@wirecat/zoom-cli 0.56.0 → 0.57.0

package/dist/bundle/chunk-R3HPOCZD.js

@@ -0,0 +1,188 @@
+import { createRequire as __bundleRequire } from "node:module";
+const require = __bundleRequire(import.meta.url);
+import {
+  checkCancelled,
+  object
+} from "./chunk-A4ETXPMZ.js";
+import {
+  CliError,
+  isCliError
+} from "./chunk-AE4BOXH7.js";
+import {
+  __name
+} from "./chunk-ZVVMGPBJ.js";
+
+// dist/tokens.js
+var TOKEN_LOG_ALLOW = ["rotated", "saved", "pid"];
+var TOKEN_LOG_EVENT = "zoom.token.exchange";
+var abortReason = /* @__PURE__ */ __name((parent) => !parent?.aborted ? "timeout" : isCliError(parent.reason) ? parent.reason.code : "cancelled", "abortReason");
+var TokenManager = class _TokenManager {
+  static {
+    __name(this, "TokenManager");
+  }
+  options;
+  refreshState = /* @__PURE__ */ new Map();
+  constructor(options) {
+    this.options = options;
+  }
+  /** The login of one profile: `<client id>:<profile>` in the keyring. */
+  forProfile(profile) {
+    const parent = this.options;
+    const scoped = new _TokenManager({
+      get clientId() {
+        return parent.clientId;
+      },
+      get account() {
+        return `${parent.clientId}:${profile}`;
+      },
+      keyring: parent.keyring,
+      service: parent.service,
+      fetch: parent.fetch,
+      now: parent.now,
+      log: parent.log,
+      signal: parent.signal
+    });
+    scoped.refreshState = this.refreshState;
+    return scoped;
+  }
+  withSignal(signal, fetcher = this.options.fetch) {
+    const parent = this.options;
+    let login;
+    const pinned = /* @__PURE__ */ __name(() => login ??= { clientId: parent.clientId, account: parent.account }, "pinned");
+    const scoped = new _TokenManager({
+      get clientId() {
+        return pinned().clientId;
+      },
+      get account() {
+        return pinned().account;
+      },
+      keyring: parent.keyring,
+      service: parent.service,
+      fetch: fetcher,
+      now: parent.now,
+      log: parent.log,
+      signal: signal && parent.signal ? AbortSignal.any([signal, parent.signal]) : signal ?? parent.signal
+    });
+    scoped.refreshState = this.refreshState;
+    return scoped;
+  }
+  accountOf() {
+    return this.options.account ?? this.options.clientId;
+  }
+  read(account) {
+    try {
+      return this.options.keyring.get(this.options.service, account);
+    } catch {
+      throw new CliError("configuration_error", "system keyring is unavailable");
+    }
+  }
+  load(account = this.accountOf()) {
+    const saved = this.read(account);
+    if (!saved)
+      return null;
+    try {
+      const value = object(JSON.parse(saved));
+      if (typeof value.accessToken !== "string" || !value.accessToken || typeof value.refreshToken !== "string" || !value.refreshToken || typeof value.expiresAt !== "number" || !Number.isFinite(value.expiresAt) || !Array.isArray(value.scopes) || !value.scopes.every((s) => typeof s === "string"))
+        throw new Error("invalid token entry");
+      return {
+        accessToken: value.accessToken,
+        refreshToken: value.refreshToken,
+        expiresAt: value.expiresAt,
+        scopes: value.scopes
+      };
+    } catch (error) {
+      if (isCliError(error) && error.code === "configuration_error")
+        throw error;
+      throw new CliError("authentication_error", "saved login is invalid; run zm <profile> session start again, or sign in from WireCat Desktop (Tools \u2192 Zoom \u2192 Manage)");
+    }
+  }
+  save(tokens, account = this.accountOf()) {
+    try {
+      this.options.keyring.set(this.options.service, account, JSON.stringify(tokens));
+    } catch {
+      throw new CliError("configuration_error", "could not save login to the system keyring");
+    }
+  }
