Start of the window (inclusive) \u2014 ${INSTANT3}. With \`to\`; both default to the next day.`,
         format: "date-time"
       },
       {
         name: "to",
-        description: `End of the window (exclusive, at most 62 days after \`from\`) \u2014 ${INSTANT}.`,
+        description: `End of the window (exclusive, at most 62 days after \`from\`) \u2014 ${INSTANT3}.`,
         format: "date-time"
       },
       { name: "kind", description: "Only blocks of this kind: `task`, `focus` or `life`." }
@@ -33268,6 +34470,112 @@ var webhookOperations = defineOperations({
   }
 });
 
+// ../../packages/schema/src/operations/whoami.ts
+var whoamiOperations = defineOperations({
+  whoami: {
+    method: "get",
+    path: "/whoami",
+    scopes: [],
+    tag: "Identity",
+    summary: "Identity ping",
+    description: "What the presented key resolved to (tenant + scopes), and the Agent it acts as when it is an Agent's key (`agentId`, else null).",
+    status: 200,
+    response: { description: "The resolved API-key identity." },
+    operationId: "whoami"
+  }
+});
+
+// ../../packages/schema/src/operations/withings.ts
+var withingsOperations = defineOperations({
+  status: {
+    method: "get",
+    path: "/health/withings",
+    scopes: ["health:read"],
+    tag: "Health",
+    summary: "Get the Withings link",
+    description: "The key's member's Withings link (connected in the app, Settings \u2192 Health): `available` and `mode` (off \xB7 fake \xB7 live, the server's switch), `connected`, `lastSyncAt`, and `failure` (`reauth` \xB7 `unavailable` \xB7 `other`, with a title and a hint) when the sync stopped. Never another member's.",
+    status: 200,
+    response: { description: "The link's status." },
+    errors: { 403: true }
+  },
+  sync: {
+    method: "post",
+    path: "/health/withings/sync",
+    scopes: ["health:write"],
+    tag: "Health",
+    summary: "Sync Withings now",
+    description: "As the key's member, one sync of their Withings scale, as the 07:30 morning sync and Withings' own notify do: each weigh-in (kg) onto their own ledger, joining the Weight Metric, nothing twice. Returns written and skipped and the status after it; a sync that stops answers 200 with `status.failure`. 409 before the member connected, 403 while the server has Withings off.",
+    status: 200,
+    response: { description: "What came in, and the status after it." },
+    errors: { 403: true, 409: true }
+  }
+});
+
+// ../../packages/schema/src/operations/worktree-links.ts
+var pathParams5 = { nodeId: "The linked Task's or Project's ULID." };
+var notLinkable = "No live Task or Project with that id in this Space (or, for GET, no link on it).";
+var worktreeLinkOperations = defineOperations({
+  list: {
+    method: "get",
+    path: "/worktree-links",
+    scopes: ["orca:read"],
+    tag: "Orca",
+    summary: "List worktree links",
+    description: "Every Worktree link on a live Task or Project in the Space, with the node's `title`.",
+    query: [
+      { name: "host", description: "Only links to worktrees on this Orca host." },
+      {
+        name: "worktreeId",
+        description: "Only links to this Orca worktree id (`<repoId>::<path>`)."
+      },
+      { name: "subject", description: "Only links on this kind of node: `task` or `project`." }
+    ],
+    querySchema: worktreeLinkListQuerySchema,
+    status: 200,
+    response: { description: "The Space's worktree links." },
+    errors: { 400: true }
+  },
+  get: {
+    method: "get",
+    path: "/worktree-links/{nodeId}",
+    pathParams: pathParams5,
+    scopes: ["orca:read"],
+    tag: "Orca",
+    summary: "Get a worktree link",
+    description: "The Worktree link on a Task or Project.",
+    status: 200,
+    response: { description: "The link." },
+    errors: { 404: notLinkable }
+  },
+  set: {
+    method: "put",
+    path: "/worktree-links/{nodeId}",
+    pathParams: pathParams5,
+    scopes: ["orca:write"],
+    tag: "Orca",
+    summary: "Set a worktree link",
+    description: "Link a Task or Project to an Orca worktree (`host` + `worktreeId`, optionally `path` and `branch`), replacing any earlier link; fires `worktree.link.set`.",
+    body: setWorktreeLinkInputSchema,
+    status: 200,
+    response: { description: "The stored link." },
+    errors: { 400: true, 404: notLinkable },
+    webhook: "worktree.link.set"
+  },
+  clear: {
+    method: "delete",
+    path: "/worktree-links/{nodeId}",
+    pathParams: pathParams5,
+    scopes: ["orca:write"],
+    tag: "Orca",
+    summary: "Clear a worktree link",
+    description: "Unlink a Task or Project; fires `worktree.link.cleared` with the removed link. Idempotent \u2014 a node without a link is a no-op.",
+    status: 204,
+    response: { description: "Cleared." },
+    errors: { 404: notLinkable },
+    webhook: "worktree.link.cleared"
+  }
+});
+
 // ../../node_modules/ulidx/dist/node/index.js
 import crypto from "crypto";
 
@@ -33520,7 +34828,7 @@ function parseCapture2(input, now) {
 
 // src/meta.ts
 var CLI_NAME = "do";
-var VERSION = "1.306.1";
+var VERSION = "1.307.0";
 var API_PREFIX = "/api/v1";
 var DEFAULT_API_URL = "http://localhost:3001";
 
@@ -33749,7 +35057,7 @@ function resolveConfig(io, flags) {
 }
 
 // src/contacts-commands.ts
-var WRITE4 = ["contacts:write"];
+var WRITE6 = ["contacts:write"];
 var FIELD_FLAGS = [
   { name: "name", type: "string", description: "The display name (or pass it as the argument)." },
   { name: "kind", type: "string", description: "person (the default) or organization." },
@@ -33792,7 +35100,7 @@ var CONTACT_COMMAND_SPECS = [
     summary: "Add a contact: a person or an organisation, with their details.",
     args: [{ name: "name", required: false, description: "The display name." }],
     flags: FIELD_FLAGS,
-    scopes: WRITE4,
+    scopes: WRITE6,
     returns: "ContactView",
     notes: 'Flags build a CreateContactInput; --data adds any other field (a flag wins). The id is minted when omitted. e.g. `do contacts create "Sam Peters" --email sam@example.com --birthday 1990-04-12 --circles <id>`.'
   },
@@ -33801,7 +35109,7 @@ var CONTACT_COMMAND_SPECS = [
     summary: "Change a contact's details.",
     args: [{ name: "id", required: true, description: "The contact's id." }],
     flags: FIELD_FLAGS,
-    scopes: WRITE4,
+    scopes: WRITE6,
     returns: "ContactView",
     notes: "Only the flags you pass change. `none` clears a field (--email none, --birthday none). --birthday keeps the contact's other dates; --roles, --circles and --tags replace the list (a role it already has keeps its details)."
   }
@@ -34000,12 +35308,9 @@ var ENTITIES = [
     createInput: "CreateHabitInput",
     updateInput: "UpdateHabitInput"
   }),
-  {
+  entityFromOperations(projectOperations, {
     name: "projects",
-    path: "/projects",
-    readScopes: ["projects:read"],
     returns: "ProjectView",
-    canGet: true,
     listFlags: [
       AREA_FLAG,
       {
@@ -34015,15 +35320,9 @@ var ENTITIES = [
       UPDATED_SINCE_FLAG,
       DUE_BEFORE_FLAG
     ],
-    write: {
-      scopes: ["projects:write"],
-      createSchema: createProjectInputSchema,
-      createInput: "CreateProjectInput",
-      updateSchema: updateProjectInputSchema,
-      updateInput: "UpdateProjectInput",
-      canDelete: true
-    }
-  },
+    createInput: "CreateProjectInput",
+    updateInput: "UpdateProjectInput"
+  }),
   entityFromOperations(areaOperations, {
     name: "areas",
     returns: "AreaView",
@@ -34386,12 +35685,9 @@ var ENTITIES = [
     createInput: "CreateAnimalInput",
     updateInput: "UpdateAnimalInput"
   }),
-  {
+  entityFromOperations(runOperations, {
     name: "runs",
-    path: "/runs",
-    readScopes: ["collections:read"],
     returns: "RunView",
-    canGet: true,
     listFlags: [
       { name: "game", description: "only the runs of this game item id", query: "gameId" },
       {
@@ -34401,15 +35697,9 @@ var ENTITIES = [
       },
       { name: "theme", description: "only this theme pack (skyrim, pokemon, \u2026)", query: "theme" }
     ],
-    write: {
-      scopes: ["collections:write"],
-      createSchema: createRunInputSchema,
-      createInput: "CreateRunInput",
-      updateSchema: updateRunInputSchema,
-      updateInput: "UpdateRunInput",
-      canDelete: true
-    }
-  },
+    createInput: "CreateRunInput",
+    updateInput: "UpdateRunInput"
+  }),
   entityFromOperations(shoppingListOperations, {
     name: "shopping-lists",
     returns: "ShoppingList",
@@ -34488,8 +35778,8 @@ function entityOperations(e) {
 }
 
 // src/health-commands.ts
-var READ4 = ["health:read"];
-var WRITE5 = ["health:write"];
+var READ6 = ["health:read"];
+var WRITE7 = ["health:write"];
 var DATA_FLAG = {
   name: "data",
   type: "string",
@@ -34503,7 +35793,7 @@ function recordSpecs(plural, singular, noun, returns, createInput, updateInput,
       summary: `List your health ${noun}s.`,
       args: [],
       flags: listFlags,
-      scopes: READ4,
+      scopes: READ6,
       returns
     },
     {
@@ -34511,7 +35801,7 @@ function recordSpecs(plural, singular, noun, returns, createInput, updateInput,
       summary: `Show one health ${noun}.`,
       args: [id],
       flags: [],
-      scopes: READ4,
+      scopes: READ6,
       returns
     },
     {
@@ -34519,7 +35809,7 @@ function recordSpecs(plural, singular, noun, returns, createInput, updateInput,
       summary: `Add a health ${noun} (--data '${createInput}').`,
       args: [],
       flags: [DATA_FLAG, ...addFlags],
-      scopes: WRITE5,
+      scopes: WRITE7,
       returns,
       notes: `Body: ${createInput}. Always private to you; subjectNodeId names who it is about (absent = you).`
     },
@@ -34528,7 +35818,7 @@ function recordSpecs(plural, singular, noun, returns, createInput, updateInput,
       summary: `Change a health ${noun} (--data '${updateInput}').`,
       args: [id],
       flags: [DATA_FLAG],
-      scopes: WRITE5,
+      scopes: WRITE7,
       returns,
       notes: `Body: ${updateInput}. null clears a field.`
     },
@@ -34537,7 +35827,7 @@ function recordSpecs(plural, singular, noun, returns, createInput, updateInput,
       summary: `Delete a health ${noun}.`,
       args: [id],
       flags: [],
-      scopes: WRITE5,
+      scopes: WRITE7,
       returns: "Deleted",
       notes: "Destructive: needs --allow-destructive. An Agent's delete waits on your confirmation."
