@wirecat/cli-core 0.545.0 → 0.547.0

package/dist/store/sqlite/memories.d.ts

@@ -1,12 +1,14 @@
 import { MEMORY_KINDS, MEMORY_SCOPES, type MEMORY_STATUSES } from "../../domain/knowledge.js";
-import { type Actor } from "./actors.js";
+import { type Decider } from "../decisions.js";
+import { type Actor, type ProposedByFilter } from "./actors.js";
 import { type EvidenceSource } from "./evidence-sources.js";
 import { type NoteIndexState } from "./note-index.js";
 import type { StoreContext } from "./open.js";
-/** Who wrote it: the owner, or an agent by its bot handle and the model it ran on. */
+/** Who wrote it: the owner, or an agent (or a rule scorer) by its bot handle and the model it ran on. */
 export type Author = "owner" | {
     bot: string;
     model?: string;
+    kind?: "agent" | "rule";
 };
 export interface Memory {
     id: string;
@@ -22,11 +24,12 @@ export interface Memory {
     /** The project it belongs to, as `project:<id>`. */
     project: string | null;
     projectName: string | null;
-    /** `name` is a bot's handle; `null` for a person. */
+    /** `name` is a bot's handle and `kind` whether it is an agent or a rule; both `null` for a person. */
     author: {
         type: Actor["type"];
         id: string;
         name: string | null;
+        kind: "agent" | "rule" | null;
     };
     model: string | null;
     confidence: number | null;
@@ -63,21 +66,22 @@ export interface MemoriesStore {
         kind?: Memory["kind"];
         status?: Memory["status"];
         scope?: Memory["scope"];
+        proposedBy?: ProposedByFilter;
         limit?: number;
     }): Promise<Memory[]>;
     /** Moves it to another project, or to none with `null`. */
     update(reference: string, change: {
         project: string | null;
     }): Promise<Memory>;
-    /** The owner stands behind it; its evidence was checked now. */
-    confirm(reference: string): Promise<Memory>;
-    /** Its evidence no longer holds. */
-    markStale(reference: string): Promise<Memory>;
+    /** The owner, or an agent for the owner, stands behind it; its evidence was checked now. */
+    confirm(reference: string, by: Decider): Promise<Memory>;
+    /** Its evidence no longer holds; for an agent's memory this is how it is turned down, so `by` must be allowed. */
+    markStale(reference: string, by: Decider): Promise<Memory>;
     /**
      * Erases the memory: its row, its text in the search and meaning indexes, and every link from or to it. A memory
      * that replaced it no longer names it. A backup made before keeps it.
      */
-    remove(reference: string): Promise<{
+    remove(reference: string, by: Decider): Promise<{
         ref: string;
         removed: true;
         links: number;