+  async exchange(params, previous, clientId = this.options.clientId, account = this.options.account ?? clientId) {
+    checkCancelled(this.options.signal);
+    const signal = this.options.signal ? AbortSignal.any([this.options.signal, AbortSignal.timeout(3e4)]) : AbortSignal.timeout(3e4);
+    const parent = this.options.signal;
+    const record = /* @__PURE__ */ __name((level, fields) => this.options.log?.[level]({
+      event: TOKEN_LOG_EVENT,
+      operation: params.grant_type ?? "unknown",
+      pid: process.pid,
+      ...signal.aborted ? { reason: abortReason(parent) } : {},
+      ...fields
+    }), "record");
+    let response;
+    try {
+      response = await this.options.fetch("https://zoom.us/oauth/token", {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ ...params, client_id: clientId }),
+        signal,
+        redirect: "error"
+      });
+    } catch {
+      record("warn", { outcome: "no_response" });
+      throw new CliError("outcome_unknown", "Zoom token exchange did not finish; run zm <profile> session start again before retrying");
+    }
+    if (!response.ok) {
+      record("warn", { outcome: "rejected", status: response.status });
+      throw new CliError("authentication_error", `Zoom token request failed (HTTP ${response.status}); run zm <profile> session start again`);
+    }
+    let body;
+    try {
+      body = object(await response.json());
+    } catch {
+      record("error", { outcome: "unreadable_response", status: response.status });
+      throw new CliError("outcome_unknown", "Zoom returned an invalid token response; run zm <profile> session start again before retrying");
+    }
+    const refreshToken = typeof body.refresh_token === "string" ? body.refresh_token : previous?.refreshToken;
+    if (typeof body.access_token !== "string" || !body.access_token || !refreshToken || typeof body.expires_in !== "number" || !Number.isFinite(body.expires_in) || body.expires_in <= 0 || !Number.isFinite((this.options.now?.() ?? Date.now()) + body.expires_in * 1e3) || body.scope !== void 0 && typeof body.scope !== "string" || body.refresh_token !== void 0 && typeof body.refresh_token !== "string") {
+      record("error", { outcome: "invalid_response", status: response.status });
+      throw new CliError("outcome_unknown", "Zoom returned an invalid token response; run zm <profile> session start again before retrying");
+    }
+    const rotated = previous ? { rotated: refreshToken !== previous.refreshToken } : {};
+    const tokens = {
+      accessToken: body.access_token,
+      refreshToken,
+      expiresAt: (this.options.now?.() ?? Date.now()) + body.expires_in * 1e3,
+      scopes: typeof body.scope === "string" ? body.scope.split(/\s+/).filter(Boolean) : previous?.scopes ?? []
+    };
+    try {
+      this.save(tokens, account);
+    } catch (error) {
+      record("error", { outcome: "save_failed", status: response.status, ...rotated, saved: false });
+      throw error;
+    }
+    record("info", { outcome: "saved", status: response.status, ...rotated, saved: true });
+    return tokens;
+  }
+  async tokens() {
+    checkCancelled(this.options.signal);
+    const clientId = this.options.clientId;
+    const account = this.options.account ?? clientId;
+    const saved = this.load(account);
+    if (!saved)
+      throw new CliError("authentication_error", "run zm <profile> session start first, or sign in from WireCat Desktop (Tools \u2192 Zoom \u2192 Manage)");
+    if (saved.expiresAt > (this.options.now?.() ?? Date.now()) + 3e4)
+      return saved;
+    let refreshing = this.refreshState.get(account);
+    if (!refreshing) {
+      refreshing = this.exchange({ grant_type: "refresh_token", refresh_token: saved.refreshToken }, saved, clientId, account).finally(() => {
