@wirecat/cli-core 0.420.0 → 0.422.0

package/dist/meetings/mcp/index.d.ts

@@ -38,6 +38,7 @@ export declare const meetingTools: ({
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -53,11 +54,11 @@ export declare const meetingTools: ({
             format?: undefined;
             transcript_id?: undefined;
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -75,11 +76,11 @@ export declare const meetingTools: ({
             format?: undefined;
             transcript_id?: undefined;
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -101,7 +102,6 @@ export declare const meetingTools: ({
                 minimum: number;
             };
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
@@ -188,6 +188,7 @@ export declare const meetingTools: ({
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -203,11 +204,11 @@ export declare const meetingTools: ({
             format?: undefined;
             transcript_id?: undefined;
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -225,11 +226,11 @@ export declare const meetingTools: ({
             format?: undefined;
             transcript_id?: undefined;
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -251,7 +252,6 @@ export declare const meetingTools: ({
                 minimum: number;
             };
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
@@ -338,6 +338,7 @@ export declare const meetingTools: ({
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -353,11 +354,11 @@ export declare const meetingTools: ({
             format?: undefined;
             transcript_id?: undefined;
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -375,11 +376,11 @@ export declare const meetingTools: ({
             format?: undefined;
             transcript_id?: undefined;
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -401,7 +402,6 @@ export declare const meetingTools: ({
                 minimum: number;
             };
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
@@ -488,6 +488,7 @@ export declare const meetingTools: ({
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -503,11 +504,11 @@ export declare const meetingTools: ({
             format?: undefined;
             transcript_id?: undefined;
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -525,11 +526,11 @@ export declare const meetingTools: ({
             format?: undefined;
             transcript_id?: undefined;
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -551,7 +552,6 @@ export declare const meetingTools: ({
                 minimum: number;
             };
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
@@ -638,6 +638,7 @@ export declare const meetingTools: ({
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -653,11 +654,11 @@ export declare const meetingTools: ({
             format?: undefined;
             transcript_id?: undefined;
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -675,11 +676,11 @@ export declare const meetingTools: ({
             format?: undefined;
             transcript_id?: undefined;
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -701,7 +702,6 @@ export declare const meetingTools: ({
                 minimum: number;
             };
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;

package/dist/parity/manifest.js

@@ -1,4 +1,3 @@
-import { MOVED_TO_MEMO } from "../cli/moved.js";
 export const longName = (flags) => flags.split(/[\s,|]+/).find((part) => part.startsWith("--")) ?? flags;
 const presence = (entry) => (typeof entry === "string" ? { in: entry } : entry);
 /** `true` the CLI must have it, `false` it must not, `undefined` it is planned and either passes. */
@@ -93,9 +92,6 @@ export const manifestProblems = (manifest) => {
         }
         optionEntries(path, row.options ?? {});
     }
-    for (const path of Object.keys(manifest.commands))
-        if (Object.keys(MOVED_TO_MEMO).some((moved) => path === moved || path.startsWith(`${moved} `)))
-            problems.push(`${path}: moved to memo (src/cli/moved.ts), so a source tool has no row for it`);
     for (const [name, option] of Object.entries(manifest.options)) {
         if (!option.meaning)
             problems.push(`options ${name}: no meaning`);

package/dist/ports/app.d.ts

@@ -19,6 +19,12 @@ export interface AppIdentity {
      * can stem in place of English and the system's language; the person still confirms, since the choice is shared.
      */
     contentLanguages?: readonly string[];
+    /**
+     * `false` for a CLI that is not a messenger — notes, files, a calendar. The shared help, `config`, `commands info`
+     * and MCP text then name its own commands and leave out chats, messages and senders. Unset means a messenger, so
+     * tg, max and wa print what they always did.
+     */
+    messenger?: boolean;
     /** Error reasons and detail keys of its own — max's `max_code`, tg's `migrated_chat_id` — kept in every error it prints. */
     errors?: AppErrors;
 }

