@wirecat/zoom-cli 0.60.0 → 0.61.0

package/dist/bundle/{chunk-SKENSSY2.js → chunk-O3WVOAT7.js}

@@ -2,34 +2,33 @@ import { createRequire as __bundleRequire } from "node:module";
 const require = __bundleRequire(import.meta.url);
 import {
   ZM
-} from "./chunk-J5ZVGKSZ.js";
+} from "./chunk-VARX3SBT.js";
 import {
   commandsCommand,
   formatSuggestions,
   meetingResultItem,
   runsCommand,
-  sharedCommandTemplate,
   suggest
-} from "./chunk-SK3K2VHF.js";
+} from "./chunk-BPQNTYLN.js";
 import {
   sharedStoreCommand
-} from "./chunk-DKIIKMSE.js";
+} from "./chunk-E4QPLXZT.js";
 import {
   answerEntity
-} from "./chunk-4MC4Z45G.js";
+} from "./chunk-QHT2LZRW.js";
 import {
-  LOCAL_READ,
   NO_EFFECTS,
   REMOTE_READ,
   annotate,
   changesAuthorityNow,
-  customizeSharedCommand,
+  checkConfigText,
   describeOptions,
   describeProgram,
   flatten,
   hasSharedContract,
   isLogin,
   isStoreChange,
+  issueMessage,
   itemOf,
   listOf,
   metaNow,
@@ -37,86 +36,211 @@ import {
   overrideSharedContract,
   profileFree,
   renderAnswer,
-  snakeKeys
-} from "./chunk-G3MXAGF2.js";
+  snakeKeys,
+  usableProfileName
+} from "./chunk-AOSIU5T6.js";
 import {
   readOnlyLockOf,
   readOnlyRefusal
-} from "./chunk-3P4LUGXI.js";
+} from "./chunk-6LHTWR3X.js";
 import {
   setupPermissionCeiling
-} from "./chunk-4HZRZDMC.js";
+} from "./chunk-KZGHGU2M.js";
 import {
   CEILING_KEY,
   DEFAULT_PERMISSIONS,
   LEVELS,
   keyForCommand,
   levelFor
-} from "./chunk-NKFRV2LB.js";
+} from "./chunk-CUSGSXSR.js";
 import {
   MEETING_RESULT_ENTITIES
-} from "./chunk-UOL4ILXT.js";
+} from "./chunk-RSXLI5GP.js";
 import {
   CliError,
   array,
   boolean,
+  check,
   createRenderer,
+  custom,
   exitCodeOfAnswer,
   integer,
   isoTimestamp,
   literal,
+  maxLength,
   minLength,
   minValue,
   nullable,
   number,
   optional,
+  parse,
   picklist,
   pipe,
   projectFields,
   record,
+  regex,
   safeParse,
+  saveConfigFile,
   strictObject,
   string,
   union
-} from "./chunk-YIMI6O7R.js";
+} from "./chunk-L7VIPVHL.js";
 import {
   __name
 } from "./chunk-ZVVMGPBJ.js";
 
-// dist/read-only.js
-var pathOf = /* @__PURE__ */ __name((command) => {
-  const words = [];
-  for (let at = command; at?.parent; at = at.parent)
-    words.unshift(at.name());
-  return words.join(" ");
+// dist/config.js
+import { existsSync, readFileSync, statSync } from "node:fs";
+
+// dist/config-issues.js
+var isNode = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null && !Array.isArray(value), "isNode");
+var SETTING_NAMES = {
+  client_id: "zoom.client_id",
+  source: "source",
+  files_folder: "files.folder",
+  files_timezone: "files.timezone",
+  context_sources: "context.sources",
+  record: "record",
+  keep_runs_for_days: "keep_runs_for_days",
+  keep_successful_runs_for_days: "keep_successful_runs_for_days",
+  runs_size_limit_mb: "runs_size_limit_mb",
+  record_input: "record_input"
+};
+var SHELL_SAFE = /^[A-Za-z0-9_.:@-]*$/;
+var fileIssue = /* @__PURE__ */ __name((file, what) => ({ kind: "invalid_value", file, what, at: [] }), "fileIssue");
+var pathOf = /* @__PURE__ */ __name((raw, { profile, key }) => {
+  if (key === void 0)
+    return [];
+  if (profile !== void 0) {
+    const entry = isNode(raw.profiles) ? raw.profiles[profile] : void 0;
+    const permission = key.startsWith("permissions.") && !(isNode(entry) && Object.hasOwn(entry, key));
+    return permission ? ["profiles", profile, "permissions", key.slice("permissions.".length)] : ["profiles", profile, key];
+  }
+  if (Object.hasOwn(raw, key))
+    return [key];
+  if (key.startsWith("profiles."))
