@wirecat/cli-core 0.411.0 → 0.413.0

package/CHANGELOG.md

@@ -5,6 +5,38 @@ Notable changes to `@wirecat/cli-core` (`@wirecat/cli-messaging` up to 0.261.0,
 minor version may break callers, and says how under "Changed — may break callers". `pnpm docs:check` checks the
 shape of this file.
 
+## Unreleased
+
+## 0.413.0 — 25.10.2026
+
+### Added
+
+- **`startCli`, one entry-point call for a CLI that builds its own program** (from `@wirecat/cli-core/cli`). It does what drive, zm and memo wire by hand in `src/bin/`: the crash catch, cancellation on SIGINT and SIGTERM, a quiet exit 0 on a closed pipe, the SQLite swap, the first-run questions (`entry.atStart`), the consent prompt (`entry.ask`) and the browser (`entry.openBrowser`). The program and its failure report stay the CLI's own. Nothing changes for a CLI that keeps its own wiring.
+- **Sign-in module `@wirecat/cli-core/oauth`** (available from cli-core 0.413.0). A CLI declares its provider (URLs, client, loopback or relay redirect) and gets authorization code with PKCE S256 (state check, timeout, cancel, paste fallback), refresh and revoke over plain `fetch`, and a `tokenKeeper` whose refresh takes a lock per keyring entry shared by every process, so two processes refreshing at once send one request. `credentialStorage` sits on cli-base's `Credentials`; `standardCodec` writes new entries as `oauth:<provider>:<profile>`, and `driveSessionCodec` and `zoomTokenCodec` read and write drive's and zm's existing entries unchanged, so nobody signs in again.
+- **`gatherProjectEvidence` caps each linked chat per invocation.** A linked chat returns at most `max(20, floor(maxItems / (linked chats read + 1)))` new items per run (50 for one chat at the default 100 items, 20 from four chats up); the rest stays in the checkpoint for the next `--cursor` run, which gives it a fresh share. Every linked chat still gets its first page before any chat gets a second. Each `linkedChats` entry now has `items` (new items it returned in this run) and `capped` (it hit the limit and has more to read). Before, one busy chat could fill the whole run. Checkpoints stay version 1, and old ones still resume.
+
+### Fixed
+
+- **A file lock no longer fails with "no such file" when another writer releases at the same moment** (available from cli-core 0.413.0). The releaser removes the empty marker folder; an acquirer that had just created it now creates it again instead of throwing `ENOENT`. `acquireLock`, the archive writer lease and the sign-in module's refresh lock all use it.
+- **The 0.412.0 notes for the provider registry, unknown providers and the `events` kind say "available from cli-core 0.413.0"; they shipped in 0.412.0.** The release folded them in from `main`'s head. Nothing else in those entries changes.
+
+## 0.412.0 — 24.10.2026
+
+### Added
+
+- **A stored provider registry** (available from cli-core 0.413.0). `registerProvider(store, { name, kind, aliases, command })` (from `@wirecat/cli-core/store`) writes a CLI's entry into `store_settings` under the key `providers`; every store handle loads the stored entries when it opens, so `kindOf`, `providerNamed` and `--source` in every CLI know a provider cli-core does not list. The built-ins stay the seed. `useProviders(entries)`, `kindIn(provider)`, `providerNamed`, `kindOf`, `providers()`, `KINDS` and `PROVIDERS` are exported from `@wirecat/cli-core`. Two entries that disagree on a kind, or an alias another provider has, are a `validation_error` naming both; a stored entry that clashes with a built-in is left out when the store opens, so it never stops the store opening.
+- **Knowledge lists filter at their native readers.** Organizations, projects, reminders and mail rules accept optional queries before SQL list bounds. Document tags and links accept native selectors, and meeting-link reads can select one URL before aggregation. Existing unfiltered calls keep their behavior.
+
+### Changed — may break callers
+
+- **A provider no registry entry names is skipped, never searched as messages** (available from cli-core 0.413.0). `search messages`, `search all` and `--source` lists report each of its accounts under `skipped` with the reason "unknown provider — run its CLI once" (code `not_found`). The account the search runs as is still read, whatever its provider. `kindOf` keeps its signature and its `messages` default; `kindIn` answers `undefined` for such a provider. `ListedAccount.kind` is now `Kind | undefined`.
+- **`KINDS` and `Kind` gain `events`** (available from cli-core 0.413.0). No search reads events yet; `--source events` says so.
+- **`bot store fetch` is now `bot messages sync`, and the `bot store` group is gone** (tg and max). It does what the personal `messages sync` does, so it carries the same name; `store` is for the local database. The old path answers with a pointer to the new one, and a saved `permissions.bot.store.fetch` is refused until it is renamed to `permissions.bot.messages.sync`. A CLI that customizes the command must move its override to the new path.
+
+### Fixed
+
+- **`config set` and `config unset` work while a moved permission key is saved.** Every other command still refuses the old key and names its replacement; `config unset permissions.<old>` and `config set permissions.<new>` now fix it instead of failing with the same error.
+- **`tasks update <task> --parent none` clears the parent.** The CLI keeps the sentinel through option parsing and converts it to null when building the plan, so Commander cannot turn it into an empty task id.
 
