@wirecat/cli-core 0.546.0 → 0.547.0

package/dist/store/sqlite/notes.js

@@ -4,6 +4,7 @@ import { googleDocumentLinks } from "../../domain/google-documents.js";
 import { DOCUMENT_ACCOUNT_PROVIDERS, filesAccountSql, folderProviderOf, folderProviderSql, isDocumentAccountProvider, } from "../../domain/providers.js";
 import { parseReference } from "../../domain/references.js";
 import { normalizeTag } from "../../domain/tags.js";
+import { assertMayWithdraw } from "../decisions.js";
 import { fold } from "../normalize.js";
 import { ulid } from "../ulid.js";
 import { ownerPerson } from "./actors.js";
@@ -149,6 +150,20 @@ export const resolvePersonLinks = (database, names) => {
         if (check.get(key))
             resolveKey(database, key);
 };
+/** A confirmed link is the owner's statement, of any kind; an agent's link is written unconfirmed. */
+const ownerLink = (input) => {
+    if (input.confirmed === false)
+        return input;
+    if (input.by === undefined)
+        throw new CliError("validation_error", "a confirmed link names who writes it: the owner", {
+            reason: "proposal.decider-required",
+        });
+    if (input.by !== "owner")
+        throw new CliError("permission_error", "an agent's link is written unconfirmed; only the owner confirms one", {
+            reason: "proposal.owner-only",
+        });
+    return input;
+};
 /** Writes one link; an identical resolved link is answered instead of doubled. */
 export const insertLink = (context, input) => {
     const { database, now } = context;
@@ -592,7 +607,7 @@ export const notesStoreOver = (context) => {
             database.prepare("DELETE FROM notes WHERE id = ?").run(Number(bare));
             return { id, removed: true };
         }),
-        addLink: async (input) => write(database, () => insertLink(context, input)),
+        addLink: async (input) => write(database, () => insertLink(context, ownerLink(input))),
         links: async (options = {}) => {
             const pair = (reference) => {
                 if (reference === undefined)
@@ -617,7 +632,8 @@ export const notesStoreOver = (context) => {
                 .all(from.type, from.type, from.id, to.type, to.type, to.id, options.unresolved ? 1 : 0, ...filters.map(({ value }) => value))
                 .map((row) => linkOf(database, row));
         },
-        removeLink: async (id) => write(database, () => {
+        removeLink: async (id, by) => write(database, () => {
+            assertMayWithdraw({ id: `link:${id}`, proposedBy: { type: "unknown" }, proposed: false }, by);
             if (!/^\d+$/.test(id) || !database.prepare("DELETE FROM links WHERE id = ?").run(Number(id)).changes)
                 throw new CliError("not_found", `no link ${id} in the local store`);
             return { id, removed: true };

package/dist/store/sqlite/open-store.d.ts

@@ -1,3 +1,4 @@
+import { type DecisionPolicy } from "../decisions.js";
 import { type StoreContext } from "./open.js";
 export interface StoreOptions {
     /** Open an existing compatible store without maintenance; SQLite refuses writes. */
@@ -11,6 +12,8 @@ export interface StoreOptions {
     version?: string;
     /** Where the notice of an upgrade that locks other CLIs out goes; stderr, since stdout may carry JSON or MCP. */
     warn?: (line: string) => void;
+    /** The host's decision policy (its `agent_decisions`); the default lets an agent decide with a reason. */
+    decisions?: DecisionPolicy;
 }
 export declare const BACKFILL_ON_OPEN = 5000;
-export declare const openStoreContext: ({ path, env, now, command, version, warn, readOnly, }?: StoreOptions) => Promise<StoreContext>;
+export declare const openStoreContext: ({ path, env, now, command, version, warn, readOnly, decisions, }?: StoreOptions) => Promise<StoreContext>;