+    return ["profiles", key.slice("profiles.".length)];
+  return [key.split(".")[0]];
 }, "pathOf");
-var usesEmbeddings = /* @__PURE__ */ __name((command, path) => {
-  const options = command.opts();
-  if (path === "meetings embeddings")
-    return true;
-  return path === "search meetings" && options.model !== void 0;
-}, "usesEmbeddings");
-var refusalOf = /* @__PURE__ */ __name((command) => {
-  const effects = metaOf(command).effects;
-  const path = pathOf(command);
-  if (isLogin(command))
-    return "log in or out";
-  if (effects?.remote === "write")
-    return "change Zoom";
-  if (usesEmbeddings(command, path))
-    return "build meeting vectors or send text to an embedding service";
-  if (changesAuthorityNow(command))
-    return "change what a later run may do";
-  if (!effects || isStoreChange(command))
-    return "change the local store or local files";
-  return void 0;
-}, "refusalOf");
-var refuseChangeWhenReadOnly = /* @__PURE__ */ __name((command, env) => {
-  const lock2 = readOnlyLockOf(ZM, env);
-  const refusal = lock2 && refusalOf(command);
-  if (lock2 && refusal)
-    throw readOnlyRefusal(lock2, refusal);
-}, "refuseChangeWhenReadOnly");
+var inZmTerms = /* @__PURE__ */ __name((raw, issue) => {
+  const { fix: _, key: shared, ...rest } = issue;
+  const at = pathOf(raw, issue);
+  const [first] = at;
+  if (shared === void 0 || first === void 0)
+    return { ...rest, at };
+  const key = first === "profiles" ? shared : SETTING_NAMES[first] ?? first;
+  const named = key + shared.slice(first === "profiles" ? shared.length : first.length);
+  const fixable = [key, issue.profile ?? ""].every((word) => SHELL_SAFE.test(word));
+  return {
+    ...rest,
+    kind: issue.kind === "missing_setting" ? "invalid_value" : issue.kind,
+    key,
+    what: issue.what.replace(`setting ${shared}`, `setting ${named}`),
+    ...fixable ? { fix: `zm${issue.profile === void 0 ? "" : ` ${issue.profile}`} config unset ${key}` } : {},
+    at
+  };
+}, "inZmTerms");
+var configIssues = /* @__PURE__ */ __name((text2, file, schema, permissionKeys2) => {
+  const checked = checkConfigText(text2, { file, tool: "zm", schema });
+  const broken = checked.issues.find((issue) => issue.kind === "invalid_json");
+  if (broken)
+    return { issues: [{ ...broken, at: [] }], raw: null };
+  const raw = JSON.parse(text2);
+  if (!isNode(raw))
+    return { issues: [fileIssue(file, "the file has to be an object, in braces")], raw: null };
+  const found = /* @__PURE__ */ new Map();
+  const add = /* @__PURE__ */ __name((issue) => {
+    const id = issue.at.join("\0");
+    if (!found.has(id))
+      found.set(id, issue);
+  }, "add");
+  for (const issue of checked.issues)
+    add(inZmTerms(raw, issue));
+  if (permissionKeys2) {
+    const rest = JSON.stringify(withoutIssues(raw, [...found.values()]));
+    for (const issue of checkConfigText(rest, { file, tool: "zm", schema, knownPermissions: permissionKeys2 }).issues)
+      if (issue.kind === "unknown_permission")
+        add(inZmTerms(raw, issue));
+  }
+  return { issues: [...found.values()], raw };
+}, "configIssues");
+var withoutIssues = /* @__PURE__ */ __name((raw, issues) => {
+  const copy = structuredClone(raw);
+  for (const { at } of issues)
+    removeAt(copy, at);
+  return copy;
+}, "withoutIssues");
+var removeAt = /* @__PURE__ */ __name((raw, at) => {
+  const parent = at.slice(0, -1).reduce((node, key) => isNode(node) ? node[key] : void 0, raw);
+  if (isNode(parent))
+    delete parent[at.at(-1)];
+}, "removeAt");
+var publicIssue = /* @__PURE__ */ __name(({ at: _, ...issue }) => issue, "publicIssue");
+
+// dist/profile.js
+var profilePattern = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+var profileAccountKey = /* @__PURE__ */ __name((profile) => `zm-profile:${profile}`, "profileAccountKey");
+var given = /* @__PURE__ */ __name((value) => value?.trim() ? value.trim() : void 0, "given");
+var usable = /* @__PURE__ */ __name((profile) => {
+  usableProfileName(profile);
+  if (!profilePattern.test(profile))
+    throw new CliError("validation_error", `"${profile}" cannot be a profile name \u2014 64 characters at most`);
+  return profile;
+}, "usable");
+var chooseProfile = /* @__PURE__ */ __name(({ word, env, profiles }) => {
+  const lock2 = given(env.ZM_PROFILE_LOCK);
+  const named = word !== void 0 ? word : given(env.ZM_PROFILE);
+  if (lock2 !== void 0)
+    usable(lock2);
+  if (named !== void 0 && lock2 !== void 0 && named !== lock2)
+    throw new CliError("permission_error", `this process is locked to profile ${lock2} (ZM_PROFILE_LOCK) \u2014 profile ${named} is refused`);
+  const profile = named ?? lock2;
+  if (profile === void 0) {
+    const here = profiles();
+    throw new CliError("validation_error", here.length === 0 ? "name a profile: there is none on this computer yet \u2014 create one with `zm personal session start` (any name in place of personal)" : `name a profile: \`zm <profile> \u2026\` \u2014 profiles here: ${here.join(", ")} (or set ZM_PROFILE)`, { profiles: [...here] });
+  }
+  return usable(profile);
+}, "chooseProfile");
+
+// dist/context-sources.js
+var fields = {
+  id: pipe(string(), regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/)),