 ## 0.411.0 — 24.10.2026
 

package/dist/cli/bot/command.js

@@ -16,12 +16,12 @@ import { botExamples } from "./examples.js";
 import { BOT_CHATS_QUERY, BOT_PROFILES_QUERY, botChatFilter, botProfileName } from "./list-queries.js";
 import { botMcpCommand } from "./mcp.js";
 import { botCan, botIdOf, botMessagesCommand } from "./messages.js";
+import { botMessagesSyncCommand } from "./messages-sync.js";
 import { botModerateCommand, botRulesCommand } from "./moderation.js";
 import { addBotCopyReads, botContactsCommand, botSearchCommand } from "./people.js";
 import { BOT_ACTIONS } from "./port.js";
 import { registryProfiles } from "./registry.js";
 import { botCallbacksCommand, botMenuCommand, botWebhooksCommand } from "./setup.js";
-import { botStoreCommand } from "./store.js";
 import { BotTokenStore } from "./token.js";
 import { botWatchCommand } from "./watch.js";
 /** Where each of the messenger's other secrets comes from, `null` when it is not set; never the value. */
@@ -289,6 +289,8 @@ const chatsCommand = (bot) => {
  */
 const withCopyReads = (messages, bot) => {
     addBotCopyReads(messages, bot);
+    if (bot.fetching)
+        messages.addCommand(botMessagesSyncCommand(bot, bot.fetching));
     return messages;
 };
 export const botCommand = (bot) => {
@@ -310,7 +312,5 @@ export const botCommand = (bot) => {
         .addCommand(botContactsCommand(bot));
     if (bot.identity)
         command.addCommand(meCommand(bot));
-    if (bot.fetching)
-        command.addCommand(botStoreCommand(bot, bot.fetching));
     return bot.mcp ? command.addCommand(botMcpCommand(bot)) : command;
 };

package/dist/cli/bot/messages-sync.d.ts

@@ -0,0 +1,7 @@
+import { Command } from "commander";
+import type { BotMessenger } from "./port.js";
+/**
+ * `bot messages sync`: a chat's history into the bot's local copy, newest to oldest and resumable, as the
+ * personal `messages sync` does. Mounted for a messenger whose Bot API pages back through a chat.
+ */
+export declare const botMessagesSyncCommand: (bot: BotMessenger, fetching: NonNullable<BotMessenger["fetching"]>) => Command;

package/dist/cli/bot/{store.js → messages-sync.js}

@@ -16,12 +16,11 @@ const wholeNumber = (value) => {
     return parsed;
 };
 /**
- * `bot store fetch`: a chat's history into the bot's local copy, newest to oldest and resumable, as the
+ * `bot messages sync`: a chat's history into the bot's local copy, newest to oldest and resumable, as the
  * personal `messages sync` does. Mounted for a messenger whose Bot API pages back through a chat.
  */
-export const botStoreCommand = (bot, fetching) => {
-    const command = new Command("store").description("the bot's local copy on this machine");
-    const fetch = annotate(command.command("fetch"), { effects: FETCH })
+export const botMessagesSyncCommand = (bot, fetching) => {
+    const fetch = annotate(new Command("sync"), { effects: FETCH })
         .description("fetch a chat's history into the bot's local copy, newest first; run it again to continue")
         .argument("<chat>", "a chat id, or the title of a chat this bot has seen")
         .option("--limit <n>", `at most this many messages in this run; ${fetching.maxPages * fetching.page} if not given`, wholeNumber)
@@ -85,5 +84,5 @@ export const botStoreCommand = (bot, fetching) => {
             stop.release();
         }
     });
-    return command;
+    return fetch;
 };

