@wirecat/cli-core 0.405.0 → 0.407.0

package/dist/meetings/result-items.d.ts

@@ -0,0 +1,127 @@
+import * as v from "valibot";
+export declare const MEETING_RESULT_ENTITIES: {
+    readonly meeting_ingestion: v.StrictObjectSchema<{
+        readonly meetings: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 0, undefined>]>;
+        readonly participants: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 0, undefined>]>;
+        readonly transcript_rows: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 0, undefined>]>;
+        readonly summaries: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 0, undefined>]>;
+        readonly warnings: v.ArraySchema<v.StrictObjectSchema<{
+            readonly external_id: v.StringSchema<undefined>;
+            readonly message: v.StringSchema<undefined>;
+        }, undefined>, undefined>;
+        readonly timezone: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    }, undefined>;
+    readonly meeting_export: v.UnionSchema<[v.StrictObjectSchema<{
+        readonly meeting_id: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+        readonly format: v.PicklistSchema<["markdown", "vtt"], undefined>;
+        readonly filename: v.StringSchema<undefined>;
+        readonly content: v.StringSchema<undefined>;
+    }, undefined>, v.StrictObjectSchema<{
+        readonly meeting_id: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+        readonly format: v.PicklistSchema<["markdown", "vtt"], undefined>;
+        readonly output: v.StringSchema<undefined>;
+    }, undefined>], undefined>;
+    readonly meeting_association: v.StrictObjectSchema<{
+        readonly scope: v.StrictObjectSchema<{
+            readonly provider: v.StringSchema<undefined>;
+            readonly account: v.StringSchema<undefined>;
+        }, undefined>;
+        readonly account_id: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+        readonly meeting_id: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+        readonly change: v.UnionSchema<[v.StrictObjectSchema<{
+            readonly action: v.LiteralSchema<"event.link", undefined>;
+            readonly event_id: v.NullableSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+            readonly expected_event_id: v.OptionalSchema<v.NullableSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>, undefined>;
+        }, undefined>, v.StrictObjectSchema<{
+            readonly action: v.LiteralSchema<"person.link", undefined>;
+            readonly participant_id: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+            readonly person_uid: v.StringSchema<undefined>;
+            readonly expected_person_uid: v.OptionalSchema<v.NullableSchema<v.StringSchema<undefined>, undefined>, undefined>;
+            readonly target_account_ids: v.OptionalSchema<v.ArraySchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>, undefined>;
+        }, undefined>], undefined>;
+        readonly applied: v.BooleanSchema<undefined>;
+        readonly result: v.OptionalSchema<v.UnionSchema<[v.StrictObjectSchema<{
+            readonly meeting_id: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+            readonly event_id: v.NullableSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+            readonly previous_event_id: v.NullableSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+            readonly changed: v.BooleanSchema<undefined>;
+        }, undefined>, v.StrictObjectSchema<{
+            readonly meeting_id: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+            readonly participant_id: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+            readonly person_uid: v.StringSchema<undefined>;
+            readonly previous_person_uid: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+            readonly changed: v.BooleanSchema<undefined>;
+        }, undefined>], undefined>, undefined>;
+    }, undefined>;
+    readonly meeting_transcription: v.UnionSchema<[v.StrictObjectSchema<{
+        readonly applied: v.LiteralSchema<false, undefined>;
+        readonly account_id: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+        readonly external_id: v.StringSchema<undefined>;
+        readonly segments: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 0, undefined>]>;
+        readonly media: v.StrictObjectSchema<{
+            readonly id: v.StringSchema<undefined>;
+            readonly content_hash: v.StringSchema<undefined>;
+            readonly size: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 0, undefined>]>;
+            readonly duration_ms: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 0, undefined>]>;
+            readonly format: v.StringSchema<undefined>;
+            readonly sample_rate: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 0, undefined>]>;
+            readonly channels: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 0, undefined>]>;
+            readonly recognition: v.StrictObjectSchema<{
+                readonly engine: v.StringSchema<undefined>;
+                readonly model: v.StringSchema<undefined>;
+                readonly version: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly timing: v.OptionalSchema<v.PicklistSchema<["fixed-windows", "recognition-segments"], undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
+    }, undefined>, v.StrictObjectSchema<{
+        readonly applied: v.LiteralSchema<true, undefined>;
+        readonly account_id: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+        readonly external_id: v.StringSchema<undefined>;
+        readonly meeting_id: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+        readonly created: v.BooleanSchema<undefined>;
+        readonly inserted_transcripts: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 0, undefined>]>;
+        readonly replayed_transcripts: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 0, undefined>]>;
+        readonly superseded_transcripts: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 0, undefined>]>;
+        readonly segments: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 0, undefined>]>;
+        readonly media_sha256: v.StringSchema<undefined>;
+        readonly engine: v.StringSchema<undefined>;
+        readonly model: v.StringSchema<undefined>;
+        readonly model_version: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+        readonly timing: v.PicklistSchema<["fixed-windows", "recognition-segments"], undefined>;
+    }, undefined>], undefined>;
+    readonly meeting_embedding: v.UnionSchema<[v.StrictObjectSchema<{
+        readonly account_id: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+        readonly model: v.StrictObjectSchema<{
+            readonly key: v.StringSchema<undefined>;
+            readonly dims: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 0, undefined>]>;
+            readonly kind: v.PicklistSchema<["local", "remote"], undefined>;
+            readonly model: v.StringSchema<undefined>;
+        }, undefined>;
+        readonly status: v.StrictObjectSchema<{
+            readonly chunks: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 0, undefined>]>;
+            readonly embedded: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 0, undefined>]>;
+        }, undefined>;
+        readonly applied: v.LiteralSchema<false, undefined>;
+        readonly scope: v.LiteralSchema<"existing-current-chunks", undefined>;
+        readonly rebuild_required: v.LiteralSchema<"explicit", undefined>;
+    }, undefined>, v.StrictObjectSchema<{
+        readonly account_id: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+        readonly model: v.StrictObjectSchema<{
+            readonly key: v.StringSchema<undefined>;
+            readonly dims: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 0, undefined>]>;
+            readonly kind: v.PicklistSchema<["local", "remote"], undefined>;
+            readonly model: v.StringSchema<undefined>;
+        }, undefined>;
+        readonly saved: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 0, undefined>]>;
+        readonly skipped: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 0, undefined>]>;
+        readonly has_more: v.BooleanSchema<undefined>;
+        readonly next_hash: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+        readonly applied: v.LiteralSchema<true, undefined>;
+        readonly rebuild: v.StrictObjectSchema<{
+            readonly transcripts: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 0, undefined>]>;
+            readonly chunks: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 0, undefined>]>;
+            readonly has_more: v.BooleanSchema<undefined>;
+            readonly next_transcript_id: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+        }, undefined>;
+    }, undefined>], undefined>;
+};

