@wirecat/cli-core 0.342.0 → 0.344.0

package/dist/replies/template.d.ts

@@ -35,4 +35,3 @@ export interface TemplateInput {
     limits?: Partial<typeof TEMPLATE_LIMITS>;
 }
 export declare const renderReplyTemplate: (reply: ReplyRule["reply"], input: TemplateInput) => Promise<TemplateResult>;
-//# sourceMappingURL=template.d.ts.map

package/dist/replies/template.js

@@ -164,4 +164,3 @@ export const renderReplyTemplate = async (reply, input) => {
         return { text: null, warnings, blocks, reason: "reply template is invalid or exceeds its rendering limits" };
     }
 };
-//# sourceMappingURL=template.js.map

package/dist/resolve.d.ts

@@ -19,4 +19,3 @@ export declare const pickChat: (reference: string, chats: Chat[]) => Chat;
  * `lower()` folds ASCII only, and most of these names are Cyrillic.
  */
 export declare const pickPerson: (reference: string, people: PeopleLookup) => Contact;
-//# sourceMappingURL=resolve.d.ts.map

package/dist/resolve.js

@@ -44,4 +44,3 @@ const ambiguous = (reference, what, candidates, label) => {
     return new CliError("validation_error", `"${singleLine(reference)}" matches ${candidates.length} ${what} — name one by its id:\n${lines}`, { candidates });
 };
 const isPresent = (value) => value !== null && value !== undefined;
-//# sourceMappingURL=resolve.js.map

package/dist/runs/events.d.ts

@@ -58,4 +58,3 @@ export declare const providerErrorKey: (value: unknown) => string | undefined;
  * ```
  */
 export declare const renderEvent: (event: DiagnosticEvent) => string;
-//# sourceMappingURL=events.d.ts.map

package/dist/runs/events.js

@@ -49,4 +49,3 @@ export const renderEvent = (event) => {
 const MARK = { request: "→", response: "←", cache: "•", warning: "!" };
 const age = (ms) => (ms < 1000 ? `${ms}ms` : `${Math.round(ms / 1000)}s`);
 const size = (bytes) => (bytes < 1000 ? `${bytes} B` : `${(bytes / 1000).toFixed(1)} kB`);
-//# sourceMappingURL=events.js.map

package/dist/runs/log-attributes.d.ts

@@ -5,4 +5,3 @@
 export declare const LOG_ATTRIBUTES: readonly string[];
 /** For `cli-dev lint --schemas`, under the name `log_attributes`. */
 export declare const logAttributesSchema: () => Record<string, unknown>;
-//# sourceMappingURL=log-attributes.d.ts.map

package/dist/runs/log-attributes.js

@@ -70,4 +70,3 @@ export const LOG_ATTRIBUTES = [
 ].sort();
 /** For `cli-dev lint --schemas`, under the name `log_attributes`. */
 export const logAttributesSchema = () => logAttributesJsonSchema(LOG_ATTRIBUTES);
-//# sourceMappingURL=log-attributes.js.map

package/dist/runs/log-events.d.ts

@@ -7,4 +7,3 @@ export declare const CORE_LOG_EVENTS: {
 }[];
 /** An adapter's event names stay short in memory; the log writes them as registered ids. */
 export declare const DIAGNOSTIC_LOG_EVENTS: Record<DiagnosticEvent["event"], string>;
-//# sourceMappingURL=log-events.d.ts.map

package/dist/runs/log-events.js

@@ -28,4 +28,3 @@ export const DIAGNOSTIC_LOG_EVENTS = {
     warning: "client.warning",
     cache: "cache.answered",
 };
-//# sourceMappingURL=log-events.js.map

package/dist/runs/log-keys.d.ts

@@ -11,4 +11,3 @@ export declare const logAttributes: (event: object) => Record<string, unknown>;
 export declare const fromLogAttributes: (attributes: object) => Record<string, unknown>;
 /** A logger that writes every event's keys in snake_case. */
 export declare const snakeLogger: (logger: Logger) => Logger;
