@wirecat/cli-core 0.419.0 → 0.421.0

package/CHANGELOG.md

@@ -7,6 +7,54 @@ shape of this file.
 
 ## Unreleased
 
+## 0.421.0 — 25.10.2026
+
+### Changed — may break callers
+
+- **Old command names and old permission keys are no longer recognised.** A retired command path (`contacts profile`, `bot store fetch`, `search mail` and the rest) gets the ordinary "unknown command" answer, on the command line and over MCP, with no pointer to a replacement. A saved permission key is read only as written: nothing maps an old key to a new one, and `chats.mute` no longer covers `chats unmute`. Removed with it: `movedCommandError` from `/cli`; `PERMISSIONS`, `Permission`, `permissionFor` and `assertStatsPermissionsCurrent` from `/sends`; the `permission` field of an MCP tool definition; and the `skipMovedPermissions` option of `resolveSettings`. A CLI that imports one of them drops the import; nothing replaces them.
+- **Bot commands and `--dry-run` refuse a saved permission key that no command checks**, as messenger commands already did. They stop with a `configuration_error` that names the key and the `config unset` that removes it: "permissions.bot.store.fetch names no command — remove it with \`tg sales config unset --bot permissions.bot.store.fetch\`". `config show`, `set` and `unset` still run, so the file can be repaired. Before, a bot command did not look at the keys at all, and an old key was quietly renamed or ignored.
+- **`messages sync` and `bot messages sync` are checked as `messages.sync` and `bot.messages.sync`**, their own paths. A level on `messages` or `bot.messages` still applies to them; `commands --json` now reports the longer key.
+
+### Fixed
+
+- **A deny saved on the sync command itself now stops it.** `permissions.bot.messages.sync: deny` was ignored, because `bot messages sync` was checked under `bot.messages`; `permissions.messages.sync: deny` could not be saved at all and was refused as naming no command. Both are now honoured on the command line, in MCP discovery and by the MCP server. Bot commands also refuse a denied read (`bot.messages: deny` stops `bot messages list` and `bot messages sync`) before they connect, as messenger commands already did.
+
+## 0.420.0 — 25.10.2026
+
+### Changed — may break callers
+
+- **A meeting links to an event by its room, with exclusive ends, and two candidate events make no link** (`eventCandidates`, `linkEvent`; available from the cli-core release that carries store versions 30 to 33). Rooms are compared by `join_key`, never by the raw link with its passcode; an event a calendar entry holds is a candidate though it has no meeting yet; back-to-back events no longer both match. With two or more candidates `linkEvent` links none and creates none, and `MeetingStore.reviewMeetingLink` (optional; the store's own implements it) puts the meeting on the owner's review list. Before, it created a new automatic event: a second event for a meeting the calendar already held.
+- **`Event` gains optional `status`, `allDay` and `sourceDeletedAt`, and `origin` on `Event` and `EventSeries` may be `calendar`** (store version 33; available from the cli-core release that carries store versions 30 to 33). The stored event answer (`events list`, its MCP tool; a strict schema) gains `status`, `all_day` and `source_deleted_at`, and its `origin` takes `calendar`. A caller that switches over `origin` or validates the answer against the old schema must take the new value and fields.
+- **Notes import finds a file by its place in `files`, and a new file with one document's content is that document** (requirements 3.3, rule 2; available from the cli-core release that carries store versions 30 to 33). `saveFileNote`, `renameFileNote`, `deleteFileNotes` and `notes({ folderId })` work through each folder's `files` rows, so one document can live in several folders, each listing it under its own path. A new local file whose content hash equals one document's is a copy of it — a live one, else a deleted one no file holds any more, so a file moved between folders keeps its document in whichever order the folders sync; two such documents give a new document and one review entry; empty text never joins. A document stays live while any of its files is, and its own `account_id` and `external_id` follow the file it shows (the owner's pin, else the latest changed); Drive's documents keep theirs. A file renamed and edited in one sync is a new document, and the old one stays, deleted. `saveFileNote` and `renameFileNote` answer the note as the saving folder sees it: its `folderId` and `path` are that file's.
+- **Reviewed tag consolidation (store version 30)** (available from the cli-core release that carries store versions 30 to 33). Tag and automatic-claim
+  tables move behind a structural compatibility boundary with `minCompatible: 30`: `tags` becomes `canonical_tags`
+  and `auto_tag_claims` becomes `canonical_auto_tag_claims`, so an older SDK refuses the migrated file, including a
+  handle it already holds open. Later migrations must keep that minimum; the manifest refuses one that omits or
+  lowers it. Version 30 ships in one breaking release with versions 31 to 33. Consolidated tag groups refuse
+  document annotation transfer before copying; existing destinations need current schema maintenance for a
+  read-only preview.
+- **Drive documents move from their stand-in notes folder to the `google-drive` account (store version 31, `minCompatible` 31)** (available from the cli-core release that carries store versions 30 to 33). The store moves every Drive file of a `folder` named `google-drive:<principal>` to the `{ provider: "google-drive", account: <principal> }` account by `UPDATE`, so `document:<id>` references, chunks, tags, notes and links keep pointing where they did; the folder row goes, saved profiles `{ provider: "folder", account: "google-drive:<p>" }` become `{ provider: "google-drive", account: "<p>" }`, and group entries `notes:<folder id>` follow to the account's id. A CLI on an older cli-core refuses the store until it is upgraded. `notes.folders()` no longer lists Drive; `notes.documentsAccount(key, create)` and `notes.documentsAccounts()` find it, and `documentIngestion({ provider: "google-drive" })` writes into it (`collectionName` is now optional). `folder:<id>`, `--source drive:<profile>`, `--source google-drive:<principal>` and annotation transfers (`google-drive:<principal>`, from a store on either side of version 31) name the account. Ships in the same release as store version 30.
+- **A deleted document keeps its tags** (store version 32; available from the cli-core release that carries store versions 30 to 33). The version-1 trigger that dropped a document's tags when it was marked deleted is gone; its tags go when the row itself is purged. `knowledge.labelled` and the vocabulary's `usageCount` leave out a deleted document's taggings, and search already did. A document revived by a later sync, such as a file moved to another folder, comes back with its tags.