package/dist/meetings/result-items.js

@@ -0,0 +1,125 @@
+import * as v from "valibot";
+const text = v.string();
+const identifier = v.pipe(text, v.minLength(1));
+const nullableText = v.nullable(text);
+const count = v.pipe(v.number(), v.integer(), v.minValue(0));
+const flag = v.boolean();
+const scope = v.strictObject({ provider: text, account: text });
+const run = v.strictObject({
+    meetings: count,
+    participants: count,
+    transcript_rows: count,
+    summaries: count,
+    warnings: v.array(v.strictObject({ external_id: text, message: text })),
+    timezone: v.optional(text),
+});
+const exported = v.union([
+    v.strictObject({ meeting_id: identifier, format: v.picklist(["markdown", "vtt"]), filename: text, content: text }),
+    v.strictObject({ meeting_id: identifier, format: v.picklist(["markdown", "vtt"]), output: text }),
+]);
+const eventChange = v.strictObject({
+    action: v.literal("event.link"),
+    event_id: v.nullable(identifier),
+    expected_event_id: v.optional(v.nullable(identifier)),
+});
+const personChange = v.strictObject({
+    action: v.literal("person.link"),
+    participant_id: identifier,
+    person_uid: text,
+    expected_person_uid: v.optional(nullableText),
+    target_account_ids: v.optional(v.array(identifier)),
+});
+const eventResult = v.strictObject({
+    meeting_id: identifier,
+    event_id: v.nullable(identifier),
+    previous_event_id: v.nullable(identifier),
+    changed: flag,
+});
+const personResult = v.strictObject({
+    meeting_id: identifier,
+    participant_id: identifier,
+    person_uid: text,
+    previous_person_uid: nullableText,
+    changed: flag,
+});
+const meetingChange = v.strictObject({
+    scope,
+    account_id: identifier,
+    meeting_id: identifier,
+    change: v.union([eventChange, personChange]),
+    applied: flag,
+    result: v.optional(v.union([eventResult, personResult])),
+});
+const recognition = v.strictObject({
+    engine: text,
+    model: text,
+    version: v.optional(text),
+    timing: v.optional(v.picklist(["fixed-windows", "recognition-segments"])),
+});
+const transcription = v.union([
+    v.strictObject({
+        applied: v.literal(false),
+        account_id: identifier,
+        external_id: text,
+        segments: count,
+        media: v.strictObject({
+            id: text,
+            content_hash: text,
+            size: count,
+            duration_ms: count,
+            format: text,
+            sample_rate: count,
+            channels: count,
+            recognition,
+        }),
+    }),
+    v.strictObject({
+        applied: v.literal(true),
+        account_id: identifier,
+        external_id: text,
+        meeting_id: identifier,
+        created: flag,
+        inserted_transcripts: count,
+        replayed_transcripts: count,
+        superseded_transcripts: count,
+        segments: count,
+        media_sha256: text,
+        engine: text,
+        model: text,
+        model_version: nullableText,
+        timing: v.picklist(["fixed-windows", "recognition-segments"]),
+    }),
+]);
+const embeddingModel = v.strictObject({ key: text, dims: count, kind: v.picklist(["local", "remote"]), model: text });
+const embedding = v.union([
+    v.strictObject({
+        account_id: identifier,
+        model: embeddingModel,
+        status: v.strictObject({ chunks: count, embedded: count }),
+        applied: v.literal(false),
+        scope: v.literal("existing-current-chunks"),
+        rebuild_required: v.literal("explicit"),
+    }),
+    v.strictObject({
+        account_id: identifier,
+        model: embeddingModel,
+        saved: count,
+        skipped: count,
+        has_more: flag,
+        next_hash: v.optional(text),
+        applied: v.literal(true),
+        rebuild: v.strictObject({
+            transcripts: count,
+            chunks: count,
+            has_more: flag,
+            next_transcript_id: v.optional(identifier),
+        }),
+    }),
+]);
+export const MEETING_RESULT_ENTITIES = {
+    meeting_ingestion: run,
+    meeting_export: exported,
+    meeting_association: meetingChange,
+    meeting_transcription: transcription,
+    meeting_embedding: embedding,
+};

package/dist/ports/app.d.ts

@@ -10,7 +10,7 @@ export interface AppIdentity {
     envPrefix: string;
     description: string;
     version: string;
-    /** Where a problem report goes — a new-issue page. `doctor report create` names it. */
+    /** Where a problem report goes — a new-issue page. `doctor reports create` names it. */
     issues?: string;
     /** The language of the transcript a person reads: its day headings and the word for "you". `ru-RU` when unset. */
     locale?: string;

