@tikoci/centrs 0.1.8 → 0.1.9-next.22

package/src/protocols/adapter.ts

@@ -180,6 +180,16 @@ export interface ProtocolApiResult {
 	data: unknown;
 }
 
+/**
+ * Options for a single `execute`/`apiRequest` call. `onSent` fires once the
+ * command itself is about to leave for the router: after a native or console
+ * login, never during it. A failure before it fired cannot have run the
+ * command (#448).
+ */
+export interface ProtocolSendOptions {
+	onSent?: () => void;
+}
+
 /** Options for incremental native command replies. */
 export interface ProtocolListenOptions {
 	/** Abort the listen (sends `/cancel`); the generator then ends cleanly. */
@@ -237,9 +247,15 @@ export interface ProtocolAdapter {
 	/** Read a menu as an array of records, optionally projected/detailed. */
 	list(path: string, options: RetrieveListOptions): Promise<unknown[]>;
 	/** Run a CLI-shaped command (WP-1c write surface). */
-	execute(request: ProtocolExecuteRequest): Promise<ProtocolExecuteResult>;
+	execute(
+		request: ProtocolExecuteRequest,
+		options?: ProtocolSendOptions,
+	): Promise<ProtocolExecuteResult>;
 	/** Run a normalized structured `api` request (the gh-api passthrough surface). */
-	apiRequest(request: ProtocolApiRequest): Promise<ProtocolApiResult>;
+	apiRequest(
+		request: ProtocolApiRequest,
+		options?: ProtocolSendOptions,
+	): Promise<ProtocolApiResult>;
 	/**
 	 * Incremental native replies to the literal command (the same mapping as
 	 * `apiRequest`; never rewritten into a `listen`). Yields each `!re` and
@@ -341,7 +357,10 @@ class RestAdapter implements ProtocolAdapter {
 
 	async execute(
 		request: ProtocolExecuteRequest,
+		options?: ProtocolSendOptions,
 	): Promise<ProtocolExecuteResult> {
+		// REST has no session to open first: the request is the command.
+		options?.onSent?.();
 		if (request.script !== undefined) {
 			const data = await this.restPost<unknown>("/execute", {
 				script: request.script,
@@ -369,7 +388,11 @@ class RestAdapter implements ProtocolAdapter {
 		return normalizeRestExecute(data);
 	}
 
-	async apiRequest(request: ProtocolApiRequest): Promise<ProtocolApiResult> {
+	async apiRequest(
+		request: ProtocolApiRequest,
+		options?: ProtocolSendOptions,
+	): Promise<ProtocolApiResult> {
+		options?.onSent?.();
 		const base = request.path.replace(/\/$/, "");
 		switch (request.verb) {
 			case "print": {
@@ -765,9 +788,12 @@ class NativeApiAdapter implements ProtocolAdapter {
 
 	async execute(
 		request: ProtocolExecuteRequest,
+		options?: ProtocolSendOptions,
 	): Promise<ProtocolExecuteResult> {
 		if (request.script !== undefined) {
-			return normalizeNativeExecute(await this.executeScript(request.script));
+			return normalizeNativeExecute(
+				await this.executeScript(request.script, options),
+			);
 		}
 		const command: NativeApiCommand = {
 			command: `${request.path.replace(/\/$/, "")}/${request.command}`,
@@ -781,7 +807,7 @@ class NativeApiAdapter implements ProtocolAdapter {
 		if (request.binary) {
 			command.binary = true;
 		}
-		const replies = await this.talk(command);
+		const replies = await this.talk(command, options);
 		return { records: repliesToRecords(replies) };
 	}
 
@@ -794,17 +820,24 @@ class NativeApiAdapter implements ProtocolAdapter {
 	 */
 	private async executeScript(
 		script: string,
+		options?: ProtocolSendOptions,
 	): Promise<Record<string, string>[]> {
-		const replies = await this.talk({
-			command: "/execute",
-			attributes: { script, "as-string": "" },
-		});
+		const replies = await this.talk(
+			{
+				command: "/execute",
+				attributes: { script, "as-string": "" },
+			},
+			options,
+		);
 		return repliesToRecords(replies);
 	}
 