     }
@@ -34549,7 +35839,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Show whether Health is on (only you turn it on or off, in do).",
     args: [],
     flags: [],
-    scopes: READ4,
+    scopes: READ6,
     returns: "HealthConsentState",
     notes: "`granted` is on at today's consent text (`currentVersion`); `renewalNeeded` means you agreed to an older text, so writes wait until you agree again in do. `aiProvider` names who processes what the agent reads (null when this deployment names none)."
   },
@@ -34558,7 +35848,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Show your health profile: blood group, allergies, lifestyle, notes, emergency contact, GP.",
     args: [],
     flags: [],
-    scopes: READ4,
+    scopes: READ6,
     returns: "HealthProfile"
   },
   {
@@ -34566,7 +35856,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Show your Medical ID: name, blood group, allergies, current medications, height, emergency contact.",
     args: [],
     flags: [],
-    scopes: READ4,
+    scopes: READ6,
     returns: "HealthMedicalId",
     notes: "The few facts someone helping in an emergency needs. The emergency contact comes with their name and phone; a field not set is null. Each read by a key is logged for the member."
   },
@@ -34587,7 +35877,7 @@ var HEALTH_COMMAND_SPECS = [
         description: `Sex, in your words, for the doctor's page ("female"); "" clears it.`
       }
     ],
-    scopes: WRITE5,
+    scopes: WRITE7,
     returns: "HealthProfile",
     notes: "Body: UpdateHealthProfileInput. An absent key keeps a field; null clears it. Lifestyle is `alcohol`, `smoking`, `exercise`, and `notes` anything else: the member's own words. Notes go on For the doctor's background; `sex` on its patient line."
   },
@@ -34596,7 +35886,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Log one health message: find or start the Episode, add a symptom and/or a dose.",
     args: [],
     flags: [DATA_FLAG],
-    scopes: WRITE5,
+    scopes: WRITE7,
     returns: "HealthReceipt",
     notes: 'Body: LogHealthInput, e.g. {"episode":{"title":"Sprained ankle","bodyRegion":"ankle_l"},"symptom":{"symptom":"worse on the stairs","severity":6,"severityGuessed":true},"dose":{"medication":"Ibuprofen"}}. The receipt lists each part with a line, what was guessed, and its undo. With "thread":{"slug":"<agent>"} (only an agent key that converses) the receipt card is posted there too, and postId names it.'
   },
@@ -34605,7 +35895,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: `Correct a symptom entry and get a receipt (--data '{"bodyRegion":"ankle_l"}').`,
     args: [{ name: "entry", required: true, description: "The entry's id (its latest version)." }],
     flags: [DATA_FLAG],
-    scopes: WRITE5,
+    scopes: WRITE7,
     returns: "HealthReceipt"
   },
   {
@@ -34616,7 +35906,7 @@ var HEALTH_COMMAND_SPECS = [
       { name: "trend", required: true, description: "better|same|worse, against yesterday." }
     ],
     flags: [],
-    scopes: WRITE5,
+    scopes: WRITE7,
     returns: "HealthReceipt",
     notes: "One a day: a second check-in the same day corrects the first. The receipt carries its undo."
   },
@@ -34633,7 +35923,7 @@ var HEALTH_COMMAND_SPECS = [
         description: "Post the confirmation card in this thread (by slug); the agent's key only."
       }
     ],
-    scopes: WRITE5,
+    scopes: WRITE7,
     returns: "HealthRedFlagsResult",
     notes: "Flags: fever, vomiting, black_stools, blood, weight_loss, night_pain, chest_pain, short_of_breath. Answers merge into those asked before; the Episode is marked checked today, and For the doctor shows it."
   },
@@ -34645,7 +35935,7 @@ var HEALTH_COMMAND_SPECS = [
       { name: "id", required: true, description: "The id from the receipt's undo." }
     ],
     flags: [],
-    scopes: WRITE5,
+    scopes: WRITE7,
     returns: "HealthUndoResult",
     notes: "A POST, so an Agent's undo never waits on a confirmation."
   },
@@ -34654,7 +35944,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Find the open Episode a complaint belongs to, or start one (--data UpsertHealthEpisodeInput).",
     args: [],
     flags: [DATA_FLAG],
-    scopes: WRITE5,
+    scopes: WRITE7,
     returns: "HealthEpisodeUpsert"
   },
   {
@@ -34664,7 +35954,7 @@ var HEALTH_COMMAND_SPECS = [
     flags: [
       { name: "episode", type: "string", description: "The Episode; default the latest open one." }
     ],
-    scopes: READ4,
+    scopes: READ6,
     returns: "HealthSummary"
   },
   {
@@ -34687,7 +35977,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Your For-the-doctor links: sections, expiry, opens; never the secret.",
     args: [],
     flags: [],
-    scopes: READ4,
+    scopes: READ6,
     returns: "HealthShare[]",
     notes: "Only the member makes a share, in do; a key can list and take one back."
   },
@@ -34696,7 +35986,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Take a For-the-doctor link back: it stops opening.",
     args: [{ name: "id", required: true, description: "The share's id." }],
     flags: [],
-    scopes: WRITE5,
+    scopes: WRITE7,
     returns: "HealthShare"
   },
   ...recordSpecs("conditions", "condition", "condition", "HealthConditionView", "CreateHealthConditionInput", "UpdateHealthConditionInput"),
@@ -34714,7 +36004,7 @@ var HEALTH_COMMAND_SPECS = [
         description: 'Their role on it, in your words ("dermatologist").'
       }
     ],
-    scopes: WRITE5,
+    scopes: WRITE7,
     returns: "HealthConditionView",
     notes: "A cared_by link (condition \u2192 contact). Adding one already on it sets the role. The condition's page, the Health home's Care team and For the doctor list them."
   },
@@ -34726,7 +36016,7 @@ var HEALTH_COMMAND_SPECS = [
       { name: "contact", required: true, description: "The Contact's id." }
     ],
     flags: [],
-    scopes: WRITE5,
+    scopes: WRITE7,
     returns: "HealthConditionView",
     notes: "An Agent's removal waits on your confirmation, like a delete."
   },
@@ -34763,7 +36053,7 @@ var HEALTH_COMMAND_SPECS = [
       { name: "at", type: "string", description: "When it happened (ISO); defaults to now." },
       { name: "note", type: "string", description: "A free-text note." }
     ],
-    scopes: WRITE5,
+    scopes: WRITE7,
     returns: "HealthSymptomEntry",
     notes: "An Agent's entry is source chat. For qualifiers, send --data with LogHealthSymptomInput."
   },
@@ -34779,7 +36069,7 @@ var HEALTH_COMMAND_SPECS = [
       }
     ],
     flags: [DATA_FLAG],
-    scopes: WRITE5,
+    scopes: WRITE7,
     returns: "HealthSymptomEntry",
     notes: "Body: CorrectHealthSymptomInput; fields not named are copied. The history stays."