package/dist/store/sqlite/memories.js

@@ -1,7 +1,8 @@
 import { CliError } from "@wirecat/cli-base";
 import { MEMORY_KINDS, MEMORY_SCOPES } from "../../domain/knowledge.js";
+import { assertMayDecide, assertMayWithdraw } from "../decisions.js";
 import { normalize } from "../normalize.js";
-import { botNamed, ownerPerson } from "./actors.js";
+import { botNamed, ownerPerson, proposedBySql, proposerOf } from "./actors.js";
 import { evidenceSourcesOf } from "./evidence-sources.js";
 import { linkKind } from "./link-kinds.js";
 import { CORPORA, corpusIndexState, drainCorpus } from "./note-index.js";
@@ -9,7 +10,7 @@ import { requiredThing } from "./notes.js";
 import { stemmerCache } from "./stems.js";
 import { referenceOfThing, storedThing } from "./things.js";
 import { write } from "./transaction.js";
-const NAMED = "SELECT m.*, b.name AS author_name FROM memories m LEFT JOIN bots b ON m.author_type = 'bot' AND b.id = m.author_id";
+const NAMED = "SELECT m.*, b.name AS author_name, b.kind AS author_kind FROM memories m LEFT JOIN bots b ON m.author_type = 'bot' AND b.id = m.author_id";
 const iso = (value) => new Date(Number(value)).toISOString();
 const oneOf = (value, allowed, what) => {
     if (typeof value !== "string" || !allowed.includes(value))
@@ -20,7 +21,7 @@ export const authorActor = (context, author) => {
     if (author === "owner")
         return { actor: ownerPerson(context.database), model: null };
     return {
-        actor: botNamed(context.database, author.bot, context.now(), "agent"),
+        actor: botNamed(context.database, author.bot, context.now(), author.kind ?? "agent"),
         model: author.model === undefined ? null : author.model.trim().slice(0, 200) || null,
     };
 };
@@ -28,6 +29,7 @@ export const authorOf = (row) => ({
     type: row.author_type,
     id: String(row.author_id),
     name: row.author_name == null ? null : String(row.author_name),
+    kind: row.author_type !== "bot" ? null : row.author_kind === "rule" || row.author_name === "rule" ? "rule" : "agent",
 });
 /** Writes `evidence` links from a row to each reference, refusing one the store does not hold. */
 export const linkEvidence = (context, from, references, author) => {
@@ -153,6 +155,10 @@ export const memoriesStoreOver = (context) => {
             throw new CliError("not_found", `${reference} is a fact now: store.facts holds it`);
         return row;
     };
+    const decided = (reference, by) => {
+        const row = rowOf(reference);
+        assertMayDecide({ id: `memory:${row.id}`, proposedBy: proposerOf(database, row.author_type, row.author_id) }, by, context.decisions);
+    };
     const setStatus = (reference, status, verified) => {
         const row = rowOf(reference);
         const at = now();
@@ -179,6 +185,10 @@ export const memoriesStoreOver = (context) => {
             if (input.confidence !== undefined && !(input.confidence >= 0 && input.confidence <= 1))
                 throw new CliError("validation_error", "confidence takes 0–1");
             const status = oneOf(input.status ?? "proposed", ["proposed", "confirmed"], "a new memory's status");
+            if (status === "confirmed" && input.author !== "owner")
+                throw new CliError("permission_error", "an agent's memory waits as proposed; only the owner confirms it", {
+                    reason: "proposal.owner-only",
+                });
             const id = write(database, () => {
                 const { actor, model } = authorActor(context, input.author);
                 const subject = input.subject === undefined ? undefined : requiredThing(database, input.subject, "the subject");
@@ -201,11 +211,12 @@ export const memoriesStoreOver = (context) => {
         list: async (options = {}) => {
