@ghostlytools/cli 1.1.3 → 1.1.5

package/dist/assets/{server-9AM0ta6q.js → server-TamKsfmC.js}

@@ -1,7 +1,9 @@
-import { a as fileBytesOf, c as removeFileBytes, d as __exportAll, i as fileBytes, n as blobDigest } from "./fileBytes-DxiJHmTk.js";
-import { $a as filePartName, $i as BUTTON_ID, $n as freshHubs, $o as createChatInvite, $r as IdentityExchange, $s as randomBytes, $t as isPubkyKey, A as GROUP_EDIT_TEXT_BYTES, Aa as RTC_CONFIG, An as findEndpoint, Ao as readSetUpdate, Ar as newWakeToken, As as RelayTransport, At as encodeDidDhtPacket, Ba as LEGACY_SERVICES, Bi as GROUP_REACTION_FRAME, Bo as enrollCancelReason, Br as HOLD_LIMITS, Bs as createRelayPayload, Bt as USDT_PUBLIC_RPC, C as groupWakes, Ca as formatLocalTarget, Co as readHandoffHello, Cr as nextPinNumber, Cs as nextTurnPosition, D as GroupSession, Da as decodeControl, Dn as ENDPOINT, Do as sealHandoffPiece, Dr as WAKE_CALL_INTERVAL_MS, Ds as turnKeys, Dt as didDhtDocument, E as GROUP_READ_NOTE, Ea as LIMITS, En as decodeBolt11, Eo as readHandoffVerified, Er as readPin, Es as signTurnRelease, Fi as dhtEditId, Fn as INVITE_TAKEN, Fr as vapidKeysMatch, Fs as budgetRetryMs, Ft as ONCHAIN_PROVIDER, Ga as HANDOFF_HAVE, Gi as reactionEmoji, Gn as MESH_HUBS, Go as enrollProofFrame, Gr as CapsExchange, Gs as identityFromSeed, Gt as validatePaymentTarget, Ha as HANDOFF_ACK, Hi as ReactionWindow, Ho as enrollDoneFrame, Hr as HoldRefusedError, Ht as assertTokenUnits, Ia as parseCallSignal, Ii as parseLinkPreview, In as LIVENESS_PING_MS, Is as isDiscoveryBudgetError, It as PaymentPreflightError, Ja as HANDOFF_PAKE, Ji as validReactionNumber, Jn as pickMeshHubs, Jo as verifyEnrollProof, Jr as dialDescriptors, Js as verify, Jt as SPARK_PROVIDER, Ka as HANDOFF_HELLO, Ki as reactionIsNewer, Kn as mayBeHub, Ko as readEnrollGrant, Kr as DHT_TEXT_CAPABILITY, Ks as identityFromSeedB64, Kt as walletNetworkOf, Li as forwardedAgain, Ln as pairedMessageFrame, Lr as EDIT_CAPABILITY, Ls as withRequestOptions, Lt as SEPOLIA_TEST_USDT, M as parseCommunityEdit, Mi as EDIT_BUFFER_MS, Mn as parseCashuRequestPayload, Mo as setUpdateFrame, Mr as relayRequest, Ms as normalizeRelayUrl, Mt as signDidDhtPacket, N as mentionsMember, Ni as EDIT_RATE_WINDOW_MS, Nn as parseFedimintRequestPayload, No as signTombstone, Nr as wakeRequest, Nt as ETHEREUM_USDT, Oa as encodeControl, Oi as fileMessageText, On as cashuRequestPayload, Or as WakeLimiter, Os as turnName, Ot as didDhtFromPublicKey, P as groupName, Pi as RateWindow, Pn as GhostLink, Po as verifySetUpdate, Pr as checkPushEndpoint, Ps as traceLink, Pt as EVM_TEST_CHAINS, Qa as HANDOFF_VERIFIED, Qi as replySnippet, Qn as doorHubs, Qo as OwnInviteError, Qs as fromBase64Url, Ra as emptyLinkRecords, Ri as readForwarded, Rn as CarriedTransport, Rr as HOLD_CAPABILITY, Rs as PacketTooLargeError, Rt as SEPOLIA_TEST_USDT_FAUCET, S as groupWakeFrame, Sa as GhostlyHttpError, Si as safeBlobType, So as readHandoffHave, Sr as mayPin, Ss as firstDeviceSetSecret, Ta as webLocalFetch, Tn as engineText, To as readHandoffTurnFrame, Tr as pinNumberHolds, Ts as signTurnPacket, Ua as HANDOFF_CANCEL, Ui as nextReactionNumber, Un as groupSignalFrame, Uo as enrollGrantFrame, Ur as newMailbox, Ut as assertWholeSats, Va as serviceIdFromName, Vi as REACTION_LIMITS, Vo as enrollDigits, Vr as HoldKeys, Vt as WALLET_NETWORKS, Wa as HANDOFF_DONE, Wi as queueReaction, Wn as readGroupSignal, Wo as enrollHelloFrame, Wr as readManifest, Ws as createIdentity, Wt as formatPaymentAmount, Xa as HANDOFF_REQUEST, Xi as pairedReplyAuthor, Xn as beaconKeys, Xo as deviceInviteJoinerParams, Xs as sanitizeAvatar, Xt as sparkInvoiceDetails, Ya as HANDOFF_PIECE_BYTES, Yi as wireReaction, Yn as COMMUNITY_TOPOLOGY, Yo as createDeviceInvite, Yt as sparkAddressKind, Za as HANDOFF_TIMINGS, Zi as readReply, Zn as beaconRecords, Zo as readDeviceInvite, Zr as IDENTITY_REVOCATION_LABEL, Zs as bytesEqual, Zt as isBitcoinAddress, _ as knockRecords, _a as edgeParams, _i as peekDhtMailbox, _o as handoffVersions, _r as TypingSender, _s as TURN_SETTLE_MS, a as sealGroupTyping, aa as sameButtonText, ai as receivedIdentityStatus, ao as handoffContext, ar as pickHubs, as as ENROLL_CAPABILITY, ba as RELAY_POLL_INTERVALS, bi as parseImageMeta, bo as readHandoffCancel, bs as TURN_LAST_SEQUENCE, c as GROUP_READ_NOTE_COMMUNITY, ca as claimedTime, ci as PeerProofs, co as handoffDigest, cr as readBeaconHead, cs as deviceEchoNonce, d as encodeCommunityLink, da as shownTime, di as TRANSPORTS, do as handoffManifestFrames, dr as ChatFiles, ds as devicePingFrame, ec as toBase64Url, eo as handoffAttemptAllowed, er as lobbyKeys, es as decodeInviteCode, et as isAtprotoDid, fa as GROUP_MEMBER_CAP, fi as automaticTransport, fo as handoffOfferFrame, fr as FILE_LIMITS, fs as newDeviceSetSecret, g as knockIdentity, ga as verifyCommitSignature, gi as DHT_MESSAGE_TTL, go as handoffStreamKey, gs as TURN_RAISE_READ_TIMEOUT_MS, h as entryParams, ha as rosterHas, ho as handoffRetryAfter, i as openGroupTyping, ia as checkStatusCard, ii as newIdentityBinding, io as handoffCancelFrame, ir as newerHead, is as DEVICES_CAPABILITY, j as carryMentions, ji as parseVideoMeta, jn as isFederationId, jo as setAckFrame, jr as parseWakeFrame, js as currentRelays, ki as parseVoiceMeta, kn as fedimintRequestPayload, kr as deviceWakeRequest, ks as DEFAULT_RELAYS, kt as encodeDidDhtDeactivated, l as communityHasFrame, la as heardTime, li as emptyProofLedger, lo as handoffEphemeral, lr as readLobby, ls as deviceKeyZ32, m as encodeGroupEntryLink, ma as MEMBER_KEY, mi as irohRelayUrl, mo as handoffReleaseFrame, mr as transferStalled, ms as webCryptoSigner, n as GroupTypingBoard, na as STATUS_CARD_LIMITS, nc as utf8Decode, ni as identityRevocationValue, no as handoffAttemptSucceeded, nr as mergeBeacon, o as COMMUNITY_LIMITS, oa as statusCardText, oi as revokesIdentity, oo as handoffContextProof, or as rankHubs, os as HANDOFF_CAPABILITY, p as decodeGroupEntryLink, pi as irohDescriptor, po as handoffPakeFrame, pr as transferEnded, ps as seedSigner, qa as HANDOFF_OFFER, qi as readReaction, qn as meshHubs, qo as readEnrollHello, qr as capsDescriptors, qs as publicKeyFromZ32, qt as SPARK_NETWORKS, r as groupTypingEpoch, rc as utf8Encode, ri as identityStatement, ro as handoffBusyFrame, rr as mergeLobby, rs as inviteOwnership, s as CommunitySession, sa as arrivalKey, si as lastSharedWithMe, so as handoffDataFrame, sr as readBeacon, ss as deviceEchoFrame, tc as toZ32, ti as emptyIdentityLedger, to as handoffAttemptFailed, tr as lobbyRecords, ts as encodeInviteCode, tt as normalizeAtprotoHandle, u as decodeCommunityLink, ua as receivedTimestamp, ui as validExternalKey, uo as handoffHelloFrame, ur as shouldBeHub, us as deviceLinkPairing, v as mergeKnocks, va as DirectPathWatch, vi as DHT_FILE_CAPABILITY, vo as newHandoffId, vs as classifyTurnRead, w as parseGroupWakeFrame, wa as parseLocalTarget, wn as engineError, wo as readHandoffPake, wr as pinIsNewer, ws as readTurnPacket, x as GroupWakeLimiter, xa as presenceSeenAt, xo as readHandoffDone, xr as PIN_LIMITS, xs as TURN_MAX, y as readKnocks, yi as dhtFileId, yo as readHandoffAck, yr as typingActivity, ys as turnPutSummary, za as HTTP_SERVICE_PROTO, zi as COMMUNITY_REACTION_FRAME, zo as enrollCancelFrame, zr as HOLD_DATED_BACK_MS, zt as TEST_USDT_FAUCET_AMOUNT } from "./src-C_E99PGx.js";
-import { a as deleteDatabase, c as profileOpenFailure, d as wrap, i as databaseName, l as store, n as STORES$1, o as fileStore, r as clearProfileStores, s as openDb, t as CARD_INDEX, u as transact } from "./idb-Co2lObpU.js";
-import { $ as onAdaptersChanged, A as intentRepository, C as ProviderSources, Ct as FileAppender, D as requireTurn, Dt as streamStored, E as refuseAway, Et as storedSize, F as ModeGate, G as fakesLightning, H as BITCOIN_INVOICE_ON_TESTNET, I as WrongNetworkError, J as mintNetwork, K as isTestMint, L as networkLabel, M as sealSeed, N as unsealSeed, O as setAwayWallets, P as ModeChanged, Q as identityProviders, R as CASHU_MINT_SOURCE, S as lightningPaying, St as paymentWireId, T as awayFrom, Tt as removeStored, U as DEFAULT_MINTS, V as WALLET_TYPES, W as TEST_MINT, X as BACKUP_MEDIA_TYPE, Y as paysItsOwnInvoices, Z as MAX_BACKUP_BYTES, _ as normalizePhrase, _t as pairedWireReply, a as createFailure, at as SourceConfigError, b as breezDatabasesFor, bt as replyTo, c as paymentNetwork, ct as networkMode, d as networkReason, dt as resolveAtprotoDid, et as registeredLightningProviders, f as rpcHost, ft as setOwnDidSource, g as isRecoveryPhrase, gt as groupReply, h as cardsKey, ht as chosenResolver, i as assertConfirmedReal, it as PROVIDER_PLATFORMS, j as newDeviceKey, k as setSingleWriterGate, l as paymentNetworksOf, lt as redact, m as LightningCards, mt as verifyIdentity, n as loadFedimintSdk, nt as reserveAdapterIds, o as createTiming, ot as SourceUnreachableError, p as CASHU_CARD, pt as boundedIdentityFetch, q as isWorthlessMint, r as WALLET_NAMES, rt as NothingSpentError, s as crossNetwork, st as isNothingSpentError, t as fedimintDatabase, tt as registeredOnchainProviders, u as walletInstances, ut as assertPublicServer, v as breezDatabase, vt as receivedPairedReply, w as sourceKey, wt as readStored$1, x as dropBreezDatabase, xt as paymentAlias, y as breezDatabaseInUse, yt as replyRef, z as cashuMint } from "../ghostly.mjs";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { $a as parseLocalTarget, $i as parseLinkPreview, $o as readHandoffPake, $r as EDIT_CAPABILITY, $s as readTurnPacket, $t as TEST_USDT_FAUCET_AMOUNT, A as knockIdentity, Ac as toZ32, Ao as handoffAttemptFailed, As as encodeInviteCode, B as GROUP_READ_NOTE, Bn as decodeBolt11, Bo as handoffManifestFrames, Br as readPin, Bs as devicePingFrame, C as communityHasFrame, Ca as statusCardText, Cc as verify, Ci as revokesIdentity, Co as HANDOFF_PAKE, Cr as readLobby, Cs as verifyEnrollProof, D as decodeGroupEntryLink, Da as receivedTimestamp, Dc as fromBase64Url, Di as validExternalKey, Do as HANDOFF_VERIFIED, Dr as transferEnded, Ds as OwnInviteError, Ea as heardTime, Ec as bytesEqual, Ei as emptyProofLedger, Eo as HANDOFF_TIMINGS, Er as FILE_LIMITS, Es as readDeviceInvite, F as GroupWakeLimiter, Fa as isAppRef, Fi as DHT_FILE_CAPABILITY, Fo as handoffContextProof, Fr as PIN_LIMITS, Fs as HANDOFF_CAPABILITY, G as carryMentions, Ga as verifyCommitSignature, Gi as fileMessageText, Gn as isFederationId, Go as handoffStreamKey, Gr as parseWakeFrame, Gs as TURN_RAISE_READ_TIMEOUT_MS, Hn as cashuRequestPayload, Ho as handoffPakeFrame, Hr as WakeLimiter, Hs as seedSigner, Ht as didDhtFromPublicKey, I as groupWakeFrame, Ia as readAppRevocations, Ii as dhtFileId, Io as handoffDataFrame, Ir as mayPin, Is as deviceEchoFrame, J as groupName, Ji as parseVideoMeta, Jn as GhostLink, Jo as readHandoffAck, Jr as checkPushEndpoint, Js as turnPutSummary, Jt as EVM_TEST_CHAINS, K as parseCommunityEdit, Ka as edgeParams, Ki as parseVoiceMeta, Kn as parseCashuRequestPayload, Ko as handoffVersions, Kr as relayRequest, Ks as TURN_SETTLE_MS, Kt as signDidDhtPacket, L as groupWakes, Li as parseImageMeta, Lo as handoffDigest, Lr as nextPinNumber, Ls as deviceEchoNonce, M as mergeKnocks, Ma as appRef, Mc as utf8Encode, Mo as handoffBusyFrame, Ms as inviteOwnership, N as readKnocks, Ni as DHT_MESSAGE_TTL, No as handoffCancelFrame, Nr as typingActivity, Ns as DEVICES_CAPABILITY, O as encodeGroupEntryLink, Oa as shownTime, Oc as randomBytes, Oi as TRANSPORTS, Oo as filePartName, Or as transferStalled, Os as createChatInvite, Pa as isAppKey, Pi as peekDhtMailbox, Po as handoffContext, Ps as ENROLL_CAPABILITY, Qa as formatLocalTarget, Qi as dhtEditId, Qn as CarriedTransport, Qo as readHandoffHello, Qs as nextTurnPosition, Qt as SEPOLIA_TEST_USDT_FAUCET, R as parseGroupWakeFrame, Rn as engineError, Ro as handoffEphemeral, Rr as pinIsNewer, Rs as deviceKeyZ32, S as GROUP_READ_NOTE_COMMUNITY, Sa as sameButtonText, Sc as publicKeyFromZ32, Si as receivedIdentityStatus, So as HANDOFF_OFFER, Sr as readBeaconHead, Ss as readEnrollHello, T as encodeCommunityLink, Ta as claimedTime, Tc as sanitizeAvatar, Ti as PeerProofs, To as HANDOFF_REQUEST, Tr as ChatFiles, Ts as deviceInviteJoinerParams, Ua as MEMBER_KEY, Un as fedimintRequestPayload, Uo as handoffReleaseFrame, Ur as deviceWakeRequest, Us as webCryptoSigner, Ut as encodeDidDhtDeactivated, V as GroupSession, Va as GROUP_MEMBER_CAP, Vn as ENDPOINT, Vo as handoffOfferFrame, Vr as WAKE_CALL_INTERVAL_MS, Vs as newDeviceSetSecret, Vt as didDhtDocument, W as GROUP_EDIT_TEXT_BYTES, Wa as rosterHas, Wn as findEndpoint, Wo as handoffRetryAfter, Wr as newWakeToken, Wt as encodeDidDhtPacket, Xa as presenceSeenAt, Xi as EDIT_RATE_WINDOW_MS, Xn as LIVENESS_PING_MS, Xo as readHandoffDone, Xr as chatAppId, Xs as TURN_MAX, Xt as PaymentPreflightError, Ya as RELAY_POLL_INTERVALS, Yi as EDIT_BUFFER_MS, Yn as INVITE_TAKEN, Yo as readHandoffCancel, Yr as vapidKeysMatch, Ys as TURN_LAST_SEQUENCE, Yt as ONCHAIN_PROVIDER, Za as GhostlyHttpError, Zi as RateWindow, Zn as pairedMessageFrame, Zo as readHandoffHave, Zr as isAppVersion, Zs as firstDeviceSetSecret, Zt as SEPOLIA_TEST_USDT, _ as groupTypingEpoch, _o as HANDOFF_ACK, _r as mergeLobby, _s as enrollDoneFrame, aa as ReactionWindow, ac as RelayTransport, ai as HoldRefusedError, an as validatePaymentTarget, ao as