   },
@@ -34791,7 +36081,7 @@ var HEALTH_COMMAND_SPECS = [
       { name: "entry", required: true, description: "The entry's id." }
     ],
     flags: [],
-    scopes: WRITE5,
+    scopes: WRITE7,
     returns: "Deleted"
   },
   ...recordSpecs("visits", "visit", "visit", "HealthEncounterView", "CreateHealthEncounterInput", "UpdateHealthEncounterInput"),
@@ -34801,7 +36091,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "List the doses of a Medication, latest first.",
     args: [{ name: "med", required: true, description: "The Medication's id." }],
     flags: [],
-    scopes: READ4,
+    scopes: READ6,
     returns: "HealthMedicationDose"
   },
   {
@@ -34815,7 +36105,7 @@ var HEALTH_COMMAND_SPECS = [
       { name: "at", type: "string", description: "When (ISO); defaults to now." },
       { name: "note", type: "string", description: "A free-text note." }
     ],
-    scopes: WRITE5,
+    scopes: WRITE7,
     returns: "HealthMedicationDose"
   },
   {
@@ -34826,7 +36116,7 @@ var HEALTH_COMMAND_SPECS = [
       { name: "dose", required: true, description: "The dose's id." }
     ],
     flags: [DATA_FLAG],
-    scopes: WRITE5,
+    scopes: WRITE7,
     returns: "HealthMedicationDose",
     notes: "Body: UpdateHealthDoseInput."
   },
@@ -34838,7 +36128,7 @@ var HEALTH_COMMAND_SPECS = [
       { name: "dose", required: true, description: "The dose's id." }
     ],
     flags: [],
-    scopes: WRITE5,
+    scopes: WRITE7,
     returns: "Deleted"
   },
   ...recordSpecs("labs", "lab", "lab draw", "HealthLabPanelView", "CreateHealthLabPanelInput", "UpdateHealthLabPanelInput"),
@@ -34860,7 +36150,7 @@ var HEALTH_COMMAND_SPECS = [
         description: "The file's media type, when its name doesn't say."
       }
     ],
-    scopes: WRITE5,
+    scopes: WRITE7,
     returns: "HealthLabImportResult",
     notes: "The draw stays a draft (status draft, source import) until the member checks it; the report is kept as its original. A report with no lab value in it is a 422."
   },
@@ -34869,7 +36159,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "The canonical analytes: key, printed name, group, unit, LOINC and aliases.",
     args: [],
     flags: [],
-    scopes: READ4,
+    scopes: READ6,
     returns: "LabAnalyteDef[]",
     notes: 'A result is written under the canonical key its analyte or name stands for ("ALAT" \u2192 alt, "25-OH vitamin D" \u2192 vitamin_d); a name that matches none keeps its slug and comes back in the draw\'s `unmatched`.'
   },
@@ -34884,7 +36174,7 @@ var HEALTH_COMMAND_SPECS = [
         description: "Required: only report, change nothing."
       }
     ],
-    scopes: READ4,
+    scopes: READ6,
     returns: "HealthLabNormalizeReport",
     notes: "Nothing is rewritten: trends already read old keys as their canonical one. Lists each result's from \u2192 to, and the keys that match no canonical analyte."
   },
@@ -34893,7 +36183,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Every analyte your draws measured, each with its trend, grouped as a lab sheet.",
     args: [],
     flags: [],
-    scopes: READ4,
+    scopes: READ6,
     returns: "HealthLabOverview"
   },
   {
@@ -34919,25 +36209,25 @@ var HEALTH_COMMAND_SPECS = [
     summary: "Whether your Withings scale is connected, the last sync, and what stops it.",
     args: [],
     flags: [],
-    scopes: READ4,
+    scopes: [...withingsOperations.status.scopes],
     returns: "WithingsStatus",
-    notes: "GET /api/v1/health/withings. Connecting needs Withings' consent in a browser: Settings \u2192 Health in do. `failure` (reauth, unavailable, other) says what stops the sync, with a title and a hint."
+    notes: `${routeOf(withingsOperations.status)}. Connecting needs Withings' consent in a browser: Settings \u2192 Health in do. \`failure\` (reauth, unavailable, other) says what stops the sync, with a title and a hint.`
   },
   {
     path: ["health", "withings", "sync"],
     summary: "Sync your Withings weigh-ins now, as the morning sync does.",
     args: [],
     flags: [],
-    scopes: WRITE5,
+    scopes: [...withingsOperations.sync.scopes],
     returns: "WithingsSyncResult",
-    notes: "POST /api/v1/health/withings/sync. Written and skipped, and the status after it; a sync that stops answers 200 with `status.failure`. 409 before Withings is connected, 403 while the server has it switched off."
+    notes: `${routeOf(withingsOperations.sync)}. Written and skipped, and the status after it; a sync that stops answers 200 with \`status.failure\`. 409 before Withings is connected, 403 while the server has it switched off.`
   },
   {
     path: ["health", "analyte"],
     summary: "One analyte's trend across draws (do health analyte vitamin_d).",
     args: [{ name: "analyte", required: true, description: "The analyte key (vitamin_d)." }],
     flags: [],
-    scopes: READ4,
+    scopes: READ6,
     returns: "HealthLabAnalyteView"
   },
   {
@@ -34945,7 +36235,7 @@ var HEALTH_COMMAND_SPECS = [
     summary: `Keep a target band or the supplement for an analyte (--data '{"targetLow":40,"targetHigh":60}').`,
     args: [{ name: "analyte", required: true, description: "The analyte key (vitamin_d)." }],
     flags: [DATA_FLAG],
-    scopes: WRITE5,
+    scopes: WRITE7,
     returns: "HealthLabAnalyteView",
     notes: "Body: SetHealthLabAnalyteInput. An absent key keeps a field; null clears it."
   }
@@ -35229,9 +36519,9 @@ var COMMAND_SPECS = [
       { name: "from", type: "string", description: "Window start (ISO); default today, UTC." },
       { name: "to", type: "string", description: "Window end (ISO); default a day after from." }
     ],
-    scopes: ["tasks:read"],
+    scopes: [...readOperations.now.scopes],
     returns: "NowResponse",
-    notes: "GET /api/v1/now \u2014 server-side; pass your local day bounds with --from/--to."
+    notes: `${routeOf(readOperations.now)} \u2014 server-side; pass your local day bounds with --from/--to.`
   },
   {
     path: ["landed"],
@@ -35241,7 +36531,7 @@ var COMMAND_SPECS = [
       { name: "from", type: "string", description: "Window start (ISO); default today, UTC." },
       { name: "to", type: "string", description: "Window end (ISO); default a day after from." }
     ],
-    scopes: ["tasks:read"],
+    scopes: [...readOperations.landed.scopes],
     returns: "LandedResponse",
     notes: "Cancelled tasks never count. For a week: --from <monday> --to <next monday>."
   },
@@ -35253,7 +36543,7 @@ var COMMAND_SPECS = [
       { name: "from", type: "string", description: "Window start (ISO); default today, UTC." },
       { name: "to", type: "string", description: "Window end (ISO); default a day after from." }
     ],
-    scopes: ["tasks:read"],
+    scopes: [...readOperations.review.scopes],
     returns: "ReviewDayStat"
   },
   {
@@ -35638,7 +36928,7 @@ var COMMAND_SPECS = [
       },
       { name: "limit", type: "string", description: "Max hits (1\u201350, default 20)." }
     ],
-    scopes: [],
+    scopes: [...readOperations.search.scopes],
     returns: "SearchHit",
     notes: "Returns only the node types your key holds a read scope for."
   },
@@ -36574,7 +37864,7 @@ var COMMAND_SPECS = [
     summary: "Show the note attached to any node (Habit, Area, Contact, \u2026).",
     args: [{ name: "node", required: true, description: "Owner node ULID." }],
     flags: [],
-    scopes: ["notes:read"],
+    scopes: [...nodeOperations.getNotes.scopes],
     returns: "AttachedNoteView",
     notes: "No note yet is `noteId: null` (human output says so). 404 for a `note`/`event` node."
   },
@@ -36583,7 +37873,7 @@ var COMMAND_SPECS = [
     summary: "Set the note attached to any node (upsert).",
     args: [{ name: "node", required: true, description: "Owner node ULID." }],
     flags: [{ name: "body", type: "string", description: "The note body (markdown)." }],
-    scopes: ["notes:write"],
+    scopes: [...nodeOperations.setNotes.scopes],
     returns: "AttachedNoteView",
     notes: "Body from --body (required). A blank body is refused \u2014 clear with `notes detach`."
   },
@@ -36616,7 +37906,7 @@ var COMMAND_SPECS = [
     flags: [
       { name: "allow-destructive", type: "boolean", description: "Required to actually clear." }
     ],
-    scopes: ["notes:write"],
+    scopes: [...nodeOperations.clearNotes.scopes],
     returns: "None",
     notes: "Destructive \u2014 gated behind --allow-destructive + a notes:write key. Idempotent."
   },
@@ -36625,7 +37915,7 @@ var COMMAND_SPECS = [
     summary: "List every Orca host's worktrees: status, last line, sessions and linked Task.",
     args: [],
     flags: [],
-    scopes: ["orca:read"],
+    scopes: [...orcaOperations.overview.scopes],
     returns: "OrcaOverview",
     notes: "state is ok | unreachable | not_configured. waitingCount counts worktrees waiting on you. Read live; nothing is stored."
