@robbeverhelst/do 1.332.0 → 1.333.0

package/dist/do.js

@@ -14410,7 +14410,7 @@ var configError = (message) => new CliError("config", message, EXIT.CONFIG);
 
 // src/meta.ts
 var CLI_NAME = "do";
-var VERSION = "1.332.0";
+var VERSION = "1.333.0";
 var API_PREFIX = "/api/v1";
 var DEFAULT_API_URL = "http://localhost:3001";
 
@@ -18355,6 +18355,7 @@ var userSettings = pgTable("user_settings", {
   foodDiaryMode: boolean4("food_diary_mode").notNull().default(false),
   calendarZoom: integer2("calendar_zoom"),
   lifeBlockSharing: jsonb("life_block_sharing").$type(),
+  recentSearches: jsonb("recent_searches").$type().notNull().default([]),
   createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
   updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
 }, (t) => [unique("user_settings_tenant_user_uniq").on(t.tenantId, t.userId)]);
@@ -19955,9 +19956,29 @@ var animalLostCards = pgTable("animal_lost_cards", {
   phone: text("phone"),
   showChipped: boolean4("show_chipped").notNull().default(false),
   note: text("note"),
+  description: text("description"),
+  answersTo: text("answers_to"),
+  missingSince: timestamp("missing_since", { withTimezone: true }),
+  missingWhere: text("missing_where"),
   createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
   updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
 }, (t) => [index("animal_lost_cards_tenant_idx").on(t.tenantId)]);
+var animalLostReportFrom = pgEnum("animal_lost_report_from", ["owner", "finder"]);
+var animalLostReports = pgTable("animal_lost_reports", {
+  id: text("id").primaryKey(),
+  tenantId: text("tenant_id").notNull().references(() => tenants.id),
+  animalId: text("animal_id").notNull().references(() => animals.id, { onDelete: "cascade" }),
+  from: animalLostReportFrom("from").notNull(),
+  at: timestamp("at", { withTimezone: true }).notNull(),
+  title: text("title"),
+  note: text("note"),
+  place: text("place"),
+  lat: doublePrecision("lat"),
+  lng: doublePrecision("lng"),
+  phone: text("phone"),
+  photoFileId: text("photo_file_id"),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (t) => [index("animal_lost_reports_animal_idx").on(t.tenantId, t.animalId, t.at)]);
 var animalHandoverLinks = pgTable("animal_handover_links", {
   id: text("id").primaryKey(),
   tenantId: text("tenant_id").notNull().references(() => tenants.id),
@@ -20769,22 +20790,72 @@ var animalSitterNoteInputSchema = object({
   body: string2().trim().max(1000).default("")
 }).strict();
 var animalSitterPhoneSchema = object({ phone: string2() });
+var lostCardPhoneSchema = string2().trim().regex(/^\+?[0-9][0-9 ()./-]{4,30}$/, "A phone number: digits, spaces, + ( ) . / -");
 var animalLostCardInputSchema = object({
   photoFileId: ulidSchema.nullish(),
-  phone: string2().trim().regex(/^\+?[0-9][0-9 ()./-]{4,30}$/, "A phone number: digits, spaces, + ( ) . / -").nullish(),
+  phone: lostCardPhoneSchema.nullish(),
   showChipped: boolean2().optional(),
-  note: string2().trim().min(1).max(200).nullish()
+  note: string2().trim().min(1).max(200).nullish(),
+  description: string2().trim().min(1).max(400).nullish(),
+  answersTo: string2().trim().min(1).max(120).nullish(),
+  missingSince: exports_coerce.date().nullish(),
+  missingWhere: string2().trim().min(1).max(200).nullish()
 }).strict();
 var animalLostCardPhotoSchema = object({ id: ulidSchema, name: string2() });
+var animalLostUpdateSchema = object({
+  id: ulidSchema,
+  at: exports_coerce.date(),
+  title: string2(),
+  note: string2().nullable(),
+  place: string2().nullable()
+});
 var animalLostCardPublicSchema = object({
   name: string2(),
   speciesKey: string2().nullable(),
   kind: string2().nullable(),
   missing: boolean2(),
   hasPhoto: boolean2(),
-  phone: string2().nullable(),
+  phoneMasked: string2().nullable(),
   chipped: boolean2(),
-  note: string2().nullable()
+  note: string2().nullable(),
+  description: string2().nullable(),
+  answersTo: string2().nullable(),
+  missingSince: exports_coerce.date().nullable(),
+  missingWhere: string2().nullable(),
+  pronoun: _enum2(["he", "she", "they"]),
+  sharedBy: string2().nullable(),
+  owners: array(string2()),
+  vet: string2().nullable(),
+  updates: array(animalLostUpdateSchema)
+});
+var animalLostCardCallSchema = object({ phone: string2() });
+var blankless = (v) => typeof v === "string" && v.trim() === "" ? undefined : v;
+var animalLostFoundInputSchema = object({
+  where: string2().trim().min(1).max(300),
+  lat: preprocess(blankless, exports_coerce.number().min(-90).max(90).optional()),
+  lng: preprocess(blankless, exports_coerce.number().min(-180).max(180).optional()),
+  phone: preprocess(blankless, lostCardPhoneSchema.optional())
+}).strict().refine((v) => v.lat === undefined === (v.lng === undefined), {
+  message: "Send both lat and lng, or neither."