package/dist/ports/messenger.d.ts

@@ -377,6 +377,11 @@ export interface HistoryBatch {
     votes?: HistoryVote[];
     reactions?: HistoryReaction[];
     stars?: HistoryStar[];
+    /** Deletions learned from a synced snapshot, scoped to their chat and applied after the batch's messages. */
+    deletions?: {
+        chatId: Id;
+        messageId: Id;
+    }[];
     events?: HistoryChatEvent[];
 }
 /** For a messenger that pushes its history to the client instead of answering for it (`Messenger.history: "store"`). */
@@ -488,7 +493,7 @@ export interface AccountTools {
     /** The owner's contact list as the messenger keeps it — the address book, not the chats. */
     addressBook(): Promise<Member[]>;
 }
-/** Everything the messenger says about one person — what `contacts profile` shows. */
+/** Everything the messenger says about one person — what `contacts info` shows. */
 export interface PersonProfiles {
     /** Reading it tells them nothing. A chat that is not a person is refused. */
     profile(person: string): Promise<ProfileFacts>;

package/dist/search/task-similarity.js

@@ -2,7 +2,7 @@ import { normalize } from "../store/normalize.js";
 import { createStemmer, DEFAULT_STEMMERS } from "./stem.js";
 import { amountOf, dayOf, dueDayOf } from "./task-signature.js";
 /**
- * How alike two tasks are, field by field, as the tasks plan's duplicate chain scores them
+ * How alike two tasks are, field by field, as the tasks update's duplicate chain scores them
  * (`docs/dev/tasks-plan.md`, "Duplicates — the comparison chain" § 1, 4, 5). Ported from the scorer that
  * tuned the weights, WireCatLabs/cli-testing `performance/tasks/duplicates/` (cli-testing#60); the counts
  * quoted beside each weight are that run's duplicate / other candidate pairs at the level.

package/dist/sends/guard.js

@@ -12,12 +12,12 @@ const HOUR_MS = 60 * 60 * 1000;
  */
 const READS_UNDER_HOLD = new Set([
     "attachments.extract",
-    "conversations.embed",
+    "conversations.embeddings",
     "conversations.links",
     "messages.server-search",
     "messages.sync-first",
     "stats.contacts.top.sync-first",
-    "stats.messages.counters.refresh",
+    "stats.messages.counters.sync",
     "stats.messages.show.sync-first",
     "stats.messages.top.sync-first",
     "store.gaps.repair",

package/dist/sends/permission-aliases.d.ts

@@ -0,0 +1,5 @@
+import type { Level } from "./permissions.js";
+/** Canonical names for internal permission keys; saved moved paths are refused below. */
+export declare const canonicalPermissionKey: (key: string) => string;
+/** WC-PERM-8: a moved saved path must name the replacement before any command runs. */
+export declare const canonicalPermissions: (levels: Readonly<Record<string, Level>>) => Record<string, Level>;

