@wirecat/zoom-cli 0.56.0 → 0.58.0

package/dist/bundle/chunk-PF25S7L4.js

@@ -0,0 +1,422 @@
+import { createRequire as __bundleRequire } from "node:module";
+const require = __bundleRequire(import.meta.url);
+import {
+  CliError
+} from "./chunk-YIMI6O7R.js";
+import {
+  __name
+} from "./chunk-ZVVMGPBJ.js";
+
+// node_modules/.pnpm/@wirecat+cli-core@0.473.0_@wirecat+cli-base@0.65.0_commander@15.0.0_esbuild@0.28.2_type_39633e3162553a2c86dde989a9811fcb/node_modules/@wirecat/cli-core/dist/sends/permissions.js
+var LEVELS = ["deny", "readonly", "ask", "allow"];
+var DANGEROUS = /* @__PURE__ */ new Set(["messages.delete", "bot.messages.delete", "topics.delete", "chats.delete", "chats.clear"]);
+var skipFlagFor = /* @__PURE__ */ __name((key) => DANGEROUS.has(key) ? "--allow-dangerous" : "--yes", "skipFlagFor");
+var DEFAULT_PERMISSIONS = {
+  "messages.delete": "ask",
+  "account.sessions.end": "ask",
+  "bot.messages.delete": "ask",
+  "topics.enable": "ask",
+  "topics.delete": "ask",
+  "chats.delete": "ask",
+  "chats.clear": "ask",
+  // NEED-568: a rule writes to people with nobody typing a command; it waits for the owner's own allow.
+  "replies.send": "deny",
+  // NEED-1662: an agent that changes settings, schedules or recipients could lift its own limits; the owner opts in.
+  "mcp.authority": "deny",
+  // NEED-1663: writes no level stopped before, so MCP could not offer them; over MCP `ask` goes ahead.
+  "store.backup": "ask",
+  "store.restore": "ask",
+  "store.migrate": "ask",
+  "store.repair": "ask",
+  "store.reset": "ask",
+  "store.clear": "ask",
+  "store.decrypt": "ask",
+  "store.copies.delete": "ask",
+  "server.start": "ask",
+  "server.stop": "ask",
+  "server.restart": "ask",
+  "models.download": "ask",
+  "images.models.download": "ask",
+  "schedule.run": "ask",
+  "schedule.exec": "ask",
+  "doctor.reports.create": "ask"
+};
+var KEYED_UNDER_HOUSEKEEPING = new Set(Object.keys(DEFAULT_PERMISSIONS).filter((key) => /^(store|server|models|images|schedule|doctor)\./.test(key)));
+var AUTHORITY_KEY = "mcp.authority";
+var authorityAllowed = /* @__PURE__ */ __name((levels) => {
+  const { level } = levelFor(levels, AUTHORITY_KEY);
+  return level === "allow" || level === "ask";
+}, "authorityAllowed");
+var BOT_API_KEY = "bot.api";
+var isBotApi = /* @__PURE__ */ __name((path) => path[0] === "bot" && path[1] === "api", "isBotApi");
+var botApiAllowed = /* @__PURE__ */ __name((levels) => {
+  const { level } = levelFor(levels, BOT_API_KEY, { ...DEFAULT_PERMISSIONS, [BOT_API_KEY]: "deny" });
+  return level === "allow" || level === "ask";
+}, "botApiAllowed");
+var RESOURCES = [
+  "messages",
+  "drafts",
+  "reactions",
+  "polls",
+  "topics",
+  "chats",
+  "contacts",
+  "account",
+  "bot",
+  "conversations",
+  "tags",
+  "mentions",
+  "search",
+  "searches",
+  "tasks",
+  "replies",
+  "attachments",
+  "stats",
+  "store",
+  "metadata",
+  "mcp",
+  "server",
+  "models",
+  "schedule",
+  "doctor",
+  "images"
+];
+var layerPermissions = /* @__PURE__ */ __name((layers) => {
+  const levels = {};
+  const sources = {};
+  for (const [from, layer] of layers) {
+    const nearer = Object.keys(levels);