   },
@@ -36641,7 +37931,7 @@ var COMMAND_SPECS = [
       { name: "limit", type: "string", description: "At most this many lines (1\u20132000)." },
       { name: "screen", type: "boolean", description: "Read the rendered screen instead." }
     ],
-    scopes: ["orca:read"],
+    scopes: [...orcaOperations.output.scopes],
     returns: "OrcaTerminalOutput"
   },
   {
@@ -36655,7 +37945,7 @@ var COMMAND_SPECS = [
       { name: "text", type: "string", description: "The message to send." },
       { name: "no-enter", type: "boolean", description: "Type it without pressing Enter." }
     ],
-    scopes: ["orca:write"],
+    scopes: [...orcaOperations.send.scopes],
     returns: "OrcaSendMessageResult",
     notes: "An Agent's key gets a 428 confirmation_required; it runs once the member confirms in do's agent panel (#678)."
   },
@@ -36671,7 +37961,7 @@ var COMMAND_SPECS = [
       },
       { name: "agent", type: "string", description: "The agent to start: claude or codex." }
     ],
-    scopes: ["orca:write"],
+    scopes: [...orcaOperations.restart.scopes],
     returns: "OrcaRestartSessionResult",
     notes: "Starts a new session; the old one is left as it was. Gated like orca send: an Agent's key gets a 428 confirmation_required until the member confirms."
   },
@@ -36688,7 +37978,7 @@ var COMMAND_SPECS = [
       },
       { name: "subject", type: "string", description: "Only `task` or `project` links." }
     ],
-    scopes: ["orca:read"],
+    scopes: [...worktreeLinkOperations.list.scopes],
     returns: "WorktreeLinkView",
     notes: "Each row carries the linked node's title. Progress is never stored \u2014 read it in Orca."
   },
@@ -36697,7 +37987,7 @@ var COMMAND_SPECS = [
     summary: "Show the Worktree link on a Task or Project.",
     args: [{ name: "node", required: true, description: "Task or Project ULID." }],
     flags: [],
-    scopes: ["orca:read"],
+    scopes: [...worktreeLinkOperations.get.scopes],
     returns: "WorktreeLink",
     notes: "Not found (exit 4) when the node has no link. Task/Project reads carry it as worktreeLink."
   },
@@ -36719,7 +38009,7 @@ var COMMAND_SPECS = [
       },
       { name: "branch", type: "string", description: "The branch, when known." }
     ],
-    scopes: ["orca:write"],
+    scopes: [...worktreeLinkOperations.set.scopes],
     returns: "WorktreeLink",
     notes: "PUT /api/v1/worktree-links/{node}. --host and --worktree are required."
   },
@@ -36730,7 +38020,7 @@ var COMMAND_SPECS = [
     flags: [
       { name: "allow-destructive", type: "boolean", description: "Required to actually unlink." }
     ],
-    scopes: ["orca:write"],
+    scopes: [...worktreeLinkOperations.clear.scopes],
     returns: "None",
     notes: "Gated behind --allow-destructive + an orca:write key. Idempotent."
   },
@@ -37110,7 +38400,7 @@ var COMMAND_SPECS = [
     summary: "Show the agent runtime the agent panel's chat goes to (never its key).",
     args: [],
     flags: [],
-    scopes: ["agents:read"],
+    scopes: [...agentConnectionOperations.get.scopes],
     returns: "AgentConnection",
     notes: "hasKey says whether a key is set; the key itself is write-only."
   },
@@ -37143,7 +38433,7 @@ var COMMAND_SPECS = [
       },
       { name: "clear-key", type: "boolean", description: "Remove the stored key." }
     ],
-    scopes: ["agents:write"],
+    scopes: [...agentConnectionOperations.save.scopes],
     returns: "AgentConnection",
     notes: "The runtime's key is read from DO_AGENT_API_KEY or, with --key-stdin, from stdin \u2014 never a flag. With neither, the stored key is kept. --model and --agent are replaced as sent (left out clears them). Owner/admin only (canManageSpace)."
   },
@@ -37154,7 +38444,7 @@ var COMMAND_SPECS = [
     flags: [
       { name: "allow-destructive", type: "boolean", description: "Required to actually remove." }
     ],
-    scopes: ["agents:write"],
+    scopes: [...agentConnectionOperations.remove.scopes],
     returns: "None",
     notes: "Owner/admin only. An Agent's key gets a 428 confirmation_required until the member confirms in do's agent panel."
   },
@@ -37492,7 +38782,7 @@ var COMMAND_SPECS = [
     summary: "List the catalog Types (key \xB7 label \xB7 status subset).",
     args: [],
     flags: [],
-    scopes: ["collections:read"],
+    scopes: [...collectionOperations.types.scopes],
     returns: "CollectionTypeSummary",
     notes: "The Type registry is code-defined (ADR 0017); served from GET /api/v1/collection/types."
   },
@@ -37520,7 +38810,7 @@ var COMMAND_SPECS = [
       },
       ...PAGINATION_FLAGS
     ],
-    scopes: ["collections:read"],
+    scopes: [...collectionOperations.list.scopes],
     returns: "CollectionItemView"
   },
   {
@@ -37535,7 +38825,7 @@ var COMMAND_SPECS = [
         description: "Initial status; defaults to the Type's first."
       }
     ],
-    scopes: ["collections:write"],
+    scopes: [...collectionOperations.create.scopes],
     returns: "CollectionItemView",
     grammar: {
       "#tag": "Adds a tag. Repeatable: '#scifi #2024'."
@@ -37554,7 +38844,7 @@ var COMMAND_SPECS = [
       }
     ],
     flags: [],
-    scopes: ["collections:write"],
+    scopes: [...collectionOperations.update.scopes],
     returns: "CollectionItemView"
   },
   {
@@ -37577,7 +38867,7 @@ var COMMAND_SPECS = [
       { name: "cost", type: "string", description: "What it cost (a sweep, a repair)." },
       { name: "contact", type: "string", description: "Contact ULID of who did it." }
     ],
-    scopes: ["collections:write"],
+    scopes: [...collectionOperations.addEntry.scopes],
     returns: "CollectionItemDetail"
   },
   {
@@ -37635,9 +38925,9 @@ var COMMAND_SPECS = [
         description: "Day it occurred (YYYY-MM-DD); defaults to today."
       }
     ],
-    scopes: ["collections:write"],
+    scopes: [...collectionOperations.log.scopes],
     returns: "CollectionLogResult",
-    notes: "POST /api/v1/collection/log. Matches the exact title (case-insensitive); several matches \u2192 409 naming them, none without --type \u2192 404 naming close titles."
+    notes: `${routeOf(collectionOperations.log)}. Matches the exact title (case-insensitive); several matches \u2192 409 naming them, none without --type \u2192 404 naming close titles.`
   },
   {
     path: ["collection", "edit-entry"],
@@ -37651,7 +38941,7 @@ var COMMAND_SPECS = [
       { name: "note", type: "string", description: "New note." },
       { name: "on", type: "string", description: "New day (YYYY-MM-DD)." }
     ],
-    scopes: ["collections:write"],
+    scopes: [...collectionOperations.editEntry.scopes],
     returns: "CollectionItemDetail"
   },
   {
@@ -37665,7 +38955,7 @@ var COMMAND_SPECS = [
         description: "Use this image instead of searching (fixes a wrong cover)."
       }
     ],
-    scopes: ["collections:write"],
+    scopes: [...collectionOperations.cover.scopes],
     returns: "CollectionCoverResult",
     notes: "Without --url: books from Open Library, games from IGDB then Steam; replaces the current cover with the next one (the one showing and ones passed over before are skipped). found: false when no other is left. Returns { found, item }."
   },
@@ -37674,7 +38964,7 @@ var COMMAND_SPECS = [
     summary: "List other covers for an Item, best first (up to 6).",
     args: [{ name: "id", required: true, description: "Item ULID." }],
     flags: [],
-    scopes: ["collections:read"],
+    scopes: [...collectionOperations.coverCandidates.scopes],
     returns: "CollectionCoverCandidates",
     notes: "The providers' image URLs without the one showing and the ones passed over. Nothing is fetched; use one with `do collection cover <id> --url <url>`. Returns { candidates: [{ url }] }."
   },
@@ -37683,7 +38973,7 @@ var COMMAND_SPECS = [
     summary: "Backfill covers for books and games that have none (25 per call).",
     args: [],
     flags: [],
-    scopes: ["collections:write"],
+    scopes: [...collectionOperations.backfillCovers.scopes],
     returns: "CollectionCoverBackfillResult",
     notes: "Returns { checked, found }; run again while checked is 25 to work through more."
   },
@@ -38856,9 +40146,9 @@ var COMMAND_SPECS = [
       { name: "session", type: "string", description: "Put the changes on this session id." },
       { name: "new-session", type: "boolean", description: "Start a new session for them." }
     ],
-    scopes: ["collections:write"],
+    scopes: [...runOperations.applyChanges.scopes],
     returns: "RunChangesResult",
-    notes: "POST /api/v1/runs/{id}/changes. Ops: set|merge on a one-value section (character, arc, nextSteps, achievements, install, \u2026), upsert|remove on a list section matched by name (quests, choices, homes, people, mounts, uniques, orderOfPlay, team, checklists, links), tick on a checklist. The batch joins the last session if it was active in the last 6 hours, else opens a new one. A change that leaves the run invalid writes nothing."