package/dist/sends/permission-aliases.js

@@ -0,0 +1,49 @@
+import { CliError } from "@wirecat/cli-base";
+const RENAMED = [
+    ["models.audio.download", "models.download"],
+    ["models.text.download", "models.download"],
+    ["models.text.key", "models.keys"],
+    ["models.audio", "models"],
+    ["models.text", "models"],
+    ["doctor.report", "doctor.reports"],
+    ["contacts.aliases.rm", "contacts.aliases.remove"],
+    ["contacts.alias.rm", "contacts.aliases.remove"],
+    ["contacts.alias", "contacts.aliases"],
+    ["contacts.profile", "contacts.info"],
+    ["contacts.timeline", "contacts.events"],
+    ["chats.links.revoke", "chats.links.remove"],
+    ["chats.link.revoke", "chats.links.remove"],
+    ["chats.link", "chats.links"],
+    ["chats.members.audit", "chats.members.check"],
+    ["chats.requests.accept", "chats.requests.confirm"],
+    ["chats.requests.decline", "chats.requests.reject"],
+    ["metadata.get", "metadata.show"],
+    ["metadata.refresh", "metadata.sync"],
+    ["tasks.plan", "tasks.update"],
+    ["tags.auto", "tags.rebuild"],
+    ["attachments.text.set", "attachments.update"],
+    ["attachments.text", "attachments.update"],
+    ["conversations.build", "conversations.links.rebuild"],
+    ["conversations.embed", "conversations.embeddings"],
+    ["conversations.batches.next", "conversations.batches.show"],
+    ["conversations.consents.revoke", "conversations.consents.remove"],
+    ["stats.messages.counters.refresh", "stats.messages.counters.sync"],
+    ["store.gaps.plan", "store.gaps.show"],
+    ["store.reindex", "store.rebuild"],
+];
+/** Canonical names for internal permission keys; saved moved paths are refused below. */
+export const canonicalPermissionKey = (key) => {
+    if (key.startsWith("bot."))
+        return `bot.${canonicalPermissionKey(key.slice(4))}`;
+    const renamed = RENAMED.find(([old]) => key === old || key.startsWith(`${old}.`));
+    return renamed ? renamed[1] + key.slice(renamed[0].length) : key;
+};
+/** WC-PERM-8: a moved saved path must name the replacement before any command runs. */
+export const canonicalPermissions = (levels) => {
+    for (const key of Object.keys(levels)) {
+        const canonical = canonicalPermissionKey(key);
+        if (key !== canonical)
+            throw new CliError("configuration_error", `permission path moved — rename permissions.${key} to permissions.${canonical}`, { permission: key, replacement: canonical, retryable: false });
+    }
+    return { ...levels };
+};