             const subject = options.subject === undefined ? undefined : requiredThing(database, options.subject);
             const project = options.project === undefined ? null : projectId(database, options.project);
+            const by = proposedBySql("m.author_type", "m.author_id", options.proposedBy);
             return database
                 .prepare(`${NAMED} WHERE m.deleted_at IS NULL AND (? IS NULL OR (m.subject_type = ? AND m.subject_id = ?)) ` +
                 "AND (? IS NULL OR m.project_id = ?) AND (? IS NULL OR m.kind = ?) AND (? IS NULL OR m.status = ?) AND (? IS NULL OR m.scope = ?) " +
-                "ORDER BY m.created_at DESC, m.id DESC LIMIT ?")
-                .all(subject?.type ?? null, subject?.type ?? null, subject?.id ?? null, project, project, options.kind ?? null, options.kind ?? null, options.status ?? null, options.status ?? null, options.scope ?? null, options.scope ?? null, Math.min(Math.max(options.limit ?? 100, 1), 500))
+                `AND ${by.sql} ORDER BY m.created_at DESC, m.id DESC LIMIT ?`)
+                .all(subject?.type ?? null, subject?.type ?? null, subject?.id ?? null, project, project, options.kind ?? null, options.kind ?? null, options.status ?? null, options.status ?? null, options.scope ?? null, options.scope ?? null, ...by.params, Math.min(Math.max(options.limit ?? 100, 1), 500))
                 .map(memoryOf);
         },
         update: async (reference, change) => write(database, () => {
@@ -214,10 +225,22 @@ export const memoriesStoreOver = (context) => {
             database.prepare("UPDATE memories SET project_id = ?, updated_at = ? WHERE id = ?").run(project, now(), id);
             return memoryOf(rowOf(`memory:${id}`));
         }),
-        confirm: async (reference) => setStatus(reference, "confirmed", true),
-        markStale: async (reference) => setStatus(reference, "stale", false),
-        remove: async (reference) => {
-            const id = Number(rowOf(reference).id);
+        confirm: async (reference, by) => {
+            decided(reference, by);
+            return setStatus(reference, "confirmed", true);
+        },
+        markStale: async (reference, by) => {
+            decided(reference, by);
+            return setStatus(reference, "stale", false);
+        },
+        remove: async (reference, by) => {
+            const row = rowOf(reference);
+            assertMayWithdraw({
+                id: `memory:${row.id}`,
+                proposedBy: proposerOf(database, row.author_type, row.author_id),
+                proposed: row.status === "proposed",
+            }, by);
+            const id = Number(row.id);
             const links = erase(database, () => {
                 keepHighestId(database, "memories", now());
                 database.prepare("UPDATE memories SET supersedes_id = NULL WHERE supersedes_id = ?").run(id);
@@ -238,7 +261,7 @@ export const memoriesStoreOver = (context) => {
                 throw new CliError("validation_error", "say what to find in the memories");
             const match = `normalized_text : (${words.map((word) => `"${word.replaceAll('"', '""')}"*`).join(" AND ")})`;
             return database
-                .prepare("SELECT m.*, b.name AS author_name FROM memory_words w JOIN memories m ON m.id = w.rowid " +
+                .prepare("SELECT m.*, b.name AS author_name, b.kind AS author_kind FROM memory_words w JOIN memories m ON m.id = w.rowid " +
                 "LEFT JOIN bots b ON m.author_type = 'bot' AND b.id = m.author_id WHERE memory_words MATCH ? " +
                 "AND m.deleted_at IS NULL AND (? IS NULL OR (m.subject_type = ? AND m.subject_id = ?)) " +
                 "AND (? IS NULL OR m.scope = ?) ORDER BY bm25(memory_words), m.id LIMIT ?")

