@wirecat/cli-core 0.558.0 → 0.560.0

package/dist/store/sqlite/mail-findings.js

@@ -0,0 +1,333 @@
+import { CliError } from "@wirecat/cli-base";
+import { contextEvidenceFingerprint } from "../../context/evidence.js";
+import { parseLocator } from "../../domain/locator.js";
+import { MAIL_FINDINGS_PER_SENDER, mailFindingFingerprint, validateMailFindings, } from "../../mail/findings.js";
+import { findingHash } from "../../meetings/index.js";
+import { assertMayDecide } from "../decisions.js";
+import { MAIL_FINDINGS_KIND } from "../mail-findings.js";
+import { findingsAgent, findingsCoreOver } from "./findings-core.js";
+import { authorActor, memoriesStoreOver } from "./memories.js";
+import { insertLink, requiredThing } from "./notes.js";
+import { linkIdentityToPerson } from "./person-links.js";
+import { proposalOperationsOver } from "./proposed-actions.js";
+import { addComment } from "./task-comments.js";
+import { inboxProject } from "./tasks.js";
+import { taskRowOf } from "./things.js";
+import { write } from "./transaction.js";
+import { workTaskOperationsOver } from "./work-tasks.js";
+const stale = () => {
+    throw new CliError("validation_error", "mail findings cite mail that changed since it was read; stage a new batch", {
+        reason: "mail-findings.stale",
+    });
+};
+const invalid = (message, reason) => {
+    throw new CliError("validation_error", message, reason ? { reason } : undefined);
+};
+const TEXT_BUDGET = 262144;
+const EMAIL = `SELECT e.id, e.account_id, e.subject, coalesce(e.body_text, '') AS body,
+    json_extract(e.metadata, '$.partial') IS NOT NULL AS partial, lower(e.from_address) AS sender,
+    coalesce(e.outgoing, lower(e.from_address) = lower(a.external_id)) AS outgoing
+  FROM emails e JOIN email_threads t ON t.id = e.email_thread_id JOIN accounts a ON a.id = e.account_id
+  WHERE a.provider = 'email' AND a.external_id = ? AND t.external_id = ? AND e.external_id = ? AND e.deleted_at IS NULL`;
+export const mailFindingsStoreOver = (context) => {
+    const { database, now } = context;
+    const proposals = proposalOperationsOver(context);
+    const core = findingsCoreOver(context, MAIL_FINDINGS_KIND);
+    const memories = memoriesStoreOver(context);
+    const tasks = workTaskOperationsOver(context);
+    const mailbox = (key) => {
+        if (key?.provider !== "email" || typeof key.account !== "string" || !key.account.trim())
+            return invalid("mail findings belong to one email account");
+        const row = database
+            .prepare("SELECT id FROM accounts WHERE provider = 'email' AND external_id = ?")
+            .get(key.account);
+        if (!row)
+            throw new CliError("not_found", `no mail of ${key.account} is stored`);
+        return Number(row.id);
+    };
+    const load = (id) => {
+        if (typeof id !== "string" || !/^[1-9]\d*$/.test(id) || !Number.isSafeInteger(Number(id)))
+            return invalid("a findings batch needs a stored ID");
+        const row = database
+            .prepare("SELECT length(CAST(payload AS BLOB)) AS bytes, length(CAST(result AS BLOB)) AS result_bytes FROM proposed_actions WHERE id = ? AND kind = ?")
+            .get(Number(id), MAIL_FINDINGS_KIND);
+        if (!row)
+            throw new CliError("not_found", "the mail findings batch is unavailable");
+        if (Number(row.bytes) > 100000 || Number(row.result_bytes) > 65536)
+            return invalid("stored findings exceed the read budget");
+        return proposals.get(id);
+    };
+    const accountOf = (proposal) => mailbox(proposal.account);
+    const view = (proposal) => {
+        const input = proposal.payload;
+        if (!input || !proposal.account || !["proposed", "approved", "rejected"].includes(proposal.status))
+            return invalid("invalid stored findings batch");
+        return {
+            id: proposal.id,
+            account: proposal.account,
+            input: { schemaVersion: 1, key: input.key, extractor: input.extractor, findings: input.findings },
+            fingerprint: findingHash({ input, author: proposal.proposedBy.id }),
+            status: proposal.status === "proposed" ? "proposed" : "reviewed",
+            author: proposal.proposedBy,
+            decidedBy: proposal.decidedBy,
+            decidedAt: proposal.decidedAt,
+            previous: proposal.result
+                ? proposal.result.items
+                : input.findings.flatMap((finding) => {
+                    const held = core.previous(accountOf(proposal), mailFindingFingerprint(finding));
+                    return held ? [{ ...held, id: finding.id, reused: true }] : [];
+                }),
+            receipt: proposal.result,
+        };
+    };
+    /**
+     * Reads each cited email once: it must be stored, whole, and hash to the fingerprint given. Every finding cites
+     * mail of the batch's own mailbox, and no sender other than the owner is behind more than five findings.
+     */
+    const cite = (findings, account) => {
+        const read = new Map();
+        const perSender = new Map();
+        let bytes = 0;
+        for (const finding of findings) {
+            const senders = new Set();
+            let own = false;
+            for (const { reference, fingerprint } of finding.evidence) {
+                let row = read.get(reference);
+                if (!row) {
+                    const at = parseLocator(reference);
+                    row = database.prepare(EMAIL).get(at.account, at.chat, at.message);
+                    if (!row)
+                        return stale();
+                    bytes += Buffer.byteLength(String(row.body)) + Buffer.byteLength(String(row.subject ?? ""));
+                    if (bytes > TEXT_BUDGET)
+                        return invalid(`finding evidence exceeds the ${TEXT_BUDGET}-byte stored text budget`);
+                    if (row.partial)
+                        return invalid(`${reference} is not stored whole yet; cite it once it is`, "mail-findings.partial");
+                    const title = row.subject == null ? null : String(row.subject);
+                    row.fingerprint = contextEvidenceFingerprint({
+                        ref: reference,