+- **Notes folders are accounts of provider `obsidian` (a vault) or `local` (a plain folder), no longer `folder`** (store version 32; available from the cli-core release that carries store versions 30 to 33). The migration renames each by its `settings.format`; A Drive stand-in folder (`google-drive:<principal>`) that version 31 left behind keeps `folder`. `FOLDER_PROVIDER` is replaced by `FOLDER_PROVIDERS` and `isFolderProvider`, both exported from the package root; `local` and `obsidian` are built-in providers of kind `notes`, and `--source obsidian` / `--source local` name the folders of that provider. Saved profile keys and annotation export files that say `folder` still resolve and import. **Version 32 raises `minCompatible` to 32**: a CLI on an older cli-core refuses the store and says to upgrade, instead of finding no folders and importing them a second time.
+
+### Added
+
+- **`knowledge.applyTagConsolidation`** (available from the cli-core release that carries store versions 30 to 33) applies an owner-reviewed complete preview
+  atomically, retains independent assignment/claim/alias/link provenance, follows inherited names in reads and
+  search, and returns a text-free idempotent receipt. Label removal respects requested origin scope across retained
+  members. [The consolidation guide](docs/dev/TAG-CONSOLIDATION.md) describes review, compatibility and the explicit
+  transfer limitation.
+- **Files: the source records of documents** (store version 32; available from the cli-core release that carries store versions 30 to 33). A new `files` table holds one row per item in one place: a file under a local folder or an Obsidian vault, a Drive file or folder. Each row has the item's `path` from its account's root, a `parent_id` to its folder's own row (local folders get rows made from the path), `path_folded` for prefix and substring search, and the `document_id` it is a copy of. A Drive item is keyed by its Drive file id and takes its link, type, size, edit time and version from the document's columns or, for rows saved before those columns, from its front matter; a Markdown file's front matter is `metadata.front_matter`. Every documents writer in cli-core keeps its row current (`saveFileNote`, `renameFileNote`, `deleteFileNotes`, `catalog.upsert`, `catalog.reconcile`, annotation transfers), and the first open after the upgrade writes the rows of every existing document in short batches, resuming where it stopped. `documents` stays the entity: no document is re-inserted and every `document:<id>` keeps working.
+- **The owner pins the file a document shows** (store version 32; same release). `documents.pinned_file_id` (nullable) holds the owner's choice; `store.files.pin(document, fileId)` takes one of the document's own files and `store.files.unpin(document)` clears it, so the document shows its most recently changed file again. `FilesStore` from `@wirecat/cli-core/store`.
+- **`EventStore`, the calendar's store** (`store.calendar`; types from `@wirecat/cli-core/meetings`; available from the cli-core release that carries store versions 30 to 33). `saveCalendars` (a calendar the owner owns syncs, others are listed), `calendars`, `setCalendarSynced`, `saveEntries` (one sync page in one transaction, matched by rules 1–5 of requirements 3.4: the same calendar and id; the same series slot, so a plain occurrence and its exception are one entry, in whichever order the series and its occurrences arrive; another calendar's copy by iCalUID; a Zoom meeting's automatic event by room and overlapping time, which the entry adopts as origin `calendar`; else a new event), `markUnseen` (after a full list; plain occurrences only inside the window fetched), `events(filter)` by time, account, calendar or person, `event(id)` with its entries, participants and revisions, `linkEntry` / `unlinkEntry` (the owner's, which no rule replaces), `reviews` and `resolveReview` (choose a candidate, or none of them). An event shows its owner-organized copy, else the latest edited; it is cancelled only when every live entry is. A deleted single event, occurrence or whole series keeps its past as history (`source_deleted_at`) and cancels its future. Each change of an entry's or meeting's event is logged in `entity_link_events`. Text is stored with HTML reduced to text, passcode, password and PIN lines dropped and every link without its query string; `metadata` keeps only `ENTRY_METADATA_KEYS`. `eventStoreContract` (`@wirecat/cli-core/meetings/testing`) runs the rules against any `EventStore`.
+- **Calendars in the store** (store version 33; available from the cli-core release that carries store versions 30 to 33). `calendars` (an account's calendars, `synced` for those whose entries sync), `calendar_entries` (one calendar's copy of a single event, a series or one occurrence: the source records of `events` and `event_series`, with `ical_uid`, `original_starts_at`, `recurrence`, `recurrence_ends_at` — NULL for a series that repeats indefinitely —, `join_url` without its query string and `join_key`; a trigger refuses an entry that ends before it starts), `calendar_entry_revisions` (tracked fields before a change) and `calendar_entry_participants` (who an entry lists, by address). Events gain `status`, `all_day` and `source_deleted_at` (below). Events have a words index of their own (`event_words`, `event_stems`, queue `event_index_pending`) over title, description, location and attendee names, leaving out working-location, focus-time, out-of-office and birthday entries; every existing event is queued. Nothing writes calendars yet: `EventStore` comes next.
+- **`meetings.join_key`** (store version 33; same release): the room a meeting is held in without its passcode — `zoom:<number>`, `meet:<code>`, else host and path — written with every meeting and filled on open for those stored before, so a calendar entry can be matched to its Zoom meeting by room rather than by a link carrying `pwd=`. `joinKeyOf` and `joinUrlWithoutQuery` (`src/meetings/join-key.ts`).
+- **`store.files`, where each document is kept** (available from the cli-core release that carries store versions 30 to 33). `list(accountId, { under, pathContains, kind, includeDeleted, limit, offset })` reads one account's files by path: `under` is a subtree, one range over the folded path's index; `pathContains` is any case and accent. `byPath(accountId, path)` and `ofDocument(reference)`, which answers the most recently changed live file first: the one the document shows. Types `FilesStore`, `StoredFile` and `FileListQuery` from `@wirecat/cli-core/store`. The account is always named; there is no default place.
+- **Search hits read a document's link and edit time from its file** (same release): `search notes`, `search all` and context evidence prefer the preferred file's `url` and `external_updated_at`, then the document's columns, then Drive's front matter. A document whose account's provider is registered with kind `documents` is a document with no front matter, labelled with the command whose profile names that account.
+- **`identities.email`** (store version 32; same release). A mail contact's address, lower case, filled for every existing mail contact and by a trigger for every new one, whatever writes it. A contact saved with an address (`savePeople`'s `email`, a Drive owner or editor) carries it too, and the same-email join finds the mail contact by this column.
+- **`entity_link_events` and `link_reviews`** (store version 32; same release): the log of every change of the entity a source record belongs to (each file's link to its document now, method `import`; calendar entries and meetings to events next), and the owner's review list of source records with two equally good entities, which nothing writes yet.
+- **`NoteFolder.provider`**: `obsidian`, `local`, or `folder` for Drive's stand-in folders.
+
 ## 0.419.0 — 25.10.2026
 