package/dist/search/dictionary.d.ts

@@ -1,10 +1,7 @@
+import { type Language } from "./languages.js";
 /** The Hunspell dictionary that tells a real word from a garbled one, for each language the store stems. */
-export declare const DICTIONARIES: {
-    readonly russian: "dictionary-ru";
-    readonly english: "dictionary-en";
-    readonly spanish: "dictionary-es";
-};
-export type DictionaryLanguage = keyof typeof DICTIONARIES;
+export declare const DICTIONARIES: Record<Language, string>;
+export type DictionaryLanguage = Language;
 /**
  * `known`: whether a folded word the index stores is real in one of `languages` that write in its alphabet.
  * `covers`: whether any of them does; without one, a garbled spelling cannot be told from a real word.

package/dist/search/dictionary.js

@@ -1,7 +1,8 @@
 import { readFileSync } from "node:fs";
 import { fold } from "../store/normalize.js";
+import { LANGUAGES } from "./languages.js";
 /** The Hunspell dictionary that tells a real word from a garbled one, for each language the store stems. */
-export const DICTIONARIES = { russian: "dictionary-ru", english: "dictionary-en", spanish: "dictionary-es" };
+export const DICTIONARIES = Object.fromEntries(LANGUAGES.map(({ name, dictionary }) => [name, dictionary]));
 /** `fold`, without Unicode normalisation for plain Russian letters: it would double the time Russian loads in. */
 const folded = (word) => /^[а-яё'-]*$/.test(word) ? word.replaceAll("ё", "е").replaceAll("й", "и") : fold(word);
 const loaded = new Map();

package/dist/search/languages.d.ts

@@ -0,0 +1,28 @@
+/** The languages search can stem and spell-check. Adding one here needs its Snowball stemmer in `stem.ts`. */
+export declare const LANGUAGES: readonly [{
+    readonly name: "russian";
+    readonly code: "ru";
+    readonly label: "Russian";
+    readonly script: "cyrillic";
+    readonly dictionary: "dictionary-ru";
+}, {
+    readonly name: "english";
+    readonly code: "en";
+    readonly label: "English";
+    readonly script: "latin";
+    readonly dictionary: "dictionary-en";
+}, {
+    readonly name: "spanish";
+    readonly code: "es";
+    readonly label: "Spanish";
+    readonly script: "latin";
+    readonly dictionary: "dictionary-es";
+}];
+type Entry = (typeof LANGUAGES)[number];
+export type Language = Entry["name"];
+export type Script = Entry["script"];
+export type LanguageOf<S extends Script> = Extract<Entry, {
+    script: S;
+}>["name"];
+export declare const languagesOf: <S extends Script>(script: S) => LanguageOf<S>[];
+export {};

package/dist/search/languages.js

@@ -0,0 +1,7 @@
+/** The languages search can stem and spell-check. Adding one here needs its Snowball stemmer in `stem.ts`. */
+export const LANGUAGES = [
+    { name: "russian", code: "ru", label: "Russian", script: "cyrillic", dictionary: "dictionary-ru" },
+    { name: "english", code: "en", label: "English", script: "latin", dictionary: "dictionary-en" },
+    { name: "spanish", code: "es", label: "Spanish", script: "latin", dictionary: "dictionary-es" },
+];
+export const languagesOf = (script) => LANGUAGES.filter((one) => one.script === script).map(({ name }) => name);

package/dist/search/stem.d.ts

@@ -1,9 +1,10 @@
+import { type LanguageOf } from "./languages.js";
 /** The version of the vendored files in `./snowball/`; `bin/snowball-update` regenerates them. */
 export declare const SNOWBALL_VERSION = "3.1.1";
-export declare const CYRILLIC_STEMMERS: readonly ["russian", "none"];
-export declare const LATIN_STEMMERS: readonly ["spanish", "english", "none"];
-export type CyrillicStemmer = (typeof CYRILLIC_STEMMERS)[number];
-export type LatinStemmer = (typeof LATIN_STEMMERS)[number];
+export type CyrillicStemmer = LanguageOf<"cyrillic"> | "none";
+export type LatinStemmer = LanguageOf<"latin"> | "none";
+export declare const CYRILLIC_STEMMERS: readonly CyrillicStemmer[];
+export declare const LATIN_STEMMERS: readonly LatinStemmer[];
 /** `latin` is one stemmer, `none`, or several joined by commas in alphabetical order (`english,spanish`). */
 export type Stemmers = {
     cyrillic: CyrillicStemmer;