+  kind: picklist(["message", "mail", "document"]),
+  provider: pipe(string(), check((s) => !!s.trim() && Buffer.byteLength(s) <= 128)),
+  account: pipe(string(), check((s) => !!s.trim() && Buffer.byteLength(s) <= 1024))
+};
+var selected = pipe(array(strictObject(fields)), maxLength(8));
+var contextSourcesSchema = pipe(array(strictObject({ ...fields, profile: pipe(string(), regex(profilePattern)) })), maxLength(64), check((entries) => {
+  const ids = /* @__PURE__ */ new Set(), identities = /* @__PURE__ */ new Set(), counts = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    const id = JSON.stringify([entry.profile, entry.id]), key = JSON.stringify([entry.profile, entry.kind, entry.provider, entry.account]);
+    const count2 = (counts.get(entry.profile) ?? 0) + 1;
+    if (ids.has(id) || identities.has(key) || count2 > 8)
+      return false;
+    ids.add(id);
+    identities.add(key);
+    counts.set(entry.profile, count2);
+  }
+  return true;
+}));
+var replaceContextSources = /* @__PURE__ */ __name((value, profile, existing = []) => {
+  if (!profile)
+    throw new CliError("configuration_error", "name a profile: `zm <profile> config set context.sources \u2026`");
+  let input;
+  try {
+    input = JSON.parse(value);
+  } catch {
+    throw new CliError("validation_error", "context.sources must be a JSON array");
+  }
+  const parsed = safeParse(selected, input);
+  if (!parsed.success)
+    throw new CliError("validation_error", "context.sources needs at most eight unique source IDs with kind/provider/account; unknown fields are refused");
+  const combined = [...existing.filter((s) => s.profile !== profile), ...parsed.output.map((s) => ({ ...s, profile }))];
+  const all = safeParse(contextSourcesSchema, combined);
+  if (!all.success)
+    throw new CliError("validation_error", "context.sources contains duplicate IDs/identities or exceeds its profile limits");
+  return all.output;
+}, "replaceContextSources");
 
 // dist/answer-entities.js
 var text = string();
@@ -348,8 +472,8 @@ var bodyOf = /* @__PURE__ */ __name((value) => {
 }, "bodyOf");
 var renderBody = /* @__PURE__ */ __name((command, body, options) => {
   const data = normalizeZoomAnswer(snakeKeys(body), metaOf(command).output?.entity);
-  const fields = options.fields;
-  const projected = fields ? projectFields(data, fields) : data;
+  const fields2 = options.fields;
+  const projected = fields2 ? projectFields(data, fields2) : data;
   const meta = metaNow({ ...projected.meta, run_id: options.meta.run_id, duration_ms: options.meta.duration_ms });
   const chunks = [];
   const streams = {
@@ -373,361 +497,42 @@ var renderBody = /* @__PURE__ */ __name((command, body, options) => {
 }, "renderBody");
 var wholeList = /* @__PURE__ */ __name((command, items) => listOf(command, { items, limit: Math.max(1, items.length), has_more: false }), "wholeList");
 
-// dist/contract-overrides.js
-var SHELL_OVERRIDES = {
-  skill: [
-    {
-      command: ["skill"],
-      field: "effects",
-      before: null,
-      after: {
-        remote: "none",
-        local: "none"
-      },
-      reason: "Zoom installs its own meeting instructions through its source renderer and treats the packaged primary skill as effect-free."
-    },
-    {
-      command: ["skill", "show"],
-      field: "examples",
-      before: ["zm skill show"],
-      after: ["zm skill show --json"],
-      reason: "Zoom installs its own meeting instructions through its source renderer and treats the packaged primary skill as effect-free."
-    },
-    {
-      command: ["skill", "install"],
-      field: "examples",
-      before: ["zm skill install --for agents"],
-      after: ["zm skill install --for agents --json"],
-      reason: "Zoom installs its own meeting instructions through its source renderer and treats the packaged primary skill as effect-free."
-    }
-  ],
-  doctor: [
-    {
-      command: ["doctor"],
-      field: "description",
-      before: "the state this installation is in, without connecting unless --online",
-      after: "check local runtime and public config without a login or database",
-      reason: "Zoom local diagnostics inspect runtime and public config only; online account checks belong to session status."
-    },
-    {
-      command: ["doctor"],
-      field: "effects",
-      before: {
-        remote: "read",
-        local: "read"
-      },
-      after: {
-        remote: "none",
-        local: "read"
-      },
-      reason: "Zoom local diagnostics inspect runtime and public config only; online account checks belong to session status."
-    },
-    {
-      command: ["doctor"],
-      field: "runnable",
-      before: true,
-      after: null,
-      reason: "Zoom local diagnostics inspect runtime and public config only; online account checks belong to session status."
-    },
-    {
-      command: ["doctor"],
-      field: "options",
-      before: [
-        {
-          flags: "--online",
-          description: "also connect once and read the account; sends nothing",
-          takes_value: false,
-          mandatory: false
-        }
-      ],
-      after: [],
-      reason: "Zoom local diagnostics inspect runtime and public config only; online account checks belong to session status."
