@wirecat/cli-core 0.411.0 → 0.413.0

package/dist/oauth/requests.d.ts

@@ -0,0 +1,11 @@
+import type { ExchangeContext, OAuthProvider, RequestContext, TokenSet } from "./provider.js";
+export declare const TOKEN_LOG_EVENT = "oauth.token";
+/** The keys the module's log records carry, for a run log's `allow`; names only, never a token. */
+export declare const TOKEN_LOG_ALLOW: readonly ["provider", "operation", "outcome", "status", "rotated", "pid"];
+/**
+ * The token endpoint, form-encoded, for both grants. Nothing from the request or the response reaches a message or
+ * a log record: both carry codes and tokens.
+ */
+export declare const requestTokens: (provider: OAuthProvider, params: Record<string, string>, context: ExchangeContext) => Promise<TokenSet>;
+/** Revokes the refresh token at `revokeUrl`. A provider without one, or with another method, declares `revoke`. */
+export declare const revokeToken: (provider: OAuthProvider, tokens: TokenSet, context: RequestContext) => Promise<void>;

package/dist/oauth/requests.js

@@ -0,0 +1,129 @@
+import { CliError, isCliError } from "@wirecat/cli-base";
+const REQUEST_LIMIT_MS = 30_000;
+export const TOKEN_LOG_EVENT = "oauth.token";
+/** The keys the module's log records carry, for a run log's `allow`; names only, never a token. */
+export const TOKEN_LOG_ALLOW = ["provider", "operation", "outcome", "status", "rotated", "pid"];
+const object = (value) => {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        throw new Error("not an object");
+    return value;
+};
+const requestSignal = (signal) => signal ? AbortSignal.any([signal, AbortSignal.timeout(REQUEST_LIMIT_MS)]) : AbortSignal.timeout(REQUEST_LIMIT_MS);
+const cancelledBy = (signal) => {
+    if (!signal?.aborted)
+        return;
+    throw isCliError(signal.reason) ? signal.reason : new CliError("cancelled", "sign-in was cancelled");
+};
+const post = async (url, body, context) => {
+    cancelledBy(context.signal);
+    try {
+        return await context.fetch(url, {
+            method: "POST",
+            headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+            body,
+            signal: requestSignal(context.signal),
+            redirect: "error",
+        });
+    }
+    catch {
+        cancelledBy(context.signal);
+        return undefined;
+    }
+};
+const clientFields = ({ client }) => ({
+    client_id: client.clientId,
+    ...(client.clientSecret ? { client_secret: client.clientSecret } : {}),
+});
+/**
+ * The token endpoint, form-encoded, for both grants. Nothing from the request or the response reaches a message or
+ * a log record: both carry codes and tokens.
+ */
+export const requestTokens = async (provider, params, context) => {
+    const operation = params.grant_type ?? "unknown";
+    const record = (level, fields) => context.log?.[level]({ event: TOKEN_LOG_EVENT, provider: provider.id, operation, pid: process.pid, ...fields });
+    const again = `run ${context.signInCommand} again`;
+    const response = await post(provider.tokenUrl, new URLSearchParams({ ...params, ...clientFields(context) }), context);
+    if (!response) {
+        record("warn", { outcome: "no_response" });
+        throw new CliError("outcome_unknown", `${provider.name} token request did not finish; ${again} if it keeps failing`, {
+            reason: "oauth.no-response",
+        });
+    }
+    if (!response.ok) {
+        record("warn", { outcome: "rejected", status: response.status });
+        if (response.status === 429 || response.status >= 500)
+            throw new CliError("provider_unavailable", `${provider.name} token request failed (HTTP ${response.status})`, {
+                status: response.status,
+                retryable: true,
+                reason: "oauth.unavailable",
+            });
+        throw new CliError("authentication_error", `${provider.name} sign-in was refused (HTTP ${response.status}); ${again}`, {
+            status: response.status,
+            reason: "oauth.expired",
+        });
+    }
+    let body;
+    try {
+        body = object(await response.json());
+    }
+    catch {
+        record("error", { outcome: "unreadable_response", status: response.status });
+        throw new CliError("invalid_response", `${provider.name} returned an unreadable token response; ${again}`, {
+            reason: "oauth.invalid-response",
+        });
+    }
+    const previous = context.previous;
+    const refreshToken = typeof body.refresh_token === "string" && body.refresh_token ? body.refresh_token : previous?.refreshToken;
+    const expiresIn = body.expires_in;
+    if (typeof body.access_token !== "string" ||
+        !body.access_token ||
+        (expiresIn !== undefined && (typeof expiresIn !== "number" || !Number.isFinite(expiresIn) || expiresIn <= 0)) ||
+        (body.scope !== undefined && typeof body.scope !== "string") ||
+        (body.token_type !== undefined && typeof body.token_type !== "string")) {
+        record("error", { outcome: "invalid_response", status: response.status });
+        throw new CliError("invalid_response", `${provider.name} returned an invalid token response; ${again}`, {
+            reason: "oauth.invalid-response",
+        });
+    }
+    if (!refreshToken) {
+        record("error", { outcome: "no_refresh_token", status: response.status });
+        throw new CliError("authentication_error", `${provider.name} returned no offline refresh token; ${again}`, {
+            reason: "oauth.failed",
+        });
+    }
+    const scopes = typeof body.scope === "string" ? body.scope.split(/\s+/).filter(Boolean) : (previous?.scopes ?? []);
+    const tokenType = typeof body.token_type === "string" ? body.token_type : previous?.tokenType;
+    record("info", {
+        outcome: "received",
+        status: response.status,
+        ...(previous ? { rotated: refreshToken !== previous.refreshToken } : {}),
+    });
+    return {
+        accessToken: body.access_token,
+        refreshToken,
+        ...(typeof expiresIn === "number" ? { expiresAt: context.now() + expiresIn * 1000 } : {}),
+        scopes,
+        ...(tokenType ? { tokenType } : {}),
+    };
+};
+/** Revokes the refresh token at `revokeUrl`. A provider without one, or with another method, declares `revoke`. */
+export const revokeToken = async (provider, tokens, context) => {
+    if (provider.revoke)
+        return provider.revoke(tokens, context);
+    if (!provider.revokeUrl)
+        throw new CliError("validation_error", `${provider.name} declares no way to revoke a sign-in`);
+    const response = await post(provider.revokeUrl, new URLSearchParams({ token: tokens.refreshToken, ...clientFields(context) }), context);
+    context.log?.[response?.ok ? "info" : "warn"]({
+        event: TOKEN_LOG_EVENT,
+        provider: provider.id,
+        operation: "revoke",
+        pid: process.pid,
+        outcome: response?.ok ? "revoked" : response ? "rejected" : "no_response",
+        ...(response ? { status: response.status } : {}),
+    });
+    if (!response?.ok)
+        throw new CliError("outcome_unknown", `${provider.name} did not confirm the revoke`, {
+            reason: "oauth.revoke-failed",
+            ...(response ? { status: response.status } : {}),
+        });
+};