package/dist/store/sqlite/open-store.js

@@ -1,6 +1,7 @@
 import { mkdirSync, statSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 import { CliError } from "@wirecat/cli-base";
+import { DEFAULT_DECISION_POLICY } from "../decisions.js";
 import { migrate } from "../migrations.js";
 import { storeCapable } from "../open.js";
 import { storePath } from "../path.js";
@@ -31,7 +32,7 @@ const createWritable = (file) => {
         throw new CliError("permission_error", "the message store cannot be written from here; run where it is writable, or set MESSAGING_STORE", { reason: "store.not-writable" });
     }
 };
-export const openStoreContext = async ({ path, env, now = Date.now, command, version, warn = (line) => process.stderr.write(`${line}\n`), readOnly = false, } = {}) => {
+export const openStoreContext = async ({ path, env, now = Date.now, command, version, warn = (line) => process.stderr.write(`${line}\n`), readOnly = false, decisions = DEFAULT_DECISION_POLICY, } = {}) => {
     if (typeof readOnly !== "boolean")
         throw new CliError("validation_error", "readOnly must be a boolean");
     await storeCapable();
@@ -68,7 +69,12 @@ export const openStoreContext = async ({ path, env, now = Date.now, command, ver
             });
         }
         loadProviders(database);
-        return { ...opened, now, sharedConfig: sharedConfigPath(file, env ?? process.env) };
+        return {
+            ...opened,
+            now,
+            sharedConfig: sharedConfigPath(file, env ?? process.env),
+            decisions,
+        };
     }
     catch (error) {
         database.close();

package/dist/store/sqlite/open.d.ts

@@ -1,3 +1,4 @@
+import type { DecisionPolicy } from "../decisions.js";
 import { type CacheDatabase } from "../driver.js";
 import type { SQLiteAsyncDatabase } from "./drizzle/core.js";
 /** Drizzle over the store's connection. Synchronous inside: a transaction never awaits (plan D3). */
@@ -11,6 +12,8 @@ export interface StoreContext extends OpenedSqlite {
     now: () => number;
     /** The owner's shared config file, whose `task_categories` edits the store's list; none in a bare context. */
     sharedConfig?: string;
+    /** Who may decide proposals, set once by the host at open; every decide method reads it. */
+    decisions?: DecisionPolicy;
 }
 /**
  * One SQLite connection, seen two ways: the `CacheDatabase` seam the hand-written SQL and the

package/dist/store/sqlite/proposed-actions.d.ts

@@ -1,5 +1,6 @@
+import { type Decider, type Proposer } from "../decisions.js";
 import type { AccountKey } from "../types.js";
-import type { Actor } from "./actors.js";
+import { type Actor, type ProposedByFilter } from "./actors.js";
 import { type Author } from "./memories.js";
 import type { StoreContext } from "./open.js";
 export declare const PROPOSAL_STATUSES: readonly ["proposed", "approved", "rejected", "executed", "failed"];
@@ -18,11 +19,12 @@ export interface ProposedAction {
     payload: unknown;
     reason: string | null;
     status: (typeof PROPOSAL_STATUSES)[number];
-    /** `name` is a bot's handle; `null` for a person. */
+    /** `name` is a bot's handle and `kind` whether it is an agent or a rule; both `null` for a person. */
     proposedBy: {
         type: Actor["type"];
         id: string;
         name: string | null;
+        kind: "agent" | "rule" | null;
     };
     decidedBy: {
         type: Actor["type"];
@@ -50,14 +52,20 @@ export interface ProposedActionsStore {
     pending(options?: {
         limit?: number;
     }): Promise<ProposedAction[]>;
-    /** Newest first; every status unless one is named. */
+    /** Newest first; every status unless one is named, every kind unless `kinds` names some or `except` leaves some out. */
     list(options?: {
         status?: ProposedAction["status"];
         limit?: number;
+        kinds?: readonly string[];
+        except?: readonly string[];
+        proposedBy?: ProposedByFilter;
+        /** A `project:<id>` the action targets or its payload names as `to`, `from` or `project`. */
+        project?: string;
     }): Promise<ProposedAction[]>;
-    /** `result` records what the approval made, such as the task it became. */
-    approve(id: string, result?: unknown): Promise<ProposedAction>;
-    reject(id: string): Promise<ProposedAction>;
+    /** `result` records what the approval made, such as the task it became. `by` must be allowed to decide it. */
+    approve(id: string, by: Decider, result?: unknown): Promise<ProposedAction>;
+    /** `reason` is kept as the result: why it was turned down. */
+    reject(id: string, by: Decider, reason?: string): Promise<ProposedAction>;
     /** An approved action the adapter carried out, with what the provider answered. */
     executed(id: string, result?: unknown): Promise<ProposedAction>;
     failed(id: string, error: string): Promise<ProposedAction>;
@@ -65,10 +73,15 @@ export interface ProposedActionsStore {
 }
 type ProposalOperations = Omit<{
     [K in keyof ProposedActionsStore]: ProposedActionsStore[K] extends (...args: infer A) => Promise<infer R> ? (...args: A) => R : never;
-}, "approve"> & {
-    /** `by` records an agent deciding for the owner; the public store always records the owner. */
+}, "approve" | "reject"> & {
+    /** Records a decision already checked; `by` records an agent deciding for the owner. */
     approve(id: string, result?: unknown, by?: Author): ProposedAction;
+    reject(id: string, by?: Author, result?: unknown): ProposedAction;
+    /** Who proposed it, for `mayDecide`. */
+    proposer(id: string): Proposer;
 };
+/** Who proposed an action, for `mayDecide`. */
+export declare const proposerOfAction: ({ proposedBy }: ProposedAction) => Proposer;
 export declare const proposalOperationsOver: (context: StoreContext) => ProposalOperations;
 export declare const proposedActionsStoreOver: (context: StoreContext) => ProposedActionsStore;
 export {};

