@wirecat/cli-core 0.558.0 → 0.560.0

package/CHANGELOG.md

@@ -7,6 +7,66 @@ shape of this file.
 
 ## Unreleased
 
+## 0.560.0 — 02.11.2026
+
+### Changed — may break callers
+
+- **Agents no longer decide for the owner by default; the owner turns it on.**
+  `DEFAULT_DECISION_POLICY.agentDecisions` is now `false`, so a store opened without `decisions` refuses every agent
+  confirm or reject with `proposals.agent-decisions-off`; before, an agent with a reason could decide facts, memories,
+  links and project findings. A host turns it back on only from the owner's explicit config, `"agent_decisions": true`,
+  passed as `openStore({ decisions: { ...DEFAULT_DECISION_POLICY, agentDecisions: true } })`. Owner-only proposals
+  (mail and meeting findings, task close suggestions) stay refused either way.
+
+### Added
+
+- **A `propose` tier under `<PREFIX>_READ_ONLY`.** `proposesOnly(command)` marks a command that only stages
+  something for the owner or moves its caller's own mark; the lock lets it run only when its path also ends with one
+  of `PROPOSE_COMMANDS` — `messages acknowledge` and `mail findings add` — a closed list. `isStoreChange` applies it,
+  so every host's lock does. `messages acknowledge` moved from `destroysNothing` to this tier.
+- **Mail findings for the owner** (`mail_findings` in `proposed_actions`, no schema change): `store.mailFindings`
+  stages one batch per mailbox and run (`key` `<holder>:<through_id>`), of up to 30 findings — `task`,
+  `task_update` (close, due, detail), `fact`, `memory`, `link` (address → person, person → organization, thread →
+  project) and `new_contact` — each citing 1–8 `msg:email/…` emails by fingerprint, at most five per sender. Changed
+  or partial mail refuses the batch. Only the owner decides one, whatever `agent_decisions` says; the registry kind
+  `mail_findings` is owner-only too (`ProposalKind.ownerOnly`). `parseMailFindingsJson` reads the file;
+  the `mail_findings` entity describes it.
+- **Mail `review` items carry what a pipeline cites and checks:** each email's evidence `fingerprint`, `new_sender`
+  (no earlier stored email from the address) and `sender_identities`. `review --holder` also leaves out senders whose
+  score is demoted, counted as `suspicious` in the mark.
+- **`schedule agent --on-new-mail <holder>`,** where the host passes `newMail` (`holderHasMail`): the agent starts
+  only when mail is stored past the holder's mark, and may check every 5 minutes; a run with nothing new costs no
+  model call and records nothing. Mail that is only skipped moves the holder's mark without the agent.
+
+### Fixed
+
+- **A test can no longer open the owner's real store.** Under vitest, opening a file in the owner's WireCat folder
+  (found from the account's home, not `HOME`) throws, read-only or not. This holds in every CLI's tests that open the
+  store through cli-core. cli-core's own suite now refuses vitest's threads pool. There a test env without `HOME`
+  reached the real home folder: on 2026-10-18 a `--pool=threads` run wrote test rows into the real store.
+- **The test rows that leaked into a real store are removed (store version 48).** A store that holds an account of
+  the test messenger `chat` gets a mark from the migration. The next writable open then removes every such account
+  with all it holds, as `cache clear` removes one, so the search and vector indexes stay in step. A store without
+  one is unchanged. If the removal fails, the store still opens: a warning names the error and the next open tries
+  again.
+
+## 0.559.0 — 02.11.2026
+
+### Added
+
+- **Imports through one envelope (store version 47).** `ingest(store, envelope, { account, dryRun })` in
+  `./services` takes the v1 records envelope (`schema_version`, `source { provider, account, batch_id }`, `records[]`
+  with `key`, `type`, `external_id`, `operation` `upsert` or `delete`, `fields`, `revision`, `relations[]`), or a JSONL
+  file through `envelopeOfJsonl`. Its JSON Schema (Draft 2020-12) is `RECORDS_ENVELOPE_SCHEMA` and
+  `@wirecat/cli-core/schemas/records-envelope.v1.schema.json`. Each record is kept in the new `records` table, unique
+  per account, type and external id: the same import twice writes nothing, a lower revision is refused, a delete is
+  soft, and a field that looks like a secret is refused. The receipt counts created, updated, unchanged, deleted and
+  refused records, and each error carries a JSON pointer and a stable code.
+- **An import never writes confirmed money.** An `invoice` or `payment` record becomes a proposal by the bot `import`,
+  decided in the proposal inbox. A reference to a record not yet imported waits for it, and a person or organization
+  record is linked only by the owner (`store.records.map`), never by name. `store.records` lists and reads records,
+  waiting and flagged ones too.
+
 ## 0.558.0 — 02.11.2026
 