+});
+var animalLostFoundSentSchema = object({ to: array(string2()) });
+var animalLostUpdateInputSchema = object({
+  at: exports_coerce.date(),
+  title: string2().trim().min(1).max(120),
+  note: string2().trim().min(1).max(200).nullish(),
+  place: string2().trim().min(1).max(200).nullish()
+}).strict();
+var animalLostReportSchema = object({
+  id: ulidSchema,
+  from: _enum2(["owner", "finder"]),
+  at: exports_coerce.date(),
+  title: string2().nullable(),
+  note: string2().nullable(),
+  place: string2().nullable(),
+  lat: number2().nullable(),
+  lng: number2().nullable(),
+  phone: string2().nullable(),
+  photoFileId: ulidSchema.nullable()
 });
 var animalLostCardStateSchema = object({
   card: object({
@@ -20793,7 +20864,12 @@ var animalLostCardStateSchema = object({
     phone: string2().nullable(),
     showChipped: boolean2(),
     note: string2().nullable(),
+    description: string2().nullable(),
+    answersTo: string2().nullable(),
+    missingSince: exports_coerce.date().nullable(),
+    missingWhere: string2().nullable(),
     since: exports_coerce.date(),
+    reports: array(animalLostReportSchema),
     preview: animalLostCardPublicSchema
   }).nullable(),
   photos: array(animalLostCardPhotoSchema),
@@ -21044,7 +21120,7 @@ var animalOperations = defineOperations({
     scopes: READ,
     tag: "Animals",
     summary: "An animal's lost-pet card",
-    description: "`card` is null while it's off; else its `path` (`/lost/<token>`, the page its QR code opens, no account), what it shows (`photoFileId`, `phone`, `showChipped`, `note`) and `preview`, the finder's page. `photos` are the pictures on the animal it may show; `chipOnFile` whether it can say chipped.",
+    description: "`card` is null while it's off; else its `path` (`/lost/<token>`, the page its QR code opens, no account), what it shows (`photoFileId`, `phone`, `showChipped`, `note`, `description`, `answersTo`, `missingSince`, `missingWhere`), `reports` (the household's updates and finders' reports, with a finder's number) and `preview`, the finder's page (its number masked). `photos` are the pictures on the animal it may show; `chipOnFile` whether it can say chipped.",
     status: 200,
     response: { description: "The card's state." },
     errors: { 404: true }
@@ -21736,6 +21812,8 @@ var taskOwnerSchema = actorRefSchema.extend({ desk: string2().nullable() });
 var taskFilingSuggestionSchema = object({
   areaId: ulidSchema.nullable(),
   area: string2().nullable(),
+  projectId: ulidSchema.nullable().default(null),
+  project: string2().nullable().default(null),
   owner: taskOwnerSchema.nullable(),
   scheduledAt: exports_coerce.date().nullable(),
   by: actorRefSchema
@@ -23146,6 +23224,8 @@ var moneyBankPendingSchema = object({
   pendingId: ulidSchema,
   bank: string2(),
   consentValidUntil: exports_coerce.date(),
+  createdAt: exports_coerce.date(),
+  expiresAt: exports_coerce.date(),
   accounts: array(object({
     index: number2().int().min(0),
     name: string2().nullable(),
@@ -23181,6 +23261,33 @@ var moneyBankSyncResultSchema = object({
     error: true
   }).extend({ accountTitle: string2() }))
 });
+var moneyDedupeInputSchema = object({ accountId: ulidSchema, commit: boolean2().optional() }).strict();
+var moneyDedupePairSchema = object({
+  keepId: string2(),
+  twinId: string2(),
+  bookedOn: string2(),
+  twinBookedOn: string2(),
+  amount: string2(),
+  description: string2().nullable(),
+  counterpartyName: string2().nullable(),
+  ambiguous: boolean2()
+});
+var moneyDedupeChangesSchema = object({
+  merged: number2().int(),
+  links: number2().int(),
+  splits: number2().int(),
+  settlements: number2().int(),
+  transfers: number2().int(),
+  rules: number2().int(),
+  notes: number2().int()
+});
+var moneyDedupeResultSchema = object({
+  accountId: string2(),
+  committed: boolean2(),
+  pairs: array(moneyDedupePairSchema),
+  counts: object({ pairs: number2().int(), ambiguous: number2().int() }),
+  changed: moneyDedupeChangesSchema
+});
 
 // ../../packages/schema/src/operations/bank-link.ts
 var CONNECT = ["connections:write"];
@@ -23263,6 +23370,18 @@ var bankLinkOperations = defineOperations({
     response: { description: "The bank accounts to map." },
     errors: { 400: true, 403: true, 409: true }
   },
+  pendings: {
+    method: "get",
+    path: "/money/bank-link/pending",
+    scopes: CONNECT,
+    afterScopes: AFTER,
+    tag: "Money",
+    summary: "List the bank links waiting to be mapped",
+    description: "Every authorisation the key's member brought back from a bank and hasn't mapped yet, newest first, while it lasts (a day): each as the pending answers it, with `createdAt` and `expiresAt`. For when the page that finished it is gone; map one with link.",
+    status: 200,
+    response: { description: "The bank links waiting to be mapped." },
+    errors: { 403: true }
+  },
   pending: {
     method: "get",
     path: "/money/bank-link/pending/{id}",
@@ -25085,7 +25204,8 @@ var moneyAccountSchema = createSelectSchema(moneyAccounts, {
 });
 var moneyAccountViewSchema = moneyAccountSchema.omit({ ibanHash: true }).extend({
   title: string2(),
-  visibility: _enum2(NODE_VISIBILITY_VALUES)
+  visibility: _enum2(NODE_VISIBILITY_VALUES),
+  balanceKnown: boolean2()
 });
 var moneyCategorySchema = createSelectSchema(moneyCategories, {
   archivedAt: exports_coerce.date().nullable(),
@@ -25145,7 +25265,14 @@ var createMoneyAccountInputSchema = object({
   includeInNetWorth: boolean2().optional(),
   visibility: _enum2(NODE_VISIBILITY_VALUES).optional()