 ### Fixed

package/dist/cli/bot/context.d.ts

@@ -1,7 +1,8 @@
 import type { Command } from "commander";
 import { SendJournal } from "../../sends/journal.js";
-import type { Level, PermissionKey } from "../../sends/permissions.js";
+import { type Level, type PermissionKey } from "../../sends/permissions.js";
 import { RecipientList } from "../../sends/recipients.js";
+import type { Settings } from "../settings.js";
 import type { BotAdapter, BotChatRef, BotConnectOptions, BotMessenger } from "./port.js";
 import { ChatRegistry } from "./registry.js";
 import { BotTokenStore } from "./token.js";
@@ -9,7 +10,7 @@ import { BotTokenStore } from "./token.js";
 export declare const botWords: (bot: BotMessenger, profile: string) => string;
 /** What a bot command needs, resolved once: the bot's settings, its token, its lists. */
 export declare const botContext: (command: Command, bot: BotMessenger) => {
-    settings: import("../settings.js").Settings;
+    settings: Settings;
     renderer: import("@wirecat/cli-base").Renderer;
     format: import("@wirecat/cli-base").RenderFormat;
     color: boolean;

package/dist/cli/bot/context.js

@@ -2,16 +2,30 @@ import { CliError } from "@wirecat/cli-base";
 import { pickChat } from "../../resolve.js";
 import { sendGuard } from "../../sends/guard.js";
 import { SendJournal } from "../../sends/journal.js";
+import { levelFor, readKeysForCommand } from "../../sends/permissions.js";
 import { RecipientList } from "../../sends/recipients.js";
 import { readSecret } from "../../terminal/prompt.js";
+import { commandPathOf } from "../command-contract.js";
 import { baseContext, secretInputOf } from "../context.js";
 import { terminalAsker } from "../messenger/ask.js";
+import { refuseUnknownPermissionKeys } from "../permission-keys.js";
 import { asFirstWord } from "../profile.js";
 import { botCopy } from "./copy.js";
 import { botFiles, ChatRegistry } from "./registry.js";
 import { BotTokenStore } from "./token.js";
 /** How the owner types this bot — `max sales bot` — so a refusal names the command that fixes it. */
 export const botWords = (bot, profile) => `${bot.app.command} ${asFirstWord(profile)}bot`;
+/** What a messenger command refuses before it connects, for a bot: an unknown key, then a denied read. */
+const refuseBotPermissions = (command, bot, settings) => {
+    refuseUnknownPermissionKeys(command, settings.permissions, `${bot.app.command} ${asFirstWord(settings.profile)}config unset --bot`);
+    for (const key of readKeysForCommand(commandPathOf(command))) {
+        const { level, key: named } = levelFor(settings.permissions, key);
+        if (level !== "deny")
+            continue;
+        throw new CliError("permission_error", `bot profile ${settings.profile} denies ${key} (permissions.${named} is deny, from the ` +
+            `${settings.permissionSources[named ?? ""] ?? "default"})`, { permission: key });
+    }
+};
 /** What a bot command needs, resolved once: the bot's settings, its token, its lists. */
 export const botContext = (command, bot) => {
     const base = baseContext(command, (flags, options) => bot.resolveSettings(flags, { ...options, kind: "bot" }));
@@ -21,6 +35,7 @@ export const botContext = (command, bot) => {
     const tokens = bot.tokenStore?.(command, profile) ??
         new BotTokenStore({ app: bot.app, profile, env, ...(keyring ? { keyring } : {}) });
     const words = botWords(bot, profile);
+    refuseBotPermissions(command, bot, settings);
     const registry = bot.registry?.(command, profile) ?? new ChatRegistry(bot.app, profile, env);
     const recipients = () => new RecipientList(files.recipients, words);
     const journal = () => new SendJournal(files.journal, { service: bot.app.command, version: bot.app.version });