 ### Changed — may break callers

package/dist/background/schedules.d.ts

@@ -17,6 +17,8 @@ export interface Schedule {
     /** The variables the run gets on top of the timer's: the profile, where the files are, PATH. Never a credential. */
     environment: Record<string, string>;
     createdAt: string;
+    /** A holder whose mark gates the run: it starts only when mail is stored past that mark. */
+    onNewMail?: string;
 }
 export interface LastRun {
     at: string;

package/dist/cli/effects.d.ts

@@ -39,6 +39,16 @@ export declare const isLogin: (command: Command) => boolean;
  * (merge/unmerge, claim/release) or keeps the old value in the task's history; under the lock a close only suggests.
  */
 export declare const destroysNothing: <T extends Command>(command: T) => T;
+/**
+ * The `propose` tier, a closed list: the only commands `<PREFIX>_READ_ONLY` lets stage something for the owner. Each
+ * appends a proposal the owner decides or moves its caller's own processing mark, and nothing else. A command must
+ * be marked `proposesOnly` **and** end with one of these paths; adding a path widens what a read-only agent can
+ * write, so it needs its own review.
+ */
+export declare const PROPOSE_COMMANDS: readonly ["messages acknowledge", "mail findings add"];
+/** Marks a command of the `propose` tier; the lock lets it through only when its path is in `PROPOSE_COMMANDS`. */
+export declare const proposesOnly: <T extends Command>(command: T) => T;
+export declare const isProposal: (command: Command) => boolean;
 /** A local edit remains an edit even when it first fetches metadata from the messenger. */
 export declare const changesStore: <T extends Command>(command: T) => T;
 /**
@@ -66,8 +76,9 @@ export declare const readsOverMcp: (command: Command) => boolean;
 export declare const readsOverMcpAt: (root: Command) => (path: readonly string[]) => boolean;
 /**
  * Whether `<PREFIX>_READ_ONLY` refuses the command as a change to the store. Every write that stays on this machine
- * is refused unless `destroysNothing` marks it, so a new one fails closed (WC-PERM-12). A fetch (`remote: "read"`)
- * keeps receiving, a remote write is `changesMessenger`'s, and an authority change has its own refusal.
+ * is refused unless `destroysNothing` marks it or it is of the `propose` tier, so a new one fails closed
+ * (WC-PERM-12). A fetch (`remote: "read"`) keeps receiving, a remote write is `changesMessenger`'s, and an authority
+ * change has its own refusal.
  */
 export declare const isStoreChange: (command: Command) => boolean;
 export declare const STORE_CHANGE_REFUSAL = "change the message store";