package/dist/search/stem.js

@@ -1,12 +1,13 @@
 import { CliError } from "@wirecat/cli-base";
 import { normalize } from "../store/normalize.js";
+import { languagesOf } from "./languages.js";
 import EnglishStemmer from "./snowball/english-stemmer.js";
 import RussianStemmer from "./snowball/russian-stemmer.js";
 import SpanishStemmer from "./snowball/spanish-stemmer.js";
 /** The version of the vendored files in `./snowball/`; `bin/snowball-update` regenerates them. */
 export const SNOWBALL_VERSION = "3.1.1";
-export const CYRILLIC_STEMMERS = ["russian", "none"];
-export const LATIN_STEMMERS = ["spanish", "english", "none"];
+export const CYRILLIC_STEMMERS = [...languagesOf("cyrillic"), "none"];
+export const LATIN_STEMMERS = [...languagesOf("latin"), "none"];
 export const DEFAULT_STEMMERS = { cyrillic: "russian", latin: "english,spanish" };
 /**
  * Raised with every change to `DEFAULT_STEMMERS`. A default saved in the store carries it, so a newer build

package/dist/sends/index.d.ts

@@ -3,7 +3,7 @@ export { type FloodDeadline, FloodMemory, type FloodState, FROZEN_HOLD_MS, flood
 export { type Asker, type GuardRequest, guardFor, type SendGuard, type SendGuardOptions, sendGuard, sharedJournal, } from "./guard.js";
 export { currentOperation, guardedWrite, type Operated } from "./guarded.js";
 export { type AccountAction, type ChatAction, type SendEntry, SendJournal, type SendKind, type SendOutcome, sendsPathFor, } from "./journal.js";
-export { assertStatsPermissionsCurrent, CEILING_KEY, DEFAULT_PERMISSIONS, keyForCommand, keyForWrite, LEVELS, type Level, layerPermissions, levelFor, PERMISSIONS, type Permission, type PermissionKey, permissionFor, permissionOverrides, readKeysForCommand, skipFlagFor, WRITE_KEYS, } from "./permissions.js";
+export { CEILING_KEY, DEFAULT_PERMISSIONS, keyForCommand, keyForWrite, LEVELS, type Level, layerPermissions, levelFor, type PermissionKey, permissionOverrides, readKeysForCommand, skipFlagFor, WRITE_KEYS, } from "./permissions.js";
 export { type Recipient, RecipientList, recipientsPathFor } from "./recipients.js";
 export { newOperationId, newSendId } from "./send-id.js";
 export { MAX_BUFFERED_UPLOAD_BYTES, readUpload, refusedPlace, uploadBlob, uploadBytes, uploadSize, } from "./upload.js";

package/dist/sends/index.js

@@ -2,7 +2,7 @@ export { FloodMemory, FROZEN_HOLD_MS, floodPathFor, LIMITED_HOLD_MS, } from "./f
 export { guardFor, sendGuard, sharedJournal, } from "./guard.js";
 export { currentOperation, guardedWrite } from "./guarded.js";
 export { SendJournal, sendsPathFor, } from "./journal.js";
-export { assertStatsPermissionsCurrent, CEILING_KEY, DEFAULT_PERMISSIONS, keyForCommand, keyForWrite, LEVELS, layerPermissions, levelFor, PERMISSIONS, permissionFor, permissionOverrides, readKeysForCommand, skipFlagFor, WRITE_KEYS, } from "./permissions.js";
+export { CEILING_KEY, DEFAULT_PERMISSIONS, keyForCommand, keyForWrite, LEVELS, layerPermissions, levelFor, permissionOverrides, readKeysForCommand, skipFlagFor, WRITE_KEYS, } from "./permissions.js";
 export { RecipientList, recipientsPathFor } from "./recipients.js";
 export { newOperationId, newSendId } from "./send-id.js";
 export { MAX_BUFFERED_UPLOAD_BYTES, readUpload, refusedPlace, uploadBlob, uploadBytes, uploadSize, } from "./upload.js";

