@wirecat/cli-core 0.560.0 → 0.561.0

package/CHANGELOG.md

@@ -7,6 +7,37 @@ shape of this file.
 
 ## Unreleased
 
+## 0.561.0 — 03.11.2026
+
+### Changed — may break callers
+
+- **`links review` under a profile lock lists only the profile's own link choices.** With `deps.locked`, or without
+  `deps.messages`, only choices about the account's own copies are listed, and a candidate event the account holds no
+  copy of shows its ref alone, so no other account's titles. Unlocked it still lists every account's and names them
+  in `meta.accounts` (WC-ACCT-9); the top-level `accounts: "all"` is gone. Over MCP, `event_links_review` lists only
+  the served accounts' choices. `reviewsAnswer(store, accountIds?)` takes the scope; `calendarAccountNames` names the
+  store's calendar accounts.
+
+### Added
+
+- **`keyedGuard` in `@wirecat/cli-core/sends`:** the guard over a write's main key and its extra keys that the
+  calendar writes use — a key that refuses refuses before anything is asked, one question names every key at `ask`,
+  and `refuse(request)` checks without asking. A CLI's own API writes can now share it instead of a copy.
+- **Calendar times at a terminal are in the zone in use, and the zone is named (WC-TIME-4).** Every shared calendar
+  command hands its host a `view` that prints each time on the zone's wall clock (an all-day event by its dates) and
+  ends with `times in <zone>`. JSON, JSONL and `--compact` are unchanged. `CalendarCommandDeps.write`'s `view` now
+  takes the host's body, which `renderAnswer` passes.
+
+### Fixed
+
+- **`calendars busy` says when the provider did not answer for a calendar or person.** `meta.complete` is false
+  with a `busy.unanswered` issue each (`calendar:<id>` or `person:<email>`), with or without `--duration-minutes`,
+  so free stretches are no longer shown as whole. The command is `partial`, so it still exits 0. `meta` also has
+  `now`, `now_local` and `timezone` (WC-TIME-7).
+- **`events list`'s first help example runs.** It named `starts_at` twice, which the query refuses; it is now
+  `'starts_at:[2026-11-02 TO 2026-11-07}'`, quoted, as are `events export`'s, so zsh does not read the brackets. A
+  test runs every calendar help example with a query.
+
 ## 0.560.0 — 02.11.2026
 
 ### Changed — may break callers

package/dist/calendar/busy.d.ts

@@ -72,4 +72,15 @@ export declare const busyAnswer: (source: CalendarSource, query: BusyQuery, opti
         end: string;
     }[] | undefined;
     unknown?: string[] | undefined;
+    meta: {
+        now: string;
+        now_local: string;
+        timezone: string;
+        complete: boolean;
+        issues?: {
+            code: "authentication_error" | "cancelled" | "configuration_error" | "confirmation_required" | "invalid_response" | "network_error" | "not_found" | "outcome_unknown" | "permission_error" | "provider_error" | "provider_unavailable" | "rate_limited" | "timeout" | "validation_error";
+            reason?: string | undefined;
+            source: string;
+        }[] | undefined;
+    };
 }>;