package/dist/oauth/storage.d.ts

@@ -0,0 +1,48 @@
+import { type CredentialSource, type CredentialsOptions } from "@wirecat/cli-base";
+import type { OAuthClient, TokenSet } from "./provider.js";
+export interface StoredTokens {
+    tokens: TokenSet;
+    /** The app the entry was signed in with, when the entry records it; refresh must use that one. */
+    client?: OAuthClient;
+}
+export interface EncodeInput {
+    tokens: TokenSet;
+    client: OAuthClient;
+    /** The entry as stored before, so fields the codec does not own survive a write. */
+    previous?: string;
+    /** Fields a CLI adds at sign-in, such as drive's `principal`. */
+    extra?: Record<string, unknown>;
+}
+/** Every failure throws a fixed message: a parser's message would quote the secret. */
+export interface TokenCodec {
+    decode(raw: string): StoredTokens;
+    encode(input: EncodeInput): string;
+}
+export interface TokenStorage {
+    /** Names the entry across processes; the lock is keyed by it. */
+    readonly key: string;
+    /** Throws when the entry cannot be saved, so a sign-in fails before the browser, not after consent. */
+    probe(): void;
+    read(): StoredTokens | undefined;
+    write(input: Omit<EncodeInput, "previous">): void;
+    remove(): CredentialSource[];
+}
+export declare const oauthAccount: (providerId: string, profile: string) => string;
+/** The entry every new sign-in writes: account `oauth:<provider>:<profile>` under the CLI's own service. */
+export declare const standardCodec: (providerId: string) => TokenCodec;
+/**
+ * drive's entry as drive-cli writes it today: `{principal, clientId, clientSecret?, tokens: {access_token,
+ * refresh_token, expiry_date, scope, token_type, …}}`. A write keeps every field it does not own.
+ */
+export declare const driveSessionCodec: TokenCodec;
+/** zm's entry as zoom-cli writes it today: `{accessToken, refreshToken, expiresAt, scopes}`, all four required. */
+export declare const zoomTokenCodec: TokenCodec;
+export interface CredentialStorageOptions {
+    /** What the CLI passes `Credentials` today; the same options address the same entry. */
+    credentials: CredentialsOptions;
+    account: string;
+    /** Older accounts read when `account` is empty; a hit is copied to `account` and left in place. */
+    legacyAccounts?: readonly string[];
+    codec: TokenCodec;
+}
+export declare const credentialStorage: (options: CredentialStorageOptions) => TokenStorage;