 }).strict();
-var updateMoneyAccountInputSchema = createMoneyAccountInputSchema.omit({ id: true, currency: true }).partial().strict();
+var moneyBalanceAtSchema = union([keyDateDaySchema, exports_iso.datetime({ offset: true })]);
+var updateMoneyAccountInputSchema = createMoneyAccountInputSchema.omit({ id: true, currency: true }).partial().extend({
+  balance: moneyAmountSchema.optional(),
+  balanceAt: moneyBalanceAtSchema.optional()
+}).strict().refine((u) => u.balance === undefined === (u.balanceAt === undefined), {
+  message: "a balance and the day it's from go together",
+  path: ["balanceAt"]
+});
 var createMoneyCategoryInputSchema = object({
   id: ulidSchema,
   name: string2().trim().min(1).max(60),
@@ -25240,8 +25367,13 @@ var moneyTransactionPageSchema = object({
 var MONEY_IMPORT_MAX_BYTES = 5 * 1024 * 1024;
 var moneyImportFieldsSchema = object({
   accountId: ulidSchema,
-  since: keyDateDaySchema.optional()
-}).strict();
+  since: keyDateDaySchema.optional(),
+  balance: moneyAmountSchema.optional(),
+  balanceAt: moneyBalanceAtSchema.optional()
+}).strict().refine((f) => f.balance === undefined === (f.balanceAt === undefined), {
+  message: "a balance and the day it's from go together",
+  path: ["balanceAt"]
+});
 var moneyImportOutcomeSchema = _enum2([
   "new",
   "duplicate",
@@ -26945,6 +27077,8 @@ var healthShares = pgTable("health_shares", {
   episodeId: text("episode_id"),
   sections: text("sections").array().notNull().default(sql`'{}'::text[]`),
   snapshot: jsonb("snapshot").notNull(),
+  note: text("note"),
+  attachments: jsonb("attachments").notNull().default(sql`'[]'::jsonb`),
   tokenHash: text("token_hash").notNull().unique(),
   expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
   revokedAt: timestamp("revoked_at", { withTimezone: true }),
@@ -32057,6 +32191,98 @@ var keyOperations = defineOperations({
   }
 });
 
+// ../../packages/schema/src/contracts/money-kraken.ts
+var KRAKEN_SECRET = /^[A-Za-z0-9+/]+={0,2}$/;
+var moneyKrakenKeyInputSchema = object({
+  apiKey: string2().trim().min(16).max(200).regex(/^\S+$/, "The API key has no spaces."),
+  apiSecret: string2().trim().min(40).max(200).regex(KRAKEN_SECRET, { message: "Paste the private key as Kraken shows it (base64)." }),
+  accountId: ulidSchema.optional()
+}).strict();
+var moneyHoldingSchema = object({
+  asset: string2(),
+  amount: string2(),
+  priceEur: string2().nullable(),
+  valueEur: string2().nullable(),
+  share: number2().nullable()
+});
+var moneyHoldingsSchema = object({
+  accountId: ulidSchema,
+  at: exports_coerce.date(),
+  totalEur: string2(),
+  dustEur: string2(),
+  holdings: array(moneyHoldingSchema)
+});
+var moneyAccountHoldingsSchema = object({ holdings: moneyHoldingsSchema.nullable() });
+var moneyKrakenLinkStatusSchema = object({
+  configured: boolean2(),
+  link: object({
+    id: ulidSchema,
+    accountId: ulidSchema,
+    accountTitle: string2(),
+    status: _enum2(moneyConnectionStatus.enumValues),
+    lastSyncAt: exports_coerce.date().nullable(),
+    lastError: string2().nullable()
+  }).nullable(),
+  holdings: moneyHoldingsSchema.nullable()
+});
+
+// ../../packages/schema/src/operations/kraken-link.ts
+var CONNECT2 = ["connections:write"];
+var AFTER2 = "`*` and `private:*` never grant `connections:write`: a key holds it by name, and a guest's key never does.";
+var krakenLinkOperations = defineOperations({
+  status: {
+    method: "get",
+    path: "/money/kraken-link",
+    scopes: CONNECT2,
+    afterScopes: AFTER2,
+    tag: "Money",
+    summary: "Get the Kraken link",
+    description: "Whether the key's member has a Kraken key set (`configured`), the investment account it feeds with how its last sync went (`link`: `status` `active` or `failing`, `lastSyncAt`, `lastError`), and the `holdings` that sync saw: per asset its `amount`, EUR `priceEur` and `valueEur` and `share`, with `totalEur` and `at`; holdings worth under \u20AC0.50 are left out of the list (`dustEur` sums them), never out of the total. The key is never returned.",
+    status: 200,
+    response: { description: "The Kraken link." },
+    errors: { 403: true }
+  },
+  set: {
+    method: "put",
+    path: "/money/kraken-link",
+    scopes: CONNECT2,
+    afterScopes: AFTER2,
+    tag: "Money",
+    summary: "Set the Kraken key",
+    description: "Keep the key's member's Kraken `apiKey` and `apiSecret` (the private key), sealed, then sync. Make the key at Kraken with only Query Funds ticked. The key is checked, never echoed: it must read the balance and must not see open orders (a key that can may do more than read, and is refused); the answer is the link, without it. `accountId` picks the investment account it feeds; left out, the link keeps its account, or a first set makes one named Kraken. 400 for a key Kraken refuses, a key that isn't read-only, or an account that isn't an EUR investment account.",
+    body: moneyKrakenKeyInputSchema,
+    status: 200,
+    response: { description: "The Kraken link, without the key." },
+    errors: { 400: true, 403: true, 404: true, 503: true },
+    throttle: "strict",
+    mcp: false
+  },
+  sync: {
+    method: "post",
+    path: "/money/kraken-link/sync",
+    scopes: CONNECT2,
+    afterScopes: AFTER2,
+    tag: "Money",
+    summary: "Sync Kraken now",
+    description: "Read the holdings from Kraken now, value them in EUR and set the account's balance, as the daily sync does. A failure keeps the last holdings and marks the link `failing` with its reason. Answers the link. 400 before a key is set.",
