@leemour/max-cli 0.10.0 → 0.11.0

package/dist/sends/guard.js

@@ -1,21 +1,38 @@
+import { randomUUID } from "node:crypto";
 import { CliError } from "@leemour/cli-core";
+import { SendJournal, sendsPathFor, } from "./journal.js";
 import { permissionFor } from "./permissions.js";
+import { RecipientList, recipientsPathFor } from "./recipients.js";
 const HOUR_MS = 60 * 60 * 1000;
 /**
- * What puts a new message in somebody's chat (`NEED-168`). A reaction, an edit, a quiet pin or a
- * change to a chat wakes nobody up; creating a group does — the people in it are told. A deletion
- * wakes nobody either, but many at once is what a ban for automation looks like, so each deleted
- * message counts as one (`MAX-47`).
+ * What puts something in front of somebody (`NEED-168`, widened by `NEED-282`). A message, a
+ * forward, an edit, a pin that notifies, a new group and people added to one all do. A reaction,
+ * a quiet pin or a change of title wakes nobody. A deletion wakes nobody either, but many at once
+ * is what a ban for automation looks like (`MAX-47`).
  */
-const countsTowardLimit = ({ kind = "message", action }) => kind === "message" || kind === "forward" || kind === "delete" || action === "create";
-const weightOf = (entry) => (entry.kind === "delete" ? (entry.count ?? 1) : 1);
+const countsTowardLimit = ({ kind = "message", action, notify }) => kind === "message" ||
+    kind === "forward" ||
+    kind === "edit" ||
+    kind === "delete" ||
+    (kind === "pin" && notify === true) ||
+    action === "create" ||
+    action === "members.add";
+/** Each deleted message, and each person added to a group, counts as one. */
+const weightOf = ({ kind, action, count, people }) => kind === "delete"
+    ? (count ?? 1)
+    : action === "create" || action === "members.add"
+        ? Math.max(1, people ?? count ?? 1)
+        : 1;
+/** A scheduled message counts in the hour MAX sends it. */
+const timeOf = (entry) => Date.parse(entry.scheduledFor ?? entry.at);
 /**
  * These stop a model that was talked into sending by a message it read. They do **not** stop an
  * agent that edits the configuration itself — that needs a boundary outside this process
  * (`docs/security.md`).
  */
-export const sendGuard = ({ profile, readOnly, readOnlyFrom, allow, allowFrom = "default", sendsPerHour, journal, recipients, warn, now = () => new Date(), }) => ({
-    check: (chatId, kind = "message", action, count = 1) => {
+export const sendGuard = ({ profile, readOnly, readOnlyFrom, allow, allowFrom = "default", sendsPerHour, journal, recipients, warn, now = () => new Date(), }) => {
+    let reservation;
+    const permitted = ({ chatId, kind = "message", action, personIds }) => {
         if (readOnly) {
             throw new CliError("permission_error", `profile ${profile} is read-only (readOnly, from the ${readOnlyFrom}) — it cannot send, react, change chats or change the account`);
         }
@@ -30,19 +47,37 @@ export const sendGuard = ({ profile, readOnly, readOnlyFrom, allow, allowFrom =
             throw new CliError("confirmation_required", `chat ${chatId} is not on the recipient list of profile ${profile} — ` +
                 `the owner adds it with \`max ${profile} recipients add ${chatId}\``, { chatId });
         }
-        if (!countsTowardLimit({ kind, action }))
-            return;
+        // Adding somebody to a group writes to them as surely as a message does.
+        const strangers = allowed ? (personIds ?? []).filter((id) => !allowed.some((chat) => chat.partnerId === id)) : [];
+        if (strangers.length > 0) {
+            throw new CliError("confirmation_required", `${strangers.join(", ")} ${strangers.length === 1 ? "is" : "are"} not on the recipient list of profile ${profile} — ` +
+                `the owner adds the one-to-one chat with each person (\`max ${profile} recipients add <chat>\`); ` +
+                "a chat added to the list earlier is added again to be recognised", { personIds: strangers });
+        }
+    };
+    const withinLimit = (request, entries) => {
+        const { chatId, cid } = request;
+        const asked = { ...request, people: request.personIds?.length ?? request.count };
+        const count = weightOf(asked);
         if (count > sendsPerHour) {
             throw new CliError("rate_limited", `${count} at once is more than the hourly limit of profile ${profile} (sendsPerHour ${sendsPerHour}) — ` +
                 "do fewer at a time");
         }
-        const since = now().getTime() - HOUR_MS;
-        const recent = journal
-            .entries()
+        const at = request.scheduledFor ? Date.parse(request.scheduledFor) : now().getTime();
+        const counted = entries
             .filter(countsTowardLimit)
-            .filter((entry) => entry.outcome === "sent" || entry.outcome === "outcome_unknown")
-            .map((entry) => ({ time: Date.parse(entry.at), weight: weightOf(entry) }))
-            .filter(({ time }) => time > since)
+            .filter((entry) => entry.outcome === "sent" || entry.outcome === "outcome_unknown" || entry.outcome === "reserved")
+            .filter((entry) => Math.abs(timeOf(entry) - at) < HOUR_MS);
+        // A retry of a send whose outcome was unknown repeats its `cid` in the same chat, and MAX
+        // delivers one message for both. Only that: a `cid` that was sent, or another chat, is a new send.
+        const unsure = (entry) => entry.outcome === "outcome_unknown";
+        const same = (a, b) => a.cid !== undefined && a.cid === b.cid && a.chatId === b.chatId;
+        const last = [...counted].reverse().find((entry) => same(entry, { chatId, cid }));
+        if (cid !== undefined && last && unsure(last))
+            return false;
+        const recent = counted
+            .filter((entry, index) => !(unsure(entry) && counted.slice(index + 1).some((later) => same(later, entry))))
+            .map((entry) => ({ time: timeOf(entry), weight: weightOf(entry) }))
             .sort((a, b) => a.time - b.time);
         const used = recent.reduce((sum, { weight }) => sum + weight, 0);
         if (used + count > sendsPerHour) {
@@ -55,19 +90,84 @@ export const sendGuard = ({ profile, readOnly, readOnlyFrom, allow, allowFrom =
             });
             const nextMs = (opening?.time ?? 0) + HOUR_MS;
             const next = new Date(nextMs).toISOString();
-            throw new CliError("rate_limited", `profile ${profile} has sent ${used} messages in the last hour, and its limit is ` +
+            throw new CliError("rate_limited", `profile ${profile} has sent ${used} messages in the hour around ${new Date(at).toISOString()}, and its limit is ` +
                 `${sendsPerHour} (sendsPerHour) — the next send is possible at ${next}`, { retryAfterMs: nextMs - now().getTime(), retryAt: next });
         }
-    },
-    // After a send, a failure to write here must not become the command's answer: the message is
-    // already with a person, and an error would invite the caller to send it again.
-    record: (entry) => {
-        try {
-            journal.append({ at: now().toISOString(), profile, ...entry });
-        }
-        catch (error) {
-            warn(`this send is not in the send journal: ${error instanceof Error ? error.message : String(error)}`);
-        }
-    },
+        return true;
+    };
+    return {
+        check: (request, { reserve = true } = {}) => {
+            permitted(request);
+            const asked = { ...request, people: request.personIds?.length ?? request.count };
+            if (!countsTowardLimit(asked))
+                return;
+            if (!reserve) {
+                withinLimit(request, journal.entries());
+                return;
+            }
+            journal.locked(() => {
+                if (!withinLimit(request, journal.entries()))
+                    return;
+                const id = randomUUID();
+                const { chatId, kind, action, cid, scheduledFor, notify } = request;
+                journal.append({
+                    at: now().toISOString(),
+                    profile,
+                    chatId,
+                    outcome: "reserved",
+                    reservation: id,
+                    ...(kind ? { kind } : {}),
+                    ...(action ? { action } : {}),
+                    ...(asked.people === undefined ? {} : kind === "delete" ? { count: asked.people } : { people: asked.people }),
+                    ...(cid === undefined ? {} : { cid }),
+                    ...(scheduledFor ? { scheduledFor } : {}),
+                    ...(notify === undefined ? {} : { notify }),
+                });
+                reservation = id;
+            });
+        },
+        // After a send, a failure to write here must not become the command's answer: the message is
+        // already with a person, and an error would invite the caller to send it again.
+        record: (entry) => {
+            const { personIds: _, ...kept } = entry;
+            const settles = entry.outcome === "refused" ? undefined : reservation;
+            reservation = undefined;
+            try {
+                journal.append({ at: now().toISOString(), profile, ...kept, ...(settles ? { reservation: settles } : {}) });
+            }
+            catch (error) {
+                warn(`this send is not in the send journal: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        },
+    };
+};
+/**
+ * The guard a profile's configuration asks for — the command's, and `max serve`'s for every write
+ * it forwards. Built per request in the server, so `config set readOnly true` needs no restart.
+ */
+export const guardFor = (settings, warn) => sendGuard({
+    profile: settings.profile,
+    readOnly: settings.readOnly,
+    readOnlyFrom: settings.sources.readOnly,
+    ...(settings.allow ? { allow: settings.allow, allowFrom: settings.sources.allow } : {}),
+    sendsPerHour: settings.sendsPerHour,
+    journal: new SendJournal(sendsPathFor(settings.profile)),
+    recipients: new RecipientList(recipientsPathFor(settings.profile)),
+    warn,
 });
+/**
+ * Over `max serve`, the server journals what it forwards, with the outcome it saw; the command
+ * writes only the refusals of its own check, which never reached the server.
+ */
+export const sharedJournal = (guard, wire) => wire
+    ? {
+        // The check comes before the connection, when `journals` cannot tell yet; the server
+        // reserves under its own lock, and a command that falls back to its own socket goes unreserved.
+        check: (request) => guard.check(request, { reserve: false }),
+        record: (entry) => {
+            if (entry.outcome === "refused" || !wire.journals)
+                guard.record(entry);
+        },
+    }
+    : guard;
 //# sourceMappingURL=guard.js.map