package/dist/oauth/storage.js

@@ -0,0 +1,197 @@
+import { CliError, Credentials, keyringService, } from "@wirecat/cli-base";
+const invalid = () => new CliError("authentication_error", "the saved sign-in cannot be read; sign in again", { reason: "oauth.invalid" });
+const parse = (raw) => {
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        throw invalid();
+    }
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        throw invalid();
+    return value;
+};
+const text = (value) => (typeof value === "string" && value ? value : undefined);
+const finite = (value) => typeof value === "number" && Number.isFinite(value) ? value : undefined;
+const previousOf = (raw) => {
+    if (raw === undefined)
+        return {};
+    try {
+        return parse(raw);
+    }
+    catch {
+        return {};
+    }
+};
+const defined = (value) => Object.fromEntries(Object.entries(value).filter(([, field]) => field !== undefined));
+export const oauthAccount = (providerId, profile) => {
+    if (!profile.trim())
+        throw new CliError("validation_error", "name a profile: a sign-in always belongs to one");
+    return `oauth:${providerId}:${profile}`;
+};
+/** The entry every new sign-in writes: account `oauth:<provider>:<profile>` under the CLI's own service. */
+export const standardCodec = (providerId) => ({
+    decode: (raw) => {
+        const value = parse(raw);
+        const refreshToken = text(value.refreshToken);
+        const clientId = text(value.clientId);
+        if (value.version !== 1 || value.provider !== providerId || !refreshToken || !clientId)
+            throw invalid();
+        if (!Array.isArray(value.scopes) || !value.scopes.every((scope) => typeof scope === "string"))
+            throw invalid();
+        return {
+            client: { clientId },
+            tokens: defined({
+                accessToken: text(value.accessToken),
+                refreshToken,
+                expiresAt: finite(value.expiresAt),
+                scopes: value.scopes,
+                tokenType: text(value.tokenType),
+            }),
+        };
+    },
+    encode: ({ tokens, client, previous, extra }) => JSON.stringify(defined({
+        ...previousOf(previous),
+        ...extra,
+        version: 1,
+        provider: providerId,
+        clientId: client.clientId,
+        accessToken: tokens.accessToken,
+        refreshToken: tokens.refreshToken,
+        expiresAt: tokens.expiresAt,
+        scopes: tokens.scopes,
+        tokenType: tokens.tokenType,
+    })),
+});
+/**
+ * drive's entry as drive-cli writes it today: `{principal, clientId, clientSecret?, tokens: {access_token,
+ * refresh_token, expiry_date, scope, token_type, …}}`. A write keeps every field it does not own.
+ */
+export const driveSessionCodec = {
+    decode: (raw) => {
+        const value = parse(raw);
+        const tokens = value.tokens;
+        if (typeof tokens !== "object" || tokens === null || Array.isArray(tokens))
+            throw invalid();
+        const fields = tokens;
+        const refreshToken = text(fields.refresh_token);
+        const clientId = text(value.clientId);
+        if (!refreshToken || !clientId || typeof value.principal !== "string")
+            throw invalid();
+        return {
+            client: defined({ clientId, clientSecret: text(value.clientSecret) }),
+            tokens: defined({
+                accessToken: text(fields.access_token),
+                refreshToken,
+                expiresAt: finite(fields.expiry_date),
+                scopes: typeof fields.scope === "string" ? fields.scope.split(/\s+/).filter(Boolean) : [],
+                tokenType: text(fields.token_type),
+            }),
+        };
+    },
+    encode: ({ tokens, client, previous, extra }) => {
+        const before = previousOf(previous);
+        const oldTokens = typeof before.tokens === "object" && before.tokens !== null ? before.tokens : {};