package/dist/cli/config-command.js

@@ -55,7 +55,7 @@ export const configCommand = (app, config, { permissionKey } = {}) => {
             .option("--bot", "only for bots — the bot section of the file");
         if (action === "set")
             sub
-                .argument("<value>", "a number, true or false, or for allow a list like send,reaction; for a group tg:work,max:Alice,email:me@x")
+                .argument("<value>", "a number, true or false; for a group tg:work,max:Alice,email:me@x")
                 .description("save a setting to the configuration file");
         else
             sub.description("remove a setting from the configuration file");
@@ -64,7 +64,6 @@ export const configCommand = (app, config, { permissionKey } = {}) => {
             const context = baseContext(this, (flags, options) => config.resolveSettings(flags, {
                 ...options,
                 needsProfile: !everyone && setting !== "default_profile" && !isStoreSetting(setting),
-                skipMovedPermissions: true,
             }));
             const { settings, renderer, env } = context;
             if (isStoreSetting(setting)) {

package/dist/cli/index.d.ts

@@ -96,7 +96,6 @@ export type { Running, ServerOptions, ServerProcess, ServerSystem } from "./mess
 export { storeSummary } from "./messenger/store-maintenance-command.js";
 export { type Saving, stored } from "./messenger/stored.js";
 export { MODEL_CATALOGUE_QUERY, type ModelCatalogueOptions } from "./model-catalogue-command.js";
-export { movedCommandError } from "./moved.js";
 export { window, withPaging } from "./paging.js";
 export { knownBeside, knownPermissionKeys, type PermissionKeyOf, unknownPermissionKeys } from "./permission-keys.js";
 export { asFirstWord, commandWords, liftProfile, refuseCommandName, rootOf, usableProfileName } from "./profile.js";

package/dist/cli/index.js

@@ -87,7 +87,6 @@ export { STEMS_EVERY_MS, STEMS_SLICE_MS, stemFills } from "./messenger/serve-ste
 export { storeSummary } from "./messenger/store-maintenance-command.js";
 export { stored } from "./messenger/stored.js";
 export { MODEL_CATALOGUE_QUERY } from "./model-catalogue-command.js";
-export { movedCommandError } from "./moved.js";
 export { window, withPaging } from "./paging.js";
 export { knownBeside, knownPermissionKeys, unknownPermissionKeys } from "./permission-keys.js";
 export { asFirstWord, commandWords, liftProfile, refuseCommandName, rootOf, usableProfileName } from "./profile.js";

package/dist/cli/messenger/context.js

@@ -3,12 +3,12 @@ import { servingProfiles } from "../../background/lock.js";
 import { FloodMemory, floodPathFor } from "../../sends/flood.js";
 import { ceilingRefusal, guardFor } from "../../sends/guard.js";
 import { DEFAULT_PACE, Pacer, pacePathFor } from "../../sends/pace.js";
-import { assertStatsPermissionsCurrent, CEILING_KEY, levelFor, readKeysForCommand, } from "../../sends/permissions.js";
+import { CEILING_KEY, levelFor, readKeysForCommand } from "../../sends/permissions.js";
 import { RecipientList, recipientsPathFor } from "../../sends/recipients.js";
 import { OFFLINE, servicesFor } from "../../services/index.js";
 import { openStore } from "../../store/store.js";
 import { baseContext, environmentOf } from "../context.js";
-import { knownPermissionKeys, unknownPermissionKeys } from "../permission-keys.js";
+import { refuseUnknownPermissionKeys } from "../permission-keys.js";
 import { asFirstWord } from "../profile.js";
 import { rootOf } from "../steps.js";
 import { recalledAccount, rememberAccount } from "./accounts.js";
@@ -325,7 +325,6 @@ const pathOf = (command) => {
 };
 /** `deny` stops a read too, before anything connects: what the profile may not see is never fetched. */
 const refuseDenied = (command, settings) => {
-    assertStatsPermissionsCurrent(pathOf(command), settings.permissions);
     for (const key of readKeysForCommand(pathOf(command))) {
         const { level, key: named } = levelFor(settings.permissions, key);
         if (level !== "deny")
@@ -356,9 +355,7 @@ export const messengerContext = (command, messenger, resolving = {}) => {
     const { profile } = base.settings;
     refuseDenied(command, base.settings);
     refuseLacking(messenger, pathOf(command));
-    for (const key of unknownPermissionKeys(base.settings.permissions, knownPermissionKeys(command, messenger.permissionKey))) {
-        throw new CliError("configuration_error", `permissions.${key} names no command — remove it with \`${app.command} ${asFirstWord(profile)}config unset permissions.${key}\``, { permission: key });
-    }
+    refuseUnknownPermissionKeys(command, base.settings.permissions, `${app.command} ${asFirstWord(profile)}config unset`, messenger.permissionKey);
     // Read when warning, not now: serve swaps the renderer's methods for log records after this.
     const warn = (text, warning) => base.renderer.warn(text, warning);
     const accountFor = () => {

package/dist/cli/permission-keys.d.ts

@@ -9,3 +9,5 @@ export declare const knownPermissionKeys: (command: Command, keyOf?: PermissionK
 /** The known keys one level under the unknown key's parent, to name in the refusal. */
 export declare const knownBeside: (key: PermissionKey, known: ReadonlySet<PermissionKey>) => PermissionKey[];
 export declare const unknownPermissionKeys: (levels: Readonly<Record<PermissionKey, unknown>>, known: ReadonlySet<PermissionKey>) => PermissionKey[];
+/** A saved key no command checks would do nothing, so the command refuses to run; `unset` names the fix. */
+export declare const refuseUnknownPermissionKeys: (command: Command, levels: Readonly<Record<PermissionKey, unknown>>, unset: string, keyOf?: PermissionKeyOf) => void;