package/dist/sends/guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../src/sends/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAG5C,OAAO,EAAmB,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAGjE,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAwB9B;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,EAAE,MAAM,EAA4D,EAAE,EAAE,CACnH,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ,IAAI,MAAM,KAAK,QAAQ,CAAA;AAEtF,MAAM,QAAQ,GAAG,CAAC,KAAgB,EAAU,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAEjG;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,EACxB,OAAO,EACP,QAAQ,EACR,YAAY,EACZ,KAAK,EACL,SAAS,GAAG,SAAS,EACrB,YAAY,EACZ,OAAO,EACP,UAAU,EACV,IAAI,EACJ,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,GACL,EAAa,EAAE,CAAC,CAAC;IAClC,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,GAAG,SAAS,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,EAAE,EAAE;QACrD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,QAAQ,CAChB,kBAAkB,EAClB,WAAW,OAAO,qCAAqC,YAAY,+DAA+D,CACnI,CAAA;QACH,CAAC;QAED,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAC9C,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACzC,MAAM,OAAO,GACX,SAAS,KAAK,iBAAiB,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,OAAO,OAAO,mBAAmB,CAAA;YACzG,MAAM,IAAI,QAAQ,CAChB,kBAAkB,EAClB,WAAW,OAAO,mBAAmB,UAAU,YAAY,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,eAAe,SAAS,KAAK;gBACnH,gBAAgB,OAAO,IAAI,CAAC,GAAG,KAAK,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAC/D,EAAE,UAAU,EAAE,CACf,CAAA;QACH,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAA;QACjC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,QAAQ,CAChB,uBAAuB,EACvB,QAAQ,MAAM,4CAA4C,OAAO,KAAK;gBACpE,gCAAgC,OAAO,mBAAmB,MAAM,IAAI,EACtE,EAAE,MAAM,EAAE,CACX,CAAA;QACH,CAAC;QAED,IAAI,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAAE,OAAM;QAEhD,IAAI,KAAK,GAAG,YAAY,EAAE,CAAC;YACzB,MAAM,IAAI,QAAQ,CAChB,cAAc,EACd,GAAG,KAAK,qDAAqD,OAAO,kBAAkB,YAAY,MAAM;gBACtG,oBAAoB,CACvB,CAAA;QACH,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,OAAO,CAAA;QACvC,MAAM,MAAM,GAAG,OAAO;aACnB,OAAO,EAAE;aACT,MAAM,CAAC,iBAAiB,CAAC;aACzB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,iBAAiB,CAAC;aAClF,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;aACzE,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC;aAClC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAA;QAClC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,GAAG,GAAG,MAAM,EAAE,CAAC,CAAC,CAAA;QAChE,IAAI,IAAI,GAAG,KAAK,GAAG,YAAY,EAAE,CAAC;YAChC,wFAAwF;YACxF,sDAAsD;YACtD,IAAI,KAAK,GAAG,CAAC,CAAA;YACb,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;gBACzC,KAAK,IAAI,MAAM,CAAA;gBACf,OAAO,IAAI,GAAG,KAAK,GAAG,KAAK,IAAI,YAAY,CAAA;YAC7C,CAAC,CAAC,CAAA;YACF,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,CAAC,GAAG,OAAO,CAAA;YAC7C,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAA;YAC3C,MAAM,IAAI,QAAQ,CAChB,cAAc,EACd,WAAW,OAAO,aAAa,IAAI,+CAA+C;gBAChF,GAAG,YAAY,kDAAkD,IAAI,EAAE,EACzE,EAAE,YAAY,EAAE,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAC1D,CAAA;QACH,CAAC;IACH,CAAC;IAED,6FAA6F;IAC7F,gFAAgF;IAChF,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;QAChB,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,yCAAyC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACzG,CAAC;IACH,CAAC;CACF,CAAC,CAAA"}
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../src/sends/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAG5C,OAAO,EAIL,WAAW,EAEX,YAAY,GACb,MAAM,cAAc,CAAA;AACrB,OAAO,EAAmB,aAAa,EAAE,MAAM,kBAAkB,CAAA;AACjE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAElE,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AA2C9B;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,EAAW,EAAE,EAAE,CAC1E,IAAI,KAAK,SAAS;IAClB,IAAI,KAAK,SAAS;IAClB,IAAI,KAAK,MAAM;IACf,IAAI,KAAK,QAAQ;IACjB,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,KAAK,IAAI,CAAC;IACnC,MAAM,KAAK,QAAQ;IACnB,MAAM,KAAK,aAAa,CAAA;AAE1B,6EAA6E;AAC7E,MAAM,QAAQ,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAW,EAAU,EAAE,CACpE,IAAI,KAAK,QAAQ;IACf,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACd,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,aAAa;QAC/C,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC,CAAA;AAET,2DAA2D;AAC3D,MAAM,MAAM,GAAG,CAAC,KAA6C,EAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,EAAE,CAAC,CAAA;AAEpH;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,EACxB,OAAO,EACP,QAAQ,EACR,YAAY,EACZ,KAAK,EACL,SAAS,GAAG,SAAS,EACrB,YAAY,EACZ,OAAO,EACP,UAAU,EACV,IAAI,EACJ,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,GACL,EAAa,EAAE;IAChC,IAAI,WAA+B,CAAA;IAEnC,MAAM,SAAS,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,GAAG,SAAS,EAAE,MAAM,EAAE,SAAS,EAAgB,EAAE,EAAE;QAClF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,QAAQ,CAChB,kBAAkB,EAClB,WAAW,OAAO,qCAAqC,YAAY,+DAA+D,CACnI,CAAA;QACH,CAAC;QAED,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAC9C,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACzC,MAAM,OAAO,GACX,SAAS,KAAK,iBAAiB,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,OAAO,OAAO,mBAAmB,CAAA;YACzG,MAAM,IAAI,QAAQ,CAChB,kBAAkB,EAClB,WAAW,OAAO,mBAAmB,UAAU,YAAY,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,eAAe,SAAS,KAAK;gBACnH,gBAAgB,OAAO,IAAI,CAAC,GAAG,KAAK,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAC/D,EAAE,UAAU,EAAE,CACf,CAAA;QACH,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAA;QACjC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,QAAQ,CAChB,uBAAuB,EACvB,QAAQ,MAAM,4CAA4C,OAAO,KAAK;gBACpE,gCAAgC,OAAO,mBAAmB,MAAM,IAAI,EACtE,EAAE,MAAM,EAAE,CACX,CAAA;QACH,CAAC;QACD,yEAAyE;QACzE,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QACjH,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,QAAQ,CAChB,uBAAuB,EACvB,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,yCAAyC,OAAO,KAAK;gBACnH,8DAA8D,OAAO,6BAA6B;gBAClG,kEAAkE,EACpE,EAAE,SAAS,EAAE,SAAS,EAAE,CACzB,CAAA;QACH,CAAC;IACH,CAAC,CAAA;IAED,MAAM,WAAW,GAAG,CAAC,OAAqB,EAAE,OAAoB,EAAE,EAAE;QAClE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;QAC/B,MAAM,KAAK,GAAG,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,IAAI,OAAO,CAAC,KAAK,EAAE,CAAA;QAChF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC7B,IAAI,KAAK,GAAG,YAAY,EAAE,CAAC;YACzB,MAAM,IAAI,QAAQ,CAChB,cAAc,EACd,GAAG,KAAK,qDAAqD,OAAO,kBAAkB,YAAY,MAAM;gBACtG,oBAAoB,CACvB,CAAA;QACH,CAAC;QAED,MAAM,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAA;QACpF,MAAM,OAAO,GAAG,OAAO;aACpB,MAAM,CAAC,iBAAiB,CAAC;aACzB,MAAM,CACL,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,iBAAiB,IAAI,KAAK,CAAC,OAAO,KAAK,UAAU,CAC3G;aACA,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,OAAO,CAAC,CAAA;QAC5D,0FAA0F;QAC1F,mGAAmG;QACnG,MAAM,MAAM,GAAG,CAAC,KAAgB,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,iBAAiB,CAAA;QACxE,MAAM,IAAI,GAAG,CAAC,CAAY,EAAE,CAAsC,EAAE,EAAE,CACpE,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAA;QACjE,MAAM,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;QACjF,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QAC3D,MAAM,MAAM,GAAG,OAAO;aACnB,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;aAC1G,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;aAClE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAA;QAClC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,GAAG,GAAG,MAAM,EAAE,CAAC,CAAC,CAAA;QAChE,IAAI,IAAI,GAAG,KAAK,GAAG,YAAY,EAAE,CAAC;YAChC,wFAAwF;YACxF,sDAAsD;YACtD,IAAI,KAAK,GAAG,CAAC,CAAA;YACb,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;gBACzC,KAAK,IAAI,MAAM,CAAA;gBACf,OAAO,IAAI,GAAG,KAAK,GAAG,KAAK,IAAI,YAAY,CAAA;YAC7C,CAAC,CAAC,CAAA;YACF,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,CAAC,GAAG,OAAO,CAAA;YAC7C,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAA;YAC3C,MAAM,IAAI,QAAQ,CAChB,cAAc,EACd,WAAW,OAAO,aAAa,IAAI,gCAAgC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,qBAAqB;gBAChH,GAAG,YAAY,kDAAkD,IAAI,EAAE,EACzE,EAAE,YAAY,EAAE,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAC1D,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED,OAAO;QACL,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,OAAO,GAAG,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;YAC1C,SAAS,CAAC,OAAO,CAAC,CAAA;YAClB,MAAM,KAAK,GAAG,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,IAAI,OAAO,CAAC,KAAK,EAAE,CAAA;YAChF,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;gBAAE,OAAM;YACrC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;gBACvC,OAAM;YACR,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE;gBAClB,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;oBAAE,OAAM;gBACpD,MAAM,EAAE,GAAG,UAAU,EAAE,CAAA;gBACvB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;gBACnE,OAAO,CAAC,MAAM,CAAC;oBACb,EAAE,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE;oBACvB,OAAO;oBACP,MAAM;oBACN,OAAO,EAAE,UAAU;oBACnB,WAAW,EAAE,EAAE;oBACf,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7B,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;oBAC7G,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;oBACrC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;iBAC5C,CAAC,CAAA;gBACF,WAAW,GAAG,EAAE,CAAA;YAClB,CAAC,CAAC,CAAA;QACJ,CAAC;QAED,6FAA6F;QAC7F,gFAAgF;QAChF,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAChB,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,KAA4C,CAAA;YAC9E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAA;YACrE,WAAW,GAAG,SAAS,CAAA;YACvB,IAAI,CAAC;gBACH,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;YAC7G,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,yCAAyC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YACzG,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,QAAkB,EAAE,IAA+B,EAAa,EAAE,CACzF,SAAS,CAAC;IACR,OAAO,EAAE,QAAQ,CAAC,OAAO;IACzB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;IAC3B,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ;IACvC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvF,YAAY,EAAE,QAAQ,CAAC,YAAY;IACnC,OAAO,EAAE,IAAI,WAAW,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACxD,UAAU,EAAE,IAAI,aAAa,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClE,IAAI;CACL,CAAC,CAAA;AAEJ;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAgB,EAAE,IAAgD,EAAa,EAAE,CAC7G,IAAI;IACF,CAAC,CAAC;QACE,qFAAqF;QACrF,gGAAgG;QAChG,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5D,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAChB,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACxE,CAAC;KACF;IACH,CAAC,CAAC,KAAK,CAAA"}