+        const session = {
+            ...before,
+            ...extra,
+            clientId: client.clientId,
+            ...(client.clientSecret ? { clientSecret: client.clientSecret } : {}),
+            tokens: defined({
+                ...oldTokens,
+                access_token: tokens.accessToken,
+                refresh_token: tokens.refreshToken,
+                expiry_date: tokens.expiresAt,
+                ...(tokens.scopes.length ? { scope: tokens.scopes.join(" ") } : {}),
+                token_type: tokens.tokenType,
+            }),
+        };
+        if (typeof session.principal !== "string")
+            throw new CliError("configuration_error", "drive's sign-in entry needs the account's principal");
+        return JSON.stringify(session);
+    },
+};
+/** zm's entry as zoom-cli writes it today: `{accessToken, refreshToken, expiresAt, scopes}`, all four required. */
+export const zoomTokenCodec = {
+    decode: (raw) => {
+        const value = parse(raw);
+        const accessToken = text(value.accessToken);
+        const refreshToken = text(value.refreshToken);
+        const expiresAt = finite(value.expiresAt);
+        if (!accessToken || !refreshToken || expiresAt === undefined)
+            throw invalid();
+        if (!Array.isArray(value.scopes) || !value.scopes.every((scope) => typeof scope === "string"))
+            throw invalid();
+        return { tokens: { accessToken, refreshToken, expiresAt, scopes: value.scopes } };
+    },
+    encode: ({ tokens }) => {
+        if (!tokens.accessToken)
+            throw new CliError("invalid_response", "zm's sign-in entry needs an access token");
+        return JSON.stringify({
+            accessToken: tokens.accessToken,
+            refreshToken: tokens.refreshToken,
+            expiresAt: tokens.expiresAt ?? 0,
+            scopes: tokens.scopes,
+        });
+    },
+};
+const keyringFailure = () => new CliError("configuration_error", "could not reach the saved sign-in; use an available keyring or file storage", {
+    reason: "oauth.not-saved",
+});
+export const credentialStorage = (options) => {
+    if (!options.credentials.keyring)
+        throw new CliError("configuration_error", "a sign-in store needs its keyring passed in, never a default");
+    const credentials = new Credentials(options.credentials);
+    const { account, codec } = options;
+    const service = keyringService(options.credentials.service, options.credentials.configDir, options.credentials.isolated);
+    const raw = (name) => {
+        try {
+            return credentials.read(name)?.secret;
+        }
+        catch {
+            throw keyringFailure();
+        }
+    };
+    const save = (value) => {
+        try {
+            credentials.write(account, value);
+        }
+        catch {
+            throw keyringFailure();
+        }
+    };
+    const current = () => {
+        const own = raw(account);
+        if (own !== undefined)
+            return own;
+        for (const legacy of options.legacyAccounts ?? []) {
+            const found = raw(legacy);
+            if (found === undefined)
+                continue;
+            codec.decode(found);
+            save(found);
+            return found;
+        }
+        return undefined;
+    };
+    return {
+        key: `${service}\u0000${account}`,
+        probe: () => {
+            raw(account);
+        },
+        read: () => {
+            const value = current();
+            return value === undefined ? undefined : codec.decode(value);
+        },
+        write: (input) => save(codec.encode({ ...input, previous: raw(account) })),
+        remove: () => {
+            try {
+                return credentials.remove(account);
+            }
+            catch {
+                throw keyringFailure();
+            }
+        },
+    };
+};