+    status: 200,
+    response: { description: "The Kraken link after the sync." },
+    errors: { 400: true, 403: true }
+  },
+  remove: {
+    method: "delete",
+    path: "/money/kraken-link",
+    scopes: CONNECT2,
+    afterScopes: AFTER2,
+    tag: "Money",
+    summary: "Remove the Kraken link",
+    description: "Forget the key's member's Kraken key and stop syncing. The account stays, with its last balance and holdings.",
+    status: 200,
+    response: { description: "The Kraken link, not configured." },
+    errors: { 403: true }
+  }
+});
+
 // ../../packages/schema/src/db/mail.ts
 var mailCampaignStatus = pgEnum("mail_campaign_status", [
   "draft",
@@ -32602,6 +32828,13 @@ var moneyNetWorthAccountSchema = object({
   source: moneySnapshotSourceSchema,
   month: moneyMonthSchema
 });
+var moneyNetWorthUnknownSchema = moneyNetWorthAccountSchema.pick({
+  accountId: true,
+  title: true,
+  kind: true,
+  visibility: true,
+  currency: true
+});
 var moneyNetWorthSchema = object({
   scope: moneyBudgetScopeSchema,
   month: moneyMonthSchema,
@@ -32609,7 +32842,9 @@ var moneyNetWorthSchema = object({
   have: amount5,
   owe: amount5,
   points: array(moneyNetWorthPointSchema),
-  accounts: array(moneyNetWorthAccountSchema)
+  accounts: array(moneyNetWorthAccountSchema),
+  complete: boolean2(),
+  unknown: array(moneyNetWorthUnknownSchema)
 });
 var setMoneyNetWorthValueInputSchema = object({
   accountId: ulidSchema,
@@ -32791,7 +33026,7 @@ var moneyOperations = defineOperations({
     scopes: ["finance:write"],
     tag: "Money",
     summary: "Import a statement",
-    description: "Book a statement's new lines as unreviewed transactions (the same upload as the preview). Re-importing a file, or an overlapping one, books nothing twice. An account without an IBAN takes the file's; the newest line's balance becomes the account's.",
+    description: "Book a statement's new lines as unreviewed transactions (the same upload as the preview). Re-importing a file, or an overlapping one, books nothing twice. An account without an IBAN takes the file's; the newest line's balance becomes the account's. For a bank whose export has no running balance, `balance` + `balanceAt` (a day, read as its end, or a moment; together, never a day ahead) state what the account holds and anchor it there, as an account update does; a preview ignores them.",
     body: moneyImportFieldsSchema,
     multipart: STATEMENT,
     status: 201,
@@ -32838,7 +33073,7 @@ var moneyOperations = defineOperations({
     scopes: ["finance:write"],
     tag: "Money",
     summary: "Sync bank connections now",
-    description: "Sync every live bank link the key may see, or with `accountId` the one feeding that account, the way the daily run does: booked transactions go through the CSV import's pipeline (the bank's entry id, else the CSV row of the same day, amount and counterparty or reference, is matched instead of booked twice), the rules and transfer matching run, and the balance is updated. Per link: outcome (ok \xB7 failed), fetched, imported, matched, duplicates and the error in plain words. An account is the household's (`visibility: space`) or \"Only me\" (`owner`, the default for a new one); another member never sees an Only me account or anything on it.",
+    description: "Sync every live bank link the key may see, or with `accountId` the one feeding that account, the way the daily run does: booked transactions go through the CSV import's pipeline (the bank's entry id, else the CSV row of the same amount booked within a day \u2014 the most alike when several fit \u2014 is matched: it adopts the bank's entry id instead of the row being booked twice), the rules and transfer matching run, and the balance is updated. Per link: outcome (ok \xB7 failed), fetched, imported, matched, duplicates and the error in plain words. An account is the household's (`visibility: space`) or \"Only me\" (`owner`, the default for a new one); another member never sees an Only me account or anything on it.",
     body: moneyBankSyncInputSchema,
     status: 200,
     response: { description: "What each sync did." },
@@ -32860,6 +33095,18 @@ var moneyOperations = defineOperations({
     response: { description: "The sync log." },
     errors: { 404: `No such account or transaction, or it is another member's "Only me" one.` }
   },
+  dedupe: {
+    method: "post",
+    path: "/money/dedupe",
+    scopes: ["finance:write"],
+    tag: "Money",
+    summary: "Fold a bank link's twins into the statement's rows",
+    description: "Find, on one `accountId`, the movements booked twice: a statement import's row (no bank entry id) and a bank link's row (with one), paired by the bank sync's own rule \u2014 the same amount, booked a day apart at most, the most alike when several fit (counterparty IBAN, structured reference, name, then the words), never one row twice. A preview by default: the pairs (`keepId` the statement's row, `twinId` the bank's, their days, amount, description) and their counts, writing nothing. With `commit: true` each pair is folded: the statement's row keeps its category, review status, notes, links, splits and transfer, takes the bank's entry id and the details it lacked; whatever pointed at the twin (links, splits, settlements, its transfer peer, a rule made from it, its note) moves to the kept row, and the twin is deleted. `changed` counts what moved. A pair marked `ambiguous` (another row fit just as well) is listed but never committed. Running it again changes nothing.",