RTC_CONFIG, ar as MESH_HUBS, as as readSetUpdate, b as COMMUNITY_LIMITS, bc as identityFromSeed, bi as identityStatement, bo as HANDOFF_HAVE, br as rankHubs, bs as enrollProofFrame, c as APP_BUNDLE_LIMITS, ca as reactionEmoji, ci as CapsExchange, cn as SPARK_PROVIDER, cr as pickMeshHubs, cs as signTombstone, da as validReactionNumber, dc as isDiscoveryBudgetError, di as dialDescriptors, dn as isBitcoinAddress, do as parseCallSignal, dr as beaconRecords, ea as forwardedAgain, ec as signTurnPacket, ei as UPGRADE_CAPABILITY, en as USDT_PUBLIC_RPC, eo as webLocalFetch, es as readHandoffTurnFrame, fa as wireReaction, fc as withRequestOptions, fr as doorHubs, g as GroupTypingBoard, ga as BUTTON_ID, gi as IdentityExchange, go as serviceIdFromName, gr as mergeBeacon, gs as enrollDigits, ha as replySnippet, hc as createRelayPayload, ho as LEGACY_SERVICES, hr as lobbyRecords, hs as enrollCancelReason, ht as normalizeAtprotoHandle, i as planAppUpdate, ia as REACTION_LIMITS, ic as DEFAULT_RELAYS, ii as HoldKeys, in as formatPaymentAmount, ir as readGroupSignal, j as knockRecords, ja as appFingerprint, jc as utf8Decode, jo as handoffAttemptSucceeded, jr as TypingSender, k as entryParams, kc as toBase64Url, ki as automaticTransport, ko as handoffAttemptAllowed, ks as decodeInviteCode, l as APP_BUNDLE_MAGIC, la as reactionIsNewer, lc as traceLink, li as DHT_TEXT_CAPABILITY, ln as sparkAddressKind, lr as COMMUNITY_TOPOLOGY, ls as verifySetUpdate, m as readAppBundle, ma as readReply, mi as IDENTITY_REVOCATION_LABEL, mo as HTTP_SERVICE_PROTO, mr as lobbyKeys, ms as enrollCancelFrame, mt as isAtprotoDid, n as appUpdateDecision, na as COMMUNITY_REACTION_FRAME, nc as turnKeys, ni as HOLD_DATED_BACK_MS, nn as assertTokenUnits, no as decodeControl, ns as sealHandoffPiece, o as readAppStore, oa as nextReactionNumber, oc as currentRelays, oi as newMailbox, on as walletNetworkOf, or as mayBeHub, os as setAckFrame, p as isAppUrl, pa as pairedReplyAuthor, pc as PacketTooLargeError, pn as isPubkyKey, po as emptyLinkRecords, pr as freshHubs, q as mentionsMember, qa as DirectPathWatch, qn as parseFedimintRequestPayload, qo as newHandoffId, qr as wakeRequest, qs as classifyTurnRead, qt as ETHEREUM_USDT, r as checkAppBeforeRun, ra as GROUP_REACTION_FRAME, rc as turnName, ri as HOLD_LIMITS, rn as assertWholeSats, ro as encodeControl, rr as groupSignalFrame, sa as queueReaction, sc as normalizeRelayUrl, si as readManifest, sn as SPARK_NETWORKS, sr as meshHubs, ss as setUpdateFrame, t as appStoreDecision, ta as readForwarded, tc as signTurnRelease, ti as HOLD_CAPABILITY, tn as WALLET_NETWORKS, to as LIMITS, ts as readHandoffVerified, u as appDigest, ua as readReaction, uc as budgetRetryMs, ui as capsDescriptors, un as sparkInvoiceDetails, ur as beaconKeys, v as openGroupTyping, vi as emptyIdentityLedger, vo as HANDOFF_CANCEL, vr as newerHead, vs as enrollGrantFrame, w as decodeCommunityLink, wa as arrivalKey, wi as lastSharedWithMe, wo as HANDOFF_PIECE_BYTES, wr as shouldBeHub, ws as createDeviceInvite, x as CommunitySession, xa as checkStatusCard, xc as identityFromSeedB64, xi as newIdentityBinding, xo as HANDOFF_HELLO, xr as readBeacon, xs as readEnrollGrant, y as sealGroupTyping, ya as STATUS_CARD_LIMITS, yc as createIdentity, yi as identityRevocationValue, yo as HANDOFF_DONE, yr as pickHubs, ys as enrollHelloFrame, za as canonicalJson, zi as safeBlobType, zn as engineText, zo as handoffHelloFrame, zr as pinNumberHolds, zs as deviceLinkPairing } from "./src-C6qQYrAH.js";
+import { a as clearProfileStores, c as fileStore, d as store, f as transact, i as STORES$1, l as openDb, n as APP_STORAGE_SCOPE_INDEX, o as databaseName, p as wrap, r as CARD_INDEX, s as deleteDatabase, t as APP_STORAGE_CHAT_INDEX, u as profileOpenFailure } from "./idb-BIdus0WX.js";
+import { a as fileBytesOf, c as removeFileBytes, i as fileBytes, l as FILE_BYTES_STEP, n as blobDigest } from "./fileBytes-3AQ2tJzW.js";
+import { $ as BACKUP_MEDIA_TYPE, A as requireTurn, At as streamStored, B as networkLabel, C as breezDatabasesFor, Ct as replyTo, D as sourceKey, Dt as readStored$1, E as ProviderSources, Et as FileAppender, F as sealSeed, G as BITCOIN_INVOICE_ON_TESTNET, H as cashuMint, I as unsealSeed, J as fakesLightning, K as DEFAULT_MINTS, L as ModeChanged, M as setSingleWriterGate, N as intentRepository, O as awayFrom, Ot as removeStored, P as newDeviceKey, Q as paysItsOwnInvoices, R as ModeGate, S as breezDatabaseInUse, St as replyRef, T as lightningPaying, Tt as paymentWireId, V as CASHU_MINT_SOURCE, W as WALLET_TYPES, X as isWorthlessMint, Y as isTestMint, Z as mintNetwork, _ as LightningCards, _t as verifyIdentity, a as irohRelayProblem, at as reserveAdapterIds, b as normalizePhrase, bt as pairedWireReply, c as createFailure, ct as SourceConfigError, d as paymentNetwork, dt as networkMode, et as MAX_BACKUP_BYTES, f as paymentNetworksOf, ft as redact, g as CASHU_CARD, gt as boundedIdentityFetch, h as rpcHost, ht as setOwnDidSource, i as createIrohWebEndpoint, it as registeredOnchainProviders, j as setAwayWallets, k as refuseAway, kt as storedSize, l as createTiming, lt as SourceUnreachableError, m as networkReason, mt as resolveAtprotoDid, n as loadFedimintSdk, nt as onAdaptersChanged, o as WALLET_NAMES, ot as NothingSpentError, p as walletInstances, pt as assertPublicServer, q as TEST_MINT, r as DEFAULT_IROH_RELAYS, rt as registeredLightningProviders, s as assertConfirmedReal, st as PROVIDER_PLATFORMS, t as fedimintDatabase, tt as identityProviders, u as crossNetwork, ut as isNothingSpentError, v as cardsKey, vt as chosenResolver, w as dropBreezDatabase, wt as paymentAlias, x as breezDatabase, xt as receivedPairedReply, y as isRecoveryPhrase, yt as groupReply, z as WrongNetworkError } from "../ghostly.mjs";
+import { n as traceJoin } from "./joinTrace-CO8mlhNO.js";
 import { hkdf } from "@noble/hashes/hkdf.js";
 import { sha256 } from "@noble/hashes/sha2.js";
 import { base64, base64url, base64urlnopad, bech32, hex } from "@scure/base";
@@ -190,6 +192,27 @@ var erc20 = new Interface([
 ]);
 var same$1 = (a, b) => a.toLowerCase() === b.toLowerCase();
 var CONFIRMATIONS = 2;
+/** The JSON-RPC methods that only read: asked again once when they fail (see `UsdtAdapter.rpc`). */
+var RETRIED_READS = /* @__PURE__ */ new Set([
+	"eth_chainId",
+	"eth_getCode",
+	"eth_call",
+	"eth_getBalance",
+	"eth_blockNumber",
+	"eth_getLogs",
+	"eth_getTransactionCount",
+	"eth_estimateGas",
+	"eth_getBlockByNumber",
+	"eth_maxPriorityFeePerGas",
+	"eth_gasPrice",
+	"eth_feeHistory",
+	"eth_getTransactionByHash",
+	"eth_getTransactionReceipt"
+]);
+var RETRY_AFTER_MS = 1e3;
+/** Failures that would fail the same way again at once: not retried. */
+var FINAL = /* @__PURE__ */ new WeakSet();
+var timedOut = (error) => error instanceof Error && (error.name === "AbortError" || error.name === "TimeoutError");
 /**
 * The `provider` a request carries to the contact. Which RPC pays is the payer's own choice, so it names none of
 * this wallet's: a typed RPC URL may hold an API key (`/v3/<key>`), and every contact would read it. Older apps
@@ -259,7 +282,22 @@ var UsdtAdapter = class UsdtAdapter {
 		adapter.account = await adapter.manager.getAccount(0);
 		return adapter;
 	}
+	/**
+	* A read that fails is asked again, once, a moment later: a public RPC drops a request now and then, and a chain that
+	* just made a block can refuse a read of "latest" it no longer holds. Without it a network switch, a restore or New
+	* gave up on the first such answer. Never a broadcast or anything else that writes, nor a request that did not answer
+	* in time (the person would wait twice as long), nor one the server refused as such (4xx).
+	*/
 	async rpc(method, params = []) {
+		try {
+			return await this.ask(method, params);
+		} catch (error) {
+			if (!RETRIED_READS.has(method) || FINAL.has(error)) throw error;
+			await new Promise((resolve) => setTimeout(resolve, RETRY_AFTER_MS));
+			return this.ask(method, params);
+		}
+	}
+	async ask(method, params) {
 		let response;
 		try {
 			response = await fetch(this.config.provider, {
@@ -275,9 +313,15 @@ var UsdtAdapter = class UsdtAdapter {
 			});
 		} catch (error) {
 			const reason = networkReason(error, rpcHost(this.config.provider));
-			throw reason ? Object.assign(new Error(reason), { cause: error }) : error;
+			const thrown = reason ? Object.assign(new Error(reason), { cause: error }) : error;
+			if (timedOut(error) && thrown && typeof thrown === "object") FINAL.add(thrown);
+			throw thrown;
+		}
+		if (!response.ok) {
+			const error = engineError("usdtRpcUnavailable");
+			if (response.status !== 429 && response.status < 500) FINAL.add(error);
+			throw error;
 		}
-		if (!response.ok) throw engineError("usdtRpcUnavailable");
 		const result = await response.json();
 		if (result.error || !Object.prototype.hasOwnProperty.call(result, "result")) throw new Error("USDT RPC rejected the operation");
 		return result.result;
@@ -1259,6 +1303,12 @@ var ArkadeAdapter = class ArkadeAdapter {
 };
 //#endregion
 //#region ../browser/src/engine/paymentAdapters/backup.ts
+/**
+* Wallet database versions a backup may carry. 3 is what SDK 0.4.74-0.4.76 made (Ghostly 1.1.3 and earlier);
+* 4 is SDK 0.4.78's, which adds the vtxos `scriptUnspent` index. An older one is restored at its own version
+* and the SDK upgrades it the first time the wallet opens. arkBackupSchema.test.ts fails when the SDK moves on.
+*/
+var ARK_DB_VERSIONS = [3, 4];
 var allowed = /* @__PURE__ */ new Set([
 	"vtxos",
 	"utxos",
@@ -1315,7 +1365,7 @@ async function snapshotArkDatabase(walletId) {
 }
 /** Only imports into a freshly allocated database; never replaces an existing wallet. */
 async function restoreArkDatabase(walletId, snapshot) {
-	if (snapshot.version !== 3 || !Array.isArray(snapshot.stores) || snapshot.stores.length > allowed.size || new Set(snapshot.stores.map((s) => s.name)).size !== snapshot.stores.length || snapshot.stores.some((s) => !allowed.has(s.name) || !Array.isArray(s.values) || !Array.isArray(s.keys) || s.values.length !== s.keys.length)) throw new Error("Unsupported Ark backup schema");
+	if (!ARK_DB_VERSIONS.includes(snapshot.version) || !Array.isArray(snapshot.stores) || snapshot.stores.length > allowed.size || new Set(snapshot.stores.map((s) => s.name)).size !== snapshot.stores.length || snapshot.stores.some((s) => !allowed.has(s.name) || !Array.isArray(s.values) || !Array.isArray(s.keys) || s.values.length !== s.keys.length)) throw new Error("Unsupported Ark backup schema");
 	for (const name of [
 		"vtxos",
 		"utxos",
@@ -3330,7 +3380,7 @@ var loading$2;
 /** Loads the WebAssembly once, on first use: profiles that never pick Breez never fetch its 12.8 MB. */
 function loadBreezSdk() {
 	return loading$2 ??= (async () => {
-		const breez = await import("./web-OUQl4Q7L.js");
+		const breez = await import("./web-DwgdhfcY.js");
 		await breez.default();
 		return { async connect({ network, mnemonic, apiKey, storage }) {
 			const config = breez.defaultConfig(network);
@@ -6127,7 +6177,7 @@ var COMMANDO_NOT_RUN = {
 };
 var MAX_REPLY = 4194304;
 /** One websocket frame may carry many Lightning messages; one this large is not an answer to anything. */
-var MAX_FRAME$1 = 4259840;
+var MAX_FRAME = 4259840;
 var text$1 = new TextDecoder();
 /**
 * One connection to a node, opened on first use and again after it drops. Calls run concurrently, matched
@@ -6231,7 +6281,7 @@ var CommandoClient = class {
 			ws.onmessage = ({ data }) => {
 				if (!(data instanceof ArrayBuffer) && !ArrayBuffer.isView(data)) return fail("The node sent something that is not binary");
 				const chunk = data instanceof ArrayBuffer ? new Uint8Array(data) : new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
-				if (chunk.length > MAX_FRAME$1) return fail("The node sent more than it was asked for");
+				if (chunk.length > MAX_FRAME) return fail("The node sent more than it was asked for");
 				buffer = concatBytes(buffer, chunk);
 				try {
 					if (stage === "act2") {
@@ -8432,6 +8482,16 @@ var REVOCATIONS = "identityRevocations";
 var REPUBLISH_MS$1 = 36e5;
 /** How often the contacts' proofs are looked up for a revocation (and once shortly after start). */
 var REVOCATION_CHECK_MS = 432e5;
+/**
+* After a contact withdraws a proof, how long to wait before each lookup for its revocation (WISP 300: removing a proof withdraws it from
+* every chat and revokes it). The notice goes out before the revocation is published, so not at once; each try backs
+* off, and the first that finds it stops the rest. The 12 h check covers it after that.
+*/
+var WITHDRAWN_REVOCATION_TRIES_MS = [
+	2e4,
+	6e4,
+	18e4
+];
 var DRAFT_TTL = 18e5;
 var MAX_DRAFTS$1 = 4;
 var MAX_PROOFS = 32;
@@ -8644,10 +8704,31 @@ var IdentityProofs = class {
 		}
 		for (const r of live) await this.publishRevocation(r).catch(() => {});
 	}
-	/** Looks up every contact's current proofs for a revocation (the Pkarr record only, not the provider). */
+	/**
+	* Looks up the contacts' proofs for a revocation (the Pkarr record only, not the provider): the ones standing, and the
+	* ones withdrawn, which a removal also revokes. Not a proof already revoked, nor one past its expiry: its owner
+	* publishes the revocation only until then.