package/dist/sends/permissions.js

@@ -1,4 +1,5 @@
 import { CliError } from "@wirecat/cli-base";
+import { canonicalPermissionKey, canonicalPermissions } from "./permission-aliases.js";
 /**
  * What a profile may be allowed to do (max-cli `CLI-37`, `NEED-251`). One name per thing the owner would
  * recognise, so `sessions` — which logs the owner out of their phone — never rides along with
@@ -91,12 +92,11 @@ export const DEFAULT_PERMISSIONS = {
     "server.start": "ask",
     "server.stop": "ask",
     "server.restart": "ask",
-    "models.audio.download": "ask",
-    "models.text.download": "ask",
+    "models.download": "ask",
     "images.models.download": "ask",
     "schedule.run": "ask",
     "schedule.exec": "ask",
-    "doctor.report.create": "ask",
+    "doctor.reports.create": "ask",
 };
 /** Commands under a housekeeping word, or store maintenance, that still have a key of their own: their path. */
 const KEYED_UNDER_HOUSEKEEPING = new Set(Object.keys(DEFAULT_PERMISSIONS).filter((key) => /^(store|server|models|images|schedule|doctor)\./.test(key)));
@@ -163,7 +163,7 @@ const OLD_WORDS = {
         "chats.leave",
         "chats.members",
         "chats.admins",
-        "chats.link",
+        "chats.links",
         "chats.requests",
         "chats.moderate",
         "topics.enable",
@@ -199,7 +199,7 @@ export const layerPermissions = (layers) => {
     const sources = {};
     for (const [from, layer] of layers) {
         const nearer = Object.keys(levels);
-        for (const [key, level] of Object.entries(layer ?? {})) {
+        for (const [key, level] of Object.entries(canonicalPermissions(layer ?? {}))) {
             if (nearer.some((named) => key === named || key.startsWith(`${named}.`)))
                 continue;
             levels[key] = level;
@@ -236,6 +236,8 @@ const FORMER_KEYS = { "chats.unmute": "chats.mute" };
  * A path nothing names is allowed.
  */
 export const levelFor = (permissions, key, defaults = DEFAULT_PERMISSIONS) => {
+    permissions = canonicalPermissions(permissions);
+    key = canonicalPermissionKey(key);
     const found = profileLevel(permissions, key, defaults);
     const ceiling = permissions[CEILING_KEY];
     return ceiling && ORDER[ceiling] < ORDER[found.level] ? { level: ceiling, key: CEILING_KEY } : found;
@@ -290,7 +292,7 @@ const KIND_KEYS = {
 /** The command path a guarded write belongs to, when the caller did not name it. */
 export const keyForWrite = (kind, action) => {
     if (kind === "chat")
-        return CHAT_KEYS[action ?? ""] ?? `chats.${action ?? "update"}`;
+        return canonicalPermissionKey(CHAT_KEYS[action ?? ""] ?? `chats.${action ?? "update"}`);
     if (kind === "account") {
         const key = ACCOUNT_KEYS[action];
         if (!key)
@@ -301,6 +303,7 @@ export const keyForWrite = (kind, action) => {
 };
 /** `keyForWrite` read backwards, as far as a command's key says it: an unpin is a `pin`, a chat change names its action. */
 export const writeOfKey = (key) => {
+    key = canonicalPermissionKey(key);
     const account = Object.entries(ACCOUNT_KEYS).find(([, named]) => named === key)?.[0];
     if (account)
         return { kind: "account", action: account };
@@ -324,14 +327,14 @@ const NAMED_WRITE_KEYS = [
     "messages.press",
     "chats.start",
     "chats.app",
-    "stats.messages.counters.refresh",
+    "stats.messages.counters.sync",
     "stats.messages.show.sync-first",
     "stats.messages.top.sync-first",
     "stats.contacts.top.sync-first",
     "account.sessions.list",
     "attachments.extract",
     "attachments.move",
-    "attachments.text.set",
+    "attachments.update",
     "bot.callbacks.answer",
     "bot.chats.action",
     "bot.chats.admins.add",
@@ -346,14 +349,14 @@ const NAMED_WRITE_KEYS = [
     "bot.messages.unpin",
     "chats.admins.add",
     "chats.admins.remove",
-    "chats.link.create",
-    "chats.link.reset",
-    "chats.link.revoke",
-    "chats.link.update",
+    "chats.links.create",
+    "chats.links.reset",
+    "chats.links.remove",
+    "chats.links.update",
     "chats.members.add",
     "chats.members.remove",
     "chats.moderate",