package/dist/calendar/busy.js

@@ -1,5 +1,6 @@
 import { CliError } from "@wirecat/cli-base";
 import { dayBoundary, queryError, queryFieldsOf, zonedMoment, } from "@wirecat/cli-base/query";
+import { clockMeta } from "@wirecat/cli-base/standards";
 import { LIST_QUERY_GUIDE, listQuery, nativeTermLists, typedQuery } from "../cli/list-query.js";
 import { calendarBusy } from "./cli/answers.js";
 import { isFeedCalendar } from "./feeds.js";
@@ -153,7 +154,13 @@ export const busyAnswer = async (source, query, options) => {
         ...query.calendars.map((calendar) => ({ calendar: String(calendar.id), ...missing(calendar.externalId) })),
         ...query.people.map((person) => ({ person, ...missing(person) })),
     ];
-    const unknown = rows.filter(({ error }) => error !== undefined).map(({ id }) => id);
+    const failed = rows.filter(({ error }) => error !== undefined);
+    const unknown = failed.map(({ id }) => id);
+    const issues = failed.map((row) => ({
+        code: "provider_error",
+        reason: "busy.unanswered",
+        source: "person" in row ? `person:${row.person}` : `calendar:${row.calendar}`,
+    }));
     return {
         ...times(query.window),
         timezone: options.zone,
@@ -169,5 +176,11 @@ export const busyAnswer = async (source, query, options) => {
                 ...(unknown.length ? { unknown } : {}),
             }
             : {}),
+        // Busy times missing for one calendar or person make every free stretch a guess, slots or not.
+        meta: {
+            complete: issues.length === 0,
+            ...(issues.length ? { issues } : {}),
+            ...clockMeta(options.now, options.zone),
+        },
     };
 };

package/dist/calendar/cli/index.d.ts

@@ -40,8 +40,11 @@ export interface CalendarCommandDeps {
         embedded: number;
         left: boolean;
     }>;
-    /** `view` is the text a person reads in place of the default rendering, where a command has one. */
-    write: (value: unknown, format: "json" | "jsonl" | "text", view?: () => string) => void;
+    /**
+     * `view` is the text a person reads in place of the default rendering: the times on the zone's wall clock, and the
+     * zone named. It takes the host's own body (`renderAnswer` passes it) or, without one, renders `value`.
+     */
+    write: (value: unknown, format: "json" | "jsonl" | "text", view?: (body?: unknown) => string) => void;
     /** A line for the person beside the answer, never in it: which accounts `search all` read and which it skipped. */
     note?: (text: string) => void;
     /**
@@ -58,7 +61,10 @@ export interface CalendarCommandDeps {
     writeFile?: (path: string, content: string) => Promise<void>;
     /** Reads `events import`'s file; without it, and the writer's `import`, there is no `events import`. */
     readFile?: (path: string) => Promise<string>;
-    /** A profile lock pins the process (WC-ACCT-5): `events list --source` may then read only the profile's account. */
+    /**
+     * A profile lock pins the process (WC-ACCT-5): `events list --source` may then read only the profile's account, and
+     * `links review` lists only its choices.
+     */
     locked?: boolean;
 }
 export declare const addCalendarCommands: (program: Command, deps: CalendarCommandDeps) => void;