package/dist/cli/bot/port.d.ts

@@ -53,7 +53,7 @@ export interface BotHistory {
         messages: Message[];
         more: boolean;
     }>;
-    /** One page back from `before` (or from now), newest first: what `bot store fetch` walks. */
+    /** One page back from `before` (or from now), newest first: what `bot messages sync` walks. */
     historyBefore(chat: BotChatRef, window: {
         limit: number;
         before?: string;
@@ -250,7 +250,7 @@ export interface BotNativeApi {
 export interface BotConnectOptions {
     stop?: AbortSignal;
     events?: EventSink;
-    /** Only `bot store fetch` asks for a history reader; other commands stay on the Bot API. */
+    /** Only `bot messages sync` asks for a history reader; other commands stay on the Bot API. */
     history?: {
         from?: string;
         pauseMs: number;
@@ -295,7 +295,7 @@ export interface BotMessenger {
     readSecret?: (command: Command, prompt: string) => Promise<string>;
     /** What kind of chat a stored message came from; without it a positive id is a dialog, a negative one a group. */
     chatKindOf?: (hit: StoredHit) => ChatKind;
-    /** How its history pages, for `bot store fetch`, which is mounted only when this is set. */
+    /** How its history pages, for `bot messages sync`, which is mounted only when this is set. */
     /** `from`: the help of `--until-id`, the message the fetch starts at; the option is mounted only when set. */
     fetching?: Fetching & {
         from?: string;

package/dist/cli/config-command.js

@@ -64,6 +64,7 @@ export const configCommand = (app, config, { permissionKey } = {}) => {
             const context = baseContext(this, (flags, options) => config.resolveSettings(flags, {
                 ...options,
                 needsProfile: !everyone && setting !== "default_profile" && !isStoreSetting(setting),
+                skipMovedPermissions: true,
             }));
             const { settings, renderer, env } = context;
             if (isStoreSetting(setting)) {

package/dist/cli/entry.d.ts

@@ -0,0 +1,59 @@
+import { type ChildProcess, type SpawnOptions } from "node:child_process";
+import type { ErrorReason } from "@wirecat/cli-base/standards";
+import type { Command } from "commander";
+import { type AppIdentity } from "../ports/app.js";
+/** What `startCli` hands the CLI's own program: the process, wired once. */
+export interface EntryContext {
+    /** `process.argv` without the runtime and the script. */
+    args: string[];
+    env: NodeJS.ProcessEnv;
+    /** Whether stdout is a terminal. */
+    tty: boolean;
+    /** Aborted on SIGINT, SIGTERM and a closed or failing stdout. */
+    signal: AbortSignal;
+    /** The first-run questions, before the command acts: call it from a `preAction` hook with the action command. */
+    atStart: (command: Command) => Promise<void>;
+    /** A yes/no question on stderr; false without asking when there is no terminal, under CI, `--json`, `--jsonl` or `--no-input`. */
+    ask: (question: string, command?: Command) => Promise<boolean>;
+    /** Opens the URL in the system browser, or in `browser` when given; never waits for the browser to close. */
+    openBrowser: (url: string, browser?: string) => Promise<void>;
+    /** True once a reader closed the output (`| head`): nothing more reaches the terminal. */
+    outputClosed: () => boolean;
+}
+/** The parts of the process `startCli` touches, replaced in tests. */
+export interface EntryIo {
+    argv: readonly string[];
+    env: NodeJS.ProcessEnv;
+    platform: NodeJS.Platform;
+    stdin: NodeJS.ReadableStream & {
+        isTTY?: boolean;
+    };
+    stdout: NodeJS.WritableStream & {
+        isTTY?: boolean;
+    };
+    stderr: NodeJS.WritableStream & {
+        isTTY?: boolean;
+    };
+    signals: Pick<NodeJS.Process, "on" | "off">;
+    setExitCode: (code: number) => void;
+    spawn: (command: string, args: readonly string[], options: SpawnOptions) => ChildProcess;
+}
+export interface CliEntry {
+    app: AppIdentity;
+    /** Builds and runs the CLI's program; a returned number is the exit code, nothing keeps the one already set. */
+    run: (entry: EntryContext) => Promise<number | undefined>;
+    /** Says a failure the program threw, once, and gives its exit code. */
+    fail: (error: unknown, entry: EntryContext) => number;
+    /** Whether a crash may print the human form; stdout being a terminal when left out. */
+    interactive?: (args: readonly string[], tty: boolean) => boolean;
+    reasons?: readonly ErrorReason[];
+    /** Swap a system SQLite that cannot hold the store before anything runs (`ensureSqlite`). */
+    sqlite?: boolean;
+    io?: Partial<EntryIo>;
+}
+/**
+ * The entry point of a CLI that builds its own commander program: crash catch, cancellation, a quiet end on a closed
+ * pipe, the first-run questions, the consent prompt and the browser. It sets `process.exitCode` and never exits, so
+ * output still flushes.
+ */
+export declare const startCli: (entry: CliEntry) => Promise<void>;