package/dist/store/sqlite/proposed-actions.js

@@ -1,6 +1,8 @@
 import { CliError } from "@wirecat/cli-base";
 import { MEETING_FINDINGS_KIND } from "../../meetings/index.js";
+import { assertMayDecide, deciderAuthor } from "../decisions.js";
 import { EVIDENCE_FINDINGS_KIND } from "../evidence-findings.js";
+import { proposedBySql } from "./actors.js";
 import { authorActor } from "./memories.js";
 import { requiredThing } from "./notes.js";
 import { referenceOfThing, storedThing } from "./things.js";
@@ -15,8 +17,14 @@ const json = (value) => (value == null ? null : JSON.parse(String(value)));
  */
 const STATUS = `CASE WHEN p.status = 'approved' AND p.kind IN ('${MEETING_FINDINGS_KIND}', '${EVIDENCE_FINDINGS_KIND}') ` +
     "AND json_array_length(p.result, '$.accepted') = 0 THEN 'rejected' ELSE p.status END";
-const NAMED = `SELECT p.*, ${STATUS} AS shown_status, b.name AS proposer_name FROM proposed_actions p ` +
+const NAMED = `SELECT p.*, ${STATUS} AS shown_status, b.name AS proposer_name, b.kind AS proposer_kind FROM proposed_actions p ` +
     "LEFT JOIN bots b ON p.proposed_by_type = 'bot' AND b.id = p.proposed_by_id";
+/** Who proposed an action, for `mayDecide`. */
+export const proposerOfAction = ({ proposedBy }) => proposedBy.type === "person"
+    ? { type: "person", id: proposedBy.id }
+    : proposedBy.name === null
+        ? { type: "unknown" }
+        : { type: "bot", id: proposedBy.id, name: proposedBy.name, kind: proposedBy.kind ?? "agent" };
 export const proposalOperationsOver = (context) => {
     const { database, now } = context;
     const actionOf = (row) => {
@@ -37,6 +45,11 @@ export const proposalOperationsOver = (context) => {
                 type: row.proposed_by_type,
                 id: String(row.proposed_by_id),
                 name: row.proposer_name == null ? null : String(row.proposer_name),
+                kind: row.proposed_by_type !== "bot"
+                    ? null
+                    : row.proposer_kind === "rule" || row.proposer_name === "rule"
+                        ? "rule"
+                        : "agent",
             },
             decidedBy: row.decided_by_type == null
                 ? null
@@ -108,16 +121,21 @@ export const proposalOperationsOver = (context) => {
             .prepare(`${NAMED} WHERE p.status = 'proposed' ORDER BY p.created_at, p.id LIMIT ?`)
             .all(Math.min(Math.max(limit, 1), 500))
             .map(actionOf),
-        list: ({ status, limit = 100 } = {}) => {
+        list: ({ status, limit = 100, kinds, except, proposedBy, project } = {}) => {
             if (status !== undefined && !PROPOSAL_STATUSES.includes(status))
                 throw new CliError("validation_error", `a status is one of ${PROPOSAL_STATUSES.join(", ")}`);
+            const by = proposedBySql("p.proposed_by_type", "p.proposed_by_id", proposedBy);
             return database
-                .prepare(`${NAMED} WHERE (? IS NULL OR ${STATUS} = ?) ORDER BY p.created_at DESC, p.id DESC LIMIT ?`)
-                .all(status ?? null, status ?? null, Math.min(Math.max(limit, 1), 500))
+                .prepare(`${NAMED} WHERE (? IS NULL OR ${STATUS} = ?) AND (? IS NULL OR p.kind IN (SELECT value FROM json_each(?))) ` +
+                "AND p.kind NOT IN (SELECT value FROM json_each(?)) AND (? IS NULL OR (p.target_type = 'project' AND " +
+                "'project:' || p.target_id = ?) OR json_extract(p.payload, '$.to') = ? OR json_extract(p.payload, '$.from') = ? " +
+                `OR json_extract(p.payload, '$.project') = ?) AND ${by.sql} ORDER BY p.created_at DESC, p.id DESC LIMIT ?`)
+                .all(status ?? null, status ?? null, kinds === undefined ? null : 1, JSON.stringify(kinds ?? []), JSON.stringify(except ?? []), ...Array(5).fill(project ?? null), ...by.params, Math.min(Math.max(limit, 1), 500))
                 .map(actionOf);
         },
         approve: (id, result, by) => decide(id, "approved", result, by),
-        reject: (id) => decide(id, "rejected"),
+        reject: (id, by, result) => decide(id, "rejected", result, by),
+        proposer: (id) => proposerOfAction(actionOf(rowOf(id))),
         executed: (id, result) => move(id, ["approved"], "executed", ", executed_at = ?, result = ?", [
             now(),
             result === undefined ? null : JSON.stringify(result),
@@ -161,13 +179,15 @@ export const proposedActionsStoreOver = (context) => {
         get: async (id) => operations.get(id),
         pending: async (options) => operations.pending(options),
         list: async (options) => operations.list(options),
-        approve: async (id, result) => {
+        approve: async (id, by, result) => {
             generic(id);
-            return operations.approve(id, result);
+            assertMayDecide({ id, proposedBy: operations.proposer(id) }, by, context.decisions);
+            return operations.approve(id, result, deciderAuthor(by));
         },
-        reject: async (id) => {
+        reject: async (id, by, reason) => {
             generic(id);
-            return operations.reject(id);
+            assertMayDecide({ id, proposedBy: operations.proposer(id) }, by, context.decisions);
+            return operations.reject(id, deciderAuthor(by), reason?.trim() ? { reason: reason.trim() } : undefined);
         },
         executed: async (id, result) => {
             generic(id);