package/dist/cli/effects.js

@@ -60,6 +60,25 @@ export const destroysNothing = (command) => {
     KEPT_UNDER_LOCK.add(command);
     return command;
 };
+/**
+ * The `propose` tier, a closed list: the only commands `<PREFIX>_READ_ONLY` lets stage something for the owner. Each
+ * appends a proposal the owner decides or moves its caller's own processing mark, and nothing else. A command must
+ * be marked `proposesOnly` **and** end with one of these paths; adding a path widens what a read-only agent can
+ * write, so it needs its own review.
+ */
+export const PROPOSE_COMMANDS = ["messages acknowledge", "mail findings add"];
+const PROPOSES = new WeakSet();
+/** Marks a command of the `propose` tier; the lock lets it through only when its path is in `PROPOSE_COMMANDS`. */
+export const proposesOnly = (command) => {
+    PROPOSES.add(command);
+    return command;
+};
+export const isProposal = (command) => {
+    if (!PROPOSES.has(command))
+        return false;
+    const path = pathOf(command).join(" ");
+    return PROPOSE_COMMANDS.some((listed) => path === listed || path.endsWith(` ${listed}`));
+};
 const STORE_WRITES = new WeakSet();
 /** A local edit remains an edit even when it first fetches metadata from the messenger. */
 export const changesStore = (command) => {
@@ -125,14 +144,16 @@ export const readsOverMcpAt = (root) => (path) => {
 };
 /**
  * Whether `<PREFIX>_READ_ONLY` refuses the command as a change to the store. Every write that stays on this machine
- * is refused unless `destroysNothing` marks it, so a new one fails closed (WC-PERM-12). A fetch (`remote: "read"`)
- * keeps receiving, a remote write is `changesMessenger`'s, and an authority change has its own refusal.
+ * is refused unless `destroysNothing` marks it or it is of the `propose` tier, so a new one fails closed
+ * (WC-PERM-12). A fetch (`remote: "read"`) keeps receiving, a remote write is `changesMessenger`'s, and an authority
+ * change has its own refusal.
  */
 export const isStoreChange = (command) => {
     const effects = metaOf(command).effects;
     return ((effects?.remote === "none" || STORE_WRITES.has(command)) &&
         effects?.local === "write" &&
         !KEPT_UNDER_LOCK.has(command) &&
+        !isProposal(command) &&
         !changesAuthority(command) &&
         writesFileNow(command));
 };

package/dist/cli/index.d.ts

@@ -69,7 +69,7 @@ export { sharedCommandTemplate } from "./contract-templates.js";
 export { type Closeable, withDeadline } from "./deadline.js";
 export { DEFAULT_CONFIG, ensureDefaultConfig } from "./default-config.js";
 export { DISCOVERY_DESCRIPTIONS } from "./discovery-descriptions.js";
-export { changesAuthority, changesAuthorityAt, changesAuthorityNow, destroysNothing, FETCH, fetchesOnly, fetchesOnlyAt, grantsAuthority, isLogin, isOtherServiceCall, isStoreChange, judgedEffects, judgedTargets, LOCAL_READ, LOCAL_WRITE, logsInOrOut, NO_EFFECTS, ownerOnlyOption, previewFlag, REMOTE_READ, REMOTE_WRITE, reachesOtherService, readsOverMcp, readsOverMcpAt, refuseUnderReadOnly, storeChangeRefusal, writesFileOnlyWith, } from "./effects.js";
+export { changesAuthority, changesAuthorityAt, changesAuthorityNow, destroysNothing, FETCH, fetchesOnly, fetchesOnlyAt, grantsAuthority, isLogin, isOtherServiceCall, isProposal, isStoreChange, judgedEffects, judgedTargets, LOCAL_READ, LOCAL_WRITE, logsInOrOut, NO_EFFECTS, ownerOnlyOption, PROPOSE_COMMANDS, previewFlag, proposesOnly, REMOTE_READ, REMOTE_WRITE, reachesOtherService, readsOverMcp, readsOverMcpAt, refuseUnderReadOnly, storeChangeRefusal, writesFileOnlyWith, } from "./effects.js";
 export { type CliEntry, type EntryContext, type EntryIo, openBrowser, startCli } from "./entry.js";
 export { type AnswerOutput, answerSchema, type Body, type ItemBody, isBody, itemAnswer, itemOf, jsonlRecords, judgedAnswer, type ListBody, type ListInput, listOf, metaNow, printItem, renderAnswer, sealed, snakeKeys, snakeKeysKeeping, } from "./envelope.js";
 export { withAbort } from "./execution.js";
@@ -85,7 +85,7 @@ export { commandPath, LIST_QUERY_GUIDE, listQuery, nativeField, nativeTermLists,
 export { MCP_HTTP_DEFAULT_PORT, type McpServerOptions, type McpServerTarget, mcpServerCommand, } from "./mcp-server-command.js";
 export { formatMeetingBatch, prepareMeetingBatch } from "./meeting-batch.js";
 export { meetingEvidenceItem, meetingPersonContextItem } from "./meeting-evidence-answer.js";
-export { parseEvidenceFindingsJson, parseMeetingFindingsJson } from "./meeting-findings-input.js";
+export { parseEvidenceFindingsJson, parseMailFindingsJson, parseMeetingFindingsJson, } from "./meeting-findings-input.js";
 export { meetingPreparationAnswer } from "./meeting-preparation-answer.js";
 export { type MeetingPreparationReader, meetingPreparationInput, readMeetingPreparation, } from "./meeting-preparation-read.js";
 export { readMeetingProjectCandidates } from "./meeting-project-candidates-read.js";