+    body: moneyDedupeInputSchema,
+    status: 200,
+    response: { description: "The pairs, their counts and what changed." },
+    errors: { 400: true, 404: NO_ACCOUNT }
+  },
   getAccount: {
     method: "get",
     path: "/money/accounts/{id}",
@@ -32879,7 +33126,7 @@ var moneyOperations = defineOperations({
     scopes: ["finance:write"],
     tag: "Money",
     summary: "Update a money account",
-    description: "Rename it, change its kind, IBAN, opening balance, what it counts towards, or who sees it.",
+    description: "Rename it, change its kind, IBAN, opening balance, what it counts towards, or who sees it. `balance` with `balanceAt` (a day, read as its end, or a moment) states what it held then: the anchor net worth counts from, back and forward through the ledger, for a bank whose export has no running balance. The two go together; a day ahead, or an account a bank link keeps, is a 400.",
     pathParams: { id: "The account's ULID." },
     pathParamSchemas: { id: ulidSchema },
     body: updateMoneyAccountInputSchema,
@@ -33399,7 +33646,7 @@ var moneyOperations = defineOperations({
     scopes: ["finance:read"],
     tag: "Money",
     summary: "Get net worth and its monthly line",
-    description: "Net worth for the accounts that count in it (`includeInNetWorth`): `total`, `have` and `owe` this month, `points` (one per month, oldest first, the current month last; `total` null before any account had a value) and `accounts` (biggest first, each with its `value`, `source` \u2014 balance, ledger or manual \u2014 and the `month` that value is from). A loan or a credit card always counts as owed. This month follows each account's balance; the months before an account was first read are worked back from its ledger; a value set by hand carries on until the next one. `scope`: `all` (default), `space` or `owner`; `months` 2\u201360 (12 by default).",
+    description: "Net worth for the accounts that count in it (`includeInNetWorth`): `total`, `have` and `owe` this month, `points` (one per month, oldest first, the current month last; `total` null before any account had a value) and `accounts` (biggest first, each with its `value`, `source` \u2014 balance, ledger or manual \u2014 and the `month` that value is from). A loan or a credit card always counts as owed. This month follows each account's balance, carried forward by what was booked after `balanceAt`; the months before an account was first read are worked back from its ledger; a value set by hand carries on until the next one. An account whose ledger came from a bank but has no balance yet (an export with no running balance) is never counted as 0: it is listed under `unknown` and left out of the total, and `complete` is false. `scope`: `all` (default), `space` or `owner`; `months` 2\u201360 (12 by default).",
     query: [
       { name: "scope", description: "all, space or owner." },
       { name: "months", description: "How many months the line covers (2\u201360, default 12)." }
@@ -39215,7 +39462,7 @@ var STATUS_MARK = {
 };
 function suggestionText(s) {
   const parts = [
-    s.area,
+    [s.area, s.project].filter(Boolean).join(" \u203A ") || null,
     s.owner ? `owner ${ownerText(s.owner)}` : null,
     s.scheduledAt ? shortDate(s.scheduledAt) : null
   ].filter(Boolean);
@@ -42682,12 +42929,18 @@ var CONNECTION_COMMAND_SPECS = [
   },
   {
     path: ["money", "bank-link", "pending"],
-    summary: "A bank authorisation waiting to be mapped: its bank accounts and the suggestions.",
-    args: [{ name: "id", required: true, description: "The pendingId from `complete`." }],
+    summary: "The bank authorisations waiting to be mapped, or one by its id: bank accounts and suggestions.",
+    args: [
+      {
+        name: "id",
+        required: false,
+        description: "The pendingId from `complete`; without it, every one still waiting."
+      }
+    ],
     flags: [],
     scopes: scopesOf(bankLinkOperations.pending),
-    returns: "MoneyBankPending",
-    notes: `${routeOf(bankLinkOperations.pending)}.`
+    returns: "MoneyBankPending (one) or MoneyBankPending[] (all)",
+    notes: `${routeOf(bankLinkOperations.pending)}; without an id ${routeOf(bankLinkOperations.pendings)}, newest first, each with createdAt and expiresAt (a day after). Finds an authorisation whose browser tab is gone, before it runs out.`
   },
   {
     path: ["money", "bank-link", "link"],
@@ -42705,6 +42958,53 @@ var CONNECTION_COMMAND_SPECS = [
     returns: "MoneyConnectionView[]",
     notes: `${routeOf(bankLinkOperations.link)}. Each do account is fed by one bank account.`
   },
+  {
+    path: ["money", "kraken-link", "status"],
+    summary: "Your Kraken link: the account it feeds, how its last sync went, and the holdings it saw.",
+    args: [],
+    flags: [],
+    scopes: scopesOf(krakenLinkOperations.status),
+    returns: "MoneyKrakenLinkStatus",
+    notes: `${routeOf(krakenLinkOperations.status)}. The key is never returned.`
+  },
+  {
+    path: ["money", "kraken-link", "set"],
+    summary: "Give do your read-only Kraken API key, read from a file, and sync.",
+    args: [],
+    flags: [
+      {
+        name: "key-file",
+        type: "string",
+        description: "Path to a file holding the API key and its private key (two lines, or JSON with apiKey and apiSecret), or - to read it from stdin."
+      },
+      {
+        name: "account",
+        type: "string",
+        description: "The EUR investment account it feeds. Left out: the link's account, or a new one named Kraken."