+        this.refreshState.delete(account);
+      });
+      this.refreshState.set(account, refreshing);
+    }
+    const refreshed = await refreshing;
+    checkCancelled(this.options.signal);
+    return refreshed;
+  }
+};
+
+export {
+  TOKEN_LOG_ALLOW,
+  TOKEN_LOG_EVENT,
+  TokenManager
+};

package/dist/bundle/chunk-RMV4C2YL.js

@@ -0,0 +1,482 @@
+import { createRequire as __bundleRequire } from "node:module";
+const require = __bundleRequire(import.meta.url);
+import {
+  LEVELS
+} from "./chunk-TKCHUT2H.js";
+import {
+  CliError,
+  array,
+  getDotPath,
+  integer,
+  minLength,
+  minValue,
+  nullable,
+  number,
+  optional,
+  picklist,
+  pipe,
+  record,
+  regex,
+  resolvePaths,
+  safeParse,
+  singleLine,
+  strictObject,
+  string,
+  transform,
+  unknown,
+  visibleControls,
+  writeSecurely
+} from "./chunk-AE4BOXH7.js";
+import {
+  __name
+} from "./chunk-ZVVMGPBJ.js";
+
+// node_modules/.pnpm/@wirecat+cli-core@0.469.0_@wirecat+cli-base@0.65.0_commander@15.0.0_typescript@7.0.2_vi_80b586dbc8b099637a6e461856c2ee6b/node_modules/@wirecat/cli-core/dist/resolve.js
+var isId = /* @__PURE__ */ __name((reference) => /^-?\d+$/.test(reference.trim()), "isId");
+var foldName = /* @__PURE__ */ __name((name) => name.normalize("NFC").replace(/[\uFE0E\uFE0F\u200D]/g, "").toLowerCase(), "foldName");
+var pickChat = /* @__PURE__ */ __name((reference, chats) => {
+  const wanted = foldName(reference.trim());
+  const matches = chats.filter((chat) => chat.title !== null && foldName(chat.title).includes(wanted));
+  if (matches.length === 1 && matches[0])
+    return matches[0];
+  if (matches.length === 0)
+    throw new CliError("not_found", `no chat matches "${reference}"`);
+  throw ambiguous(reference, "chats", matches.map((chat) => ({ id: chat.id, title: chat.title })), ({ title }) => singleLine(String(title)));
+}, "pickChat");
+var pickPerson = /* @__PURE__ */ __name((reference, people) => {
+  const trimmed = reference.trim();
+  const known = people.get(trimmed);
+  if (known)
+    return known;
+  if (isId(trimmed))
+    throw new CliError("not_found", `no person ${trimmed} in what this account has seen`);
+  const wanted = foldName(trimmed.replace(/^@/, ""));
+  const everyone = people.all().toSorted((a, b) => (a.name ?? "").localeCompare(b.name ?? ""));
+  const fields = /* @__PURE__ */ __name((person) => [person.alias, person.name, person.username].filter(isPresent).map(foldName), "fields");
+  const exact = everyone.filter((person) => fields(person).includes(wanted));
+  const matches = exact.length > 0 ? exact : everyone.filter((person) => fields(person).some((one) => one.includes(wanted)));
+  if (matches.length === 1 && matches[0])
+    return matches[0];
+  if (matches.length === 0)
+    throw new CliError("not_found", `nobody matches "${reference}"`);
+  throw ambiguous(reference, "people", matches.map(({ id, name, username }) => ({ id, name, username })), ({ name, username }) => singleLine([name, username && `@${username}`].filter(isPresent).join("  ")));
+}, "pickPerson");
+var ambiguous = /* @__PURE__ */ __name((reference, what, candidates, label) => {
+  const width = Math.max(...candidates.map(({ id }) => id.length));
+  const lines = candidates.map((candidate) => `  ${candidate.id.padEnd(width)}  ${label(candidate)}`).join("\n");
+  return new CliError("validation_error", `"${singleLine(reference)}" matches ${candidates.length} ${what} \u2014 name one by its id:
+${lines}`, { candidates });
+}, "ambiguous");
+var isPresent = /* @__PURE__ */ __name((value) => value !== null && value !== void 0, "isPresent");
+
+// node_modules/.pnpm/@wirecat+cli-core@0.469.0_@wirecat+cli-base@0.65.0_commander@15.0.0_typescript@7.0.2_vi_80b586dbc8b099637a6e461856c2ee6b/node_modules/@wirecat/cli-core/dist/domain/formatting.js