-//# sourceMappingURL=log-keys.d.ts.map

package/dist/runs/log-keys.js

@@ -18,4 +18,3 @@ export const snakeLogger = (logger) => ({
     warn: (event, message) => logger.warn(logAttributes(event), message),
     error: (event, message) => logger.error(logAttributes(event), message),
 });
-//# sourceMappingURL=log-keys.js.map

package/dist/runs/record-log.d.ts

@@ -5,4 +5,3 @@ export declare const recordLogFor: (to: string | ((line: string) => void), app:
     traceId?: string;
     command?: string;
 }) => Logger;
-//# sourceMappingURL=record-log.d.ts.map

package/dist/runs/record-log.js

@@ -15,4 +15,3 @@ export const recordLogFor = (to, app, { traceId, command } = {}) => {
         allow: LOG_ATTRIBUTES,
     }));
 };
-//# sourceMappingURL=record-log.js.map

package/dist/runs/recording.d.ts

@@ -51,4 +51,3 @@ export declare const crashOf: (error: unknown) => {
     frames: string[];
 };
 export declare const partialOutcome: (answer: unknown) => import("./run.js").RunMetadata["partial"];
-//# sourceMappingURL=recording.d.ts.map

package/dist/runs/recording.js

@@ -160,4 +160,3 @@ export const partialOutcome = (answer) => {
         return { failed: 1, failures: [{ id: body.chat ?? "history", stage: "history", errorCode: body.issue.code }] };
     return undefined;
 };
-//# sourceMappingURL=recording.js.map

package/dist/runs/run.d.ts

@@ -122,4 +122,3 @@ export declare const pruneRuns: (runsDir: string, { keepDays, now }: {
     keepDays: number;
     now: Date;
 }) => number;
-//# sourceMappingURL=run.d.ts.map

package/dist/runs/run.js

@@ -277,4 +277,3 @@ const metadataOf = (parsed) => {
         },
     };
 };
-//# sourceMappingURL=run.js.map

package/dist/runs/scope.d.ts

@@ -32,4 +32,3 @@ export declare const childTrace: () => {
     traceId: string;
     traceparent: string;
 };
-//# sourceMappingURL=scope.d.ts.map

package/dist/runs/scope.js

@@ -45,4 +45,3 @@ export const childTrace = () => {
     const traceId = hex(16);
     return { traceId, traceparent: `00-${traceId}-${hex(8)}-01` };
 };
-//# sourceMappingURL=scope.js.map

package/dist/sealed.d.ts

@@ -36,4 +36,3 @@ export declare const seal: (open: () => Readable, to: string, password: string,
  * damaged file leaves nothing half-written behind.
  */
 export declare const unsealFile: (from: string, to: string, password: string) => Promise<void>;
-//# sourceMappingURL=sealed.d.ts.map

package/dist/sealed.js

@@ -137,4 +137,3 @@ export const unsealFile = async (from, to, password) => {
     }
     renameSync(pending, to);
 };
-//# sourceMappingURL=sealed.js.map

package/dist/search/account-list.d.ts

@@ -55,4 +55,3 @@ export declare const fitting: (entries: readonly ListedEntry[], kinds: readonly
     accounts: AccountKey[];
     skipped: SkippedSource[];
 };
-//# sourceMappingURL=account-list.d.ts.map

package/dist/search/account-list.js

@@ -185,4 +185,3 @@ export const fitting = (entries, kinds, what, reasonOf = (kind) => READS[kind])
         fail(`--source names nothing ${what} reads: ${skipped.map(({ source, reason }) => `${source} (${reason})`).join(", ")}`);
     return { accounts: [...chosen.values()], skipped };
 };
-//# sourceMappingURL=account-list.js.map

package/dist/search/correct.d.ts

@@ -22,4 +22,3 @@ export declare const editDistance: (a: string, b: string, max: number) => number
  * with no close neighbour, or made of digits, is left as it is.