+	*/
 	async checkRevocations() {
 		if (!this.host.online()) return;
-		for (const linkId of this.host.linkIds()) for (const r of this.host.ledger(linkId)?.received ?? []) if (r.status === "verified" || r.status === "unconfirmed") await this.exchange(linkId)?.recheck(r.id, { revocationOnly: true }).catch(() => {});
+		for (const linkId of this.host.linkIds()) for (const r of this.host.ledger(linkId)?.received ?? []) if (this.revocable(r)) await this.exchange(linkId)?.recheck(r.id, { revocationOnly: true }).catch(() => {});
+	}
+	revocable(r) {
+		return r.status !== "revoked" && Math.min(r.binding.expiresAt, r.verified.expiresAt ?? Infinity) > now();
+	}
+	/** A proof the contact just withdrew: looked up for its revocation a few times (`WITHDRAWN_REVOCATION_TRIES_MS`). */
+	afterWithdrawal(linkId, id, tries = WITHDRAWN_REVOCATION_TRIES_MS) {
+		const [wait, ...rest] = tries;
+		if (wait === void 0) return;
+		const timer = setTimeout(() => {
+			this.timers = this.timers.filter((t) => t !== timer);
+			const r = this.host.ledger(linkId)?.received.find((x) => x.id === id);
+			if (!r || r.status !== "withdrawn" || !this.revocable(r)) return;
+			(async () => {
+				if ((this.host.online() ? await this.exchange(linkId)?.recheck(id, { revocationOnly: true }).catch(() => void 0) : void 0)?.status !== "revoked") this.afterWithdrawal(linkId, id, rest);
+			})();
+		}, wait);
+		this.timers.push(timer);
 	}
 	views() {
 		return this.proofs.map((p) => this.viewOf(p));
@@ -8751,8 +8832,12 @@ var IdentityProofs = class {
 		}));
 		this.host.emit();
 	}
-	frame(linkId, frame) {
-		return this.exchange(linkId)?.receive(frame) ?? Promise.resolve();
+	async frame(linkId, frame) {
+		const x = this.exchange(linkId);
+		if (!x) return;
+		const withdrawn = frame.t === "idp-withdraw" && typeof frame.id === "string" && this.host.ledger(linkId)?.received.some((r) => r.id === frame.id && r.status !== "withdrawn" && r.status !== "revoked");
+		await x.receive(frame);
+		if (withdrawn && this.host.ledger(linkId)?.received.some((r) => r.id === frame.id && r.status === "withdrawn")) this.afterWithdrawal(linkId, frame.id);
 	}
 	ready(linkId) {
 		if (this.greeted.has(linkId) || !this.host.channel(linkId)) return;
@@ -11620,6 +11705,1159 @@ var eachNetwork = (value) => "mainnet" in value && "testnet" in value ? value :
 	testnet: value
 };
 //#endregion
+//#region ../browser/src/engine/appFetch.ts
+/** The hosts phase 1 reads from. A jsDelivr URL must also name a 40-character commit (`isAppUrl`). */
+var APP_FETCH_HOSTS = ["raw.githubusercontent.com", "cdn.jsdelivr.net"];
+var APP_FETCH_LIMITS = {
+	/**
+	* A store index as read (WISP 1200 § Stores, Privacy): 4 MiB in phase 1, under the format's 16 MiB. Counted on the body
+	* as it arrives, after the browser undid any compression, since a page never sees the compressed size.
+	*/
+	storeIndexBytes: 4194304,
+	/** A store's signature statement, `ghostly-store.sig` (canonical, at most 1 KiB). */
+	sigBytes: 1024,
+	/** `ghostly-revoke.json`: at most 4096 signed revocations. */
+	revocationsBytes: 16777216,
+	timeoutMs: 3e4
+};
+/** A URL this client may read an app, a store or a revocation list from. */
+function isAppFetchUrl(value) {
+	if (!isAppUrl(value)) return false;
+	const url = new URL(value);
+	return url.port === "" && APP_FETCH_HOSTS.includes(url.hostname.toLowerCase());
+}
+var AppFetchError = class extends Error {
+	code;
+	status;
+	constructor(code, message, status) {
+		super(`${code}: ${message}`);
+		this.code = code;
+		this.status = status;
+		this.name = "AppFetchError";
+	}
+};
+function boundedAppFetch(options = {}) {
+	return async (url, { maxBytes, peek = false }) => {
+		if (!isAppFetchUrl(url)) throw new AppFetchError("host", "Apps are read only from raw.githubusercontent.com, or from cdn.jsdelivr.net at a commit, over HTTPS");
+		if (options.online && !options.online()) throw new AppFetchError("offline", "Offline");
+		const fetcher = options.fetcher ?? globalThis.fetch.bind(globalThis);
+		let response;
+		try {
+			response = await fetcher(url, {
+				signal: AbortSignal.timeout(options.timeoutMs ?? APP_FETCH_LIMITS.timeoutMs),
+				credentials: "omit",
+				referrerPolicy: "no-referrer",
+				cache: "no-store",
+				redirect: "error",
+				...peek && { headers: { range: `bytes=0-${maxBytes - 1}` } }
+			});
+		} catch (error) {
+			throw new AppFetchError("network", error instanceof Error ? error.message : String(error));
+		}
+		if (response.url && response.url !== url && !isAppFetchUrl(response.url)) throw new AppFetchError("host", "The host sent the request elsewhere");
+		if (!response.ok) {
+			await response.body?.cancel().catch(() => {});
+			throw new AppFetchError("status", `The host answered ${response.status}`, response.status);
+		}
+		if (!peek && Number(response.headers.get("content-length")) > maxBytes) {
+			await response.body?.cancel().catch(() => {});
+			throw new AppFetchError("too-large", "Too large");
+		}
+		const parts = [];
+		let length = 0;
+		const reader = response.body?.getReader();
+		if (reader) try {
+			for (;;) {
+				const { done, value } = await reader.read();
+				if (done) break;
+				if (length + value.length > maxBytes) {
+					if (!peek) throw new AppFetchError("too-large", "Too large");
+					parts.push(value.subarray(0, maxBytes - length));
+					length = maxBytes;
+					break;
+				}
+				parts.push(value);
+				length += value.length;
+			}
+		} catch (error) {
+			if (error instanceof AppFetchError) throw error;
+			throw new AppFetchError("network", error instanceof Error ? error.message : String(error));
+		} finally {
+			await reader.cancel().catch(() => {});
+		}
+		const bytes = new Uint8Array(length);
+		let at = 0;
+		for (const part of parts) {
+			bytes.set(part, at);
+			at += part.length;
+		}
+		return bytes;
+	};
+}
+var NAME = /^[A-Za-z0-9_.-]+$/;
+/**
+* The URL a pasted address reads `file` from (WISP 1200 § Paste a URL), or null when it is not one this client reads:
+* - `https://github.com/<owner>/<repo>`, or `/tree/<ref>`: `raw.githubusercontent.com/<owner>/<repo>/<ref or HEAD>/<file>`,
+*   with no request to `github.com` or `api.github.com`;
+* - a file as GitHub shows it, `https://github.com/<owner>/<repo>/blob/<ref>/<path>` (or `/raw/`), naming a `.ghostlyapp`
+*   or `.json` file: `raw.githubusercontent.com/<owner>/<repo>/<ref>/<path>`, again with no request to `github.com`;
+* - a URL of the list that names a file (`….ghostlyapp`, `….json`): itself;
+* - a URL of the list that names a folder: `<file>` in it.
+*/
+function appPasteUrl(input, file) {
+	let url;
+	try {
+		url = new URL(input.trim());
+	} catch {
+		return null;
+	}
+	if (url.protocol !== "https:" || url.username || url.password || url.port) return null;
+	const host = url.hostname.toLowerCase();
+	if (host === "github.com" || host === "www.github.com") {
+		const parts = url.pathname.split("/").filter(Boolean);
+		if (parts.length < 2) return null;
+		const owner = parts[0], repo = parts[1].replace(/\.git$/, "");
+		if (!NAME.test(owner) || !NAME.test(repo)) return null;
+		let ref = "HEAD";
+		if (parts.length > 2) {
+			const rest = parts.slice(3);
+			if (!rest.length || !rest.every((p) => NAME.test(p) && p !== "." && p !== "..")) return null;
+			if (parts[2] === "blob" || parts[2] === "raw") {
+				if (rest.length < 2 || !/\.(ghostlyapp|json)$/.test(rest[rest.length - 1])) return null;
+				const raw = `https://raw.githubusercontent.com/${owner}/${repo}/${rest.join("/")}`;
+				return isAppFetchUrl(raw) ? raw : null;
+			}
+			if (parts[2] !== "tree") return null;
+			ref = rest.join("/");
+		}
+		const raw = `https://raw.githubusercontent.com/${owner}/${repo}/${ref}/${file}`;
+		return isAppFetchUrl(raw) ? raw : null;
+	}
+	const last = url.pathname.split("/").pop() ?? "";
+	const named = /\.(ghostlyapp|json)$/.test(last) ? url.href : new URL(`${url.pathname.replace(/\/?$/, "/")}${file}`, url).href;
+	return isAppFetchUrl(named) ? named : null;
+}
+/** A page of github.com (any scheme): a link `appPasteUrl` could not read is still GitHub, and is answered as such. */
+function isGitHubPage(input) {
+	try {
+		const host = new URL(input.trim()).hostname.toLowerCase();
+		return host === "github.com" || host === "www.github.com";
+	} catch {
+		return false;
+	}
+}
+/** A file beside another (`ghostly-store.sig` beside the index, `ghostly-revoke.json` beside a bundle). */
+function besideUrl(url, name) {
+	const target = new URL(url);
+	target.search = "";
+	target.hash = "";
+	return new URL(name, target).href;
+}
+/**
+* The stores a new profile starts with (WISP 1200 § Stores: the default store, preloaded and removable), each a URL and
+* the store key it is pinned to. Preloading one makes no request; the first read comes when the person opens the Apps
+* page or once an app is installed.
+*/
+var DEFAULT_APP_STORES = [{
+	url: "https://raw.githubusercontent.com/MiguelMedeiros/ghostly-store/HEAD/ghostly-store.json",
+	key: "y379ia3t1urwudj8o4w1qwmuwp1mcxyf956b5r7pqup7stce6diy"
+}];
+var APP_STORAGE_LIMITS = {
+	/** A key, in UTF-8 bytes. */
+	keyBytes: 256,
+	/** A value, as compact JSON in UTF-8 bytes. */
+	valueBytes: 65536,
+	/** Every key and value of one app in one scope. */
+	scopeBytes: 5242880
+};
+var APP_CHECK_TIMINGS = {
+	/** After the engine starts, so the chats come up first. */
+	afterStartMs: 6e4,
+	everyMs: 864e5,
+	/** A check at start is skipped when every app was checked this recently (a page reloaded several times). */
+	freshMs: 36e5
+};
+/** A fetched bundle kept for its install screen: at most this many, for this long. */
+var STAGED = {
+	max: 4,
+	ms: 6e5
+};
+/** The first bytes of a bundle: magic, the manifest's length and the largest manifest. */
+var PEEK_BYTES = APP_BUNDLE_MAGIC.length + 4 + APP_BUNDLE_LIMITS.manifestBytes;
+var bundleId = (digest) => `app-${digest}`;
+/** An error whose message starts with its code (`<code>: words`), as it crosses the engine's RPC. */
+function fail(code, words) {
+	throw new Error(`${code}: ${words}`);
+}
+/**
+* Why a pasted link is not read: a github.com page that is neither a repository nor a file of one (`github-link`), so
+* the person is not told GitHub is off the list; any other host (`host`).
+*/
+function notReadable(url, words) {
+	if (typeof url === "string" && isGitHubPage(url)) fail("github-link", "Paste the repository's link, or the link to its app file");
+	fail("host", words);
+}
+var versionOf = (manifest, digest) => ({
+	ref: appRef(manifest.publisher, manifest.name),
+	sequence: manifest.sequence,
+	digest
+});
+var byteLength = (text) => utf8Encode(text).length;
+/** Rows of one app (`[ref]`), or of one app in one scope (`[ref, scope]`), in `STORES.appStorage`. */
+var rowsOf = (...prefix) => IDBKeyRange.bound(prefix, [...prefix, []]);
+function done(tx) {
+	return new Promise((resolve, reject) => {
+		tx.oncomplete = () => resolve();
+		tx.onerror = tx.onabort = () => reject(tx.error ?? /* @__PURE__ */ new Error("App storage failed"));
+	});
+}
+/**
+* The manifest of a bundle's first bytes, unchecked: only to see whether a source holds something newer before reading
+* all of it. Whatever it says, the whole bundle is checked before anything is kept.
+*/
+function peekAppManifest(bytes) {
+	const magic = utf8Encode(APP_BUNDLE_MAGIC);
+	if (bytes.length < magic.length + 4 || !magic.every((b, i) => bytes[i] === b)) return null;
+	const length = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength).getUint32(magic.length);
+	if (length > APP_BUNDLE_LIMITS.manifestBytes || bytes.length < magic.length + 4 + length) return null;
+	const manifestBytes = bytes.subarray(magic.length + 4, magic.length + 4 + length);
+	try {
+		const manifest = JSON.parse(utf8Decode(manifestBytes));
+		const ref = typeof manifest.publisher === "string" && typeof manifest.name === "string" ? appRef(manifest.publisher, manifest.name) : "";
+		if (!isAppRef(ref) || typeof manifest.sequence !== "number" || !Number.isSafeInteger(manifest.sequence)) return null;
+		return {
+			ref,
+			sequence: manifest.sequence,
+			digest: appDigest(manifestBytes)
+		};
+	} catch {
+		return null;
+	}
+}
+var Apps = class {
+	host;
+	staged = /* @__PURE__ */ new Map();
+	/** Bundles read back and checked, by digest: the one running is read once, not on every `file`. */
+	verified = /* @__PURE__ */ new Map();
+	/** Bytes used per `ref\0scope`, counted once from the rows and kept in step by the writes here. */
+	usage = /* @__PURE__ */ new Map();
+	queues = /* @__PURE__ */ new Map();
+	timer = null;
+	checking = null;
+	/** Runs the person started with Run anyway (`<ref> <digest>`), for this engine's life: a removal does not cut them off. */
+	anyway = /* @__PURE__ */ new Set();
+	stopped = false;
+	constructor(host) {
+		this.host = host;
+	}
+	now() {
+		return (this.host.now ?? Date.now)();
+	}
+	nowS() {
+		return Math.floor(this.now() / 1e3);
+	}
+	/** Preloads the default stores (no request), then checks for updates soon after start and every 24 hours. */
+	async start() {
+		this.stopped = false;
+		await this.seedDefaults();
+		this.schedule(APP_CHECK_TIMINGS.afterStartMs, true);
+	}
+	stop() {
+		this.stopped = true;
+		if (this.timer) clearTimeout(this.timer);
+		this.timer = null;
+	}
+	schedule(ms, atStart = false) {
+		if (this.timer) clearTimeout(this.timer);
+		this.timer = setTimeout(() => {
+			this.timer = null;
+			(async () => {
+				if (this.stopped) return;
+				if (this.host.online()) {
+					const apps = await this.installed();
+					const fresh = atStart && apps.length > 0 && apps.every((a) => a.checkedAt !== void 0 && this.now() - a.checkedAt < APP_CHECK_TIMINGS.freshMs);
+					if (apps.length && !fresh) await this.checkUpdates().catch(() => {});
+				}
+				if (!this.stopped) this.schedule(APP_CHECK_TIMINGS.everyMs);
+			})();
+		}, ms);
+	}
+	async seedDefaults() {
+		for (const d of this.host.defaults ?? DEFAULT_APP_STORES) {
+			if (!isAppKey(d.key) || !isAppFetchUrl(d.url)) continue;
+			if (await this.storeRecord(d.key)) continue;
+			await this.putStore({
+				key: d.key,
+				url: d.url,
+				addedAt: this.now(),
+				preloaded: true
+			});
+		}
+	}
+	async installed() {
+		return wrap((await store(STORES$1.apps, "readonly")).getAll());
+	}
+	async app(ref) {
+		return wrap((await store(STORES$1.apps, "readonly")).get(ref));
+	}
+	async installedOrFail(ref) {
+		if (!isAppRef(ref)) fail("bad-ref", "Not an app reference");
+		return await this.app(ref) ?? fail("not-installed", "This app is not installed");
+	}
+	/**
+	* An installed app that may still run (WISP 1200 § Takedowns): a running app whose version its publisher revoked, or
+	* a store of the person's removed (unless this run was started with Run anyway), is cut off with `stopped`, whether
+	* or not the page stops its frame.