-	async apiRequest(request: ProtocolApiRequest): Promise<ProtocolApiResult> {
+	async apiRequest(
+		request: ProtocolApiRequest,
+		options?: ProtocolSendOptions,
+	): Promise<ProtocolApiResult> {
 		const records = repliesToRecords(
-			await this.talk(nativeCommandFor(request)),
+			await this.talk(nativeCommandFor(request), options),
 		);
 		switch (request.verb) {
 			case "print":
@@ -880,8 +913,13 @@ class NativeApiAdapter implements ProtocolAdapter {
 		return session;
 	}
 
-	private async talk(command: NativeApiCommand): Promise<ApiReply[]> {
+	private async talk(
+		command: NativeApiCommand,
+		options?: ProtocolSendOptions,
+	): Promise<ApiReply[]> {
+		// Connecting logs in lazily; only the sentence after `/login` is the command.
 		const session = await this.connect();
+		options?.onSent?.();
 		return this.withTimeout(session.talk(command));
 	}
 
@@ -982,6 +1020,7 @@ class MacTelnetAdapter implements ProtocolAdapter {
 
 	async execute(
 		request: ProtocolExecuteRequest,
+		options?: ProtocolSendOptions,
 	): Promise<ProtocolExecuteResult> {
 		const cli = request.script;
 		if (cli === undefined) {
@@ -994,6 +1033,7 @@ class MacTelnetAdapter implements ProtocolAdapter {
 			});
 		}
 		const console = await this.open();
+		options?.onSent?.();
 		const { output } = await console.run(cli);
 		return { records: [], ret: output };
 	}
@@ -1134,6 +1174,7 @@ class SshExecAdapter implements ProtocolAdapter {
 
 	async execute(
 		request: ProtocolExecuteRequest,
+		options?: ProtocolSendOptions,
 	): Promise<ProtocolExecuteResult> {
 		const cli = request.script;
 		if (cli === undefined) {
@@ -1145,6 +1186,7 @@ class SshExecAdapter implements ProtocolAdapter {
 					"Report this bug; runCommand must pass the raw command as `script` for ssh.",
 			});
 		}
+		options?.onSent?.();
 		const output = await this.client.exec(cli);
 		return { records: [], ret: output };
 	}

package/src/resolver/cdb.ts

@@ -44,6 +44,11 @@ import {
 	parseDuration,
 	type ResolvedSetting,
 } from "./settings.ts";
+import {
+	assertNoTargetCredentials,
+	assertNoTargetPassword,
+	redactTargetInput,
+} from "./target.ts";
 
 const ENV_CDB_FILE = "CENTRS_CDB_FILE";
 const ENV_CDB_PASSWORD = "CENTRS_CDB_PASSWORD";
@@ -161,6 +166,8 @@ export async function resolveCdb(
 	if (!input.targetInput) {
 		return undefined;
 	}
+	// Before any lookup: a CDB miss echoes the target it was given (#478).
+	assertNoTargetPassword(input.targetInput);
 
 	const settings = resolveDevicesSettings({
 		cdbFile: input.cdbFile,
@@ -225,6 +232,10 @@ export async function resolveCdb(
 			...(defaults ? { defaults } : {}),
 		};
 	} catch (error) {
+		// Preserve registered identities; mask credential-shaped lookup failures.
+		if (redactTargetInput(input.targetInput) !== input.targetInput) {
+			assertNoTargetCredentials(input.targetInput);
+		}
 		if (error instanceof CentrsError && error.code === "cdb/not-found-target") {
 			// A `__default__` record supplies fallback credentials even when the
 			// target has no record of its own. On the CLI/API this fills creds for
@@ -366,7 +377,8 @@ export function resolutionFromEntry(
  * ambiguity path). See `commands/devices/README.md` (Identity model).
  */
 export function identityFromComment(comment: string, target: string): string {
-	return parseCommentKv(comment).lookups.identity ?? target;
+	// The record's target is shown as its handle; never with a password (#478).
+	return parseCommentKv(comment).lookups.identity ?? redactTargetInput(target);
 }
 