+var invalid = /* @__PURE__ */ __name(() => new CliError("validation_error", "the messenger formatter returned invalid text spans"), "invalid");
+var validateFormattedText = /* @__PURE__ */ __name((formatted) => {
+  const { text, spans } = formatted;
+  if (typeof text !== "string" || !Array.isArray(spans) || spans.length > 100)
+    throw invalid();
+  const boundary = /* @__PURE__ */ __name((at) => !(at > 0 && at < text.length && /[\uD800-\uDBFF]/u.test(text[at - 1] ?? "") && /[\uDC00-\uDFFF]/u.test(text[at] ?? "")), "boundary");
+  for (const span of spans) {
+    if (![
+      "bold",
+      "italic",
+      "strike",
+      "underline",
+      "code",
+      "pre",
+      "link",
+      "blockquote",
+      "spoiler",
+      "highlight",
+      "heading"
+    ].includes(span.type) || !Number.isInteger(span.from) || !Number.isInteger(span.length) || span.from < 0 || span.length <= 0 || span.from + span.length > text.length || !boundary(span.from) || !boundary(span.from + span.length))
+      throw invalid();
+    if (span.type === "link") {
+      if (!span.url || Array.from(span.url).some((char) => char.charCodeAt(0) <= 32 || char.charCodeAt(0) === 127))
+        throw new CliError("validation_error", "a Markdown link needs an absolute http, https or mailto URL");
+      let url;
+      try {
+        url = new URL(span.url);
+      } catch {
+        throw new CliError("validation_error", "a Markdown link needs an absolute http, https or mailto URL");
+      }
+      if (!["http:", "https:", "mailto:"].includes(url.protocol))
+        throw new CliError("validation_error", "Markdown links support http, https and mailto URLs");
+    }
+  }
+  return formatted;
+}, "validateFormattedText");
+var visibleFormattedText = /* @__PURE__ */ __name((formatted) => {
+  validateFormattedText(formatted);
+  const text = visibleControls(formatted.text);
+  const positions = /* @__PURE__ */ new Map([[0, 0]]);
+  let original = 0;
+  let visible = 0;
+  for (const character of formatted.text) {
+    const rendered = text.startsWith(character, visible) ? character : visibleControls(character);
+    original += character.length;
+    visible += rendered.length;
+    positions.set(original, visible);
+  }
+  return {
+    text,
+    spans: formatted.spans.map((span) => ({
+      ...span,
+      from: positions.get(span.from),
+      length: positions.get(span.from + span.length) - positions.get(span.from),
+      ...span.url === void 0 ? {} : { url: visibleControls(span.url) }
+    }))
+  };
+}, "visibleFormattedText");
+
+// node_modules/.pnpm/@wirecat+cli-core@0.469.0_@wirecat+cli-base@0.65.0_commander@15.0.0_typescript@7.0.2_vi_80b586dbc8b099637a6e461856c2ee6b/node_modules/@wirecat/cli-core/dist/moderation/check.js
+var INVITE = /max\.ru\/join\/|(t|telegram)\.me\/(\+|joinchat\/)|tg:\/\/join/i;
+var LINK = /https?:\/\/\S+/i;
+var STRENGTH = { report: 0, delete: 1, remove: 2 };
+var judge = /* @__PURE__ */ __name(({ rules, messages, joined, answerers, service, now, invites }) => {
+  const invite = invites ? new RegExp(`${INVITE.source}|${invites.source}`, "i") : INVITE;
+  const trusted = new Set(rules.trusted);
+  const blocked = /* @__PURE__ */ __name((id, name) => id !== null && rules.blocked.includes(id) || name !== null && rules.blockedNames.some((part) => name.toLocaleLowerCase().includes(part.toLocaleLowerCase())), "blocked");
+  const young = /* @__PURE__ */ __name((member) => rules.newAccount.days > 0 && typeof member.registeredAt === "string" && now - Date.parse(member.registeredAt) < rules.newAccount.days * 864e5, "young");
+  const found = [];
+  const add = /* @__PURE__ */ __name((finding) => {