+	*/
+	async stillRunnable(app) {
+		const run = this.runStatus(app, await this.stores(), app.revocations);
+		if (run.status === "revoked") fail("stopped", "Its publisher revoked this version");
+		if (run.status === "removed" && !this.anyway.has(`${app.ref} ${app.digest}`)) fail("stopped", `Removed by ${run.by[0].name}: ${run.by[0].reason}`);
+		return app;
+	}
+	async runningOrFail(ref) {
+		return this.stillRunnable(await this.installedOrFail(ref));
+	}
+	/**
+	* Before an app's frames go to a contact (`appOpen`, `appSend`): refused with `stopped` as its storage is. A reference
+	* not installed here (a bot that speaks an app's messages) is not this store's to refuse.
+	*/
+	async chatRunnable({ ref }) {
+		const app = isAppRef(ref) ? await this.app(ref) : void 0;
+		if (app) await this.stillRunnable(app);
+	}
+	async putApp(app) {
+		await wrap((await store(STORES$1.apps, "readwrite")).put(app));
+	}
+	async storeRecord(key) {
+		return wrap((await store(STORES$1.appStores, "readonly")).get(key));
+	}
+	async putStore(record) {
+		await wrap((await store(STORES$1.appStores, "readwrite")).put(record));
+	}
+	/** The stores the person has (a removed default is not one). */
+	async stores() {
+		return (await wrap((await store(STORES$1.appStores, "readonly")).getAll())).filter((s) => !s.removed);
+	}
+	storeViews(stores) {
+		return stores.filter((s) => s.index).map((s) => ({
+			key: s.key,
+			name: s.index.name,
+			kind: s.index.kind,
+			removed: s.index.removed,
+			revoked: s.index.revoked
+		}));
+	}
+	listedBy(ref, stores) {
+		return stores.filter((s) => s.index?.apps.some((a) => a.ref === ref)).map((s) => ({
+			key: s.key,
+			name: s.index.name,
+			kind: s.index.kind
+		}));
+	}
+	runStatus(version, stores, revocations = []) {
+		const check = checkAppBeforeRun(version, this.storeViews(stores), revocations);
+		if (check.status === "revoked") return {
+			status: "revoked",
+			...check.revocation.statement.reason && { reason: check.revocation.statement.reason }
+		};
+		return check;
+	}
+	/**
+	* Stores a bundle's bytes. A browser that keeps no files fails here: Safari's Private Browsing (and WebKit's in-memory
+	* contexts) refuses a Blob in IndexedDB with "Error preparing Blob/File data to be stored in object store". Any such
+	* failure is `storage`, with the browser's own words after it for the logs, and leaves no piece behind.
+	*/
+	async writeBundle(digest, bytes) {
+		const id = bundleId(digest);
+		const expected = toBase64Url(sha256(bytes));
+		let files;
+		let stored;
+		try {
+			files = await fileBytes();
+			const size = await files.size(id);
+			if (size === bytes.length && await files.digest(id) === expected) return files.kind;
+			if (size !== null) await files.remove(id);
+			for (let at = 0; at < bytes.length; at += FILE_BYTES_STEP) await files.append(id, at, bytes.subarray(at, at + FILE_BYTES_STEP));
+			await files.flush(id);
+			await files.close(id);
+			stored = await files.digest(id);
+		} catch (e) {
+			await files?.close(id).catch(() => {});
+			await files?.remove(id).catch(() => {});
+			const words = e instanceof Error ? `${e.name}: ${e.message}` : String(e);
+			console.warn("[apps] storage:", words);
+			fail("storage", `The app's files could not be stored on this device (${words})`);
+		}
+		if (stored !== expected) {
+			await files.remove(id).catch(() => {});
+			fail("storage", "The app's files could not be stored on this device");
+		}
+		return files.kind;
+	}
+	async readBundleBytes(kind, digest) {
+		const files = await fileBytesOf(kind);
+		const id = bundleId(digest);
+		const size = files ? await files.size(id) : null;
+		if (!files || size === null || size > APP_BUNDLE_LIMITS.bundleBytes) return null;
+		const out = new Uint8Array(size);
+		for (let at = 0; at < size;) {
+			const part = await files.read(id, at, Math.min(FILE_BYTES_STEP, size - at));
+			if (!part.length) return null;
+			out.set(part, at);
+			at += part.length;
+		}
+		return out;
+	}
+	async hasBundle(kind, digest) {
+		const files = await fileBytesOf(kind);
+		return !!files && await files.size(bundleId(digest)) !== null;
+	}
+	async removeBundle(kind, digest) {
+		this.verified.delete(digest);
+		await (await fileBytesOf(kind))?.remove(bundleId(digest)).catch(() => {});
+	}
+	/** The installed bundle read back and checked again before it runs (WISP 1200 § Signatures: "again before it runs one"). */
+	async verifiedBundle(app) {
+		const kept = this.verified.get(app.digest);
+		if (kept) return kept;
+		const bytes = await this.readBundleBytes(app.bytes, app.digest);
+		if (!bytes) fail("needs-files", "This app's files are not on this device yet");
+		const read = readAppBundle(bytes);
+		if (!read.ok || read.bundle.digest !== app.digest) fail("damaged", "This app's stored files do not match what was installed");
+		if (this.verified.size >= 2) this.verified.delete(this.verified.keys().next().value);
+		this.verified.set(app.digest, read.bundle);
+		return read.bundle;
+	}
+	async fetchBundle(url) {
+		const bytes = await this.host.fetch(url, { maxBytes: APP_BUNDLE_LIMITS.bundleBytes });
+		const read = readAppBundle(bytes);
+		if (!read.ok) fail(read.reason, `This is not an app Ghostly can install${read.detail ? ` (${read.detail})` : ""}`);
+		return {
+			bundle: read.bundle,
+			bytes
+		};
+	}
+	async readStoreAt(url, heldKey) {
+		const [indexBytes, sigBytes] = await Promise.all([this.host.fetch(url, { maxBytes: APP_FETCH_LIMITS.storeIndexBytes }), this.host.fetch(besideUrl(url, "ghostly-store.sig"), { maxBytes: APP_FETCH_LIMITS.sigBytes })]);
+		return readAppStore(indexBytes, sigBytes, this.nowS(), heldKey);
+	}
+	/** The revocations its publisher signed, read beside each URL (`ghostly-revoke.json`); none there is not an error. */
+	async readRevocations(ref, urls) {
+		const out = [];
+		for (const url of new Set(urls.filter(isAppFetchUrl).map((u) => besideUrl(u, "ghostly-revoke.json")))) try {
+			const read = readAppRevocations(await this.host.fetch(url, { maxBytes: APP_FETCH_LIMITS.revocationsBytes }));
+			if (read.ok) out.push(...read.revocations.filter((r) => r.statement.app === ref));
+		} catch {}
+		return out;
+	}
+	summary(s) {
+		const index = s.index;
+		return {
+			key: s.key,
+			fingerprint: appFingerprint(s.key),
+			url: s.url,
+			preloaded: !!s.preloaded,
+			...index && {
+				name: index.name,
+				kind: index.kind,
+				sequence: index.sequence,
+				expires: index.expires,
+				...index.description !== void 0 && { description: index.description }
+			},
+			expired: !!index && index.expires < this.nowS(),
+			...s.fetchedAt !== void 0 && { fetchedAt: s.fetchedAt },
+			apps: index?.apps ?? [],
+			removed: index?.removed ?? [],
+			...s.equivocation && { equivocation: {
+				sequence: s.equivocation.sequence,
+				at: s.equivocation.at
+			} },
+			...s.problem && { problem: s.problem }
+		};
+	}
+	async listStores() {
+		return (await this.stores()).sort((a, b) => a.addedAt - b.addedAt).map((s) => this.summary(s));
+	}
+	storeUrl(url) {
+		return typeof url === "string" && appPasteUrl(url, "ghostly-store.json") || notReadable(url, "Stores are read only from raw.githubusercontent.com, or from cdn.jsdelivr.net at a commit, over HTTPS");
+	}
+	/** Reads a store at a URL for the person to see before adding it. Nothing is kept. */
+	async previewStore({ url }) {
+		const at = this.storeUrl(url);
+		const read = await this.readStoreAt(at);
+		if (!read.ok) fail(read.reason, "This is not a store Ghostly can read");
+		const { index } = read.store;
+		return {
+			url: at,
+			key: index.key,
+			fingerprint: appFingerprint(index.key),
+			name: index.name,
+			kind: index.kind,
+			sequence: index.sequence,
+			expires: index.expires,
+			expired: read.store.expired,
+			apps: index.apps.length,
+			...index.description !== void 0 && { description: index.description }
+		};
+	}
+	/**
+	* Adds a store the person chose: read at its URL and pinned to its key (`key`, when given, is the key the person saw,
+	* and another one is refused). A store already added under that key takes the URL and the newer index.
+	*/
+	async addStore({ url, key }) {
+		if (key !== void 0 && !isAppKey(key)) fail("store-key", "Not a store key");
+		const at = this.storeUrl(url);
+		const read = await this.readStoreAt(at, key);
+		if (!read.ok) fail(read.reason, "This is not a store Ghostly can read");
+		const { index, digest } = read.store;
+		const held = await this.storeRecord(index.key);
+		const record = held && !held.removed ? {
+			...held,
+			url: at
+		} : {
+			key: index.key,
+			url: at,
+			addedAt: this.now(),
+			...held?.preloaded && { preloaded: true }
+		};
+		await this.putStore(this.withIndex(record, index, digest));
+		return this.summary(await this.storeRecord(index.key));
+	}
+	/** The update rule for indexes (WISP 1200 § Stores): a lower `sequence` or the same one with other bytes is refused, the held one kept. */
+	withIndex(record, index, digest) {
+		const held = record.index ? {
+			key: record.key,
+			sequence: record.index.sequence,
+			digest: record.digest ?? ""
+		} : null;
+		const decision = appStoreDecision(held, {
+			key: index.key,
+			sequence: index.sequence,
+			digest
+		});
+		const { problem: _problem, ...rest } = record;
+		switch (decision) {
+			case "new":
+			case "update": {
+				const { equivocation: _e, ...clean } = rest;
+				return {
+					...clean,
+					index,
+					digest,
+					fetchedAt: this.now()
+				};
+			}
+			case "same": return {
+				...rest,
+				fetchedAt: this.now()
+			};
+			case "rollback": return {
+				...rest,
+				problem: "rollback"
+			};
+			case "equivocation": return {
+				...rest,
+				equivocation: {
+					sequence: index.sequence,
+					digest,
+					at: this.now()
+				},
+				problem: "equivocation"
+			};
+			default: return {
+				...rest,
+				problem: "store-key"
+			};
+		}
+	}
+	async removeStore({ key }) {
+		const held = await this.storeRecord(key);
+		if (!held) return;
+		if (held.preloaded) await this.putStore({
+			key: held.key,
+			url: held.url,
+			addedAt: held.addedAt,
+			preloaded: true,
+			removed: true
+		});
+		else await wrap((await store(STORES$1.appStores, "readwrite")).delete(key));
+	}
+	/** Reads one store again, or every store (the person opened the Apps page, or the update check). */
+	async refreshStores({ key } = {}) {
+		const stores = (await this.stores()).filter((s) => key === void 0 || s.key === key);
+		if (key !== void 0 && !stores.length) fail("no-store", "No such store");
+		const out = [];
+		for (const s of stores) {
+			let next;
+			try {
+				const read = await this.readStoreAt(s.url, s.key);
+				next = read.ok ? this.withIndex(s, read.store.index, read.store.digest) : {
+					...s,
+					problem: read.reason
+				};
+			} catch (error) {
+				next = {
+					...s,
+					problem: error instanceof AppFetchError ? error.code : "network"
+				};
+			}
+			if (!await this.storeRecord(s.key) || (await this.storeRecord(s.key))?.removed) continue;
+			await this.putStore(next);
+			out.push(this.summary(next));
+		}
+		return out;
+	}
+	/**
+	* Fetches an app and checks it, for the install screen: from a pasted URL, a store's listing (its URLs in order) or a
+	* chat card's pointer. A store's or a card's `sequence` and digest must hold: the same app, and that version or a newer
+	* one. Nothing is stored: the checked bundle waits in memory for `install`.
+	*/
+	async preview(source) {
+		let urls;
+		let expect = null;
+		if ("url" in source) urls = [typeof source.url === "string" && appPasteUrl(source.url, "app.ghostlyapp") || notReadable(source.url, "Apps are read only from raw.githubusercontent.com, or from cdn.jsdelivr.net at a commit, over HTTPS")];
+		else if ("store" in source) {
+			const s = await this.storeRecord(source.store);
+			const listing = s && !s.removed ? s.index?.apps.find((a) => a.ref === source.ref) : void 0;
+			if (!listing) fail("not-listed", "This store does not list this app");
+			urls = listing.urls.filter(isAppFetchUrl);
+			expect = {
+				ref: listing.ref,
+				sequence: listing.sequence,
+				digest: listing.digest
+			};
+		} else if ("card" in source && source.card) {
+			const { ref, url, sequence, digest } = source.card;
+			if (!isAppRef(ref)) fail("bad-ref", "Not an app reference");
+			if (!isAppFetchUrl(url)) fail("host", "A card's app is read only from raw.githubusercontent.com, or from cdn.jsdelivr.net at a commit");
+			urls = [url];
+			expect = {
+				ref,
+				...typeof sequence === "number" && { sequence },
+				...typeof digest === "string" && { digest }
+			};
+		} else fail("bad-source", "No app to fetch");
+		if (!urls.length) fail("host", "This listing has no URL Ghostly reads from");
+		let last = null;
+		for (const url of urls) try {
+			const { bundle, bytes } = await this.fetchBundle(url);
+			const version = versionOf(bundle.manifest, bundle.digest);
+			if (expect) {
+				if (version.ref !== expect.ref) fail("other-app", "The URL holds another app");
+				if (expect.sequence !== void 0 && version.sequence < expect.sequence) fail("rollback", "The URL holds an older version than the one named");
+				if (expect.sequence === version.sequence && expect.digest !== void 0 && expect.digest !== version.digest) fail("equivocation", "The URL holds another version under the same number");
+			}
+			return this.stage(bundle, bytes, url);
+		} catch (error) {
+			last = error;
+		}
+		throw last instanceof Error ? last : new Error(String(last));
+	}
+	async stage(bundle, bytes, from) {
+		for (const [digest, s] of this.staged) if (this.now() - s.at > STAGED.ms) this.staged.delete(digest);
+		this.staged.delete(bundle.digest);
+		while (this.staged.size >= STAGED.max) this.staged.delete(this.staged.keys().next().value);
+		this.staged.set(bundle.digest, {
+			bundle,
+			bytes,
+			from,
+			at: this.now()
+		});
+		const { manifest, digest } = bundle;
+		const version = versionOf(manifest, digest);
+		const [installed, stores] = await Promise.all([this.app(version.ref), this.stores()]);
+		const decision = installed ? appUpdateDecision(installed, version) : "new";
+		const install = decision === "other-app" ? "new" : decision;
+		const asks = install === "new" ? [...manifest.permissions] : install === "update" ? manifest.permissions.filter((p) => !installed.permissions.includes(p)) : [];
+		const listedBy = this.listedBy(version.ref, stores);
+		return {
+			digest,
+			ref: version.ref,
+			publisher: manifest.publisher,
+			fingerprint: appFingerprint(manifest.publisher),
+			manifest,
+			from,
+			icon: bundle.files.get("icon.png")?.slice() ?? null,
+			install,
+			asks,
+			run: this.runStatus(version, stores, installed?.revocations),
+			listedBy,
+			unknownPublisher: !listedBy.some((s) => s.kind === "curated")
+		};
+	}
+	/**
+	* Installs the bundle `preview` fetched, once the person pressed Install: `grant` must hold every permission it asks
+	* for (WISP 1200 § Permissions: none is granted by a store or a contact). A revoked or removed version is not
+	* installed; neither is a rollback, nor another bundle under an installed `sequence` (marked on the app).