package/dist/calendar/cli/index.js

@@ -16,12 +16,13 @@ import { linkPeople } from "../../services/people.js";
 import { BUSY_QUERY, BUSY_QUERY_NOTE, busyAnswer, busyQuery, workingHoursOf } from "../busy.js";
 import { isFeedCalendar, isPlainHttp, syncWithFeeds } from "../feeds.js";
 import { eventPreparation, nextMeeting, PREPARE_MESSAGES } from "../prepare.js";
-import { accountsMeta, CALENDAR_UNTRUSTED_FIELDS, calendarIn, calendarItem, EVENTS_QUERY, EVENTS_QUERY_NOTE, EXPORT_MAX, eventAnswer, eventIdOf, eventOf, eventsAnswer, eventsFilter, eventsIcs, peopleAnswer, resolveAnswer, reviewsAnswer, sourceAccounts, weekFilter, } from "../reads.js";
+import { accountsMeta, CALENDAR_UNTRUSTED_FIELDS, calendarAccountNames, calendarIn, calendarItem, EVENTS_QUERY, EVENTS_QUERY_NOTE, EXPORT_MAX, eventAnswer, eventIdOf, eventOf, eventsAnswer, eventsFilter, eventsIcs, peopleAnswer, resolveAnswer, reviewsAnswer, sourceAccounts, weekFilter, } from "../reads.js";
 import { REPEAT_HELP } from "../recurrence.js";
 import { bothSearchAnswer, serverSearchAnswer } from "../server-search.js";
 import { calendarStatus } from "../sync.js";
 import { createEvent, createEventFromText, deleteEvent, EVENT_RESPONSES, IMPORT_MAX, importEvents, moveEvent, respondToEvent, updateEvent, } from "../writes.js";
 import { CALENDARS_QUERY, declareCalendarAnswers, PEOPLE_QUERY } from "./answers.js";
+import { localTimesView } from "./local-times.js";
 import { addRemind } from "./remind.js";
 import { addSearchAll } from "./search-all.js";
 const LOCAL_READ = { remote: "none", local: "read" };
@@ -69,7 +70,7 @@ const addCalendarCommandsDefinition = (program, deps) => {
     const zone = () => timezoneOf(deps.timezone);
     const print = (value, command) => {
         const opts = command.optsWithGlobals();
-        deps.write(value, opts.json ? "json" : opts.jsonl ? "jsonl" : "text");
+        deps.write(value, opts.json ? "json" : opts.jsonl ? "jsonl" : "text", (body) => localTimesView(body ?? value, zone(), outputFor(command).color));
     };
     const messages = (what) => {
         if (!deps.messages)
@@ -154,7 +155,7 @@ const addCalendarCommandsDefinition = (program, deps) => {
         });
     }
     if (deps.freeBusy)
-        example(withQuery(annotate(calendars.command("busy"), { effects: REMOTE_READ, offline: false }).description("when calendars and people are taken, asked of the provider and not stored; with --duration-minutes, " +
+        example(withQuery(annotate(calendars.command("busy"), { effects: REMOTE_READ, offline: false, partial: true }).description("when calendars and people are taken, asked of the provider and not stored; with --duration-minutes, " +
             "the free stretches they share"), BUSY_QUERY).addHelpText("after", BUSY_QUERY_NOTE), "calendars busy person:ana@example.com --json", "calendars busy start>=2026-11-02 end<=2026-11-06 person:ana@example.com --duration-minutes 30 " +
             "--hours 10:00-16:00")
             .option("--duration-minutes <minutes>", "find free stretches at least this long, 5–1440", minutes)
@@ -256,7 +257,7 @@ const addCalendarCommandsDefinition = (program, deps) => {
         }), command);
     });
     const events = annotate(program.command("events").description("the account's stored events"), { effects: GROUP });
-    example(withQuery(annotate(events.command("list"), { effects: LOCAL_READ, partial: true }).description("list stored events, earliest first; --source reads several accounts as one list"), EVENTS_QUERY).addHelpText("after", EVENTS_QUERY_NOTE), "events list starts_at>=2026-11-02 starts_at<2026-11-07 --json", "events list ends_at>=today person:ana@example.com", "events list overlapping:true --source all")
+    example(withQuery(annotate(events.command("list"), { effects: LOCAL_READ, partial: true }).description("list stored events, earliest first; --source reads several accounts as one list"), EVENTS_QUERY).addHelpText("after", EVENTS_QUERY_NOTE), "events list 'starts_at:[2026-11-02 TO 2026-11-07}' --json", "events list ends_at>=today person:ana@example.com", "events list overlapping:true --source all")
         .option("--limit <n>", "events per page, 1–1000", integer, 100)
         .option("--page <n>", "which page, starting at 1", integer, 1)
         .option("--source <accounts>", "calendar accounts held in the store to read as one list: all, a provider, or a list such as " +
@@ -285,9 +286,9 @@ const addCalendarCommandsDefinition = (program, deps) => {
         "finds; each occurrence of a repeating event as an event of its own"), EVENTS_QUERY).addHelpText("after", EVENTS_QUERY_NOTE), ...(deps.writeFile
         ? [
             "events export id:42 --output planning.ics",
-            "events export starts_at:[2026-11-02 TO 2026-11-09} NOT event_type:birthday --output week.ics",
+            "events export 'starts_at:[2026-11-02 TO 2026-11-09}' NOT event_type:birthday --output week.ics",
         ]
-        : ["events export id:42", "events export starts_at:[2026-11-02 TO 2026-11-09} NOT event_type:birthday"]));
+        : ["events export id:42", "events export 'starts_at:[2026-11-02 TO 2026-11-09}' NOT event_type:birthday"]));
     // Not over MCP: an agent would choose where on the owner's disk to write. It gets the text in the answer.
     if (deps.writeFile)
         writesFileOnlyWith(exporter.addOption(ownerOnlyOption("--output <file>", "the file to write; printed in the answer when absent")), "output");
@@ -440,7 +441,13 @@ const addCalendarCommandsDefinition = (program, deps) => {
         effects: GROUP,
     });
     example(annotate(links.command("review"), { effects: LOCAL_READ }).description("copies that fit two or more events equally well, waiting for the owner's choice"), "links review --json").action(async (_opts, command) => {
-        print(eachMarked(await reviewsAnswer(deps.store), REVIEW_UNTRUSTED), command);
+        // Locked to a profile (WC-ACCT-5), or with no shared store to name the others by, only the profile's own account.
+        const own = deps.locked || !deps.messages;
+        const answer = await reviewsAnswer(deps.store, own ? [deps.accountId] : undefined);
+        const accounts = own
+            ? [`${deps.account.provider}:${deps.account.account}`]
+            : await calendarAccountNames(deps.store, messages("links review"), deps.account);
+        print({ ...eachMarked(answer, REVIEW_UNTRUSTED), meta: { accounts, complete: true } }, command);
     });
     example(annotate(links.command("resolve"), { effects: LOCAL_WRITE })
         .description("join a copy to the event you choose, or keep it apart")