+    notes: `${routeOf(runOperations.applyChanges)}. Ops: set|merge on a one-value section (character, arc, nextSteps, achievements, install, \u2026), upsert|remove on a list section matched by name (quests, choices, homes, people, mounts, uniques, orderOfPlay, team, checklists, links), tick on a checklist. The batch joins the last session if it was active in the last 6 hours, else opens a new one. A change that leaves the run invalid writes nothing.`
   },
   {
     path: ["runs", "save-header"],
@@ -38884,18 +40174,18 @@ var COMMAND_SPECS = [
       },
       { name: "dry-run", type: "boolean", description: "Print what the save says; send nothing." }
     ],
-    scopes: ["collections:write"],
+    scopes: [...runOperations.uploadSaveHeader.scopes],
     returns: "RunSaveHeaderResult",
-    notes: "POST /api/v1/runs/{id}/save-header. The save sync (run tracker phase 4): name, level, location, race, play time, the in-game date, plugins and General Stats become the run's `save` section and its character's level, as one update with a receipt and Undo; the screenshot is a file on the run (the last one is dropped). The same save twice changes nothing. Needs a member's key (the screenshot is stored as theirs). The save itself is only read. See docs/agents/skyrim-save-sync.md."
+    notes: `${routeOf(runOperations.uploadSaveHeader)}. The save sync (run tracker phase 4): name, level, location, race, play time, the in-game date, plugins and General Stats become the run's \`save\` section and its character's level, as one update with a receipt and Undo; the screenshot is a file on the run (the last one is dropped). The same save twice changes nothing. Needs a member's key (the screenshot is stored as theirs). The save itself is only read. See docs/agents/skyrim-save-sync.md.`
   },
   {
     path: ["runs", "undo"],
     summary: "Undo a run's latest chat update (or the one given).",
     args: [{ name: "id", required: true, description: "Run ULID." }],
     flags: [{ name: "batch", type: "string", description: "The batch id to undo." }],
-    scopes: ["collections:write"],
+    scopes: [...runOperations.undo.scopes],
     returns: "RunDetail",
-    notes: "POST /api/v1/runs/{id}/undo. Puts the changed sections back as they were."
+    notes: `${routeOf(runOperations.undo)}. Puts the changed sections back as they were.`
   },
   {
     path: ["runs", "dex", "tick"],
@@ -38914,27 +40204,27 @@ var COMMAND_SPECS = [
       { name: "untick", type: "boolean", description: "Untick them instead." },
       { name: "message", type: "string", description: "The chat message, quoted on the receipt." }
     ],
-    scopes: ["collections:write"],
+    scopes: [...runOperations.tickChecklist.scopes],
     returns: "RunChangesResult",
-    notes: "POST /api/v1/runs/{id}/checklists/{key}/tick. `do runs dex tick <run> 495 496 497`, `do runs dex tick <run> --bulk caught.txt` (up to 5000 ids). A dex the run doesn't have yet is made from the Pok\xE9mon pack's national dex."
+    notes: `${routeOf(runOperations.tickChecklist)}. \`do runs dex tick <run> 495 496 497\`, \`do runs dex tick <run> --bulk caught.txt\` (up to 5000 ids). A dex the run doesn't have yet is made from the Pok\xE9mon pack's national dex.`
   },
   {
     path: ["runs", "steam", "status"],
     summary: "Whether you've linked Steam, how many games have a Steam app id, and the last sync.",
     args: [],
     flags: [],
-    scopes: ["collections:read"],
+    scopes: [...runOperations.steamStatus.scopes],
     returns: "SteamAccountStatus",
-    notes: "GET /api/v1/runs/steam. Steam is linked in the app's Settings; the Steam ID and Web API key are never returned. A game takes part once its `steamAppId` is set."
+    notes: `${routeOf(runOperations.steamStatus)}. Steam is linked in the app's Settings; the Steam ID and Web API key are never returned. A game takes part once its \`steamAppId\` is set.`
   },
   {
     path: ["runs", "steam", "sync"],
     summary: "Sync your Steam achievements into your runs now, as the daily sync does.",
     args: [],
     flags: [{ name: "game", type: "string", description: "Only this game item ULID." }],
-    scopes: ["collections:write"],
+    scopes: [...runOperations.steamSync.scopes],
     returns: "SteamSyncResult",
-    notes: "POST /api/v1/runs/steam/sync. Writes into each run whose achievements come from Steam or aren't kept yet; runs kept by hand are left alone. Per game: outcome, runs, unlocked, total and the error (unauthorized, private, no_stats, unavailable, bad_response). 409 before Steam is linked."
+    notes: `${routeOf(runOperations.steamSync)}. Writes into each run whose achievements come from Steam or aren't kept yet; runs kept by hand are left alone. Per game: outcome, runs, unlocked, total and the error (unauthorized, private, no_stats, unavailable, bad_response). 409 before Steam is linked.`
   },
   {
     path: ["sensors", "status"],
@@ -39041,9 +40331,9 @@ var COMMAND_SPECS = [
     summary: "A run's sessions, newest first, with recaps and change batches.",
     args: [{ name: "run", required: true, description: "Run ULID." }],
     flags: [],
-    scopes: ["collections:read"],
+    scopes: [...runOperations.listSessions.scopes],
     returns: "RunSession[]",
-    notes: "GET /api/v1/runs/{id}/sessions."
+    notes: `${routeOf(runOperations.listSessions)}.`
   },
   {
     path: ["runs", "sessions", "add"],
@@ -39054,9 +40344,9 @@ var COMMAND_SPECS = [
       { name: "minutes", type: "string", description: "How long it lasted." },
       { name: "on", type: "string", description: "The day, YYYY-MM-DD (default today)." }
     ],
-    scopes: ["collections:write"],
+    scopes: [...runOperations.addSession.scopes],
     returns: "RunDetail",
-    notes: "POST /api/v1/runs/{id}/sessions."
+    notes: `${routeOf(runOperations.addSession)}.`
   },
   {
     path: ["runs", "sessions", "update"],
@@ -39070,9 +40360,9 @@ var COMMAND_SPECS = [
       { name: "minutes", type: "string", description: "How long it lasted." },
       { name: "on", type: "string", description: "The day, YYYY-MM-DD." }
     ],
-    scopes: ["collections:write"],
+    scopes: [...runOperations.updateSession.scopes],
     returns: "RunDetail",
-    notes: "PATCH /api/v1/runs/{id}/sessions/{sessionId}."
+    notes: `${routeOf(runOperations.updateSession)}.`
   },
   {
     path: ["people", "propose"],
@@ -39134,9 +40424,9 @@ var COMMAND_SPECS = [
         description: "Required to actually delete it."
       }
     ],
-    scopes: ["collections:write"],
+    scopes: [...runOperations.removeSession.scopes],
     returns: "None",
-    notes: "DELETE /api/v1/runs/{id}/sessions/{sessionId}."
+    notes: `${routeOf(runOperations.removeSession)}.`
   },
   {
     path: ["places", "import"],
@@ -39568,7 +40858,7 @@ var COMMAND_SPECS = [
         description: 'JSON CreateInviteInput, e.g. {"type":"link"} or {"type":"email","email":"a@b.c"}.'
       }
     ],
-    scopes: ["members:write"],
+    scopes: [...inviteOperations.create.scopes],
     returns: "Invite"
   },
   {
@@ -39576,7 +40866,7 @@ var COMMAND_SPECS = [
     summary: "List the Space's invites.",
     args: [],
     flags: [],
-    scopes: ["members:read"],
+    scopes: [...inviteOperations.list.scopes],
     returns: "Invite"
   },
   {
@@ -39586,7 +40876,7 @@ var COMMAND_SPECS = [
     flags: [
       { name: "allow-destructive", type: "boolean", description: "Required to actually revoke." }
     ],
-    scopes: ["members:write"],
+    scopes: [...inviteOperations.revoke.scopes],
     returns: "None",
     notes: "Destructive \u2014 gated behind --allow-destructive + a members:write key."
   },
@@ -39595,7 +40885,7 @@ var COMMAND_SPECS = [
     summary: "List the Space's members.",
     args: [],
     flags: [],
-    scopes: ["members:read"],
+    scopes: [...memberOperations.list.scopes],
     returns: "MemberView"
   },
   {
@@ -39606,7 +40896,7 @@ var COMMAND_SPECS = [
       { name: "role", type: "string", description: "Base role: owner|admin|member|guest." },
       { name: "data", type: "string", description: "JSON SetMemberRoleInput (overrides --role)." }
     ],
-    scopes: ["members:write"],
+    scopes: [...memberOperations.setRole.scopes],
     returns: "MemberView"
   },
   {
@@ -39616,7 +40906,7 @@ var COMMAND_SPECS = [
     flags: [
       { name: "allow-destructive", type: "boolean", description: "Required to actually remove." }
     ],
-    scopes: ["members:write"],
+    scopes: [...memberOperations.remove.scopes],
     returns: "None",
     notes: "Destructive \u2014 gated behind --allow-destructive + a members:write key."
   },
@@ -39639,7 +40929,7 @@ var COMMAND_SPECS = [
         default: "member"
       }
     ],
-    scopes: ["sharing:write"],
+    scopes: [...sharingOperations.createGrant.scopes],
     returns: "NodeGrantView"
   },
   {
@@ -39647,7 +40937,7 @@ var COMMAND_SPECS = [
     summary: "List the grants on a node.",
     args: [{ name: "node", required: true, description: "Node ULID." }],
     flags: [],
-    scopes: ["sharing:read"],
+    scopes: [...sharingOperations.listGrants.scopes],
     returns: "NodeGrantView"
   },
   {
@@ -39660,7 +40950,7 @@ var COMMAND_SPECS = [
     flags: [
       { name: "allow-destructive", type: "boolean", description: "Required to actually revoke." }
     ],
-    scopes: ["sharing:write"],
+    scopes: [...sharingOperations.revokeGrant.scopes],
     returns: "None",
     notes: "Destructive \u2014 gated behind --allow-destructive + a sharing:write key."