+      }
+    ],
+    scopes: scopesOf(krakenLinkOperations.set),
+    returns: "MoneyKrakenLinkStatus",
+    notes: `${routeOf(krakenLinkOperations.set)}. Make the key at Kraken with only Query Funds ticked: a key that can see open orders is refused. The key and secret are read from the file and sealed; they are never a flag, never printed and never read back. A new Kraken account is "Only me", so making it needs finance:write on the key too (or pass --account). Replaces a key set before.`
+  },
+  {
+    path: ["money", "kraken-link", "sync"],
+    summary: "Read your Kraken holdings now and update the account's balance.",
+    args: [],
+    flags: [],
+    scopes: scopesOf(krakenLinkOperations.sync),
+    returns: "MoneyKrakenLinkStatus",
+    notes: `${routeOf(krakenLinkOperations.sync)}. A failure keeps the last holdings and shows on the link as failing, with its reason.`
+  },
+  {
+    path: ["money", "kraken-link", "remove"],
+    summary: "Forget your Kraken key. The account keeps its last balance and holdings.",
+    args: [],
+    flags: [DESTRUCTIVE],
+    scopes: scopesOf(krakenLinkOperations.remove),
+    returns: "MoneyKrakenLinkStatus",
+    notes: `${routeOf(krakenLinkOperations.remove)}. Gated behind --allow-destructive.`
+  },
   {
     path: ["doccle", "connect"],
     summary: "Give do your Doccle login so the nightly import can run. do checks it with Doccle first and keeps it sealed.",
@@ -42811,8 +43111,14 @@ var CONNECTION_HANDLERS = {
   },
   "money bank-link pending": async ({ args, requireClient }) => {
     const id = args[0];
-    if (!id)
-      throw usageError("money bank-link pending needs the pendingId");
+    if (!id) {
+      return {
+        data: await guarded([], () => requireClient().get(pathOf(bankLinkOperations.pendings))),
+        render: (data, mode) => Array.isArray(data) ? data.length === 0 ? "No bank links waiting to be mapped." : data.map((p) => renderPending(p, mode)).join(`
+
+`) : renderRecord(data, mode)
+      };
+    }
     return {
       data: await guarded([], () => requireClient().get(pathOf(bankLinkOperations.pending, { id }))),
       render: renderPending
@@ -42827,6 +43133,32 @@ var CONNECTION_HANDLERS = {
 `) || "Linked."
     };
   },
+  "money kraken-link status": async ({ requireClient }) => ({
+    data: await guarded([], () => requireClient().get(pathOf(krakenLinkOperations.status))),
+    render: renderKraken
+  }),
+  "money kraken-link set": async ({ io, flags, requireClient }) => {
+    refuseSecretFlags(flags, ["key", "api-key", "secret", "api-secret", "private-key"], "--key-file <path>");
+    const text = await readSecret(io, flags, "key-file", "the Kraken key", "all");
+    const { apiKey, apiSecret } = parseKrakenKey(text);
+    const account = flagString(flags, "account")?.trim();
+    const body = { apiKey, apiSecret, ...account ? { accountId: account } : {} };
+    return {
+      data: await guarded([apiKey, apiSecret], () => requireClient().put(pathOf(krakenLinkOperations.set), body)),
+      render: renderKraken
+    };
+  },
+  "money kraken-link sync": async ({ requireClient }) => ({
+    data: await guarded([], () => requireClient().post(pathOf(krakenLinkOperations.sync), {})),
+    render: renderKraken
+  }),
+  "money kraken-link remove": async ({ flags, requireClient }) => {
+    assertDestructive(flags, "forget the Kraken key");
+    return {
+      data: await guarded([], () => requireClient().delete(pathOf(krakenLinkOperations.remove))),
+      render: renderKraken
+    };
+  },
   "doccle connect": (ctx) => connectDoccle(ctx),
   "steam link": async ({ io, flags, requireClient }) => {
     refuseSecretFlags(flags, ["key", "steam-key", "web-api-key"], "--key-file <path>");
@@ -43003,7 +43335,8 @@ function renderPending(data, mode) {
   const p = data;
   if (!Array.isArray(p?.accounts))
     return renderRecord(data, mode);
-  const lines = [`${p.bank ?? "Bank"} \xB7 pending ${p.pendingId}`];
+  const until = p.expiresAt ? ` \xB7 map before ${p.expiresAt}` : "";
+  const lines = [`${p.bank ?? "Bank"} \xB7 pending ${p.pendingId}${until}`];
   for (const a of p.accounts) {
     const label = [a.name, a.ibanMasked].filter(Boolean).join(" ") || "account";
     const hint = a.suggestedAccountId ? ` \u2192 ${a.suggestedAccountId}` : "";
@@ -43012,6 +43345,48 @@ function renderPending(data, mode) {
   return lines.join(`
 `);
 }
+function parseKrakenKey(text) {
+  const hint = "the key file should hold the API key and its private key: two lines, or JSON with apiKey and apiSecret";
+  if (text.startsWith("{")) {
+    let parsed;
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      throw usageError(hint);
+    }
+    const o = parsed ?? {};
+    const apiKey = o.apiKey ?? o.key;
+    const apiSecret = o.apiSecret ?? o.secret ?? o.privateKey;
+    if (typeof apiKey !== "string" || typeof apiSecret !== "string")
+      throw usageError(hint);