+                        title,
+                        text: String(row.body),
+                        revision: null,
+                    });
+                    read.set(reference, row);
+                }
+                if (row.fingerprint !== fingerprint)
+                    return stale();
+                if (Number(row.account_id) === account)
+                    own = true;
+                if (!row.outgoing && row.sender != null)
+                    senders.add(String(row.sender));
+            }
+            if (!own)
+                return invalid(`finding ${finding.id} cites no email of this mailbox`);
+            for (const sender of senders) {
+                const count = (perSender.get(sender) ?? 0) + 1;
+                if (count > MAIL_FINDINGS_PER_SENDER)
+                    return invalid(`more than ${MAIL_FINDINGS_PER_SENDER} findings from ${sender} in one batch`);
+                perSender.set(sender, count);
+            }
+        }
+        return read;
+    };
+    const identityOfAddress = (address) => database
+        .prepare("SELECT i.id, l.person_id FROM identities i LEFT JOIN identity_links l ON l.identity_id = i.id " +
+        "WHERE i.provider = 'email' AND lower(i.external_id) = ?")
+        .get(address.toLowerCase());
+    /** Whatever a finding names must be stored: a task to update, a subject, a link's ends, a contact's address. */
+    const targets = (finding, read) => {
+        const thing = (reference, what) => {
+            if (reference !== undefined)
+                requiredThing(database, reference, what);
+        };
+        switch (finding.kind) {
+            case "task":
+                thing(finding.project, "the project");
+                thing(finding.assignee, "the assignee");
+                return;
+            case "fact":
+            case "memory":
+                thing(finding.subject, "the subject");
+                thing(finding.project, "the project");
+                return;
+            case "task_update":
+                if (taskRowOf(database, finding.task.slice("task:".length)) === undefined)
+                    throw new CliError("not_found", `no task ${finding.task}`);
+                return;
+            case "link":
+                thing(finding.from, "the link's source");
+                thing(finding.to, "the link's target");
+                return;
+            case "new_contact": {
+                const ids = finding.evidence.map(({ reference }) => Number(read.get(reference)?.id));
+                const marks = ids.map(() => "?").join(",");
+                const named = database
+                    .prepare(`SELECT 1 FROM emails WHERE id IN (${marks}) AND lower(from_address) = ? UNION ALL ` +
+                    `SELECT 1 FROM email_recipients WHERE email_id IN (${marks}) AND lower(address) = ? LIMIT 1`)
+                    .get(...ids, finding.address, ...ids, finding.address);
+                if (!named)
+                    return invalid(`${finding.address} neither sent nor received the mail finding ${finding.id} cites`);
+                if (!identityOfAddress(finding.address))
+                    throw new CliError("not_found", `no stored contact ${finding.address}`);
+                return;
+            }
+        }
+    };
+    /** What accepting one finding makes, inside the decision's write; returns the reference of what it made. */
+    const create = (finding, account, agent) => {
+        const evidence = finding.evidence.map((one) => one.reference);
+        switch (finding.kind) {
+            case "fact":
+                return core.create(finding, agent, "owner");
+            case "task": {
+                const project = finding.project ?? `project:${inboxProject(context, `email:${account.account}`, true)}`;
+                return core.create({ ...finding, project }, agent, "owner");
+            }
+            case "task_update": {
+                if (finding.change === "close")
+                    tasks.editNow(finding.task, { status: "done", reason: finding.reason }, "owner");
+                else if (finding.change === "due")
+                    tasks.editNow(finding.task, { dueAt: new Date(finding.dueAt) }, "owner");
+                else {
+                    const row = taskRowOf(database, finding.task.slice("task:".length));
+                    addComment(context, row, `${finding.detail}\n\n${evidence.join("\n")}`, agent);
+                }
+                return finding.task;
+            }
+            case "memory": {
+                const made = memories.addNow({
+                    kind: finding.memoryKind,
+                    body: finding.body,
+                    scope: finding.scope,
+                    evidence,
+                    author: agent,
+                    ...(finding.subject === undefined ? {} : { subject: finding.subject }),
+                    ...(finding.project === undefined ? {} : { project: finding.project }),
+                });
+                return memories.confirmNow(made.ref, "owner").ref;
+            }
+            case "link": {
+                if (finding.from.startsWith("contact:")) {
+                    const identity = requiredThing(database, finding.from, "the contact");
+                    const person = requiredThing(database, finding.to, "the person");
+                    linkIdentityToPerson(context, identity.id, person.id, { method: "mail-finding", by: "owner" });
+                    return finding.to;
+                }
+                const link = insertLink(context, {
+                    from: finding.from,
+                    to: finding.to,
+                    kind: "member-of",
+                    origin: "owner",
+                    evidence: evidence[0],
+                    provenance: `${agent.bot}: ${finding.reason}`,
+                });
+                if (!link.confirmed)
+                    database.prepare("UPDATE links SET confirmed = 1, updated_at = ? WHERE id = ?").run(now(), Number(link.id));
+                return `link:${link.id}`;
+            }
+            case "new_contact": {
+                const person = Number(identityOfAddress(finding.address)?.person_id);
+                database