package/dist/cli/entry.js

@@ -0,0 +1,136 @@
+import { spawn } from "node:child_process";
+import { CliError, catchCrashes } from "@wirecat/cli-base";
+import { readOnlyLockOf } from "../ports/app.js";
+import { ensureSqlite } from "../sqlite-runtime.js";
+import { readSecret } from "../terminal/prompt.js";
+import { commandPathOf } from "./command-contract.js";
+import { setupAtStart } from "./first-run.js";
+const processIo = () => ({
+    argv: process.argv,
+    env: process.env,
+    platform: process.platform,
+    stdin: process.stdin,
+    stdout: process.stdout,
+    stderr: process.stderr,
+    signals: process,
+    setExitCode: (code) => {
+        process.exitCode = code;
+    },
+    spawn,
+});
+/**
+ * The entry point of a CLI that builds its own commander program: crash catch, cancellation, a quiet end on a closed
+ * pipe, the first-run questions, the consent prompt and the browser. It sets `process.exitCode` and never exits, so
+ * output still flushes.
+ */
+export const startCli = async (entry) => {
+    const io = { ...processIo(), ...entry.io };
+    const args = io.argv.slice(2);
+    const tty = io.stdout.isTTY === true;
+    const release = catchCrashes({
+        cli: entry.app.command,
+        interactive: entry.interactive?.(args, tty) ?? tty,
+        ...(entry.reasons ? { reasons: entry.reasons } : {}),
+        target: io.signals,
+    });
+    const controller = new AbortController();
+    let closed = false;
+    let unwritable = false;
+    const interrupted = (signal) => () => controller.abort(new CliError("cancelled", `command interrupted by ${signal}`, { reason: signal, retryable: false }));
+    const sigint = interrupted("SIGINT");
+    const sigterm = interrupted("SIGTERM");
+    const outputFailed = (error) => {
+        if (error.code === "EPIPE") {
+            closed = true;
+            controller.abort(new CliError("cancelled", "output pipe closed", { retryable: false }));
+        }
+        else {
+            unwritable = true;
+            controller.abort(new CliError("configuration_error", "could not write command output"));
+        }
+    };
+    const headless = (command) => {
+        const flags = command?.optsWithGlobals() ?? {};
+        return Boolean(flags.json || flags.jsonl || flags.input === false || io.env.CI) || !tty;
+    };
+    const context = {
+        args,
+        env: io.env,
+        tty,
+        signal: controller.signal,
+        atStart: (command) => setupAtStart({
+            command: entry.app.command,
+            env: io.env,
+            path: commandPathOf(command),
+            headless: headless(command),
+            readOnlyLock: readOnlyLockOf(entry.app, io.env),
+            input: io.stdin,
+        }),
+        ask: async (question, command) => {
+            if (headless(command) || io.stdin.isTTY !== true)
+                return false;
+            const answer = await readSecret(`${question} [y/N] `, {
+                input: io.stdin,
+                output: io.stderr,
+                echo: true,
+                signal: controller.signal,
+            });
+            return /^(y|yes)$/i.test(answer.trim());
+        },
+        openBrowser: (url, browser) => openBrowser(io, url, browser),
+        outputClosed: () => closed,
+    };
+    let code;
+    try {
+        if (entry.sqlite)
+            await ensureSqlite();
+        io.signals.on("SIGINT", sigint).on("SIGTERM", sigterm);
+        io.stdout.on("error", outputFailed);
+        io.stderr.on("error", outputFailed);
+        const returned = await entry.run(context);
+        if (typeof returned === "number")
+            code = returned;
+    }
+    catch (error) {
+        code = commanderExit(error) ?? entry.fail(error, context);
+    }
+    finally {
+        io.signals.off("SIGINT", sigint).off("SIGTERM", sigterm);
+        release();
+    }
+    // The listeners stay: output still flushing after the command can meet the closed pipe too.
+    if (closed)
+        io.setExitCode(0);
+    else if (unwritable)
+        io.setExitCode(3);
+    else if (code !== undefined)
+        io.setExitCode(code);
+};
+/** Help and the version were printed already; help for a missing command is a usage mistake, as in `run()`. */
+const commanderExit = (error) => {
+    if (!(error instanceof Error))
+        return undefined;
+    const { code, exitCode } = error;
+    if (typeof code !== "string" || !code.startsWith("commander.") || typeof exitCode !== "number")
+        return undefined;
+    if (exitCode === 0)
+        return 0;
+    return code === "commander.help" ? 2 : undefined;
+};
+const openBrowser = (io, url, browser) => {
+    const [command, prefix] = browser !== undefined
+        ? [browser, []]
+        : io.platform === "darwin"
+            ? ["open", []]
+            : io.platform === "win32"
+                ? ["rundll32.exe", ["url.dll,FileProtocolHandler"]]
+                : ["xdg-open", []];
+    return new Promise((resolve, reject) => {
+        const child = io.spawn(command, [...prefix, url], { detached: true, stdio: "ignore", windowsHide: true });
+        child.once("error", () => reject(new CliError("configuration_error", `could not start ${command} — open the printed URL in a browser`)));
+        child.once("spawn", () => {
+            child.unref();
+            resolve();
+        });
+    });
+};