package/dist/search/account-list.d.ts

@@ -24,9 +24,12 @@ export interface ListContext {
         command?: string;
     };
 }
-/** An account as `--source` and a hit name it: a notes folder is `notes:<its id>`, never the store's ulid. */
+/**
+ * An account as `--source` and a hit name it: a notes folder is `notes:<its id>`, never the store's ulid. The kind is
+ * `undefined` for a provider no registry entry names: no search reads it, and `fitting` reports it.
+ */
 export interface ListedAccount extends AccountKey {
-    kind: Kind;
+    kind: Kind | undefined;
 }
 /** One entry of the list as written, a group's member included, and the accounts it named. */
 export interface ListedEntry {

package/dist/search/account-list.js

@@ -1,5 +1,5 @@
 import { CliError } from "@wirecat/cli-base";
-import { FOLDER_PROVIDER, INTERNAL_NOTES, isKind, kindOf, PROVIDERS, providerNamed, } from "../domain/providers.js";
+import { FOLDER_PROVIDER, INTERNAL_NOTES, isKind, kindIn, kindOf, providerNamed, providers as registered, UNKNOWN_PROVIDER, } from "../domain/providers.js";
 import { isBotProvider } from "./query.js";
 /** Store-wide: every profile, tg, MAX and memo reads the same groups. */
 export const ACCOUNT_GROUPS = "accountGroups";
@@ -25,16 +25,20 @@ export const groupMembers = (value) => itemsOf(value).map((item) => item.toLower
         ? fail(`"${item}" names no account after the colon`)
         : item);
 const describe = (accounts) => accounts.map(({ provider, account, name }) => `${provider}:${account}${name ? ` (${name})` : ""}`).join(", ");
-const heldOf = (stored) => [
+/** The app running knows its own provider is a messenger, entry or not. */
+const kindHere = (provider, running) => provider === running.provider ? kindOf(provider) : kindIn(provider);
+const heldOf = (stored, running) => [
     ...stored
-        .filter(({ provider }) => kindOf(provider) !== "notes")
-        .map(({ provider, account, name }) => ({ provider, account, name, kind: kindOf(provider) })),
+        .filter(({ provider }) => kindIn(provider) !== "notes")
+        .map(({ provider, account, name }) => ({ provider, account, name, kind: kindHere(provider, running) })),
     { provider: "notes", account: INTERNAL_NOTES, name: null, kind: "notes" },
     ...stored
         .filter(({ provider }) => provider === FOLDER_PROVIDER)
         .map(({ id, name }) => ({ provider: "notes", account: String(id), name, kind: "notes" })),
 ];
-const registry = () => PROVIDERS.map(({ name, aliases }) => (aliases.length ? `${name} (${aliases.join(", ")})` : name)).join(", ");
+const registry = () => registered()
+    .map(({ name, aliases }) => (aliases.length ? `${name} (${aliases.join(", ")})` : name))
+    .join(", ");
 const providerOf = (prefix, held, { running, profiles }) => {
     const wanted = prefix.toLowerCase();
     if (wanted === running.command?.toLowerCase())
@@ -57,7 +61,11 @@ const accountOf = (prefix, ref, held, context) => {
     const byId = ofProvider.find(({ account }) => account === ref || account === ref.toLowerCase());
     if (byId)
         return byId;
-    const keyed = (key) => ofProvider.find(({ account }) => account === key.account) ?? { ...key, name: null, kind: kindOf(key.provider) };
+    const keyed = (key) => ofProvider.find(({ account }) => account === key.account) ?? {
+        ...key,
+        name: null,
+        kind: kindHere(key.provider, context.running),
+    };
     const recorded = context.profiles[prefix.toLowerCase()]?.[ref];
     if (recorded?.provider === FOLDER_PROVIDER) {
