@ghostlytools/cli 1.1.4 → 1.1.5

package/dist/assets/{server-CXFTDnFI.js → server-TamKsfmC.js}

@@ -1,7 +1,9 @@
-import { a as fileBytesOf, c as removeFileBytes, d as __exportAll, i as fileBytes, n as blobDigest } from "./fileBytes-DxiJHmTk.js";
-import { $a as HANDOFF_VERIFIED, $i as replySnippet, $n as freshHubs, $o as OwnInviteError, $s as fromBase64Url, $t as isPubkyKey, A as GROUP_EDIT_TEXT_BYTES, Ai as parseVoiceMeta, An as findEndpoint, Ar as newWakeToken, As as DEFAULT_RELAYS, At as encodeDidDhtPacket, Ba as HTTP_SERVICE_PROTO, Bi as COMMUNITY_REACTION_FRAME, Bo as enrollCancelFrame, Br as HOLD_DATED_BACK_MS, Bt as USDT_PUBLIC_RPC, C as groupWakes, Ca as GhostlyHttpError, Ci as safeBlobType, Co as readHandoffHave, Cr as nextPinNumber, Cs as firstDeviceSetSecret, D as GroupSession, Da as LIMITS, Dn as ENDPOINT, Do as readHandoffVerified, Dr as WAKE_CALL_INTERVAL_MS, Ds as signTurnRelease, Dt as didDhtDocument, E as GROUP_READ_NOTE, Ea as webLocalFetch, En as decodeBolt11, Eo as readHandoffTurnFrame, Er as readPin, Es as signTurnPacket, Fi as RateWindow, Fn as INVITE_TAKEN, Fo as verifySetUpdate, Fr as vapidKeysMatch, Fs as traceLink, Ft as ONCHAIN_PROVIDER, Ga as HANDOFF_DONE, Gi as queueReaction, Gn as MESH_HUBS, Go as enrollHelloFrame, Gr as readManifest, Gs as createIdentity, Gt as validatePaymentTarget, Ha as serviceIdFromName, Hi as REACTION_LIMITS, Ho as enrollDigits, Hr as HoldKeys, Ht as assertTokenUnits, Ii as dhtEditId, In as LIVENESS_PING_MS, Is as budgetRetryMs, It as PaymentPreflightError, Ja as HANDOFF_OFFER, Ji as readReaction, Jn as pickMeshHubs, Jo as readEnrollHello, Jr as capsDescriptors, Js as publicKeyFromZ32, Jt as SPARK_PROVIDER, Ka as HANDOFF_HAVE, Ki as reactionEmoji, Kn as mayBeHub, Ko as enrollProofFrame, Kr as CapsExchange, Ks as identityFromSeed, Kt as walletNetworkOf, La as parseCallSignal, Li as parseLinkPreview, Ln as pairedMessageFrame, Lr as EDIT_CAPABILITY, Ls as isDiscoveryBudgetError, Lt as SEPOLIA_TEST_USDT, M as parseCommunityEdit, Mi as parseVideoMeta, Mn as parseCashuRequestPayload, Mo as setAckFrame, Mr as relayRequest, Ms as currentRelays, Mt as signDidDhtPacket, N as mentionsMember, Ni as EDIT_BUFFER_MS, Nn as parseFedimintRequestPayload, No as setUpdateFrame, Nr as wakeRequest, Ns as normalizeRelayUrl, Nt as ETHEREUM_USDT, Oa as decodeControl, On as cashuRequestPayload, Oo as sealHandoffPiece, Or as WakeLimiter, Os as turnKeys, Ot as didDhtFromPublicKey, P as groupName, Pi as EDIT_RATE_WINDOW_MS, Pn as GhostLink, Po as signTombstone, Pr as checkPushEndpoint, Pt as EVM_TEST_CHAINS, Qa as HANDOFF_TIMINGS, Qi as readReply, Qn as doorHubs, Qo as readDeviceInvite, Qr as IDENTITY_REVOCATION_LABEL, Qs as bytesEqual, Ri as forwardedAgain, Rn as CarriedTransport, Rr as UPGRADE_CAPABILITY, Rs as withRequestOptions, Rt as SEPOLIA_TEST_USDT_FAUCET, S as groupWakeFrame, Sa as presenceSeenAt, So as readHandoffDone, Sr as mayPin, Ss as TURN_MAX, Ta as parseLocalTarget, Tn as engineText, To as readHandoffPake, Tr as pinNumberHolds, Ts as readTurnPacket, Ua as HANDOFF_ACK, Ui as ReactionWindow, Un as groupSignalFrame, Uo as enrollDoneFrame, Ur as HoldRefusedError, Ut as assertWholeSats, Va as LEGACY_SERVICES, Vi as GROUP_REACTION_FRAME, Vo as enrollCancelReason, Vr as HOLD_LIMITS, Vs as createRelayPayload, Vt as WALLET_NETWORKS, Wa as HANDOFF_CANCEL, Wi as nextReactionNumber, Wn as readGroupSignal, Wo as enrollGrantFrame, Wr as newMailbox, Wt as formatPaymentAmount, Xa as HANDOFF_PIECE_BYTES, Xi as wireReaction, Xn as beaconKeys, Xo as createDeviceInvite, Xt as sparkInvoiceDetails, Ya as HANDOFF_PAKE, Yi as validReactionNumber, Yn as COMMUNITY_TOPOLOGY, Yo as verifyEnrollProof, Yr as dialDescriptors, Ys as verify, Yt as sparkAddressKind, Za as HANDOFF_REQUEST, Zi as pairedReplyAuthor, Zn as beaconRecords, Zo as deviceInviteJoinerParams, Zs as sanitizeAvatar, Zt as isBitcoinAddress, _ as knockRecords, _a as verifyCommitSignature, _i as DHT_MESSAGE_TTL, _o as handoffStreamKey, _r as TypingSender, _s as TURN_RAISE_READ_TIMEOUT_MS, a as sealGroupTyping, aa as checkStatusCard, ai as newIdentityBinding, ao as handoffCancelFrame, ar as pickHubs, as as DEVICES_CAPABILITY, bi as dhtFileId, bo as readHandoffAck, bs as turnPutSummary, c as GROUP_READ_NOTE_COMMUNITY, ca as arrivalKey, ci as lastSharedWithMe, co as handoffDataFrame, cr as readBeaconHead, cs as deviceEchoFrame, d as encodeCommunityLink, da as receivedTimestamp, di as validExternalKey, do as handoffHelloFrame, dr as ChatFiles, ds as deviceLinkPairing, ea as BUTTON_ID, ec as randomBytes, ei as IdentityExchange, eo as filePartName, er as lobbyKeys, es as createChatInvite, et as isAtprotoDid, fa as shownTime, fi as TRANSPORTS, fo as handoffManifestFrames, fr as FILE_LIMITS, fs as devicePingFrame, g as knockIdentity, ga as rosterHas, go as handoffRetryAfter, h as entryParams, ha as MEMBER_KEY, hi as irohRelayUrl, ho as handoffReleaseFrame, hs as webCryptoSigner, i as openGroupTyping, ic as utf8Encode, ii as identityStatement, io as handoffBusyFrame, ir as newerHead, is as inviteOwnership, j as carryMentions, ja as RTC_CONFIG, jn as isFederationId, jo as readSetUpdate, jr as parseWakeFrame, js as RelayTransport, ka as encodeControl, ki as fileMessageText, kn as fedimintRequestPayload, kr as deviceWakeRequest, ks as turnName, kt as encodeDidDhtDeactivated, l as communityHasFrame, la as claimedTime, li as PeerProofs, lo as handoffDigest, lr as readLobby, ls as deviceEchoNonce, m as encodeGroupEntryLink, mi as irohDescriptor, mo as handoffPakeFrame, mr as transferStalled, ms as seedSigner, n as GroupTypingBoard, nc as toZ32, ni as emptyIdentityLedger, no as handoffAttemptFailed, nr as mergeBeacon, ns as encodeInviteCode, o as COMMUNITY_LIMITS, oa as sameButtonText, oi as receivedIdentityStatus, oo as handoffContext, or as rankHubs, os as ENROLL_CAPABILITY, p as decodeGroupEntryLink, pa as GROUP_MEMBER_CAP, pi as automaticTransport, po as handoffOfferFrame, pr as transferEnded, ps as newDeviceSetSecret, qa as HANDOFF_HELLO, qi as reactionIsNewer, qn as meshHubs, qo as readEnrollGrant, qr as DHT_TEXT_CAPABILITY, qs as identityFromSeedB64, qt as SPARK_NETWORKS, r as groupTypingEpoch, ra as STATUS_CARD_LIMITS, rc as utf8Decode, ri as identityRevocationValue, ro as handoffAttemptSucceeded, rr as mergeLobby, s as CommunitySession, sa as statusCardText, si as revokesIdentity, so as handoffContextProof, sr as readBeacon, ss as HANDOFF_CAPABILITY, tc as toBase64Url, to as handoffAttemptAllowed, tr as lobbyRecords, ts as decodeInviteCode, tt as normalizeAtprotoHandle, u as decodeCommunityLink, ua as heardTime, ui as emptyProofLedger, uo as handoffEphemeral, ur as shouldBeHub, us as deviceKeyZ32, v as mergeKnocks, va as edgeParams, vi as peekDhtMailbox, vo as handoffVersions, vs as TURN_SETTLE_MS, w as parseGroupWakeFrame, wa as formatLocalTarget, wn as engineError, wo as readHandoffHello, wr as pinIsNewer, ws as nextTurnPosition, x as GroupWakeLimiter, xa as RELAY_POLL_INTERVALS, xi as parseImageMeta, xo as readHandoffCancel, xr as PIN_LIMITS, xs as TURN_LAST_SEQUENCE, y as readKnocks, ya as DirectPathWatch, yi as DHT_FILE_CAPABILITY, yo as newHandoffId, yr as typingActivity, ys as classifyTurnRead, za as emptyLinkRecords, zi as readForwarded, zr as HOLD_CAPABILITY, zs as PacketTooLargeError, zt as TEST_USDT_FAUCET_AMOUNT } from "./src-K3NijMq-.js";