package/dist/calendar/cli/local-times.d.ts

@@ -0,0 +1,5 @@
+/**
+ * A calendar answer as a person reads it at a terminal (WC-TIME-4): each UTC time on the wall clock of `zone`, an
+ * all-day event's times as its local dates, and a last line naming the zone. JSON keeps the UTC times.
+ */
+export declare const localTimesView: (value: unknown, zone: string, color: boolean) => string;

package/dist/calendar/cli/local-times.js

@@ -0,0 +1,39 @@
+import { renderPretty } from "@wirecat/cli-base";
+const UTC_TIME = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/u;
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/**
+ * A calendar answer as a person reads it at a terminal (WC-TIME-4): each UTC time on the wall clock of `zone`, an
+ * all-day event's times as its local dates, and a last line naming the zone. JSON keeps the UTC times.
+ */
+export const localTimesView = (value, zone, color) => {
+    const clock = new Intl.DateTimeFormat("en-CA", {
+        timeZone: zone,
+        year: "numeric",
+        month: "2-digit",
+        day: "2-digit",
+        hour: "2-digit",
+        minute: "2-digit",
+        hourCycle: "h23",
+    });
+    let shown = false;
+    const local = (text, dateOnly) => {
+        const part = Object.fromEntries(clock.formatToParts(Date.parse(text)).map(({ type, value }) => [type, value]));
+        shown = true;
+        const date = `${part.year}-${part.month}-${part.day}`;
+        return dateOnly ? date : `${date} ${part.hour}:${part.minute}`;
+    };
+    const walk = (one, allDay = false) => {
+        if (typeof one === "string")
+            return UTC_TIME.test(one) ? local(one, allDay) : one;
+        if (Array.isArray(one))
+            return one.map((item) => walk(item));
+        if (!isRecord(one))
+            return one;
+        const dates = one.all_day === true || one.allDay === true;
+        return Object.fromEntries(Object.entries(one).map(([key, item]) => [key, walk(item, dates && /^(starts|ends)_?at$/iu.test(key))]));
+    };
+    const { meta: _meta, ...rest } = isRecord(value) ? value : { value };
+    const body = isRecord(value) ? (Array.isArray(rest.items) ? rest.items : "item" in rest ? rest.item : rest) : value;
+    const text = renderPretty(walk(body), { color });
+    return shown ? `${text}\n\ntimes in ${zone}` : text;
+};