package/dist/sends/permissions.d.ts

@@ -1,13 +1,4 @@
 import type { AccountAction, ChatAction, SendKind } from "./journal.js";
-/**
- * What a profile may be allowed to do (max-cli `CLI-37`, `NEED-251`). One name per thing the owner would
- * recognise, so `sessions` — which logs the owner out of their phone — never rides along with
- * adding a contact. There is no `*`: "everything" is not setting `allow` at all, and a wildcard
- * would switch on `delete` without anyone naming it.
- */
-export declare const PERMISSIONS: readonly ["send", "forward", "reaction", "edit", "pin", "read", "delete", "groups", "contacts", "profile", "folders", "sessions"];
-export type Permission = (typeof PERMISSIONS)[number];
-export declare const permissionFor: (kind: SendKind, action?: string) => Permission;
 /** What a profile may do with one command path — the standard's "Permissions". */
 export declare const LEVELS: readonly ["deny", "readonly", "ask", "allow"];
 export type Level = (typeof LEVELS)[number];
@@ -32,8 +23,6 @@ export declare const isBotApi: (path: readonly string[]) => boolean;
 export declare const botApiAllowed: (levels: Readonly<Record<PermissionKey, Level>>) => boolean;
 /** The resources at the top of the command tree, which `readOnly` and `allow` turn read-only as a whole. */
 export declare const RESOURCES: readonly ["messages", "drafts", "reactions", "polls", "topics", "chats", "contacts", "account", "bot", "conversations", "tags", "mentions", "search", "searches", "tasks", "replies", "attachments", "stats", "store", "metadata", "mcp", "server", "models", "schedule", "doctor", "images"];
-/** The command path an old `allow` word stood for, as one key — what an MCP tool's `permission` is checked against. */
-export declare const keyOfWord: (word: Permission) => PermissionKey;
 /**
  * Layers come nearest first. A key a nearer layer sets hides that key and every key under it in the
  * farther layers, so a profile's `messages: readonly` is not undone by `messages.delete: allow` in
@@ -67,8 +56,6 @@ export declare const writeOfKey: (key: PermissionKey) => {
 };
 /** Every key a write is checked against that a command path may not spell out. */
 export declare const WRITE_KEYS: readonly PermissionKey[];
-/** Statistics and searches moved; a deny under an old path would stop applying unseen, so the command refuses. */
-export declare const assertStatsPermissionsCurrent: (path: readonly string[], permissions: Readonly<Record<string, Level>>) => void;
 export declare const readKeysForCommand: (path: readonly string[]) => PermissionKey[];
 /**
  * The key a command path is checked against: `null` for housekeeping, which no level stops, and