package/dist/cli/index.js

@@ -61,7 +61,7 @@ export { sharedCommandTemplate } from "./contract-templates.js";
 export { withDeadline } from "./deadline.js";
 export { DEFAULT_CONFIG, ensureDefaultConfig } from "./default-config.js";
 export { DISCOVERY_DESCRIPTIONS } from "./discovery-descriptions.js";
-export { changesAuthority, changesAuthorityAt, changesAuthorityNow, destroysNothing, FETCH, fetchesOnly, fetchesOnlyAt, grantsAuthority, isLogin, isOtherServiceCall, isStoreChange, judgedEffects, judgedTargets, LOCAL_READ, LOCAL_WRITE, logsInOrOut, NO_EFFECTS, ownerOnlyOption, previewFlag, REMOTE_READ, REMOTE_WRITE, reachesOtherService, readsOverMcp, readsOverMcpAt, refuseUnderReadOnly, storeChangeRefusal, writesFileOnlyWith, } from "./effects.js";
+export { changesAuthority, changesAuthorityAt, changesAuthorityNow, destroysNothing, FETCH, fetchesOnly, fetchesOnlyAt, grantsAuthority, isLogin, isOtherServiceCall, isProposal, isStoreChange, judgedEffects, judgedTargets, LOCAL_READ, LOCAL_WRITE, logsInOrOut, NO_EFFECTS, ownerOnlyOption, PROPOSE_COMMANDS, previewFlag, proposesOnly, REMOTE_READ, REMOTE_WRITE, reachesOtherService, readsOverMcp, readsOverMcpAt, refuseUnderReadOnly, storeChangeRefusal, writesFileOnlyWith, } from "./effects.js";
 export { openBrowser, startCli } from "./entry.js";
 export { answerSchema, isBody, itemAnswer, itemOf, jsonlRecords, judgedAnswer, listOf, metaNow, printItem, renderAnswer, sealed, snakeKeys, snakeKeysKeeping, } from "./envelope.js";
 export { withAbort } from "./execution.js";
@@ -77,7 +77,7 @@ export { commandPath, LIST_QUERY_GUIDE, listQuery, nativeField, nativeTermLists,
 export { MCP_HTTP_DEFAULT_PORT, mcpServerCommand, } from "./mcp-server-command.js";
 export { formatMeetingBatch, prepareMeetingBatch } from "./meeting-batch.js";
 export { meetingEvidenceItem, meetingPersonContextItem } from "./meeting-evidence-answer.js";
-export { parseEvidenceFindingsJson, parseMeetingFindingsJson } from "./meeting-findings-input.js";
+export { parseEvidenceFindingsJson, parseMailFindingsJson, parseMeetingFindingsJson, } from "./meeting-findings-input.js";
 export { meetingPreparationAnswer } from "./meeting-preparation-answer.js";
 export { meetingPreparationInput, readMeetingPreparation, } from "./meeting-preparation-read.js";
 export { readMeetingProjectCandidates } from "./meeting-project-candidates-read.js";