   },
@@ -39672,7 +40962,7 @@ var COMMAND_SPECS = [
       { name: "to", type: "string", description: "Member ULID to assign to." },
       { name: "cap", type: "string", description: "Capability (default edit).", default: "edit" }
     ],
-    scopes: ["sharing:write"],
+    scopes: [...sharingOperations.assign.scopes],
     returns: "NodeGrantView"
   },
   {
@@ -39683,7 +40973,7 @@ var COMMAND_SPECS = [
       { name: "body", required: true, description: "Comment text." }
     ],
     flags: [],
-    scopes: ["comments:write"],
+    scopes: [...commentOperations.create.scopes],
     returns: "CommentView"
   },
   {
@@ -39691,7 +40981,7 @@ var COMMAND_SPECS = [
     summary: "List a node's comment thread.",
     args: [{ name: "node", required: true, description: "Node ULID." }],
     flags: [],
-    scopes: ["comments:read"],
+    scopes: [...commentOperations.list.scopes],
     returns: "CommentView"
   },
   {
@@ -39699,7 +40989,7 @@ var COMMAND_SPECS = [
     summary: "List the Space's custom roles.",
     args: [],
     flags: [],
-    scopes: ["roles:read"],
+    scopes: [...roleOperations.list.scopes],
     returns: "RoleView"
   },
   {
@@ -39710,7 +41000,7 @@ var COMMAND_SPECS = [
       { name: "cap", type: "string", description: "Capability (default view).", default: "view" },
       { name: "expires", type: "string", description: "Expiry (ISO date/time)." }
     ],
-    scopes: ["links:write"],
+    scopes: [...shareLinkOperations.create.scopes],
     returns: "CreateShareLinkResult",
     notes: "The signed token is returned once, in the create response."
   },
@@ -39719,7 +41009,7 @@ var COMMAND_SPECS = [
     summary: "List the share-links for a node.",
     args: [{ name: "node", required: true, description: "Node ULID." }],
     flags: [],
-    scopes: ["links:read"],
+    scopes: [...shareLinkOperations.listForNode.scopes],
     returns: "ShareLinkPublic"
   },
   {
@@ -39729,7 +41019,7 @@ var COMMAND_SPECS = [
     flags: [
       { name: "allow-destructive", type: "boolean", description: "Required to actually revoke." }
     ],
-    scopes: ["links:write"],
+    scopes: [...shareLinkOperations.revoke.scopes],
     returns: "ShareLinkPublic",
     notes: "Destructive \u2014 gated behind --allow-destructive + a links:write key."
   },
@@ -39766,16 +41056,16 @@ var COMMAND_SPECS = [
         description: "Comma-separated kinds to keep, e.g. task,project."
       }
     ],
-    scopes: [],
+    scopes: [...changesOperations.list.scopes],
     returns: "ChangesPage",
-    notes: "GET /api/v1/changes. Store nextCursor and pass it back as --since; rerun at once while hasMore. A key sees the kinds its *:read scopes cover (tasks:read \u2192 task, \u2026)."
+    notes: `${routeOf(changesOperations.list)}. Store nextCursor and pass it back as --since; rerun at once while hasMore. A key sees the kinds its *:read scopes cover (tasks:read \u2192 task, \u2026).`
   },
   {
     path: ["keys", "list"],
     summary: "List your API keys: name, id, reach, and when each last changed.",
     args: [],
     flags: [],
-    scopes: ["keys:read"],
+    scopes: [...keyOperations.list.scopes],
     returns: "ApiKeyListItem",
     notes: "Only the keys of the member behind this key; never a secret."
   },
@@ -39796,7 +41086,7 @@ var COMMAND_SPECS = [
       },
       { name: "name", type: "string", description: "A new name for the key." }
     ],
-    scopes: ["keys:write"],
+    scopes: [...keyOperations.update.scopes],
     returns: "ApiKey",
     notes: "A key never grants more than it holds: it can't widen its own scopes or change a key that reaches further (exit 3). Every change is recorded on the key. Minting and revoking stay in the app."
   },
@@ -39805,7 +41095,7 @@ var COMMAND_SPECS = [
     summary: "Show the tenant and scopes the configured key resolves to.",
     args: [],
     flags: [],
-    scopes: [],
+    scopes: [...whoamiOperations.whoami.scopes],
     returns: "ApiKeyContext"
   },
   {
@@ -42131,7 +43421,7 @@ var HANDLERS = {
     };
   },
   now: async ({ flags, requireClient }) => ({
-    data: await requireClient().get("/now", {
+    data: await requireClient().get(pathOf(readOperations.now), {
       query: {
         for: flagString(flags, "for"),
         from: flagString(flags, "from"),
@@ -42141,13 +43431,13 @@ var HANDLERS = {
     render: renderNow
   }),
   landed: async ({ flags, requireClient }) => ({
-    data: await requireClient().get("/landed", {
+    data: await requireClient().get(pathOf(readOperations.landed), {
       query: { from: flagString(flags, "from"), to: flagString(flags, "to") }
     }),
     render: renderLanded
   }),
   review: async ({ flags, requireClient }) => ({
-    data: await requireClient().get("/review", {
+    data: await requireClient().get(pathOf(readOperations.review), {
       query: { from: flagString(flags, "from"), to: flagString(flags, "to") }
     }),
     render: renderReview
@@ -42461,14 +43751,14 @@ var HANDLERS = {
     if (q.length === 0)
       throw usageError('search needs text, e.g. `do search "passport"`');
     return {
-      data: await requireClient().get("/search", {
+      data: await requireClient().get(pathOf(readOperations.search), {
         query: { q, type: flagString(flags, "type"), limit: flagString(flags, "limit") }
       }),
       render: renderSearch
     };
   },
   changes: async ({ flags, requireClient }) => {
-    const text = await requireClient().getText("/changes", {
+    const text = await requireClient().getText(pathOf(changesOperations.list), {
       query: {
         since: flagString(flags, "since"),
         limit: flagString(flags, "limit"),
@@ -42480,7 +43770,7 @@ var HANDLERS = {
   "notes attached": async ({ args, requireClient }) => {
     const node = requireArg(args, 0, "node id");
     return {
-      data: await requireClient().get(`/nodes/${node}/notes`),
+      data: await requireClient().get(pathOf(nodeOperations.getNotes, { id: node })),
       render: renderAttachedNote
     };
   },
@@ -42494,7 +43784,7 @@ var HANDLERS = {
     }
     const body = parseInput(setAttachedNoteInputSchema, { body: raw });
     return {
-      data: await requireClient().put(`/nodes/${node}/notes`, body),
+      data: await requireClient().put(pathOf(nodeOperations.setNotes, { id: node }), body),
       render: renderAttachedNote
     };
   },
@@ -42524,18 +43814,18 @@ var HANDLERS = {
   "notes detach": async ({ args, flags, requireClient }) => {
     const node = requireArg(args, 0, "node id");
     assertDestructiveAllowed(flags, `detach the note from ${node}`);
-    await requireClient().delete(`/nodes/${node}/notes`);
+    await requireClient().delete(pathOf(nodeOperations.clearNotes, { id: node }));
     return { data: { ok: true, detached: node }, render: renderRecord };
   },
   "orca list": async ({ requireClient }) => ({
-    data: await requireClient().get("/orca"),
+    data: await requireClient().get(pathOf(orcaOperations.overview)),
     render: renderOrca
   }),
   "orca output": async ({ args, flags, requireClient }) => {
     const host = requireArg(args, 0, "host");
     const handle = requireArg(args, 1, "session handle");
     return {
-      data: await requireClient().get(`/orca/hosts/${encodeURIComponent(host)}/terminals/${encodeURIComponent(handle)}/output`, {
+      data: await requireClient().get(pathOf(orcaOperations.output, { host, handle }), {
         query: {
           cursor: flagString(flags, "cursor"),
           limit: flagString(flags, "limit"),
@@ -42556,7 +43846,7 @@ var HANDLERS = {
       enter: !flagBool(flags, "no-enter")
     });
     return {
-      data: await requireClient().post(`/orca/hosts/${encodeURIComponent(host)}/terminals/${encodeURIComponent(handle)}/messages`, body),
+      data: await requireClient().post(pathOf(orcaOperations.send, { host, handle }), body),
       render: renderRecord
     };
   },
@@ -42571,12 +43861,12 @@ var HANDLERS = {
       agent: flagString(flags, "agent")
     });
     return {
-      data: await requireClient().post(`/orca/hosts/${encodeURIComponent(host)}/sessions`, body),
+      data: await requireClient().post(pathOf(orcaOperations.restart, { host }), body),
       render: renderRecord
     };
   },
   "worktree-links list": async ({ flags, requireClient }) => ({
-    data: await requireClient().get("/worktree-links", {
+    data: await requireClient().get(pathOf(worktreeLinkOperations.list), {
       query: {
         host: flagString(flags, "host"),
         worktreeId: flagString(flags, "worktree"),
@@ -42588,7 +43878,7 @@ var HANDLERS = {
   "worktree-links get": async ({ args, requireClient }) => {
     const node = requireArg(args, 0, "node id");
     return {
-      data: await requireClient().get(`/worktree-links/${node}`),
+      data: await requireClient().get(pathOf(worktreeLinkOperations.get, { nodeId: node })),
       render: renderWorktreeLink
     };
   },
@@ -42606,14 +43896,14 @@ var HANDLERS = {
       branch: flagString(flags, "branch")