package/dist/cli/permission-keys.js

@@ -1,4 +1,4 @@
-import { canonicalPermissionKey } from "../sends/permission-aliases.js";
+import { CliError } from "@wirecat/cli-base";
 import { CEILING_KEY, keyForCommand, WRITE_KEYS } from "../sends/permissions.js";
 const pathOf = (command) => {
     const words = [];
@@ -20,12 +20,12 @@ const everyCommand = (command) => [command, ...command.commands.flatMap(everyCom
 export const knownPermissionKeys = (command, keyOf = (one) => keyForCommand(pathOf(one)), extra = []) => {
     const known = new Set();
     const add = (key) => {
-        key = canonicalPermissionKey(key);
         for (let parts = key.split("."); parts.length > 0; parts = parts.slice(0, -1))
             known.add(parts.join("."));
     };
     for (const one of everyCommand(rootOf(command))) {
-        const key = keyOf(one);
+        const own = keyOf(one);
+        const key = own === undefined ? keyForCommand(pathOf(one)) : own;
         if (key)
             add(key);
     }
@@ -42,3 +42,10 @@ export const knownBeside = (key, known) => {
         .sort();
 };
 export const unknownPermissionKeys = (levels, known) => Object.keys(levels).filter((key) => key !== CEILING_KEY && !known.has(key));
+/** A saved key no command checks would do nothing, so the command refuses to run; `unset` names the fix. */
+export const refuseUnknownPermissionKeys = (command, levels, unset, keyOf) => {
+    const [key] = unknownPermissionKeys(levels, knownPermissionKeys(command, keyOf));
+    if (key === undefined)
+        return;
+    throw new CliError("configuration_error", `permissions.${key} names no command — remove it with \`${unset} permissions.${key}\``, { permission: key });
+};

package/dist/cli/preview.d.ts

@@ -1,8 +1,8 @@
 import type { Command } from "commander";
-import { type Level } from "../sends/permissions.js";
+import { type Level, type PermissionKey } from "../sends/permissions.js";
 export declare class PreviewComplete extends Error {
 }
-export declare const preview: (command: Command, permissions: Readonly<Record<string, Level>>) => {
+export declare const preview: (command: Command, permissions: Readonly<Record<string, Level>>, unset: string, keyOf?: (path: readonly string[]) => PermissionKey | null | undefined) => {
     preview: boolean;
     path: string[];
     permission: {

package/dist/cli/preview.js

@@ -1,15 +1,16 @@
 import { CliError } from "@wirecat/cli-base";
 import { metaOf } from "@wirecat/cli-base/commands";
 import { writes as writesAnything } from "@wirecat/cli-base/standards";
-import { assertStatsPermissionsCurrent, keyForCommand, levelFor, readKeysForCommand, WRITE_KEYS, } from "../sends/permissions.js";
+import { keyForCommand, levelFor, readKeysForCommand, WRITE_KEYS, } from "../sends/permissions.js";
 import { commandPathOf } from "./command-contract.js";
+import { refuseUnknownPermissionKeys } from "./permission-keys.js";
 export class PreviewComplete extends Error {
 }
-export const preview = (command, permissions) => {
+export const preview = (command, permissions, unset, keyOf) => {
     const path = commandPathOf(command);
+    refuseUnknownPermissionKeys(command, permissions, unset, keyOf && ((one) => keyOf(commandPathOf(one))));
     const key = keyForCommand(path);
     const level = key ? levelFor(permissions, key).level : "allow";
-    assertStatsPermissionsCurrent(path, permissions);
     for (const source of readKeysForCommand(path)) {
         if (levelFor(permissions, source).level === "deny")
             throw new CliError("permission_error", `this profile does not permit ${source}`, { permission: source });

package/dist/cli/program.js

@@ -25,9 +25,8 @@ import { installHelp } from "./help/first-screen.js";
 import { showInputFields } from "./input-fields.js";
 import { MAX_BUFFERED_INPUT, provideInputPolicy } from "./input-policy.js";
 import { checkJson, liftJson } from "./json-fields.js";
-import { movedCommandError } from "./moved.js";
 import { PreviewComplete, preview } from "./preview.js";
-import { commandWords, liftProfile, PROFILE_FREE, valuedOptions } from "./profile.js";
+import { asFirstWord, commandWords, liftProfile, PROFILE_FREE, valuedOptions } from "./profile.js";
 import { absolutePaths, relayTarget } from "./relay-route.js";
 import { settingsFor } from "./settings.js";
 import { assertSharedContracts } from "./shared-contracts.js";
@@ -377,7 +376,9 @@ const runOnce = async (argv, definition, options) => {
                 needsProfile: keyForCommand(path) !== null,
             });
             const permissions = "permissions" in resolved ? resolved.permissions : {};
-            renderAnswer(action, outputFor(action), itemOf(snakeKeys(preview(action, permissions))));
+            const unset = `${command} ${asFirstWord(resolved.profile)}config unset${path[0] === "bot" ? " --bot" : ""}`;
+            const previewed = preview(action, permissions, unset, definition.configuration?.permissionKey);
+            renderAnswer(action, outputFor(action), itemOf(snakeKeys(previewed)));
             throw new PreviewComplete();
         }
         // Not inside the scheduled run itself: its own failure is already on its way to last.json.
@@ -421,11 +422,6 @@ const runOnce = async (argv, definition, options) => {
         const settled = await settleFailure(failure, { definition, program, rest, profile, options });
         return report(streams, reporting, failed(definition, program, rest, failure, settled, debug));
     }
-    const failure = movedCommandError(program, rest);
-    if (failure !== undefined) {
-        const settled = await settleFailure(failure, { definition, program, rest, profile, options });
-        return report(streams, reporting, failed(definition, program, rest, failure, settled, debug));
-    }
     try {
         await control.race(() => program.parseAsync(rest, { from: "user" }));
         const code = exit.code ?? (process.exitCode === undefined ? 0 : Number(process.exitCode));