package/dist/sends/permissions.js

@@ -1,66 +1,4 @@
 import { CliError } from "@wirecat/cli-base";
-import { canonicalPermissionKey, canonicalPermissions } from "./permission-aliases.js";
-/**
- * What a profile may be allowed to do (max-cli `CLI-37`, `NEED-251`). One name per thing the owner would
- * recognise, so `sessions` — which logs the owner out of their phone — never rides along with
- * adding a contact. There is no `*`: "everything" is not setting `allow` at all, and a wildcard
- * would switch on `delete` without anyone naming it.
- */
-export const PERMISSIONS = [
-    "send",
-    "forward",
-    "reaction",
-    "edit",
-    "pin",
-    "read",
-    "delete",
-    "groups",
-    "contacts",
-    "profile",
-    "folders",
-    "sessions",
-];
-const ACCOUNT = {
-    "contact-add": "contacts",
-    "contact-remove": "contacts",
-    "contact-import": "contacts",
-    "contact-rename": "contacts",
-    "contact-block": "contacts",
-    "contact-unblock": "contacts",
-    profile: "profile",
-    "folder-create": "folders",
-    "folder-update": "folders",
-    "folder-delete": "folders",
-    "folder-order": "folders",
-    "folder-join": "folders",
-    "sessions-end": "sessions",
-    "chat-mute": "profile",
-    "chat-unmute": "profile",
-    "chat-archive": "profile",
-    "chat-unarchive": "profile",
-    "chat-pin": "profile",
-    "chat-unpin": "profile",
-    "chat-mark-unread": "profile",
-    "message-star": "profile",
-    "message-unstar": "profile",
-    privacy: "profile",
-};
-export const permissionFor = (kind, action) => {
-    switch (kind) {
-        case "message":
-            return "send";
-        case "chat":
-            return "groups";
-        case "account": {
-            const permission = ACCOUNT[action];
-            if (!permission)
-                throw new Error(`an account change without a known action: ${action}`);
-            return permission;
-        }
-        default:
-            return kind;
-    }
-};
 /** What a profile may do with one command path — the standard's "Permissions". */
 export const LEVELS = ["deny", "readonly", "ask", "allow"];
 /** The deletions nobody gets back: the word that skips their question is `--allow-dangerous`, never `--yes`. */
@@ -148,47 +86,6 @@ export const RESOURCES = [
     "doctor",
     "images",
 ];
-const OLD_WORDS = {
-    send: ["messages.send", "polls.create", "chats.start"],
-    forward: ["messages.forward"],
-    reaction: ["reactions", "polls.vote", "messages.press", "chats.app"],
-    edit: ["messages.edit", "polls.close"],
-    pin: ["messages.pin", "messages.unpin"],
-    read: ["chats.mark-read"],
-    delete: ["messages.delete", "chats.delete", "chats.clear"],
-    groups: [
-        "chats.create",
-        "chats.update",
-        "chats.join",
-        "chats.leave",
-        "chats.members",
-        "chats.admins",
-        "chats.links",
-        "chats.requests",
-        "chats.moderate",
-        "topics.enable",
-        "topics.create",
-        "topics.edit",
-        "topics.delete",
-    ],
-    contacts: ["contacts"],
-    profile: ["account.update", "account.privacy.set", "chats.mute", "messages.star", "messages.unstar"],
-    folders: ["chats.folders"],
-    sessions: ["account.sessions.end"],
-};
-/** The command path an old `allow` word stood for, as one key — what an MCP tool's `permission` is checked against. */
-export const keyOfWord = (word) => OLD_WORDS[word][0];
-/**
- * A bot's old words meant its own writes: `profile` was its command menu, and `read` was taking
- * updates, which every level but `deny` allows now.
- */
-const botKeysOf = (word) => {
-    if (word === "profile")
-        return ["bot.commands"];
-    if (word === "read")
-        return [];
-    return OLD_WORDS[word].map((key) => `bot.${key}`);
-};
 /**
  * Layers come nearest first. A key a nearer layer sets hides that key and every key under it in the
  * farther layers, so a profile's `messages: readonly` is not undone by `messages.delete: allow` in
@@ -199,7 +96,7 @@ export const layerPermissions = (layers) => {
     const sources = {};
     for (const [from, layer] of layers) {
         const nearer = Object.keys(levels);
-        for (const [key, level] of Object.entries(canonicalPermissions(layer ?? {}))) {