package/dist/store/sqlite/reads.d.ts

@@ -898,14 +898,25 @@ export declare const messagesWindow: (context: StoreContext, chatKey: number, {
     before: number;
     after: number;
 }) => Message[];
-export declare const messagePage: (context: StoreContext, chatKey: number, { limit, before: anchorId, since, threadId, outgoing, starred, }: {
+/**
+ * `before` pages back from a message, newest page first. `after` reads forward from a message or strictly after a
+ * moment (epoch ms), oldest first. `until` (epoch ms, inclusive) ends either read.
+ */
+export interface MessagePageWindow {
     limit: number;
     before?: Id;
+    after?: {
+        id: Id;
+    } | {
+        time: number;
+    };
     since?: string;
+    until?: number;
     threadId?: Id;
     outgoing?: boolean;
     starred?: boolean;
-}) => Page<Message>;
+}
+export declare const messagePage: (context: StoreContext, chatKey: number, { limit, before: beforeId, after: start, since, until, threadId, outgoing, starred }: MessagePageWindow) => Page<Message>;
 export declare const around: (context: StoreContext, chatKey: number | undefined, messageId: Id, { before: earlier, after: later }: {
     before: number;
     after: number;

package/dist/store/sqlite/reads.js

@@ -33,6 +33,7 @@ export const selectMessages = ({ orm }) => orm
     .innerJoin(chats, eq(chats.id, messages.chatId))
     .leftJoin(identities, eq(identities.id, messages.senderIdentityId));
 export const newestFirst = [desc(messages.sentAt), desc(messages.id)];
+const oldestFirst = [asc(messages.sentAt), asc(messages.id)];
 export const before = (sentAt, pk) => sql `(${messages.sentAt}, ${messages.id}) < (${sentAt}, ${pk})`;
 const after = (sentAt, pk) => sql `(${messages.sentAt}, ${messages.id}) > (${sentAt}, ${pk})`;
 const live = (chatKey, ...conditions) => and(eq(messages.chatId, chatKey), isNull(messages.deletedAt), ...conditions);
@@ -92,7 +93,9 @@ export const messagesWindow = (context, chatKey, { at, before: earlier, after: l
         .all();
     return toMessages(context, [...older.reverse(), ...newer]);
 };
-export const messagePage = (context, chatKey, { limit, before: anchorId, since, threadId, outgoing, starred, }) => {
+export const messagePage = (context, chatKey, { limit, before: beforeId, after: start, since, until, threadId, outgoing, starred }) => {
+    const forward = start !== undefined;
+    const anchorId = forward ? ("id" in start ? start.id : undefined) : beforeId;
     const anchor = anchorId === undefined
         ? undefined
         : context.orm
@@ -104,7 +107,7 @@ export const messagePage = (context, chatKey, { limit, before: anchorId, since,
         throw new CliError("not_found", `message ${anchorId} is not in the local copy of this chat`);
     }
     const rows = selectMessages(context)
-        .where(live(chatKey, anchor ? before(anchor.sentAt, anchor.pk) : undefined, since === undefined ? undefined : gte(messages.sentAt, toMs(since)), threadId === undefined ? undefined : eq(messages.threadExternalId, threadId), outgoing === undefined
+        .where(live(chatKey, anchor ? (forward ? after : before)(anchor.sentAt, anchor.pk) : undefined, start !== undefined && "time" in start ? gt(messages.sentAt, start.time) : undefined, since === undefined ? undefined : gte(messages.sentAt, toMs(since)), until === undefined ? undefined : lte(messages.sentAt, until), threadId === undefined ? undefined : eq(messages.threadExternalId, threadId), outgoing === undefined
         ? undefined
         : outgoing
             ? eq(messages.outgoing, 1)
@@ -113,10 +116,11 @@ export const messagePage = (context, chatKey, { limit, before: anchorId, since,
         : starred
             ? sql `${messages.starred} = 1`
             : or(eq(messages.starred, 0), isNull(messages.starred))))
-        .orderBy(...newestFirst)
+        .orderBy(...(forward ? oldestFirst : newestFirst))
         .limit(limit + 1)
         .all();
-    return { items: toMessages(context, rows.slice(0, limit)).reverse(), hasMore: rows.length > limit };
+    const page = toMessages(context, rows.slice(0, limit));
+    return { items: forward ? page : page.reverse(), hasMore: rows.length > limit };
 };
 export const around = (context, chatKey, messageId, { before: earlier, after: later }) => {
     const anchor = chatKey === undefined

package/dist/store/sqlite/relation-proposals.d.ts

@@ -0,0 +1,34 @@
+import { type Decider } from "../decisions.js";
+import type { Author } from "./memories.js";
+import { type Link } from "./notes.js";
+import type { StoreContext } from "./open.js";
+import { type ProposedAction } from "./proposed-actions.js";
+import { type Thing } from "./things.js";
+/** `relationship` proposals in `proposed_actions`: an agent's or a rule's, and the rejected ones a scan skips. */
+export declare const relationProposalsOver: (context: StoreContext) => {
+    /** The same pending pair returns the proposal already held. */
+    propose: (from: Thing, input: {
+        from: string;
+        to: string;
+        kind: string;
+        role?: string;
+        evidence?: string[];
+        reason?: string;
+    }, by: Exclude<Author, "owner">) => ProposedAction;
+    rejected: (link: Link, by: Decider, reason?: string) => void;
+    /**
+     * Decides a stored `relationship` or `key_document` proposal in one transaction: the confirmed link and the
+     * decision land together or not at all.
+     */
+    decideProposal: (id: string, decision: LinkDecision) => {
+        proposal: ProposedAction;
+        link: Link | null;
+    };
+    /** Decides an unconfirmed link written before proposals were stored; only the owner may, as its author is unknown. */
+    decideLink: (id: string, decision: LinkDecision) => Link | null;
+};
+export interface LinkDecision {
+    confirm: boolean;
+    by: Decider;
+    reason?: string;
+}