-    },
-    {
-      command: ["doctor"],
-      field: "children",
-      before: ["reports"],
-      after: [],
-      reason: "Zoom local diagnostics inspect runtime and public config only; online account checks belong to session status."
-    },
-    {
-      command: ["doctor"],
-      field: "examples",
-      before: null,
-      after: ["zm doctor --json"],
-      reason: "Zoom local diagnostics inspect runtime and public config only; online account checks belong to session status."
-    }
-  ],
-  mcp: [
-    {
-      command: ["mcp"],
-      field: "summary",
-      before: "serve this profile's commands to an AI agent, and set that up",
-      after: "serve zm's commands to an AI agent",
-      reason: "Zoom serves meeting and archive commands over stdio under its selected profile; HTTP-specific options are unsupported."
-    },
-    {
-      command: ["mcp"],
-      field: "description",
-      before: "serve this profile to an agent over MCP and set it up \u2014 `claude mcp add zm -- zm <profile> mcp serve`",
-      after: "serve zm's commands to an agent over MCP \u2014 `claude mcp add zm -- zm <profile> mcp serve`",
-      reason: "Zoom serves meeting and archive commands over stdio under its selected profile; HTTP-specific options are unsupported."
-    },
-    {
-      command: ["mcp"],
-      field: "children",
-      before: ["serve", "revoke", "server", "config", "add", "check"],
-      after: ["serve"],
-      reason: "Zoom serves meeting and archive commands over stdio under its selected profile; HTTP-specific options are unsupported."
-    },
-    {
-      command: ["mcp", "serve"],
-      field: "description",
-      before: "serve this profile to an agent over MCP, on stdin and stdout \u2014 `claude mcp add zm -- zm <profile> mcp serve`; `zm mcp serve --profiles a,b` or `--profiles all` serves those profiles from one server and each tool asks which",
-      after: "serve this profile to an agent over MCP, on stdin and stdout \u2014 `claude mcp add zm -- zm <profile> mcp serve`; `--profiles a,b` or `--profiles all` serves several from one server and each tool asks which",
-      reason: "Zoom serves meeting and archive commands over stdio under its selected profile; HTTP-specific options are unsupported."
-    },
-    {
-      command: ["mcp", "serve"],
-      field: "effects",
-      before: {
-        remote: "write",
-        local: "write"
-      },
-      after: {
-        remote: "read",
-        local: "write"
-      },
-      reason: "Zoom serves meeting and archive commands over stdio under its selected profile; HTTP-specific options are unsupported."
-    },
-    {
-      command: ["mcp", "serve"],
-      field: "examples",
-      before: [
-        "zm personal mcp serve",
-        "zm mcp serve --profiles work,personal",
-        "zm personal mcp serve --http --public-url https://laptop.example.ts.net"
-      ],
-      after: ["zm personal mcp serve"],
-      reason: "Zoom serves meeting and archive commands over stdio under its selected profile; HTTP-specific options are unsupported."
-    },
-    {
-      command: ["mcp", "serve"],
-      field: "options",
-      before: [
-        {
-          flags: "--permission <key=level>",
-          description: "make a permission stricter for this server only, like messages.send=deny; it never loosens the profile; repeat for more keys",
-          takes_value: true,
-          mandatory: false
-        },
-        {
-          flags: "--profiles <names|all>",
-          description: "serve several profiles from one server instead of one: names, comma-separated, or all for every profile",
-          takes_value: true,
-          mandatory: false
-        },
-        {
-          flags: "--http",
-          description: "serve over HTTP on 127.0.0.1 for ChatGPT and Claude in the browser, behind your tunnel; the profile's permissions decide",
-          takes_value: false,
-          mandatory: false
-        },
-        {
-          flags: "--port <port>",
-          description: "the local port for --http (default 8765)",
-          takes_value: true,
-          mandatory: false
-        },
-        {
-          flags: "--public-url <url>",
-          description: "the tunnel's https address the browser apps use, e.g. https://<name>.ts.net or https://<name>.ts.net/tg",
-          takes_value: true,
-          mandatory: false
-        }
-      ],
-      after: [
-        {
-          flags: "--profiles <names|all>",
-          description: "serve several profiles from one server instead of one: names, comma-separated, or all for every profile",
-          takes_value: true,
-          mandatory: false
-        }
-      ],
-      reason: "Zoom serves meeting and archive commands over stdio under its selected profile; HTTP-specific options are unsupported."
-    }
-  ],
-  search: [
-    {
-      command: ["search"],
-      field: "summary",
-      before: "search the local archive",
-      after: null,
-      reason: "Zoom searches explicit local meeting and archive sources, with opt-in unified store reads rather than a live messenger backend."
-    },
-    {
-      command: ["search"],
-      field: "description",
-      before: "find things by text: one resource when you know it (messages, notes), or search all across messages and notes; for mail, the separate memo CLI: memo search mail",
-      after: "opt-in shared store search; meetings by default",
-      reason: "Zoom searches explicit local meeting and archive sources, with opt-in unified store reads rather than a live messenger backend."
-    },
-    {
-      command: ["search"],
-      field: "children",
-      before: ["all", "messages", "notes", "conversations", "runs"],
-      after: ["all"],
-      reason: "Zoom searches explicit local meeting and archive sources, with opt-in unified store reads rather than a live messenger backend."