package/dist/store/sqlite/notes.d.ts

@@ -1,4 +1,5 @@
 import type { Section } from "../../readers/types.js";
+import { type Decider } from "../decisions.js";
 import type { CacheDatabase } from "../driver.js";
 import { type DocumentMetadata } from "./document-metadata.js";
 import { type ImportedDocuments } from "./imported-documents.js";
@@ -81,6 +82,8 @@ export interface LinkInput {
     evidence?: string;
     provenance?: string;
     confirmed?: boolean;
+    /** Who writes it: a confirmed link needs the owner. */
+    by?: Decider;
 }
 export interface FileNoteInput {
     folderId: string;
@@ -151,7 +154,8 @@ export interface NotesStore extends NoteSearch, ImportedDocuments {
     }>;
     addLink(input: LinkInput): Promise<Link>;
     links(options?: LinkListFilter): Promise<Link[]>;
-    removeLink(id: string): Promise<{
+    /** Only the owner removes a link: it records no actor, so who proposed it cannot be checked. */
+    removeLink(id: string, by: Decider): Promise<{
         id: string;
         removed: true;
     }>;

package/dist/store/sqlite/notes.js

@@ -4,6 +4,7 @@ import { googleDocumentLinks } from "../../domain/google-documents.js";
 import { DOCUMENT_ACCOUNT_PROVIDERS, filesAccountSql, folderProviderOf, folderProviderSql, isDocumentAccountProvider, } from "../../domain/providers.js";
 import { parseReference } from "../../domain/references.js";
 import { normalizeTag } from "../../domain/tags.js";
+import { assertMayWithdraw } from "../decisions.js";
 import { fold } from "../normalize.js";
 import { ulid } from "../ulid.js";
 import { ownerPerson } from "./actors.js";
@@ -14,7 +15,7 @@ import { LINK_KINDS, LINK_ORIGINS, linkKind } from "./link-kinds.js";
 import { reviewLink } from "./link-reviews.js";
 import { holdingText } from "./note-index.js";
 import { addTags, ensureTag, labelsOf } from "./tags.js";
-import { canonicalThingReference, referenceOfThing, storedThing, thingOf } from "./things.js";
+import { referenceOfThing, storedThing, thingOf } from "./things.js";
 import { write } from "./transaction.js";
 export const NOTE_FORMATS = ["obsidian", "markdown"];
 export { LINK_ORIGINS } from "./link-kinds.js";
@@ -94,7 +95,7 @@ export const linkOf = (database, row) => {
 };
 /** The row a reference names, refused when the store holds none. */
 export const requiredThing = (database, reference, what = "the target") => {
-    const thing = thingOf(database, canonicalThingReference(reference));
+    const thing = thingOf(database, reference);
     if (!thing)
         throw new CliError("not_found", `${what} ${reference} is not in the local store`);
     return thing;
@@ -149,6 +150,20 @@ export const resolvePersonLinks = (database, names) => {
         if (check.get(key))
             resolveKey(database, key);
 };
+/** A confirmed link is the owner's statement, of any kind; an agent's link is written unconfirmed. */
+const ownerLink = (input) => {
+    if (input.confirmed === false)
+        return input;
+    if (input.by === undefined)
+        throw new CliError("validation_error", "a confirmed link names who writes it: the owner", {
+            reason: "proposal.decider-required",
+        });
+    if (input.by !== "owner")
+        throw new CliError("permission_error", "an agent's link is written unconfirmed; only the owner confirms one", {
+            reason: "proposal.owner-only",
+        });
+    return input;
+};
 /** Writes one link; an identical resolved link is answered instead of doubled. */