+	*/
+	async install({ digest, grant }) {
+		const staged = this.staged.get(digest);
+		if (!staged || this.now() - staged.at > STAGED.ms) {
+			this.staged.delete(digest);
+			fail("expired", "Fetch the app again");
+		}
+		const { bundle, bytes, from } = staged;
+		const { manifest } = bundle;
+		if (!Array.isArray(grant) || !manifest.permissions.every((p) => grant.includes(p))) fail("permissions", "Every permission the app asks for must be granted");
+		const version = versionOf(manifest, digest);
+		const [installed, stores] = await Promise.all([this.app(version.ref), this.stores()]);
+		const run = this.runStatus(version, stores, installed?.revocations);
+		if (run.status === "revoked") fail("revoked", "Its publisher revoked this version");
+		if (run.status === "removed") fail("removed", `Removed by ${run.by[0].name}: ${run.by[0].reason}`);
+		const pendingClash = installed?.pending && installed.pending.sequence === version.sequence && installed.pending.digest !== digest;
+		const decision = installed ? pendingClash ? "equivocation" : appUpdateDecision(installed, version) : "new";
+		if (decision === "rollback") fail("rollback", "A newer version of this app is installed");
+		if (decision === "equivocation") {
+			await this.putApp({
+				...installed,
+				equivocation: {
+					sequence: version.sequence,
+					digest,
+					at: this.now()
+				}
+			});
+			fail("equivocation", `Two different versions ${version.sequence} exist. Ghostly kept the one you have.`);
+		}
+		if (decision === "same" && installed) {
+			if (!await this.hasBundle(installed.bytes, digest)) await this.putApp({
+				...installed,
+				bytes: await this.writeBundle(digest, bytes)
+			});
+			this.staged.delete(digest);
+			return this.view(await this.app(version.ref), stores);
+		}
+		const kind = await this.writeBundle(digest, bytes);
+		const next = this.versionRecord(installed, bundle, kind, from);
+		await this.putApp(next);
+		if (installed && installed.digest !== digest) await this.removeBundle(installed.bytes, installed.digest);
+		if (installed?.pending && installed.pending.sequence <= version.sequence && installed.pending.digest !== digest) await this.removeBundle(installed.pending.bytes, installed.pending.digest);
+		this.staged.delete(digest);
+		return this.view(next, stores);
+	}
+	/** The record of a version installed now, keeping what the app had (its revocations, a newer version waiting). */
+	versionRecord(installed, bundle, kind, from) {
+		const { manifest, digest } = bundle;
+		const now = this.now();
+		const keepPending = installed?.pending && installed.pending.sequence > manifest.sequence ? installed.pending : void 0;
+		return {
+			ref: appRef(manifest.publisher, manifest.name),
+			publisher: manifest.publisher,
+			name: manifest.name,
+			sequence: manifest.sequence,
+			digest,
+			permissions: [...manifest.permissions],
+			manifest,
+			bytes: kind,
+			from,
+			installedAt: installed?.installedAt ?? now,
+			updatedAt: now,
+			...installed?.revocations?.length && { revocations: installed.revocations },
+			...installed?.equivocation && installed.equivocation.sequence >= manifest.sequence && { equivocation: installed.equivocation },
+			...keepPending && { pending: keepPending },
+			...installed?.checkedAt !== void 0 && { checkedAt: installed.checkedAt }
+		};
+	}
+	/** The person accepted the permissions a waiting update adds: it is installed now. */
+	async acceptUpdate({ ref }) {
+		const installed = await this.installedOrFail(ref);
+		const pending = installed.pending ?? fail("no-update", "No update waits for this app");
+		const bytes = await this.readBundleBytes(pending.bytes, pending.digest);
+		const read = bytes ? readAppBundle(bytes) : null;
+		if (!read?.ok || read.bundle.digest !== pending.digest) {
+			const { pending: _p, ...rest } = installed;
+			await this.putApp(rest);
+			fail("needs-files", "The update's files are gone; it is fetched again at the next check");
+		}
+		const stores = await this.stores();
+		const run = this.runStatus(versionOf(read.bundle.manifest, pending.digest), stores, installed.revocations);
+		if (run.status === "revoked") fail("revoked", "Its publisher revoked this version");
+		if (run.status === "removed") fail("removed", `Removed by ${run.by[0].name}: ${run.by[0].reason}`);
+		const plan = planAppUpdate(installed, {
+			...versionOf(read.bundle.manifest, pending.digest),
+			permissions: read.bundle.manifest.permissions
+		});
+		if (plan.action === "refuse") fail(plan.decision, "This update can no longer be installed");
+		const { pending: _p, ...without } = installed;
+		const next = this.versionRecord(without, read.bundle, pending.bytes, pending.from);
+		await this.putApp(next);
+		await this.removeBundle(installed.bytes, installed.digest);
+		return this.view(next, stores);
+	}
+	/**
+	* The update check (WISP 1200 § Updates and rollback): only with an app installed; every store read again, then each
+	* app's newer versions looked for in the stores' listings and its manifest's `sources`, and its publisher's
+	* revocations read beside its sources. An update that keeps or drops permissions installs by itself; one that adds
+	* some waits for the person. One check at a time.
+	*/
+	checkUpdates() {
+		this.checking ??= this.checkNow().then((results) => {
+			try {
+				this.host.checked?.(results);
+			} catch {}
+			return results;
+		}).finally(() => {
+			this.checking = null;
+		});
+		return this.checking;
+	}
+	async checkNow() {
+		const apps = await this.installed();
+		if (!apps.length) return [];
+		await this.refreshStores();
+		const stores = await this.stores();
+		const out = [];
+		for (const listed of apps) {
+			if (!await this.hasBundle(listed.bytes, listed.digest)) await this.fetchFiles({ ref: listed.ref }).catch(() => {});
+			const first = await this.app(listed.ref);
+			if (!first) continue;
+			let app = first;
+			let outcome = "none";
+			const highest = Math.max(app.sequence, app.pending?.sequence ?? 0);
+			const known = /* @__PURE__ */ new Set([app.digest, ...app.pending ? [app.pending.digest] : []]);
+			const candidates = [];
+			for (const s of stores) {
+				const listing = s.index?.apps.find((a) => a.ref === app.ref);
+				if (listing && (listing.sequence > highest || listing.sequence >= app.sequence && !known.has(listing.digest))) candidates.push(...listing.urls.filter(isAppFetchUrl));
+			}
+			for (const url of (app.manifest.sources ?? []).filter(isAppFetchUrl)) try {
+				const peek = peekAppManifest(await this.host.fetch(url, {
+					maxBytes: PEEK_BYTES,
+					peek: true
+				}));
+				if (peek && peek.ref === app.ref && (peek.sequence > highest || peek.sequence >= app.sequence && !known.has(peek.digest))) candidates.push(url);
+			} catch {}
+			for (const url of new Set(candidates)) {
+				let fetched;
+				try {
+					fetched = await this.fetchBundle(url);
+				} catch {
+					continue;
+				}
+				const { bundle, bytes } = fetched;
+				const version = versionOf(bundle.manifest, bundle.digest);
+				if (version.ref !== app.ref || known.has(version.digest)) continue;
+				if (app.pending && version.sequence === app.pending.sequence) {
+					app = {
+						...app,
+						equivocation: {
+							sequence: version.sequence,
+							digest: version.digest,
+							at: this.now()
+						}
+					};
+					outcome = "equivocation";
+					continue;
+				}
+				const plan = planAppUpdate(app, {
+					...version,
+					permissions: bundle.manifest.permissions
+				});
+				if (plan.action === "refuse") {
+					if (plan.decision === "equivocation") {
+						app = {
+							...app,
+							equivocation: {
+								sequence: version.sequence,
+								digest: version.digest,
+								at: this.now()
+							}
+						};
+						outcome = "equivocation";
+					}
+					continue;
+				}
+				if (this.runStatus(version, stores, app.revocations).status !== "ok") continue;
+				if (app.pending && version.sequence < app.pending.sequence) continue;
+				const kind = await this.writeBundle(version.digest, bytes);
+				if (plan.action === "install") {
+					const old = app;
+					app = this.versionRecord(app, bundle, kind, url);
+					if (old.pending && old.pending.sequence <= version.sequence) {
+						await this.removeBundle(old.pending.bytes, old.pending.digest);
+						delete app.pending;
+					}
+					await this.putApp(app);
+					await this.removeBundle(old.bytes, old.digest);
+					outcome = "updated";
+				} else {
+					if (app.pending) await this.removeBundle(app.pending.bytes, app.pending.digest);
+					app = {
+						...app,
+						pending: {
+							sequence: version.sequence,
+							digest: version.digest,
+							manifest: bundle.manifest,
+							added: plan.added,
+							bytes: kind,
+							from: url,
+							at: this.now()
+						}
+					};
+					outcome = "ask";
+				}
+				break;
+			}
+			const revocations = await this.readRevocations(app.ref, [app.from, ...app.manifest.sources ?? []]);
+			const merged = new Map((app.revocations ?? []).map((r) => [canonicalJson(r), r]));
+			for (const r of revocations) merged.set(canonicalJson(r), r);
+			if (!await this.app(app.ref)) continue;
+			app = {
+				...app,
+				...merged.size && { revocations: [...merged.values()] },
+				checkedAt: this.now()
+			};
+			await this.putApp(app);
+			out.push({
+				ref: app.ref,
+				outcome,
+				run: await this.runCheckOf(app, stores)
+			});
+		}
+		return out;
+	}
+	/**
+	* Fetches an installed app's bundle again when it is not on this device (a profile restored from a backup, which
+	* carries the installed list but no bundle: WISP 1200 § Where installed apps live). Only the installed digest is
+	* taken, checked whole: from the URL it was installed from, the listings of the person's stores that name that digest,
+	* then its `sources`. Nothing answers: it stays `needs-files`, and it never runs unchecked.
+	*/
+	async fetchFiles({ ref }) {
+		const app = await this.installedOrFail(ref);
+		const stores = await this.stores();
+		if (await this.hasBundle(app.bytes, app.digest)) return this.runCheckOf(app, stores);
+		const urls = [app.from];
+		for (const s of stores) for (const listing of s.index?.apps ?? []) if (listing.ref === app.ref && listing.digest === app.digest) urls.push(...listing.urls);
+		urls.push(...app.manifest.sources ?? []);
+		for (const url of new Set(urls.filter(isAppFetchUrl))) {
+			let fetched;
+			try {
+				fetched = await this.fetchBundle(url);
+			} catch {
+				continue;
+			}
+			if (fetched.bundle.digest !== app.digest) continue;
+			const kind = await this.writeBundle(app.digest, fetched.bytes);
+			const now = await this.app(app.ref);
+			if (!now || now.digest !== app.digest) {
+				await this.removeBundle(kind, app.digest);
+				fail("not-installed", "This app is not installed");
+			}
+			if (now.bytes !== kind) await this.putApp({
+				...now,
+				bytes: kind
+			});
+			return this.runCheckOf({
+				...now,
+				bytes: kind
+			}, stores);
+		}
+		return { status: "needs-files" };
+	}
+	async runCheckOf(app, stores) {
+		if (!await this.hasBundle(app.bytes, app.digest)) return { status: "needs-files" };
+		return this.runStatus(app, stores, app.revocations);
+	}
+	/** Before an app runs (WISP 1200 § Takedowns): revoked stops it, removed by a store of the person's warns. No request. */
+	async runCheck({ ref }) {
+		return this.runCheckOf(await this.installedOrFail(ref), await this.stores());
+	}
+	/**
+	* What the runner writes into its frame: the entry, from the bundle read back and checked again. A revoked version
+	* never runs; one a store removed runs only when the person chose "Run anyway" (`runAnyway`).
+	*/
+	async entry({ ref, runAnyway }) {
+		let app = await this.installedOrFail(ref);
+		let run = await this.runCheckOf(app, await this.stores());
+		if (run.status === "needs-files") {
+			run = await this.fetchFiles({ ref });
+			app = await this.installedOrFail(ref);
+		}
+		if (run.status === "revoked") fail("revoked", "Its publisher revoked this version");
+		if (run.status === "removed" && runAnyway !== true) fail("removed", `Removed by ${run.by[0].name}: ${run.by[0].reason}`);
+		if (run.status === "needs-files") fail("needs-files", "This app's files are not on this device yet");
+		if (run.status === "removed") this.anyway.add(`${app.ref} ${app.digest}`);
+		const bundle = await this.verifiedBundle(app);
+		const entry = bundle.files.get(bundle.manifest.entry) ?? fail("damaged", "The entry is missing");
+		return {
+			ref: app.ref,
+			digest: app.digest,
+			version: app.manifest.version,
+			title: app.manifest.title,
+			permissions: [...app.permissions],
+			entry: utf8Decode(entry)
+		};
+	}
+	/** A file of the installed bundle, for the broker's `file` (`ghostly.file(path)`). */
+	async file({ ref, path }) {
+		const app = path === "icon.png" ? await this.installedOrFail(ref) : await this.runningOrFail(ref);
+		const bundle = await this.verifiedBundle(app);
+		if (typeof path !== "string" || !bundle.files.has(path)) fail("no-file", "No such file in this app");
+		return bundle.files.get(path).slice();
+	}
+	async view(app, stores) {
+		const { manifest } = app;
+		const listedBy = this.listedBy(app.ref, stores);
+		return {
+			ref: app.ref,
+			name: app.name,
+			publisher: app.publisher,
+			fingerprint: appFingerprint(app.publisher),
+			title: manifest.title,
+			tagline: manifest.tagline,
+			...manifest.description !== void 0 && { description: manifest.description },
+			version: manifest.version,
+			sequence: app.sequence,
+			digest: app.digest,
+			permissions: [...app.permissions],
+			from: app.from,
+			icon: manifest.files.some((f) => f.path === "icon.png"),
+			installedAt: app.installedAt,
+			updatedAt: app.updatedAt,
+			run: await this.runCheckOf(app, stores),
+			listedBy,
+			unknownPublisher: !listedBy.some((s) => s.kind === "curated"),
+			...app.pending && { pending: {
+				sequence: app.pending.sequence,
+				version: app.pending.manifest.version,
+				added: [...app.pending.added]
+			} },
+			...app.equivocation && { equivocation: {
+				sequence: app.equivocation.sequence,
+				at: app.equivocation.at
+			} },
+			...app.checkedAt !== void 0 && { checkedAt: app.checkedAt }
+		};
+	}
+	async list() {
+		const [apps, stores] = await Promise.all([this.installed(), this.stores()]);
+		return Promise.all(apps.sort((a, b) => a.installedAt - b.installedAt).map((a) => this.view(a, stores)));
+	}
+	/**
+	* Uninstalls an app: its bundle (and a waiting update's), its record and its storage in every scope. The person chose
+	* it, after the offer of an export (`exportData`).