-    },
-    {
-      command: ["search"],
-      field: "effects",
-      before: null,
-      after: {
-        remote: "none",
-        local: "none"
-      },
-      reason: "Zoom searches explicit local meeting and archive sources, with opt-in unified store reads rather than a live messenger backend."
-    },
-    {
-      command: ["search", "all"],
-      field: "summary",
-      before: "search stored messages, notes, calendar events and selected meeting transcripts",
-      after: null,
-      reason: "Zoom searches explicit local meeting and archive sources, with opt-in unified store reads rather than a live messenger backend."
-    },
-    {
-      command: ["search", "all"],
-      field: "description",
-      before: "search messenger messages and notes in the local store, calendar events when the store holds a calendar, and a meeting account's transcripts when --source names one \u2014 best match first; not mail (the separate memo CLI searches it: memo search mail), tasks, people, memories or projects. Use it when you do not know where something was written; search messages or notes reads one kind with all its fields",
-      after: "search meetings and, with --only, messages, mail and notes in the local store",
-      reason: "Zoom searches explicit local meeting and archive sources, with opt-in unified store reads rather than a live messenger backend."
-    },
-    {
-      command: ["search", "all"],
-      field: "effects",
-      before: {
-        remote: "read",
-        local: "read"
-      },
-      after: {
-        remote: "none",
-        local: "read"
-      },
-      reason: "Zoom searches explicit local meeting and archive sources, with opt-in unified store reads rather than a live messenger backend."
-    },
-    {
-      command: ["search", "all"],
-      field: "examples",
-      before: ["zm personal search all draft"],
-      after: ['zm personal search all "example plan" --json'],
-      reason: "Zoom searches explicit local meeting and archive sources, with opt-in unified store reads rather than a live messenger backend."
-    },
-    {
-      command: ["search", "all"],
-      field: "arguments",
-      before: [
-        {
-          name: "query",
-          required: true,
-          variadic: true,
-          description: 'strict Lucene query: words, "phrases", AND/OR/NOT, field groups and date ranges'
-        }
-      ],
-      after: [
-        {
-          name: "query",
-          required: true,
-          variadic: false,
-          description: "words to find; a word also matches longer words it starts"
-        }
-      ],
-      reason: "Zoom searches explicit local meeting and archive sources, with opt-in unified store reads rather than a live messenger backend."
-    },
-    {
-      command: ["search", "all"],
-      field: "options",
-      before: [
-        {
-          flags: "--only <resources>",
-          description: "only these resources, separated by commas: messages, notes, events; meetings when --source names a meeting account",
-          takes_value: true,
-          mandatory: false
-        },
-        {
-          flags: "--source <accounts>",
-          description: "only these accounts, separated by commas: provider:account as a hit shows it, a provider, a kind or group:<name>; each resource reads the ones of its kind, and meetings only when it names one",
-          takes_value: true,
-          mandatory: false
-        },
-        {
-          flags: "--max-meetings <n>",
-          description: "how many of the meeting account's meetings to look through, newest first, or all for every one (default 100)",
-          takes_value: true,
-          mandatory: false
-        },
-        {
-          flags: "--limit <n>",
-          description: "how many",
-          takes_value: true,
-          mandatory: false
-        },
-        {
-          flags: "--page <n>",
-          description: "which page, starting at 1",
-          takes_value: true,
-          mandatory: false
-        },
-        {
-          flags: "--exact",
-          description: "bare words and quotes match their exact form only, as exact:word does",
-          takes_value: false,
-          mandatory: false
-        },
-        {
-          flags: "--timezone <zone>",
-          description: "the IANA timezone for calendar date boundaries",
-          takes_value: true,
-          mandatory: false
-        }
-      ],
-      after: [
-        {
-          flags: "--only <resources>",
-          description: "comma-separated meetings,messages,mail,notes (default meetings)",
-          takes_value: true,
-          mandatory: false
-        },
-        {
-          flags: "--limit <n>",
-          description: "how many results, 1 through 1000 (default 100)",
-          takes_value: true,
-          mandatory: false,
-          default: 100
-        },
-        {
-          flags: "--page <n>",
-          description: "which page, starting at 1",
-          takes_value: true,
-          mandatory: false
-        },
-        {
-          flags: "--max-meetings <n>",
-          description: "most meetings to look through, newest first, or all (default 100)",
-          takes_value: true,
-          mandatory: false
-        },
-        {
-          flags: "--exact",
-          description: "request exact matching; unsupported meeting queries are reported as skipped",
-          takes_value: false,
-          mandatory: false
-        }
-      ],
-      reason: "Zoom searches explicit local meeting and archive sources, with opt-in unified store reads rather than a live messenger backend."