package/dist/cli/settings.d.ts

@@ -140,8 +140,6 @@ export interface ResolveOptions {
     needsProfile?: boolean;
     /** Read the config file without writing it: no default file. For a dry run. */
     readOnly?: boolean;
-    /** Skip moved permission keys instead of refusing them, so `config set` and `unset` can fix one. */
-    skipMovedPermissions?: boolean;
 }
 /** Where `profile` came from when none was named and the command needs none. */
 export declare const NONE_NAMED = "none named";

package/dist/cli/settings.js

@@ -4,7 +4,6 @@ import * as v from "valibot";
 import { AI_ENTRIES, resolveAISettings } from "../analysis/settings.js";
 import { parseDuration } from "../domain/duration.js";
 import { envName, readOnlyLockOf } from "../ports/app.js";
-import { canonicalPermissionKey } from "../sends/permission-aliases.js";
 import { assertOverridesTighten, CEILING_KEY, LEVELS, layerPermissions, permissionOverrides, RESOURCES, } from "../sends/permissions.js";
 import { storePath } from "../store/path.js";
 import { sharedConfigPath } from "../store/shared-config.js";
@@ -78,7 +77,6 @@ const SHARED_DEFAULTS_ONLY = {
     update_check: v.optional(flag),
     skill_hint: v.optional(flag),
 };
-const withoutMoved = (levels) => levels && Object.fromEntries(Object.entries(levels).filter(([key]) => canonicalPermissionKey(key) === key));
 /** Where `profile` came from when none was named and the command needs none. */
 export const NONE_NAMED = "none named";
 /** A name for a command that speaks for no account; never chosen for one that does. */
@@ -232,9 +230,7 @@ export const settingsFor = (app, extension = {}) => {
             : { value: false, from: "default" };
         const fileLayers = layers.map(([from, scope]) => [
             from,
-            options.skipMovedPermissions
-                ? withoutMoved(scope?.permissions)
-                : scope?.permissions,
+            scope?.permissions,
         ]);
         const overrides = permissionOverrides(flags.permission);
         assertOverridesTighten(overrides, layerPermissions(fileLayers).levels);

package/dist/domain/providers.d.ts

@@ -11,8 +11,26 @@ export interface ProviderEntry {
 }
 /** The seed: what cli-core knows before any CLI has written its entry into the store. */
 export declare const PROVIDERS: readonly ProviderEntry[];
-/** The store keeps a notes folder as an `accounts` row of this provider; people call it `notes`. */
-export declare const FOLDER_PROVIDER = "folder";
+/**
+ * A notes folder is an `accounts` row of one of these providers; people call every one `notes`. `obsidian` is a vault,
+ * `local` a plain folder (store version 32). `folder` is what they were before, and what Drive's stand-in folders and
+ * profile keys saved before that still say.
+ */
+export declare const FOLDER_PROVIDERS: readonly ["local", "obsidian", "folder"];
+export declare const isFolderProvider: (provider: string) => boolean;
+/** The same test in SQL, over an `accounts` row's `provider` column. */
+export declare const folderProviderSql: (column?: string) => string;
+/** The provider a new folder of this format gets. */
+export declare const folderProviderOf: (format: "obsidian" | "markdown") => "obsidian" | "local";
+/**
+ * Providers whose account holds documents the way a notes folder does: one account per remote principal, its
+ * files as `documents` rows (store version 31 moved Drive here from a `folder` named `google-drive:<principal>`).
+ * The provider registry's `documents` kind replaces this list when Drive leaves `notes` (Wave 3 R2).
+ */
+export declare const DOCUMENT_ACCOUNT_PROVIDERS: readonly ["google-drive"];
+export declare const isDocumentAccountProvider: (provider: string) => boolean;
+/** A folder or a documents account, in SQL over an `accounts` row's `provider` column. */
+export declare const filesAccountSql: (column?: string) => string;
 /** Notes written in memo have no account row; this is their account. */
 export declare const INTERNAL_NOTES = "internal";
 /** The reason a search gives for an account whose provider no entry names. */

package/dist/domain/providers.js

@@ -11,10 +11,30 @@ export const PROVIDERS = [
     { name: "whatsapp-bot", kind: "messages", aliases: ["wa-bot"] },
     { name: "email", kind: "mail", aliases: [] },
     { name: "notes", kind: "notes", aliases: [] },
+    { name: "local", kind: "notes", aliases: [] },
+    { name: "obsidian", kind: "notes", aliases: [] },
     { name: "zoom", kind: "meetings", aliases: [] },
 ];
-/** The store keeps a notes folder as an `accounts` row of this provider; people call it `notes`. */
-export const FOLDER_PROVIDER = "folder";
+/**
+ * A notes folder is an `accounts` row of one of these providers; people call every one `notes`. `obsidian` is a vault,
+ * `local` a plain folder (store version 32). `folder` is what they were before, and what Drive's stand-in folders and
+ * profile keys saved before that still say.
+ */
+export const FOLDER_PROVIDERS = ["local", "obsidian", "folder"];
+export const isFolderProvider = (provider) => FOLDER_PROVIDERS.includes(provider);
+/** The same test in SQL, over an `accounts` row's `provider` column. */
+export const folderProviderSql = (column = "provider") => `${column} IN (${FOLDER_PROVIDERS.map((name) => `'${name}'`).join(", ")})`;
+/** The provider a new folder of this format gets. */
+export const folderProviderOf = (format) => format === "markdown" ? "local" : "obsidian";
+/**
+ * Providers whose account holds documents the way a notes folder does: one account per remote principal, its
+ * files as `documents` rows (store version 31 moved Drive here from a `folder` named `google-drive:<principal>`).
+ * The provider registry's `documents` kind replaces this list when Drive leaves `notes` (Wave 3 R2).
+ */
+export const DOCUMENT_ACCOUNT_PROVIDERS = ["google-drive"];
+export const isDocumentAccountProvider = (provider) => DOCUMENT_ACCOUNT_PROVIDERS.includes(provider);
+/** A folder or a documents account, in SQL over an `accounts` row's `provider` column. */
+export const filesAccountSql = (column = "provider") => `${column} IN (${[...FOLDER_PROVIDERS, ...DOCUMENT_ACCOUNT_PROVIDERS].map((name) => `'${name}'`).join(", ")})`;
 /** Notes written in memo have no account row; this is their account. */
 export const INTERNAL_NOTES = "internal";
 /** The reason a search gives for an account whose provider no entry names. */
@@ -105,6 +125,6 @@ export const providerNamed = (word) => {
     return registry.find((entry) => wordsOf(entry).includes(wanted));
 };
 /** The kind of a provider the registry knows; `undefined` for one no entry names, which a search skips. */
-export const kindIn = (provider) => provider === FOLDER_PROVIDER ? "notes" : registry.find(({ name }) => name === provider)?.kind;
+export const kindIn = (provider) => isFolderProvider(provider) ? "notes" : registry.find(({ name }) => name === provider)?.kind;
 /** A provider the registry does not list counts as a messenger here; a search asks `kindIn` and skips it. */
 export const kindOf = (provider) => kindIn(provider) ?? "messages";