 export const insertLink = (context, input) => {
     const { database, now } = context;
@@ -522,7 +537,7 @@ export const notesStoreOver = (context) => {
             const { limit, offset } = bounded(options.limit, options.offset);
             if (options.source !== undefined)
                 oneOf(options.source, ["file", "internal"], "a note's source");
-            const about = options.about === undefined ? undefined : thingOf(database, canonicalThingReference(options.about));
+            const about = options.about === undefined ? undefined : thingOf(database, options.about);
             if (options.about !== undefined && !about)
                 return { items: [], hasMore: false };
             const folder = options.folderId === undefined ? null : Number(folderRow(options.folderId).id);
@@ -592,12 +607,12 @@ export const notesStoreOver = (context) => {
             database.prepare("DELETE FROM notes WHERE id = ?").run(Number(bare));
             return { id, removed: true };
         }),
-        addLink: async (input) => write(database, () => insertLink(context, input)),
+        addLink: async (input) => write(database, () => insertLink(context, ownerLink(input))),
         links: async (options = {}) => {
             const pair = (reference) => {
                 if (reference === undefined)
                     return { known: true, type: null, id: null };
-                const thing = thingOf(database, canonicalThingReference(reference));
+                const thing = thingOf(database, reference);
                 return thing ? { known: true, type: thing.type, id: thing.id } : { known: false, type: null, id: null };
             };
             const from = pair(options.from);
@@ -617,7 +632,8 @@ export const notesStoreOver = (context) => {
                 .all(from.type, from.type, from.id, to.type, to.type, to.id, options.unresolved ? 1 : 0, ...filters.map(({ value }) => value))
                 .map((row) => linkOf(database, row));
         },
-        removeLink: async (id) => write(database, () => {
+        removeLink: async (id, by) => write(database, () => {
+            assertMayWithdraw({ id: `link:${id}`, proposedBy: { type: "unknown" }, proposed: false }, by);
             if (!/^\d+$/.test(id) || !database.prepare("DELETE FROM links WHERE id = ?").run(Number(id)).changes)
                 throw new CliError("not_found", `no link ${id} in the local store`);
             return { id, removed: true };

package/dist/store/sqlite/open-store.d.ts

@@ -1,3 +1,4 @@
+import { type DecisionPolicy } from "../decisions.js";
 import { type StoreContext } from "./open.js";
 export interface StoreOptions {
     /** Open an existing compatible store without maintenance; SQLite refuses writes. */
@@ -11,6 +12,8 @@ export interface StoreOptions {
     version?: string;
     /** Where the notice of an upgrade that locks other CLIs out goes; stderr, since stdout may carry JSON or MCP. */
     warn?: (line: string) => void;
+    /** The host's decision policy (its `agent_decisions`); the default lets an agent decide with a reason. */
+    decisions?: DecisionPolicy;
 }
 export declare const BACKFILL_ON_OPEN = 5000;
-export declare const openStoreContext: ({ path, env, now, command, version, warn, readOnly, }?: StoreOptions) => Promise<StoreContext>;
+export declare const openStoreContext: ({ path, env, now, command, version, warn, readOnly, decisions, }?: StoreOptions) => Promise<StoreContext>;