package/dist/cli/first-run.d.ts

@@ -53,7 +53,7 @@ export declare const askSetupQuestions: (run: FirstRun) => Promise<Question[]>;
 /**
  * The first-run step a tool runs before each command: asks when `asksAtStart` says so, and lets the command run
  * whatever happens to the questions. `setup` asks all three again, since a refusal sends the owner there.
- * A tool that builds its own program (zm, memo, drive) calls this with its command path.
+ * A tool that builds its own program gets it from `startCli` as `entry.atStart`.
  */
 export declare const setupAtStart: (start: {
     command: string;

package/dist/cli/first-run.js

@@ -203,7 +203,7 @@ export const askSetupQuestions = async (run) => {
 /**
  * The first-run step a tool runs before each command: asks when `asksAtStart` says so, and lets the command run
  * whatever happens to the questions. `setup` asks all three again, since a refusal sends the owner there.
- * A tool that builds its own program (zm, memo, drive) calls this with its command path.
+ * A tool that builds its own program gets it from `startCli` as `entry.atStart`.
  */
 export const setupAtStart = async (start) => {
     const input = start.input ?? process.stdin;

package/dist/cli/index.d.ts

@@ -59,6 +59,7 @@ export { type Closeable, withDeadline } from "./deadline.js";
 export { DEFAULT_CONFIG, ensureDefaultConfig } from "./default-config.js";
 export { DISCOVERY_DESCRIPTIONS } from "./discovery-descriptions.js";
 export { changesAuthority, changesAuthorityAt, changesAuthorityNow, destroysNothing, FETCH, grantsAuthority, isLogin, isOtherServiceCall, isStoreChange, judgedEffects, judgedTargets, LOCAL_READ, LOCAL_WRITE, logsInOrOut, NO_EFFECTS, ownerOnlyOption, REMOTE_READ, REMOTE_WRITE, reachesOtherService, refuseUnderReadOnly, } from "./effects.js";
+export { type CliEntry, type EntryContext, type EntryIo, startCli } from "./entry.js";
 export { type AnswerOutput, answerSchema, type Body, type ItemBody, isBody, itemAnswer, itemOf, jsonlRecords, judgedAnswer, type ListBody, type ListInput, listOf, metaNow, printItem, renderAnswer, sealed, snakeKeys, snakeKeysKeeping, } from "./envelope.js";
 export { withAbort } from "./execution.js";
 export { askSetupQuestions, asksAtStart, type FirstRun, type FirstRunIo, LANGUAGES, setupAtStart, systemLanguage, } from "./first-run.js";

package/dist/cli/index.js

@@ -52,6 +52,7 @@ export { withDeadline } from "./deadline.js";
 export { DEFAULT_CONFIG, ensureDefaultConfig } from "./default-config.js";
 export { DISCOVERY_DESCRIPTIONS } from "./discovery-descriptions.js";
 export { changesAuthority, changesAuthorityAt, changesAuthorityNow, destroysNothing, FETCH, grantsAuthority, isLogin, isOtherServiceCall, isStoreChange, judgedEffects, judgedTargets, LOCAL_READ, LOCAL_WRITE, logsInOrOut, NO_EFFECTS, ownerOnlyOption, REMOTE_READ, REMOTE_WRITE, reachesOtherService, refuseUnderReadOnly, } from "./effects.js";
+export { startCli } from "./entry.js";
 export { answerSchema, isBody, itemAnswer, itemOf, jsonlRecords, judgedAnswer, listOf, metaNow, printItem, renderAnswer, sealed, snakeKeys, snakeKeysKeeping, } from "./envelope.js";
 export { withAbort } from "./execution.js";
 export { askSetupQuestions, asksAtStart, LANGUAGES, setupAtStart, systemLanguage, } from "./first-run.js";