+    for (const [key, level] of Object.entries(layer ?? {})) {
+      if (nearer.some((named) => key === named || key.startsWith(`${named}.`)))
+        continue;
+      levels[key] = level;
+      sources[key] = from;
+    }
+  }
+  return { levels, sources };
+}, "layerPermissions");
+var CEILING_KEY = "*";
+var ALLOWED = { level: "allow", key: null };
+var ORDER = { deny: 0, readonly: 1, ask: 2, allow: 3 };
+var nearest = /* @__PURE__ */ __name((levels, key) => {
+  for (let parts = key.split("."); parts.length > 0; parts = parts.slice(0, -1)) {
+    const named = parts.join(".");
+    const level = levels[named];
+    if (level)
+      return { level, key: named, depth: parts.length };
+  }
+  return void 0;
+}, "nearest");
+var levelFor = /* @__PURE__ */ __name((permissions, key, defaults = DEFAULT_PERMISSIONS) => {
+  const found = profileLevel(permissions, key, defaults);
+  const ceiling = permissions[CEILING_KEY];
+  return ceiling && ORDER[ceiling] < ORDER[found.level] ? { level: ceiling, key: CEILING_KEY } : found;
+}, "levelFor");
+var profileLevel = /* @__PURE__ */ __name((permissions, key, defaults) => {
+  const own = nearest(permissions, key);
+  const builtIn = nearest(defaults, key);
+  if (!builtIn || own && own.depth >= builtIn.depth)
+    return own ? { level: own.level, key: own.key } : ALLOWED;
+  if (!own || ORDER[builtIn.level] <= ORDER[own.level])
+    return { level: builtIn.level, key: builtIn.key };
+  return { level: own.level, key: own.key };
+}, "profileLevel");
+var CHAT_KEYS = {
+  settings: "chats.update",
+  "requests.accept": "chats.requests.confirm",
+  "requests.decline": "chats.requests.reject",
+  "link.create": "chats.links.create",
+  "link.reset": "chats.links.reset",
+  "link.revoke": "chats.links.remove",
+  "link.update": "chats.links.update"
+};
+var ACCOUNT_KEYS = {
+  "contact-add": "contacts.add",
+  "contact-remove": "contacts.remove",
+  "contact-import": "contacts.import",
+  "contact-rename": "contacts.rename",
+  "contact-block": "contacts.block",
+  "contact-unblock": "contacts.unblock",
+  profile: "account.update",
+  "folder-create": "chats.folders.create",
+  "folder-update": "chats.folders.update",
+  "folder-delete": "chats.folders.delete",
+  "folder-order": "chats.folders.order",
+  "folder-join": "chats.folders.join",
+  "sessions-end": "account.sessions.end",
+  "chat-mute": "chats.mute",
+  "chat-unmute": "chats.unmute",
+  "chat-archive": "chats.archive",
+  "chat-unarchive": "chats.unarchive",
+  "chat-pin": "chats.pin",
+  "chat-unpin": "chats.unpin",
+  "chat-mark-unread": "chats.mark-unread",
+  "message-star": "messages.star",
+  "message-unstar": "messages.unstar",
+  privacy: "account.privacy.set"
+};
+var KIND_KEYS = {
+  message: "messages.send",
+  forward: "messages.forward",
+  edit: "messages.edit",
+  pin: "messages.pin",
+  reaction: "reactions",
+  read: "chats.mark-read",
+  delete: "messages.delete"
+};
+var keyForWrite = /* @__PURE__ */ __name((kind, action) => {
+  if (kind === "chat")
+    return CHAT_KEYS[action] ?? `chats.${action ?? "update"}`;
+  if (kind === "account") {
+    const key = ACCOUNT_KEYS[action];
+    if (!key)