 /**

package/src/resolver/index.ts

@@ -97,6 +97,7 @@ export {
 	SUPPORTED_DESCRIPTOR_VERSION,
 } from "./quickchr-provider.ts";
 export {
+	emptyWriteSelectionError,
 	expandSelection,
 	isDefaultRecordTarget,
 	type SelectionExpansion,
@@ -130,10 +131,13 @@ export {
 	toCoreSource,
 } from "./settings.ts";
 export {
+	assertNoTargetCredentials,
+	assertNoTargetPassword,
 	defaultPortForScheme,
 	parseHostCandidate,
 	type ResolvedAuth,
 	type ResolvedTarget,
+	redactTargetInput,
 	resolveAuth,
 	resolveTarget,
 	type TargetResolveInput,

package/src/resolver/selection.ts

@@ -47,6 +47,11 @@ import {
 	matchesNear,
 	type NearPredicate,
 } from "./geo.ts";
+import {
+	assertNoTargetCredentials,
+	assertNoTargetPassword,
+	redactTargetInput,
+} from "./target.ts";
 
 /** One `--where attr=value` device-class clause (exact-match, AND-combined). */
 export interface SelectionWhereClause {
@@ -106,10 +111,36 @@ export interface SelectionExpansion {
 	/** Members ordered by record index; literals appended in positional order. */
 	targets: readonly SelectionMember[];
 	warnings: readonly ResolverWarning[];
-	/** True when nothing matched (an empty/unknown selection is not an error). */
+	/** True when nothing matched (an error only for a write; see {@link emptyWriteSelectionError}). */
 	empty: boolean;
 }
 
+/**
+ * An empty selection for a write-shaped fan-out (#460). A read over it is
+ * `ok: true` with the expansion's warning, so a poller over an occasionally
+ * empty group stays quiet. A write is an error, as RouterOS refuses an empty
+ * CMR selection (`no devices selected`): a misspelled group must not look like
+ * a successful bulk write. The code is the expansion's own empty warning.
+ */
+export function emptyWriteSelectionError(
+	expansion: Pick<SelectionExpansion, "warnings">,
+	action: string,
+): CentrsError {
+	const warning = expansion.warnings.findLast(
+		(w) => w.code === "cdb/empty-group" || w.code === "cdb/empty-selection",
+	);
+	return new CentrsError({
+		code:
+			warning?.code === "cdb/empty-group"
+				? "cdb/empty-group"
+				: "cdb/empty-selection",
+		summary: `${warning?.message ?? "The target selection matched no CDB records."} Nothing ran: a write-shaped ${action} must select at least one router.`,
+		remediation:
+			"Check the selector against `centrs devices list` and `centrs devices groups` (groups and `--where` values match as written), then re-run. A read over the same selection succeeds with a warning instead.",
+		context: { ...warning?.context, write: true },
+	});
+}
+
 /** True when a resolved target is the reserved credential-fallback record. */
 export function isDefaultRecordTarget(target: string): boolean {
 	return target === DEFAULT_RECORD_TARGET;
@@ -249,10 +280,15 @@ export async function expandSelection(
 	const literals: SelectionMember[] = [];
 	const seenLiteral = new Set<string>();
 	for (const positional of selection.positionals) {
+		assertNoTargetPassword(positional);
 		try {
 			const shown = showDevice({ cdb, target: positional });
 			indices.add(shown.data.entry.cdbRecordIndex);
 		} catch (error) {
+			// Preserve registered identities; mask credential-shaped lookup failures.
+			if (redactTargetInput(positional) !== positional) {
+				assertNoTargetCredentials(positional);
+			}
 			if (
 				error instanceof CentrsError &&
 				error.code === "cdb/not-found-target"

package/src/resolver/target.ts

@@ -104,11 +104,12 @@ export function resolveTarget(
 			summary: "No host could be resolved for `retrieve`.",
 			remediation:
 				"Pass a target positional like `centrs retrieve 192.0.2.10 /system/resource --via rest-api` or set `--host` / `CENTRS_HOST`.",
-			context: { targetInput: input.targetInput },
+			context: { targetInput: redactTargetInput(input.targetInput) },
 		});
 	}
 
 	const rawCandidate = hostSetting.value.trim();
+	assertNoTargetCredentials(rawCandidate);
 	const macCandidate = normalizeMac(rawCandidate);
 