package/dist/cli/messenger/store-maintenance-command.d.ts

@@ -3,9 +3,9 @@ import type { CacheDatabase } from "../../store/driver.js";
 import type { Messenger } from "./context.js";
 /** `doctor`'s short summary of the store. Must answer for a broken file, so an error is a field. */
 export declare const storeSummary: (env: NodeJS.ProcessEnv) => Promise<{
+    error?: undefined;
     path: string;
     exists: boolean;
-    error?: undefined;
 } | {
     path: string;
     exists: boolean;

package/dist/cli/messenger/tasks-command.js

@@ -111,7 +111,7 @@ const planFrom = (options) => {
     if (options.priority !== undefined)
         plan.priority = options.priority;
     if (options.parent !== undefined)
-        plan.parent = options.parent;
+        plan.parent = options.parent === "none" ? null : options.parent;
     if (options.category !== undefined)
         plan.category = options.category;
     if (options.title !== undefined)
@@ -203,7 +203,7 @@ export const tasksCommand = (messenger) => {
             throw new CliError("validation_error", "--priority takes 0 through 4");
         return Number(value);
     })
-        .option("--parent <id>", "parent task in the same project; none clears it", (value) => value === "none" ? null : value), "send Alex the API token").action(async function (id) {
+        .option("--parent <id>", "parent task in the same project; none clears it"), "send Alex the API token").action(async function (id) {
         const context = messengerContext(this, messenger);
         refuseLocalWrite(context, messenger.app.command, "tasks.update");
         const plan = planFrom(this.opts());

package/dist/cli/moved.js

@@ -32,6 +32,7 @@ export const RENAMED_COMMANDS = {
     "mcp setup": "mcp add",
     "mcp doctor": "mcp check",
     "commands schema": "commands info",
+    "bot store fetch": "bot messages sync",
     "store gaps plan": "store gaps show",
     "store reindex": "store rebuild",
     "stats messages counters refresh": "stats messages counters sync",

package/dist/cli/settings.d.ts

@@ -140,6 +140,8 @@ export interface ResolveOptions {
     needsProfile?: boolean;
     /** Read the config file without writing it: no default file. For a dry run. */
     readOnly?: boolean;
+    /** Skip moved permission keys instead of refusing them, so `config set` and `unset` can fix one. */
+    skipMovedPermissions?: boolean;
 }
 /** Where `profile` came from when none was named and the command needs none. */
 export declare const NONE_NAMED = "none named";

package/dist/cli/settings.js

@@ -4,6 +4,7 @@ import * as v from "valibot";
 import { AI_ENTRIES, resolveAISettings } from "../analysis/settings.js";
 import { parseDuration } from "../domain/duration.js";
 import { envName, readOnlyLockOf } from "../ports/app.js";
+import { canonicalPermissionKey } from "../sends/permission-aliases.js";
 import { assertOverridesTighten, CEILING_KEY, LEVELS, layerPermissions, permissionOverrides, RESOURCES, } from "../sends/permissions.js";
 import { storePath } from "../store/path.js";
 import { sharedConfigPath } from "../store/shared-config.js";
@@ -77,6 +78,7 @@ const SHARED_DEFAULTS_ONLY = {
     update_check: v.optional(flag),
     skill_hint: v.optional(flag),
 };
+const withoutMoved = (levels) => levels && Object.fromEntries(Object.entries(levels).filter(([key]) => canonicalPermissionKey(key) === key));
 /** Where `profile` came from when none was named and the command needs none. */
 export const NONE_NAMED = "none named";
 /** A name for a command that speaks for no account; never chosen for one that does. */
@@ -230,7 +232,9 @@ export const settingsFor = (app, extension = {}) => {
             : { value: false, from: "default" };
         const fileLayers = layers.map(([from, scope]) => [
             from,
-            scope?.permissions,
+            options.skipMovedPermissions
+                ? withoutMoved(scope?.permissions)
+                : scope?.permissions,
         ]);
         const overrides = permissionOverrides(flags.permission);
         assertOverridesTighten(overrides, layerPermissions(fileLayers).levels);