+      throw new Error(`an account change without a known action: ${action}`);
+    return key;
+  }
+  return KIND_KEYS[kind];
+}, "keyForWrite");
+var writeOfKey = /* @__PURE__ */ __name((key) => {
+  const account = Object.entries(ACCOUNT_KEYS).find(([, named]) => named === key)?.[0];
+  if (account)
+    return { kind: "account", action: account };
+  const kind = Object.entries(KIND_KEYS).find(([, named]) => named === key || key.startsWith(`${named}.`))?.[0];
+  if (kind)
+    return { kind };
+  if (key === "messages.unpin")
+    return { kind: "pin" };
+  if (key.startsWith("chats.")) {
+    const action = Object.entries(CHAT_KEYS).find(([, named]) => named === key)?.[0] ?? key.slice("chats.".length);
+    return { kind: "chat", action };
+  }
+  return {};
+}, "writeOfKey");
+var NAMED_WRITE_KEYS = [
+  "drafts",
+  "store.gaps.repair",
+  "messages.sync-first",
+  "messages.server-search",
+  "messages.press",
+  "chats.start",
+  "chats.app",
+  "stats.messages.counters.sync",
+  "stats.messages.show.sync-first",
+  "stats.messages.top.sync-first",
+  "stats.contacts.top.sync-first",
+  "account.sessions.list",
+  "attachments.extract",
+  "attachments.move",
+  "attachments.update",
+  "bot.callbacks.answer",
+  "bot.chats.action",
+  "bot.chats.admins.add",
+  "bot.chats.admins.remove",
+  "bot.chats.leave",
+  "bot.chats.members.remove",
+  "bot.chats.moderate",
+  "bot.messages.delete",
+  "bot.messages.edit",
+  "bot.messages.pin",
+  "bot.messages.send",
+  "bot.messages.unpin",
+  "chats.admins.add",
+  "chats.admins.remove",
+  "chats.links.create",
+  "chats.links.reset",
+  "chats.links.remove",
+  "chats.links.update",
+  "chats.members.add",
+  "chats.members.remove",
+  "chats.moderate",
+  "conversations.embeddings",
+  "conversations.links",
+  "polls.close",
+  "polls.create",
+  "polls.vote",
+  "searches.clear",
+  "searches.create",
+  "searches.delete",
+  "contacts.aliases.set",
+  "contacts.aliases.remove",
+  "contacts.notes.add",
+  "contacts.notes.edit",
+  "contacts.notes.remove",
+  "tags.rebuild",
+  "metadata.sync",
+  "mentions.rebuild",
+  "mentions.confirm",
+  "mentions.reject",
+  "tags.add",
+  "tags.remove",
+  "tasks.add",
+  "tasks.claim",
+  "tasks.close",
+  "tasks.duplicates.defer",
+  "tasks.duplicates.reject",
+  "tasks.link",
+  "tasks.merge",
+  "tasks.update",
+  "tasks.release",
+  "tasks.scan",
+  "tasks.unmerge",
+  "topics.create",
+  "topics.edit",
+  "topics.enable"
+];
+var WRITE_KEYS = [
+  .../* @__PURE__ */ new Set([
+    ...NAMED_WRITE_KEYS,
+    ...Object.keys(DEFAULT_PERMISSIONS),
+    ...Object.values(KIND_KEYS),
+    ...Object.values(ACCOUNT_KEYS),
+    ...Object.values(CHAT_KEYS)
+  ])
+];
+var HOUSEKEEPING = /* @__PURE__ */ new Set([
+  "help",
+  "guide",
+  "config",
+  "session",
+  "doctor",
+  "commands",
+  "complete",
+  "upgrade",
+  "skill",
+  "models",
+  "server",
+  // What a schedule runs is checked by its own key when it runs; an agent runs read-only.
+  "schedule",
+  "runs",
+  "sends",
+  "recipients",
+  "flood",
+  "mcp",
+  // Its commands read the rules or flip the pause switch; what a rule sends is checked as `replies.send`.