+    if (finding.action === "remove" && found.some((f) => f.action === "remove" && f.personId === finding.personId)) {
+      return;
+    }
+    found.push(finding);
+  }, "add");
+  for (const member of joined) {
+    if (trusted.has(member.id) || answerers.has(member.id))
+      continue;
+    const person = { kind: "member", personId: member.id, personName: member.name };
+    if (blocked(member.id, member.name)) {
+      add({ ...person, rule: "blocked", action: rules.blockedPeople === "remove" ? "remove" : "report" });
+    } else if (young(member)) {
+      add({ ...person, rule: "newAccount", action: rules.newAccount.action });
+    }
+  }
+  const flooding = floodOf(messages, rules.flood);
+  for (const message of messages) {
+    const id = message.senderId;
+    if (id === null || message.outgoing === true || answerers.has(id) || trusted.has(id))
+      continue;
+    if (service.has(message.id) || message.attachments.some((attachment) => attachment.kind === "control"))
+      continue;
+    const base = { kind: "message", personId: id, personName: message.senderName, messageId: message.id };
+    const text = message.text;
+    const broken2 = [];
+    if (blocked(id, message.senderName))
+      broken2.push(["blocked", rules.blockedPeople]);
+    if (invite.test(text))
+      broken2.push(["invites", rules.invites]);
+    if (LINK.test(text) || message.attachments.some((attachment) => attachment.kind === "share")) {
+      broken2.push(["links", rules.links]);
+    }
+    if (message.forwardedFrom !== null)
+      broken2.push(["forwards", rules.forwards]);
+    if (flooding.has(message.id))
+      broken2.push(["flood", rules.flood.action]);
+    const strongest = broken2.reduce((best, rule) => best === void 0 || STRENGTH[rule[1]] > STRENGTH[best[1]] ? rule : best, void 0);
+    if (strongest)
+      add({ ...base, rule: strongest[0], action: strongest[1] });
+  }
+  return found;
+}, "judge");
+var floodOf = /* @__PURE__ */ __name((messages, flood) => {
+  const window = flood.minutes * 6e4;
+  const over = /* @__PURE__ */ new Set();
+  const bySender = /* @__PURE__ */ new Map();
+  for (const message of messages) {
+    if (message.senderId === null)
+      continue;
+    const times = bySender.get(message.senderId) ?? [];
+    const at = Date.parse(message.timestamp);
+    times.push(at);
+    bySender.set(message.senderId, times);
+    if (times.filter((time) => at - time < window).length > flood.messages)
+      over.add(message.id);
+  }
+  return over;
+}, "floodOf");
+var act = /* @__PURE__ */ __name(async (moderator, findings, options) => {
+  const { chatId, rules, allowDangerous, dryRun, maxActions, confirm, command } = options;
+  const typed = options.commandFor ?? ((chat, finding) => commandFor(command, chat, finding));
+  const rows = [];
+  let acted = 0;
+  let stopped;
+  for (const finding of findings) {
+    if (finding.action === "report") {
+      rows.push({ ...finding, outcome: "reported" });
+      continue;
+    }
+    const consent = finding.action;
+    const level2 = rules.consent[consent];
+    const row = /* @__PURE__ */ __name((outcome, reason) => ({
+      ...finding,
+      outcome,
+      ...reason ? { reason } : {},
+      ...outcome === "done" || outcome === "reported" ? {} : { command: typed(chatId, finding) }
+    }), "row");
+    if (level2 === "deny") {
+      rows.push(row("forbidden", `consent.${consent} is deny`));
+      continue;
+    }
+    if (level2 === "readonly") {
+      rows.push(row("reported", `consent.${consent} is readonly`));
+      continue;
+    }
+    if (dryRun) {
+      rows.push(row("planned", "--dry-run"));
+      continue;
+    }
+    if (stopped || acted >= maxActions) {
+      rows.push(row("skipped", stopped ?? `over the limit of ${maxActions} actions per check`));