package/dist/cli/meeting-findings-input.d.ts

@@ -1,3 +1,6 @@
+import { type MailFindingsInput } from "../mail/findings.js";
 import { type FindingsInput, type MeetingFindingsInput } from "../meetings/index.js";
 export declare const parseMeetingFindingsJson: (text: string) => MeetingFindingsInput;
 export declare const parseEvidenceFindingsJson: (text: string) => FindingsInput;
+/** A mail findings batch as `mail findings add` reads it: snake_case JSON, checked for shape before the store. */
+export declare const parseMailFindingsJson: (text: string) => MailFindingsInput;

package/dist/cli/meeting-findings-input.js

@@ -1,4 +1,5 @@
 import { CliError } from "@wirecat/cli-base";
+import { validateMailFindings } from "../mail/findings.js";
 import { validateMeetingFindings } from "../meetings/index.js";
 import { validateEvidenceFindings } from "../store/evidence-findings.js";
 const keys = {
@@ -6,6 +7,7 @@ const keys = {
     due_at: "dueAt",
     due_evidence: "dueEvidence",
     assignee_evidence: "assigneeEvidence",
+    memory_kind: "memoryKind",
 };
 const parseFindingsJson = (text, label, validate) => {
     if (Buffer.byteLength(text, "utf8") > 65536)
@@ -40,3 +42,5 @@ const parseFindingsJson = (text, label, validate) => {
 };
 export const parseMeetingFindingsJson = (text) => parseFindingsJson(text, "meeting findings", validateMeetingFindings);
 export const parseEvidenceFindingsJson = (text) => parseFindingsJson(text, "evidence findings", validateEvidenceFindings);
+/** A mail findings batch as `mail findings add` reads it: snake_case JSON, checked for shape before the store. */
+export const parseMailFindingsJson = (text) => parseFindingsJson(text, "mail findings", validateMailFindings);

package/dist/cli/messenger/conversation-answers.d.ts

@@ -251,6 +251,9 @@ export declare const conversationShown: (account: AccountKey, { summary, message
             bulk?: boolean | undefined;
             list_id?: string | null | undefined;
             rule_id?: number | null | undefined;
+            fingerprint?: string | undefined;
+            new_sender?: boolean | undefined;
+            sender_identities?: number | undefined;
         } | undefined;
         provider_metadata?: {
             [x: string]: unknown;

package/dist/cli/messenger/message-answers.d.ts

@@ -228,6 +228,9 @@ export declare const threadAnswer: ({ items, ...thread }: ThreadContext, reader:
             bulk?: boolean | undefined;
             list_id?: string | null | undefined;
             rule_id?: number | null | undefined;
+            fingerprint?: string | undefined;
+            new_sender?: boolean | undefined;
+            sender_identities?: number | undefined;
         } | undefined;
         provider_metadata?: {
             [x: string]: unknown;

package/dist/cli/messenger/message-writes.d.ts

@@ -232,6 +232,9 @@ export declare const writtenAnswer: ({ operationId, sendId, message, messages, s
             bulk?: boolean | undefined;
             list_id?: string | null | undefined;
             rule_id?: number | null | undefined;
+            fingerprint?: string | undefined;
+            new_sender?: boolean | undefined;
+            sender_identities?: number | undefined;
         } | undefined;
         provider_metadata?: {
             [x: string]: unknown;
@@ -454,6 +457,9 @@ export declare const writtenAnswer: ({ operationId, sendId, message, messages, s
             bulk?: boolean | undefined;
             list_id?: string | null | undefined;
             rule_id?: number | null | undefined;
+            fingerprint?: string | undefined;
+            new_sender?: boolean | undefined;
+            sender_identities?: number | undefined;
         } | undefined;
         provider_metadata?: {
             [x: string]: unknown;