package/dist/domain/providers.d.ts

@@ -1,20 +1,42 @@
 import type { Provider } from "./models.js";
 /** What a search reads; the same names `--only`, `searched` and `skipped` use. */
-export declare const KINDS: readonly ["messages", "mail", "notes", "documents", "meetings"];
+export declare const KINDS: readonly ["messages", "mail", "notes", "documents", "meetings", "events"];
 export type Kind = (typeof KINDS)[number];
 export interface ProviderEntry {
     name: Provider;
     kind: Kind;
     aliases: readonly string[];
+    /** The CLI that wrote the entry (`zm`, `drive`). One CLI may write several providers, so it is not an alias. */
+    command?: string;
 }
-/** Adding a provider is one entry here; `--source` and every search read it. */
+/** The seed: what cli-core knows before any CLI has written its entry into the store. */
 export declare const PROVIDERS: readonly ProviderEntry[];
 /** The store keeps a notes folder as an `accounts` row of this provider; people call it `notes`. */
 export declare const FOLDER_PROVIDER = "folder";
 /** Notes written in memo have no account row; this is their account. */
 export declare const INTERNAL_NOTES = "internal";
+/** The reason a search gives for an account whose provider no entry names. */
+export declare const UNKNOWN_PROVIDER = "unknown provider \u2014 run its CLI once";
+/** An entry as a CLI or the store gives it, checked: anything else is a `validation_error`. */
+export declare const providerEntryOf: (value: unknown) => ProviderEntry;
+/** The built-ins and the entries the store or the CLI running gave; what `kindOf` and `providerNamed` read. */
+export declare const providers: () => readonly ProviderEntry[];
+/**
+ * Replaces the entries beyond the built-ins. Opening the store calls it with the stored entries; a test or a CLI
+ * with no store may call it too. Two entries that disagree on a kind, or one word naming two providers, throw.
+ */
+export declare const useProviders: (entries: readonly ProviderEntry[]) => void;
+/**
+ * Like `useProviders`, but an entry that clashes is left out instead of failing: what the store holds was written
+ * by CLIs of other versions, and one stale entry must not stop the store opening. Answers the entries left out.
+ */
+export declare const useStoredProviders: (entries: readonly unknown[]) => unknown[];
+/** Adds one entry to those in use, strictly: a clash throws and leaves the registry as it was. */
+export declare const addProvider: (entry: ProviderEntry) => void;
 export declare const isKind: (word: string) => word is Kind;
 /** The registry's provider a name or alias stands for. */
 export declare const providerNamed: (word: string) => ProviderEntry | undefined;
-/** A provider the registry does not list is a messenger: consumers define their own and tests use made-up ones. */
+/** The kind of a provider the registry knows; `undefined` for one no entry names, which a search skips. */
+export declare const kindIn: (provider: Provider) => Kind | undefined;
+/** A provider the registry does not list counts as a messenger here; a search asks `kindIn` and skips it. */
 export declare const kindOf: (provider: Provider) => Kind;