-import { a as deleteDatabase, c as profileOpenFailure, d as wrap, i as databaseName, l as store, n as STORES$1, o as fileStore, r as clearProfileStores, s as openDb, t as CARD_INDEX, u as transact } from "./idb-Co2lObpU.js";
-import { $ as onAdaptersChanged, A as intentRepository, C as ProviderSources, Ct as FileAppender, D as requireTurn, Dt as streamStored, E as refuseAway, Et as storedSize, F as ModeGate, G as fakesLightning, H as BITCOIN_INVOICE_ON_TESTNET, I as WrongNetworkError, J as mintNetwork, K as isTestMint, L as networkLabel, M as sealSeed, N as unsealSeed, O as setAwayWallets, P as ModeChanged, Q as identityProviders, R as CASHU_MINT_SOURCE, S as lightningPaying, St as paymentWireId, T as awayFrom, Tt as removeStored, U as DEFAULT_MINTS, V as WALLET_TYPES, W as TEST_MINT, X as BACKUP_MEDIA_TYPE, Y as paysItsOwnInvoices, Z as MAX_BACKUP_BYTES, _ as normalizePhrase, _t as pairedWireReply, a as createFailure, at as SourceConfigError, b as breezDatabasesFor, bt as replyTo, c as paymentNetwork, ct as networkMode, d as networkReason, dt as resolveAtprotoDid, et as registeredLightningProviders, f as rpcHost, ft as setOwnDidSource, g as isRecoveryPhrase, gt as groupReply, h as cardsKey, ht as chosenResolver, i as assertConfirmedReal, it as PROVIDER_PLATFORMS, j as newDeviceKey, k as setSingleWriterGate, l as paymentNetworksOf, lt as redact, m as LightningCards, mt as verifyIdentity, n as loadFedimintSdk, nt as reserveAdapterIds, o as createTiming, ot as SourceUnreachableError, p as CASHU_CARD, pt as boundedIdentityFetch, q as isWorthlessMint, r as WALLET_NAMES, rt as NothingSpentError, s as crossNetwork, st as isNothingSpentError, t as fedimintDatabase, tt as registeredOnchainProviders, u as walletInstances, ut as assertPublicServer, v as breezDatabase, vt as receivedPairedReply, w as sourceKey, wt as readStored$1, x as dropBreezDatabase, xt as paymentAlias, y as breezDatabaseInUse, yt as replyRef, z as cashuMint } from "../ghostly.mjs";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { $a as parseLocalTarget, $i as parseLinkPreview, $o as readHandoffPake, $r as EDIT_CAPABILITY, $s as readTurnPacket, $t as TEST_USDT_FAUCET_AMOUNT, A as knockIdentity, Ac as toZ32, Ao as handoffAttemptFailed, As as encodeInviteCode, B as GROUP_READ_NOTE, Bn as decodeBolt11, Bo as handoffManifestFrames, Br as readPin, Bs as devicePingFrame, C as communityHasFrame, Ca as statusCardText, Cc as verify, Ci as revokesIdentity, Co as HANDOFF_PAKE, Cr as readLobby, Cs as verifyEnrollProof, D as decodeGroupEntryLink, Da as receivedTimestamp, Dc as fromBase64Url, Di as validExternalKey, Do as HANDOFF_VERIFIED, Dr as transferEnded, Ds as OwnInviteError, Ea as heardTime, Ec as bytesEqual, Ei as emptyProofLedger, Eo as HANDOFF_TIMINGS, Er as FILE_LIMITS, Es as readDeviceInvite, F as GroupWakeLimiter, Fa as isAppRef, Fi as DHT_FILE_CAPABILITY, Fo as handoffContextProof, Fr as PIN_LIMITS, Fs as HANDOFF_CAPABILITY, G as carryMentions, Ga as verifyCommitSignature, Gi as fileMessageText, Gn as isFederationId, Go as handoffStreamKey, Gr as parseWakeFrame, Gs as TURN_RAISE_READ_TIMEOUT_MS, Hn as cashuRequestPayload, Ho as handoffPakeFrame, Hr as WakeLimiter, Hs as seedSigner, Ht as didDhtFromPublicKey, I as groupWakeFrame, Ia as readAppRevocations, Ii as dhtFileId, Io as handoffDataFrame, Ir as mayPin, Is as deviceEchoFrame, J as groupName, Ji as parseVideoMeta, Jn as GhostLink, Jo as readHandoffAck, Jr as checkPushEndpoint, Js as turnPutSummary, Jt as EVM_TEST_CHAINS, K as parseCommunityEdit, Ka as edgeParams, Ki as parseVoiceMeta, Kn as parseCashuRequestPayload, Ko as handoffVersions, Kr as relayRequest, Ks as TURN_SETTLE_MS, Kt as signDidDhtPacket, L as groupWakes, Li as parseImageMeta, Lo as handoffDigest, Lr as nextPinNumber, Ls as deviceEchoNonce, M as mergeKnocks, Ma as appRef, Mc as utf8Encode, Mo as handoffBusyFrame, Ms as inviteOwnership, N as readKnocks, Ni as DHT_MESSAGE_TTL, No as handoffCancelFrame, Nr as typingActivity, Ns as DEVICES_CAPABILITY, O as encodeGroupEntryLink, Oa as shownTime, Oc as randomBytes, Oi as TRANSPORTS, Oo as filePartName, Or as transferStalled, Os as createChatInvite, Pa as isAppKey, Pi as peekDhtMailbox, Po as handoffContext, Ps as ENROLL_CAPABILITY, Qa as formatLocalTarget, Qi as dhtEditId, Qn as CarriedTransport, Qo as readHandoffHello, Qs as nextTurnPosition, Qt as SEPOLIA_TEST_USDT_FAUCET, R as parseGroupWakeFrame, Rn as engineError, Ro as handoffEphemeral, Rr as pinIsNewer, Rs as deviceKeyZ32, S as GROUP_READ_NOTE_COMMUNITY, Sa as sameButtonText, Sc as publicKeyFromZ32, Si as receivedIdentityStatus, So as HANDOFF_OFFER, Sr as readBeaconHead, Ss as readEnrollHello, T as encodeCommunityLink, Ta as claimedTime, Tc as sanitizeAvatar, Ti as PeerProofs, To as HANDOFF_REQUEST, Tr as ChatFiles, Ts as deviceInviteJoinerParams, Ua as MEMBER_KEY, Un as fedimintRequestPayload, Uo as handoffReleaseFrame, Ur as deviceWakeRequest, Us as webCryptoSigner, Ut as encodeDidDhtDeactivated, V as GroupSession, Va as GROUP_MEMBER_CAP, Vn as ENDPOINT, Vo as handoffOfferFrame, Vr as WAKE_CALL_INTERVAL_MS, Vs as newDeviceSetSecret, Vt as didDhtDocument, W as GROUP_EDIT_TEXT_BYTES, Wa as rosterHas, Wn as findEndpoint, Wo as handoffRetryAfter, Wr as newWakeToken, Wt as encodeDidDhtPacket, Xa as presenceSeenAt, Xi as EDIT_RATE_WINDOW_MS, Xn as LIVENESS_PING_MS, Xo as readHandoffDone, Xr as chatAppId, Xs as TURN_MAX, Xt as PaymentPreflightError, Ya as RELAY_POLL_INTERVALS, Yi as EDIT_BUFFER_MS, Yn as INVITE_TAKEN, Yo as readHandoffCancel, Yr as vapidKeysMatch, Ys as TURN_LAST_SEQUENCE, Yt as ONCHAIN_PROVIDER, Za as GhostlyHttpError, Zi as RateWindow, Zn as pairedMessageFrame, Zo as readHandoffHave, Zr as isAppVersion, Zs as firstDeviceSetSecret, Zt as SEPOLIA_TEST_USDT, _ as groupTypingEpoch, _o as HANDOFF_ACK, _r as mergeLobby, _s as enrollDoneFrame, aa as ReactionWindow, ac as RelayTransport, ai as HoldRefusedError, an as validatePaymentTarget, ao as RTC_CONFIG, ar as MESH_HUBS, as as readSetUpdate, b as COMMUNITY_LIMITS, bc as identityFromSeed, bi as identityStatement, bo as HANDOFF_HAVE, br as rankHubs, bs