 	// L2 transports (mac-telnet) address the device by **MAC** directly — no IP
@@ -127,11 +128,13 @@ export function resolveTarget(
 		if (!mac) {
 			throw new CentrsError({
 				code: "target/mac-required",
-				summary: `mac-telnet needs a MAC address target; got "${input.targetInput ?? cdb?.target ?? rawCandidate}".`,
+				summary: `mac-telnet needs a MAC address target; got "${redactTargetInput(input.targetInput ?? cdb?.target ?? rawCandidate)}".`,
 				remediation:
 					"Pass the device MAC (aa:bb:cc:dd:ee:ff), or pin an IP transport with `--via native-api`/`rest-api` (add `--resolve arp` for a MAC).",
 				context: {
-					target: input.targetInput ?? cdb?.target ?? rawCandidate,
+					target: redactTargetInput(
+						input.targetInput ?? cdb?.target ?? rawCandidate,
+					),
 					via,
 				},
 			});
@@ -178,7 +181,7 @@ export function resolveTarget(
 		const deliveryHost = deliveryHostSetting?.value.trim() || "255.255.255.255";
 		const port = macPortSetting?.value ?? MAC_TELNET_PORT;
 		return {
-			input: input.targetInput,
+			input: redactTargetInput(input.targetInput),
 			host: deliveryHost,
 			mac,
 			port,
@@ -290,7 +293,7 @@ export function resolveTarget(
 	};
 
 	return {
-		input: input.targetInput,
+		input: redactTargetInput(input.targetInput),
 		// WHATWG keeps an IPv6 hostname bracketed; sockets and ssh need the bare
 		// address (`baseUrl` re-brackets it).
 		host: parsedUrl.hostname.replace(/^\[(.*)\]$/, "$1"),
@@ -471,6 +474,91 @@ export function resolveAuth(
 	};
 }
 