package/dist/domain/providers.js

@@ -1,6 +1,7 @@
+import { CliError } from "@wirecat/cli-base";
 /** What a search reads; the same names `--only`, `searched` and `skipped` use. */
-export const KINDS = ["messages", "mail", "notes", "documents", "meetings"];
-/** Adding a provider is one entry here; `--source` and every search read it. */
+export const KINDS = ["messages", "mail", "notes", "documents", "meetings", "events"];
+/** The seed: what cli-core knows before any CLI has written its entry into the store. */
 export const PROVIDERS = [
     { name: "telegram", kind: "messages", aliases: ["tg"] },
     { name: "telegram-bot", kind: "messages", aliases: ["tg-bot"] },
@@ -16,11 +17,94 @@ export const PROVIDERS = [
 export const FOLDER_PROVIDER = "folder";
 /** Notes written in memo have no account row; this is their account. */
 export const INTERNAL_NOTES = "internal";
+/** The reason a search gives for an account whose provider no entry names. */
+export const UNKNOWN_PROVIDER = "unknown provider — run its CLI once";
+const WORD = /^[a-z0-9][a-z0-9_-]*$/;
+const invalid = (message) => {
+    throw new CliError("validation_error", message);
+};
+const wordOf = (value, what) => typeof value === "string" && WORD.test(value)
+    ? value
+    : invalid(`${what} is lowercase letters, digits, - and _ — not ${JSON.stringify(value)}`);
+/** An entry as a CLI or the store gives it, checked: anything else is a `validation_error`. */
+export const providerEntryOf = (value) => {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return invalid("a provider entry is an object");
+    const { name, kind, aliases = [], command } = value;
+    const named = wordOf(name, "a provider's name");
+    if (typeof kind !== "string" || !KINDS.includes(kind))
+        invalid(`provider ${named}'s kind is one of ${KINDS.join(", ")} — not ${JSON.stringify(kind)}`);
+    if (!Array.isArray(aliases))
+        invalid(`provider ${named}'s aliases are a list`);
+    return {
+        name: named,
+        kind: kind,
+        aliases: [...new Set(aliases.map((alias) => wordOf(alias, `an alias of ${named}`)))],
+        ...(command === undefined ? {} : { command: wordOf(command, `the command of ${named}`) }),
+    };
+};
+const describe = ({ name, kind, command }) => `${name} (${kind}${command ? `, from ${command}` : ""})`;
+const wordsOf = ({ name, aliases }) => [name, ...aliases];
+/** `entry` joined to `known`: the same name keeps one entry with both entries' aliases; a clash is an error. */
+const joined = (known, entry) => {
+    const same = known.find(({ name }) => name === entry.name);
+    if (same && same.kind !== entry.kind)
+        invalid(`two provider entries disagree on the kind: ${describe(same)} and ${describe(entry)}`);
+    const merged = same
+        ? {
+            ...same,
+            aliases: [...new Set([...same.aliases, ...entry.aliases])],
+            ...(entry.command ? { command: entry.command } : {}),
+        }
+        : entry;
+    const others = known.filter((one) => one !== same);
+    for (const word of wordsOf(merged)) {
+        const owner = others.find((one) => wordsOf(one).includes(word));
+        if (owner)
+            invalid(`"${word}" names two providers: ${describe(owner)} and ${describe(merged)}`);
+    }
+    return same ? known.map((one) => (one === same ? merged : one)) : [...known, merged];
+};
+let registry = PROVIDERS;
+/** The built-ins and the entries the store or the CLI running gave; what `kindOf` and `providerNamed` read. */
+export const providers = () => registry;
+/**
+ * Replaces the entries beyond the built-ins. Opening the store calls it with the stored entries; a test or a CLI
+ * with no store may call it too. Two entries that disagree on a kind, or one word naming two providers, throw.
+ */
+export const useProviders = (entries) => {
+    registry = entries.map(providerEntryOf).reduce(joined, PROVIDERS);
+};
+/**
+ * Like `useProviders`, but an entry that clashes is left out instead of failing: what the store holds was written
+ * by CLIs of other versions, and one stale entry must not stop the store opening. Answers the entries left out.
+ */
+export const useStoredProviders = (entries) => {
+    const left = [];
+    registry = entries.reduce((known, entry) => {
+        try {
+            return joined(known, providerEntryOf(entry));
+        }
+        catch (error) {
+            if (!(error instanceof CliError))
+                throw error;
+            left.push(entry);
+            return known;
+        }
+    }, PROVIDERS);
+    return left;
+};
+/** Adds one entry to those in use, strictly: a clash throws and leaves the registry as it was. */
+export const addProvider = (entry) => {
+    registry = joined(registry, providerEntryOf(entry));
+};
 export const isKind = (word) => KINDS.includes(word.toLowerCase());
 /** The registry's provider a name or alias stands for. */
 export const providerNamed = (word) => {
     const wanted = word.toLowerCase();
-    return PROVIDERS.find(({ name, aliases }) => name === wanted || aliases.includes(wanted));
+    return registry.find((entry) => wordsOf(entry).includes(wanted));
 };
-/** A provider the registry does not list is a messenger: consumers define their own and tests use made-up ones. */
-export const kindOf = (provider) => provider === FOLDER_PROVIDER ? "notes" : (providerNamed(provider)?.kind ?? "messages");
+/** The kind of a provider the registry knows; `undefined` for one no entry names, which a search skips. */
+export const kindIn = (provider) => provider === FOLDER_PROVIDER ? "notes" : registry.find(({ name }) => name === provider)?.kind;
+/** A provider the registry does not list counts as a messenger here; a search asks `kindIn` and skips it. */
+export const kindOf = (provider) => kindIn(provider) ?? "messages";