as enrollProofFrame, c as APP_BUNDLE_LIMITS, ca as reactionEmoji, ci as CapsExchange, cn as SPARK_PROVIDER, cr as pickMeshHubs, cs as signTombstone, da as validReactionNumber, dc as isDiscoveryBudgetError, di as dialDescriptors, dn as isBitcoinAddress, do as parseCallSignal, dr as beaconRecords, ea as forwardedAgain, ec as signTurnPacket, ei as UPGRADE_CAPABILITY, en as USDT_PUBLIC_RPC, eo as webLocalFetch, es as readHandoffTurnFrame, fa as wireReaction, fc as withRequestOptions, fr as doorHubs, g as GroupTypingBoard, ga as BUTTON_ID, gi as IdentityExchange, go as serviceIdFromName, gr as mergeBeacon, gs as enrollDigits, ha as replySnippet, hc as createRelayPayload, ho as LEGACY_SERVICES, hr as lobbyRecords, hs as enrollCancelReason, ht as normalizeAtprotoHandle, i as planAppUpdate, ia as REACTION_LIMITS, ic as DEFAULT_RELAYS, ii as HoldKeys, in as formatPaymentAmount, ir as readGroupSignal, j as knockRecords, ja as appFingerprint, jc as utf8Decode, jo as handoffAttemptSucceeded, jr as TypingSender, k as entryParams, kc as toBase64Url, ki as automaticTransport, ko as handoffAttemptAllowed, ks as decodeInviteCode, l as APP_BUNDLE_MAGIC, la as reactionIsNewer, lc as traceLink, li as DHT_TEXT_CAPABILITY, ln as sparkAddressKind, lr as COMMUNITY_TOPOLOGY, ls as verifySetUpdate, m as readAppBundle, ma as readReply, mi as IDENTITY_REVOCATION_LABEL, mo as HTTP_SERVICE_PROTO, mr as lobbyKeys, ms as enrollCancelFrame, mt as isAtprotoDid, n as appUpdateDecision, na as COMMUNITY_REACTION_FRAME, nc as turnKeys, ni as HOLD_DATED_BACK_MS, nn as assertTokenUnits, no as decodeControl, ns as sealHandoffPiece, o as readAppStore, oa as nextReactionNumber, oc as currentRelays, oi as newMailbox, on as walletNetworkOf, or as mayBeHub, os as setAckFrame, p as isAppUrl, pa as pairedReplyAuthor, pc as PacketTooLargeError, pn as isPubkyKey, po as emptyLinkRecords, pr as freshHubs, q as mentionsMember, qa as DirectPathWatch, qn as parseFedimintRequestPayload, qo as newHandoffId, qr as wakeRequest, qs as classifyTurnRead, qt as ETHEREUM_USDT, r as checkAppBeforeRun, ra as GROUP_REACTION_FRAME, rc as turnName, ri as HOLD_LIMITS, rn as assertWholeSats, ro as encodeControl, rr as groupSignalFrame, sa as queueReaction, sc as normalizeRelayUrl, si as readManifest, sn as SPARK_NETWORKS, sr as meshHubs, ss as setUpdateFrame, t as appStoreDecision, ta as readForwarded, tc as signTurnRelease, ti as HOLD_CAPABILITY, tn as WALLET_NETWORKS, to as LIMITS, ts as readHandoffVerified, u as appDigest, ua as readReaction, uc as budgetRetryMs, ui as capsDescriptors, un as sparkInvoiceDetails, ur as beaconKeys, v as openGroupTyping, vi as emptyIdentityLedger, vo as HANDOFF_CANCEL, vr as newerHead, vs as enrollGrantFrame, w as decodeCommunityLink, wa as arrivalKey, wi as lastSharedWithMe, wo as HANDOFF_PIECE_BYTES, wr as shouldBeHub, ws as createDeviceInvite, x as CommunitySession, xa as checkStatusCard, xc as identityFromSeedB64, xi as newIdentityBinding, xo as HANDOFF_HELLO, xr as readBeacon, xs as readEnrollGrant, y as sealGroupTyping, ya as STATUS_CARD_LIMITS, yc as createIdentity, yi as identityRevocationValue, yo as HANDOFF_DONE, yr as pickHubs, ys as enrollHelloFrame, za as canonicalJson, zi as safeBlobType, zn as engineText, zo as handoffHelloFrame, zr as pinNumberHolds, zs as deviceLinkPairing } from "./src-C6qQYrAH.js";
+import { a as clearProfileStores, c as fileStore, d as store, f as transact, i as STORES$1, l as openDb, n as APP_STORAGE_SCOPE_INDEX, o as databaseName, p as wrap, r as CARD_INDEX, s as deleteDatabase, t as APP_STORAGE_CHAT_INDEX, u as profileOpenFailure } from "./idb-BIdus0WX.js";
+import { a as fileBytesOf, c as removeFileBytes, i as fileBytes, l as FILE_BYTES_STEP, n as blobDigest } from "./fileBytes-3AQ2tJzW.js";
+import { $ as BACKUP_MEDIA_TYPE, A as requireTurn, At as streamStored, B as networkLabel, C as breezDatabasesFor, Ct as replyTo, D as sourceKey, Dt as readStored$1, E as ProviderSources, Et as FileAppender, F as sealSeed, G as BITCOIN_INVOICE_ON_TESTNET, H as cashuMint, I as unsealSeed, J as fakesLightning, K as DEFAULT_MINTS, L as ModeChanged, M as setSingleWriterGate, N as intentRepository, O as awayFrom, Ot as removeStored, P as newDeviceKey, Q as paysItsOwnInvoices, R as ModeGate, S as breezDatabaseInUse, St as replyRef, T as lightningPaying, Tt as paymentWireId, V as CASHU_MINT_SOURCE, W as WALLET_TYPES, X as isWorthlessMint, Y as isTestMint, Z as mintNetwork, _ as LightningCards, _t as verifyIdentity, a as irohRelayProblem, at as reserveAdapterIds, b as normalizePhrase, bt as pairedWireReply, c as createFailure, ct as SourceConfigError, d as paymentNetwork, dt as networkMode, et as MAX_BACKUP_BYTES, f as paymentNetworksOf, ft as redact, g as CASHU_CARD, gt as boundedIdentityFetch, h as rpcHost, ht as setOwnDidSource, i as createIrohWebEndpoint, it as registeredOnchainProviders, j as setAwayWallets, k as refuseAway, kt as storedSize, l as createTiming, lt as SourceUnreachableError, m as networkReason, mt as resolveAtprotoDid, n as loadFedimintSdk, nt as onAdaptersChanged, o as WALLET_NAMES, ot as NothingSpentError, p as walletInstances, pt as assertPublicServer, q as TEST_MINT, r as DEFAULT_IROH_RELAYS, rt as registeredLightningProviders, s as assertConfirmedReal, st as PROVIDER_PLATFORMS, t as fedimintDatabase, tt as identityProviders, u as crossNetwork, ut as isNothingSpentError, v as cardsKey, vt as chosenResolver, w as dropBreezDatabase, wt as paymentAlias, x as breezDatabase, xt as receivedPairedReply, y as isRecoveryPhrase, yt as groupReply, z as WrongNetworkError } from "../ghostly.mjs";
+import { n as traceJoin } from "./joinTrace-CO8mlhNO.js";
 import { hkdf } from "@noble/hashes/hkdf.js";
 import { sha256 } from "@noble/hashes/sha2.js";
 import { base64, base64url, base64urlnopad, bech32, hex } from "@scure/base";
@@ -6175,7 +6177,7 @@ var COMMANDO_NOT_RUN = {
 };
 var MAX_REPLY = 4194304;
 /** One websocket frame may carry many Lightning messages; one this large is not an answer to anything. */
-var MAX_FRAME$1 = 4259840;
+var MAX_FRAME = 4259840;
 var text$1 = new TextDecoder();
 /**
 * One connection to a node, opened on first use and again after it drops. Calls run concurrently, matched
@@ -6279,7 +6281,7 @@ var CommandoClient = class {
 			ws.onmessage = ({ data }) => {
 				if (!(data instanceof ArrayBuffer) && !ArrayBuffer.isView(data)) return fail("The node sent something that is not binary");
 				const chunk = data instanceof ArrayBuffer ? new Uint8Array(data) : new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
-				if (chunk.length > MAX_FRAME$1) return fail("The node sent more than it was asked for");
+				if (chunk.length > MAX_FRAME) return fail("The node sent more than it was asked for");