+        for (const [key, level] of Object.entries(layer ?? {})) {
             if (nearer.some((named) => key === named || key.startsWith(`${named}.`)))
                 continue;
             levels[key] = level;
@@ -224,11 +121,6 @@ const nearest = (levels, key) => {
     }
     return undefined;
 };
-/**
- * `chats unmute` was checked as `chats.mute` before it had its own key; a config that names only the old key
- * keeps meaning it, so a `chats.mute: readonly` written then still stops an unmute.
- */
-const FORMER_KEYS = { "chats.unmute": "chats.mute" };
 /**
  * The most specific key the owner set wins. A built-in default (`DEFAULT_PERMISSIONS`) only ever
  * tightens: against a broader key of the owner's, the stricter of the two holds — so
@@ -236,16 +128,11 @@ const FORMER_KEYS = { "chats.unmute": "chats.mute" };
  * A path nothing names is allowed.
  */
 export const levelFor = (permissions, key, defaults = DEFAULT_PERMISSIONS) => {
-    permissions = canonicalPermissions(permissions);
-    key = canonicalPermissionKey(key);
     const found = profileLevel(permissions, key, defaults);
     const ceiling = permissions[CEILING_KEY];
     return ceiling && ORDER[ceiling] < ORDER[found.level] ? { level: ceiling, key: CEILING_KEY } : found;
 };
 const profileLevel = (permissions, key, defaults) => {
-    const former = FORMER_KEYS[key];
-    if (former !== undefined && permissions[key] === undefined)
-        return profileLevel(permissions, former, defaults);
     const own = nearest(permissions, key);
     const builtIn = nearest(defaults, key);
     if (!builtIn || (own && own.depth >= builtIn.depth))
@@ -254,7 +141,15 @@ const profileLevel = (permissions, key, defaults) => {
         return { level: builtIn.level, key: builtIn.key };
     return { level: own.level, key: own.key };
 };
-const CHAT_KEYS = { settings: "chats.update" };
+const CHAT_KEYS = {
+    settings: "chats.update",
+    "requests.accept": "chats.requests.confirm",
+    "requests.decline": "chats.requests.reject",
+    "link.create": "chats.links.create",
+    "link.reset": "chats.links.reset",
+    "link.revoke": "chats.links.remove",
+    "link.update": "chats.links.update",
+};
 const ACCOUNT_KEYS = {
     "contact-add": "contacts.add",
     "contact-remove": "contacts.remove",
@@ -292,7 +187,7 @@ const KIND_KEYS = {
 /** The command path a guarded write belongs to, when the caller did not name it. */
 export const keyForWrite = (kind, action) => {
     if (kind === "chat")
-        return canonicalPermissionKey(CHAT_KEYS[action ?? ""] ?? `chats.${action ?? "update"}`);
+        return CHAT_KEYS[action] ?? `chats.${action ?? "update"}`;
     if (kind === "account") {
         const key = ACCOUNT_KEYS[action];
         if (!key)
@@ -303,7 +198,6 @@ export const keyForWrite = (kind, action) => {
 };
 /** `keyForWrite` read backwards, as far as a command's key says it: an unpin is a `pin`, a chat change names its action. */
 export const writeOfKey = (key) => {
-    key = canonicalPermissionKey(key);
     const account = Object.entries(ACCOUNT_KEYS).find(([, named]) => named === key)?.[0];
     if (account)
         return { kind: "account", action: account };
@@ -399,8 +293,7 @@ export const WRITE_KEYS = [
         ...Object.values(KIND_KEYS),
         ...Object.values(ACCOUNT_KEYS),
         ...Object.values(CHAT_KEYS),
-        ...PERMISSIONS.flatMap((word) => [...OLD_WORDS[word], ...botKeysOf(word)]),
-    ].map(canonicalPermissionKey)),
+    ]),
 ];
 /** Commands that look after the tool and its files and never show a message: no level stops them. */
 const HOUSEKEEPING = new Set([
@@ -430,21 +323,6 @@ const BOT_HOUSEKEEPING = new Set(["auth", "list", "sends", "recipients", "mcp"])
 const STORE_MAINTENANCE = new Set(["info", "check", "copies"]);
 /** Commands outside `messages` that print what people wrote, so `deny messages` reaches them too. */
 const SHOW_MESSAGES = new Set(["inbox", "review", "watch", "serve", "store", "conversations"]);
-/** Before every search moved under `search` (2026-10-09). */
-const OLD_SEARCH_KEY = /^(bot\.)?(messages|conversations|topics)\.search(?:\.|$)/;
-/** Statistics and searches moved; a deny under an old path would stop applying unseen, so the command refuses. */
-export const assertStatsPermissionsCurrent = (path, permissions) => {