  */
 export declare const correctWords: (vocabulary: Vocabulary, words: string[]) => Promise<Map<string, string[]>>;
-//# sourceMappingURL=correct.d.ts.map

package/dist/search/correct.js

@@ -62,4 +62,3 @@ export const correctWords = async (vocabulary, words) => {
     }
     return corrections;
 };
-//# sourceMappingURL=correct.js.map

package/dist/search/lucene/automaton.d.ts

@@ -14,4 +14,3 @@ export declare const wildcardPattern: (value: string) => string;
  * that folded vocabulary. Operators, predefined classes and the case of `\D` `\W` `\S` stay as written.
  */
 export declare const foldRegex: (pattern: string, span: Span) => string;
-//# sourceMappingURL=automaton.d.ts.map

package/dist/search/lucene/automaton.js

@@ -408,4 +408,3 @@ export const foldRegex = (pattern, span) => {
     }
     return out;
 };
-//# sourceMappingURL=automaton.js.map

package/dist/search/lucene/presets.d.ts

@@ -3,4 +3,3 @@ export declare const PRESETS: Record<string, {
     explanation: string;
     candidate: (body: string, attachments: readonly string[]) => boolean;
 }>;
-//# sourceMappingURL=presets.d.ts.map

package/dist/search/lucene/presets.js

@@ -50,4 +50,3 @@ export const PRESETS = {
         candidate: (s, a) => a.includes("location") || /\bgeo:-?\d{1,2}(?:\.\d{1,8})?,-?\d{1,3}(?:\.\d{1,8})?\b/u.test(s),
     },
 };
-//# sourceMappingURL=presets.js.map

package/dist/search/lucene/registry.d.ts

@@ -78,4 +78,3 @@ export declare const QUERY_OPERATORS: readonly [{
     readonly example: "invoice^2";
     readonly semantics: "query.unsupported-operator";
 }];
-//# sourceMappingURL=registry.d.ts.map

package/dist/search/lucene/registry.js

@@ -505,4 +505,3 @@ export const QUERY_OPERATORS = [
     },
     { name: "boost / minimum / intervals", example: "invoice^2", semantics: "query.unsupported-operator" },
 ];
-//# sourceMappingURL=registry.js.map

package/dist/search/lucene/resolved.d.ts

@@ -58,4 +58,3 @@ export declare const hasText: (node: QueryNode) => boolean;
 /** A leaf that reads the stems: `text` terms and phrases. Patterns never stem. */
 export declare const isStemmed: (node: Predicate) => boolean;
 export declare const hasStems: (node: QueryNode) => boolean;
-//# sourceMappingURL=resolved.d.ts.map

package/dist/search/lucene/resolved.js

@@ -5,4 +5,3 @@ export const hasText = (node) => node.kind === "predicate"
 /** A leaf that reads the stems: `text` terms and phrases. Patterns never stem. */
 export const isStemmed = (node) => node.field === "text" && (node.operator === "term" || node.operator === "phrase") && node.value !== "";
 export const hasStems = (node) => node.kind === "predicate" ? isStemmed(node) : node.clauses.some(({ node }) => hasStems(node));
-//# sourceMappingURL=resolved.js.map

package/dist/search/lucene/types.d.ts

@@ -15,4 +15,3 @@ export declare const QUERY_LIMITS: {
 export declare const SEARCH_QUERY: QueryContext;
 export declare function searchError(reason: string, span: Span, alternative?: string): never;
 export declare function exhausted(budget: string): never;
-//# sourceMappingURL=types.d.ts.map

package/dist/search/lucene/types.js

@@ -25,4 +25,3 @@ export function exhausted(budget) {
         complete: false,
     });
 }
-//# sourceMappingURL=types.js.map

package/dist/search/query.d.ts

@@ -10,4 +10,3 @@ export declare const inSource: (source: Source, provider: Provider) => boolean;
  * (`tg`), or the kind `messages` or `mail`; an alias and `mail` come back as the provider they stand for.