+  "replies"
+]);
+var BOT_HOUSEKEEPING = /* @__PURE__ */ new Set(["auth", "list", "sends", "recipients", "mcp"]);
+var STORE_MAINTENANCE = /* @__PURE__ */ new Set(["info", "check", "copies"]);
+var SHOW_MESSAGES = /* @__PURE__ */ new Set(["inbox", "review", "watch", "serve", "store", "conversations"]);
+var readKeysForCommand = /* @__PURE__ */ __name((path) => {
+  if (path[0] === "bot")
+    return readKeysForCommand(path.slice(1)).map((key2) => `bot.${key2}`);
+  const key = keyForCommand(path);
+  if (!key)
+    return [];
+  if (path[0] === "attachments" && path[1] === "download")
+    return [key, "messages", "chats"];
+  if (path[0] === "attachments" && (path[1] === "extract" || path[1] === "show"))
+    return [key, "messages"];
+  if (path[0] === "store" && path[1] === "gaps" && path[2] === "repair")
+    return [key, "messages"];
+  if (path[0] === "store" && ["reset", "clear", "decrypt"].includes(path[1] ?? ""))
+    return [key, "messages"];
+  if (path[0] === "search") {
+    if (path[1] === "notes")
+      return [key];
+    if (path[1] === "topics")
+      return [key, "topics"];
+    if (path[1] === "conversations")
+      return [key, "messages", "conversations"];
+    return [key, "messages"];
+  }
+  if (path[0] !== "stats")
+    return [key];
+  const resource = path[1] === "charts" ? "chats" : path[1];
+  return [
+    .../* @__PURE__ */ new Set([
+      key,
+      "messages",
+      ...["chats", "contacts", "tasks"].includes(resource ?? "") ? [resource] : []
+    ])
+  ];
+}, "readKeysForCommand");
+var keyForCommand = /* @__PURE__ */ __name((path) => {
+  if (path.length === 0)
+    return null;
+  const [top, next] = path;
+  if (top === "bot") {
+    if (next === void 0 || BOT_HOUSEKEEPING.has(next))
+      return null;
+    const inner = keyForCommand(path.slice(1));
+    return `bot.${inner ?? path.slice(1).join(".")}`;
+  }
+  if (KEYED_UNDER_HOUSEKEEPING.has(path.join(".")))
+    return path.join(".");
+  if (top === void 0 || HOUSEKEEPING.has(top) || top === "search" && next === "runs")
+    return null;
+  if (top === "images" && next === "models")
+    return null;
+  if (top === "attachments" && (next === "check" || next === "jobs"))
+    return null;
+  if (top === "attachments" && next === "download")
+    return "messages";
+  if (top === "store" && next !== void 0 && STORE_MAINTENANCE.has(next))
+    return null;
+  if (top === "conversations" && next === "links")
+    return path[2] === "rebuild" ? "conversations.links.rebuild" : "conversations.links";
+  if (top === "conversations" && (next === "embeddings" || next === "embed") || top === "images" && next === "embed" || top === "conversations" && next === "rebuild")
+    return "conversations.embeddings";
+  if (top === "attachments" && next === "list" || top === "chats" && next === "documents")
+    return "messages";
+  if (top === "mentions")
+    return next === "rebuild" || next === "confirm" || next === "reject" ? `mentions.${next}` : "messages";
+  if (top === "store" && (next === "gaps" || next === "jobs"))
+    return path.join(".");
+  if (SHOW_MESSAGES.has(top) || top === "contacts" && (next === "context" || next === "prepare" || next === "events"))
+    return "messages";
+  if (RESOURCES.includes(top))
+    return path.join(".");
+  return void 0;
+}, "keyForCommand");
+var RESOURCE_KEY = new RegExp(`^(${RESOURCES.join("|")})(\\.[a-z][a-z-]*)*$`);
+var COMMAND_PATH_KEY = /^[a-z][a-z-]*(\.[a-zA-Z][a-zA-Z-]*)*$/;
+var permissionOverrides = /* @__PURE__ */ __name((entries = [], shape = RESOURCE_KEY) => {
+  const levels = {};
+  const example = shape === RESOURCE_KEY ? "messages.send=allow" : "api=readonly";
+  for (const entry of entries) {
+    const [key = "", level = "", extra] = entry.split("=");
+    if (!shape.test(key) || !LEVELS.includes(level) || extra !== void 0)
+      throw new CliError("validation_error", `--permission takes a command path and level, e.g. ${example} (deny, readonly, ask, allow)`);