-    }
-  ]
-};
+// dist/read-only.js
+var pathOf2 = /* @__PURE__ */ __name((command) => {
+  const words = [];
+  for (let at = command; at?.parent; at = at.parent)
+    words.unshift(at.name());
+  return words.join(" ");
+}, "pathOf");
+var usesEmbeddings = /* @__PURE__ */ __name((command, path) => {
+  const options = command.opts();
+  if (path === "meetings embeddings")
+    return true;
+  return path === "search meetings" && options.model !== void 0;
+}, "usesEmbeddings");
+var refusalOf = /* @__PURE__ */ __name((command) => {
+  const effects = metaOf(command).effects;
+  const path = pathOf2(command);
+  if (path === "mcp serve")
+    return void 0;
+  if (isLogin(command))
+    return "log in or out";
+  if (effects?.remote === "write")
+    return "change Zoom";
+  if (usesEmbeddings(command, path))
+    return "build meeting vectors or send text to an embedding service";
+  if (changesAuthorityNow(command))
+    return "change what a later run may do";
+  if (!effects || isStoreChange(command))
+    return "change the local store or local files";
+  return void 0;
+}, "refusalOf");
+var refuseChangeWhenReadOnly = /* @__PURE__ */ __name((command, env) => {
+  const lock2 = readOnlyLockOf(ZM, env);
+  const refusal = lock2 && refusalOf(command);
+  if (lock2 && refusal)
+    throw readOnlyRefusal(lock2, refusal);
+}, "refuseChangeWhenReadOnly");
 
 // dist/commands.js
 var addStandardCommandsDefinition = /* @__PURE__ */ __name((program, deps) => {
@@ -745,7 +550,6 @@ var addStandardCommandsDefinition = /* @__PURE__ */ __name((program, deps) => {
       deps.raw(`${formatSuggestions(suggestions)}
 `);
   }), { effects: NO_EFFECTS, examples: ["zm complete -- meetings s"] });
-  annotate(program.command("doctor").description("check local runtime and public config without a login or database").action(() => deps.output(itemOf(deps.doctor()))), { effects: LOCAL_READ, examples: ["zm doctor --json"] });
   const session = annotate(program.command("session"), { effects: NO_EFFECTS }).description("the saved Zoom login, separate from local data profiles");
   annotate(session.command("status").description("show cached login state; remote verification is explicit").option("--check", "verify the session with Zoom").action(async (options) => deps.output(itemOf(await deps.sessionStatus(options.check === true)))), {
     effects: REMOTE_READ,
@@ -821,15 +625,7 @@ var exampleFor = /* @__PURE__ */ __name((path) => {
   };
   return `zm ${profile}${path}${argumentsByPath[path] ? ` ${argumentsByPath[path]}` : ""} --json`;
 }, "exampleFor");
-var addStandardCommands = /* @__PURE__ */ __name((...args) => {
-  customizeSharedCommand(sharedCommandTemplate(ZM, "doctor"), "Zoom local diagnostics inspect runtime and public config only; online account checks belong to session status.", () => {
-    addStandardCommandsDefinition(...args);
-    const command = args[0].commands.find((command2) => command2.name() === "doctor");
-    if (!command)
-      throw new Error("doctor builder did not install its command");
-    return command;
-  }, SHELL_OVERRIDES.doctor);
-}, "addStandardCommands");
+var addStandardCommands = addStandardCommandsDefinition;
 
 // dist/permissions.js
 var DEFAULT_PERMISSIONS2 = {
@@ -846,14 +642,14 @@ var discoveryLevels = /* @__PURE__ */ __name((own, env) => {
   };
 }, "discoveryLevels");
 var HOUSEKEEPING = /* @__PURE__ */ new Set([...PROFILE_FREE, "session", "mcp"]);
-var pathOf2 = /* @__PURE__ */ __name((command) => {
+var pathOf3 = /* @__PURE__ */ __name((command) => {
   const words = [];
   for (let at = command; at?.parent; at = at.parent)
     words.unshift(at.name());
   return words;
 }, "pathOf");
 var permissionKeyForPath = /* @__PURE__ */ __name((path) => path.length === 0 || HOUSEKEEPING.has(path[0]) && keyForCommand(path) === null ? null : path.join("."), "permissionKeyForPath");
-var permissionKeyOf = /* @__PURE__ */ __name((command) => permissionKeyForPath(pathOf2(command)), "permissionKeyOf");
+var permissionKeyOf = /* @__PURE__ */ __name((command) => permissionKeyForPath(pathOf3(command)), "permissionKeyOf");
 var permissionKeys = /* @__PURE__ */ __name((program) => {
   const keys = /* @__PURE__ */ new Set(["mcp.authority"]);
   const walk = /* @__PURE__ */ __name((command) => {
@@ -916,7 +712,7 @@ var checkPermission = /* @__PURE__ */ __name((command, context) => {
   }
   if (!context.confirm)
     throw new CliError("confirmation_required", `${at} asks first for profile ${profile}: add --yes to apply, or --dry-run to preview`, { key: at });
-  return context.confirm(`zm: ${pathOf2(command).join(" ")} changes Zoom for profile ${profile}. Apply?`).then((yes) => {
+  return context.confirm(`zm: ${pathOf3(command).join(" ")} changes Zoom for profile ${profile}. Apply?`).then((yes) => {
     if (!yes)
       throw new CliError("cancelled", "not applied");
     command.setOptionValue("yes", true);