-    "conversations.embed",
+    "conversations.embeddings",
     "conversations.links",
     "polls.close",
     "polls.create",
@@ -361,13 +364,13 @@ const NAMED_WRITE_KEYS = [
     "searches.clear",
     "searches.create",
     "searches.delete",
-    "contacts.alias.set",
-    "contacts.alias.rm",
+    "contacts.aliases.set",
+    "contacts.aliases.remove",
     "contacts.notes.add",
     "contacts.notes.edit",
     "contacts.notes.remove",
-    "tags.auto",
-    "metadata.refresh",
+    "tags.rebuild",
+    "metadata.sync",
     "mentions.rebuild",
     "mentions.confirm",
     "mentions.reject",
@@ -380,7 +383,7 @@ const NAMED_WRITE_KEYS = [
     "tasks.duplicates.reject",
     "tasks.link",
     "tasks.merge",
-    "tasks.plan",
+    "tasks.update",
     "tasks.release",
     "tasks.scan",
     "tasks.unmerge",
@@ -397,7 +400,7 @@ export const WRITE_KEYS = [
         ...Object.values(ACCOUNT_KEYS),
         ...Object.values(CHAT_KEYS),
         ...PERMISSIONS.flatMap((word) => [...OLD_WORDS[word], ...botKeysOf(word)]),
-    ]),
+    ].map(canonicalPermissionKey)),
 ];
 /** Commands that look after the tool and its files and never show a message: no level stops them. */
 const HOUSEKEEPING = new Set([
@@ -483,6 +486,9 @@ export const readKeysForCommand = (path) => {
  * `undefined` for a path this package does not know — a CLI's own command, which its CLI maps.
  */
 export const keyForCommand = (path) => {
+    if (path.length === 0)
+        return null;
+    path = canonicalPermissionKey(path.join(".")).split(".");
     const [top, next] = path;
     if (top === "bot") {
         if (next === undefined || BOT_HOUSEKEEPING.has(next))
@@ -505,11 +511,12 @@ export const keyForCommand = (path) => {
         return null;
     // The agent's answers write only to the local store: their own key, so read-only messages can still link (phase 4 A10).
     if (top === "conversations" && next === "links")
-        return "conversations.links";
+        return path[2] === "rebuild" ? "conversations.links.rebuild" : "conversations.links";
     // Vectors are written to the local store only, and the text never leaves the machine (phase 5 E10).
-    if (((top === "conversations" || top === "images") && next === "embed") ||
+    if ((top === "conversations" && next === "embeddings") ||
+        (top === "images" && next === "embed") ||
         (top === "conversations" && next === "rebuild"))
-        return "conversations.embed";
+        return "conversations.embeddings";
     // Which files a message has, and where they are saved, tells as much as a message does; so does who
     // shared which document link, and when.
     if ((top === "attachments" && next === "list") || (top === "chats" && next === "documents"))
@@ -521,8 +528,7 @@ export const keyForCommand = (path) => {
         return path.join(".");
     if (top === "messages" && next === "sync")
         return "messages";
-    if (SHOW_MESSAGES.has(top) ||
-        (top === "contacts" && (next === "context" || next === "prepare" || next === "timeline")))
+    if (SHOW_MESSAGES.has(top) || (top === "contacts" && (next === "context" || next === "prepare" || next === "events")))
         return "messages";
     if (RESOURCES.includes(top))
         return path.join(".");
@@ -538,10 +544,12 @@ export const permissionOverrides = (entries = []) => {
             throw new CliError("validation_error", "--permission takes a command path and level, e.g. messages.send=allow (deny, readonly, ask, allow)");
         levels[key] = level;
     }
-    return levels;
+    return canonicalPermissions(levels);
 };
 /** No startup flag grants access: an override may narrow the profile's level, never lift it or a key under it. */
 export const assertOverridesTighten = (overrides, profile) => {
+    overrides = canonicalPermissions(overrides);
+    profile = canonicalPermissions(profile);
     for (const [key, level] of Object.entries(overrides)) {
         const under = Object.keys(profile).filter((named) => named.startsWith(`${key}.`));
         const lifted = [key, ...under].find((named) => ORDER[level] > ORDER[levelFor(profile, named).level]);