package/dist/sends/journal.d.ts

@@ -1,5 +1,6 @@
 import type { Id } from "../domain/models.js";
-export type SendOutcome = "sent" | "outcome_unknown" | "refused" | "failed";
+/** `reserved` holds a place under the hourly limit while the write is on its way; its outcome follows. */
+export type SendOutcome = "sent" | "outcome_unknown" | "refused" | "failed" | "reserved";
 /** Absent in the journal means a message: that is every line written before reactions were guarded. */
 export type SendKind = "message" | "reaction" | "edit" | "forward" | "pin" | "read" | "delete" | "chat" | "account";
 /** What a `chat` entry did. Never a title, a description or a link — only which action. */
@@ -28,8 +29,12 @@ export interface SendEntry {
         kind: "photo" | "file";
         bytes: number;
     }[];
-    /** When MAX will send it; the entry is written when it was queued, and the guard counted it then. */
+    /** When MAX will send it; it counts toward the limit of that hour, not of the hour it was queued. */
     scheduledFor?: string;
+    /** Whether a pin told the members. */
+    notify?: boolean;
+    /** Pairs an outcome with the `reserved` line it settles. */
+    reservation?: string;
     errorCode?: string;
 }
 /**
@@ -38,10 +43,19 @@ export interface SendEntry {
  */
 export declare const sendsPathFor: (profile: string, env?: NodeJS.ProcessEnv) => string;
 export declare class SendJournal {
+    #private;
     readonly path: string;
     constructor(path: string);
+    /**
+     * Runs `body` with the journal to itself, across processes: two sends at the limit must not both
+     * read "one left". A lock file opened with `wx`, because `flock` is not there on Windows.
+     */
+    locked<T>(body: () => T): T;
     append(entry: SendEntry): void;
-    /** Oldest first. A line that does not parse is skipped: a torn last write must not block sending. */
+    /**
+     * Oldest first, each reservation folded into its outcome; one with no outcome yet is in flight,
+     * or its process died. A line that does not parse is skipped: a torn last write must not block sending.
+     */
     entries(): SendEntry[];
 }
 //# sourceMappingURL=journal.d.ts.map

package/dist/sends/journal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"journal.d.ts","sourceRoot":"","sources":["../../src/sends/journal.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAA;AAE7C,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,iBAAiB,GAAG,SAAS,GAAG,QAAQ,CAAA;AAE3E,uGAAuG;AACvG,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAA;AAEnH,2FAA2F;AAC3F,MAAM,MAAM,UAAU,GAClB,QAAQ,GACR,MAAM,GACN,OAAO,GACP,aAAa,GACb,gBAAgB,GAChB,YAAY,GACZ,eAAe,GACf,QAAQ,GACR,UAAU,GACV,iBAAiB,GACjB,kBAAkB,GAClB,YAAY,CAAA;AAEhB,oGAAoG;AACpG,MAAM,MAAM,aAAa,GACrB,aAAa,GACb,gBAAgB,GAChB,gBAAgB,GAChB,SAAS,GACT,eAAe,GACf,eAAe,GACf,eAAe,GACf,cAAc,CAAA;AAElB,iEAAiE;AACjE,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,oHAAoH;IACpH,MAAM,EAAE,EAAE,GAAG,IAAI,CAAA;IACjB,OAAO,EAAE,WAAW,CAAA;IACpB,IAAI,CAAC,EAAE,QAAQ,CAAA;IACf,MAAM,CAAC,EAAE,UAAU,GAAG,aAAa,CAAA;IACnC,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,EAAE,CAAA;IACd,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,+DAA+D;IAC/D,WAAW,CAAC,EAAE;QAAE,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IACzD,qGAAqG;IACrG,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;GAGG;AACH,eAAO,MAAM,YAAY,YAAa,MAAM,QAAO,MAAM,CAAC,UAAU,KAAiB,MACc,CAAA;AAEnG,qBAAa,WAAW;IACV,QAAQ,CAAC,IAAI,EAAE,MAAM;IAAjC,YAAqB,IAAI,EAAE,MAAM,EAAI;IAErC,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI,CAG7B;IAED,qGAAqG;IACrG,OAAO,IAAI,SAAS,EAAE,CAiBrB;CACF"}
+{"version":3,"file":"journal.d.ts","sourceRoot":"","sources":["../../src/sends/journal.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAA;AAE7C,0GAA0G;AAC1G,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,iBAAiB,GAAG,SAAS,GAAG,QAAQ,GAAG,UAAU,CAAA;AAExF,uGAAuG;AACvG,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAA;AAEnH,2FAA2F;AAC3F,MAAM,MAAM,UAAU,GAClB,QAAQ,GACR,MAAM,GACN,OAAO,GACP,aAAa,GACb,gBAAgB,GAChB,YAAY,GACZ,eAAe,GACf,QAAQ,GACR,UAAU,GACV,iBAAiB,GACjB,kBAAkB,GAClB,YAAY,CAAA;AAEhB,oGAAoG;AACpG,MAAM,MAAM,aAAa,GACrB,aAAa,GACb,gBAAgB,GAChB,gBAAgB,GAChB,SAAS,GACT,eAAe,GACf,eAAe,GACf,eAAe,GACf,cAAc,CAAA;AAElB,iEAAiE;AACjE,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,oHAAoH;IACpH,MAAM,EAAE,EAAE,GAAG,IAAI,CAAA;IACjB,OAAO,EAAE,WAAW,CAAA;IACpB,IAAI,CAAC,EAAE,QAAQ,CAAA;IACf,MAAM,CAAC,EAAE,UAAU,GAAG,aAAa,CAAA;IACnC,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,EAAE,CAAA;IACd,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,+DAA+D;IAC/D,WAAW,CAAC,EAAE;QAAE,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IACzD,qGAAqG;IACrG,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,sCAAsC;IACtC,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,4DAA4D;IAC5D,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;GAGG;AACH,eAAO,MAAM,YAAY,YAAa,MAAM,QAAO,MAAM,CAAC,UAAU,KAAiB,MACc,CAAA;AAOnG,qBAAa,WAAW;;IACV,QAAQ,CAAC,IAAI,EAAE,MAAM;IAAjC,YAAqB,IAAI,EAAE,MAAM,EAAI;IAErC;;;OAGG;IACH,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CA4B1B;IAED,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI,CAG7B;IAED;;;OAGG;IACH,OAAO,IAAI,SAAS,EAAE,CAMrB;CAoBF"}