package/dist/store/sqlite/relation-proposals.js

@@ -0,0 +1,114 @@
+import { CliError } from "@wirecat/cli-base";
+import { assertMayDecide, deciderAuthor } from "../decisions.js";
+import { actorOfOrigin, botNamed, ownerPerson } from "./actors.js";
+import { insertLink, linkOf } from "./notes.js";
+import { proposalOperationsOver, proposerOfAction } from "./proposed-actions.js";
+import { thingOf } from "./things.js";
+import { write } from "./transaction.js";
+/** `relationship` proposals in `proposed_actions`: an agent's or a rule's, and the rejected ones a scan skips. */
+export const relationProposalsOver = (context) => {
+    const { database, now } = context;
+    const operations = proposalOperationsOver(context);
+    /** The rejected `relationship` proposal a removed link leaves behind, so a scan never proposes it again. */
+    const rejected = (link, by, reason) => {
+        const at = now();
+        const proposed = link.confirmed ? ownerPerson(database) : actorOfOrigin(database, "agent");
+        const decided = by === "owner" ? ownerPerson(database) : botNamed(database, by.bot, at);
+        const why = [
+            `${link.confirmed ? "removed" : "rejected"} by ${by === "owner" ? "the owner" : `agent:${by.bot}`}`,
+            by === "owner" ? undefined : by.reason.trim(),
+            reason?.trim() || undefined,
+        ].filter(Boolean);
+        const from = thingOf(database, link.from);
+        database
+            .prepare("INSERT INTO proposed_actions (kind, target_type, target_id, payload, reason, status, proposed_by_type, " +
+            "proposed_by_id, decided_by_type, decided_by_id, decided_at, result, created_at, updated_at) " +
+            "VALUES ('relationship', ?, ?, ?, ?, 'rejected', ?, ?, ?, ?, ?, ?, ?, ?)")
+            .run(from?.type ?? null, from?.id ?? null, JSON.stringify({ from: link.from, to: link.to, kind: link.kind, ...(link.role ? { role: link.role } : {}) }), link.evidence, proposed.type, proposed.id, decided.type, decided.id, at, JSON.stringify({ reason: why.join(": "), link: link.id }), at, at);
+    };
+    return {
+        /** The same pending pair returns the proposal already held. */
+        propose: (from, input, by) => {
+            const evidence = input.evidence ?? [];
+            if (!Array.isArray(evidence) || evidence.length > 5 || evidence.some((ref) => typeof ref !== "string"))
+                throw new CliError("validation_error", "a relationship proposal cites up to 5 references");
+            return write(database, () => {
+                const held = database
+                    .prepare("SELECT id FROM proposed_actions WHERE kind='relationship' AND status='proposed' AND target_type=? AND target_id=? " +
+                    "AND json_extract(payload,'$.to')=? AND json_extract(payload,'$.kind')=? ORDER BY id LIMIT 1")
+                    .get(from.type, from.id, input.to, input.kind);
+                if (held)
+                    return operations.get(String(held.id));
+                return operations.propose({
+                    kind: "relationship",
+                    by,
+                    target: input.from,
+                    payload: {
+                        from: input.from,
+                        to: input.to,
+                        kind: input.kind,
+                        ...(input.role === undefined ? {} : { role: input.role }),
+                        evidence,