 				buffer = concatBytes(buffer, chunk);
 				try {
 					if (stage === "act2") {
@@ -11703,6 +11705,1159 @@ var eachNetwork = (value) => "mainnet" in value && "testnet" in value ? value :
 	testnet: value
 };
 //#endregion
+//#region ../browser/src/engine/appFetch.ts
+/** The hosts phase 1 reads from. A jsDelivr URL must also name a 40-character commit (`isAppUrl`). */
+var APP_FETCH_HOSTS = ["raw.githubusercontent.com", "cdn.jsdelivr.net"];
+var APP_FETCH_LIMITS = {
+	/**
+	* A store index as read (WISP 1200 § Stores, Privacy): 4 MiB in phase 1, under the format's 16 MiB. Counted on the body
+	* as it arrives, after the browser undid any compression, since a page never sees the compressed size.
+	*/
+	storeIndexBytes: 4194304,
+	/** A store's signature statement, `ghostly-store.sig` (canonical, at most 1 KiB). */
+	sigBytes: 1024,
+	/** `ghostly-revoke.json`: at most 4096 signed revocations. */
+	revocationsBytes: 16777216,
+	timeoutMs: 3e4
+};
+/** A URL this client may read an app, a store or a revocation list from. */
+function isAppFetchUrl(value) {
+	if (!isAppUrl(value)) return false;
+	const url = new URL(value);
+	return url.port === "" && APP_FETCH_HOSTS.includes(url.hostname.toLowerCase());
+}
+var AppFetchError = class extends Error {
+	code;
+	status;
+	constructor(code, message, status) {
+		super(`${code}: ${message}`);
+		this.code = code;
+		this.status = status;
+		this.name = "AppFetchError";
+	}
+};
+function boundedAppFetch(options = {}) {
+	return async (url, { maxBytes, peek = false }) => {
+		if (!isAppFetchUrl(url)) throw new AppFetchError("host", "Apps are read only from raw.githubusercontent.com, or from cdn.jsdelivr.net at a commit, over HTTPS");
+		if (options.online && !options.online()) throw new AppFetchError("offline", "Offline");
+		const fetcher = options.fetcher ?? globalThis.fetch.bind(globalThis);
+		let response;
+		try {
+			response = await fetcher(url, {
+				signal: AbortSignal.timeout(options.timeoutMs ?? APP_FETCH_LIMITS.timeoutMs),
+				credentials: "omit",
+				referrerPolicy: "no-referrer",
+				cache: "no-store",
+				redirect: "error",
+				...peek && { headers: { range: `bytes=0-${maxBytes - 1}` } }
+			});
+		} catch (error) {
+			throw new AppFetchError("network", error instanceof Error ? error.message : String(error));
+		}
+		if (response.url && response.url !== url && !isAppFetchUrl(response.url)) throw new AppFetchError("host", "The host sent the request elsewhere");
+		if (!response.ok) {
+			await response.body?.cancel().catch(() => {});
+			throw new AppFetchError("status", `The host answered ${response.status}`, response.status);
+		}
+		if (!peek && Number(response.headers.get("content-length")) > maxBytes) {
+			await response.body?.cancel().catch(() => {});
+			throw new AppFetchError("too-large", "Too large");
+		}
+		const parts = [];
+		let length = 0;
+		const reader = response.body?.getReader();
+		if (reader) try {
+			for (;;) {
+				const { done, value } = await reader.read();
+				if (done) break;
+				if (length + value.length > maxBytes) {
+					if (!peek) throw new AppFetchError("too-large", "Too large");
+					parts.push(value.subarray(0, maxBytes - length));
+					length = maxBytes;
+					break;
+				}
+				parts.push(value);
+				length += value.length;
+			}
+		} catch (error) {
+			if (error instanceof AppFetchError) throw error;
+			throw new AppFetchError("network", error instanceof Error ? error.message : String(error));
+		} finally {
+			await reader.cancel().catch(() => {});
+		}
+		const bytes = new Uint8Array(length);
+		let at = 0;
+		for (const part of parts) {
+			bytes.set(part, at);
+			at += part.length;
+		}
+		return bytes;
+	};
+}
+var NAME = /^[A-Za-z0-9_.-]+$/;
+/**
+* The URL a pasted address reads `file` from (WISP 1200 § Paste a URL), or null when it is not one this client reads:
+* - `https://github.com/<owner>/<repo>`, or `/tree/<ref>`: `raw.githubusercontent.com/<owner>/<repo>/<ref or HEAD>/<file>`,
+*   with no request to `github.com` or `api.github.com`;
+* - a file as GitHub shows it, `https://github.com/<owner>/<repo>/blob/<ref>/<path>` (or `/raw/`), naming a `.ghostlyapp`
+*   or `.json` file: `raw.githubusercontent.com/<owner>/<repo>/<ref>/<path>`, again with no request to `github.com`;
+* - a URL of the list that names a file (`….ghostlyapp`, `….json`): itself;
+* - a URL of the list that names a folder: `<file>` in it.
+*/
+function appPasteUrl(input, file) {
+	let url;
+	try {
+		url = new URL(input.trim());
+	} catch {
+		return null;
+	}
+	if (url.protocol !== "https:" || url.username || url.password || url.port) return null;
+	const host = url.hostname.toLowerCase();
+	if (host === "github.com" || host === "www.github.com") {
+		const parts = url.pathname.split("/").filter(Boolean);
+		if (parts.length < 2) return null;
+		const owner = parts[0], repo = parts[1].replace(/\.git$/, "");
+		if (!NAME.test(owner) || !NAME.test(repo)) return null;
+		let ref = "HEAD";
+		if (parts.length > 2) {
+			const rest = parts.slice(3);
+			if (!rest.length || !rest.every((p) => NAME.test(p) && p !== "." && p !== "..")) return null;
+			if (parts[2] === "blob" || parts[2] === "raw") {
+				if (rest.length < 2 || !/\.(ghostlyapp|json)$/.test(rest[rest.length - 1])) return null;
+				const raw = `https://raw.githubusercontent.com/${owner}/${repo}/${rest.join("/")}`;
+				return isAppFetchUrl(raw) ? raw : null;
+			}
+			if (parts[2] !== "tree") return null;
+			ref = rest.join("/");
+		}
+		const raw = `https://raw.githubusercontent.com/${owner}/${repo}/${ref}/${file}`;
+		return isAppFetchUrl(raw) ? raw : null;
+	}
+	const last = url.pathname.split("/").pop() ?? "";
+	const named = /\.(ghostlyapp|json)$/.test(last) ? url.href : new URL(`${url.pathname.replace(/\/?$/, "/")}${file}`, url).href;
+	return isAppFetchUrl(named) ? named : null;
+}
+/** A page of github.com (any scheme): a link `appPasteUrl` could not read is still GitHub, and is answered as such. */
+function isGitHubPage(input) {
+	try {
+		const host = new URL(input.trim()).hostname.toLowerCase();
+		return host === "github.com" || host === "www.github.com";
+	} catch {
+		return false;
+	}
+}
+/** A file beside another (`ghostly-store.sig` beside the index, `ghostly-revoke.json` beside a bundle). */
+function besideUrl(url, name) {
+	const target = new URL(url);
+	target.search = "";
+	target.hash = "";
+	return new URL(name, target).href;
+}
+/**
+* The stores a new profile starts with (WISP 1200 § Stores: the default store, preloaded and removable), each a URL and
+* the store key it is pinned to. Preloading one makes no request; the first read comes when the person opens the Apps
+* page or once an app is installed.