         const folder = held.find((one) => one.provider === "notes" && one.name === recorded.account);
@@ -105,7 +113,7 @@ const keyOf = ({ provider, account }) => `${provider}\u0000${account}`;
  * the account's name — a bare provider for all its accounts, or a bare kind for every provider of it.
  */
 export const entriesOfList = (value, context) => {
-    const held = heldOf(context.held);
+    const held = heldOf(context.held, context.running);
     const entries = [];
     const entry = (item, group) => {
         const colon = item.indexOf(":");
@@ -161,6 +169,7 @@ const READS = {
     notes: "notes — search notes reads them",
     documents: "documents — search notes reads them",
     meetings: "meetings — search all reads them",
+    events: "calendar events — no search reads them yet",
 };
 /**
  * The accounts of `kinds` the entries name, and each entry that names none of them with the reason. A search
@@ -170,16 +179,23 @@ export const fitting = (entries, kinds, what, reasonOf = (kind) => READS[kind])
     const chosen = new Map();
     const skipped = [];
     for (const { entry, accounts } of entries) {
-        const fits = accounts.filter(({ kind }) => kinds.includes(kind));
+        const fits = accounts.filter(({ kind }) => kind !== undefined && kinds.includes(kind));
         for (const { provider, account } of fits)
             if (!chosen.has(keyOf({ provider, account })))
                 chosen.set(keyOf({ provider, account }), { provider, account });
+        const known = accounts.filter(({ kind }) => kind !== undefined);
+        const unknown = accounts.filter(({ kind }) => kind === undefined);
+        if (known.length)
+            for (const { provider, account } of unknown)
+                skipped.push({ source: `${provider}:${account}`, code: "not_found", reason: UNKNOWN_PROVIDER });
         if (fits.length)
             continue;
-        const other = accounts[0];
-        skipped.push(other
+        const other = known[0];
+        skipped.push(other?.kind
             ? { source: entry, code: "validation_error", reason: reasonOf(other.kind) }
-            : { source: entry, code: "not_found", reason: "no account in the store" });
+            : unknown.length
+                ? { source: entry, code: "not_found", reason: UNKNOWN_PROVIDER }
+                : { source: entry, code: "not_found", reason: "no account in the store" });
     }
     if (chosen.size === 0)
         fail(`--source names nothing ${what} reads: ${skipped.map(({ source, reason }) => `${source} (${reason})`).join(", ")}`);

package/dist/search/query.js

@@ -27,7 +27,9 @@ export const sourceOf = (name, value, providers) => {
         return source;
     if (isKind(source))
         fail(`${name}${source} names ${source}, which a message search does not read — ` +
-            `search ${source === "meetings" ? "all --source meetings" : "notes"} does`);
+            (source === "events"
+                ? "no search reads them yet"
+                : `search ${source === "meetings" ? "all --source meetings" : "notes"} does`));
     const named = providerNamed(source);
     if (named && providers.includes(named.name))
         return named.name;

package/dist/sends/permission-aliases.js

@@ -28,6 +28,7 @@ const RENAMED = [
     ["conversations.batches.next", "conversations.batches.show"],
     ["conversations.consents.revoke", "conversations.consents.remove"],
     ["stats.messages.counters.refresh", "stats.messages.counters.sync"],
+    ["store.fetch", "messages.sync"],
     ["store.gaps.plan", "store.gaps.show"],
     ["store.reindex", "store.rebuild"],
 ];