package/dist/cli/schedule/schedule-command.d.ts

@@ -9,10 +9,15 @@ export interface ScheduleHost {
         env: NodeJS.ProcessEnv;
         profile: string;
     };
+    /**
+     * Whether mail is stored past the holder's mark (`holderHasMail`). Given, `schedule agent` takes `--on-new-mail`:
+     * the agent then runs only after a sync stored mail it has not processed.
+     */
+    newMail?: (command: Command, holder: string) => Promise<boolean>;
 }
 /**
  * Runs the CLI's own commands, or an agent, later or on a timer — through systemd (Linux), launchd
  * (macOS) or Task Scheduler (Windows). Every timer runs `schedule exec <file>`; the schedule file holds
  * the rest, so what runs and with which variables is the same on all three.
  */
-export declare const scheduleCommandFor: ({ app, context: contextOf }: ScheduleHost) => Command;
+export declare const scheduleCommandFor: ({ app, context: contextOf, newMail }: ScheduleHost) => Command;

package/dist/cli/schedule/schedule-command.js

@@ -7,6 +7,7 @@ import { describeWhen, findProgram, lastRun, listSchedules, readSchedule, runSch
 import { thisMachine } from "../../background/system.js";
 import { locationVariables } from "../../background/units.js";
 import { parseDuration } from "../../domain/duration.js";
+import { HOLDER } from "../../mail/marks.js";
 import { readOnlyLockOf } from "../../ports/app.js";
 import { aheadOf } from "../../services/moment.js";
 import { storePath } from "../../store/path.js";
@@ -18,6 +19,8 @@ import { SCHEDULES_QUERY, scheduleFilter } from "../messenger/list-result-querie
 import { lineOf } from "../steps.js";
 /** Each run of an agent is a paid model call that reads chats; keeping the store current is `serve`'s job. */
 const AGENT_MINIMUM_MINUTES = 60;
+/** A run gated on new mail costs a store read when nothing came, so it may check as often as mail syncs. */
+const GATED_AGENT_MINIMUM_MINUTES = 5;
 const COMMAND_MINIMUM_MINUTES = 1;
 const HARNESSES = ["claude", "codex"];
 const whenOf = ({ every, at, atTime }, minimum) => {
@@ -78,7 +81,7 @@ const promptExample = (app) => app.messenger === false
  * (macOS) or Task Scheduler (Windows). Every timer runs `schedule exec <file>`; the schedule file holds
  * the rest, so what runs and with which variables is the same on all three.
  */
-export const scheduleCommandFor = ({ app, context: contextOf }) => {
+export const scheduleCommandFor = ({ app, context: contextOf, newMail }) => {
     const command = new Command("schedule").description(`run a ${app.command} command or an agent later or on a timer (systemd, launchd, Task Scheduler); an agent cannot send`);
     const prepare = (self, resolving = {}) => {
         const context = contextOf(self, resolving);
@@ -114,6 +117,13 @@ export const scheduleCommandFor = ({ app, context: contextOf }) => {
         };
         return { context, system, state, say, timer, environment, save };
     };
+    /** A schedule gated on new mail waits while nothing is stored past its holder's mark. */
+    const waits = async (self, file) => {
+        const holder = existsSync(file) ? readSchedule(file).onNewMail : undefined;
+        if (holder === undefined || !newMail || (await newMail(self, holder)))
+            return undefined;