package/dist/services/admin.js

@@ -111,14 +111,14 @@ export const adminService = (deps) => {
             return { operationId, chat: card };
         },
         link: async (chat) => {
-            const group = await capability(await online("chats link show"), "group", "read a group")(chat);
+            const group = await capability(await online("chats links show"), "group", "read a group")(chat);
             if (group.link === null) {
                 throw new CliError("not_found", `${group.title ?? group.id} shows you no invite link — only admins, or members when the group allows it`);
             }
             return { chatId: group.id, title: group.title, link: group.link };
         },
         resetLink: async (chat) => {
-            const connection = await online("chats link reset");
+            const connection = await online("chats links reset");
             const reset = capability(connection, "resetInviteLink", "replace an invite link");
             const { id: chatId } = await connection.resolve(chat);
             const operationId = newOperationId();
@@ -127,7 +127,7 @@ export const adminService = (deps) => {
         },
         createLink: async (chat, { approval, expires, maxUses }) => {
             const expiresAt = linkLimits({ approval, expires, maxUses });
-            const connection = await online("chats link create");
+            const connection = await online("chats links create");
             const create = capability(connection, "createInviteLink", "make another invite link");
             const { id: chatId } = await connection.resolve(chat);
             const operationId = newOperationId();
@@ -193,8 +193,8 @@ export const adminService = (deps) => {
         },
         revokeLink: async (chat, link) => {
             if (link.trim() === "")
-                throw new CliError("validation_error", "which link? give it as `chats link list` shows it");
-            const connection = await online("chats link revoke");
+                throw new CliError("validation_error", "which link? give it as `chats links list` shows it");
+            const connection = await online("chats links remove");
             const revoke = capability(connection, "revokeInviteLink", "revoke an invite link");
             const { id: chatId } = await connection.resolve(chat);
             const operationId = newOperationId();
@@ -203,12 +203,12 @@ export const adminService = (deps) => {
         },
         updateLink: async (chat, link, { approval, expires, maxUses }) => {
             if (link.trim() === "")
-                throw new CliError("validation_error", "which link? give it as `chats link list` shows it");
+                throw new CliError("validation_error", "which link? give it as `chats links list` shows it");
             if (approval === undefined && expires === undefined && maxUses === undefined)
                 throw new CliError("validation_error", "nothing to change: give --approval, --no-approval, --expire-time or --max-uses");
             const limited = linkLimits({ approval, expires: expires === "never" ? undefined : expires, maxUses });
             const expiresAt = expires === "never" ? null : limited;
-            const connection = await online("chats link update");
+            const connection = await online("chats links update");
             const update = capability(connection, "updateInviteLink", "change an invite link");
             const { id: chatId } = await connection.resolve(chat);
             const change = {