package/dist/services/documents/knowledge.d.ts

@@ -1,5 +1,5 @@
 import type { QueryAst } from "@wirecat/cli-base/query";
-import type { Author, Fact, Link, LinkInput, Memory, MemoryInput, MessageStore, Note } from "../../store/index.js";
+import type { Author, Fact, Link, LinkInput, LinkListFilter, Memory, MemoryInput, MessageStore, Note } from "../../store/index.js";
 export interface DocumentKnowledge {
     documents(principal: string, query: QueryAst | undefined, page: {
         limit: number;
@@ -9,8 +9,10 @@ export interface DocumentKnowledge {
         hasMore: boolean;
     }>;
     document(principal: string, ref: string): Promise<Note>;
-    tags(principal: string, ref: string, action: "list" | "add" | "remove", tags?: string[]): Promise<string[]>;
-    links(principal: string, ref: string): Promise<Link[]>;
+    tags(principal: string, ref: string, action: "list" | "add" | "remove", tags?: string[], filter?: {
+        tag?: string;
+    }): Promise<string[]>;
+    links(principal: string, ref: string, filter?: Omit<LinkListFilter, "from" | "to">): Promise<Link[]>;
     addLink(principal: string, ref: string, input: Omit<LinkInput, "from" | "origin">): Promise<Link>;
     removeLink(principal: string, ref: string, id: string): Promise<unknown>;
     notes(principal: string, ref: string, options?: {

package/dist/services/documents/knowledge.js

@@ -47,18 +47,18 @@ export const documentKnowledge = (store, folder) => {
             return folderId ? store.notes.importedDocuments(folderId, query, page) : { items: [], hasMore: false };
         },
         document,
-        tags: async (principal, ref, action, tags = []) => {
+        tags: async (principal, ref, action, tags = [], filter) => {
             const note = await document(principal, ref);
             const target = { type: "document", id: note.id };
             if (action === "add")
                 return store.knowledge.addTags(null, target, tags);
             if (action === "remove")
                 return store.knowledge.removeTags(null, target, tags);
-            return store.knowledge.tags(null, target);
+            return store.knowledge.tags(null, target, filter?.tag);
         },
-        links: async (principal, ref) => {
+        links: async (principal, ref, filter) => {
             await document(principal, ref);
-            return store.notes.links({ from: ref });
+            return store.notes.links({ ...filter, from: ref });
         },
         addLink: async (principal, ref, input) => {
             await document(principal, ref);

package/dist/services/meeting-links.d.ts

@@ -1,7 +1,9 @@
 import type { MeetingChatLinesInput, MeetingHitSearchRequest, MeetingLink } from "../meetings/index.js";
 import type { MessageStore } from "../store/store.js";
 export type { MeetingLink };
-export type MeetingLinksRequest = Omit<MeetingHitSearchRequest, "limit" | "after" | "maxReadBytes"> & Pick<MeetingChatLinesInput, "maxMessages">;
+export type MeetingLinksRequest = Omit<MeetingHitSearchRequest, "limit" | "after" | "maxReadBytes"> & Pick<MeetingChatLinesInput, "maxMessages"> & {
+    url?: string;
+};
 /** Links shared in the chat of the selected meetings, most shared first; found when read, not stored. */
 export declare const readMeetingLinks: (store: Pick<MessageStore, "meetings"> & {
     knowledge?: MessageStore["knowledge"];

package/dist/services/meeting-links.js

@@ -3,7 +3,7 @@ import { findMentions } from "../domain/mentions.js";
 import { resolveMeetingSelection } from "./meeting-hit-search.js";
 /** Links shared in the chat of the selected meetings, most shared first; found when read, not stored. */
 export const readMeetingLinks = async (store, request) => {
-    const { maxMessages, ...selecting } = request;
+    const { maxMessages, url, ...selecting } = request;
     const { input, selection } = await resolveMeetingSelection(store, selecting);
     const lines = await store.meetings.meetingChatLines({
         ...input,
@@ -12,7 +12,7 @@ export const readMeetingLinks = async (store, request) => {
     const links = new Map();
     for (const line of lines)
         for (const found of findMentions(line.text)) {
-            if (found.kind !== "url")
+            if (found.kind !== "url" || (url !== undefined && found.value !== url))
                 continue;
             const link = links.get(found.value) ?? {
                 url: found.value,