package/dist/domain/tag-consolidation.d.ts

@@ -16,6 +16,8 @@ export interface TagConsolidationPreview {
         id: string;
         name: string;
     };
+    sourceMemberIds: string[];
+    survivorMemberIds: string[];
     vocabularyFingerprint: string;
     previewFingerprint: string;
     assignments: {
@@ -69,9 +71,36 @@ export interface TagConsolidationPreview {
         rows: number;
         readBytes: number;
         samplesComplete: boolean;
-        applySupported: false;
+        applySupported: true;
     };
 }
 export interface TagConsolidationStore {
     previewTagConsolidation(options: TagConsolidationOptions): Promise<TagConsolidationPreview>;
+    applyTagConsolidation(options: TagConsolidationApplyOptions): Promise<TagConsolidationReceipt>;
+}
+export interface TagConsolidationApplyOptions extends Omit<TagConsolidationOptions, "sampleLimit"> {
+    by: "owner";
+    expectedPreviewFingerprint: string;
+    idempotencyKey: string;
+}
+export interface TagConsolidationReceipt {
+    id: string;
+    sourceId: string;
+    survivorId: string;
+    sourceMemberIds: string[];
+    survivorMemberIds: string[];
+    actor: {
+        type: "person";
+        id: string;
+    };
+    createdAt: string;
+    idempotencyKey: string;
+    vocabularyFingerprint: string;
+    previewFingerprint: string;
+    counts: {
+        assignments: number;
+        aliases: number;
+        automaticClaims: number;
+        links: number;
+    };
 }

package/dist/entities/index.d.ts

@@ -6783,7 +6783,10 @@ export declare const ENTITIES: {
         readonly starts_at: v.NullableSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.IsoTimestampAction<string, "an ISO 8601 time in UTC">, v.EndsWithAction<string, "Z", "an ISO 8601 time in UTC, ending in `Z`">]>, undefined>;
         readonly ends_at: v.NullableSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.IsoTimestampAction<string, "an ISO 8601 time in UTC">, v.EndsWithAction<string, "Z", "an ISO 8601 time in UTC, ending in `Z`">]>, undefined>;
         readonly timezone: v.NullableSchema<v.StringSchema<undefined>, undefined>;
-        readonly origin: v.PicklistSchema<["auto", "owner"], undefined>;
+        readonly origin: v.PicklistSchema<["auto", "owner", "calendar"], undefined>;
+        readonly status: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+        readonly all_day: v.BooleanSchema<undefined>;
+        readonly source_deleted_at: v.NullableSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.IsoTimestampAction<string, "an ISO 8601 time in UTC">, v.EndsWithAction<string, "Z", "an ISO 8601 time in UTC, ending in `Z`">]>, undefined>;
         readonly deleted_at: v.NullableSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.IsoTimestampAction<string, "an ISO 8601 time in UTC">, v.EndsWithAction<string, "Z", "an ISO 8601 time in UTC, ending in `Z`">]>, undefined>;
         readonly created_at: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.IsoTimestampAction<string, "an ISO 8601 time in UTC">, v.EndsWithAction<string, "Z", "an ISO 8601 time in UTC, ending in `Z`">]>;
         readonly updated_at: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.IsoTimestampAction<string, "an ISO 8601 time in UTC">, v.EndsWithAction<string, "Z", "an ISO 8601 time in UTC, ending in `Z`">]>;

package/dist/index.d.ts

@@ -8,7 +8,7 @@ export { parseMarkdownSpans } from "./domain/markdown-spans.js";
 export type { MessageLink, MessagePermalink } from "./domain/message-link.js";
 export type * from "./domain/models.js";
 export { countedPoll } from "./domain/polls.js";
-export { isKind, KINDS, type Kind, kindIn, kindOf, PROVIDERS, type ProviderEntry, providerNamed, providers, UNKNOWN_PROVIDER, useProviders, } from "./domain/providers.js";
+export { FOLDER_PROVIDERS, isFolderProvider, isKind, KINDS, type Kind, kindIn, kindOf, PROVIDERS, type ProviderEntry, providerNamed, providers, UNKNOWN_PROVIDER, useProviders, } from "./domain/providers.js";
 export type { RankingGraphEvidence, RankingGraphLink } from "./domain/rankings-graph.js";
 export type { RankingComponent, RankingInput, RankingMeasure, RankingOptions, RankingTarget, RankingWeights, ScorePreset, } from "./domain/rankings-options.js";
 export { rankingOptions } from "./domain/rankings-options.js";

