@robbeverhelst/do 1.311.7 → 1.312.0

package/dist/do.js

@@ -29059,14 +29059,16 @@ var API_KEY_SCOPE_VALUES = [
   "finance:read",
   "finance:write",
   "people:family-tree",
+  "connections:write",
   "private:*",
   "*"
 ];
 var FULL_ACCESS_SCOPE = "*";
+var CONNECTIONS_WRITE_SCOPE = "connections:write";
 function scopeGranted(granted, required) {
   if (granted.includes(required))
     return true;
-  if (required === PRIVATE_ACCESS_SCOPE)
+  if (required === PRIVATE_ACCESS_SCOPE || required === CONNECTIONS_WRITE_SCOPE)
     return false;
   if (isSensitiveScope(required))
     return granted.includes(PRIVATE_ACCESS_SCOPE);
@@ -31734,6 +31736,18 @@ var googleHealthOperations = defineOperations({
     status: 200,
     response: { description: "What came in, and the status after it." },
     errors: { 403: true, 409: true }
+  },
+  connect: {
+    method: "post",
+    path: "/health/google-health/connect",
+    scopes: ["connections:write"],
+    afterScopes: "`*` and `private:*` never grant `connections:write`: a key holds it by name, and a guest's key never does.",
+    tag: "Health",
+    summary: "Connect Google Health",
+    description: "As the key's member, start connecting Google Health (replacing a link they had): answers the consent `authorizationUrl` for the member to open in a browser. Once they agree, Google sends them back to do and the link is theirs, as if they had connected in the app (Settings \u2192 Health). 403 while the server has Google Health off.",
+    status: 200,
+    response: { description: "The consent URL." },
+    errors: { 403: true }
   }
 });
 
@@ -34055,9 +34069,36 @@ var runOperations = defineOperations({
     scopes: READ4,
     tag: "Runs",
     summary: "Get the Steam achievements link",
-    description: "Whether the key's member has linked Steam (from Settings in the app; the Steam ID and Web API key are never returned), how many games carry a `steamAppId` and `lastSyncedAt`, the newest sync on a run. 403 for a key no member minted.",
+    description: "Whether the key's member has linked Steam (in Settings, or with a key that holds `connections:write`; the Steam ID and Web API key are never returned), how many games carry a `steamAppId` and `lastSyncedAt`, the newest sync on a run. 403 for a key no member minted.",
+    status: 200,
+    response: { description: "The link's status." },
+    errors: { 403: true }
+  },
+  steamLink: {
+    method: "put",
+    path: "/runs/steam",
+    scopes: ["connections:write"],
+    afterScopes: "`*` and `private:*` never grant `connections:write`: a key holds it by name, and a guest's key never does.",
+    tag: "Runs",
+    summary: "Link Steam",
+    description: "Link (or replace) the key's member's Steam account: `{ steamId, apiKey }` (the 17-digit SteamID64 and a Steam Web API key), sealed and never read back. Answers the link's status, as the status route does.",
+    body: steamAccountInputSchema,
     status: 200,
     response: { description: "The link's status." },
+    errors: { 400: true, 403: true },
+    throttle: "strict",
+    mcp: false
+  },
+  steamUnlink: {
+    method: "delete",
+    path: "/runs/steam",
+    scopes: ["connections:write"],
+    afterScopes: "`*` and `private:*` never grant `connections:write`: a key holds it by name, and a guest's key never does.",
+    tag: "Runs",
+    summary: "Unlink Steam",
+    description: "Forget the key's member's Steam account. The runs keep what was synced.",
+    status: 204,
+    response: { description: "Unlinked." },
     errors: { 403: true }
   },
   steamSync: {
@@ -35034,6 +35075,18 @@ var withingsOperations = defineOperations({
     status: 200,
     response: { description: "What came in, and the status after it." },
     errors: { 403: true, 409: true }
+  },
+  connect: {
+    method: "post",
+    path: "/health/withings/connect",
+    scopes: ["connections:write"],
+    afterScopes: "`*` and `private:*` never grant `connections:write`: a key holds it by name, and a guest's key never does.",
+    tag: "Health",
+    summary: "Connect Withings",
+    description: "As the key's member, start connecting Withings (replacing a link they had): answers the consent `authorizationUrl` for the member to open in a browser. Once they agree, Withings sends them back to do and the link is theirs, as if they had connected in the app (Settings \u2192 Health). 403 while the server has Withings off.",
+    status: 200,
+    response: { description: "The consent URL." },
+    errors: { 403: true }
   }
 });
 
@@ -35354,7 +35407,7 @@ function parseCapture2(input, now) {
 
 // src/meta.ts
 var CLI_NAME = "do";
-var VERSION = "1.311.7";
+var VERSION = "1.312.0";
 var API_PREFIX = "/api/v1";
 var DEFAULT_API_URL = "http://localhost:3001";
 
@@ -38182,9 +38235,9 @@ var COMMAND_SPECS = [
         description: "Read the password from the first line of stdin (else DO_DOCCLE_PASSWORD)."
       }
     ],
-    scopes: ["documents:write"],
+    scopes: ["connections:write"],
     returns: "DoccleStatus",
-    notes: "PUT /api/v1/documents/doccle/login. The password is never a flag (shell history): pipe it in with --password-stdin or set DO_DOCCLE_PASSWORD. 422 when Doccle refuses the login or asks for a captcha (nothing is kept), 503 when Doccle is down. The login is never returned."
+    notes: "PUT /api/v1/documents/doccle/login. Needs a key with the opt-in connections:write (held by name: Full access never grants it, and a guest's key never holds it). The password is never a flag (shell history): pipe it in with --password-stdin or set DO_DOCCLE_PASSWORD. 422 when Doccle refuses the login or asks for a captcha (nothing is kept), 503 when Doccle is down. The login is never returned."
   },
   {
     path: ["documents", "doccle", "disconnect"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@robbeverhelst/do",
-  "version": "1.311.7",
+  "version": "1.312.0",
   "private": false,
   "description": "do — the agent-drivable CLI over the public /api/v1 surface",
   "homepage": "https://github.com/robbeverhelst/do/tree/main/apps/cli",