+*/
+var DEFAULT_APP_STORES = [{
+	url: "https://raw.githubusercontent.com/MiguelMedeiros/ghostly-store/HEAD/ghostly-store.json",
+	key: "y379ia3t1urwudj8o4w1qwmuwp1mcxyf956b5r7pqup7stce6diy"
+}];
+var APP_STORAGE_LIMITS = {
+	/** A key, in UTF-8 bytes. */
+	keyBytes: 256,
+	/** A value, as compact JSON in UTF-8 bytes. */
+	valueBytes: 65536,
+	/** Every key and value of one app in one scope. */
+	scopeBytes: 5242880
+};
+var APP_CHECK_TIMINGS = {
+	/** After the engine starts, so the chats come up first. */
+	afterStartMs: 6e4,
+	everyMs: 864e5,
+	/** A check at start is skipped when every app was checked this recently (a page reloaded several times). */
+	freshMs: 36e5
+};
+/** A fetched bundle kept for its install screen: at most this many, for this long. */
+var STAGED = {
+	max: 4,
+	ms: 6e5
+};
+/** The first bytes of a bundle: magic, the manifest's length and the largest manifest. */
+var PEEK_BYTES = APP_BUNDLE_MAGIC.length + 4 + APP_BUNDLE_LIMITS.manifestBytes;
+var bundleId = (digest) => `app-${digest}`;
+/** An error whose message starts with its code (`<code>: words`), as it crosses the engine's RPC. */
+function fail(code, words) {
+	throw new Error(`${code}: ${words}`);
+}
+/**
+* Why a pasted link is not read: a github.com page that is neither a repository nor a file of one (`github-link`), so
+* the person is not told GitHub is off the list; any other host (`host`).
+*/
+function notReadable(url, words) {
+	if (typeof url === "string" && isGitHubPage(url)) fail("github-link", "Paste the repository's link, or the link to its app file");
+	fail("host", words);
+}
+var versionOf = (manifest, digest) => ({
+	ref: appRef(manifest.publisher, manifest.name),
+	sequence: manifest.sequence,
+	digest
+});
+var byteLength = (text) => utf8Encode(text).length;
+/** Rows of one app (`[ref]`), or of one app in one scope (`[ref, scope]`), in `STORES.appStorage`. */
+var rowsOf = (...prefix) => IDBKeyRange.bound(prefix, [...prefix, []]);
+function done(tx) {
+	return new Promise((resolve, reject) => {
+		tx.oncomplete = () => resolve();
+		tx.onerror = tx.onabort = () => reject(tx.error ?? /* @__PURE__ */ new Error("App storage failed"));
+	});
+}
+/**
+* The manifest of a bundle's first bytes, unchecked: only to see whether a source holds something newer before reading
+* all of it. Whatever it says, the whole bundle is checked before anything is kept.
+*/
+function peekAppManifest(bytes) {
+	const magic = utf8Encode(APP_BUNDLE_MAGIC);
+	if (bytes.length < magic.length + 4 || !magic.every((b, i) => bytes[i] === b)) return null;
+	const length = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength).getUint32(magic.length);
+	if (length > APP_BUNDLE_LIMITS.manifestBytes || bytes.length < magic.length + 4 + length) return null;
+	const manifestBytes = bytes.subarray(magic.length + 4, magic.length + 4 + length);
+	try {
+		const manifest = JSON.parse(utf8Decode(manifestBytes));
+		const ref = typeof manifest.publisher === "string" && typeof manifest.name === "string" ? appRef(manifest.publisher, manifest.name) : "";
+		if (!isAppRef(ref) || typeof manifest.sequence !== "number" || !Number.isSafeInteger(manifest.sequence)) return null;
+		return {
+			ref,
+			sequence: manifest.sequence,
+			digest: appDigest(manifestBytes)
+		};
+	} catch {
+		return null;
+	}
+}
+var Apps = class {
+	host;
+	staged = /* @__PURE__ */ new Map();
+	/** Bundles read back and checked, by digest: the one running is read once, not on every `file`. */
+	verified = /* @__PURE__ */ new Map();
+	/** Bytes used per `ref\0scope`, counted once from the rows and kept in step by the writes here. */
+	usage = /* @__PURE__ */ new Map();
+	queues = /* @__PURE__ */ new Map();
+	timer = null;
+	checking = null;
+	/** Runs the person started with Run anyway (`<ref> <digest>`), for this engine's life: a removal does not cut them off. */
+	anyway = /* @__PURE__ */ new Set();
+	stopped = false;
+	constructor(host) {
+		this.host = host;
+	}
+	now() {
+		return (this.host.now ?? Date.now)();
+	}
+	nowS() {
+		return Math.floor(this.now() / 1e3);
+	}
+	/** Preloads the default stores (no request), then checks for updates soon after start and every 24 hours. */
+	async start() {
+		this.stopped = false;
+		await this.seedDefaults();
+		this.schedule(APP_CHECK_TIMINGS.afterStartMs, true);
+	}
+	stop() {
+		this.stopped = true;
+		if (this.timer) clearTimeout(this.timer);
+		this.timer = null;
+	}
+	schedule(ms, atStart = false) {
+		if (this.timer) clearTimeout(this.timer);
+		this.timer = setTimeout(() => {
+			this.timer = null;
+			(async () => {
+				if (this.stopped) return;
+				if (this.host.online()) {
+					const apps = await this.installed();
+					const fresh = atStart && apps.length > 0 && apps.every((a) => a.checkedAt !== void 0 && this.now() - a.checkedAt < APP_CHECK_TIMINGS.freshMs);
+					if (apps.length && !fresh) await this.checkUpdates().catch(() => {});
+				}
+				if (!this.stopped) this.schedule(APP_CHECK_TIMINGS.everyMs);
+			})();
+		}, ms);
+	}
+	async seedDefaults() {
+		for (const d of this.host.defaults ?? DEFAULT_APP_STORES) {
+			if (!isAppKey(d.key) || !isAppFetchUrl(d.url)) continue;
+			if (await this.storeRecord(d.key)) continue;
+			await this.putStore({
+				key: d.key,
+				url: d.url,
+				addedAt: this.now(),
+				preloaded: true
+			});
+		}
+	}
+	async installed() {
+		return wrap((await store(STORES$1.apps, "readonly")).getAll());
+	}
+	async app(ref) {
+		return wrap((await store(STORES$1.apps, "readonly")).get(ref));
+	}
+	async installedOrFail(ref) {
+		if (!isAppRef(ref)) fail("bad-ref", "Not an app reference");
+		return await this.app(ref) ?? fail("not-installed", "This app is not installed");
+	}
+	/**
+	* An installed app that may still run (WISP 1200 § Takedowns): a running app whose version its publisher revoked, or
+	* a store of the person's removed (unless this run was started with Run anyway), is cut off with `stopped`, whether
+	* or not the page stops its frame.
+	*/
+	async stillRunnable(app) {
+		const run = this.runStatus(app, await this.stores(), app.revocations);
+		if (run.status === "revoked") fail("stopped", "Its publisher revoked this version");
+		if (run.status === "removed" && !this.anyway.has(`${app.ref} ${app.digest}`)) fail("stopped", `Removed by ${run.by[0].name}: ${run.by[0].reason}`);
+		return app;
+	}
+	async runningOrFail(ref) {
+		return this.stillRunnable(await this.installedOrFail(ref));
+	}
+	/**
+	* Before an app's frames go to a contact (`appOpen`, `appSend`): refused with `stopped` as its storage is. A reference
+	* not installed here (a bot that speaks an app's messages) is not this store's to refuse.