+      continue;
+    }
+    if (level2 === "ask" && !allowDangerous) {
+      const yes = confirm ? await confirm(finding) : void 0;
+      if (yes === void 0) {
+        rows.push(row("planned", `consent.${consent} is ask, and nobody is there to answer \u2014 run with --allow-dangerous`));
+        continue;
+      }
+      if (!yes) {
+        rows.push(row("declined", "the answer was no"));
+        continue;
+      }
+    }
+    acted += 1;
+    try {
+      if (finding.action === "delete" && finding.messageId) {
+        await moderator.deleteMessage(chatId, finding.messageId);
+      } else {
+        await moderator.removePerson(chatId, finding.personId);
+      }
+      rows.push(row("done"));
+    } catch (error) {
+      const failure = asCliError(error);
+      if (failure.code === "rate_limited")
+        stopped = failure.message;
+      const refused = ["rate_limited", "permission_error", "confirmation_required"].includes(failure.code);
+      rows.push(row(refused ? "refused" : "failed", failure.message));
+    }
+  }
+  return rows;
+}, "act");
+var asCliError = /* @__PURE__ */ __name((error) => error instanceof CliError ? error : new CliError("provider_error", error instanceof Error ? error.message : String(error)), "asCliError");
+var who = /* @__PURE__ */ __name((finding) => finding.personName ?? finding.personId, "who");
+var describe = /* @__PURE__ */ __name((finding) => finding.action === "delete" ? `delete message ${finding.messageId} from ${who(finding)} for everyone (${finding.rule})` : `remove ${who(finding)} from the group (${finding.rule})`, "describe");
+var commandFor = /* @__PURE__ */ __name((command, chatId, finding) => finding.action === "delete" ? `${command} messages delete ${chatId} ${finding.messageId} --for-everyone --allow-dangerous` : finding.action === "remove" ? `${command} chats members remove ${chatId} ${finding.personId}` : "", "commandFor");
+var CHECK_READS = 1e3;
+var PAGE = 100;
+var gather = /* @__PURE__ */ __name(async (adapter, chatId, since) => {
+  const notes = [];
+  const historyAfter = adapter.historyAfter;
+  if (!historyAfter)
+    throw new CliError("validation_error", "this messenger cannot read a chat forward from a time");
+  const messages = [];
+  let more = true;
+  while (more && messages.length < CHECK_READS) {
+    const last = messages.at(-1);
+    const page = await historyAfter.call(adapter, chatId, {
+      limit: PAGE,
+      after: last ? { id: last.id } : { time: since }
+    });
+    messages.push(...page.items);
+    more = page.hasMore && page.items.length > 0;
+  }
+  const scanned = adapter.chatEvents ? (await adapter.chatEvents(chatId, { since })).events : [];
+  const until = messages.at(-1)?.timestamp ?? null;
+  const events = more && until !== null ? scanned.filter((event) => Date.parse(event.timestamp) <= Date.parse(until)) : scanned;
+  if (!adapter.chatEvents)
+    notes.push("this messenger does not say who joined, so only messages are judged");
+  const joinedIds = new Set(events.filter((one) => one.event === "join" || one.event === "add").flatMap((one) => one.people.length > 0 ? one.people.map((person) => person.id) : one.by.id ? [one.by.id] : []));
+  const joined = joinedIds.size === 0 || !adapter.members ? [] : (await adapter.members(chatId, { offset: 0 })).items.filter((member) => joinedIds.has(member.id));
+  const admins = adapter.admins ? await adapter.admins(chatId) : null;
+  if (admins === null)
+    notes.push("the group's admins are not known, so only your own messages are exempt");
+  return {
+    messages,
+    joined,
+    answerers: new Set(admins ?? []),
+    service: new Set(events.map((one) => one.messageId)),
+    until,
+    more,
+    notes
+  };