package/dist/sends/journal.js

@@ -1,4 +1,4 @@
-import { appendFileSync, mkdirSync, readFileSync } from "node:fs";
+import { appendFileSync, closeSync, mkdirSync, openSync, readFileSync, statSync, unlinkSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { resolvePaths } from "@leemour/cli-core";
 /**
@@ -6,17 +6,69 @@ import { resolvePaths } from "@leemour/cli-core";
  * `max cache clear` cannot erase what was sent in the owner's name (the reason of `NEED-51`).
  */
 export const sendsPathFor = (profile, env = process.env) => join(resolvePaths({ appName: "max-cli", prefix: "MAX", env }).state, "sends", `${profile}.jsonl`);
+const LOCK_WAIT_MS = 5_000;
+/** Longer than any check and append takes; a lock this old was left by a process that died holding it. */
+const LOCK_STALE_MS = 30_000;
+const pause = new Int32Array(new SharedArrayBuffer(4));
 export class SendJournal {
     path;
     constructor(path) {
         this.path = path;
     }
+    /**
+     * Runs `body` with the journal to itself, across processes: two sends at the limit must not both
+     * read "one left". A lock file opened with `wx`, because `flock` is not there on Windows.
+     */
+    locked(body) {
+        mkdirSync(dirname(this.path), { recursive: true, mode: 0o700 });
+        const lock = `${this.path}.lock`;
+        const deadline = Date.now() + LOCK_WAIT_MS;
+        for (;;) {
+            try {
+                closeSync(openSync(lock, "wx", 0o600));
+                break;
+            }
+            catch (error) {
+                if (error.code !== "EEXIST")
+                    throw error;
+                if (Date.now() - lockTime(lock) > LOCK_STALE_MS) {
+                    try {
+                        unlinkSync(lock);
+                    }
+                    catch { }
+                    continue;
+                }
+                if (Date.now() > deadline)
+                    throw new Error(`the send journal stayed locked for ${LOCK_WAIT_MS / 1000}s (${lock})`);
+                Atomics.wait(pause, 0, 0, 20);
+            }
+        }
+        try {
+            return body();
+        }
+        finally {
+            try {
+                unlinkSync(lock);
+            }
+            catch { }
+        }
+    }
     append(entry) {
         mkdirSync(dirname(this.path), { recursive: true, mode: 0o700 });
         appendFileSync(this.path, `${JSON.stringify(entry)}\n`, { mode: 0o600 });
     }
-    /** Oldest first. A line that does not parse is skipped: a torn last write must not block sending. */
+    /**
+     * Oldest first, each reservation folded into its outcome; one with no outcome yet is in flight,
+     * or its process died. A line that does not parse is skipped: a torn last write must not block sending.
+     */
     entries() {
+        const lines = this.#lines();
+        const settled = new Set(lines.filter((entry) => entry.outcome !== "reserved").map((entry) => entry.reservation));
+        return lines
+            .filter((entry) => entry.outcome !== "reserved" || !settled.has(entry.reservation))
+            .map(({ reservation, ...entry }) => (entry.outcome === "reserved" ? { ...entry, reservation } : entry));
+    }
+    #lines() {
         let text;
         try {
             text = readFileSync(this.path, "utf8");
@@ -37,4 +89,12 @@ export class SendJournal {
         });
     }
 }
+const lockTime = (lock) => {
+    try {
+        return statSync(lock).mtimeMs;
+    }
+    catch {
+        return Date.now();
+    }
+};
 //# sourceMappingURL=journal.js.map

package/dist/sends/journal.js.map

@@ -1 +1 @@
-{"version":3,"file":"journal.js","sourceRoot":"","sources":["../../src/sends/journal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACjE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AA0DhD;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAe,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG,EAAU,EAAE,CAC5F,IAAI,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,QAAQ,CAAC,CAAA;AAEnG,MAAM,OAAO,WAAW;IACD,IAAI;IAAzB,YAAqB,IAAY;oBAAZ,IAAI;IAAW,CAAC;IAErC,MAAM,CAAC,KAAgB;QACrB,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC/D,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1E,CAAC;IAED,qGAAqG;IACrG,OAAO;QACL,IAAI,IAAY,CAAA;QAChB,IAAI,CAAC;YACH,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAA;QACX,CAAC;QACD,OAAO,IAAI;aACR,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;aACpC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YAChB,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAc,CAAC,CAAA;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,CAAA;YACX,CAAC;QACH,CAAC,CAAC,CAAA;IACN,CAAC;CACF"}
+{"version":3,"file":"journal.js","sourceRoot":"","sources":["../../src/sends/journal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAC5G,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AA+DhD;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAe,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG,EAAU,EAAE,CAC5F,IAAI,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,QAAQ,CAAC,CAAA;AAEnG,MAAM,YAAY,GAAG,KAAK,CAAA;AAC1B,0GAA0G;AAC1G,MAAM,aAAa,GAAG,MAAM,CAAA;AAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAA;AAEtD,MAAM,OAAO,WAAW;IACD,IAAI;IAAzB,YAAqB,IAAY;oBAAZ,IAAI;IAAW,CAAC;IAErC;;;OAGG;IACH,MAAM,CAAI,IAAa;QACrB,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC/D,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,OAAO,CAAA;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAA;QAC1C,SAAS,CAAC;YACR,IAAI,CAAC;gBACH,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;gBACtC,MAAK;YACP,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAA;gBACnE,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,aAAa,EAAE,CAAC;oBAChD,IAAI,CAAC;wBACH,UAAU,CAAC,IAAI,CAAC,CAAA;oBAClB,CAAC;oBAAC,MAAM,CAAC,CAAA,CAAC;oBACV,SAAQ;gBACV,CAAC;gBACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;oBACvB,MAAM,IAAI,KAAK,CAAC,sCAAsC,YAAY,GAAG,IAAI,MAAM,IAAI,GAAG,CAAC,CAAA;gBACzF,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAA;YAC/B,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,EAAE,CAAA;QACf,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,CAAA;YAClB,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAgB;QACrB,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC/D,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1E,CAAC;IAED;;;OAGG;IACH,OAAO;QACL,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAA;QAC3B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAA;QAChH,OAAO,KAAK;aACT,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,UAAU,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;aAClF,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;IAC3G,CAAC;IAED,MAAM;QACJ,IAAI,IAAY,CAAA;QAChB,IAAI,CAAC;YACH,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAA;QACX,CAAC;QACD,OAAO,IAAI;aACR,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;aACpC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YAChB,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAc,CAAC,CAAA;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,CAAA;YACX,CAAC;QACH,CAAC,CAAC,CAAA;IACN,CAAC;CACF;AAED,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAU,EAAE;IACxC,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAA;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,GAAG,EAAE,CAAA;IACnB,CAAC;AACH,CAAC,CAAA"}