  */
 export declare const sourceOf: (name: string, value: string, providers: readonly Provider[]) => Source;
-//# sourceMappingURL=query.d.ts.map

package/dist/search/query.js

@@ -33,4 +33,3 @@ export const sourceOf = (name, value, providers) => {
         return named.name;
     return fail(`${name} takes ${[...sources, "messages", "mail"].join(", ")} — not "${value}"`);
 };
-//# sourceMappingURL=query.js.map

package/dist/search/question-plan.d.ts

@@ -9,4 +9,3 @@ export declare function planQuestion(text: string, strict?: boolean): {
     removed: string[];
     aliases: string[];
 };
-//# sourceMappingURL=question-plan.d.ts.map

package/dist/search/question-plan.js

@@ -118,4 +118,3 @@ export function planQuestion(text, strict = false) {
     const queries = [...new Set([render(terms), render(alias)])].slice(0, 2);
     return { changed: true, natural: true, queries, scope, terms, rankingTerms: original, removed, aliases: changes };
 }
-//# sourceMappingURL=question-plan.js.map

package/dist/search/stem.d.ts

@@ -55,4 +55,3 @@ export type Stemmer = {
 export declare const createStemmer: (stemmers?: Stemmers, { cacheLimit }?: {
     cacheLimit?: number;
 }) => Stemmer;
-//# sourceMappingURL=stem.d.ts.map

package/dist/search/stem.js

@@ -137,4 +137,3 @@ export const createStemmer = (stemmers = DEFAULT_STEMMERS, { cacheLimit = STEM_C
         }),
     };
 };
-//# sourceMappingURL=stem.js.map

package/dist/search/task-signature.d.ts

@@ -16,4 +16,3 @@ export declare const dayOf: (ms: number) => number;
  * the task was created; `null` when the text names none. The text is expected normalized (lower case, no diacritics).
  */
 export declare const dueDayOf: (text: string, createdMs: number) => number | null;
-//# sourceMappingURL=task-signature.d.ts.map

package/dist/search/task-signature.js

@@ -128,4 +128,3 @@ export const dueDayOf = (text, createdMs) => {
         }
     return best?.day ?? null;
 };
-//# sourceMappingURL=task-signature.js.map

package/dist/search/task-similarity.d.ts

@@ -184,4 +184,3 @@ export declare const rankCandidates: <Id>(views: readonly PreparedTask[], candid
     id: Id;
 })[];
 export {};
-//# sourceMappingURL=task-similarity.d.ts.map

package/dist/search/task-similarity.js

@@ -199,4 +199,3 @@ export const rankCandidates = (views, candidates) => candidates
     ...compareViews(subjectViews ?? views, candidate, replyChain === undefined ? {} : { replyChain }),
 }))
     .sort((a, b) => b.score - a.score);
-//# sourceMappingURL=task-similarity.js.map

package/dist/search/trigrams.d.ts

@@ -4,4 +4,3 @@
  * pieces with the right word.
  */
 export declare const trigrams: (term: string) => string[];
-//# sourceMappingURL=trigrams.d.ts.map

package/dist/search/trigrams.js

@@ -10,4 +10,3 @@ export const trigrams = (term) => {
         pieces.add(padded.slice(at, at + 3));
     return [...pieces];
 };
-//# sourceMappingURL=trigrams.js.map

package/dist/sends/buttons.d.ts

@@ -36,4 +36,3 @@ export declare const guardedApp: (guard: SendGuard, connection: MessengerAdapter
     chatId: Id;
     url: string;
 }>>;
-//# sourceMappingURL=buttons.d.ts.map

package/dist/sends/buttons.js

@@ -62,4 +62,3 @@ export const guardedApp = async (guard, connection, { chat, startParam }) => {
     const { url } = await guardedWrite(guard, { operationId, chatId, kind: "reaction", key: "chats.app" }, () => app(chatId, startParam === undefined ? {} : { startParam }));
     return { operationId, chatId, url };
 };
-//# sourceMappingURL=buttons.js.map

package/dist/sends/file-lock.d.ts

@@ -12,4 +12,3 @@ export declare const withFileLock: <T>(path: string, what: string, body: () => T
  * synchronously, so nothing else interleaves while the lock is held.