package/dist/calendar/mcp/index.js

@@ -256,7 +256,7 @@ export const callCalendarTool = async (store, name, input, { accountIds, failure
                 break;
             }
             default:
-                answer = await reviewsAnswer(store);
+                answer = await reviewsAnswer(store, accounts);
         }
         const result = { accounts, ...answer, untrusted: CALENDAR_UNTRUSTED_FIELDS };
         return agentResult({

package/dist/calendar/reads.d.ts

@@ -168,7 +168,12 @@ export declare const peopleAnswer: (store: EventStore, accountId: number, option
     };
 }>;
 /** Open link choices, with each candidate event's title and time so the owner can pick. */
-export declare const reviewsAnswer: (store: EventStore) => Promise<{
+/**
+ * Open link choices on calendar copies. Link choices are kept per store, so without `accountIds` every account's are
+ * listed; with them, only choices about those accounts' copies, and a candidate event none of them holds a copy of is
+ * shown by its ref alone.
+ */
+export declare const reviewsAnswer: (store: EventStore, accountIds?: readonly number[]) => Promise<{
     limit: number;
     hasMore: boolean;
     items: {
@@ -182,8 +187,12 @@ export declare const reviewsAnswer: (store: EventStore) => Promise<{
         }[];
     }[];
     page: number;
-    accounts: string;
 }>;
+/**
+ * The calendar accounts the store holds, by `provider:account`: the stored accounts with a calendar, and the running
+ * one. What `links review` names when it reads every account (WC-ACCT-9).
+ */
+export declare const calendarAccountNames: (store: EventStore, messages: MessageStore, running: AccountKey) => Promise<string[]>;
 export declare const resolveAnswer: (store: EventStore, accountId: number, review: string, choice: string, now: number) => Promise<{
     id: string;
     status: "apart" | "linked" | "open";

package/dist/calendar/reads.js

@@ -348,25 +348,41 @@ export const peopleAnswer = async (store, accountId, options) => {
     return hasMore ? { ...answer, meta: { complete: true, truncated: true } } : answer;
 };
 /** Open link choices, with each candidate event's title and time so the owner can pick. */
-export const reviewsAnswer = async (store) => {
-    const open = (await store.reviews({ status: "open" })).filter(({ linkableType }) => linkableType === "calendar_entry");
-    return {
-        ...listed(await Promise.all(open.map(async (review) => ({
-            id: String(review.id),
-            entry_id: String(review.linkableId),
-            reason: review.reason,
-            candidates: await Promise.all(review.candidates.map(async (id) => {
-                const event = review.entityType === "event" ? (await store.event(id))?.event : undefined;
-                return {
-                    ref: `event:${id}`,
-                    title: event?.title ?? null,
-                    starts_at: iso(event?.startsAt ?? null),
-                };
-            })),
-        })))),
-        // Link choices are kept per store, not per account, so every calendar account's are listed.
-        accounts: "all",
+/**
+ * Open link choices on calendar copies. Link choices are kept per store, so without `accountIds` every account's are
+ * listed; with them, only choices about those accounts' copies, and a candidate event none of them holds a copy of is
+ * shown by its ref alone.
+ */
+export const reviewsAnswer = async (store, accountIds) => {
+    const scope = accountIds &&
+        new Set((await Promise.all(accountIds.map((id) => calendarIds(store, id)))).flatMap((ids) => [...ids]));
+    const open = (await store.reviews({ status: "open" })).filter(({ linkableType, calendarId }) => linkableType === "calendar_entry" && (!scope || (calendarId !== null && scope.has(calendarId))));
+    const shown = async (review, id) => {
+        const details = review.entityType === "event" ? await store.event(id) : undefined;
+        if (!details || (scope && !details.entries.some(({ calendarId }) => scope.has(calendarId))))
+            return undefined;
+        return details.event;
     };
+    return listed(await Promise.all(open.map(async (review) => ({
+        id: String(review.id),
+        entry_id: String(review.linkableId),
+        reason: review.reason,
+        candidates: await Promise.all(review.candidates.map(async (id) => {
+            const event = await shown(review, id);
+            return { ref: `event:${id}`, title: event?.title ?? null, starts_at: iso(event?.startsAt ?? null) };
+        })),
+    }))));
+};
+/**
+ * The calendar accounts the store holds, by `provider:account`: the stored accounts with a calendar, and the running
+ * one. What `links review` names when it reads every account (WC-ACCT-9).
+ */
+export const calendarAccountNames = async (store, messages, running) => {
+    const names = new Set([nameOf(running)]);
+    for (const one of await messages.accounts.storedAccounts())
+        if ((await store.calendars(one.id)).length)
+            names.add(nameOf(one));
+    return [...names];
 };
 export const resolveAnswer = async (store, accountId, review, choice, now) => {
     if (!/^[1-9]\d*$/u.test(review))