+	*/
+	async chatRunnable({ ref }) {
+		const app = isAppRef(ref) ? await this.app(ref) : void 0;
+		if (app) await this.stillRunnable(app);
+	}
+	async putApp(app) {
+		await wrap((await store(STORES$1.apps, "readwrite")).put(app));
+	}
+	async storeRecord(key) {
+		return wrap((await store(STORES$1.appStores, "readonly")).get(key));
+	}
+	async putStore(record) {
+		await wrap((await store(STORES$1.appStores, "readwrite")).put(record));
+	}
+	/** The stores the person has (a removed default is not one). */
+	async stores() {
+		return (await wrap((await store(STORES$1.appStores, "readonly")).getAll())).filter((s) => !s.removed);
+	}
+	storeViews(stores) {
+		return stores.filter((s) => s.index).map((s) => ({
+			key: s.key,
+			name: s.index.name,
+			kind: s.index.kind,
+			removed: s.index.removed,
+			revoked: s.index.revoked
+		}));
+	}
+	listedBy(ref, stores) {
+		return stores.filter((s) => s.index?.apps.some((a) => a.ref === ref)).map((s) => ({
+			key: s.key,
+			name: s.index.name,
+			kind: s.index.kind
+		}));
+	}
+	runStatus(version, stores, revocations = []) {
+		const check = checkAppBeforeRun(version, this.storeViews(stores), revocations);
+		if (check.status === "revoked") return {
+			status: "revoked",
+			...check.revocation.statement.reason && { reason: check.revocation.statement.reason }
+		};
+		return check;
+	}
+	/**
+	* Stores a bundle's bytes. A browser that keeps no files fails here: Safari's Private Browsing (and WebKit's in-memory
+	* contexts) refuses a Blob in IndexedDB with "Error preparing Blob/File data to be stored in object store". Any such
+	* failure is `storage`, with the browser's own words after it for the logs, and leaves no piece behind.
+	*/
+	async writeBundle(digest, bytes) {
+		const id = bundleId(digest);
+		const expected = toBase64Url(sha256(bytes));
+		let files;
+		let stored;
+		try {
+			files = await fileBytes();
+			const size = await files.size(id);
+			if (size === bytes.length && await files.digest(id) === expected) return files.kind;
+			if (size !== null) await files.remove(id);
+			for (let at = 0; at < bytes.length; at += FILE_BYTES_STEP) await files.append(id, at, bytes.subarray(at, at + FILE_BYTES_STEP));
+			await files.flush(id);
+			await files.close(id);
+			stored = await files.digest(id);
+		} catch (e) {
+			await files?.close(id).catch(() => {});
+			await files?.remove(id).catch(() => {});
+			const words = e instanceof Error ? `${e.name}: ${e.message}` : String(e);
+			console.warn("[apps] storage:", words);
+			fail("storage", `The app's files could not be stored on this device (${words})`);
+		}
+		if (stored !== expected) {
+			await files.remove(id).catch(() => {});
+			fail("storage", "The app's files could not be stored on this device");
+		}
+		return files.kind;
+	}
+	async readBundleBytes(kind, digest) {
+		const files = await fileBytesOf(kind);
+		const id = bundleId(digest);
+		const size = files ? await files.size(id) : null;
+		if (!files || size === null || size > APP_BUNDLE_LIMITS.bundleBytes) return null;
+		const out = new Uint8Array(size);
+		for (let at = 0; at < size;) {
+			const part = await files.read(id, at, Math.min(FILE_BYTES_STEP, size - at));
+			if (!part.length) return null;
+			out.set(part, at);
+			at += part.length;
+		}
+		return out;
+	}
+	async hasBundle(kind, digest) {
+		const files = await fileBytesOf(kind);
+		return !!files && await files.size(bundleId(digest)) !== null;
+	}
+	async removeBundle(kind, digest) {
+		this.verified.delete(digest);
+		await (await fileBytesOf(kind))?.remove(bundleId(digest)).catch(() => {});
+	}
+	/** The installed bundle read back and checked again before it runs (WISP 1200 § Signatures: "again before it runs one"). */
+	async verifiedBundle(app) {
+		const kept = this.verified.get(app.digest);
+		if (kept) return kept;
+		const bytes = await this.readBundleBytes(app.bytes, app.digest);
+		if (!bytes) fail("needs-files", "This app's files are not on this device yet");
+		const read = readAppBundle(bytes);
+		if (!read.ok || read.bundle.digest !== app.digest) fail("damaged", "This app's stored files do not match what was installed");
+		if (this.verified.size >= 2) this.verified.delete(this.verified.keys().next().value);
+		this.verified.set(app.digest, read.bundle);
+		return read.bundle;
+	}
+	async fetchBundle(url) {
+		const bytes = await this.host.fetch(url, { maxBytes: APP_BUNDLE_LIMITS.bundleBytes });
+		const read = readAppBundle(bytes);
+		if (!read.ok) fail(read.reason, `This is not an app Ghostly can install${read.detail ? ` (${read.detail})` : ""}`);
+		return {
+			bundle: read.bundle,
+			bytes
+		};
+	}
+	async readStoreAt(url, heldKey) {
+		const [indexBytes, sigBytes] = await Promise.all([this.host.fetch(url, { maxBytes: APP_FETCH_LIMITS.storeIndexBytes }), this.host.fetch(besideUrl(url, "ghostly-store.sig"), { maxBytes: APP_FETCH_LIMITS.sigBytes })]);
+		return readAppStore(indexBytes, sigBytes, this.nowS(), heldKey);
+	}
+	/** The revocations its publisher signed, read beside each URL (`ghostly-revoke.json`); none there is not an error. */
+	async readRevocations(ref, urls) {
+		const out = [];
+		for (const url of new Set(urls.filter(isAppFetchUrl).map((u) => besideUrl(u, "ghostly-revoke.json")))) try {
+			const read = readAppRevocations(await this.host.fetch(url, { maxBytes: APP_FETCH_LIMITS.revocationsBytes }));
+			if (read.ok) out.push(...read.revocations.filter((r) => r.statement.app === ref));
+		} catch {}
+		return out;
+	}
+	summary(s) {
+		const index = s.index;
+		return {
+			key: s.key,
+			fingerprint: appFingerprint(s.key),
+			url: s.url,
+			preloaded: !!s.preloaded,
+			...index && {
+				name: index.name,
+				kind: index.kind,
+				sequence: index.sequence,
+				expires: index.expires,
+				...index.description !== void 0 && { description: index.description }
+			},
+			expired: !!index && index.expires < this.nowS(),
+			...s.fetchedAt !== void 0 && { fetchedAt: s.fetchedAt },
+			apps: index?.apps ?? [],
+			removed: index?.removed ?? [],
+			...s.equivocation && { equivocation: {
+				sequence: s.equivocation.sequence,
+				at: s.equivocation.at
+			} },
+			...s.problem && { problem: s.problem }
+		};
+	}
+	async listStores() {
+		return (await this.stores()).sort((a, b) => a.addedAt - b.addedAt).map((s) => this.summary(s));
+	}
+	storeUrl(url) {
+		return typeof url === "string" && appPasteUrl(url, "ghostly-store.json") || notReadable(url, "Stores are read only from raw.githubusercontent.com, or from cdn.jsdelivr.net at a commit, over HTTPS");
+	}
+	/** Reads a store at a URL for the person to see before adding it. Nothing is kept. */
+	async previewStore({ url }) {
+		const at = this.storeUrl(url);
+		const read = await this.readStoreAt(at);
+		if (!read.ok) fail(read.reason, "This is not a store Ghostly can read");
+		const { index } = read.store;
+		return {
+			url: at,
+			key: index.key,
+			fingerprint: appFingerprint(index.key),
+			name: index.name,
+			kind: index.kind,
+			sequence: index.sequence,
+			expires: index.expires,
+			expired: read.store.expired,
+			apps: index.apps.length,
+			...index.description !== void 0 && { description: index.description }
+		};
+	}
+	/**
+	* Adds a store the person chose: read at its URL and pinned to its key (`key`, when given, is the key the person saw,
+	* and another one is refused). A store already added under that key takes the URL and the newer index.