+}, "gather");
+var MAX_ACTIONS = 10;
+var undone = /* @__PURE__ */ __name((row) => ["planned", "skipped", "failed"].includes(row.outcome), "undone");
+var nextPoint = /* @__PURE__ */ __name((rows, found) => {
+  const waiting = rows.filter(undone);
+  if (waiting.some((row) => row.messageId === void 0))
+    return null;
+  const times = waiting.map((row) => found.messages.find((message) => message.id === row.messageId)?.timestamp).filter((time) => time !== void 0).map(Date.parse);
+  if (times.length === 0)
+    return found.until;
+  return new Date(Math.min(...times) - 1).toISOString();
+}, "nextPoint");
+var someUndone = /* @__PURE__ */ __name((rows) => rows.some(undone), "someUndone");
+
+// node_modules/.pnpm/@wirecat+cli-core@0.469.0_@wirecat+cli-base@0.65.0_commander@15.0.0_typescript@7.0.2_vi_80b586dbc8b099637a6e461856c2ee6b/node_modules/@wirecat/cli-core/dist/moderation/rules.js
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+var RULE_ACTIONS = ["report", "delete", "remove"];
+var OLD_LEVELS = { forbid: "deny", flag: "ask", confirm: "ask", allow: "allow" };
+var level = pipe(picklist([...LEVELS, ...Object.keys(OLD_LEVELS)]), transform((typed) => OLD_LEVELS[typed] ?? typed));
+var action = picklist(RULE_ACTIONS);
+var personIds = array(pipe(string(), regex(/^-?\d+$/, "a person id is digits")));
+var atLeast = /* @__PURE__ */ __name((min) => pipe(number(), integer(), minValue(min)), "atLeast");
+var groupRules = pipe(strictObject({
+  title: nullable(string()),
+  trusted: personIds,
+  blocked: personIds,
+  blockedNames: array(pipe(string(), minLength(1))),
+  links: action,
+  invites: action,
+  forwards: action,
+  blockedPeople: action,
+  flood: strictObject({ messages: atLeast(1), minutes: atLeast(1), action }),
+  /** 0 days turns the rule off. */
+  newAccount: strictObject({ days: atLeast(0), action: picklist(["report", "remove"]) }),
+  requests: optional(unknown()),
+  consent: strictObject({
+    delete: level,
+    remove: level,
+    accept: optional(unknown()),
+    decline: optional(unknown())
+  })
+}), transform(({ requests: _, consent: { accept: _accept, decline: _decline, ...consent }, ...rules }) => ({
+  ...rules,
+  consent
+})));
+var file = strictObject({
+  groups: record(string(), groupRules),
+  /** Where each group's next `chats moderate` starts, ISO 8601. */
+  checkedUntil: optional(record(string(), string()))
+});
+var defaultRules = /* @__PURE__ */ __name((title) => ({
+  title,
+  trusted: [],
+  blocked: [],
+  blockedNames: [],
+  links: "report",
+  invites: "report",
+  forwards: "report",
+  blockedPeople: "report",
+  flood: { messages: 5, minutes: 1, action: "report" },
+  newAccount: { days: 7, action: "report" },
+  consent: { delete: "ask", remove: "ask" }
+}), "defaultRules");
+var list = /* @__PURE__ */ __name((value) => value.split(",").map((item) => item.trim()).filter(Boolean), "list");
+var whole = /* @__PURE__ */ __name((value) => /^\d+$/.test(value.trim()) ? Number(value) : Number.NaN, "whole");
+var KEYS = {
+  trusted: { help: "person ids, comma-separated; never acted on", parse: list },
+  blocked: { help: "person ids, comma-separated", parse: list },
+  blockedNames: { help: "parts of a name, comma-separated, any case", parse: list },
+  links: { help: RULE_ACTIONS.join("|"), parse: String },
+  invites: { help: RULE_ACTIONS.join("|"), parse: String },
+  forwards: { help: RULE_ACTIONS.join("|"), parse: String },
+  blockedPeople: { help: RULE_ACTIONS.join("|"), parse: String },
+  "flood.messages": { help: "a whole number, 1 or more", parse: whole },
+  "flood.minutes": { help: "a whole number, 1 or more", parse: whole },
+  "flood.action": { help: RULE_ACTIONS.join("|"), parse: String },