package/dist/services/messages-search.js

@@ -1,6 +1,7 @@
 import { CliError } from "@wirecat/cli-base";
 import { calendarKey } from "../domain/calendar.js";
 import { parseLocator } from "../domain/locator.js";
+import { kindIn, UNKNOWN_PROVIDER } from "../domain/providers.js";
 import { syncsOneChat } from "../ports/traits.js";
 import { PRESET_VERSION } from "../search/lucene/presets.js";
 import { FIELD_VERSION, validateAst, validateFields } from "../search/lucene/registry.js";
@@ -69,13 +70,24 @@ export const prepareLucene = async (store, account, request, messenger) => {
         throw new CliError("validation_error", "a search names at least one account");
     if (request.senders !== undefined && leaves.some(({ field }) => field === "from"))
         throw new CliError("validation_error", "--from and from: together — name the people once");
-    const accounts = accountsOfKind(request.kind, request.accounts ??
+    const chosen = request.accounts ??
         listed?.accounts ??
         (source !== undefined
             ? held.filter(({ provider }) => inSource(source, provider))
             : sources.length
                 ? held.filter(({ provider }) => sources.some((source) => inSource(source, provider)))
-                : [account]), held, source ?? (sources.includes("email") ? "email" : sources[0]), messenger.app?.command, request.mailAccount, listed !== undefined || request.accounts !== undefined);
+                : [account]);
+    // The account running is the app's own: its provider is a messenger whether or not an entry names it.
+    const unknown = chosen.filter(({ provider }) => provider !== account.provider && kindIn(provider) === undefined);
+    const unknownSkipped = unknown.map(({ provider, account }) => ({
+        source: `${provider}:${account}`,
+        code: "not_found",
+        reason: UNKNOWN_PROVIDER,
+    }));
+    if (unknown.length > 0 && unknown.length === chosen.length)
+        throw new CliError("not_found", `this search reads nothing: ${unknownSkipped.map(({ source }) => source).join(", ")} (${UNKNOWN_PROVIDER})`);
+    const skipped = [...(listed?.skipped ?? []), ...unknownSkipped];
+    const accounts = accountsOfKind(request.kind, chosen.filter((one) => !unknown.includes(one)), held, source ?? (sources.includes("email") ? "email" : sources[0]), messenger.app?.command, request.mailAccount, listed !== undefined || request.accounts !== undefined);
     const scopeAccounts = accounts.map(({ provider, account }) => ({ provider, account }));
     const chatLookup = scopeAccounts.some(({ provider }) => provider === MAIL) ? withMailThreads(store) : store;
     const mailField = leaves.find(({ field, value }) => MAIL_FIELDS.has(field) &&
@@ -141,7 +153,7 @@ export const prepareLucene = async (store, account, request, messenger) => {
         stemsReady,
         ...(stemmer ? { stemming: stemmingOf(ast.root, stemmer) } : unstemmed ? { stemming: unstemmed } : {}),
         scopeAccounts,
-        ...(listed?.skipped.length ? { skipped: listed.skipped } : {}),
+        ...(skipped.length ? { skipped } : {}),
         ...(selectedChat ? { selectedChat } : {}),
     };
 };

package/dist/services/project-gathering.d.ts

@@ -77,6 +77,8 @@ export declare const gatherProjectEvidence: (ports: ProjectGatheringPorts, reque
         source: number | null;
         lane: string | null;
         state: "in-scope" | "out-of-scope" | "unavailable";
+        items: number;
+        capped: boolean;
     }[];
     fetch: {
         state: ProjectFetchState;