+	*/
+	async addStore({ url, key }) {
+		if (key !== void 0 && !isAppKey(key)) fail("store-key", "Not a store key");
+		const at = this.storeUrl(url);
+		const read = await this.readStoreAt(at, key);
+		if (!read.ok) fail(read.reason, "This is not a store Ghostly can read");
+		const { index, digest } = read.store;
+		const held = await this.storeRecord(index.key);
+		const record = held && !held.removed ? {
+			...held,
+			url: at
+		} : {
+			key: index.key,
+			url: at,
+			addedAt: this.now(),
+			...held?.preloaded && { preloaded: true }
+		};
+		await this.putStore(this.withIndex(record, index, digest));
+		return this.summary(await this.storeRecord(index.key));
+	}
+	/** The update rule for indexes (WISP 1200 § Stores): a lower `sequence` or the same one with other bytes is refused, the held one kept. */
+	withIndex(record, index, digest) {
+		const held = record.index ? {
+			key: record.key,
+			sequence: record.index.sequence,
+			digest: record.digest ?? ""
+		} : null;
+		const decision = appStoreDecision(held, {
+			key: index.key,
+			sequence: index.sequence,
+			digest
+		});
+		const { problem: _problem, ...rest } = record;
+		switch (decision) {
+			case "new":
+			case "update": {
+				const { equivocation: _e, ...clean } = rest;
+				return {
+					...clean,
+					index,
+					digest,
+					fetchedAt: this.now()
+				};
+			}
+			case "same": return {
+				...rest,
+				fetchedAt: this.now()
+			};
+			case "rollback": return {
+				...rest,
+				problem: "rollback"
+			};
+			case "equivocation": return {
+				...rest,
+				equivocation: {
+					sequence: index.sequence,
+					digest,
+					at: this.now()
+				},
+				problem: "equivocation"
+			};
+			default: return {
+				...rest,
+				problem: "store-key"
+			};
+		}
+	}
+	async removeStore({ key }) {
+		const held = await this.storeRecord(key);
+		if (!held) return;
+		if (held.preloaded) await this.putStore({
+			key: held.key,
+			url: held.url,
+			addedAt: held.addedAt,
+			preloaded: true,
+			removed: true
+		});
+		else await wrap((await store(STORES$1.appStores, "readwrite")).delete(key));
+	}
+	/** Reads one store again, or every store (the person opened the Apps page, or the update check). */
+	async refreshStores({ key } = {}) {
+		const stores = (await this.stores()).filter((s) => key === void 0 || s.key === key);
+		if (key !== void 0 && !stores.length) fail("no-store", "No such store");
+		const out = [];
+		for (const s of stores) {
+			let next;
+			try {
+				const read = await this.readStoreAt(s.url, s.key);
+				next = read.ok ? this.withIndex(s, read.store.index, read.store.digest) : {
+					...s,
+					problem: read.reason
+				};
+			} catch (error) {
+				next = {
+					...s,
+					problem: error instanceof AppFetchError ? error.code : "network"
+				};
+			}
+			if (!await this.storeRecord(s.key) || (await this.storeRecord(s.key))?.removed) continue;
+			await this.putStore(next);
+			out.push(this.summary(next));
+		}
+		return out;
+	}
+	/**
+	* Fetches an app and checks it, for the install screen: from a pasted URL, a store's listing (its URLs in order) or a
+	* chat card's pointer. A store's or a card's `sequence` and digest must hold: the same app, and that version or a newer
+	* one. Nothing is stored: the checked bundle waits in memory for `install`.
+	*/
+	async preview(source) {
+		let urls;
+		let expect = null;
+		if ("url" in source) urls = [typeof source.url === "string" && appPasteUrl(source.url, "app.ghostlyapp") || notReadable(source.url, "Apps are read only from raw.githubusercontent.com, or from cdn.jsdelivr.net at a commit, over HTTPS")];
+		else if ("store" in source) {
+			const s = await this.storeRecord(source.store);
+			const listing = s && !s.removed ? s.index?.apps.find((a) => a.ref === source.ref) : void 0;
+			if (!listing) fail("not-listed", "This store does not list this app");
+			urls = listing.urls.filter(isAppFetchUrl);
+			expect = {
+				ref: listing.ref,
+				sequence: listing.sequence,
+				digest: listing.digest
+			};
+		} else if ("card" in source && source.card) {
+			const { ref, url, sequence, digest } = source.card;
+			if (!isAppRef(ref)) fail("bad-ref", "Not an app reference");
+			if (!isAppFetchUrl(url)) fail("host", "A card's app is read only from raw.githubusercontent.com, or from cdn.jsdelivr.net at a commit");
+			urls = [url];
+			expect = {
+				ref,
+				...typeof sequence === "number" && { sequence },
+				...typeof digest === "string" && { digest }
+			};
+		} else fail("bad-source", "No app to fetch");
+		if (!urls.length) fail("host", "This listing has no URL Ghostly reads from");
+		let last = null;
+		for (const url of urls) try {
+			const { bundle, bytes } = await this.fetchBundle(url);
+			const version = versionOf(bundle.manifest, bundle.digest);
+			if (expect) {
+				if (version.ref !== expect.ref) fail("other-app", "The URL holds another app");
+				if (expect.sequence !== void 0 && version.sequence < expect.sequence) fail("rollback", "The URL holds an older version than the one named");
+				if (expect.sequence === version.sequence && expect.digest !== void 0 && expect.digest !== version.digest) fail("equivocation", "The URL holds another version under the same number");
+			}
+			return this.stage(bundle, bytes, url);
+		} catch (error) {
+			last = error;
+		}
+		throw last instanceof Error ? last : new Error(String(last));
+	}
+	async stage(bundle, bytes, from) {
+		for (const [digest, s] of this.staged) if (this.now() - s.at > STAGED.ms) this.staged.delete(digest);
+		this.staged.delete(bundle.digest);
+		while (this.staged.size >= STAGED.max) this.staged.delete(this.staged.keys().next().value);
+		this.staged.set(bundle.digest, {
+			bundle,
+			bytes,
+			from,
+			at: this.now()
+		});
+		const { manifest, digest } = bundle;
+		const version = versionOf(manifest, digest);
+		const [installed, stores] = await Promise.all([this.app(version.ref), this.stores()]);
+		const decision = installed ? appUpdateDecision(installed, version) : "new";
+		const install = decision === "other-app" ? "new" : decision;
+		const asks = install === "new" ? [...manifest.permissions] : install === "update" ? manifest.permissions.filter((p) => !installed.permissions.includes(p)) : [];
+		const listedBy = this.listedBy(version.ref, stores);
+		return {
+			digest,
+			ref: version.ref,
+			publisher: manifest.publisher,
+			fingerprint: appFingerprint(manifest.publisher),
+			manifest,
+			from,
+			icon: bundle.files.get("icon.png")?.slice() ?? null,
+			install,
+			asks,
+			run: this.runStatus(version, stores, installed?.revocations),
+			listedBy,
+			unknownPublisher: !listedBy.some((s) => s.kind === "curated")
+		};
+	}
+	/**
+	* Installs the bundle `preview` fetched, once the person pressed Install: `grant` must hold every permission it asks
+	* for (WISP 1200 § Permissions: none is granted by a store or a contact). A revoked or removed version is not
+	* installed; neither is a rollback, nor another bundle under an installed `sequence` (marked on the app).