  */
 export declare const withFileLockAsync: <T>(path: string, what: string, body: () => T, waitMs?: number, sleep?: SleepLike) => Promise<T>;
-//# sourceMappingURL=file-lock.d.ts.map

package/dist/sends/file-lock.js

@@ -79,4 +79,3 @@ const lockTime = (lock) => {
         return Date.now();
     }
 };
-//# sourceMappingURL=file-lock.js.map

package/dist/sends/flood.d.ts

@@ -58,4 +58,3 @@ export declare class FloodMemory {
     /** Forgets every wait and lifts the hold, and answers with what was still in force. */
     clear(): FloodState;
 }
-//# sourceMappingURL=flood.d.ts.map

package/dist/sends/flood.js

@@ -99,4 +99,3 @@ export class FloodMemory {
         renameSync(temporary, this.path);
     }
 }
-//# sourceMappingURL=flood.js.map

package/dist/sends/guard.d.ts

@@ -1,3 +1,4 @@
+import { CliError } from "@wirecat/cli-base";
 import type { Id } from "../domain/models.js";
 import { type AppIdentity } from "../ports/app.js";
 import { FloodMemory } from "./flood.js";
@@ -68,6 +69,15 @@ export interface SendGuardOptions {
     warn: (message: string) => void;
     now?: () => Date;
 }
+/** A write the profile's level refuses, worded alike by the guard and by the check before connecting. */
+export declare const levelRefusal: (refused: {
+    profile: string;
+    command: string;
+    key: PermissionKey;
+    level: Level;
+    named: PermissionKey | null | undefined;
+    permissionSources: Readonly<Record<PermissionKey, string>>;
+}, fix?: string) => CliError;
 /**
  * These stop a model that was talked into sending by a message it read. They do **not** stop an
  * agent that edits the configuration itself — that needs a boundary outside this process
@@ -94,4 +104,3 @@ export declare const guardFor: (app: AppIdentity, settings: GuardSettings, warn:
 export declare const sharedJournal: (guard: SendGuard, wire: {
     readonly journals: boolean;
 } | undefined) => SendGuard;
-//# sourceMappingURL=guard.d.ts.map

package/dist/sends/guard.js

@@ -1,6 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { CliError } from "@wirecat/cli-base";
-import { readOnlyRefusal } from "../ports/app.js";
+import { MESSENGER_CHANGE_REFUSAL, readOnlyRefusal } from "../ports/app.js";
 import { FloodMemory, floodPathFor, holdEnd } from "./flood.js";
 import { SendJournal, sendsPathFor, } from "./journal.js";
 import { keyForWrite, levelFor, skipFlagFor } from "./permissions.js";
@@ -50,6 +50,9 @@ const weightOf = ({ kind, action, count, people }) => kind === "delete"
         : 1;
 /** A scheduled message counts in the hour the provider sends it. */
 const timeOf = (entry) => Date.parse(entry.scheduledFor ?? entry.at);
+/** A write the profile's level refuses, worded alike by the guard and by the check before connecting. */
+export const levelRefusal = (refused, fix = `${refused.command} ${refused.profile} config set permissions.${refused.key} allow`) => new CliError("permission_error", `profile ${refused.profile} does not let ${refused.key} write (permissions.${refused.named} is ${refused.level}, ` +
+    `from the ${refused.permissionSources[refused.named ?? ""] ?? "default"}); to allow it: ${fix}`, { permission: refused.key });
 /**
  * These stop a model that was talked into sending by a message it read. They do **not** stop an
  * agent that edits the configuration itself — that needs a boundary outside this process
@@ -61,7 +64,7 @@ export const sendGuard = ({ profile, recipients, command = recipients.command, r
     const answered = new WeakSet();
     const refuseReadOnly = () => {
         if (readOnlyLock)
-            throw readOnlyRefusal(readOnlyLock, "send, react, change chats or change the account");
+            throw readOnlyRefusal(readOnlyLock, MESSENGER_CHANGE_REFUSAL);
     };
     // Every write, counted or not: a reaction or a read receipt sent through a ban is what makes the ban stick.