+        return holder;
+    };
     withWhen(grantsAuthority(annotate(command.command("command"), {
         literal_after_dashes: true,
         effects: LOCAL_WRITE,
@@ -151,6 +161,8 @@ export const scheduleCommandFor = ({ app, context: contextOf }) => {
         .addOption(new Option("--max-cost <usd>", "claude only: stop a run that costs more than this, in US dollars").argParser(Number))).action(async function (name, harness, prompt) {
         const { context, system, environment, save } = prepare(this);
         const options = this.opts();
+        if (options.onNewMail !== undefined && !HOLDER.test(options.onNewMail))
+            throw new CliError("validation_error", `--on-new-mail takes a holder: lower-case letters, digits and dashes`);
         const program = findProgram(harness, context.env, system.platform);
         if (!program)
             throw new CliError("not_found", `${harness} is not on PATH`);
@@ -188,11 +200,16 @@ export const scheduleCommandFor = ({ app, context: contextOf }) => {
             name: scheduleName(name),
             kind: "agent",
             argv,
-            when: whenOf(options, AGENT_MINIMUM_MINUTES),
+            when: whenOf(options, options.onNewMail ? GATED_AGENT_MINIMUM_MINUTES : AGENT_MINIMUM_MINUTES),
             environment: environment(),
             createdAt: new Date().toISOString(),
+            ...(options.onNewMail ? { onNewMail: options.onNewMail } : {}),
         });
     });
+    if (newMail)
+        command.commands
+            .find((one) => one.name() === "agent")
+            ?.option("--on-new-mail <holder>", `run only when mail is stored past this holder's mark — after a sync brought new mail; may check every ${GATED_AGENT_MINIMUM_MINUTES}m`);
     withQuery(annotate(command.command("list"), {
         effects: LOCAL_READ,
         examples: [`${app.command} personal schedule list`, `${app.command} personal schedule list kind:agent`],
@@ -241,6 +258,9 @@ export const scheduleCommandFor = ({ app, context: contextOf }) => {
         .argument("<name>", "the schedule's name, as `schedule list` shows it")
         .action(async function (name) {
         const { context, system, state, say, timer } = prepare(this);
+        const holder = await waits(this, scheduleFile(state, scheduleName(name)));
+        if (holder !== undefined)
+            return say({ name, skipped: true, holder }, [`${name}: skipped — no mail stored past ${holder}'s mark`]);
         const last = await untilChildEnds(this, (signal) => runSchedule(app, system, context.env, scheduleFile(state, scheduleName(name)), {
             timer: timer(),
             ...(signal ? { signal } : {}),
@@ -273,6 +293,8 @@ export const scheduleCommandFor = ({ app, context: contextOf }) => {
         .action(async function (file) {
         // A timer starts it with no profile named; the schedule's own environment carries the profile.
         const { context, system, timer } = prepare(this, { needsProfile: false });
+        if ((await waits(this, file)) !== undefined)
+            return;
         const last = await untilChildEnds(this, (signal) => runSchedule(app, system, context.env, file, {
             timer: timer(),
             untilUnlocked: true,