+                    .prepare("UPDATE persons SET name = ?, updated_at = ? WHERE id = ? AND name IS NULL")
+                    .run(finding.name, now(), person);
+                return `person:${person}`;
+            }
+        }
+    };
+    return {
+        stage: async (key, raw, rawAgent) => {
+            const input = validateMailFindings(raw);
+            const by = findingsAgent(rawAgent);
+            return write(database, () => {
+                const account = mailbox(key);
+                const { actor } = authorActor(context, by);
+                const inputHash = findingHash({ input, model: by.model ?? null });
+                const held = database
+                    .prepare("SELECT id FROM proposed_actions WHERE account_id = ? AND kind = ? AND proposed_by_type = ? AND proposed_by_id = ? AND json_extract(payload, '$.key') = ? ORDER BY id LIMIT 1")
+                    .get(account, MAIL_FINDINGS_KIND, actor.type, actor.id, input.key);
+                if (held) {
+                    const proposal = load(String(held.id));
+                    if (proposal.payload.inputHash !== inputHash)
+                        return invalid("the findings batch key was already used for different input");
+                    return view(proposal);
+                }
+                const read = cite(input.findings, account);
+                for (const finding of input.findings)
+                    targets(finding, read);
+                const fingerprints = input.findings.map(mailFindingFingerprint);
+                if (new Set(fingerprints).size !== fingerprints.length)
+                    return invalid("the batch contains duplicate findings");
+                return view(proposals.propose({
+                    kind: MAIL_FINDINGS_KIND,
+                    by,
+                    account: { provider: "email", account: key.account },
+                    payload: { ...input, inputHash, agentModel: by.model ?? null },
+                }));
+            });
+        },
+        get: async (id) => view(load(id)),
+        list: async ({ account, status, limit = 20, offset = 0 } = {}) => {
+            if (status !== undefined && status !== "proposed" && status !== "reviewed")
+                return invalid("finding status is proposed or reviewed");
+            if (!Number.isSafeInteger(limit) || limit < 1 || limit > 50 || !Number.isSafeInteger(offset) || offset < 0)
+                return invalid("findings lists take 1–50 items and a nonnegative offset");
+            const id = account === undefined ? null : mailbox(account);
+            const rows = database
+                .prepare("SELECT id FROM proposed_actions WHERE kind = ? AND (? IS NULL OR account_id = ?) AND (? IS NULL OR status = ?) " +
+                "ORDER BY id DESC LIMIT ? OFFSET ?")
+                .all(MAIL_FINDINGS_KIND, id, id, status ?? null, status === "reviewed" ? "approved" : (status ?? null), limit + 1, offset);
+            return { items: rows.slice(0, limit).map((row) => view(load(String(row.id)))), hasMore: rows.length > limit };
+        },
+        review: async (id, decision) => write(database, () => {
+            const proposal = load(id);
+            const batch = view(proposal);
+            if (!decision || typeof decision.fingerprint !== "string" || decision.fingerprint !== batch.fingerprint)
+                return stale();
+            if (!Array.isArray(decision.accept) ||
+                decision.accept.length > batch.input.findings.length ||
+                new Set(decision.accept).size !== decision.accept.length ||
+                decision.accept.some((candidate) => !batch.input.findings.some((finding) => finding.id === candidate)))
+                return invalid("accept only unique IDs shown in this batch");
+            if (decision.by === undefined)
+                return invalid("a findings review names who decides: the owner");
+            assertMayDecide({ id, proposedBy: proposals.proposer(id), ownerOnly: true }, decision.by, context.decisions);
+            const accepted = [...decision.accept].sort();
+            if (batch.receipt) {
+                if (JSON.stringify(batch.receipt.accepted) !== JSON.stringify(accepted))
+                    return invalid("this findings batch was already reviewed with a different decision");
+                return batch;
+            }
+            const input = proposal.payload;
+            const account = accountOf(proposal);
+            // Rejecting creates nothing, so a batch whose mail changed can still be closed; accepting needs the
+            // accepted findings' own mail unchanged.
+            const chosen = batch.input.findings.filter((finding) => accepted.includes(finding.id));
+            if (chosen.length)
+                cite(chosen, account);
+            if (proposal.proposedBy.type !== "bot" || !proposal.proposedBy.name)
+                return invalid("a findings author must be an agent");
+            const agent = {
+                bot: proposal.proposedBy.name,
+                ...(input.agentModel === null ? {} : { model: input.agentModel }),
+            };
+            const items = batch.input.findings.map((finding) => {
+                const fingerprint = mailFindingFingerprint(finding);
+                const prior = core.previous(account, fingerprint);
+                if (prior) {
+                    if (accepted.includes(finding.id) && prior.status === "rejected")
+                        return invalid("this unchanged finding was already rejected; changed evidence needs a new candidate");
+                    return { ...prior, id: finding.id, reused: true };
+                }
+                const status = accepted.includes(finding.id) ? "accepted" : "rejected";
+                return {
+                    id: finding.id,
+                    fingerprint,
+                    status,
+                    reference: status === "accepted" ? create(finding, batch.account, agent) : null,
+                    reused: false,
+                };
+            });
+            return view(proposals.approve(id, { previewFingerprint: batch.fingerprint, accepted, items }, "owner"));
+        }),
+    };
+};