package/dist/store/sqlite/open-store.js

@@ -1,6 +1,7 @@
 import { mkdirSync, statSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 import { CliError } from "@wirecat/cli-base";
+import { DEFAULT_DECISION_POLICY } from "../decisions.js";
 import { migrate } from "../migrations.js";
 import { storeCapable } from "../open.js";
 import { storePath } from "../path.js";
@@ -31,7 +32,7 @@ const createWritable = (file) => {
         throw new CliError("permission_error", "the message store cannot be written from here; run where it is writable, or set MESSAGING_STORE", { reason: "store.not-writable" });
     }
 };
-export const openStoreContext = async ({ path, env, now = Date.now, command, version, warn = (line) => process.stderr.write(`${line}\n`), readOnly = false, } = {}) => {
+export const openStoreContext = async ({ path, env, now = Date.now, command, version, warn = (line) => process.stderr.write(`${line}\n`), readOnly = false, decisions = DEFAULT_DECISION_POLICY, } = {}) => {
     if (typeof readOnly !== "boolean")
         throw new CliError("validation_error", "readOnly must be a boolean");
     await storeCapable();
@@ -68,7 +69,12 @@ export const openStoreContext = async ({ path, env, now = Date.now, command, ver
             });
         }
         loadProviders(database);
-        return { ...opened, now, sharedConfig: sharedConfigPath(file, env ?? process.env) };
+        return {
+            ...opened,
+            now,
+            sharedConfig: sharedConfigPath(file, env ?? process.env),
+            decisions,
+        };
     }
     catch (error) {
         database.close();

package/dist/store/sqlite/open.d.ts

@@ -1,3 +1,4 @@
+import type { DecisionPolicy } from "../decisions.js";
 import { type CacheDatabase } from "../driver.js";
 import type { SQLiteAsyncDatabase } from "./drizzle/core.js";
 /** Drizzle over the store's connection. Synchronous inside: a transaction never awaits (plan D3). */
@@ -11,6 +12,8 @@ export interface StoreContext extends OpenedSqlite {
     now: () => number;
     /** The owner's shared config file, whose `task_categories` edits the store's list; none in a bare context. */
     sharedConfig?: string;
+    /** Who may decide proposals, set once by the host at open; every decide method reads it. */
+    decisions?: DecisionPolicy;
 }
 /**
  * One SQLite connection, seen two ways: the `CacheDatabase` seam the hand-written SQL and the

package/dist/store/sqlite/proposed-actions.d.ts

@@ -1,5 +1,6 @@
+import { type Decider, type Proposer } from "../decisions.js";
 import type { AccountKey } from "../types.js";
-import type { Actor } from "./actors.js";
+import { type Actor, type ProposedByFilter } from "./actors.js";
 import { type Author } from "./memories.js";
 import type { StoreContext } from "./open.js";
 export declare const PROPOSAL_STATUSES: readonly ["proposed", "approved", "rejected", "executed", "failed"];
@@ -18,11 +19,12 @@ export interface ProposedAction {
     payload: unknown;
     reason: string | null;
     status: (typeof PROPOSAL_STATUSES)[number];
-    /** `name` is a bot's handle; `null` for a person. */
+    /** `name` is a bot's handle and `kind` whether it is an agent or a rule; both `null` for a person. */
     proposedBy: {
         type: Actor["type"];
         id: string;
         name: string | null;
+        kind: "agent" | "rule" | null;
     };
     decidedBy: {
         type: Actor["type"];
@@ -50,14 +52,20 @@ export interface ProposedActionsStore {
     pending(options?: {
         limit?: number;
     }): Promise<ProposedAction[]>;
-    /** Newest first; every status unless one is named. */
+    /** Newest first; every status unless one is named, every kind unless `kinds` names some or `except` leaves some out. */
     list(options?: {
         status?: ProposedAction["status"];
         limit?: number;
+        kinds?: readonly string[];
+        except?: readonly string[];
+        proposedBy?: ProposedByFilter;
+        /** A `project:<id>` the action targets or its payload names as `to`, `from` or `project`. */
+        project?: string;
     }): Promise<ProposedAction[]>;
-    /** `result` records what the approval made, such as the task it became. */
-    approve(id: string, result?: unknown): Promise<ProposedAction>;
-    reject(id: string): Promise<ProposedAction>;
+    /** `result` records what the approval made, such as the task it became. `by` must be allowed to decide it. */
+    approve(id: string, by: Decider, result?: unknown): Promise<ProposedAction>;
+    /** `reason` is kept as the result: why it was turned down. */
+    reject(id: string, by: Decider, reason?: string): Promise<ProposedAction>;
     /** An approved action the adapter carried out, with what the provider answered. */
     executed(id: string, result?: unknown): Promise<ProposedAction>;
     failed(id: string, error: string): Promise<ProposedAction>;
@@ -65,10 +73,15 @@ export interface ProposedActionsStore {
 }
 type ProposalOperations = Omit<{
     [K in keyof ProposedActionsStore]: ProposedActionsStore[K] extends (...args: infer A) => Promise<infer R> ? (...args: A) => R : never;
-}, "approve"> & {
-    /** `by` records an agent deciding for the owner; the public store always records the owner. */
+}, "approve" | "reject"> & {
+    /** Records a decision already checked; `by` records an agent deciding for the owner. */
     approve(id: string, result?: unknown, by?: Author): ProposedAction;
+    reject(id: string, by?: Author, result?: unknown): ProposedAction;
+    /** Who proposed it, for `mayDecide`. */
+    proposer(id: string): Proposer;
 };
+/** Who proposed an action, for `mayDecide`. */
+export declare const proposerOfAction: ({ proposedBy }: ProposedAction) => Proposer;
 export declare const proposalOperationsOver: (context: StoreContext) => ProposalOperations;
 export declare const proposedActionsStoreOver: (context: StoreContext) => ProposedActionsStore;
 export {};