-    if (path[0] === "bot") {
-        assertStatsPermissionsCurrent(path.slice(1), permissions);
-        return;
-    }
-    if (path[0] === "search" && Object.keys(permissions).some((key) => OLD_SEARCH_KEY.test(key)))
-        throw new CliError("configuration_error", "search permission paths have moved — rename messages.search, conversations.search and topics.search to search.messages, search.conversations and search.topics", { retryable: false });
-    if (path[0] !== "stats")
-        return;
-    if (Object.keys(permissions).some((key) => /^(bot\.)?(messages|chats|tasks)\.stats(?:\.|$)/.test(key)))
-        throw new CliError("configuration_error", "statistics permission paths have moved — rename messages.stats, chats.stats and tasks.stats to stats.messages.show, stats.chats.show and stats.tasks.show", { retryable: false });
-};
 export const readKeysForCommand = (path) => {
     if (path[0] === "bot")
         return readKeysForCommand(path.slice(1)).map((key) => `bot.${key}`);
@@ -488,7 +366,6 @@ export const readKeysForCommand = (path) => {
 export const keyForCommand = (path) => {
     if (path.length === 0)
         return null;
-    path = canonicalPermissionKey(path.join(".")).split(".");
     const [top, next] = path;
     if (top === "bot") {
         if (next === undefined || BOT_HOUSEKEEPING.has(next))
@@ -500,7 +377,7 @@ export const keyForCommand = (path) => {
         return path.join(".");
     if (top === undefined || HOUSEKEEPING.has(top) || (top === "search" && next === "runs"))
         return null;
-    // Picture models moved from `models image` (0.270.0); a model is housekeeping wherever it is listed.
+    // A model is housekeeping wherever it is listed.
     if (top === "images" && next === "models")
         return null;
     if (top === "attachments" && (next === "check" || next === "jobs"))
@@ -513,7 +390,7 @@ export const keyForCommand = (path) => {
     if (top === "conversations" && next === "links")
         return path[2] === "rebuild" ? "conversations.links.rebuild" : "conversations.links";
     // Vectors are written to the local store only, and the text never leaves the machine (phase 5 E10).
-    if ((top === "conversations" && next === "embeddings") ||
+    if ((top === "conversations" && (next === "embeddings" || next === "embed")) ||
         (top === "images" && next === "embed") ||
         (top === "conversations" && next === "rebuild"))
         return "conversations.embeddings";
@@ -526,8 +403,6 @@ export const keyForCommand = (path) => {
         return next === "rebuild" || next === "confirm" || next === "reject" ? `mentions.${next}` : "messages";
     if (top === "store" && (next === "gaps" || next === "jobs"))
         return path.join(".");
-    if (top === "messages" && next === "sync")
-        return "messages";
     if (SHOW_MESSAGES.has(top) || (top === "contacts" && (next === "context" || next === "prepare" || next === "events")))
         return "messages";
     if (RESOURCES.includes(top))
@@ -544,12 +419,10 @@ export const permissionOverrides = (entries = []) => {
             throw new CliError("validation_error", "--permission takes a command path and level, e.g. messages.send=allow (deny, readonly, ask, allow)");
         levels[key] = level;
     }
-    return canonicalPermissions(levels);
+    return levels;
 };
 /** No startup flag grants access: an override may narrow the profile's level, never lift it or a key under it. */
 export const assertOverridesTighten = (overrides, profile) => {
-    overrides = canonicalPermissions(overrides);
-    profile = canonicalPermissions(profile);
     for (const [key, level] of Object.entries(overrides)) {
         const under = Object.keys(profile).filter((named) => named.startsWith(`${key}.`));
         const lifted = [key, ...under].find((named) => ORDER[level] > ORDER[levelFor(profile, named).level]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-core",
-  "version": "0.420.0",
+  "version": "0.422.0",
   "description": "The messenger-neutral half of a messaging CLI: domain model, message locators, rendering, name resolution, the SQLite seam, the command skeleton and shared read commands, the send guard, run records and the message store",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",