package/dist/store/sqlite/manifest.js

@@ -62,6 +62,8 @@ export const MANIFEST = [
     { name: "20261102173102_version-45-finance", version: 45, minCompatible: 34 },
     { name: "20261102173113_version-45-finance-rules", version: 45, minCompatible: 34 },
     { name: "20261102185954_version-46-payment-facts", version: 46, minCompatible: 34 },
+    { name: "20261102192959_version-47-records", version: 47, minCompatible: 34 },
+    { name: "20261102222340_version-48-test-accounts", version: 48, minCompatible: 34 },
 ];
 export const generatedMigrations = (manifest = MANIFEST, generated = GENERATED) => {
     const migrations = [];

package/dist/store/sqlite/memories.d.ts

@@ -141,5 +141,8 @@ export declare const dropLinksOf: (database: StoreContext["database"], thing: {
  * segment still holds the erased words, and the write-ahead log emptied when no reader holds it.
  */
 export declare const erase: <T>(database: StoreContext["database"], work: () => T) => T;
-export declare const memoriesStoreOver: (context: StoreContext) => MemoriesStore;
+export declare const memoriesStoreOver: (context: StoreContext) => MemoriesStore & {
+    addNow(input: MemoryInput): Memory;
+    confirmNow(reference: string, by: Decider): Memory;
+};
 export {};