package/dist/services/chats.js

@@ -161,7 +161,7 @@ export const chatsService = (deps) => ({
     },
     audit: async (chat, { budget = AUDIT_BUDGET, minScore = AUDIT_MIN_SCORE, pauseMs = AUDIT_PAUSE_MS, deep = 0, registry }) => {
         if (deps.offline) {
-            throw new CliError("validation_error", "`chats members audit` reads the member list from the messenger; not with --offline");
+            throw new CliError("validation_error", "`chats members check` reads the member list from the messenger; not with --offline");
         }
         const connection = await deps.connection();
         const { chatId: id, members: read, more, participants } = await readMembers(connection, chat, budget, pauseMs);

package/dist/services/conversations.d.ts

@@ -61,7 +61,7 @@ export interface ConversationsService {
     batchStatus(chat: string, size: number): Promise<BatchStatus>;
     /** The next window for the agent; `undefined` when every message is answered (A1–A4). */
     nextBatch(chat: string, size: number): Promise<LinkBatch | undefined>;
-    /** Stores the agent's answer to a batch, all or nothing (A5); `conversations build` then uses it. */
+    /** Stores the agent's answer to a batch, all or nothing (A5); `conversations links rebuild` then uses it. */
     addAnswers(batch: string, answer: AgentAnswer): Promise<{
         chat: Id;
         stored: number;

package/dist/services/conversations.js

@@ -39,7 +39,7 @@ export const conversationsService = (deps) => {
         const store = await accountStore(deps);
         return { store, chatId: await chatIdIn(deps.messenger, chat, store, { includeLeft: true }) };
     };
-    const notBuilt = (chatId) => new CliError("not_found", `chat ${chatId} has no conversations yet — \`${typedCommand(deps.messenger.app.command, `conversations build --chat ${chatId}`)}\``);
+    const notBuilt = (chatId) => new CliError("not_found", `chat ${chatId} has no conversations yet — \`${typedCommand(deps.messenger.app.command, `conversations links rebuild --chat ${chatId}`)}\``);
     return {
         build: async (chat, { maxMessages, check } = {}) => {
             check?.();

package/dist/services/counters.js

@@ -115,7 +115,7 @@ export const countersService = (deps) => {
                 return preview;
             if (deps.offline)
                 throw new CliError("validation_error", "counter refresh requires an online session");
-            const request = { chatId: null, key: "stats.messages.counters.refresh" };
+            const request = { chatId: null, key: "stats.messages.counters.sync" };
             await deps.guard.ask?.(request);
             deps.guard.check(request, { reserve: false });
             const controller = new AbortController(), timer = setTimeout(() => controller.abort(new Error("counter refresh time budget exhausted")), time);