+    return { apiKey: apiKey.trim(), apiSecret: apiSecret.trim() };
+  }
+  const lines = text.split(/\r?\n/).map((l) => l.trim()).filter((l) => l.length > 0);
+  if (lines.length !== 2)
+    throw usageError(hint);
+  return { apiKey: lines[0], apiSecret: lines[1] };
+}
+function renderKraken(data, mode) {
+  const k = data;
+  if (typeof k?.configured !== "boolean")
+    return renderRecord(data, mode);
+  if (!k.link)
+    return k.configured ? "Kraken key set, not linked yet." : "No Kraken key set.";
+  const synced = k.link.lastSyncAt ? ` \xB7 synced ${k.link.lastSyncAt}` : " \xB7 not synced yet";
+  const lines = [`Kraken \u2192 ${k.link.accountTitle} \xB7 ${k.link.status}${synced}`];
+  if (k.link.lastError)
+    lines.push(`  ${k.link.lastError}`);
+  if (k.holdings) {
+    lines.push(`Holdings at ${k.holdings.at} \xB7 \u20AC ${k.holdings.totalEur}`);
+    for (const h of k.holdings.holdings) {
+      const value = h.valueEur === null ? "no EUR price" : `\u20AC ${h.valueEur}`;
+      const share = h.share === null ? "" : ` \xB7 ${(h.share * 100).toFixed(1)}%`;
+      lines.push(`  ${h.asset.padEnd(6)} ${h.amount}  ${value}${share}`);
+    }
+  }
+  return lines.join(`
+`);
+}
 var commands10 = pairCommands(CONNECTION_COMMAND_SPECS, CONNECTION_HANDLERS);
 
 // src/commands/contacts.ts
@@ -47811,6 +48186,14 @@ var commands30 = [
 // src/commands/money.ts
 import { readFileSync as readFileSync8 } from "fs";
 import { basename as basename5 } from "path";
+function renderDedupe(data) {
+  const r = data;
+  const lines = r.pairs.map((p) => `${p.bookedOn}  ${p.amount.padStart(10)}  ${p.description ?? p.counterpartyName ?? ""}  keep ${p.keepId}  twin ${p.twinId} (${p.twinBookedOn})${p.ambiguous ? "  ambiguous: sort by hand" : ""}`);
+  const c = r.changed;
+  lines.push(`${r.counts.pairs} pairs, ${r.counts.ambiguous} ambiguous`, r.committed ? `merged ${c.merged} \xB7 links ${c.links} \xB7 splits ${c.splits} \xB7 settlements ${c.settlements} \xB7 transfers ${c.transfers} \xB7 rules ${c.rules} \xB7 notes ${c.notes}` : "preview: nothing changed (--commit folds the unambiguous pairs)");
+  return lines.join(`
+`);
+}
 function partyFlag(flags) {
   const userId = flagString(flags, "with-user");
   const contactId = flagString(flags, "with-contact");
@@ -47871,13 +48254,34 @@ var commands31 = [
   defineCommand({
     operation: moneyOperations.updateAccount,
     path: ["money", "account-update"],
-    summary: "Edit a money account.",
+    summary: "Edit a money account, or state its balance (for an export with no balance column).",
     args: [{ name: "id", required: true, description: "Account ULID." }],
-    flags: [{ name: "data", type: "string", description: "UpdateMoneyAccountInput JSON." }],
+    flags: [
+      { name: "data", type: "string", description: "UpdateMoneyAccountInput JSON." },
+      {
+        name: "balance",
+        type: "string",
+        description: "What the account holds, e.g. 1234.56 (sets balance)."
+      },
+      {
+        name: "balance-at",
+        type: "string",
+        description: "The day (YYYY-MM-DD, its end) or moment that balance is from (default today)."
+      }
+    ],
     returns: "MoneyAccountView",
-    run: async ({ args, flags, requireClient }) => {
+    notes: ". `--balance 1234.56 --balance-at 2026-10-27` anchors an account whose bank export has no running balance (ING's): net worth counts from it, back and forward through the ledger. A negative one rides as `--balance=-20`. A day ahead is refused, and so is an account a bank link keeps. `--data` takes the rest (title, kind, iban, includeInNetWorth, \u2026).",
+    run: async ({ args, flags, io, requireClient }) => {
       const id = requireArg(args, 0, "account id");
-      const body = parseInput(updateMoneyAccountInputSchema, readDataFlag(flags));
+      const balance = flagString(flags, "balance");
+      const balanceAt = flagString(flags, "balance-at");
+      if (balanceAt !== undefined && balance === undefined) {
+        throw usageError("--balance-at goes with --balance");
+      }
+      const body = parseInput(updateMoneyAccountInputSchema, {
+        ...readDataFlag(flags),
+        ...balance !== undefined ? { balance, balanceAt: balanceAt ?? isoDay(io.now()) } : {}
+      });
       return {
         data: await requireClient().patch(pathOf(moneyOperations.updateAccount, { id }), body),
         render: renderRecord
@@ -47930,6 +48334,32 @@ var commands31 = [
       };
     }
   }),
+  defineCommand({
+    operation: moneyOperations.dedupe,
+    path: ["money", "dedupe"],
+    summary: "Find movements booked twice on an account (a statement's row and a bank link's twin); --commit folds them.",
+    args: [],
+    flags: [
+      { name: "account", type: "string", description: "The account ULID (required)." },
+      {
+        name: "commit",
+        type: "boolean",
+        description: "Fold the pairs; without it, a preview that writes nothing."