package/dist/store/sqlite/memories.js

@@ -167,46 +167,54 @@ export const memoriesStoreOver = (context) => {
             .run(...(verified ? [status, at, at, Number(row.id)] : [status, at, Number(row.id)]));
         return memoryOf(rowOf(reference));
     };
-    return {
-        add: async (input) => {
-            const kind = oneOf(input.kind, MEMORY_KINDS, "a memory's kind");
-            if (input.scope === undefined || input.scope === null)
-                throw new CliError("validation_error", "a memory needs its scope — personal or work; there is no default", {
-                    reason: "memory.scope-required",
-                });
-            const scope = oneOf(input.scope, MEMORY_SCOPES, "a memory's scope");
-            if (!Array.isArray(input.evidence) || input.evidence.length === 0)
-                throw new CliError("validation_error", "a memory needs at least one piece of evidence it rests on", {
-                    reason: "memory.evidence-required",
-                });
-            const body = input.body?.trim() ?? "";
-            if (!body || body.length > 20_000)
-                throw new CliError("validation_error", "a memory's body takes 1–20000 characters");
-            if (input.confidence !== undefined && !(input.confidence >= 0 && input.confidence <= 1))
-                throw new CliError("validation_error", "confidence takes 0–1");
-            const status = oneOf(input.status ?? "proposed", ["proposed", "confirmed"], "a new memory's status");
-            if (status === "confirmed" && input.author !== "owner")
-                throw new CliError("permission_error", "an agent's memory waits as proposed; only the owner confirms it", {
-                    reason: "proposal.owner-only",
-                });
-            const id = write(database, () => {
-                const { actor, model } = authorActor(context, input.author);
-                const subject = input.subject === undefined ? undefined : requiredThing(database, input.subject, "the subject");
-                const project = input.project === undefined ? null : projectId(database, input.project);
-                const replaced = input.supersedes === undefined ? undefined : Number(rowOf(input.supersedes).id);
-                const at = now();
-                const made = Number(database
-                    .prepare("INSERT INTO memories (id, kind, body, subject_type, subject_id, author_type, author_id, model, confidence, status, " +
-                    "last_verified_at, supersedes_id, scope, project_id, created_at, updated_at) " +
-                    "VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) RETURNING id")
-                    .get(nextId(database, "memories"), kind, body, subject?.type ?? null, subject?.id ?? null, actor.type, actor.id, model, input.confidence ?? null, status, status === "confirmed" ? at : null, replaced ?? null, scope, project, at, at)?.id);
-                linkEvidence(context, { type: "memory", id: made }, input.evidence, input.author === "owner" ? "owner" : "agent");
-                if (replaced !== undefined)
-                    database.prepare("UPDATE memories SET status = 'superseded', updated_at = ? WHERE id = ?").run(at, replaced);
-                return made;
+    /** `add` inside the caller's write, so a decision that adds a memory rolls back with it. */
+    const addNow = (input) => {
+        const kind = oneOf(input.kind, MEMORY_KINDS, "a memory's kind");
+        if (input.scope === undefined || input.scope === null)
+            throw new CliError("validation_error", "a memory needs its scope — personal or work; there is no default", {
+                reason: "memory.scope-required",
             });
-            return memoryOf(rowOf(`memory:${id}`));
-        },
+        const scope = oneOf(input.scope, MEMORY_SCOPES, "a memory's scope");
+        if (!Array.isArray(input.evidence) || input.evidence.length === 0)
+            throw new CliError("validation_error", "a memory needs at least one piece of evidence it rests on", {
+                reason: "memory.evidence-required",
+            });
+        const body = input.body?.trim() ?? "";
+        if (!body || body.length > 20_000)
+            throw new CliError("validation_error", "a memory's body takes 1–20000 characters");
+        if (input.confidence !== undefined && !(input.confidence >= 0 && input.confidence <= 1))
+            throw new CliError("validation_error", "confidence takes 0–1");
+        const status = oneOf(input.status ?? "proposed", ["proposed", "confirmed"], "a new memory's status");
+        if (status === "confirmed" && input.author !== "owner")
+            throw new CliError("permission_error", "an agent's memory waits as proposed; only the owner confirms it", {
+                reason: "proposal.owner-only",
+            });
+        const id = write(database, () => {
+            const { actor, model } = authorActor(context, input.author);
+            const subject = input.subject === undefined ? undefined : requiredThing(database, input.subject, "the subject");
+            const project = input.project === undefined ? null : projectId(database, input.project);
+            const replaced = input.supersedes === undefined ? undefined : Number(rowOf(input.supersedes).id);
+            const at = now();
+            const made = Number(database
+                .prepare("INSERT INTO memories (id, kind, body, subject_type, subject_id, author_type, author_id, model, confidence, status, " +
+                "last_verified_at, supersedes_id, scope, project_id, created_at, updated_at) " +
+                "VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) RETURNING id")
+                .get(nextId(database, "memories"), kind, body, subject?.type ?? null, subject?.id ?? null, actor.type, actor.id, model, input.confidence ?? null, status, status === "confirmed" ? at : null, replaced ?? null, scope, project, at, at)?.id);
+            linkEvidence(context, { type: "memory", id: made }, input.evidence, input.author === "owner" ? "owner" : "agent");
+            if (replaced !== undefined)
+                database.prepare("UPDATE memories SET status = 'superseded', updated_at = ? WHERE id = ?").run(at, replaced);
+            return made;
+        });
+        return memoryOf(rowOf(`memory:${id}`));
+    };
+    const confirmNow = (reference, by) => {
+        decided(reference, by);
+        return setStatus(reference, "confirmed", true);
+    };
+    return {
+        addNow,
+        confirmNow,
+        add: async (input) => addNow(input),
         get: async (reference) => memoryOf(rowOf(reference)),
         list: async (options = {}) => {
             const subject = options.subject === undefined ? undefined : requiredThing(database, options.subject);
@@ -225,10 +233,7 @@ export const memoriesStoreOver = (context) => {
             database.prepare("UPDATE memories SET project_id = ?, updated_at = ? WHERE id = ?").run(project, now(), id);
             return memoryOf(rowOf(`memory:${id}`));
         }),
-        confirm: async (reference, by) => {
-            decided(reference, by);
-            return setStatus(reference, "confirmed", true);
-        },
+        confirm: async (reference, by) => confirmNow(reference, by),
         markStale: async (reference, by) => {
             decided(reference, by);
             return setStatus(reference, "stale", false);