+	*/
+	async uninstall({ ref }) {
+		const app = await this.installedOrFail(ref);
+		const tx = (await openDb()).transaction([STORES$1.apps, STORES$1.appStorage], "readwrite");
+		tx.objectStore(STORES$1.apps).delete(app.ref);
+		tx.objectStore(STORES$1.appStorage).delete(rowsOf(app.ref));
+		await done(tx);
+		for (const key of [...this.usage.keys()]) if (key.startsWith(`${app.ref}\0`)) this.usage.delete(key);
+		await this.removeBundle(app.bytes, app.digest);
+		if (app.pending) await this.removeBundle(app.pending.bytes, app.pending.digest);
+	}
+	scopeOf(scope) {
+		if (scope === "alone" || typeof scope === "string" && this.host.isChat(scope)) return scope;
+		fail("bad-scope", "Not a chat of this profile");
+	}
+	keyOf(key) {
+		if (typeof key !== "string" || !key.length || byteLength(key) > APP_STORAGE_LIMITS.keyBytes) fail("bad-key", "A key is 1 to 256 bytes of text");
+		return key;
+	}
+	/** One scope's writes, one after another, so the count of bytes used stays true. */
+	serial(id, work) {
+		const run = (this.queues.get(id) ?? Promise.resolve()).then(work, work);
+		const settled = run.catch(() => {});
+		this.queues.set(id, settled);
+		settled.then(() => {
+			if (this.queues.get(id) === settled) this.queues.delete(id);
+		});
+		return run;
+	}
+	async usageOf(ref, scope) {
+		const id = `${ref}\0${scope}`;
+		let used = this.usage.get(id);
+		if (used === void 0) {
+			used = (await wrap((await store(STORES$1.appStorage, "readonly")).index(APP_STORAGE_SCOPE_INDEX).getAll([ref, scope]))).reduce((sum, r) => sum + r.size, 0);
+			this.usage.set(id, used);
+		}
+		return used;
+	}
+	async storageGet({ ref, scope, key }) {
+		const app = await this.runningOrFail(ref);
+		const row = await wrap((await store(STORES$1.appStorage, "readonly")).get([
+			app.ref,
+			this.scopeOf(scope),
+			this.keyOf(key)
+		]));
+		return row ? { value: JSON.parse(row.value) } : null;
+	}
+	/** Keeps a JSON value under a key: at most 64 KiB, and 5 MiB for every key of this app in this scope. */
+	async storageSet({ ref, scope, key, value }) {
+		const app = await this.runningOrFail(ref);
+		const where = this.scopeOf(scope), name = this.keyOf(key);
+		let text;
+		try {
+			text = JSON.stringify(value);
+		} catch {
+			text = void 0;
+		}
+		if (typeof text !== "string") fail("bad-value", "A value is JSON");
+		const valueBytes = byteLength(text);
+		if (valueBytes > APP_STORAGE_LIMITS.valueBytes) fail("too-large", "A value is at most 64 KiB");
+		const size = byteLength(name) + valueBytes;
+		await this.serial(`${app.ref}\0${where}`, async () => {
+			const used = await this.usageOf(app.ref, where);
+			const rows = await store(STORES$1.appStorage, "readonly");
+			const next = used - ((await wrap(rows.get([
+				app.ref,
+				where,
+				name
+			])))?.size ?? 0) + size;
+			if (next > APP_STORAGE_LIMITS.scopeBytes) fail("full", "This app's storage in this chat is full (5 MiB)");
+			await wrap((await store(STORES$1.appStorage, "readwrite")).put({
+				ref: app.ref,
+				scope: where,
+				key: name,
+				value: text,
+				size
+			}));
+			this.usage.set(`${app.ref}\0${where}`, next);
+		});
+	}
+	async storageDelete({ ref, scope, key }) {
+		const app = await this.runningOrFail(ref);
+		const where = this.scopeOf(scope), name = this.keyOf(key);
+		await this.serial(`${app.ref}\0${where}`, async () => {
+			const used = await this.usageOf(app.ref, where);
+			const old = await wrap((await store(STORES$1.appStorage, "readonly")).get([
+				app.ref,
+				where,
+				name
+			]));
+			if (!old) return;
+			await wrap((await store(STORES$1.appStorage, "readwrite")).delete([
+				app.ref,
+				where,
+				name
+			]));
+			this.usage.set(`${app.ref}\0${where}`, used - old.size);
+		});
+	}
+	async storageKeys({ ref, scope }) {
+		const app = await this.runningOrFail(ref);
+		return (await wrap((await store(STORES$1.appStorage, "readonly")).getAllKeys(rowsOf(app.ref, this.scopeOf(scope))))).map((k) => k[2]);
+	}
+	/** An app's storage in every scope, as export files (WISP 1200 § Where installed apps live), offered before an uninstall. */
+	async exportData({ ref }) {
+		const app = await this.installedOrFail(ref);
+		const rows = await wrap((await store(STORES$1.appStorage, "readonly")).getAll(rowsOf(app.ref)));
+		const scopes = /* @__PURE__ */ new Map();
+		for (const row of rows) {
+			const out = scopes.get(row.scope) ?? {
+				ghostlyAppData: 1,
+				app: app.ref,
+				scope: row.scope,
+				entries: {}
+			};
+			out.entries[row.key] = JSON.parse(row.value);
+			scopes.set(row.scope, out);
+		}
+		return [...scopes.values()];
+	}
+};
+//#endregion
 //#region ../browser/src/devices/state.ts
 /** WISP 06 § States of a device. */
 var DEVICE_STATES = [
@@ -13948,6 +15186,10 @@ var EnrollInviter = class extends Enrollment {
 			onPeerSeen: () => {
 				if (this.seen || this.over) return;
 				this.seen = true;
+				if (this.view.role === "inviter" && this.view.step === "waiting") this.show({
+					...this.view,
+					seen: true
+				});
 				this.timer(this.options.timing?.proofMs ?? 12e4, () => {
 					if (this.view.step === "waiting") this.fail("unreached");
 				});
@@ -16374,6 +17616,9 @@ var DeviceLinks = class {
 		const keeper = await this.turnKeeper();
 		if (!keeper) return null;
 		const outcome = await keeper.check(atStart);
+		try {
+			if (outcome) this.handoff?.turnRead?.(outcome);
+		} catch {}
 		await this.refresh();
 		return outcome;
 	}
@@ -16570,6 +17815,11 @@ var SHOWN_AFTER_RELOAD = /* @__PURE__ */ new Set([
 	"cancelled"
 ]);
 var reportOf = (busy) => busy === null ? null : typeof busy === "string" ? { why: busy } : busy;
+/**
+* What `handoff-busy` tells the taker of a local reason (WISP 06: the requesting device "Shows why"). A call is said as
+* itself, so the person waits for it to end; the rest stay "handoff": which wallet keeps the profile is said on this device.
+*/
+var wireWhy = (report) => report.why === "call" ? "call" : "handoff";
 var name = (record, key) => record.deviceSet.find((slot) => slot?.key === key)?.name ?? "";
 var slotOf = (record, key) => record.deviceSet.findIndex((slot) => slot?.key === key);
 /** One session of a handoff with the other device: its own X25519 key, the other's hello, and the stream key. */
@@ -16929,6 +18179,25 @@ var HandoffGiver = class {
 	receive(from, frame) {
 		return this.exclusive(() => this.handle(from, frame)).catch(() => {});
 	}
+	/**
+	* A turn read on this standby found the record of `key` at `turn`: the device it released to took the turn, which is
+	* what the `handoff-done` would have said. That frame goes once, as the taker reloads, and can be lost; without this
+	* the screen said "Moving to …" for good, with no Use here, until that device offered the profile back.
+	*/
+	turnTaken(key, turn) {
+		return this.exclusive(async () => {
+			if (this.stopped || this.phase !== "released" || key !== this.peer || turn <= this.turn) return;
+			await this.taken();
+		}).catch(() => {});
+	}
+	/** The release was taken: the handoff note goes, and this device is a plain standby. */
+	async taken() {
+		await this.dropBreez();
+		await this.ports.records.amend({ handoff: void 0 });
+		this.phase = "idle";
+		this.peer = null;
+		this.changed();
+	}
 	async handle(from, frame) {
 		if (this.stopped) return;
 		if (from === this.peer && frame.t.startsWith("handoff-")) this.heardAt = this.now();
@@ -16950,11 +18219,7 @@ var HandoffGiver = class {
 			case HANDOFF_DONE:
 				if (from !== this.peer || this.phase !== "released") return;
 				if (frame.t === "handoff-done" ? readHandoffDone(frame) === null : readHandoffTurnFrame(frame) === null) return;
-				await this.dropBreez();
-				await this.ports.records.amend({ handoff: void 0 });
-				this.phase = "idle";
-				this.peer = null;
-				this.changed();
+				await this.taken();
 				return;
 			case HANDOFF_CANCEL: {
 				const why = readHandoffCancel(frame);
@@ -17015,7 +18280,7 @@ var HandoffGiver = class {
 				this.failure = this.failWith(local);
 				this.changed();
 			}
-			return busy("handoff");
+			return busy(wireWhy(local));
 		}
 		const self = await this.ownSelf();
 		const versions = handoffVersions(self, session.peer);
@@ -17216,12 +18481,12 @@ var HandoffGiver = class {
 			while (this.now() < deadline && reportOf(await this.ports.busy(taker))?.why === "payment") await new Promise((resolve) => setTimeout(resolve, 1e3));
 			const still = reportOf(await this.ports.busy(taker));
 			if (still) {
-				this.out(handoffBusyFrame("handoff", 30));
+				this.out(handoffBusyFrame(wireWhy(still), 30));
 				this.reset(still.why === "payment" ? "payment" : this.failWith(still));
 				return;
 			}
 		} else if (why) {
-			this.out(handoffBusyFrame("handoff", 30));
+			this.out(handoffBusyFrame(wireWhy(why), 30));
 			this.reset(this.failWith(why));
 			return;
 		}
@@ -17451,7 +18716,7 @@ async function room() {
 async function handoffSelf(profileHost) {
 	return {
 		app: profileHost.app.replace(/[^0-9A-Za-z.+_-]/g, "").slice(0, 40) || "0",
-		db: 13,
+		db: 14,
 		pins: { ...WALLET_SDK_PINS },
 		kind: profileHost.kind,
 		room: await room(),
@@ -20337,6 +21602,9 @@ var db = {
 		await fileStore.deleteForLink(linkId);
 		await removeFileBytes(`${linkId}-in-`);
 		await removeFileBytes(`${linkId}-out-`);
+		const appStorage = await store(STORES$1.appStorage, "readwrite");
+		const appKeys = await wrap(appStorage.index(APP_STORAGE_CHAT_INDEX).getAllKeys(linkId));
+		await Promise.all(appKeys.map((key) => wrap(appStorage.delete(key))));
 	},
 	async getMessages(linkId) {
 		return (await wrap((await store(STORES$1.messages, "readonly")).index("byLink").getAll(linkId))).sort((a, b) => a.timestamp - b.timestamp);
@@ -20744,22 +22012,6 @@ async function myPin(host, chat, messageId, remove, current, now = Date.now()) {
 	};
 }
 //#endregion
-//#region ../browser/src/engine/joinTrace.ts
-/**
-* Timestamps along a join through a group's link, for measuring where the time goes. Silent unless
-* the page sets `globalThis.__ghostlyJoinTrace` (the e2e measurement does): each step is then one
-* `console.debug` line, `[ghostly:join] {"t":…,"g":…,"step":…}`, read back by the test.
-*/
-function traceJoin(group, step, detail) {
-	if (!globalThis.__ghostlyJoinTrace) return;
-	console.debug(`[ghostly:join] ${JSON.stringify({
-		t: Date.now(),
-		g: group,
-		step,
-		...detail
-	})}`);
-}
-//#endregion
 //#region ../browser/src/engine/hubClocks.ts
 /**
 * A hub dates its beacon entry by its own clock, and a reader judges it by its own. A hub's time closer than this to
@@ -20928,6 +22180,14 @@ var HUB_GRACE_MS = 18e4;
 var CUT_OFF_STEP_UP_MS = 15e3;
 /** A lobby request this recent is from a member still looking fast for my side of the edge: mine opens expecting it. */
 var LOBBY_EXPECT_MS = 3e4;
+/**
+* A lobby is one record every member asking a hub writes, each reading it and writing it back with its own request: two
+* members writing at once (both cut off by the same leave, in the same second) each write what they read, and the later
+* write drops the earlier request. So a member reads the lobby back this long after its write (plus up to `LOBBY_CHECK_JITTER_MS`, so
+* the members who wrote together do not read and write together again) and asks again at once if its request is gone.
+*/
+var LOBBY_CHECK_MS = 2e3;
+var LOBBY_CHECK_JITTER_MS = 3e3;
 var REFUSED_FOR_MS$1 = 6e5;
 var ENTRY_LINGER_MS$1 = 2e4;
 var RELAYED_KEPT = 4096;
@@ -20986,6 +22246,8 @@ var Communities = class {
 	knockAt = /* @__PURE__ */ new Map();
 	/** Joiners: how many others had a knock still being refreshed in the record I last read (they wait with me). */
 	knockingWith = /* @__PURE__ */ new Map();
+	/** Joiners: the knock record a knock read whose write the relays refused, and when it was read (`knock`). */
+	knockRead = /* @__PURE__ */ new Map();
 	/** My frames an edge took, and which of them carry an edit (`frame id → editKey`). */
 	frames = new FramesTaken();
 	carriers = /* @__PURE__ */ new Map();
@@ -21082,9 +22344,11 @@ var Communities = class {
 				return !!id && this.host.linkReady(id, 2);
 			};
 			const hubs = freshHubs(this.hubs(live), this.now()).map((h) => h.key);
+			const former = Object.entries(s.state.nicks).filter(([key]) => !rosterHas(s.roster, key));
 			return [{
 				...base,
 				name: s.name,
+				...former.length ? { formerNames: Object.fromEntries(former) } : {},
 				status: s.status,
 				statusReason: s.state.statusReason,
 				epoch: s.epoch,
@@ -21169,6 +22433,7 @@ var Communities = class {
 		this.knocked.delete(link.g);
 		this.knockAt.delete(link.g);
 		this.knockingWith.delete(link.g);
+		this.knockRead.delete(link.g);
 		const before = this.stored.get(link.g)?.joining;
 		const linkId = await this.host.openEntry(link, "guest", seedB64, link.host);
 		if (before && before.linkId !== linkId) await this.host.closeEdge(before.linkId);
@@ -21202,6 +22467,7 @@ var Communities = class {
 		this.knocked.delete(group.id);
 		this.knockAt.delete(group.id);
 		this.knockingWith.delete(group.id);
+		this.knockRead.delete(group.id);
 		await this.host.closeEdge(joining.linkId);
 		await this.store.putGroup(group);
 		this.host.emit();
@@ -21342,6 +22608,7 @@ var Communities = class {
 		this.lastPeerMessageAt.delete(groupId);
 		this.lastMentionAt.delete(groupId);
 		this.knockingWith.delete(groupId);
+		this.knockRead.delete(groupId);
 		for (const linkId of [...this.host.edges(groupId).values(), ...this.host.entries(groupId).values()]) await this.host.closeEdge(linkId);
 		await this.store.deleteGroup(groupId);
 		this.host.historyGone?.(groupId);
@@ -21360,7 +22627,7 @@ var Communities = class {
 			if (group.joining && (this.knocking(group, live) || group.joining.check)) {
 				const waited = now - group.joining.since, every = waited > this.timings.patienceMs ? this.timings.slowKnockMs : this.timings.knockMs;
 				if (!this.knocking(group, live) && waited > CHECK_MS) await this.endCheck(group);
-				else if (!this.host.linkReady(group.joining.linkId, 2) && !this.host.linkSeen?.(group.joining.linkId) && now - (this.lastKnock.get(group.id) ?? 0) >= every) await this.knock(group, now).catch(() => {});
+				else if (!this.host.linkReady(group.joining.linkId, 2) && !this.host.linkSeen?.(group.joining.linkId) && now - (this.lastKnock.get(group.id) ?? 0) >= (this.knocked.has(group.id) ? every : Math.min(every, 3e3))) await this.knock(group, now).catch(() => {});
 				if (!live) continue;
 			}
 			if (!live) continue;
@@ -21536,7 +22803,15 @@ var Communities = class {
 			live.forceHub = !kept.length && others.length < COMMUNITY_TOPOLOGY.maxHubs;
 			for (const hub of kept) {
 				const id = edges.get(hub);
-				if (id && this.host.linkReady(id, 2)) continue;
+				if (id && this.host.linkReady(id, 2)) {
+					live.lobbyChecks?.delete(hub);
+					continue;
+				}
+				const check = live.lobbyChecks?.get(hub);
+				if (check && now >= check.at) {
+					live.lobbyChecks.delete(hub);
+					if (await this.lobbyLost(groupId, live, hub, check.ts)) live.lobbyWrites.delete(hub);
+				}
 				if (now - (live.lobbyWrites.get(hub) ?? 0) >= this.timings.lobbyWriteMs) {
 					live.lobbyWrites.set(hub, now);
 					await this.askHub(groupId, live, hub, now).catch(() => {
@@ -21809,8 +23084,26 @@ var Communities = class {
 			key: live.session.myKey,
 			ts: theirs
 		}, theirs)), true, true);
+		(live.lobbyChecks ??= /* @__PURE__ */ new Map()).set(hub, {
+			at: now + LOBBY_CHECK_MS + Math.floor(this.random() * LOBBY_CHECK_JITTER_MS),
+			ts: Math.floor(theirs / 1e3) * 1e3
+		});
 		traceJoin(groupId, "lobby.written");
 	}
+	/**
+	* My request is not in the hub's lobby any more, and the lobby has room for it: another member's write, made from a
+	* reading from before mine, dropped it (`LOBBY_CHECK_MS`). A full lobby that pushed it out is left as it is: asking
+	* again there would push out someone else. A read that fails says nothing, and the usual refresh asks again.
+	*/
+	async lobbyLost(groupId, live, hub, ts) {
+		const keys = lobbyKeys(live.session.state.rv, groupId, hub);
+		const records = await this.host.resolve(keys.identity.pubKeyZ32, true, true).catch(() => void 0);
+		if (records === void 0) return false;
+		const entries = readLobby(keys, records ?? []);
+		const lost = !entries.some((e) => e.key === live.session.myKey && e.ts >= ts) && entries.length < COMMUNITY_TOPOLOGY.lobbyEntries;
+		if (lost) traceJoin(groupId, "lobby.lost");
+		return lost;
+	}
 	async pollLobby(groupId, live, now) {
 		const keys = lobbyKeys(live.session.state.rv, groupId, live.session.myKey);
 		const entries = readLobby(keys, await this.host.resolve(keys.identity.pubKeyZ32, true, true).catch(() => null) ?? []);
@@ -21935,10 +23228,19 @@ var Communities = class {
 		}
 		const records = this.knockRecordsToRead(live, door === s.myKey, busy, now);
 		if (!records.length) return;
+		let failed = 0;
 		const read = await Promise.all(records.map(async (n) => {
 			const record = knockRecord(link, n);
-			return readKnocks(record, await this.host.resolve(knockIdentity(record).pubKeyZ32, true, door === s.myKey && n === KNOCK_BELL).catch(() => null) ?? []);
+			return readKnocks(record, await this.host.resolve(knockIdentity(record).pubKeyZ32, true, door === s.myKey && n === KNOCK_BELL).catch(() => {
+				failed++;
+				return null;
+			}) ?? []);
 		}));
+		traceJoin(groupId, "knock.read", {
+			records: records.length,
+			knocks: read.flat().length,
+			...failed ? { failed } : {}
+		});
 		const bell = records.indexOf(KNOCK_BELL);
 		if (bell >= 0 && read[bell].filter((k) => now - k.ts < 18e4).length >= BELL_FULL) live.crowdUntil = now + CROWD_MS;
 		const newest = /* @__PURE__ */ new Map();
@@ -21997,10 +23299,16 @@ var Communities = class {
 	* Leaves (or refreshes) my knock: in the bell while it has room, in my own record once a crowd has
 	* filled it. The first one goes out at once; refreshes are background requests, and keep my side of
 	* the entry session looking fast while I still expect a member to answer soon.