package/dist/store/sqlite/proposed-actions.js

@@ -1,6 +1,8 @@
 import { CliError } from "@wirecat/cli-base";
 import { MEETING_FINDINGS_KIND } from "../../meetings/index.js";
+import { assertMayDecide, deciderAuthor } from "../decisions.js";
 import { EVIDENCE_FINDINGS_KIND } from "../evidence-findings.js";
+import { proposedBySql } from "./actors.js";
 import { authorActor } from "./memories.js";
 import { requiredThing } from "./notes.js";
 import { referenceOfThing, storedThing } from "./things.js";
@@ -15,8 +17,14 @@ const json = (value) => (value == null ? null : JSON.parse(String(value)));
  */
 const STATUS = `CASE WHEN p.status = 'approved' AND p.kind IN ('${MEETING_FINDINGS_KIND}', '${EVIDENCE_FINDINGS_KIND}') ` +
     "AND json_array_length(p.result, '$.accepted') = 0 THEN 'rejected' ELSE p.status END";
-const NAMED = `SELECT p.*, ${STATUS} AS shown_status, b.name AS proposer_name FROM proposed_actions p ` +
+const NAMED = `SELECT p.*, ${STATUS} AS shown_status, b.name AS proposer_name, b.kind AS proposer_kind FROM proposed_actions p ` +
     "LEFT JOIN bots b ON p.proposed_by_type = 'bot' AND b.id = p.proposed_by_id";
+/** Who proposed an action, for `mayDecide`. */
+export const proposerOfAction = ({ proposedBy }) => proposedBy.type === "person"
+    ? { type: "person", id: proposedBy.id }
+    : proposedBy.name === null
+        ? { type: "unknown" }
+        : { type: "bot", id: proposedBy.id, name: proposedBy.name, kind: proposedBy.kind ?? "agent" };
 export const proposalOperationsOver = (context) => {
     const { database, now } = context;
     const actionOf = (row) => {
@@ -37,6 +45,11 @@ export const proposalOperationsOver = (context) => {
                 type: row.proposed_by_type,
                 id: String(row.proposed_by_id),
                 name: row.proposer_name == null ? null : String(row.proposer_name),
+                kind: row.proposed_by_type !== "bot"
+                    ? null
+                    : row.proposer_kind === "rule" || row.proposer_name === "rule"
+                        ? "rule"
+                        : "agent",
             },
             decidedBy: row.decided_by_type == null
                 ? null
@@ -108,16 +121,21 @@ export const proposalOperationsOver = (context) => {
             .prepare(`${NAMED} WHERE p.status = 'proposed' ORDER BY p.created_at, p.id LIMIT ?`)
             .all(Math.min(Math.max(limit, 1), 500))
             .map(actionOf),
-        list: ({ status, limit = 100 } = {}) => {
+        list: ({ status, limit = 100, kinds, except, proposedBy, project } = {}) => {
             if (status !== undefined && !PROPOSAL_STATUSES.includes(status))
                 throw new CliError("validation_error", `a status is one of ${PROPOSAL_STATUSES.join(", ")}`);
+            const by = proposedBySql("p.proposed_by_type", "p.proposed_by_id", proposedBy);
             return database
-                .prepare(`${NAMED} WHERE (? IS NULL OR ${STATUS} = ?) ORDER BY p.created_at DESC, p.id DESC LIMIT ?`)
-                .all(status ?? null, status ?? null, Math.min(Math.max(limit, 1), 500))
+                .prepare(`${NAMED} WHERE (? IS NULL OR ${STATUS} = ?) AND (? IS NULL OR p.kind IN (SELECT value FROM json_each(?))) ` +
+                "AND p.kind NOT IN (SELECT value FROM json_each(?)) AND (? IS NULL OR (p.target_type = 'project' AND " +
+                "'project:' || p.target_id = ?) OR json_extract(p.payload, '$.to') = ? OR json_extract(p.payload, '$.from') = ? " +
+                `OR json_extract(p.payload, '$.project') = ?) AND ${by.sql} ORDER BY p.created_at DESC, p.id DESC LIMIT ?`)
+                .all(status ?? null, status ?? null, kinds === undefined ? null : 1, JSON.stringify(kinds ?? []), JSON.stringify(except ?? []), ...Array(5).fill(project ?? null), ...by.params, Math.min(Math.max(limit, 1), 500))
                 .map(actionOf);
         },
         approve: (id, result, by) => decide(id, "approved", result, by),
-        reject: (id) => decide(id, "rejected"),
+        reject: (id, by, result) => decide(id, "rejected", result, by),
+        proposer: (id) => proposerOfAction(actionOf(rowOf(id))),
         executed: (id, result) => move(id, ["approved"], "executed", ", executed_at = ?, result = ?", [
             now(),
             result === undefined ? null : JSON.stringify(result),
@@ -161,13 +179,15 @@ export const proposedActionsStoreOver = (context) => {
         get: async (id) => operations.get(id),
         pending: async (options) => operations.pending(options),
         list: async (options) => operations.list(options),
-        approve: async (id, result) => {
+        approve: async (id, by, result) => {
             generic(id);
-            return operations.approve(id, result);
+            assertMayDecide({ id, proposedBy: operations.proposer(id) }, by, context.decisions);
+            return operations.approve(id, result, deciderAuthor(by));
         },
-        reject: async (id) => {
+        reject: async (id, by, reason) => {
             generic(id);
-            return operations.reject(id);
+            assertMayDecide({ id, proposedBy: operations.proposer(id) }, by, context.decisions);
+            return operations.reject(id, deciderAuthor(by), reason?.trim() ? { reason: reason.trim() } : undefined);
         },
         executed: async (id, result) => {
             generic(id);