+                    },
+                    ...(input.reason === undefined ? {} : { reason: input.reason }),
+                });
+            });
+        },
+        rejected: (link, by, reason) => rejected(link, by, reason),
+        /**
+         * Decides a stored `relationship` or `key_document` proposal in one transaction: the confirmed link and the
+         * decision land together or not at all.
+         */
+        decideProposal: (id, decision) => write(database, () => {
+            const proposal = operations.get(id);
+            if (proposal.kind !== "relationship" && proposal.kind !== "key_document")
+                throw new CliError("validation_error", `${id} is a ${proposal.kind} proposal, not a link`);
+            assertMayDecide({ id, proposedBy: proposerOfAction(proposal) }, decision.by, context.decisions);
+            const author = deciderAuthor(decision.by);
+            const reason = decision.reason?.trim() || undefined;
+            if (!decision.confirm)
+                return { proposal: operations.reject(id, author, reason === undefined ? undefined : { reason }), link: null };
+            const payload = proposal.payload;
+            const key = proposal.kind === "key_document";
+            const link = insertLink(context, {
+                from: String(key ? payload.ref : payload.from),
+                to: String(key ? payload.project : payload.to),
+                kind: key ? "related-to" : (payload.kind ?? "member-of"),
+                ...(key ? { role: "key" } : payload.role === undefined ? {} : { role: payload.role }),
+                ...(proposal.reason === null ? {} : { evidence: proposal.reason }),
+                ...decidedOrigin(decision.by),
+            });
+            return {
+                proposal: operations.approve(id, { link: link.id, ...(reason === undefined ? {} : { reason }) }, author),
+                link,
+            };
+        }),
+        /** Decides an unconfirmed link written before proposals were stored; only the owner may, as its author is unknown. */
+        decideLink: (id, decision) => write(database, () => {
+            const row = /^\d+$/.test(id)
+                ? database.prepare("SELECT * FROM links WHERE id = ? AND confirmed = 0").get(Number(id))
+                : undefined;
+            if (!row)
+                throw new CliError("not_found", `no suggested link ${id}`);
+            assertMayDecide({ id: `link:${id}`, proposedBy: { type: "unknown" } }, decision.by, context.decisions);
+            const link = linkOf(database, row);
+            if (!decision.confirm) {
+                rejected(link, decision.by, decision.reason);
+                database.prepare("DELETE FROM links WHERE id = ?").run(Number(id));
+                return null;
+            }
+            database
+                .prepare("UPDATE links SET confirmed=1, source='owner', author='owner', updated_at=? WHERE id=?")
+                .run(now(), Number(id));
+            return linkOf(database, database.prepare("SELECT * FROM links WHERE id = ?").get(Number(id)));
+        }),
+    };
+};
+/** A link an agent confirmed for the owner says so in its provenance. */
+const decidedOrigin = (by) => by === "owner"
+    ? { origin: "owner" }
+    : {
+        origin: "suggested",
+        confirmed: true,
+        provenance: `agent:${by.bot} for the owner: ${by.reason.trim()}`,
+    };