package/dist/store/sqlite/migrations.generated.js

@@ -932,5 +932,21 @@ export const GENERATED = [
             "CREATE TRIGGER facts_no_payment_bu BEFORE UPDATE OF type ON facts WHEN new.type = 'payment' BEGIN\n  SELECT RAISE(ABORT, 'facts: a payment is a payments row in store.finance, not a fact; upgrade the CLI');\nEND;",
             "INSERT OR REPLACE INTO store_settings (key, value, at) VALUES ('payment_facts_to_move', '1', unixepoch() * 1000);"
         ]
+    },
+    {
+        "name": "20261102192959_version-47-records",
+        "statements": [
+            "CREATE TABLE `record_relations` (\n\t`id` integer PRIMARY KEY,\n\t`record_id` integer NOT NULL,\n\t`role` text NOT NULL,\n\t`target_type` text NOT NULL,\n\t`target_external_id` text NOT NULL,\n\t`target_id` integer,\n\t`created_at` integer NOT NULL,\n\tCONSTRAINT `fk_record_relations_record_id_records_id_fk` FOREIGN KEY (`record_id`) REFERENCES `records`(`id`),\n\tCONSTRAINT `fk_record_relations_target_id_records_id_fk` FOREIGN KEY (`target_id`) REFERENCES `records`(`id`),\n\tCONSTRAINT `record_relations_record_id_role_target_type_target_external_id_unique` UNIQUE(`record_id`,`role`,`target_type`,`target_external_id`)\n);",
+            "CREATE TABLE `records` (\n\t`id` integer PRIMARY KEY,\n\t`account_id` integer NOT NULL,\n\t`type` text NOT NULL,\n\t`external_id` text NOT NULL,\n\t`fields` text NOT NULL,\n\t`revision` integer,\n\t`fingerprint` text NOT NULL,\n\t`entity_type` text,\n\t`entity_id` integer,\n\t`projected_fingerprint` text,\n\t`batch_id` text NOT NULL,\n\t`created_at` integer NOT NULL,\n\t`updated_at` integer NOT NULL,\n\t`deleted_at` integer,\n\tCONSTRAINT `fk_records_account_id_accounts_id_fk` FOREIGN KEY (`account_id`) REFERENCES `accounts`(`id`),\n\tCONSTRAINT `records_account_id_type_external_id_unique` UNIQUE(`account_id`,`type`,`external_id`)\n);",
+            "CREATE INDEX `record_relations_by_target_type_target_external_id` ON `record_relations` (`target_type`,`target_external_id`);",
+            "CREATE INDEX `record_relations_by_target_id` ON `record_relations` (`target_id`);",
+            "CREATE INDEX `records_by_entity_type_entity_id` ON `records` (`entity_type`,`entity_id`);"
+        ]
+    },
+    {
+        "name": "20261102222340_version-48-test-accounts",
+        "statements": [
+            "-- Tests wrote the fake `chat` messenger of src/testing/shared-program.ts into real stores until a test could no longer\n-- open one (#2438). Deleting an account is the store's own purge, in code (every child row, the people only it saw,\n-- the vectors only it held), so the next writable open removes every `chat` account and deletes this key\n-- (purgeTestAccounts). A store without one gets no key, so a test's own `chat` rows written after this stay.\nINSERT OR REPLACE INTO store_settings (key, value, at)\nSELECT 'test_accounts_to_purge', '1', unixepoch() * 1000 WHERE EXISTS (SELECT 1 FROM accounts WHERE provider = 'chat');"
+        ]
     }
 ];