package/dist/calendar/writes.js

@@ -3,6 +3,7 @@ import { CliError, isCliError } from "@wirecat/cli-base";
 import { zonedMoment } from "@wirecat/cli-base/query";
 import { guardFor } from "../sends/guard.js";
 import { guardedWrite } from "../sends/guarded.js";
+import { keyedGuard } from "../sends/keyed-guard.js";
 import { DEFAULT_PERMISSIONS, levelFor } from "../sends/permissions.js";
 import { newOperationId } from "../sends/send-id.js";
 import { isFeedCalendar } from "./feeds.js";
@@ -85,53 +86,11 @@ export const draftOf = (fields, zone, { whole, allDay = false }) => {
         throw new CliError("validation_error", "nothing to change");
     return patch;
 };
-/**
- * Over the profile's guard, the write's other keys are checked too. A key that refuses is refused before anything is
- * asked, so nobody answers yes to a write that a stricter key then stops, and one answer covers every key of a write.
- */
+/** The profile's guard over the write's main key and its other keys (`keyedGuard`). */
 const writeGuard = (context, extra) => {
     const settings = context.writes.settings();
     const defaults = { ...DEFAULT_PERMISSIONS, ...CALENDAR_WRITE_DEFAULTS, ...settings.permissionDefaults };
-    let question;
-    let answered = false;
-    const guard = guardFor(context.writes.app, { ...settings, permissionDefaults: defaults }, context.writes.warn ?? (() => { }), context.writes.env, async (key, request) => {
-        if (answered)
-            return;
-        await context.ask(question ?? key, request);
-        answered = true;
-    });
-    const probes = new WeakMap();
-    // A probe is checked and never journaled or counted: the write itself holds the one journal line.
-    const all = (request) => {
-        let found = probes.get(request);
-        if (!found) {
-            found = extra.map((key) => ({ chatId: null, kind: "read", key }));
-            probes.set(request, found);
-        }
-        return [request, ...found];
-    };
-    return {
-        ask: async (request) => {
-            const levelOf = ({ key }) => levelFor(settings.permissions, key, defaults).level;
-            const refused = all(request).find((one) => ["deny", "readonly"].includes(levelOf(one)));
-            if (refused)
-                guard.check(refused, { reserve: false });
-            // The one question names every key that asks, so a yes to the write is never a silent yes to mailing people.
-            question = all(request)
-                .filter((one) => levelOf(one) === "ask")
-                .map(({ key }) => key)
-                .join(" and ");
-            for (const one of all(request))
-                await guard.ask?.(one);
-        },
-        check: (request, options) => {
-            for (const one of all(request).slice(1))
-                guard.check(one, { reserve: false });
-            guard.check(request, options);
-        },
-        ...(guard.reserve ? { reserve: guard.reserve } : {}),
-        record: (entry) => guard.record(entry),
-    };
+    return keyedGuard((ask) => guardFor(context.writes.app, { ...settings, permissionDefaults: defaults }, context.writes.warn ?? (() => { }), context.writes.env, ask), context.ask, (key) => levelFor(settings.permissions, key, defaults).level, extra);
 };
 const notifyOf = (context, choice, others) => {
     if (choice !== undefined)