@@ -928,13 +724,200 @@ var guardCommand = /* @__PURE__ */ __name((command, env, context, confirm) => {
   return checkPermission(command, { ...context, ...confirm ? { confirm } : {}, ...ceiling ? { ceiling } : {} });
 }, "guardCommand");
 
+// dist/config.js
+var ProfileEntry = strictObject({
+  permissions: optional(record(pipe(string(), regex(/^[a-z][a-z.-]*$/)), picklist(LEVELS)))
+});
+var ConfigFile = strictObject({
+  client_id: optional(nullable(pipe(string(), check((id) => id.trim() !== "" && !/\s/.test(id), "has to be a Zoom client ID, without spaces")))),
+  source: optional(picklist(["api", "files"])),
+  files_folder: optional(nullable(string())),
+  files_timezone: optional(nullable(pipe(string(), check((zone) => {
+    try {
+      new Intl.DateTimeFormat("en", { timeZone: zone });
+      return true;
+    } catch {
+      return false;
+    }
+  }, "has to be an IANA time zone, such as Europe/Madrid")))),
+  profiles: optional(pipe(
+    // valibot's record takes a list too, reading its items as profiles named "0", "1"…
+    custom((value) => !Array.isArray(value), "has to be an object keyed by profile name, not a list"),
+    record(pipe(string(), regex(profilePattern, "has to be a profile name of 64 characters at most")), ProfileEntry)
+  )),
+  context_sources: optional(contextSourcesSchema),
+  record: optional(boolean()),
+  keep_runs_for_days: optional(pipe(number(), integer(), minValue(1))),
+  keep_successful_runs_for_days: optional(pipe(number(), integer(), minValue(1))),
+  runs_size_limit_mb: optional(pipe(number(), integer(), minValue(1))),
+  record_input: optional(union([boolean(), literal("failed")]))
+});
+var DOCTOR = "zm doctor";
+var configOf = /* @__PURE__ */ __name((file) => ({
+  clientId: file.client_id ?? null,
+  source: file.source ?? "api",
+  filesFolder: file.files_folder ?? null,
+  filesTimezone: file.files_timezone ?? null,
+  profiles: Object.keys(file.profiles ?? {}).sort(),
+  permissions: Object.fromEntries(Object.entries(file.profiles ?? {}).flatMap(([name, entry]) => entry.permissions ? [[name, entry.permissions]] : [])),
+  ...file.context_sources === void 0 ? {} : { contextSources: file.context_sources },
+  ...file.record === void 0 ? {} : { record: file.record },
+  ...file.keep_runs_for_days === void 0 ? {} : { keepRunsForDays: file.keep_runs_for_days },
+  ...file.keep_successful_runs_for_days === void 0 ? {} : { keepSuccessfulRunsForDays: file.keep_successful_runs_for_days },
+  ...file.runs_size_limit_mb === void 0 ? {} : { runsSizeLimitMb: file.runs_size_limit_mb },
+  ...file.record_input === void 0 ? {} : { recordInput: file.record_input }
+}), "configOf");
+var inspectConfig = /* @__PURE__ */ __name((path, permissionKeys2) => {
+  let text2;
+  try {
+    text2 = readFileSync(path, "utf8");
+  } catch {
+    if (!existsSync(path))
+      return { found: false, issues: [], raw: {}, config: configOf({}) };
+    const what = statSync(path, { throwIfNoEntry: false })?.isDirectory() ? "the path is a folder, not a file" : "the file could not be read";
+    return { found: true, issues: [fileIssue(path, what)], raw: null, config: configOf({}) };
+  }
+  const { issues, raw } = configIssues(text2, path, ConfigFile, permissionKeys2);
+  return {
+    found: true,
+    issues,
+    raw,
+    config: configOf(raw ? parse(ConfigFile, withoutIssues(raw, issues)) : {})
+  };
+}, "inspectConfig");
+var readConfig = /* @__PURE__ */ __name((path, permissionKeys2) => {
+  const { issues, config } = inspectConfig(path, permissionKeys2);
+  if (issues.length > 0)
+    throw new CliError("configuration_error", issueMessage(issues.map(publicIssue), DOCTOR));
+  return config;
+}, "readConfig");
+var changeFile = /* @__PURE__ */ __name((path, permissionKeys2, change) => {
+  const inspection = inspectConfig(path, permissionKeys2);
+  if (!inspection.raw)
+    throw new CliError("configuration_error", issueMessage(inspection.issues.map(publicIssue), DOCTOR));
+  const raw = structuredClone(inspection.raw);
+  change(raw, inspection);
+  saveConfigFile(path, raw);
+  return inspectConfig(path, permissionKeys2).config;
+}, "changeFile");
+var profileEntry = /* @__PURE__ */ __name((raw, profile) => {
+  if (!isNode(raw.profiles))
+    raw.profiles = {};
+  const profiles = raw.profiles;
+  if (!isNode(profiles[profile]))
+    profiles[profile] = {};
+  return profiles[profile];
+}, "profileEntry");
+var FILE_KEYS = Object.fromEntries(Object.entries(SETTING_NAMES).map(([file, name]) => [name, file]));
+var setConfig = /* @__PURE__ */ __name((path, key, value, profile, permissionKeys2) => changeFile(path, permissionKeys2, (raw, { config, issues }) => {
+  switch (key) {
+    case "permissions": {
+      const name = profile?.();
+      if (!name)
+        throw new CliError("validation_error", "name a profile: `zm <profile> config set permissions \u2026`");