     const refuseHeld = ({ key }) => {
@@ -81,11 +84,8 @@ export const sendGuard = ({ profile, recipients, command = recipients.command, r
         if (levels !== undefined) {
             const key = request.key ?? keyForWrite(kind, action);
             const { level, key: named } = levelFor(levels, key, permissionDefaults);
-            if (level === "deny" || level === "readonly") {
-                const fix = permissionFix?.(request, key) ?? `${command} ${profile} config set permissions.${key} allow`;
-                throw new CliError("permission_error", `profile ${profile} does not let ${key} write (permissions.${named} is ${level}, from the ` +
-                    `${permissionSources[named ?? ""] ?? "default"}); to allow it: ${fix}`, { permission: key });
-            }
+            if (level === "deny" || level === "readonly")
+                throw levelRefusal({ profile, command, key, level, named, permissionSources }, permissionFix?.(request, key));
             if (level === "ask" && !answered.has(request)) {
                 throw new CliError("confirmation_required", `${key} asks before it acts, and it was not asked`);
             }
@@ -271,4 +271,3 @@ export const sharedJournal = (guard, wire) => wire
     : guard;
 /** `EACCES`, `ENOSPC` — the file system's code, not its sentence, which names the path and can quote more. */
 const journalFailure = (error) => error?.code ?? (error instanceof Error ? error.name : "error");
-//# sourceMappingURL=guard.js.map

package/dist/sends/guarded.d.ts

@@ -37,4 +37,3 @@ export declare const currentOperation: () => string | undefined;
 export declare const guardedWrite: <T>(guard: SendGuard, attempt: Attempt, act: () => Promise<T>, settled?: (done: T) => Partial<Attempt>, prepare?: () => Promise<void>) => Promise<T>;
 export declare const codeOf: (error: unknown) => string;
 export {};
-//# sourceMappingURL=guarded.d.ts.map

package/dist/sends/guarded.js

@@ -117,4 +117,3 @@ export const guardedWrite = async (guard, attempt, act, settled = () => ({}), pr
     }
 };
 export const codeOf = (error) => typeof error?.code === "string" ? error.code : "unknown";
-//# sourceMappingURL=guarded.js.map

package/dist/sends/index.d.ts

@@ -7,4 +7,3 @@ export { assertStatsPermissionsCurrent, DEFAULT_PERMISSIONS, keyForCommand, keyF
 export { type Recipient, RecipientList, recipientsPathFor } from "./recipients.js";
 export { newOperationId, newSendId } from "./send-id.js";
 export { MAX_BUFFERED_UPLOAD_BYTES, readUpload, refusedPlace, uploadBlob, uploadBytes, uploadSize, } from "./upload.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/sends/index.js

@@ -6,4 +6,3 @@ export { assertStatsPermissionsCurrent, DEFAULT_PERMISSIONS, keyForCommand, keyF
 export { RecipientList, recipientsPathFor } from "./recipients.js";
 export { newOperationId, newSendId } from "./send-id.js";
 export { MAX_BUFFERED_UPLOAD_BYTES, readUpload, refusedPlace, uploadBlob, uploadBytes, uploadSize, } from "./upload.js";
-//# sourceMappingURL=index.js.map

package/dist/sends/journal.d.ts

@@ -90,4 +90,3 @@ export declare class SendJournal {
      */
     entries(): SendEntry[];
 }
-//# sourceMappingURL=journal.d.ts.map

package/dist/sends/journal.js

@@ -98,4 +98,3 @@ const withSendId = (entry) => {
     const { cid, ...rest } = entry;
     return cid === undefined || rest.sendId !== undefined ? rest : { ...rest, sendId: String(cid) };
 };
-//# sourceMappingURL=journal.js.map

package/dist/sends/pace.d.ts

@@ -30,4 +30,3 @@ export declare class Pacer {
     private read;
     private write;
 }
-//# sourceMappingURL=pace.d.ts.map

package/dist/sends/pace.js