package/dist/errors/reasons.js

@@ -107,6 +107,7 @@ const OTHERS = [
     ["meetings.index-pending", "not_found", "some stored meetings are not indexed by person yet"],
     ["profile.locked", "permission_error", "a profile lock pins this process to its own account"],
     ["busy.offline", "permission_error", "calendars busy asks the provider; --offline was given"],
+    ["busy.unanswered", "provider_error", "the provider gave no busy times for a calendar or person that was asked"],
     validation("busy.no-calendars", "no calendar syncs and no person was named, so there is nobody to ask"),
     ["search.offline", "permission_error", "search --backend server asks the provider; --offline was given"],
     validation("search.no-calendars", "no calendar of this profile syncs yet, so the provider has nothing to search"),

package/dist/meetings/mcp/index.d.ts

@@ -38,6 +38,7 @@ export declare const meetingTools: ({
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -53,11 +54,11 @@ export declare const meetingTools: ({
             format?: undefined;
             transcript_id?: undefined;
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -75,11 +76,11 @@ export declare const meetingTools: ({
             format?: undefined;
             transcript_id?: undefined;
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -101,7 +102,6 @@ export declare const meetingTools: ({
                 minimum: number;
             };
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
@@ -188,6 +188,7 @@ export declare const meetingTools: ({
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -203,11 +204,11 @@ export declare const meetingTools: ({
             format?: undefined;
             transcript_id?: undefined;
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -225,11 +226,11 @@ export declare const meetingTools: ({
             format?: undefined;
             transcript_id?: undefined;
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -251,7 +252,6 @@ export declare const meetingTools: ({
                 minimum: number;
             };
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
@@ -338,6 +338,7 @@ export declare const meetingTools: ({
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -353,11 +354,11 @@ export declare const meetingTools: ({
             format?: undefined;
             transcript_id?: undefined;
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -375,11 +376,11 @@ export declare const meetingTools: ({
             format?: undefined;
             transcript_id?: undefined;
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -401,7 +402,6 @@ export declare const meetingTools: ({
                 minimum: number;
             };
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
@@ -488,6 +488,7 @@ export declare const meetingTools: ({
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -503,11 +504,11 @@ export declare const meetingTools: ({
             format?: undefined;
             transcript_id?: undefined;
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -525,11 +526,11 @@ export declare const meetingTools: ({
             format?: undefined;
             transcript_id?: undefined;
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -551,7 +552,6 @@ export declare const meetingTools: ({
                 minimum: number;
             };
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
@@ -638,6 +638,7 @@ export declare const meetingTools: ({
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -653,11 +654,11 @@ export declare const meetingTools: ({
             format?: undefined;
             transcript_id?: undefined;
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -675,11 +676,11 @@ export declare const meetingTools: ({
             format?: undefined;
             transcript_id?: undefined;
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -701,7 +702,6 @@ export declare const meetingTools: ({
                 minimum: number;
             };
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;

package/dist/sends/index.d.ts

@@ -3,6 +3,7 @@ export { type FloodDeadline, FloodMemory, type FloodState, FROZEN_HOLD_MS, flood
 export { type Asker, type GuardRequest, guardFor, type SendGuard, type SendGuardOptions, sendGuard, sharedJournal, } from "./guard.js";
 export { currentOperation, guardedWrite, type Operated } from "./guarded.js";
 export { type AccountAction, type ChatAction, type SendEntry, SendJournal, type SendKind, type SendOutcome, sendsPathFor, } from "./journal.js";
+export { type KeyedGuard, keyedGuard } from "./keyed-guard.js";
 export { DEFAULT_PACE, type PaceRate, Pacer, pacePathFor } from "./pace.js";
 export { assertOverridesTighten, CEILING_KEY, COMMAND_PATH_KEY, DEFAULT_PERMISSIONS, keyForCommand, keyForWrite, LEVELS, type Level, layerPermissions, levelFor, type PermissionKey, permissionOverrides, readKeysForCommand, skipFlagFor, WRITE_KEYS, } from "./permissions.js";
 export { type Recipient, RecipientList, recipientsPathFor } from "./recipients.js";