package/dist/store/sqlite/reads.d.ts

@@ -898,14 +898,25 @@ export declare const messagesWindow: (context: StoreContext, chatKey: number, {
     before: number;
     after: number;
 }) => Message[];
-export declare const messagePage: (context: StoreContext, chatKey: number, { limit, before: anchorId, since, threadId, outgoing, starred, }: {
+/**
+ * `before` pages back from a message, newest page first. `after` reads forward from a message or strictly after a
+ * moment (epoch ms), oldest first. `until` (epoch ms, inclusive) ends either read.
+ */
+export interface MessagePageWindow {
     limit: number;
     before?: Id;
+    after?: {
+        id: Id;
+    } | {
+        time: number;
+    };
     since?: string;
+    until?: number;
     threadId?: Id;
     outgoing?: boolean;
     starred?: boolean;
-}) => Page<Message>;
+}
+export declare const messagePage: (context: StoreContext, chatKey: number, { limit, before: beforeId, after: start, since, until, threadId, outgoing, starred }: MessagePageWindow) => Page<Message>;
 export declare const around: (context: StoreContext, chatKey: number | undefined, messageId: Id, { before: earlier, after: later }: {
     before: number;
     after: number;

package/dist/store/sqlite/reads.js

@@ -33,6 +33,7 @@ export const selectMessages = ({ orm }) => orm
     .innerJoin(chats, eq(chats.id, messages.chatId))
     .leftJoin(identities, eq(identities.id, messages.senderIdentityId));
 export const newestFirst = [desc(messages.sentAt), desc(messages.id)];
+const oldestFirst = [asc(messages.sentAt), asc(messages.id)];
 export const before = (sentAt, pk) => sql `(${messages.sentAt}, ${messages.id}) < (${sentAt}, ${pk})`;
 const after = (sentAt, pk) => sql `(${messages.sentAt}, ${messages.id}) > (${sentAt}, ${pk})`;
 const live = (chatKey, ...conditions) => and(eq(messages.chatId, chatKey), isNull(messages.deletedAt), ...conditions);
@@ -92,7 +93,9 @@ export const messagesWindow = (context, chatKey, { at, before: earlier, after: l
         .all();
     return toMessages(context, [...older.reverse(), ...newer]);
 };
-export const messagePage = (context, chatKey, { limit, before: anchorId, since, threadId, outgoing, starred, }) => {
+export const messagePage = (context, chatKey, { limit, before: beforeId, after: start, since, until, threadId, outgoing, starred }) => {
+    const forward = start !== undefined;
+    const anchorId = forward ? ("id" in start ? start.id : undefined) : beforeId;
     const anchor = anchorId === undefined
         ? undefined
         : context.orm
@@ -104,7 +107,7 @@ export const messagePage = (context, chatKey, { limit, before: anchorId, since,
         throw new CliError("not_found", `message ${anchorId} is not in the local copy of this chat`);
     }
     const rows = selectMessages(context)
-        .where(live(chatKey, anchor ? before(anchor.sentAt, anchor.pk) : undefined, since === undefined ? undefined : gte(messages.sentAt, toMs(since)), threadId === undefined ? undefined : eq(messages.threadExternalId, threadId), outgoing === undefined
+        .where(live(chatKey, anchor ? (forward ? after : before)(anchor.sentAt, anchor.pk) : undefined, start !== undefined && "time" in start ? gt(messages.sentAt, start.time) : undefined, since === undefined ? undefined : gte(messages.sentAt, toMs(since)), until === undefined ? undefined : lte(messages.sentAt, until), threadId === undefined ? undefined : eq(messages.threadExternalId, threadId), outgoing === undefined
         ? undefined
         : outgoing
             ? eq(messages.outgoing, 1)
@@ -113,10 +116,11 @@ export const messagePage = (context, chatKey, { limit, before: anchorId, since,
         : starred
             ? sql `${messages.starred} = 1`
             : or(eq(messages.starred, 0), isNull(messages.starred))))
-        .orderBy(...newestFirst)
+        .orderBy(...(forward ? oldestFirst : newestFirst))
         .limit(limit + 1)
         .all();
-    return { items: toMessages(context, rows.slice(0, limit)).reverse(), hasMore: rows.length > limit };
+    const page = toMessages(context, rows.slice(0, limit));
+    return { items: forward ? page : page.reverse(), hasMore: rows.length > limit };
 };
 export const around = (context, chatKey, messageId, { before: earlier, after: later }) => {
     const anchor = chatKey === undefined

package/dist/store/sqlite/relation-proposals.d.ts

@@ -0,0 +1,34 @@
+import { type Decider } from "../decisions.js";
+import type { Author } from "./memories.js";
+import { type Link } from "./notes.js";
+import type { StoreContext } from "./open.js";
+import { type ProposedAction } from "./proposed-actions.js";
+import { type Thing } from "./things.js";
+/** `relationship` proposals in `proposed_actions`: an agent's or a rule's, and the rejected ones a scan skips. */
+export declare const relationProposalsOver: (context: StoreContext) => {
+    /** The same pending pair returns the proposal already held. */
+    propose: (from: Thing, input: {
+        from: string;
+        to: string;
+        kind: string;
+        role?: string;
+        evidence?: string[];
+        reason?: string;
+    }, by: Exclude<Author, "owner">) => ProposedAction;
+    rejected: (link: Link, by: Decider, reason?: string) => void;
+    /**
+     * Decides a stored `relationship` or `key_document` proposal in one transaction: the confirmed link and the
+     * decision land together or not at all.
+     */
+    decideProposal: (id: string, decision: LinkDecision) => {
+        proposal: ProposedAction;
+        link: Link | null;
+    };
+    /** Decides an unconfirmed link written before proposals were stored; only the owner may, as its author is unknown. */
+    decideLink: (id: string, decision: LinkDecision) => Link | null;
+};
+export interface LinkDecision {
+    confirm: boolean;
+    by: Decider;
+    reason?: string;
+}