@@ -62,4 +62,3 @@ export class Pacer {
         renameSync(temporary, this.path);
     }
 }
-//# sourceMappingURL=pace.js.map

package/dist/sends/permissions.d.ts

@@ -1,4 +1,4 @@
-import type { SendKind } from "./journal.js";
+import type { AccountAction, ChatAction, SendKind } from "./journal.js";
 /**
  * What a profile may be allowed to do (max-cli `CLI-37`, `NEED-251`). One name per thing the owner would
  * recognise, so `sessions` — which logs the owner out of their phone — never rides along with
@@ -42,6 +42,11 @@ export declare const levelFor: (permissions: Readonly<Record<PermissionKey, Leve
 };
 /** The command path a guarded write belongs to, when the caller did not name it. */
 export declare const keyForWrite: (kind: SendKind, action?: string) => PermissionKey;
+/** `keyForWrite` read backwards, as far as a command's key says it: an unpin is a `pin`, a chat change names its action. */
+export declare const writeOfKey: (key: PermissionKey) => {
+    kind?: SendKind;
+    action?: ChatAction | AccountAction;
+};
 /** Every key a write is checked against that a command path may not spell out. */
 export declare const WRITE_KEYS: readonly PermissionKey[];
 /** Statistics and searches moved; a deny under an old path would stop applying unseen, so the command refuses. */
@@ -57,4 +62,3 @@ export declare const permissionOverrides: (entries?: readonly string[]) => Recor
 /** No startup flag grants access: an override may narrow the profile's level, never lift it or a key under it. */
 export declare const assertOverridesTighten: (overrides: Readonly<Record<PermissionKey, Level>>, profile: Readonly<Record<PermissionKey, Level>>) => void;
 export declare const assertRetentionEvidenceRead: (permissions: Readonly<Record<string, Level>>) => void;
-//# sourceMappingURL=permissions.d.ts.map

package/dist/sends/permissions.js

@@ -241,6 +241,22 @@ export const keyForWrite = (kind, action) => {
     }
     return KIND_KEYS[kind];
 };
+/** `keyForWrite` read backwards, as far as a command's key says it: an unpin is a `pin`, a chat change names its action. */
+export const writeOfKey = (key) => {
+    const account = Object.entries(ACCOUNT_KEYS).find(([, named]) => named === key)?.[0];
+    if (account)
+        return { kind: "account", action: account };
+    const kind = Object.entries(KIND_KEYS).find(([, named]) => named === key || key.startsWith(`${named}.`))?.[0];
+    if (kind)
+        return { kind: kind };
+    if (key === "messages.unpin")
+        return { kind: "pin" };
+    if (key.startsWith("chats.")) {
+        const action = Object.entries(CHAT_KEYS).find(([, named]) => named === key)?.[0] ?? key.slice("chats.".length);
+        return { kind: "chat", action: action };
+    }
+    return {};
+};
 /** Write keys written out where a write is checked; `permission-keys.test.ts` keeps this list whole. */
 const NAMED_WRITE_KEYS = [
     "store.gaps.repair",
@@ -466,4 +482,3 @@ export const assertRetentionEvidenceRead = (permissions) => {
             throw new CliError("permission_error", `profile denies ${permission}`, { permission });
     }
 };
-//# sourceMappingURL=permissions.js.map

package/dist/sends/polls.d.ts

@@ -46,4 +46,3 @@ export declare const quizOf: ({ quiz, correct, solution, }: {
 export declare const closeRange: ([min, max]: readonly [number, number]) => string;
 /** A delay like `90s` or `5m`, in seconds, inside the messenger's range. */
 export declare const closeAfterOf: (value: string | undefined, range: readonly [number, number] | undefined) => number | undefined;
-//# sourceMappingURL=polls.d.ts.map

package/dist/sends/polls.js