package/dist/sends/recipients.d.ts

@@ -2,6 +2,8 @@ import type { Id } from "../domain/models.js";
 export interface Recipient {
     id: Id;
     title: string | null;
+    /** The other person, for a one-to-one chat: who may be put in a group when the list is on. */
+    partnerId?: Id;
     addedAt: string;
 }
 /**
@@ -19,7 +21,7 @@ export declare class RecipientList {
     constructor(path: string);
     /** `undefined` when the list is off. A file that cannot be read refuses rather than opening up. */
     read(): Recipient[] | undefined;
-    /** Whether it was new. */
+    /** Whether it was new. Adding one again fills in a partner an older entry was stored without. */
     add(recipient: Recipient): boolean;
     /** The id or the title as it was stored; `undefined` when neither matched. */
     remove(reference: string): Recipient | undefined;

package/dist/sends/recipients.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recipients.d.ts","sourceRoot":"","sources":["../../src/sends/recipients.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAA;AAE7C,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,EAAE,CAAA;IACN,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,YAAa,MAAM,QAAO,MAAM,CAAC,UAAU,KAAiB,MACsB,CAAA;AAEhH;;;GAGG;AACH,qBAAa,aAAa;;IACZ,QAAQ,CAAC,IAAI,EAAE,MAAM;IAAjC,YAAqB,IAAI,EAAE,MAAM,EAAI;IAErC,mGAAmG;IACnG,IAAI,IAAI,SAAS,EAAE,GAAG,SAAS,CAa9B;IAED,0BAA0B;IAC1B,GAAG,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAKjC;IAED,8EAA8E;IAC9E,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAQ/C;IAED,4CAA4C;IAC5C,GAAG,IAAI,OAAO,CAIb;CAKF"}
+{"version":3,"file":"recipients.d.ts","sourceRoot":"","sources":["../../src/sends/recipients.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAA;AAE7C,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,EAAE,CAAA;IACN,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,8FAA8F;IAC9F,SAAS,CAAC,EAAE,EAAE,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,YAAa,MAAM,QAAO,MAAM,CAAC,UAAU,KAAiB,MACsB,CAAA;AAEhH;;;GAGG;AACH,qBAAa,aAAa;;IACZ,QAAQ,CAAC,IAAI,EAAE,MAAM;IAAjC,YAAqB,IAAI,EAAE,MAAM,EAAI;IAErC,mGAAmG;IACnG,IAAI,IAAI,SAAS,EAAE,GAAG,SAAS,CAa9B;IAED,iGAAiG;IACjG,GAAG,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAWjC;IAED,8EAA8E;IAC9E,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAQ/C;IAED,4CAA4C;IAC5C,GAAG,IAAI,OAAO,CAIb;CAKF"}

package/dist/sends/recipients.js

@@ -30,11 +30,16 @@ export class RecipientList {
                 "fix the file or turn the list off with `max recipients off`");
         }
     }
-    /** Whether it was new. */
+    /** Whether it was new. Adding one again fills in a partner an older entry was stored without. */
     add(recipient) {
         const chats = this.read() ?? [];
-        if (chats.some((chat) => chat.id === recipient.id))
+        const known = chats.find((chat) => chat.id === recipient.id);
+        if (known) {
+            if (recipient.partnerId && !known.partnerId) {
+                this.#write(chats.map((chat) => (chat === known ? { ...known, partnerId: recipient.partnerId } : chat)));
+            }
             return false;
+        }
         this.#write([...chats, recipient]);
         return true;
     }

package/dist/sends/recipients.js.map

@@ -1 +1 @@
-{"version":3,"file":"recipients.js","sourceRoot":"","sources":["../../src/sends/recipients.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AASzE;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAAe,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG,EAAU,EAAE,CACjG,IAAI,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,OAAO,kBAAkB,CAAC,CAAA;AAEhH;;;GAGG;AACH,MAAM,OAAO,aAAa;IACH,IAAI;IAAzB,YAAqB,IAAY;oBAAZ,IAAI;IAAW,CAAC;IAErC,mGAAmG;IACnG,IAAI;QACF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAA;QAC5C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAwB,CAAA;YACjF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrE,OAAO,MAAM,CAAC,KAAoB,CAAA;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,QAAQ,CAChB,qBAAqB,EACrB,sBAAsB,IAAI,CAAC,IAAI,oBAAoB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM;gBAC7G,6DAA6D,CAChE,CAAA;QACH,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,GAAG,CAAC,SAAoB;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAA;QAC/B,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAA;QAChE,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,EAAE,SAAS,CAAC,CAAC,CAAA;QAClC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,8EAA8E;IAC9E,MAAM,CAAC,SAAiB;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAA;QAC/B,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,CAAA;QAC/B,MAAM,IAAI,GACR,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC;YACxC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,KAAK,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAA;QACtF,IAAI,IAAI;YAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAA;QAC5D,OAAO,IAAI,CAAA;IACb,CAAC;IAED,4CAA4C;IAC5C,GAAG;QACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QACxC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACjB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,CAAC,KAAkB;QACvB,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAC5E,CAAC;CACF"}
+{"version":3,"file":"recipients.js","sourceRoot":"","sources":["../../src/sends/recipients.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAWzE;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAAe,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG,EAAU,EAAE,CACjG,IAAI,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,OAAO,kBAAkB,CAAC,CAAA;AAEhH;;;GAGG;AACH,MAAM,OAAO,aAAa;IACH,IAAI;IAAzB,YAAqB,IAAY;oBAAZ,IAAI;IAAW,CAAC;IAErC,mGAAmG;IACnG,IAAI;QACF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAA;QAC5C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAwB,CAAA;YACjF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrE,OAAO,MAAM,CAAC,KAAoB,CAAA;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,QAAQ,CAChB,qBAAqB,EACrB,sBAAsB,IAAI,CAAC,IAAI,oBAAoB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM;gBAC7G,6DAA6D,CAChE,CAAA;QACH,CAAC;IACH,CAAC;IAED,iGAAiG;IACjG,GAAG,CAAC,SAAoB;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAA;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,CAAC,CAAA;QAC5D,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,SAAS,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;gBAC5C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC1G,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,EAAE,SAAS,CAAC,CAAC,CAAA;QAClC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,8EAA8E;IAC9E,MAAM,CAAC,SAAiB;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAA;QAC/B,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,CAAA;QAC/B,MAAM,IAAI,GACR,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC;YACxC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,KAAK,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAA;QACtF,IAAI,IAAI;YAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAA;QAC5D,OAAO,IAAI,CAAA;IACb,CAAC;IAED,4CAA4C;IAC5C,GAAG;QACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QACxC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACjB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,CAAC,KAAkB;QACvB,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAC5E,CAAC;CACF"}