package/dist/store/store.d.ts

@@ -6,6 +6,7 @@ import { type AttachmentsStore } from "./attachments.js";
 import { type ChatsStore } from "./chats.js";
 import { type ConversationsStore } from "./conversations.js";
 import { type CountersStore } from "./counters.js";
+import { type DecisionPolicy } from "./decisions.js";
 import type { EvidenceFindingsStore } from "./evidence-findings.js";
 import type { MeetingFindingsStore } from "./meeting-findings.js";
 import { type MentionsStore } from "./mentions.js";
@@ -95,6 +96,8 @@ export interface MessageStore {
     readonly memories: MemoriesStore;
     /** What an agent wants done outside the store, waiting for the owner's approval. */
     readonly proposedActions: ProposedActionsStore;
+    /** Who may decide proposals, fixed when the store was opened; the store's decide methods and the registry read it. */
+    readonly decisionPolicy: DecisionPolicy;
     /** One row per tool an agent called, never its arguments. */
     readonly agentActions: AgentActionsStore;
     /** Meetings and calendar events: the port `src/meetings/` defines. */

package/dist/store/store.js

@@ -4,6 +4,7 @@ import { accountAttachmentsOver, attachmentsStoreOver, } from "./attachments.js"
 import { chatsStoreOver } from "./chats.js";
 import { conversationsStoreOver } from "./conversations.js";
 import { accountCountersOver, countersStoreOver } from "./counters.js";
+import { DEFAULT_DECISION_POLICY } from "./decisions.js";
 import { accountMentionsOver, mentionsStoreOver } from "./mentions.js";
 import { accountMessagesOver, messagesStoreOver } from "./messages.js";
 import { accountPeopleOver, peopleStoreOver } from "./people.js";
@@ -207,6 +208,7 @@ const storeOver = (context) => {
         get memories() {
             return memories();
         },
+        decisionPolicy: context.decisions ?? DEFAULT_DECISION_POLICY,
         get proposedActions() {
             return proposedActions();
         },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-core",
-  "version": "0.546.0",
+  "version": "0.547.0",
   "description": "The messenger-neutral half of a messaging CLI: domain model, message locators, rendering, name resolution, the SQLite seam, the command skeleton and shared read commands, the send guard, run records and the message store",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",