+      }
+    ],
+    returns: "MoneyDedupeResult",
+    notes: ". Pairs by the bank sync's rule: same amount, booked a day apart at most, the most alike when several fit. A commit keeps the statement's row (category, review status, notes, links, splits, transfer), gives it the bank's entry id, moves what pointed at the twin onto it and deletes the twin. An `ambiguous` pair is never committed. Running it twice changes nothing the second time.",
+    run: async ({ flags, requireClient }) => {
+      const body = parseInput(moneyDedupeInputSchema, {
+        accountId: requireFlag(flags, "account", "say which account: --account <id>"),
+        ...flagBool(flags, "commit") ? { commit: true } : {}
+      });
+      return {
+        data: await requireClient().post(pathOf(moneyOperations.dedupe), body),
+        render: renderDedupe
+      };
+    }
+  }),
   defineCommand({
     operation: moneyOperations.listConnectionSyncs,
     path: ["money", "connection-syncs"],
@@ -47990,9 +48420,9 @@ var commands31 = [
       { name: "cursor", type: "string", description: "The previous page's nextCursor." }
     ],
     returns: "{ data: MoneyTransactionView[], nextCursor }",
-    notes: ". Amounts are signed decimal strings. `--business` keeps rows with a business share; `--business-status` and `--tax-tag` narrow further.",
+    notes: ". Amounts are signed decimal strings. `--business` keeps rows with a business share; `--business-status` and `--tax-tag` narrow further. A page is 100 rows at most: while `nextCursor` isn't null, pass it back as `--cursor` for the next.",
     run: async ({ flags, requireClient }) => ({
-      data: await requireClient().get(pathOf(moneyOperations.listTransactions), {
+      data: await requireClient().getPage(pathOf(moneyOperations.listTransactions), {
         query: {
           accountId: flagString(flags, "account"),
           status: flagString(flags, "status"),
@@ -48456,12 +48886,22 @@ var commands31 = [
     flags: [
       { name: "account", type: "string", description: "The account's ULID." },
       { name: "since", type: "string", description: "First day to take (default 2025-01-01)." },
-      { name: "commit", type: "boolean", description: "Book the new lines (else a preview)." }
+      { name: "commit", type: "boolean", description: "Book the new lines (else a preview)." },
+      {
+        name: "balance",
+        type: "string",
+        description: "What the account holds, for an export with no balance column (anchors it with --commit)."
+      },
+      {
+        name: "balance-at",
+        type: "string",
+        description: "The day (YYYY-MM-DD, its end) or moment --balance is from (default today)."
+      }
     ],
     scopes: [...moneyOperations.previewImport.scopes, ...moneyOperations.commitImport.scopes],
     returns: "MoneyImportPreview | MoneyImportResult",
-    notes: `${routeOf(moneyOperations.previewImport)}, or ${routeOf(moneyOperations.commitImport)} with --commit (\`money_import_file\`). A KBC Touch export reads as is (\`;\`, comma decimals, UTF-8 or Windows-1252), and so does a CODA file. Each line is new, duplicate, before_window, other_account or other_currency; a line at exactly 0,00 (nothing moved, e.g. ING's empty SEPA lines) is left out and listed under \`skipped\`, counted as \`counts.nothing_moved\`, never a problem; re-importing books nothing twice. On a credit_card account the file is the card's statement: its CSV export (KBC's credit card CSV reads as is; a transaction cost is its own row) or the statement PDF's text (\`cardStatement\` says which, the total and the debit day); paying it off is a transfer, never spending twice.`,
-    run: async ({ args, flags, requireClient }) => {
+    notes: `${routeOf(moneyOperations.previewImport)}, or ${routeOf(moneyOperations.commitImport)} with --commit (\`money_import_file\`). A KBC Touch export reads as is (\`;\`, comma decimals, UTF-8 or Windows-1252), and so does a CODA file. Each line is new, duplicate, before_window, other_account or other_currency; a line at exactly 0,00 (nothing moved, e.g. ING's empty SEPA lines) is left out and listed under \`skipped\`, counted as \`counts.nothing_moved\`, never a problem; re-importing books nothing twice. On a credit_card account the file is the card's statement: its CSV export (KBC's credit card CSV reads as is; a transaction cost is its own row) or the statement PDF's text (\`cardStatement\` says which, the total and the debit day); paying it off is a transfer, never spending twice. A bank whose export has no running balance (ING's) leaves the account's balance unknown: \`--balance 1234.56 [--balance-at YYYY-MM-DD]\` with --commit states it, as \`do money account-update --balance\` does (a preview ignores it).`,
+    run: async ({ args, flags, io, requireClient }) => {
       const path = requireArg(args, 0, "path to the statement CSV");
       const account = requireFlag(flags, "account", "money import needs --account <account id>");
       let bytes;
@@ -48475,6 +48915,19 @@ var commands31 = [
       const since = flagString(flags, "since");
       if (since !== undefined)
         form.append("since", since);
+      const balance = flagString(flags, "balance");
+      const balanceAt = flagString(flags, "balance-at");
+      if (balanceAt !== undefined && balance === undefined) {
+        throw usageError("--balance-at goes with --balance");
+      }
+      if (balance !== undefined) {
+        const anchor = parseInput(updateMoneyAccountInputSchema, {
+          balance,
+          balanceAt: balanceAt ?? isoDay(io.now())
+        });
+        form.append("balance", anchor.balance);
+        form.append("balanceAt", anchor.balanceAt);
+      }
       const name = basename5(path);
       form.append("file", new File([Uint8Array.from(bytes)], name, { type: "text/csv" }), name);
       const op = flagBool(flags, "commit") ? moneyOperations.commitImport : moneyOperations.previewImport;
@@ -48623,7 +49076,7 @@ var commands31 = [
       }
     ],
     returns: "MoneyNetWorth",
-    notes: ". total, have and owe this month; points per month (oldest first, total null before any value); accounts biggest first with value, source (balance \xB7 ledger \xB7 manual) and the month it's from. A loan or a card always counts as owed.",
+    notes: ". total, have and owe this month; points per month (oldest first, total null before any value); accounts biggest first with value, source (balance \xB7 ledger \xB7 manual) and the month it's from. A loan or a card always counts as owed. `complete: false` when an account counts but its balance isn't known (a bank export with no running balance): it's listed under `unknown`, left out of the total, never counted as 0; `do money account-update <id> --balance \u2026 --balance-at \u2026` states it.",
     run: async ({ flags, requireClient }) => ({
       data: await requireClient().get(pathOf(moneyOperations.netWorthRead), {
         query: { scope: flagString(flags, "scope"), months: flagString(flags, "months") }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@robbeverhelst/do",
-  "version": "1.332.0",
+  "version": "1.333.0",
   "private": false,
   "description": "do — the agent-drivable CLI over the public /api/v1 surface",
   "homepage": "https://github.com/robbeverhelst/do/tree/main/apps/cli",