+  "newAccount.days": { help: "a whole number; 0 turns it off", parse: whole },
+  "newAccount.action": { help: "report|remove", parse: String },
+  "consent.delete": { help: LEVELS.join("|"), parse: String },
+  "consent.remove": { help: LEVELS.join("|"), parse: String }
+};
+var RULE_KEYS = Object.keys(KEYS);
+var moderationPathFor = /* @__PURE__ */ __name((app, profile, env = process.env) => join(resolvePaths({ appName: app.appName, prefix: app.envPrefix, env }).state, "profiles", `${profile}.moderation.json`), "moderationPathFor");
+var ModerationRules = class {
+  static {
+    __name(this, "ModerationRules");
+  }
+  path;
+  constructor(path) {
+    this.path = path;
+  }
+  /** `undefined` when this group has no section yet. */
+  read(chatId) {
+    return this.#file().groups[chatId];
+  }
+  /** Writes the group's whole section — the defaults first, if it had none — with one key changed. */
+  set(chatId, title, key, value) {
+    const known = KEYS[key];
+    if (!known)
+      throw invalid2(`no rule ${key} \u2014 one of: ${RULE_KEYS.join(", ")}`);
+    const current = this.read(chatId) ?? defaultRules(title);
+    const checked = safeParse(groupRules, assign(current, key, known.parse(value)));
+    if (!checked.success)
+      throw invalid2(`${key} ${JSON.stringify(value)} is not valid \u2014 ${known.help}`);
+    const saved = this.#file();
+    this.#write({ ...saved, groups: { ...saved.groups, [chatId]: checked.output } });
+    return checked.output;
+  }
+  /** Puts one key back to its default. */
+  unset(chatId, title, key) {
+    if (!KEYS[key])
+      throw invalid2(`no rule ${key} \u2014 one of: ${RULE_KEYS.join(", ")}`);
+    const current = this.read(chatId) ?? defaultRules(title);
+    const changed = assign(current, key, lookup(defaultRules(title), key));
+    const saved = this.#file();
+    this.#write({ ...saved, groups: { ...saved.groups, [chatId]: changed } });
+    return changed;
+  }
+  checkedUntil(chatId) {
+    return this.#file().checkedUntil?.[chatId];
+  }
+  markChecked(chatId, at) {
+    const saved = this.#file();
+    this.#write({ ...saved, checkedUntil: { ...saved.checkedUntil, [chatId]: at } });
+  }
+  #file() {
+    if (!existsSync(this.path))
+      return { groups: {} };
+    let parsed;
+    try {
+      parsed = JSON.parse(readFileSync(this.path, "utf8"));
+    } catch (error) {
+      throw broken(this.path, error instanceof Error ? error.message : String(error));
+    }
+    const checked = safeParse(file, parsed);
+    if (!checked.success) {
+      const problems = checked.issues.map((issue) => `${getDotPath(issue) ?? "file"}: ${issue.message}`);
+      throw broken(this.path, problems.join("; "));
+    }
+    return checked.output;
+  }
+  #write(content) {
+    writeSecurely(this.path, `${JSON.stringify(content, null, 2)}
+`, 384);
+  }
+};
+var invalid2 = /* @__PURE__ */ __name((message) => new CliError("validation_error", message), "invalid");
+var broken = /* @__PURE__ */ __name((path, why) => new CliError("configuration_error", `the moderation rules ${path} cannot be read (${why}) \u2014 fix the file`), "broken");
+var lookup = /* @__PURE__ */ __name((rules, key) => key.split(".").reduce((value, part) => value[part], rules), "lookup");
+var assign = /* @__PURE__ */ __name((rules, key, value) => {
+  const [head, tail] = key.split(".");
+  if (tail === void 0)
+    return { ...rules, [head]: value };
+  return { ...rules, [head]: { ...rules[head], [tail]: value } };
+}, "assign");
+
+export {
+  isId,
+  foldName,
+  pickChat,
+  pickPerson,
+  validateFormattedText,
+  visibleFormattedText,
+  judge,
+  act,
+  describe,
+  CHECK_READS,
+  gather,
+  MAX_ACTIONS,
+  nextPoint,
+  someUndone,
+  defaultRules,
+  RULE_KEYS,
+  moderationPathFor,
+  ModerationRules
+};