package/dist/store/sqlite/open-store.d.ts

@@ -12,7 +12,7 @@ export interface StoreOptions {
     version?: string;
     /** Where the notice of an upgrade that locks other CLIs out goes; stderr, since stdout may carry JSON or MCP. */
     warn?: (line: string) => void;
-    /** The host's decision policy (its `agent_decisions`); the default lets an agent decide with a reason. */
+    /** The host's decision policy (its `agent_decisions`); off unless the host passes `agentDecisions: true`. */
     decisions?: DecisionPolicy;
 }
 export declare const BACKFILL_ON_OPEN = 5000;

package/dist/store/sqlite/open-store.js

@@ -4,7 +4,7 @@ import { CliError } from "@wirecat/cli-base";
 import { DEFAULT_DECISION_POLICY } from "../decisions.js";
 import { migrate } from "../migrations.js";
 import { storeCapable } from "../open.js";
-import { storePath } from "../path.js";
+import { refuseOwnerStoreInTests, storePath } from "../path.js";
 import { sharedConfigPath } from "../shared-config.js";
 import { backfillNormalized, pendingNormalization } from "./backfill.js";
 import { fillFiles } from "./files.js";
@@ -18,6 +18,7 @@ import { assertReadCompatible } from "./read-compatibility.js";
 import { stemsState } from "./stems.js";
 import { fillStems, followDefaultStemmers } from "./stems-fill.js";
 import { moveSuggestedLinks } from "./suggested-links.js";
+import { purgeTestAccounts } from "./test-accounts.js";
 import { fillVectorIndexes } from "./vector-index.js";
 export const BACKFILL_ON_OPEN = 5_000;
 const NOT_WRITABLE = new Set(["EACCES", "EPERM", "EROFS"]);
@@ -39,6 +40,7 @@ export const openStoreContext = async ({ path, env, now = Date.now, command, ver
         throw new CliError("validation_error", "readOnly must be a boolean");
     await storeCapable();
     const file = path ?? storePath(env);
+    refuseOwnerStoreInTests(file);
     if (readOnly) {
         if (!statSync(file, { throwIfNoEntry: false })?.isFile())
             throw new CliError("not_found", "The store does not exist as a file; read-only opening does not create it");
@@ -59,6 +61,7 @@ export const openStoreContext = async ({ path, env, now = Date.now, command, ver
             fillJoinKeys(database);
             moveSuggestedLinks(database, now);
             movePaymentFacts({ ...opened, now, decisions });
+            purgeTestAccounts({ ...opened, now, decisions }, warn);
             const pending = pendingNormalization(database);
             if (pending > 0 && pending <= BACKFILL_ON_OPEN)
                 backfillNormalized(database);

package/dist/store/sqlite/open.js

@@ -1,5 +1,5 @@
-// biome-ignore-all lint/plugin/no-sqlite-driver: cli-core owns the store, so it opens the driver itself
 import { PRAGMAS } from "../driver.js";
+import { refuseOwnerStoreInTests } from "../path.js";
 import { quietSqliteWarning } from "../sqlite-warning.js";
 /**
  * One SQLite connection, seen two ways: the `CacheDatabase` seam the hand-written SQL and the
@@ -8,6 +8,7 @@ import { quietSqliteWarning } from "../sqlite-warning.js";
  * `../open.ts` for why a static import breaks the other runtime.
  */
 export const openSqlite = async (path, { readOnly = false } = {}) => {
+    refuseOwnerStoreInTests(path);
     const opened = "Bun" in globalThis ? await openUnderBun(path, readOnly) : await openUnderNode(path, readOnly);
     try {
         opened.database.exec(readOnly ? "PRAGMA busy_timeout=5000; PRAGMA foreign_keys=ON; PRAGMA query_only=ON" : PRAGMAS);