+/** An authority with userinfo: `user@host`, `user:pass@host`, with or without a scheme. */
+const URL_USERINFO = /^\s*([a-z][a-z0-9+.-]*:\/\/)?[^/@\s]*@/i;
+/** Leading whitespace and an optional `scheme://`, kept by redaction. */
+const TARGET_PREFIX = /^\s*(?:[a-z][a-z0-9+.-]*:\/\/)?/i;
+
+/**
+ * Where credentials could sit: a `:` before the LAST `@`, or explicit URL
+ * userinfo. Display also masks a percent-encoded colon; lookup validation
+ * allows that ambiguous spelling until CDB lookup has run. Bare `user@host`
+ * remains a CDB identity candidate. Index arithmetic, so a password holding `/`, `?` or
+ * `#` (which ends a URL authority early, CodeRabbit on PR #479) still counts,
+ * and nothing can backtrack (CodeQL js/polynomial-redos).
+ */
+function targetCredentialsSpan(
+	value: string,
+	includeEncodedColon = true,
+): { start: number; at: number } | undefined {
+	const at = value.lastIndexOf("@");
+	if (at < 0) return undefined;
+	const prefix = TARGET_PREFIX.exec(value)?.[0] ?? "";
+	const start = prefix.length;
+	const urlUserinfo = prefix.includes("://") && URL_USERINFO.test(value);
+	const userinfo = value.slice(start, at);
+	return userinfo.includes(":") ||
+		(includeEncodedColon && /%3a/i.test(userinfo)) ||
+		urlUserinfo
+		? { start, at }
+		: undefined;
+}
+
+/**
+ * A target string with any `user:pass@` or explicit URL userinfo replaced by
+ * `***@`, for display (#478).
+ * A target is echoed in `meta.target.input` and in error messages, so the
+ * password part must never reach them, not even when the target is refused.
+ * Everything up to the last `@` goes, so an odd password cannot slip past.
+ * Other targets, including a CDB identity like `rtr@site`, pass unchanged.
+ * An encoded colon is masked conservatively without changing lookup input.
+ */
+export function redactTargetInput(value: string): string;
+export function redactTargetInput(
+	value: string | undefined,
+): string | undefined;
+export function redactTargetInput(
+	value: string | undefined,
+): string | undefined {
+	if (value === undefined) return value;
+	const span = targetCredentialsSpan(value);
+	return span
+		? `${value.slice(0, span.start)}***${value.slice(span.at)}`
+		: value;
+}
+
+function targetCredentialsError(value: string): CentrsError {
+	const target = redactTargetInput(value);
+	return new CentrsError({
+		code: "input/invalid-target",
+		summary: `A target must not carry credentials (\`user[:password]@\`): ${target}`,
+		remediation:
+			"Drop the `user:password@` part and pass the credentials with `--username` and `--password` (or `CENTRS_USERNAME`/`CENTRS_PASSWORD`, or a CDB record); give the target as `host[:port]` or `http(s)://host[:port]`.",
+		context: { target },
+	});
+}
+
+/**
+ * Refuse a target that may hold a password, BEFORE any lookup whose miss would
+ * echo it (#478): `resolveCdb`, the MCP allowlist, the fan-out selection. A
+ * bare `user@host` is left to the lookup; a CDB identity may contain `@`.
+ * Explicit URL userinfo is always refused, including percent-encoded forms.
+ */
+export function assertNoTargetPassword(value: string): void {
+	if (targetCredentialsSpan(value, false)) throw targetCredentialsError(value);
+}
+
+/**
+ * centrs never reads credentials from a target (#478): `user:pass@host` used
+ * to be accepted with its credentials ignored, and echoed the password back.
+ * After lookup, refuse any userinfo in the host to dial, from any source.
+ */
+export function assertNoTargetCredentials(value: string): void {
+	if (targetCredentialsSpan(value) || URL_USERINFO.test(value)) {
+		throw targetCredentialsError(value);
+	}
+}
+
 export function parseHostCandidate(value: string): URL {
 	const hasScheme = /^https?:\/\//i.test(value);
 	// A bare IPv6 literal (`2001:db8::1`) has no port; URL needs it bracketed.
@@ -484,7 +572,7 @@ export function parseHostCandidate(value: string): URL {
 	if (hasScheme && url.pathname !== "/" && url.pathname !== "") {
 		throw new CentrsError({
 			code: "input/invalid-target",
-			summary: `Target URL must not include a path. Received: ${value}`,
+			summary: `Target URL must not include a path. Received: ${redactTargetInput(value)}`,
 			remediation:
 				"Pass only the RouterOS host or base URL, then provide the RouterOS menu path as the second positional argument.",
 		});
@@ -500,12 +588,12 @@ function invalidTargetError(value: string, cause: unknown): CentrsError {
 	const quickchrGuess = /^quickchr:(.+)$/i.exec(value)?.[1];
 	return new CentrsError({
 		code: "input/invalid-target",
-		summary: `Target is not a known device or a valid host: ${value}`,
+		summary: `Target is not a known device or a valid host: ${redactTargetInput(value)}`,
 		remediation:
 			quickchrGuess !== undefined
 				? `Select a quickchr VM with the flag: \`--quickchr ${quickchrGuess}\` (there is no \`quickchr:\` target prefix).`
 				: "Pass a CDB target or identity (see `centrs devices list`), an IP or hostname with optional `:port`, or an `http(s)://host[:port]` base URL.",
-		context: { target: value },
+		context: { target: redactTargetInput(value) },
 		cause,
 	});
 }

package/src/retrieve-fanout.ts

@@ -59,6 +59,7 @@ import {
 	expandSelection,
 	isDefaultRecordTarget,
 	loadEnvFileDefaults,
+	redactTargetInput,
 	type SelectionExpansion,
 	type SelectionMember,
 	type SelectionResolveInput,
@@ -97,6 +98,8 @@ export interface RetrieveFanoutOperationMeta {
 	concurrency: number;
 	summary: FanoutSummary;
 	request: RetrieveRequestSummary;
+	/** Hoisted from the targets when every target used the same login (#461). */
+	auth?: { username?: string; passwordProvided: boolean };
 	selection: RetrieveSelectionSummary;
 }
 