package/dist/server/lines.d.ts

@@ -8,6 +8,12 @@
  */
 export declare const toLine: (value: unknown) => string;
 export declare const fromLine: (line: string) => Record<string, unknown>;
-/** Calls `onLine` for each complete line `data` finishes, keeping the rest for next time. */
-export declare const lineReader: (onLine: (line: string) => void) => (data: Buffer | string) => void;
+/**
+ * Calls `onLine` for each complete line `data` finishes, keeping the rest for next time. With
+ * `maxLength`, a line that grows past it calls `onTooLong` instead and nothing more is read.
+ */
+export declare const lineReader: (onLine: (line: string) => void, { maxLength, onTooLong }?: {
+    maxLength?: number;
+    onTooLong?: () => void;
+}) => (data: Buffer | string) => void;
 //# sourceMappingURL=lines.d.ts.map

package/dist/server/lines.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lines.d.ts","sourceRoot":"","sources":["../../src/server/lines.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,eAAO,MAAM,MAAM,UAAW,OAAO,KAAG,MACiE,CAAA;AAEzG,eAAO,MAAM,QAAQ,SAAU,MAAM,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAG/B,CAAA;AAU/B,6FAA6F;AAC7F,eAAO,MAAM,UAAU,WAAY,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,YAEzC,MAAM,GAAG,MAAM,SAU9B,CAAA"}
+{"version":3,"file":"lines.d.ts","sourceRoot":"","sources":["../../src/server/lines.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,eAAO,MAAM,MAAM,UAAW,OAAO,KAAG,MACiE,CAAA;AAEzG,eAAO,MAAM,QAAQ,SAAU,MAAM,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAG/B,CAAA;AAU/B;;;GAGG;AACH,eAAO,MAAM,UAAU,WACb,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,6BACkC;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,IAAI,CAAA;CAAE,YAIhG,MAAM,GAAG,MAAM,SAgB9B,CAAA"}

package/dist/server/lines.js

@@ -16,10 +16,16 @@ const isTagged = (item) => typeof item === "object" &&
     item !== null &&
     Object.keys(item).length === 1 &&
     typeof item[BIGINT] === "string";
-/** Calls `onLine` for each complete line `data` finishes, keeping the rest for next time. */
-export const lineReader = (onLine) => {
+/**
+ * Calls `onLine` for each complete line `data` finishes, keeping the rest for next time. With
+ * `maxLength`, a line that grows past it calls `onTooLong` instead and nothing more is read.
+ */
+export const lineReader = (onLine, { maxLength = Number.POSITIVE_INFINITY, onTooLong = () => { } } = {}) => {
     let buffered = "";
+    let stopped = false;
     return (data) => {
+        if (stopped)
+            return;
         buffered += String(data);
         let end = buffered.indexOf("\n");
         while (end >= 0) {
@@ -29,6 +35,11 @@ export const lineReader = (onLine) => {
                 onLine(line);
             end = buffered.indexOf("\n");
         }
+        if (buffered.length > maxLength) {
+            stopped = true;
+            buffered = "";
+            onTooLong();
+        }
     };
 };
 //# sourceMappingURL=lines.js.map

package/dist/server/lines.js.map

@@ -1 +1 @@
-{"version":3,"file":"lines.js","sourceRoot":"","sources":["../../src/server/lines.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAEzE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,KAAc,EAAU,EAAE,CAC/C,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAA;AAEzG,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAY,EAA2B,EAAE,CAChE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;IACvE,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAC9F,CAA4B,CAAA;AAE/B,MAAM,MAAM,GAAG,SAAS,CAAA;AAExB,MAAM,QAAQ,GAAG,CAAC,IAAa,EAAgC,EAAE,CAC/D,OAAO,IAAI,KAAK,QAAQ;IACxB,IAAI,KAAK,IAAI;IACb,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;IAC9B,OAAQ,IAAgC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAA;AAE/D,6FAA6F;AAC7F,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAA8B,EAAE,EAAE;IAC3D,IAAI,QAAQ,GAAG,EAAE,CAAA;IACjB,OAAO,CAAC,IAAqB,EAAE,EAAE;QAC/B,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,CAAA;QACxB,IAAI,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAChC,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;YACnC,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;YAClC,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAA;YACpC,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"lines.js","sourceRoot":"","sources":["../../src/server/lines.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAEzE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,KAAc,EAAU,EAAE,CAC/C,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAA;AAEzG,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAY,EAA2B,EAAE,CAChE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;IACvE,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAC9F,CAA4B,CAAA;AAE/B,MAAM,MAAM,GAAG,SAAS,CAAA;AAExB,MAAM,QAAQ,GAAG,CAAC,IAAa,EAAgC,EAAE,CAC/D,OAAO,IAAI,KAAK,QAAQ;IACxB,IAAI,KAAK,IAAI;IACb,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;IAC9B,OAAQ,IAAgC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAA;AAE/D;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,MAA8B,EAC9B,EAAE,SAAS,GAAG,MAAM,CAAC,iBAAiB,EAAE,SAAS,GAAG,GAAG,EAAE,GAAE,CAAC,EAAE,GAAmD,EAAE,EACnH,EAAE;IACF,IAAI,QAAQ,GAAG,EAAE,CAAA;IACjB,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,OAAO,CAAC,IAAqB,EAAE,EAAE;QAC/B,IAAI,OAAO;YAAE,OAAM;QACnB,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,CAAA;QACxB,IAAI,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAChC,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;YACnC,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;YAClC,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAA;YACpC,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9B,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;YAChC,OAAO,GAAG,IAAI,CAAA;YACd,QAAQ,GAAG,EAAE,CAAA;YACb,SAAS,EAAE,CAAA;QACb,CAAC;IACH,CAAC,CAAA;AACH,CAAC,CAAA"}

package/dist/server/server-connection.d.ts

@@ -1,13 +1,14 @@
 import { Connection, type Wire, type WireEvent } from "../protocol/connection.js";
 import { type Payload } from "../protocol/frame.js";
 import type { SessionStore } from "../session/store.js";
+import type { Operation } from "../spec/define.js";
 /**
  * **A command's connection: `max serve`'s, shared** (`MAX-35`, `NEED-229`).
  *
  * One connection to MAX per profile, whoever asks — CLI commands, `max mcp`, `max watch`. INIT
  * and LOGIN are answered by the server's own login; **every other request goes over its
- * connection, sends included**. The send guards still apply: they run in the command's client,
- * before the request reaches this wire.
+ * connection, sends included**. The server runs the send guards on every write and journals it;
+ * the command's client checks too, so a refusal comes before an upload, and journals only that.
  *
  * No server answering: `ensure` starts one and waits for it. A connection of the command's own
  * is opened only when there is no `ensure` (the owner said `serve: false`) and no server, or for
@@ -24,15 +25,17 @@ export declare class ServerConnection implements Wire {
         ensure?: () => Promise<boolean>;
     });
     open(): Promise<void>;
+    /** Whether the server is the one answering — and so the one writing the send journal. */
+    get journals(): boolean;
     invoke(opcode: number, payload?: Payload, watch?: (event: WireEvent) => void): Promise<Payload>;
     close(): Promise<void>;
 }
 /**
- * What the server does **not** pass on: logging in is the server's own business, and a login by
- * QR or SMS is `max session start` on a connection of its own. Everything else the specification
- * lets a client send goes through the one connection.
+ * The operation the server passes on for this opcode, or `undefined` for one it does not: logging
+ * in is the server's own business, a login by QR or SMS is `max session start` on a connection of
+ * its own, and a reserved number is never sent at all.
  */
-export declare const forwarded: (opcode: number) => boolean;
+export declare const forwardedOperation: (opcode: number) => Operation | undefined;
 /**
  * Asks a running server to stop. `"refused"` is a server started by hand, which only Ctrl-C
  * stops; `"none"` is nobody listening.