package/dist/index.js

@@ -5,7 +5,7 @@ export { formatLocator, isLocator, parseLocator } from "./domain/locator.js";
 export { parseMarkdown } from "./domain/markdown.js";
 export { parseMarkdownSpans } from "./domain/markdown-spans.js";
 export { countedPoll } from "./domain/polls.js";
-export { isKind, KINDS, kindIn, kindOf, PROVIDERS, providerNamed, providers, UNKNOWN_PROVIDER, useProviders, } from "./domain/providers.js";
+export { FOLDER_PROVIDERS, isFolderProvider, isKind, KINDS, kindIn, kindOf, PROVIDERS, providerNamed, providers, UNKNOWN_PROVIDER, useProviders, } from "./domain/providers.js";
 export { rankingOptions } from "./domain/rankings-options.js";
 export { canonicalReference, formatReference, parseReference } from "./domain/references.js";
 export { normalizeTag, TAG_TYPES } from "./domain/tags.js";

package/dist/mcp/surface.js

@@ -2,7 +2,6 @@ import { toJsonSchema, toStandardJsonSchema } from "@valibot/to-json-schema";
 import { CliError } from "@wirecat/cli-base";
 import * as v from "valibot";
 import { answerSchema, listOf } from "../cli/envelope.js";
-import { movedPath, movedPointer } from "../cli/moved.js";
 import { ENTITIES } from "../entities/index.js";
 import { agentArguments } from "./text.js";
 import { answered, commandOf, entryRunner, failed, inputOf, outputSchemaOf, READ, syncAllowedFor, UNTRUSTED, WRITE, } from "./tool.js";
@@ -103,9 +102,6 @@ withheld) => {
             const one = command === undefined ? undefined : commands[command];
             if (command === undefined || !one) {
                 withheld?.(normal(asked));
-                const moved = movedPath(normal(asked).split(" "), (path) => byNormal.has(path));
-                if (moved !== undefined)
-                    throw new CliError("validation_error", `no command "${asked}" here — ${movedPointer(moved)}`);
                 const near = nearest(commands, asked);
                 throw new CliError("validation_error", `no command "${asked}" here${near.length ? ` — did you mean ${near.map((name) => `"${name}"`).join(", ")}?` : ""}; ${prefix}_tools_search finds one`);
             }

package/dist/mcp/tool.d.ts

@@ -10,7 +10,7 @@ import { type EntityName } from "../entities/index.js";
 import { type AppErrors } from "../errors/reasons.js";
 import type { MessengerAdapter } from "../ports/messenger.js";
 import type { SendGuard } from "../sends/guard.js";
-import { type Permission, type PermissionKey } from "../sends/permissions.js";
+import { type PermissionKey } from "../sends/permissions.js";
 import { type Services } from "../services/index.js";
 import type { AccountKey, MessageStore } from "../store/store.js";
 import type { MessengerSession } from "./session.js";
@@ -50,8 +50,6 @@ interface Tool<S extends Input> {
     /** What it touches, where its hints cannot say: a read of the messenger kept in the store is not a write there. */
     effects?: Effects;
     _meta?: Record<string, unknown>;
-    /** A write, and what the profile's `allow` must name for it to be offered. */
-    permission?: Permission;
     /** Writes what the owner keeps, as its command (`isStoreChange`): `<PREFIX>_READ_ONLY` refuses it. */
     changesStore?: true;
     /** The CLI command it answers as, where its name does not spell it: `chats send-as`. Its level is read from it. */

package/dist/mcp/tool.js

@@ -12,7 +12,7 @@ import { failureContext } from "../errors/reasons.js";
 import { partialOutcome, startRecording } from "../runs/recording.js";
 import { newRunId } from "../runs/run.js";
 import { inRun } from "../runs/scope.js";
-import { assertStatsPermissionsCurrent, keyForCommand, levelFor, readKeysForCommand, } from "../sends/permissions.js";
+import { keyForCommand, levelFor, readKeysForCommand } from "../sends/permissions.js";
 import { onlineDeps, storeModeDeps } from "../services/deps.js";
 import { servicesFor } from "../services/index.js";
 import { agentJson } from "./text.js";
@@ -178,7 +178,6 @@ const callRunner = ({ messenger, session, withStore, withServices, defaults, aro
                 definition.check?.(args);
                 if (definition.changesStore)
                     refuseStoreChange(messenger.app, defaults.env);
-                assertStatsPermissionsCurrent(path, defaults.settings.permissions ?? {});
                 refuseLacking(messenger, path);
                 for (const permission of readKeysForCommand(path)) {
                     if (levelFor(defaults.settings.permissions ?? {}, permission).level === "deny")

package/dist/meetings/calendar-text.d.ts

@@ -0,0 +1,13 @@
+/** Every web link without its query string or fragment, which is where passcodes ride (`pwd=`). */
+export declare const withoutLinkQueries: (text: string) => string;
+/**
+ * A calendar's text as the store keeps it: HTML reduced to text, links without their query strings, and each line
+ * naming a passcode, password or PIN dropped — except from a title, where "PIN reset review" is a meeting's name.
+ * `null` when nothing is left.
+ */
+export declare const calendarText: (text: string | null | undefined, { dropSecretLines }?: {
+    dropSecretLines?: boolean;
+}) => string | null;
+/** The provider fields a calendar entry may keep in `metadata`: none of them can open a meeting. */
+export declare const ENTRY_METADATA_KEYS: readonly ["colorId", "guestsCanInviteOthers", "guestsCanModify", "guestsCanSeeOtherGuests", "hangoutLink", "locked", "privateCopy", "recurring_event_id"];
+export declare const entryMetadata: (metadata: Record<string, unknown> | null | undefined) => Record<string, unknown>;