@@ -143,7 +146,7 @@ function summarizeSelection(
 		where: selection.where.map((clause) => `${clause.key}=${clause.value}`),
 		all: selection.all,
 		default: selection.default,
-		positionals: selection.positionals,
+		positionals: selection.positionals.map((value) => redactTargetInput(value)),
 		quickchr: selection.quickchr,
 	};
 }

package/src/retrieve-follow.ts

@@ -28,17 +28,22 @@ import {
 	buildRetrieveErrorEnvelope,
 	buildRetrieveErrorEnvelopeFromResolved,
 	type ResolvedRetrieveRequest,
-	type RetrieveEnvelope,
 	type RetrieveFollowCounts,
+	type RetrieveFollowLine,
 	type RetrieveFollowStopReason,
 	type RetrieveFollowSummary,
 	type RetrieveRequest,
+	type RetrieveStreamLineEnvelope,
 	type RetrieveStreamMeta,
 	type RetrieveSuccessEnvelope,
 	resolveRetrieveRequest,
 	validateRetrieveRead,
 } from "./retrieve.ts";
-import { failedStreamEnvelope, streamEnvelope } from "./retrieve-stream.ts";
+import {
+	failedStreamEnvelope,
+	streamEnvelope,
+	streamLineEnvelope,
+} from "./retrieve-stream.ts";
 
 /** Changes allowed to wait unread before the follow ends (`transport/stream-overflow`). */
 export const FOLLOW_BUFFER_LIMIT = 50_000;
@@ -52,7 +57,8 @@ export interface RetrieveFollowOptions {
 	bufferLimit?: number;
 }
 
-type FollowEvent =
+/** `at`: when the reply arrived (host clock), stamped by `push` in the wire tap. */
+type FollowEvent = { at?: number } & (
 	| { type: "listen"; reply: ProtocolTappedReply; version?: number }
 	| { type: "listen-end" }
 	| { type: "snapshot-row"; row: Record<string, string> }
@@ -65,7 +71,8 @@ type FollowEvent =
 			rows: Map<string, Record<string, string>>;
 	  }
 	| { type: "stop" }
-	| { type: "error"; error: unknown };
+	| { type: "error"; error: unknown }
+);
 
 /**
  * The wire-ordered event queue: every source feeds it from a synchronous
@@ -144,8 +151,8 @@ class FollowQueue {
 type FrameMeta = Extract<RetrieveStreamMeta, { kind: "frame" }>;
 