package/dist/domain/records.d.ts

@@ -0,0 +1,161 @@
+export declare const RECORDS_SCHEMA_VERSION = 1;
+export declare const RECORD_OPERATIONS: readonly ["upsert", "delete"];
+/** Types with a table of their own; anything else a source sends is `custom:<name>` and stays a record only. */
+export declare const RECORD_ENTITY_TYPES: readonly ["invoice", "payment", "person", "organization", "project"];
+export type RecordOperation = (typeof RECORD_OPERATIONS)[number];
+export type RecordEntityType = (typeof RECORD_ENTITY_TYPES)[number];
+export interface RecordRelation {
+    /** What the target is to this record: `counterparty`, `payer`, `settles`, or a source's own word. */
+    role: string;
+    type: string;
+    external_id: string;
+}
+export interface EnvelopeRecord {
+    /** The caller's name for this line, unique in the envelope; the receipt cites it. */
+    key: string;
+    type: string;
+    external_id: string;
+    operation: RecordOperation;
+    fields?: Record<string, unknown>;
+    /** Goes up with each change at the source; a lower one than the store holds is refused. */
+    revision?: number;
+    relations?: RecordRelation[];
+}
+export interface EnvelopeSource {
+    provider: string;
+    account: string;
+    batch_id: string;
+}
+export interface RecordsEnvelope {
+    schema_version: 1;
+    source: EnvelopeSource;
+    records: EnvelopeRecord[];
+}
+/** A refusal: `pointer` is an RFC 6901 JSON pointer into the envelope, `code` a stable word callers may branch on. */
+export interface IngestError {
+    pointer: string;
+    code: string;
+    message: string;
+    key?: string;
+}
+/** The v1 envelope as JSON Schema (Draft 2020-12); `schemas/records-envelope.v1.schema.json` is this, written out. */
+export declare const RECORDS_ENVELOPE_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly title: "WireCat records envelope, version 1";
+    readonly description: string;
+    readonly type: "object";
+    readonly required: readonly ["schema_version", "source", "records"];
+    readonly additionalProperties: false;
+    readonly properties: {
+        readonly schema_version: {
+            readonly const: 1;
+        };
+        readonly source: {
+            readonly $ref: "#/$defs/source";
+        };
+        readonly records: {
+            readonly type: "array";
+            readonly items: {
+                readonly $ref: "#/$defs/record";
+            };
+        };
+    };
+    readonly $defs: {
+        readonly source: {
+            readonly type: "object";
+            readonly required: readonly ["provider", "account", "batch_id"];
+            readonly additionalProperties: false;
+            readonly properties: {
+                readonly provider: {
+                    readonly type: "string";
+                    readonly pattern: "^[a-z0-9][a-z0-9_-]{0,62}$";
+                    readonly description: "The system the records come from";
+                };
+                readonly account: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 512;
+                    readonly description: "The account in that system";
+                };
+                readonly batch_id: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 512;
+                    readonly description: "This import, for the receipt";
+                };
+            };
+        };
+        readonly record: {
+            readonly type: "object";
+            readonly required: readonly ["key", "type", "external_id", "operation"];
+            readonly additionalProperties: false;
+            readonly properties: {
+                readonly key: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 512;
+                };
+                readonly type: {
+                    readonly type: "string";
+                    readonly pattern: "^(invoice|payment|person|organization|project|custom:[a-z0-9][a-z0-9_-]{0,62})$";
+                };
+                readonly external_id: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 512;
+                };
+                readonly operation: {
+                    readonly enum: readonly ["upsert", "delete"];
+                };
+                readonly fields: {
+                    readonly type: "object";
+                    readonly description: "What the source says, as data: never secrets, never instructions";
+                };
+                readonly revision: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly maximum: number;
+                };
+                readonly relations: {
+                    readonly type: "array";
+                    readonly maxItems: 100;
+                    readonly items: {
+                        readonly $ref: "#/$defs/relation";
+                    };
+                };
+            };
+        };
+        readonly relation: {
+            readonly type: "object";
+            readonly required: readonly ["role", "type", "external_id"];
+            readonly additionalProperties: false;
+            readonly properties: {
+                readonly role: {
+                    readonly type: "string";
+                    readonly pattern: "^[a-z0-9][a-z0-9_-]{0,62}$";
+                };
+                readonly type: {
+                    readonly type: "string";
+                    readonly pattern: "^(invoice|payment|person|organization|project|custom:[a-z0-9][a-z0-9_-]{0,62})$";
+                };
+                readonly external_id: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 512;
+                };
+            };
+        };
+    };
+};
+export declare const pointerOf: (...segments: (string | number)[]) => string;
+/** Why one record cannot be taken, or nothing; `index` is its place in `records`. */
+export declare const recordErrors: (record: unknown, index: number) => IngestError[];
+/** The envelope's own errors (not its records'): when there is one, no record is taken. */
+export declare const envelopeErrors: (envelope: unknown, account: string) => IngestError[];
+/** The same fields and relations in any key or relation order give the same fingerprint. */
+export declare const recordFingerprint: (fields: Record<string, unknown>, relations: RecordRelation[]) => string;
+/**
+ * A JSONL import as the envelope it stands for: the first line holds `schema_version` and `source`, each further
+ * non-empty line one record. A line that is not JSON comes back as a record the envelope check refuses, at its index.
+ */
+export declare const envelopeOfJsonl: (text: string) => unknown;