     });
     return {
-      data: await requireClient().put(`/worktree-links/${node}`, body),
+      data: await requireClient().put(pathOf(worktreeLinkOperations.set, { nodeId: node }), body),
       render: renderWorktreeLink
     };
   },
   "worktree-links clear": async ({ args, flags, requireClient }) => {
     const node = requireArg(args, 0, "node id");
     assertDestructiveAllowed(flags, `unlink ${node} from its worktree`);
-    await requireClient().delete(`/worktree-links/${node}`);
+    await requireClient().delete(pathOf(worktreeLinkOperations.clear, { nodeId: node }));
     return { data: { ok: true, unlinked: node }, render: renderRecord };
   },
   "files list": async ({ flags, requireClient }) => ({
@@ -43511,7 +44801,7 @@ var HANDLERS = {
     render: renderList
   }),
   "agent connection get": async ({ requireClient }) => ({
-    data: await requireClient().get("/agent/connection"),
+    data: await requireClient().get(pathOf(agentConnectionOperations.get)),
     render: renderRecord
   }),
   "agent connection set": async ({ io, flags, requireClient }) => {
@@ -43528,11 +44818,14 @@ var HANDLERS = {
       autoFile,
       apiKey: await readAgentKey(io, flags)
     });
-    return { data: await client.put("/agent/connection", body), render: renderRecord };
+    return {
+      data: await client.put(pathOf(agentConnectionOperations.save), body),
+      render: renderRecord
+    };
   },
   "agent connection remove": async ({ flags, requireClient }) => {
     assertDestructiveAllowed(flags, "remove the agent connection");
-    await requireClient().delete("/agent/connection");
+    await requireClient().delete(pathOf(agentConnectionOperations.remove));
     return { data: { ok: true, removed: "agent connection" }, render: renderRecord };
   },
   "agent post": agentPost,
@@ -43665,7 +44958,7 @@ var HANDLERS = {
     return { data: result, render: renderPresetInstall };
   },
   "collection types": async ({ requireClient }) => {
-    const types = collectionTypeSummarySchema.array().parse(await requireClient().get("/collection/types"));
+    const types = collectionTypeSummarySchema.array().parse(await requireClient().get(pathOf(collectionOperations.types)));
     return { data: types, render: renderList };
   },
   "collection list": async ({ flags, requireClient }) => {
@@ -43677,7 +44970,10 @@ var HANDLERS = {
       title: flagString(flags, "title")
     };
     applyPageFlags(query, flags);
-    return { data: await requireClient().getPage("/collection", { query }), render: renderList };
+    return {
+      data: await requireClient().getPage(pathOf(collectionOperations.list), { query }),
+      render: renderList
+    };
   },
   "collection add": async ({ args, flags, requireClient }) => {
     const { title, tags } = parseTitleTags(args);
@@ -43691,13 +44987,19 @@ var HANDLERS = {
       ...tags.length > 0 ? { tags } : {},
       ...flagString(flags, "status") ? { status: flagString(flags, "status") } : {}
     });
-    return { data: await requireClient().post("/collection", body), render: renderRecord };
+    return {
+      data: await requireClient().post(pathOf(collectionOperations.create), body),
+      render: renderRecord
+    };
   },
   "collection set-status": async ({ args, requireClient }) => {
     const id = requireArg(args, 0, "item id");
     const status = requireArg(args, 1, "status");
     const body = parseInput(updateCollectionItemInputSchema, { status });
-    return { data: await requireClient().patch(`/collection/${id}`, body), render: renderRecord };
+    return {
+      data: await requireClient().patch(pathOf(collectionOperations.update, { id }), body),
+      render: renderRecord
+    };
   },
   "collection add-entry": async ({ args, flags, io, requireClient }) => {
     const id = requireArg(args, 0, "item id");
@@ -43719,7 +45021,7 @@ var HANDLERS = {
       ...flagString(flags, "contact") ? { contactId: flagString(flags, "contact") } : {}
     });
     return {
-      data: await requireClient().post(`/collection/${id}/entries`, body),
+      data: await requireClient().post(pathOf(collectionOperations.addEntry, { id }), body),
       render: renderRecord
     };
   },
@@ -43767,7 +45069,10 @@ var HANDLERS = {
       ...flagString(flags, "note") ? { note: flagString(flags, "note") } : {},
       ...flagString(flags, "on") ? { occurredOn: flagString(flags, "on") } : {}
     });
-    return { data: await requireClient().post("/collection/log", body), render: renderRecord };
+    return {
+      data: await requireClient().post(pathOf(collectionOperations.log), body),
+      render: renderRecord
+    };
   },
   "collection edit-entry": async ({ args, flags, requireClient }) => {
     const id = requireArg(args, 0, "item id");
@@ -43782,7 +45087,7 @@ var HANDLERS = {
       ...flagString(flags, "on") ? { occurredOn: flagString(flags, "on") } : {}
     });
     return {
-      data: await requireClient().patch(`/collection/${id}/entries/${entryId}`, body),
+      data: await requireClient().patch(pathOf(collectionOperations.editEntry, { id, entryId }), body),
       render: renderRecord
     };
   },
@@ -43791,17 +45096,17 @@ var HANDLERS = {
     const url = flagString(flags, "url");
     const body = parseInput(collectionCoverInputSchema, url ? { url } : {});
     return {
-      data: await requireClient().post(`/collection/${id}/cover`, body),
+      data: await requireClient().post(pathOf(collectionOperations.cover, { id }), body),
       render: renderRecord
     };
   },
   "collection cover-candidates": async ({ args, requireClient }) => {
     const id = requireArg(args, 0, "item id");
-    const result = collectionCoverCandidatesSchema.parse(await requireClient().get(`/collection/${id}/cover/candidates`));
+    const result = collectionCoverCandidatesSchema.parse(await requireClient().get(pathOf(collectionOperations.coverCandidates, { id })));
     return { data: result, render: renderRecord };
   },
   "collection covers": async ({ requireClient }) => {
-    const result = collectionCoverBackfillResultSchema.parse(await requireClient().post("/collection/covers", undefined));
+    const result = collectionCoverBackfillResultSchema.parse(await requireClient().post(pathOf(collectionOperations.backfillCovers), undefined));
     return { data: result, render: renderRecord };
   },
   "areas purpose": async ({ args, flags, requireClient }) => {
@@ -44582,7 +45887,10 @@ var HANDLERS = {
     if (flagBool(flags, "new-session"))
       body.newSession = true;
     const input = parseInput(applyRunChangesInputSchema, body);
-    return { data: await requireClient().post(`/runs/${id}/changes`, input), render: renderRecord };
+    return {
+      data: await requireClient().post(pathOf(runOperations.applyChanges, { id }), input),
+      render: renderRecord
+    };
   },
   "runs save-header": async ({ args, flags, io, requireClient }) => {
     const id = requireArg(args, 0, "run id");
@@ -44619,7 +45927,10 @@ var HANDLERS = {
     const id = requireArg(args, 0, "run id");
     const batch = flagString(flags, "batch");
     const input = parseInput(undoRunChangesInputSchema, batch ? { batchId: batch } : {});
-    return { data: await requireClient().post(`/runs/${id}/undo`, input), render: renderRecord };
+    return {
+      data: await requireClient().post(pathOf(runOperations.undo, { id }), input),
+      render: renderRecord
+    };
   },
   "runs dex tick": async ({ args, flags, requireClient, io }) => {
     const id = requireArg(args, 0, "run id");
@@ -44643,19 +45954,22 @@ var HANDLERS = {
       ...message ? { message } : {}
     });
     return {
-      data: await requireClient().post(`/runs/${id}/checklists/${encodeURIComponent(key)}/tick`, input),
+      data: await requireClient().post(pathOf(runOperations.tickChecklist, { id, key }), input),
       render: renderRecord
     };
   },
   "runs steam status": async ({ requireClient }) => ({
-    data: await requireClient().get("/runs/steam"),
+    data: await requireClient().get(pathOf(runOperations.steamStatus)),
     render: renderRecord
   }),
   "runs steam sync": async ({ flags, requireClient }) => {
     const body = parseInput(steamSyncInputSchema, {
       ...typeof flags.game === "string" ? { gameId: flags.game } : {}
     });
-    return { data: await requireClient().post("/runs/steam/sync", body), render: renderRecord };
+    return {
+      data: await requireClient().post(pathOf(runOperations.steamSync), body),
+      render: renderRecord
+    };
   },
   "sensors status": async ({ requireClient }) => ({
     data: await requireClient().get(pathOf(sensorOperations.status)),
@@ -44707,13 +46021,16 @@ var HANDLERS = {
   },
   "runs sessions list": async ({ args, requireClient }) => {
     const id = requireArg(args, 0, "run id");
-    return { data: await requireClient().get(`/runs/${id}/sessions`), render: renderList };
+    return {
+      data: await requireClient().get(pathOf(runOperations.listSessions, { id })),