package/dist/store/sqlite/proposed-actions.js

@@ -2,6 +2,7 @@ import { CliError } from "@wirecat/cli-base";
 import { MEETING_FINDINGS_KIND } from "../../meetings/index.js";
 import { assertMayDecide, deciderAuthor } from "../decisions.js";
 import { EVIDENCE_FINDINGS_KIND } from "../evidence-findings.js";
+import { MAIL_FINDINGS_KIND } from "../mail-findings.js";
 import { proposedBySql } from "./actors.js";
 import { authorActor } from "./memories.js";
 import { requiredThing } from "./notes.js";
@@ -15,7 +16,7 @@ const json = (value) => (value == null ? null : JSON.parse(String(value)));
  * A findings batch closed with nothing accepted is stored `approved`, as older builds read it; it reads as
  * `rejected`, the decision the owner made.
  */
-const STATUS = `CASE WHEN p.status = 'approved' AND p.kind IN ('${MEETING_FINDINGS_KIND}', '${EVIDENCE_FINDINGS_KIND}') ` +
+const STATUS = `CASE WHEN p.status = 'approved' AND p.kind IN ('${MEETING_FINDINGS_KIND}', '${EVIDENCE_FINDINGS_KIND}', '${MAIL_FINDINGS_KIND}') ` +
     "AND json_array_length(p.result, '$.accepted') = 0 THEN 'rejected' ELSE p.status END";
 const NAMED = `SELECT p.*, ${STATUS} AS shown_status, b.name AS proposer_name, b.kind AS proposer_kind FROM proposed_actions p ` +
     "LEFT JOIN bots b ON p.proposed_by_type = 'bot' AND b.id = p.proposed_by_id";

package/dist/store/sqlite/records.d.ts

@@ -0,0 +1,81 @@
+import { type EnvelopeRecord, type EnvelopeSource, type IngestError } from "../../domain/records.js";
+import type { Author } from "./memories.js";
+import type { StoreContext } from "./open.js";
+export interface RecordKey {
+    provider: string;
+    account: string;
+    type: string;
+    externalId: string;
+}
+export interface SourceRecord extends RecordKey {
+    fields: Record<string, unknown>;
+    revision: number | null;
+    fingerprint: string;
+    relations: {
+        role: string;
+        type: string;
+        externalId: string;
+        resolved: boolean;
+    }[];
+    /** The entity made from it or mapped to it by the owner; `null` while it waits or for a type without a table. */
+    entity: string | null;
+    /** The source changed or deleted it after its entity was made: the owner should look at the entity. */
+    flagged: boolean;
+    batchId: string;
+    createdAt: string;
+    updatedAt: string;
+    deletedAt: string | null;
+}
+export interface RecordOutcome {
+    /** The record's place in the envelope's `records`. */
+    index: number;
+    key: string;
+    status: "created" | "updated" | "unchanged" | "deleted" | "refused";
+    error?: IngestError;
+}
+export interface RecordsWritten {
+    outcomes: RecordOutcome[];
+    /** `invoice:` and `payment:` refs this import proposed, also for records of earlier imports it completed. */
+    proposed: string[];
+    /** Kept, with no entity yet: the roles whose target is not imported or has no entity. */
+    waiting: {
+        index: number;
+        key: string;
+        missing: string[];
+    }[];
+    /** Changed or deleted at the source after its entity was made. */
+    flagged: {
+        index: number;
+        key: string;
+        entity: string;
+    }[];
+    /** A record of an earlier import this one completed, whose entity was still refused. */
+    laterErrors: IngestError[];
+}
+export interface RecordStore {
+    /** Writes validated records of one source, per chunk in one transaction; a dry run rolls everything back. */
+    write(source: EnvelopeSource, records: {
+        index: number;
+        record: EnvelopeRecord;
+    }[], options?: {
+        dryRun?: boolean;
+        chunk?: number;
+    }): Promise<RecordsWritten>;
+    get(key: RecordKey): Promise<SourceRecord | undefined>;
+    list(filter: {
+        provider: string;
+        account: string;
+        type?: string;
+        /** Only records whose entity waits for a reference. */
+        waiting?: boolean;
+        flagged?: boolean;
+        /** 1–500, 100 by default. */
+        limit?: number;
+    }): Promise<SourceRecord[]>;
+    /**
+     * The owner says which entity a record is: `person:4` for a payer a sheet names. Never done by name. Records that
+     * waited for it get their entity, as proposals.
+     */
+    map(key: RecordKey, entity: string, by: Author): Promise<SourceRecord>;
+}
+export declare const recordStoreOver: (context: StoreContext) => RecordStore;