 /**
- * Follow one menu: yields an optional `notice`, the snapshot frames, `synced`,
- * live frames, then exactly one summary (successful, or an error envelope
+ * Follow one menu: yields `started` (the full meta and any advice), the
+ * snapshot frames, `synced`, live frames, then exactly one summary (successful, or an error envelope
  * carrying the partial counts). Errors before the follow starts (resolution,
  * validation, a non-followable menu, a non-native transport) yield one error
  * envelope without a summary.
@@ -154,7 +161,7 @@ export async function* retrieveFollow(
 	request: RetrieveRequest,
 	env: Record<string, string | undefined> = Bun.env,
 	options: RetrieveFollowOptions = {},
-): AsyncGenerator<RetrieveEnvelope, void, void> {
+): AsyncGenerator<RetrieveFollowLine, void, void> {
 	const followRequest: RetrieveRequest = { ...request, follow: true };
 	let resolved: ResolvedRetrieveRequest;
 	try {
@@ -269,7 +276,7 @@ async function* runFollow(
 	options: RetrieveFollowOptions,
 	startedAt: number,
 	query?: readonly string[],
-): AsyncGenerator<RetrieveEnvelope, void, void> {
+): AsyncGenerator<RetrieveFollowLine, void, void> {
 	const follow = resolved.follow ?? { sweepMs: 0 };
 	const bufferLimit = options.bufferLimit ?? FOLLOW_BUFFER_LIMIT;
 	const counts: RetrieveFollowCounts = {
@@ -322,7 +329,7 @@ async function* runFollow(
 			controller.abort();
 			return;
 		}
-		queue.push(event);
+		queue.push({ ...event, at: Date.now() });
 	};
 	const stop = (reason: RetrieveFollowStopReason): void => {
 		stopReason ??= reason;
@@ -529,14 +536,16 @@ async function* runFollow(
 		id: string,
 		source: FrameMeta["source"],
 		row: Record<string, string> | null,
-	): RetrieveSuccessEnvelope => {
+		at: number | undefined,
+	): RetrieveStreamLineEnvelope => {
 		counts.frames += 1;
 		if (phase === "snapshot") counts.snapshot += 1;
 		else counts.changes += 1;
 		const data = row === null ? null : projectRow(row, resolved.attributes);
-		return streamEnvelope(resolved, validation, data, {
+		return streamLineEnvelope(data, {
 			kind: "frame",
 			index: counts.frames,
+			observedAt: new Date(at ?? Date.now()).toISOString(),
 			phase,
 			change,
 			id,
@@ -547,7 +556,7 @@ async function* runFollow(
 	const applyListen = (
 		event: Extract<FollowEvent, { type: "listen" }>,
 		phase: FrameMeta["phase"],
-	): RetrieveSuccessEnvelope | undefined => {
+	): RetrieveStreamLineEnvelope | undefined => {
 		const { reply } = event;
 		// `!empty` on a listen is the cancel acknowledgement, never a table state.
 		if (reply.type === "empty") return undefined;
@@ -568,10 +577,10 @@ async function* runFollow(
 		if (reply.attributes[".dead"] === "true") {
 			// A `.dead` for an id never reported is a coalesced add+delete.
 			if (!held.delete(id)) return undefined;
-			return frame(phase, "removed", id, "listen", null);
+			return frame(phase, "removed", id, "listen", null, event.at);
 		}
 		held.add(id);
-		return frame(phase, "upsert", id, "listen", reply.attributes);
+		return frame(phase, "upsert", id, "listen", reply.attributes, event.at);
 	};
 	/**
 	 * Between frames of one batch (the A1 replay, a sweep's removals): a stop
@@ -586,15 +595,7 @@ async function* runFollow(
 		follow.count !== undefined && counts.changes >= follow.count;
 
 	try {
-		if (tips.length > 0) {
-			yield streamEnvelope(
-				resolved,
-				validation,
-				null,
-				{ kind: "notice" },
-				tips,
-			);
-		}
+		yield streamEnvelope(resolved, validation, null, { kind: "started" }, tips);
 		loop: for (;;) {
 			const event = await queue.next();
 			switch (event.type) {
@@ -620,7 +621,7 @@ async function* runFollow(
 					const id = event.row[".id"];
 					if (id !== undefined) {
 						held.add(id);
-						yield frame("snapshot", "upsert", id, "print", event.row);
+						yield frame("snapshot", "upsert", id, "print", event.row, event.at);
 					}
 					break;
 				}
@@ -660,9 +661,9 @@ async function* runFollow(
 						const phase = counts.synced ? "live" : "snapshot";
 						if (row) {
 							held.add(id);
-							yield frame(phase, "upsert", id, "membership", row);
+							yield frame(phase, "upsert", id, "membership", row, event.at);
 						} else if (held.delete(id)) {
-							yield frame(phase, "removed", id, "membership", null);
+							yield frame(phase, "removed", id, "membership", null, event.at);
 						}
 						if (counts.synced && countReached()) {
 							stopReason ??= "count-reached";
@@ -688,13 +689,8 @@ async function* runFollow(
 							continue;
 						if (haltRequested()) break loop;
 						held.delete(id);
-						yield frame(
-							"live",
-							"removed",
-							id,
-							query ? "membership" : "sweep",
-							null,
-						);
+						// The sweep found it gone, filtered or not (#462).
+						yield frame("live", "removed", id, "sweep", null, event.at);
 						if (countReached()) {
 							stopReason ??= "count-reached";
 							break loop;