+	*
+	* "The first" is the first of this run that the relays took (`knocked`), not the first tried: a knock the relays'
+	* budget refused is tried again as one, every `UNKNOCKED_RETRY_MS`. Taken for a refresh, it went as a background
+	* request, every `knockMs`, and background requests are held to a few a minute while a link of this app signals: its
+	* own entry session, looking fast for the door's answer. A CLI that was the door of another community, its budget
+	* spent, never knocked at all (groupCompat, with the budget scaled down to 12 requests a minute).
 	*/
 	async knock(group, now = this.now()) {
 		const joining = group.joining;
-		const first = !this.lastKnock.has(group.id);
+		const first = !this.knocked.has(group.id);
 		this.lastKnock.set(group.id, now);
 		if (first || now - joining.since < this.timings.patienceMs) this.host.expectPeer?.(joining.linkId);
 		const me = identityFromSeedB64(joining.seedB64).pubKeyZ32, link = {
@@ -22015,16 +23323,37 @@ var Communities = class {
 				knocks: readKnocks(record, await this.host.resolve(knockIdentity(record).pubKeyZ32, !first) ?? [])
 			};
 		};
-		let n = this.knockAt.get(group.id) ?? KNOCK_BELL, { record, knocks } = await read(n);
-		if (n === KNOCK_BELL && !knocks.some((k) => k.key === me) && knocks.filter((k) => k.key !== me && now - k.ts < 18e4).length >= BELL_FULL) ({record, knocks} = await read(n = ownKnockRecord(me)));
-		await this.host.publish(knockIdentity(record), knockRecords(record, mergeKnocks(knocks, {
-			key: me,
-			ts: now
-		}, now)), !first);
+		const kept = this.knockRead.get(group.id);
+		this.knockRead.delete(group.id);
+		const reuse = kept && now - kept.at < this.timings.knockMs ? kept : void 0;
+		let n, record, knocks;
+		if (reuse) {
+			n = reuse.n;
+			knocks = reuse.knocks;
+			record = knockRecord(link, n);
+		} else {
+			n = this.knockAt.get(group.id) ?? KNOCK_BELL;
+			({record, knocks} = await read(n));
+			if (n === KNOCK_BELL && !knocks.some((k) => k.key === me) && knocks.filter((k) => k.key !== me && now - k.ts < 18e4).length >= BELL_FULL) ({record, knocks} = await read(n = ownKnockRecord(me)));
+		}
+		try {
+			await this.host.publish(knockIdentity(record), knockRecords(record, mergeKnocks(knocks, {
+				key: me,
+				ts: now
+			}, now)), !first);
+		} catch (error) {
+			this.knockRead.set(group.id, {
+				n,
+				knocks,
+				at: reuse?.at ?? now
+			});
+			throw error;
+		}
 		this.knockAt.set(group.id, n);
 		traceJoin(group.id, "knock.published", {
 			ms: Date.now() - started,
-			record: n
+			record: n,
+			...reuse && { kept: true }
 		});
 		const others = knocks.filter((k) => k.key !== me && now - k.ts < 2 * this.timings.slowKnockMs).length;
 		const moved = (this.knockingWith.get(group.id) ?? 0) !== others;
@@ -22161,6 +23490,7 @@ var Communities = class {
 				this.knocked.delete(g);
 				this.knockAt.delete(g);
 				this.knockingWith.delete(g);
+				this.knockRead.delete(g);
 				await this.host.closeEdge(linkId);
 				await this.reconcile(g, live, now);
 				this.host.emit();
@@ -23583,6 +24913,7 @@ var Groups = class {
 					isAdmin: false,
 					members: [],
 					canSend: false,
+					...group.formerNames ? { formerNames: group.formerNames } : {},
 					invitation: {
 						linkId: invitation.linkId,
 						contact: this.host.contactName(invitation.linkId) ?? "",
@@ -24380,6 +25711,10 @@ var Groups = class {
 				if (existing?.state && existing.state.status === "active") return;
 				if (existing?.invitation?.seedB64) return;
 				if ([...this.stored.values()].filter((x) => x.invitation).length >= 32) return;
+				const known = {
+					...existing?.formerNames,
+					...existing?.state?.nicks
+				};
 				const invitation = {
 					id: g,
 					createdAt: Date.now(),
@@ -24390,7 +25725,8 @@ var Groups = class {
 						e: Number.isSafeInteger(frame.e) ? frame.e : 0,
 						n: Number.isSafeInteger(frame.n) ? frame.n : 1,
 						pieces: []
-					}
+					},
+					...Object.keys(known).length ? { formerNames: known } : {}
 				};
 				if (existing) {
 					this.sessions.delete(g);
@@ -24483,6 +25819,8 @@ var Groups = class {
 				});
 				await this.store.putGroup(member);
 				if (!viaLink) await this.sessions.get(g).setNick(group.invitation.admin, this.host.contactName(linkId));
+				const session = this.sessions.get(g);
+				for (const [key, nick] of Object.entries(group.formerNames ?? {})) if (!session.state.nicks[key]) await session.setNick(key, nick);
 				await this.event(g, "joined", `You joined. ${GROUP_READ_NOTE}`, Date.now(), joined.state.chain.length - 1);
 				if (viaLink) traceJoin(g, "welcome.received");
 				if (viaLink) {
@@ -28613,7 +29951,8 @@ var CashuWallet = class CashuWallet {
 			let swap = (await this.swapsAt(mint)).find((s) => s.kind === "receive" && s.token === token);
 			if (swap?.finished) return {
 				amount: swap.tx?.amount ?? 0,
-				mint
+				mint,
+				fee: swap.tx?.fee ?? 0
 			};
 			if (!swap) {
 				const preview = await (await this.wallet(mint)).prepareSwapToReceive(token);
@@ -28643,7 +29982,8 @@ var CashuWallet = class CashuWallet {
 			this.events.onChange();
 			return {
 				amount: credited,
-				mint
+				mint,
+				fee: Math.max(0, faceValue - credited)
 			};
 		});
 	}
@@ -29279,6 +30619,17 @@ var CashuWallet = class CashuWallet {
 * taken back.
 */
 var UNIT = "sat";
+var satsWord = (n) => `${n} sat${n === 1 ? "" : "s"}`;
+/**
+* A refused send's review, once its ecash came back: why, and exactly what came back. Taking ecash back is a swap at
+* the mint, which can keep a fee: "The sats came back" said nothing of it. Without `back` (Fedimint, or not known),
+* the plain sentence.
+*/
+var refusedLine = (reason, back) => {
+	const why = `Refused: ${reason.replace(/\.+$/, "")}.`;
+	if (!back) return `${why} The sats came back.`;
+	return back.fee > 0 ? `${why} ${satsWord(back.amount)} came back; the mint kept ${back.fee} as its fee.` : `${why} All ${satsWord(back.amount)} came back.`;
+};
 var mintLightning = (wallet, network) => ({
 	createInvoice: (amount, paymentId) => wallet.receiveLightning(amount, paymentId, network),
 	quote: (invoice) => wallet.quoteInvoice(invoice, network),
@@ -29914,7 +31265,10 @@ var PaymentDesk = class {
 			endpoint: [ENDPOINT.bolt11, request.invoice]
 		}).catch(() => {});
 	}
-	/** Takes back ecash the peer never redeemed. If they did redeem it, the mint says so and the payment is settled. */
+	/**
+	* Takes back ecash the peer never redeemed. If they did redeem it, the mint says so and the payment is settled.
+	* Resolves to what came back of Cashu ecash (and the mint's fee for it); undefined when nothing did, or not Cashu.
+	*/
 	reclaim(paymentId) {
 		let running = this.reclaims.get(paymentId);
 		if (!running) {
@@ -29945,7 +31299,7 @@ var PaymentDesk = class {
 		}
 		if (!payment?.token || payment.direction !== "out") throw new Error("Nothing to reclaim");
 		try {
-			await this.wallet.receiveToken(payment.token, "reclaimed", payment.memo, { payment: () => ({
+			const { amount, fee } = await this.wallet.receiveToken(payment.token, "reclaimed", payment.memo, { payment: () => ({
 				...this.current(payment),
 				state: "reclaimed",
 				token: void 0
@@ -29955,6 +31309,10 @@ var PaymentDesk = class {
 				state: "reclaimed",
 				token: void 0
 			});
+			return {
+				amount,
+				fee
+			};
 		} catch (error) {
 			const message = error instanceof Error ? error.message : String(error);
 			if (!/spent/i.test(message)) throw error;
@@ -29964,6 +31322,7 @@ var PaymentDesk = class {
 				state: "settled",
 				token: void 0
 			});
+			return;
 		}
 	}
 	/** Asks this side made to pay, until the contact answers with a request (or two minutes pass). */
@@ -30379,8 +31738,8 @@ var PaymentDesk = class {
 					...payment,
 					error: result.error ?? "The payment was refused"
 				});
-				await this.reclaim(payment.id).catch(() => {});
-				if (this.current(payment).state === "reclaimed") await this.host.onReviewedPaymentRefused?.(payment.id, result.error ?? "The payment was refused");
+				const back = await this.reclaim(payment.id).catch(() => void 0);
+				if (this.current(payment).state === "reclaimed") await this.host.onReviewedPaymentRefused?.(payment.id, result.error ?? "The payment was refused", back);
 				return;
 			}
 			Promise.resolve(this.host.onReviewedPaymentResult?.(payment.id)).catch(() => {});
@@ -32053,203 +33412,6 @@ var WalletSetup = class {
 	}
 };
 //#endregion
-//#region ../browser/src/platform/irohWeb.ts
-/**
-* Iroh (WISP 102) in a browser: the same QUIC/TLS session and binding as the
-* Desktop's native Iroh, but relay only. A page cannot send UDP, so every
-* packet goes through an Iroh relay over a WebSocket; the relay sees who talks
-* to whom and when, never the frames.
-*
-* The wasm (about 1 MB gzip) loads on the first chat that starts an endpoint,
-* never on the app's first load.
-*/
-/**
-* n0's public relays, the same ones the Desktop's Iroh homes on by default. Iroh itself names them with the trailing
-* dot of a full domain name (`use1-1.relay.n0.iroh.link.`), and compares relay URLs as text; here they have none,
-* because WebKit opens no host name that ends in a dot. `BROWSER_SPELLING` is what keeps the two one relay.
-*/
-var DEFAULT_IROH_RELAYS = [
-	"https://use1-1.relay.n0.iroh.link/",
-	"https://euc1-1.relay.n0.iroh.link/",
-	"https://aps1-1.relay.n0.iroh.link/",
-	"https://usw1-1.relay.n0.iroh.link/"
-];
-/**
-* The spelling of every relay URL handed to the wasm Iroh (`irohRelayUrl`): the relays it homes on and a contact's
-* relay before a dial. One spelling, so a contact on this endpoint's relay is reached over the connection already
-* open to it; without the dot, so Safari can open it (a Desktop's record names its relay with the dot).
-*/
-var BROWSER_SPELLING = "plain";
-/**
-* Why a relay URL cannot be used, or null. TLS, except on this machine (a local `iroh-relay --dev`): a page
-* may not open plain WebSockets elsewhere, and the relay's operator would see traffic metadata in the clear.
-*/
-function irohRelayProblem(value) {
-	let url;
-	try {
-		url = new URL(value);
-	} catch {
-		return `Not a relay address: ${value}`;
-	}
-	const local = [
-		"localhost",
-		"127.0.0.1",
-		"[::1]"
-	].includes(url.hostname);
-	if (url.protocol !== "https:" && !(url.protocol === "http:" && local)) return `Use an https:// relay address: ${value}`;
-	if (url.username || url.password || url.search || url.hash || value.length > 256) return `Not a relay address: ${value}`;
-	return null;
-}
-var loaded = null;
-/** Loads the wasm once per page. Tests pass their own `load` (Node reads the file). */
-function loadIrohWasm() {
-	loaded ??= import("./ghostly_iroh_web-Dvzh3Y6E.js").then(async (module) => {
-		await module.default();
-		return module;
-	}).catch((error) => {
-		loaded = null;
-		throw error;
-	});
-	return loaded;
-}
-var SEND_BUDGET = 122880;
-var MAX_FRAME = 61440;
-/** One paired channel over one QUIC stream. Sends are queued in order. */
-var IrohWebChannel = class {
-	conn;
-	forget;
-	reader = null;
-	buffered = [];
-	queue = Promise.resolve();
-	closed = false;
-	bufferedAmount = 0;
-	sendBudget = SEND_BUDGET;
-	onClose = null;
-	constructor(conn, forget) {
-		this.conn = conn;
-		this.forget = forget;
-		this.read();
-	}
-	get onMessage() {
-		return this.reader;
-	}
-	set onMessage(reader) {
-		this.reader = reader;
-		if (reader) for (const text of this.buffered.splice(0)) reader(text);
-	}
-	async read() {
-		try {
-			for (;;) {
-				const text = await this.conn.recv();
-				if (text === void 0 || this.closed) break;
-				if (this.reader) this.reader(text);
-				else if (this.buffered.length < 64) this.buffered.push(text);
-				else break;
-			}
-		} catch {}
-		this.close();
-	}
-	send(data) {
-		if (typeof data !== "string" || this.closed || !data.length || data.length > MAX_FRAME || this.bufferedAmount + data.length > SEND_BUDGET) throw new Error("Iroh channel is closed or its send budget is full");
-		this.bufferedAmount += data.length;
-		this.queue = this.queue.then(() => this.closed ? void 0 : this.conn.send(data)).catch(() => this.close()).finally(() => {
-			this.bufferedAmount -= data.length;
-		});
-	}
-	drained() {
-		return this.queue;
-	}
-	get rttMs() {
-		const rtt = this.conn.rtt();
-		return rtt >= 0 ? rtt : void 0;
-	}
-	close() {
-		if (this.closed) return;
-		this.closed = true;
-		this.buffered = [];
-		try {
-			this.conn.close();
-		} catch {}
-		this.forget();
-		this.onClose?.();
-	}
-};
-/** A NativeEndpoint for `iroh/1`, as the Desktop's is, for one chat's transport seed. */
-async function createIrohWebEndpoint(seedB64, options = {}) {
-	const seed = fromBase64Url(seedB64);
-	if (seed.length !== 32) throw new Error("Invalid transport seed");
-	const relays = [...new Set((options.relays?.length ? options.relays : DEFAULT_IROH_RELAYS).map((relay) => irohRelayUrl(relay, BROWSER_SPELLING)))];
-	const node = await (await (options.load ?? loadIrohWasm)()).IrohNode.start(seed, relays, options.onlineMs ?? 1e4);
-	const channels = /* @__PURE__ */ new Set();
-	let stopped = false;
-	let handler = null;
-	const early = [];
-	const bind = (conn) => {
-		const channel = new IrohWebChannel(conn, () => channels.delete(channel));
-		channels.add(channel);
-		return {
-			channel,
-			binding: conn.binding()
-		};
-	};
-	const endpoint = {
-		transport: "iroh/1",
-		descriptor: {
-			...node.address(),
-			relayed: true
-		},
-		onDescriptor: null,
-		get onConnection() {
-			return handler;
-		},
-		set onConnection(value) {
-			handler = value;
-			if (value) for (const bound of early.splice(0)) value(bound);
-		},
-		async connect(descriptor) {
-			if (stopped) throw new Error("Iroh endpoint is stopped");
-			const conn = await node.connect(irohDescriptor(descriptor, BROWSER_SPELLING), options.connectMs ?? 2e4);
-			if (stopped) {
-				conn.close();
-				throw new Error("Iroh endpoint is stopped");
-			}
-			return bind(conn);
-		},
-		async close() {
-			if (stopped) return;
-			stopped = true;
-			for (const channel of [...channels]) channel.close();
-			for (const bound of early.splice(0)) bound.channel.close();
-			await node.close().catch(() => {});
-		}
-	};
-	(async () => {
-		while (!stopped) {
-			let conn;
-			try {
-				conn = await node.accept();
-			} catch {
-				break;
-			}
-			if (!conn) break;
-			if (stopped) {
-				conn.close();
-				break;
-			}
-			const bound = bind(conn);
-			const accept = endpoint.onConnection;
-			if (accept) accept(bound);
-			else if (early.length < 4) early.push(bound);
-			else bound.channel.close();
-		}
-		if (!stopped) {
-			endpoint.onUnavailable?.();
-			await endpoint.close();
-		}
-	})();
-	return endpoint;
-}
-//#endregion
 //#region ../browser/src/engine/node.ts