+      profileEntry(raw, name).permissions = parsePermissions(value, permissionKeys2 ?? /* @__PURE__ */ new Set());
+      return;
+    }
+    case "context.sources": {
+      const broken = issues.find((issue) => issue.at[0] === "context_sources");
+      if (broken)
+        throw new CliError("configuration_error", issueMessage([publicIssue(broken)], DOCTOR));
+      raw.context_sources = replaceContextSources(value, profile?.() ?? null, config.contextSources);
+      return;
+    }
+    case "zoom.client_id":
+      if (!value.trim() || /\s/.test(value))
+        throw new CliError("validation_error", "client id must not contain whitespace");
+      raw.client_id = value;
+      return;
+    case "source":
+      if (value !== "api" && value !== "files")
+        throw new CliError("validation_error", "source must be api or files");
+      raw.source = value;
+      return;
+    case "files.folder":
+      if (!value.trim())
+        throw new CliError("validation_error", "folder must not be empty");
+      raw.files_folder = value;
+      return;
+    case "files.timezone":
+      try {
+        new Intl.DateTimeFormat("en", { timeZone: value });
+      } catch {
+        throw new CliError("validation_error", "expected an IANA time zone");
+      }
+      raw.files_timezone = value;
+      return;
+    case "record":
+      if (value !== "true" && value !== "false")
+        throw new CliError("validation_error", "record must be true or false");
+      raw.record = value === "true";
+      return;
+    case "keep_runs_for_days":
+      if (!/^[1-9]\d{0,4}$/.test(value))
+        throw new CliError("validation_error", "keep_runs_for_days must be a whole number of days, 1 or more");
+      raw.keep_runs_for_days = Number(value);
+      return;
+    case "record_input":
+      if (value !== "true" && value !== "false" && value !== "failed")
+        throw new CliError("validation_error", "record_input must be true, false or failed");
+      raw.record_input = value === "failed" ? value : value === "true";
+      return;
+    case "keep_successful_runs_for_days":
+      if (!/^[1-9]\d{0,4}$/.test(value))
+        throw new CliError("validation_error", "keep_successful_runs_for_days must be a whole number of days, 1 or more");
+      raw.keep_successful_runs_for_days = Number(value);
+      return;
+    case "runs_size_limit_mb":
+      if (!/^[1-9]\d{0,5}$/.test(value))
+        throw new CliError("validation_error", "runs_size_limit_mb must be a whole number of megabytes, 1 or more");
+      raw.runs_size_limit_mb = Number(value);
+      return;
+    default:
+      throw new CliError("validation_error", "unknown config key");
+  }
+}), "setConfig");
+var unsetConfig = /* @__PURE__ */ __name((path, key, profile, permissionKeys2) => changeFile(path, permissionKeys2, (raw, { issues }) => {
+  const reported = issues.find((issue) => issue.key === key && (issue.profile === void 0 || issue.profile === profile));
+  if (key === "context.sources" && !reported && profile !== void 0 && Array.isArray(raw.context_sources)) {
+    raw.context_sources = raw.context_sources.filter((source) => !isNode(source) || source.profile !== profile);
+    return;
+  }
+  const at = reported?.at ?? (FILE_KEYS[key] ? [FILE_KEYS[key]] : profileSettingAt(key, profile));
+  removeAt(raw, at);
+  const entry = isNode(raw.profiles) ? raw.profiles[at[1] ?? ""] : void 0;
+  if (at[2] === "permissions" && isNode(entry) && isNode(entry.permissions)) {
+    if (Object.keys(entry.permissions).length === 0)
+      delete entry.permissions;
+  }
+}), "unsetConfig");
+var profileSettingAt = /* @__PURE__ */ __name((key, profile) => {
+  if (key !== "permissions" && !key.startsWith("permissions."))
+    throw new CliError("validation_error", "unknown config key");
+  if (!profile)
+    throw new CliError("validation_error", `name a profile: \`zm <profile> config unset ${key}\``);
+  return key === "permissions" ? ["profiles", profile, "permissions"] : ["profiles", profile, "permissions", key.slice("permissions.".length)];
+}, "profileSettingAt");
+var addProfile = /* @__PURE__ */ __name((path, profile) => {
+  if (readConfig(path).profiles.includes(profile))
+    return;
+  changeFile(path, void 0, (raw) => {
+    profileEntry(raw, profile);
+  });
+}, "addProfile");
+var filesZone = /* @__PURE__ */ __name((config) => config.filesTimezone ?? Intl.DateTimeFormat().resolvedOptions().timeZone, "filesZone");
+
 export {
+  publicIssue,
+  profilePattern,
+  profileAccountKey,
+  chooseProfile,
+  contextSourcesSchema,
   ZOOM_ANSWER_ENTITIES,
   declareZoomAnswers,
   bodyOf,
   renderBody,
   wholeList,
-  SHELL_OVERRIDES,
   annotateMeetingCommands,
   markProfileFree,
   zoomRunsCommand,
@@ -943,6 +926,11 @@ export {
   discoveryLevels,
   permissionKeyForPath,
   permissionKeys,
-  parsePermissions,
-  guardCommand
+  guardCommand,
+  inspectConfig,
+  readConfig,
+  setConfig,
+  unsetConfig,
+  addProfile,
+  filesZone
 };