@@ -94,4 +94,3 @@ export const closeAfterOf = (value, range) => {
         throw new CliError("validation_error", `--close-time takes a delay from ${closeRange(range)}, like 90s or 5m — not "${value}"`);
     return after;
 };
-//# sourceMappingURL=polls.js.map

package/dist/sends/recipients.d.ts

@@ -39,4 +39,3 @@ export declare class RecipientList {
     /** Whether there was a list to turn off. */
     off(): boolean;
 }
-//# sourceMappingURL=recipients.d.ts.map

package/dist/sends/recipients.js

@@ -112,4 +112,3 @@ export class RecipientList {
         writeSecurely(this.path, `${JSON.stringify({ chats }, null, 2)}\n`, 0o600);
     }
 }
-//# sourceMappingURL=recipients.js.map

package/dist/sends/send-as.d.ts

@@ -9,4 +9,3 @@ import { type MessengerAdapter } from "../ports/messenger.js";
 export declare const sendAsCheck: (connection: MessengerAdapter, sendAs: Id | undefined) => (chatId: Id) => Promise<void>;
 /** `--send-as` as typed; blank is refused rather than read as "no identity". */
 export declare const typedSendAs: (typed: string | undefined) => Id | undefined;
-//# sourceMappingURL=send-as.d.ts.map

package/dist/sends/send-as.js

@@ -31,4 +31,3 @@ export const typedSendAs = (typed) => {
         throw new CliError("validation_error", "--send-as needs an id from `chats send-as`");
     return sendAs;
 };
-//# sourceMappingURL=send-as.js.map

package/dist/sends/send-id.d.ts

@@ -5,4 +5,3 @@
 export declare const newSendId: () => string;
 /** One write's identity, for every write the guard sees. A send's is its send id, so a retry keeps it. */
 export declare const newOperationId: typeof newSendId;
-//# sourceMappingURL=send-id.d.ts.map

package/dist/sends/send-id.js

@@ -6,4 +6,3 @@ import { randomBytes } from "node:crypto";
 export const newSendId = () => randomBytes(8).readBigInt64BE().toString();
 /** One write's identity, for every write the guard sees. A send's is its send id, so a retry keeps it. */
 export const newOperationId = newSendId;
-//# sourceMappingURL=send-id.js.map

package/dist/sends/upload.d.ts

@@ -39,4 +39,3 @@ export declare const readStickerFile: (path: string, maxBytes: number, read: {
     env?: NodeJS.ProcessEnv;
     anyFile?: boolean;
 }) => Promise<StickerFile>;
-//# sourceMappingURL=upload.d.ts.map

package/dist/sends/upload.js

@@ -242,4 +242,3 @@ export const readStickerFile = async (path, maxBytes, read) => {
             `${Math.floor(maxBytes / 1024)} KiB — nothing was sent`);
     return { name, source };
 };
-//# sourceMappingURL=upload.js.map

package/dist/services/account.d.ts

@@ -35,4 +35,3 @@ export interface AccountService {
     }>>;
 }
 export declare const accountService: (deps: ServiceDeps) => AccountService;
-//# sourceMappingURL=account.d.ts.map

package/dist/services/account.js

@@ -73,4 +73,3 @@ export const accountService = (deps) => {
         },
     };
 };
-//# sourceMappingURL=account.js.map

package/dist/services/admin-statistics.d.ts

@@ -67,4 +67,3 @@ export declare const readAdminSelection: (store: MessageStore, input: unknown) =
     };
 }>;
 export declare const adminStatisticsService: (deps: ServiceDeps) => AdminStatisticsService;
-//# sourceMappingURL=admin-statistics.d.ts.map

package/dist/services/admin-statistics.js

@@ -323,4 +323,3 @@ export const adminStatisticsService = (deps) => ({
         return { ...found, items: evidence ?? [], component: "report" };
     },
 });
-//# sourceMappingURL=admin-statistics.js.map

package/dist/services/admin.d.ts

@@ -110,4 +110,3 @@ export interface AdminService {
     }>>;
 }
 export declare const adminService: (deps: ServiceDeps) => AdminService;
-//# sourceMappingURL=admin.d.ts.map