 /** How long a chat waits before listening again after its HyperDHT relay went away. */
 var RELAY_RETRY_MS = 3e4;
@@ -32793,14 +33955,15 @@ var GhostlyNode = class GhostlyNode {
 		onReviewedPaymentResult: async (id) => {
 			await this.reconcilePayment({ id });
 		},
-		onReviewedPaymentRefused: async (id, reason) => {
+		onReviewedPaymentRefused: async (id, reason, back) => {
 			const intent = await intentRepository.get(id);
 			if (intent && ["submitted", "unknown"].includes(intent.review.state)) await intentRepository.put({
 				...intent,
 				review: {
 					...intent.review,
 					state: "failed",
-					error: `Refused: ${reason}. The sats came back.`
+					error: refusedLine(reason, back),
+					...back ? { returned: back } : {}
 				}
 			});
 			this.emitState();
@@ -33731,6 +34894,7 @@ var GhostlyNode = class GhostlyNode {
 			this.prepareSpare(STARTUP_QUIET_MS);
 		}
 		if (!this.limitedMode) this.openStartedWallets(fresh);
+		if (this.appsOn) this.appStore.start().catch(() => {});
 		if (!this.options.singleDevice && this.networkOn && knownDeviceGate()?.state === "active") this.startDeviceSet().catch(() => {});
 		if (!this.options.singleDevice && this.limitedMode && knownDeviceGate()?.state === "active") this.readTurnWhileLimited();
 		if (this.restoreCheck === "checking" && this.limitedMode) this.checkRestoredTurn(0);
@@ -34115,6 +35279,7 @@ var GhostlyNode = class GhostlyNode {
 			clearTimeout(this.limitedTimer);
 			this.limitedTimer = null;
 		}
+		this.appShelf?.stop();
 		if (!quiet) this.depart();
 		this.directPath.close();
 		this.clock.close();
@@ -34187,6 +35352,83 @@ var GhostlyNode = class GhostlyNode {
 		await this.shutdown();
 		await clearProfileStores();
 	}
+	appShelf;
+	/** The installed apps and stores, refused while the apps feature is off. */
+	get appStore() {
+		if (!this.appsOn) throw new Error("Apps are unavailable in this release");
+		return this.appShelf ??= new Apps({
+			fetch: boundedAppFetch({
+				fetcher: this.options.appFetch,
+				online: () => this.networkOn
+			}),
+			isChat: (scope) => {
+				const stored = this.links.get(scope)?.stored;
+				return !!stored && !stored.group && !!stored.profile && !!stored.pairedPeerKey;
+			},
+			online: () => this.networkOn && !this.shuttingDown,
+			checked: () => this.events.onAppsChecked?.()
+		});
+	}
+	appList() {
+		return this.appStore.list();
+	}
+	appStoreList() {
+		return this.appStore.listStores();
+	}
+	appStorePreview(params) {
+		return this.appStore.previewStore(params);
+	}
+	appStoreAdd(params) {
+		return this.appStore.addStore(params);
+	}
+	appStoreRemove(params) {
+		return this.appStore.removeStore(params);
+	}
+	appStoreRefresh(params = {}) {
+		return this.appStore.refreshStores(params);
+	}
+	appPreview(params) {
+		return this.appStore.preview(params);
+	}
+	appInstall(params) {
+		return this.appStore.install(params);
+	}
+	appUpdateAccept(params) {
+		return this.appStore.acceptUpdate(params);
+	}
+	appCheckUpdates() {
+		return this.appStore.checkUpdates();
+	}
+	appUninstall(params) {
+		return this.appStore.uninstall(params);
+	}
+	appRunCheck(params) {
+		return this.appStore.runCheck(params);
+	}
+	appFetchFiles(params) {
+		return this.appStore.fetchFiles(params);
+	}
+	appEntry(params) {
+		return this.appStore.entry(params);
+	}
+	appFile(params) {
+		return this.appStore.file(params);
+	}
+	appStorageGet(params) {
+		return this.appStore.storageGet(params);
+	}
+	appStorageSet(params) {
+		return this.appStore.storageSet(params);
+	}
+	appStorageDelete(params) {
+		return this.appStore.storageDelete(params);
+	}
+	appStorageKeys(params) {
+		return this.appStore.storageKeys(params);
+	}
+	appDataExport(params) {
+		return this.appStore.exportData(params);
+	}
 	getState() {
 		const groups = this.groups.views();
 		return {
@@ -35033,7 +36275,7 @@ var GhostlyNode = class GhostlyNode {
 			this.transport.networkChanged?.();
 			this.directPath.reset();
 		}
-		for (const live of this.links.values()) live.link?.wake();
+		for (const live of this.links.values()) live.link?.wake({ network: params.network });
 		this.hold.wake();
 		for (const network of WALLET_NETWORKS) {
 			this.lightnings[network].wake();
@@ -36971,6 +38213,58 @@ var GhostlyNode = class GhostlyNode {
 		this.flushPin(linkId);
 		return { error: null };
 	}
+	/** Mini-apps are on in this build (`APPS_ENABLED`) or for this engine (`apps`). */
+	get appsOn() {
+		return this.options.apps ?? false;
+	}
+	/** A paired 1:1 chat and the chat app id of `ref` in it, from the two pinned participation keys (WISP 1200 § In a chat). */
+	appChat(linkId, ref) {
+		if (!this.appsOn) throw new Error("Apps are unavailable in this release");
+		const live = typeof linkId === "string" ? this.links.get(linkId) : void 0;
+		if (!live || live.stored.group || !live.stored.profile) throw new Error("No such chat");
+		if (!isAppRef(ref)) throw new Error("Not an app reference");
+		const { participationSeed, pairedPeerKey } = live.stored;
+		if (!participationSeed || !pairedPeerKey) throw new Error("This chat is not paired yet");
+		return {
+			live,
+			app: chatAppId(identityFromSeedB64(participationSeed).publicKey, publicKeyFromZ32(pairedPeerKey), ref)
+		};
+	}
+	/** The chat app id of an app in a paired chat: how the contact's frames name it. */
+	appId({ linkId, ref }) {
+		return { app: this.appChat(linkId, ref).app };
+	}
+	/**
+	* This side opened an app in a paired chat, or updated it: `open` goes to the contact now when the session is live,
+	* and again on every session that comes back while it stays open.
+	*/
+	async appOpen({ linkId, ref, version }) {
+		const { live, app } = this.appChat(linkId, ref);
+		if (!isAppVersion(version)) throw new Error("Not an app version");
+		await this.appStore.chatRunnable({ ref });
+		const open = live.appsOpen ??= /* @__PURE__ */ new Map();
+		if (live.link) live.link.openApp(app, version);
+		else open.set(app, version);
+		return { app };
+	}
+	/** This side closed an app in a paired chat: `close` goes now when the session is live. */
+	appClose({ linkId, ref }) {
+		const { live, app } = this.appChat(linkId, ref);
+		if (live.link) live.link.closeApp(app);
+		else live.appsOpen?.delete(app);
+	}
+	/** One data frame of an app open on both sides, on the live session only; nothing is kept to send later. */
+	async appSend({ linkId, ref, data }) {
+		const { live, app } = this.appChat(linkId, ref);
+		if (!live.appsOpen?.has(app)) return { error: "not-open" };
+		await this.appStore.chatRunnable({ ref });
+		return { error: live.link ? live.link.sendAppData(app, data) : "offline" };
+	}
+	/** Every page went away: no app runs here any more, so each open one is closed (`close` goes where it can). */
+	appsCloseAll() {
+		for (const live of this.links.values()) for (const app of [...live.appsOpen?.keys() ?? []]) if (live.link) live.link.closeApp(app);
+		else live.appsOpen?.delete(app);
+	}
 	/** Keeps a pin of a 1:1 chat when it is newer than the chat's; `out`: mine, to say until the contact confirms it. */
 	async keepLinkPin(linkId, pin, out) {
 		const live = this.links.get(linkId);
@@ -38126,7 +39420,7 @@ var GhostlyNode = class GhostlyNode {
 			...settings
 		};
 		if (!this.settings.irohRelays?.length) delete this.settings.irohRelays;
-		if (irohRelaysChanged) this.rehomeIroh();
+		if (irohRelaysChanged && !this.options.irohRelays?.length) this.rehomeIroh();
 		if (settings.relays) {
 			this.relays?.setRelays(settings.relays);
 			if (this.relays) this.settings.relays = this.relays.describe().relays;
@@ -38624,6 +39918,17 @@ var GhostlyNode = class GhostlyNode {
 		}
 	}
 	/**
+	* Whether a device code may be used in this profile now, asked before the person presses Add (WISP 06 § User
+	* experience): `ready`, or why not: `set` (this profile is already on several devices), `in-use` (it holds something,
+	* `inUse`), `loading` (what it holds is not known yet). The page says up front that a new profile is made for the
+	* code; `deviceEnrollJoin` still decides, and refuses as before.
+	*/
+	async deviceEnrollReady() {
+		if (this.starting) await this.starting;
+		if (await readDeviceRecord(databaseName()).catch(() => null)) return "set";
+		return this.inUse() ?? "ready";
+	}
+	/**
 	* Whether this profile holds anything a person would lose if it became a standby here: a chat, a group, an identity,
 	* money or a payment, or a wallet with keys of its own. The wallets a new profile gets by itself (Mainnet Cashu, with
 	* the Cashu mints' Lightning card, and USDT, `walletSetup.ts`) count only once they hold, wait for or have moved
@@ -38650,6 +39955,11 @@ var GhostlyNode = class GhostlyNode {
 	}
 	/** The giver of this active device: answers a pull, makes a push, runs pass 1 while this engine goes on. */
 	handoffGiver = null;
+	/** A call is on in one of the pages (`setCallOn`, told by the host for all of them): a handoff waits for it to end. */
+	callOn = false;
+	setCallOn({ on }) {
+		this.callOn = on === true;
+	}
 	async startHandoff() {
 		const host = handoffProfileHost(), links = this.deviceLinks;
 		if (!host || !links || this.handoffGiver || this.options.singleDevice) return;
@@ -38736,6 +40046,7 @@ var GhostlyNode = class GhostlyNode {
 	* or anything this build cannot judge. Null: the wallets move or stay home by their plan.
 	*/
 	async handoffBusy(taker) {
+		if (this.callOn) return { why: "call" };
 		if (this.limitedMode || !this.walletsStarted) return { why: "loading" };
 		await this.refreshWallet().catch(() => {});
 		const { refusal } = await this.handoffPlan(taker);
@@ -39330,6 +40641,10 @@ var GhostlyNode = class GhostlyNode {
 			statusCardSupport: true,
 			buttonsSupport: true,
 			wakeSupport: true,
+			upgradeSupport: true,
+			peerUpgrades: () => !!live.caps?.peer?.capabilities.includes(UPGRADE_CAPABILITY),
+			appsSupport: this.appsOn,
+			appsOpen: this.appsOn ? live.appsOpen ??= /* @__PURE__ */ new Map() : void 0,
 			servicesSupport: this.options.servicesSupport ?? (this.options.platform ?? "web") !== "web",
 			dht: stored.profile ? {
 				state: stored.dhtDeliveryState,
@@ -39635,6 +40950,7 @@ var GhostlyNode = class GhostlyNode {
 				onPinSupport: (supported) => {
 					if (supported) this.flushPin(linkId);
 				},
+				onAppFrame: this.appsOn ? (event) => this.events.onAppFrame?.(linkId, event) : void 0,
 				onPaymentRequest: (request) => this.desk.onPaymentRequest(linkId, request),
 				onPaymentAsk: (ask) => this.desk.onPaymentAsk(linkId, ask),
 				onPayment: (payment) => this.desk.onPayment(linkId, payment),
@@ -39728,6 +41044,7 @@ var GhostlyNode = class GhostlyNode {
 				DHT_FILE_CAPABILITY,
 				...live?.stored.hold?.enabled ? [HOLD_CAPABILITY] : [],
 				"files/2",
+				UPGRADE_CAPABILITY,
 				...GhostlyNode.testNoEdit() ? [] : [EDIT_CAPABILITY],
 				...cashu || lightning ? ["payments/1"] : [],
 				...cashu ? ["payments-cashu/1"] : [],
@@ -39784,7 +41101,7 @@ var GhostlyNode = class GhostlyNode {
 	get nativeFactories() {
 		const relay = this.relaysHyperdht ? this.hyperdhtRelay : "";
 		return {
-			...relay ? { "hyperdht/1": async (seedB64) => (await import("./hyperdhtRelay-CHMS7_KO.js")).createRelayedHyperEndpoint(seedB64, relay) } : {},
+			...relay ? { "hyperdht/1": async (seedB64) => (await import("./hyperdhtRelay-w9cwVqGZ.js")).createRelayedHyperEndpoint(seedB64, relay) } : {},
 			...this.options.nativeTransports,
 			...this.ownIrohRelays ? { "iroh/1": (seedB64) => this.options.nativeTransports["iroh/1"](seedB64, this.settings.irohRelays?.length ? { relays: [...this.settings.irohRelays] } : {}) } : {},
 			...this.options.irohWeb ? { "iroh/1": (seedB64) => createIrohWebEndpoint(seedB64, { relays: this.irohRelays }) } : {}
@@ -39795,6 +41112,7 @@ var GhostlyNode = class GhostlyNode {
 		return !!this.options.nativeIrohRelays && !!this.options.nativeTransports?.["iroh/1"];
 	}
 	get irohRelays() {
+		if (this.options.irohRelays?.length) return [...this.options.irohRelays];
 		return this.settings.irohRelays?.length ? this.settings.irohRelays : [...DEFAULT_IROH_RELAYS];
 	}
 	/** New Iroh relays: idle endpoints move now; one carrying a chat keeps its relay until that session ends. */
@@ -40336,6 +41654,11 @@ var EngineServer = class {
 	* it too: the extension's peer runs with no tab open, and a tab opened during the ring used to show no call.
 	*/
 	offers = /* @__PURE__ */ new Map();
+	/**
+	* The clients a call is on in (`setCallOn`): the engine hears whether any is, so a handoff waits for every page's
+	* call (WISP 06 § States and events). A client that goes away (a tab closed mid-call) is taken out with it.
+	*/
+	onCall = /* @__PURE__ */ new Set();
 	constructor(options = {}) {
 		this.node = new GhostlyNode({
 			onAttention: (event) => this.broadcast({
@@ -40357,6 +41680,12 @@ var EngineServer = class {
 					signal
 				});
 			},
+			onAppFrame: (linkId, event) => this.broadcast({
+				kind: "app-frame",
+				linkId,
+				event
+			}),
+			onAppsChecked: () => this.broadcast({ kind: "apps-checked" }),
 			onDeviceGate: (gate) => this.broadcast({
 				kind: "device-gate",
 				gate
@@ -40404,7 +41733,11 @@ var EngineServer = class {
 	detach(client) {
 		this.clients.delete(client);
 		this.histories.delete(client);
-		if (this.clients.size === 0) this.node.setActiveLink({ linkId: null });
+		if (this.clients.size === 0) {
+			this.node.setActiveLink({ linkId: null });
+			this.node.appsCloseAll();
+		}
+		if (this.onCall.delete(client)) this.node.setCallOn({ on: this.onCall.size > 0 });
 	}
 	async handle(client, request) {
 		if (request?.kind !== "request") return;
@@ -40413,12 +41746,18 @@ var EngineServer = class {
 			id: request.id
 		};
 		if (request.method === "setCallSignal") this.offers.delete(request.params?.linkId ?? "");
+		let params = request.params;
+		if (request.method === "setCallOn") {
+			if (request.params?.on === true) this.onCall.add(client);
+			else this.onCall.delete(client);
+			params = { on: this.onCall.size > 0 };
+		}
 		try {
 			await this.ready;
 			const method = this.node[request.method];
 			if (typeof method !== "function") throw new Error(`Unknown method: ${request.method}`);
 			if (this.node.limited && !LIMITED_MODE_METHODS.has(String(request.method))) throw new Error(LIMITED_MODE_ERROR);
-			response.result = await method.call(this.node, request.params);
+			response.result = await method.call(this.node, params);
 		} catch (error) {
 			response.error = error instanceof Error ? error.message : String(error);
 		}
@@ -40505,4 +41844,4 @@ function signalKind(signal) {
 //#endregion
 export { EngineServer, hyperdhtRelayProblem as n, server_exports as t };
 
-//# sourceMappingURL=server-9AM0ta6q.js.map
+//# sourceMappingURL=server-TamKsfmC.js.map