+      render: renderList
+    };
   },
   "runs sessions add": async ({ args, flags, requireClient }) => {
     const id = requireArg(args, 0, "run id");
     const input = parseInput(createRunSessionInputSchema, sessionFlags(flags));
     return {
-      data: await requireClient().post(`/runs/${id}/sessions`, input),
+      data: await requireClient().post(pathOf(runOperations.addSession, { id }), input),
       render: renderRecord
     };
   },
@@ -44722,7 +46039,7 @@ var HANDLERS = {
     const session = requireArg(args, 1, "session id");
     const input = parseInput(updateRunSessionInputSchema, sessionFlags(flags));
     return {
-      data: await requireClient().patch(`/runs/${id}/sessions/${session}`, input),
+      data: await requireClient().patch(pathOf(runOperations.updateSession, { id, sessionId: session }), input),
       render: renderRecord
     };
   },
@@ -44730,7 +46047,7 @@ var HANDLERS = {
     const id = requireArg(args, 0, "run id");
     const session = requireArg(args, 1, "session id");
     assertDestructiveAllowed(flags, `delete session ${session}`);
-    await requireClient().delete(`/runs/${id}/sessions/${session}`);
+    await requireClient().delete(pathOf(runOperations.removeSession, { id, sessionId: session }));
     return { data: { ok: true, removed: session }, render: renderRecord };
   },
   ...healthRecordHandlers(),
@@ -44807,11 +46124,11 @@ var HANDLERS = {
     render: renderRecord
   }),
   "health withings status": async ({ requireClient }) => ({
-    data: await requireClient().get("/health/withings"),
+    data: await requireClient().get(pathOf(withingsOperations.status)),
     render: renderRecord
   }),
   "health withings sync": async ({ requireClient }) => ({
-    data: await requireClient().post("/health/withings/sync", {}),
+    data: await requireClient().post(pathOf(withingsOperations.sync), {}),
     render: renderRecord
   }),
   "health google status": async ({ requireClient }) => ({
@@ -45383,20 +46700,23 @@ var HANDLERS = {
   },
   "invite create": async ({ flags, requireClient }) => {
     const body = parseInput(createInviteInputSchema, { id: ulid3(), ...readDataFlag(flags) });
-    return { data: await requireClient().post("/invites", body), render: renderRecord };
+    return {
+      data: await requireClient().post(pathOf(inviteOperations.create), body),
+      render: renderRecord
+    };
   },
   "invite list": async ({ requireClient }) => ({
-    data: await requireClient().get("/invites"),
+    data: await requireClient().get(pathOf(inviteOperations.list)),
     render: renderList
   }),
   "invite revoke": async ({ args, flags, requireClient }) => {
     const id = requireArg(args, 0, "invite id");
     assertDestructiveAllowed(flags, `revoke invite ${id}`);
-    await requireClient().delete(`/invites/${id}`);
+    await requireClient().delete(pathOf(inviteOperations.revoke, { id }));
     return { data: { ok: true, revoked: id }, render: renderRecord };
   },
   "member list": async ({ requireClient }) => ({
-    data: await requireClient().get("/members"),
+    data: await requireClient().get(pathOf(memberOperations.list)),
     render: renderList
   }),
   "member role": async ({ args, flags, requireClient }) => {
@@ -45404,12 +46724,15 @@ var HANDLERS = {
     const role = flagString(flags, "role");
     const raw = flagString(flags, "data") ? readDataFlag(flags) : role ? { role } : {};
     const body = parseInput(setMemberRoleInputSchema, raw);
-    return { data: await requireClient().patch(`/members/${id}/role`, body), render: renderRecord };
+    return {
+      data: await requireClient().patch(pathOf(memberOperations.setRole, { id }), body),
+      render: renderRecord
+    };
   },
   "member remove": async ({ args, flags, requireClient }) => {
     const id = requireArg(args, 0, "member id");
     assertDestructiveAllowed(flags, `remove member ${id}`);
-    await requireClient().delete(`/members/${id}`);
+    await requireClient().delete(pathOf(memberOperations.remove, { id }));
     return { data: { ok: true, removed: id }, render: renderRecord };
   },
   share: async ({ args, flags, requireClient }) => {
@@ -45422,19 +46745,22 @@ var HANDLERS = {
       capability: flagString(flags, "cap") ?? "view"
     });
     return {
-      data: await requireClient().post(`/sharing/nodes/${node}/grants`, body),
+      data: await requireClient().post(pathOf(sharingOperations.createGrant, { nodeId: node }), body),
       render: renderRecord
     };
   },
   "share list": async ({ args, requireClient }) => {
     const node = requireArg(args, 0, "node id");
-    return { data: await requireClient().get(`/sharing/nodes/${node}/grants`), render: renderList };
+    return {
+      data: await requireClient().get(pathOf(sharingOperations.listGrants, { nodeId: node })),
+      render: renderList
+    };
   },
   "share revoke": async ({ args, flags, requireClient }) => {
     const node = requireArg(args, 0, "node id");
     const grant = requireArg(args, 1, "grant id");
     assertDestructiveAllowed(flags, `revoke grant ${grant}`);
-    await requireClient().delete(`/sharing/nodes/${node}/grants/${grant}`);
+    await requireClient().delete(pathOf(sharingOperations.revokeGrant, { nodeId: node, grantId: grant }));
     return { data: { ok: true, revoked: grant }, render: renderRecord };
   },
   assign: async ({ args, flags, requireClient }) => {
@@ -45446,7 +46772,7 @@ var HANDLERS = {
       ...flagString(flags, "cap") ? { capability: flagString(flags, "cap") } : {}
     });
     return {
-      data: await requireClient().put(`/sharing/nodes/${node}/assignee`, body),
+      data: await requireClient().put(pathOf(sharingOperations.assign, { nodeId: node }), body),
       render: renderRecord
     };
   },
@@ -45456,17 +46782,20 @@ var HANDLERS = {
     if (body.length === 0)
       throw usageError('comment needs text, e.g. `do comment <node> "Nice!"`');
     const input = parseInput(createCommentInputSchema, { id: ulid3(), nodeId: node, body });
-    return { data: await requireClient().post("/comments", input), render: renderRecord };
+    return {
+      data: await requireClient().post(pathOf(commentOperations.create), input),
+      render: renderRecord
+    };
   },
   "comment list": async ({ args, requireClient }) => {
     const node = requireArg(args, 0, "node id");
     return {
-      data: await requireClient().get("/comments", { query: { nodeId: node } }),
+      data: await requireClient().get(pathOf(commentOperations.list), { query: { nodeId: node } }),
       render: renderList
     };
   },
   "role list": async ({ requireClient }) => ({
-    data: await requireClient().get("/roles"),
+    data: await requireClient().get(pathOf(roleOperations.list)),
     render: renderList
   }),
   "link create": async ({ args, flags, requireClient }) => {
@@ -45477,20 +46806,26 @@ var HANDLERS = {
       ...flagString(flags, "cap") ? { capability: flagString(flags, "cap") } : {},
       ...flagString(flags, "expires") ? { expiresAt: flagString(flags, "expires") } : {}
     });
-    return { data: await requireClient().post("/share-links", body), render: renderRecord };
+    return {
+      data: await requireClient().post(pathOf(shareLinkOperations.create), body),
+      render: renderRecord
+    };
   },
   "link list": async ({ args, requireClient }) => {
     const node = requireArg(args, 0, "node id");
-    return { data: await requireClient().get(`/share-links/node/${node}`), render: renderList };
+    return {
+      data: await requireClient().get(pathOf(shareLinkOperations.listForNode, { nodeId: node })),
+      render: renderList
+    };
   },
   "link revoke": async ({ args, flags, requireClient }) => {
     const id = requireArg(args, 0, "share-link id");
     assertDestructiveAllowed(flags, `revoke share-link ${id}`);
-    await requireClient().delete(`/share-links/${id}`);
+    await requireClient().delete(pathOf(shareLinkOperations.revoke, { id }));
     return { data: { ok: true, revoked: id }, render: renderRecord };
   },
   "keys list": async ({ requireClient }) => ({
-    data: await requireClient().getPage("/keys"),
+    data: await requireClient().getPage(pathOf(keyOperations.list)),
     render: renderKeys
   }),
   "keys update": async ({ args, flags, requireClient }) => {
@@ -45509,10 +46844,13 @@ var HANDLERS = {
       ...name === undefined ? {} : { name },
       ...scopes === undefined ? {} : { scopes: includePrivate ? [...scopes, "private:*"] : scopes }
     };
-    return { data: await requireClient().patch(`/keys/${id}`, body), render: renderRecord };
+    return {
+      data: await requireClient().patch(pathOf(keyOperations.update, { id }), body),
+      render: renderRecord
+    };
   },
   whoami: async ({ requireClient }) => ({
-    data: await requireClient().get("/whoami"),
+    data: await requireClient().get(pathOf(whoamiOperations.whoami)),
     render: renderWhoami
   }),
   login: async ({ io, config, requireClient }) => {