package/dist/sends/index.js

@@ -2,6 +2,7 @@ export { FloodMemory, FROZEN_HOLD_MS, floodPathFor, LIMITED_HOLD_MS, } from "./f
 export { guardFor, sendGuard, sharedJournal, } from "./guard.js";
 export { currentOperation, guardedWrite } from "./guarded.js";
 export { SendJournal, sendsPathFor, } from "./journal.js";
+export { keyedGuard } from "./keyed-guard.js";
 export { DEFAULT_PACE, Pacer, pacePathFor } from "./pace.js";
 export { assertOverridesTighten, CEILING_KEY, COMMAND_PATH_KEY, DEFAULT_PERMISSIONS, keyForCommand, keyForWrite, LEVELS, layerPermissions, levelFor, permissionOverrides, readKeysForCommand, skipFlagFor, WRITE_KEYS, } from "./permissions.js";
 export { RecipientList, recipientsPathFor } from "./recipients.js";

package/dist/sends/keyed-guard.d.ts

@@ -0,0 +1,12 @@
+import type { Asker, GuardRequest, SendGuard } from "./guard.js";
+import type { Level, PermissionKey } from "./permissions.js";
+export type KeyedGuard = SendGuard & {
+    /** Refuses the write when one of its keys denies it or is read-only; asks nothing. */
+    refuse(request: GuardRequest): void;
+};
+/**
+ * A guard over a write's main key and its extra keys. A key that refuses refuses before anything is asked, so nobody
+ * answers yes to a write that a stricter key then stops, and one question names every key at `ask`. The extra keys are
+ * probed as reads, never journaled or counted: the write itself holds the one journal line.
+ */
+export declare const keyedGuard: (build: (ask: Asker) => SendGuard, ask: Asker, levelOf: (key: PermissionKey) => Level, extra: readonly PermissionKey[]) => KeyedGuard;

package/dist/sends/keyed-guard.js

@@ -0,0 +1,49 @@
+/**
+ * A guard over a write's main key and its extra keys. A key that refuses refuses before anything is asked, so nobody
+ * answers yes to a write that a stricter key then stops, and one question names every key at `ask`. The extra keys are
+ * probed as reads, never journaled or counted: the write itself holds the one journal line.
+ */
+export const keyedGuard = (build, ask, levelOf, extra) => {
+    let question;
+    let answered = false;
+    const guard = build(async (key, request) => {
+        if (answered)
+            return;
+        await ask(question || key, request);
+        answered = true;
+    });
+    const probes = new WeakMap();
+    const all = (request) => {
+        let found = probes.get(request);
+        if (!found) {
+            found = extra.map((key) => ({ chatId: null, kind: "read", key }));
+            probes.set(request, found);
+        }
+        return [request, ...found];
+    };
+    const levelOfRequest = ({ key }) => levelOf(key ?? "");
+    const refuse = (request) => {
+        const refused = all(request).find((one) => ["deny", "readonly"].includes(levelOfRequest(one)));
+        if (refused)
+            guard.check(refused, { reserve: false });
+    };
+    return {
+        refuse,
+        ask: async (request) => {
+            refuse(request);
+            question = all(request)
+                .filter((one) => levelOfRequest(one) === "ask")
+                .map(({ key }) => key)
+                .join(" and ");
+            for (const one of all(request))
+                await guard.ask?.(one);
+        },
+        check: (request, options) => {
+            for (const one of all(request).slice(1))
+                guard.check(one, { reserve: false });
+            guard.check(request, options);
+        },
+        ...(guard.reserve ? { reserve: guard.reserve } : {}),
+        record: (entry) => guard.record(entry),
+    };
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-core",
-  "version": "0.560.0",
+  "version": "0.561.0",
   "description": "The messenger-neutral half of a messaging CLI: domain model, message locators, rendering, name resolution, the SQLite seam, the command skeleton and shared read commands, the send guard, run records and the message store",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",