+    levels[key] = level;
+  }
+  return levels;
+}, "permissionOverrides");
+var assertOverridesTighten = /* @__PURE__ */ __name((overrides, profile, defaults = DEFAULT_PERMISSIONS) => {
+  for (const [key, level] of Object.entries(overrides)) {
+    const under = Object.keys(profile).filter((named) => named.startsWith(`${key}.`));
+    const lifted = [key, ...under].find((named) => ORDER[level] > ORDER[levelFor(profile, named, defaults).level]);
+    if (lifted !== void 0)
+      throw new CliError("validation_error", `--permission ${key}=${level} would loosen ${lifted} from ${levelFor(profile, lifted, defaults).level}; it only tightens \u2014 change the profile's permissions to loosen it`, { key, lifted });
+  }
+}, "assertOverridesTighten");
+var assertRetentionEvidenceRead = /* @__PURE__ */ __name((permissions) => {
+  for (const permission of ["stats.chats.retention", "chats"]) {
+    if (levelFor(permissions, permission).level === "deny")
+      throw new CliError("permission_error", `profile denies ${permission}`, { permission });
+  }
+}, "assertRetentionEvidenceRead");
+
+export {
+  LEVELS,
+  skipFlagFor,
+  DEFAULT_PERMISSIONS,
+  AUTHORITY_KEY,
+  authorityAllowed,
+  BOT_API_KEY,
+  isBotApi,
+  botApiAllowed,
+  RESOURCES,
+  layerPermissions,
+  CEILING_KEY,
+  levelFor,
+  keyForWrite,
+  writeOfKey,
+  WRITE_KEYS,
+  readKeysForCommand,
+  keyForCommand,
+  RESOURCE_KEY,
+  COMMAND_PATH_KEY,
+  permissionOverrides,
+  assertOverridesTighten,
+  assertRetentionEvidenceRead
+};

package/dist/bundle/chunk-PKTFZAXG.js

@@ -0,0 +1,48 @@
+import { createRequire as __bundleRequire } from "node:module";
+const require = __bundleRequire(import.meta.url);
+import {
+  CliError
+} from "./chunk-YIMI6O7R.js";
+import {
+  __name
+} from "./chunk-ZVVMGPBJ.js";
+
+// node_modules/.pnpm/@wirecat+cli-core@0.473.0_@wirecat+cli-base@0.65.0_commander@15.0.0_esbuild@0.28.2_type_39633e3162553a2c86dde989a9811fcb/node_modules/@wirecat/cli-core/dist/http/public-url.js
+var EXAMPLE = "--public-url https://<name>.ts.net";
+var publicUrlOf = /* @__PURE__ */ __name((given, { missing, reaches, path = false }) => {
+  if (!given)
+    throw new CliError("configuration_error", `${missing} needs the tunnel's address: ${EXAMPLE}`);
+  let url;
+  try {
+    url = new URL(given);
+  } catch {
+    throw new CliError("validation_error", `--public-url is not an address: ${EXAMPLE}`);
+  }
+  if (url.username || url.password)
+    throw new CliError("validation_error", "--public-url must not contain login credentials");
+  const local = url.protocol === "http:" && ["localhost", "127.0.0.1"].includes(url.hostname);
+  if (url.protocol !== "https:" && !local)
+    throw new CliError("validation_error", `--public-url must be https \u2014 ${reaches} through it`);
+  if (url.search || url.hash || !path && url.pathname !== "/")
+    throw new CliError("validation_error", path ? `--public-url is the tunnel's address, or a path of it, without a query: ${EXAMPLE}/tg` : `--public-url is the tunnel's address only, without a path: ${EXAMPLE}`);
+  if (path && !/^(\/[A-Za-z0-9_-][A-Za-z0-9._-]*)*\/?$/.test(url.pathname))
+    throw new CliError("validation_error", "--public-url's path takes letters, digits, dot, dash and underscore: /tg");
+  if (path)
+    url.pathname = url.pathname.replace(/\/+$/, "") || "/";
+  return url;
+}, "publicUrlOf");
+var portOf = /* @__PURE__ */ __name((given, fallback) => {
+  if (given === void 0)
+    return fallback;
+  const port = Number(given);
+  if (!Number.isInteger(port) || port < 1 || port > 65535)
+    throw new CliError("validation_error", "--port takes 1\u201365535");
+  return port;
+}, "portOf");
+var mcpUrlOf = /* @__PURE__ */ __name((publicUrl) => new URL(`${publicUrl.pathname.replace(/\/+$/, "")}/mcp`, publicUrl.origin), "mcpUrlOf");
+
+export {
+  publicUrlOf,
+  portOf,
+  mcpUrlOf
+};