package/dist/server/server-connection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-connection.d.ts","sourceRoot":"","sources":["../../src/server/server-connection.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,UAAU,EAAiB,KAAK,IAAI,EAAE,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAChG,OAAO,EAAQ,KAAK,OAAO,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AASvD;;;;;;;;;;;GAWG;AACH,qBAAa,gBAAiB,YAAW,IAAI;;IAc3C,YAAY,EACV,IAAI,EACJ,KAAK,EACL,SAAkB,EAClB,MAAM,EACN,MAAM,GACP,EAAE;QACD,IAAI,EAAE,MAAM,CAAA;QACZ,KAAK,EAAE,YAAY,CAAA;QACnB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,MAAM,CAAC,EAAE,MAAM,UAAU,CAAA;QACzB,yFAAyF;QACzF,MAAM,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;KAChC,EAMA;IAEK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAG;IAExB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,OAAY,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAqBxG;IA6BK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAS3B;CA+DF;AAED;;;;GAIG;AACH,eAAO,MAAM,SAAS,WAAY,MAAM,KAAG,OAIxC,CAAA;AAEH;;;GAGG;AACH,eAAO,MAAM,UAAU,SAAU,MAAM;;MAA2B,OAAO,CAAC,SAAS,GAAG,SAAS,GAAG,MAAM,CAyBpG,CAAA;AAEJ,mFAAmF;AACnF,eAAO,MAAM,YAAY,SAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAenF,CAAA"}
+{"version":3,"file":"server-connection.d.ts","sourceRoot":"","sources":["../../src/server/server-connection.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,UAAU,EAAiB,KAAK,IAAI,EAAE,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAChG,OAAO,EAAQ,KAAK,OAAO,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AASlD;;;;;;;;;;;GAWG;AACH,qBAAa,gBAAiB,YAAW,IAAI;;IAc3C,YAAY,EACV,IAAI,EACJ,KAAK,EACL,SAAkB,EAClB,MAAM,EACN,MAAM,GACP,EAAE;QACD,IAAI,EAAE,MAAM,CAAA;QACZ,KAAK,EAAE,YAAY,CAAA;QACnB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,MAAM,CAAC,EAAE,MAAM,UAAU,CAAA;QACzB,yFAAyF;QACzF,MAAM,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;KAChC,EAMA;IAEK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAG;IAE9B,yFAAyF;IACzF,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAEK,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,OAAY,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAqBxG;IA6BK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAS3B;CAsEF;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,WAAY,MAAM,KAAG,SAAS,GAAG,SAI7D,CAAA;AAEH;;;GAGG;AACH,eAAO,MAAM,UAAU,SAAU,MAAM;;MAA2B,OAAO,CAAC,SAAS,GAAG,SAAS,GAAG,MAAM,CAyBpG,CAAA;AAEJ,mFAAmF;AACnF,eAAO,MAAM,YAAY,SAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAenF,CAAA"}

package/dist/server/server-connection.js

@@ -1,5 +1,5 @@
 import { connect } from "node:net";
-import { CliError } from "@leemour/cli-core";
+import { CliError, errorCodes } from "@leemour/cli-core";
 import { Opcode } from "../generated/opcodes.generated.js";
 import { OPERATIONS } from "../generated/operations.generated.js";
 import { Connection, ProtocolError } from "../protocol/connection.js";
@@ -10,8 +10,8 @@ import { fromLine, lineReader, toLine } from "./lines.js";
  *
  * One connection to MAX per profile, whoever asks — CLI commands, `max mcp`, `max watch`. INIT
  * and LOGIN are answered by the server's own login; **every other request goes over its
- * connection, sends included**. The send guards still apply: they run in the command's client,
- * before the request reaches this wire.
+ * connection, sends included**. The server runs the send guards on every write and journals it;
+ * the command's client checks too, so a refusal comes before an upload, and journals only that.
  *
  * No server answering: `ensure` starts one and waits for it. A connection of the command's own
  * is opened only when there is no `ensure` (the owner said `serve: false`) and no server, or for
@@ -38,6 +38,10 @@ export class ServerConnection {
         this.#direct = direct ?? (() => new Connection({ timeoutMs }));
     }
     async open() { }
+    /** Whether the server is the one answering — and so the one writing the send journal. */
+    get journals() {
+        return this.#login !== undefined && this.#own === undefined;
+    }
     async invoke(opcode, payload = {}, watch) {
         if (this.#own)
             return this.#own.invoke(opcode, payload, watch);
@@ -116,6 +120,11 @@ export class ServerConnection {
             socket.write(toLine({ id, ...request }));
         });
         const error = answer.error;
+        // The server's send guard: the same refusal, and so the same exit code, as the command's own.
+        if (error?.guard === true) {
+            const code = errorCodes.find((known) => known === error.code) ?? "permission_error";
+            throw new CliError(code, error.message ?? "the server's send guard refused it", error.details);
+        }
         if (error?.code === "refused") {
             throw new ProtocolError(error.message ?? "MAX refused it", Number(request.opcode), error.payload ?? null);
         }
@@ -154,11 +163,11 @@ export class ServerConnection {
     }
 }
 /**
- * What the server does **not** pass on: logging in is the server's own business, and a login by
- * QR or SMS is `max session start` on a connection of its own. Everything else the specification
- * lets a client send goes through the one connection.
+ * The operation the server passes on for this opcode, or `undefined` for one it does not: logging
+ * in is the server's own business, a login by QR or SMS is `max session start` on a connection of
+ * its own, and a reserved number is never sent at all.
  */
-export const forwarded = (opcode) => Object.values(OPERATIONS).some((operation) => operation.opcode === opcode && !operation.name.startsWith("session.") && !operation.name.startsWith("login."));
+export const forwardedOperation = (opcode) => Object.values(OPERATIONS).find((operation) => operation.opcode === opcode && !operation.name.startsWith("session.") && !operation.name.startsWith("login."));
 /**
  * Asks a running server to stop. `"refused"` is a server started by hand, which only Ctrl-C
  * stops; `"none"` is nobody listening.