+	*/
+	async install({ digest, grant }) {
+		const staged = this.staged.get(digest);
+		if (!staged || this.now() - staged.at > STAGED.ms) {
+			this.staged.delete(digest);
+			fail("expired", "Fetch the app again");
+		}
+		const { bundle, bytes, from } = staged;
+		const { manifest } = bundle;
+		if (!Array.isArray(grant) || !manifest.permissions.every((p) => grant.includes(p))) fail("permissions", "Every permission the app asks for must be granted");
+		const version = versionOf(manifest, digest);
+		const [installed, stores] = await Promise.all([this.app(version.ref), this.stores()]);
+		const run = this.runStatus(version, stores, installed?.revocations);
+		if (run.status === "revoked") fail("revoked", "Its publisher revoked this version");
+		if (run.status === "removed") fail("removed", `Removed by ${run.by[0].name}: ${run.by[0].reason}`);
+		const pendingClash = installed?.pending && installed.pending.sequence === version.sequence && installed.pending.digest !== digest;
+		const decision = installed ? pendingClash ? "equivocation" : appUpdateDecision(installed, version) : "new";
+		if (decision === "rollback") fail("rollback", "A newer version of this app is installed");
+		if (decision === "equivocation") {
+			await this.putApp({
+				...installed,
+				equivocation: {
+					sequence: version.sequence,
+					digest,
+					at: this.now()
+				}
+			});
+			fail("equivocation", `Two different versions ${version.sequence} exist. Ghostly kept the one you have.`);
+		}
+		if (decision === "same" && installed) {
+			if (!await this.hasBundle(installed.bytes, digest)) await this.putApp({
+				...installed,
+				bytes: await this.writeBundle(digest, bytes)
+			});
+			this.staged.delete(digest);
+			return this.view(await this.app(version.ref), stores);
+		}
+		const kind = await this.writeBundle(digest, bytes);
+		const next = this.versionRecord(installed, bundle, kind, from);
+		await this.putApp(next);
+		if (installed && installed.digest !== digest) await this.removeBundle(installed.bytes, installed.digest);
+		if (installed?.pending && installed.pending.sequence <= version.sequence && installed.pending.digest !== digest) await this.removeBundle(installed.pending.bytes, installed.pending.digest);
+		this.staged.delete(digest);
+		return this.view(next, stores);
+	}
+	/** The record of a version installed now, keeping what the app had (its revocations, a newer version waiting). */
+	versionRecord(installed, bundle, kind, from) {
+		const { manifest, digest } = bundle;
+		const now = this.now();
+		const keepPending = installed?.pending && installed.pending.sequence > manifest.sequence ? installed.pending : void 0;
+		return {
+			ref: appRef(manifest.publisher, manifest.name),
+			publisher: manifest.publisher,
+			name: manifest.name,
+			sequence: manifest.sequence,
+			digest,
+			permissions: [...manifest.permissions],
+			manifest,
+			bytes: kind,
+			from,
+			installedAt: installed?.installedAt ?? now,
+			updatedAt: now,
+			...installed?.revocations?.length && { revocations: installed.revocations },
+			...installed?.equivocation && installed.equivocation.sequence >= manifest.sequence && { equivocation: installed.equivocation },
+			...keepPending && { pending: keepPending },
+			...installed?.checkedAt !== void 0 && { checkedAt: installed.checkedAt }
+		};
+	}
+	/** The person accepted the permissions a waiting update adds: it is installed now. */
+	async acceptUpdate({ ref }) {
+		const installed = await this.installedOrFail(ref);
+		const pending = installed.pending ?? fail("no-update", "No update waits for this app");
+		const bytes = await this.readBundleBytes(pending.bytes, pending.digest);
+		const read = bytes ? readAppBundle(bytes) : null;
+		if (!read?.ok || read.bundle.digest !== pending.digest) {
+			const { pending: _p, ...rest } = installed;
+			await this.putApp(rest);
+			fail("needs-files", "The update's files are gone; it is fetched again at the next check");
+		}
+		const stores = await this.stores();
+		const run = this.runStatus(versionOf(read.bundle.manifest, pending.digest), stores, installed.revocations);
+		if (run.status === "revoked") fail("revoked", "Its publisher revoked this version");
+		if (run.status === "removed") fail("removed", `Removed by ${run.by[0].name}: ${run.by[0].reason}`);
+		const plan = planAppUpdate(installed, {
+			...versionOf(read.bundle.manifest, pending.digest),
+			permissions: read.bundle.manifest.permissions
+		});
+		if (plan.action === "refuse") fail(plan.decision, "This update can no longer be installed");
+		const { pending: _p, ...without } = installed;
+		const next = this.versionRecord(without, read.bundle, pending.bytes, pending.from);
+		await this.putApp(next);
+		await this.removeBundle(installed.bytes, installed.digest);
+		return this.view(next, stores);
+	}
+	/**
+	* The update check (WISP 1200 § Updates and rollback): only with an app installed; every store read again, then each
+	* app's newer versions looked for in the stores' listings and its manifest's `sources`, and its publisher's
+	* revocations read beside its sources. An update that keeps or drops permissions installs by itself; one that adds
+	* some waits for the person. One check at a time.
+	*/
+	checkUpdates() {
+		this.checking ??= this.checkNow().then((results) => {
+			try {
+				this.host.checked?.(results);
+			} catch {}
+			return results;
+		}).finally(() => {
+			this.checking = null;
+		});
+		return this.checking;
+	}
+	async checkNow() {
+		const apps = await this.installed();
+		if (!apps.length) return [];
+		await this.refreshStores();
+		const stores = await this.stores();
+		const out = [];
+		for (const listed of apps) {
+			if (!await this.hasBundle(listed.bytes, listed.digest)) await this.fetchFiles({ ref: listed.ref }).catch(() => {});
+			const first = await this.app(listed.ref);
+			if (!first) continue;
+			let app = first;
+			let outcome = "none";
+			const highest = Math.max(app.sequence, app.pending?.sequence ?? 0);
+			const known = /* @__PURE__ */ new Set([app.digest, ...app.pending ? [app.pending.digest] : []]);
+			const candidates = [];
+			for (const s of stores) {
+				const listing = s.index?.apps.find((a) => a.ref === app.ref);
+				if (listing && (listing.sequence > highest || listing.sequence >= app.sequence && !known.has(listing.digest))) candidates.push(...listing.urls.filter(isAppFetchUrl));
+			}
+			for (const url of (app.manifest.sources ?? []).filter(isAppFetchUrl)) try {
+				const peek = peekAppManifest(await this.host.fetch(url, {
+					maxBytes: PEEK_BYTES,
+					peek: true
+				}));
+				if (peek && peek.ref === app.ref && (peek.sequence > highest || peek.sequence >= app.sequence && !known.has(peek.digest))) candidates.push(url);
+			} catch {}
+			for (const url of new Set(candidates)) {
+				let fetched;
+				try {
+					fetched = await this.fetchBundle(url);
+				} catch {
+					continue;
+				}
+				const { bundle, bytes } = fetched;
+				const version = versionOf(bundle.manifest, bundle.digest);
+				if (version.ref !== app.ref || known.has(version.digest)) continue;
+				if (app.pending && version.sequence === app.pending.sequence) {
+					app = {
+						...app,
+						equivocation: {
+							sequence: version.sequence,
+							digest: version.digest,
+							at: this.now()
+						}
+					};
+					outcome = "equivocation";
+					continue;
+				}
+				const plan = planAppUpdate(app, {
+					...version,
+					permissions: bundle.manifest.permissions
+				});
+				if (plan.action === "refuse") {
+					if (plan.decision === "equivocation") {
+						app = {
+							...app,
+							equivocation: {
+								sequence: version.sequence,
+								digest: version.digest,
+								at: this.now()
+							}
+						};
+						outcome = "equivocation";
+					}
+					continue;
+				}
+				if (this.runStatus(version, stores, app.revocations).status !== "ok") continue;
+				if (app.pending && version.sequence < app.pending.sequence) continue;
+				const kind = await this.writeBundle(version.digest, bytes);
+				if (plan.action === "install") {
+					const old = app;
+					app = this.versionRecord(app, bundle, kind, url);
+					if (old.pending && old.pending.sequence <= version.sequence) {
+						await this.removeBundle(old.pending.bytes, old.pending.digest);
+						delete app.pending;
+					}
+					await this.putApp(app);
+					await this.removeBundle(old.bytes, old.digest);
+					outcome = "updated";
+				} else {
+					if (app.pending) await this.removeBundle(app.pending.bytes, app.pending.digest);
+					app = {
+						...app,
+						pending: {
+							sequence: version.sequence,
+							digest: version.digest,
+							manifest: bundle.manifest,
+							added: plan.added,
+							bytes: kind,
+							from: url,
+							at: this.now()
+						}
+					};
+					outcome = "ask";
+				}
+				break;
+			}
+			const revocations = await this.readRevocations(app.ref, [app.from, ...app.manifest.sources ?? []]);
+			const merged = new Map((app.revocations ?? []).map((r) => [canonicalJson(r), r]));
+			for (const r of revocations) merged.set(canonicalJson(r), r);
+			if (!await this.app(app.ref)) continue;
+			app = {
+				...app,
+				...merged.size && { revocations: [...merged.values()] },
+				checkedAt: this.now()
+			};
+			await this.putApp(app);
+			out.push({
+				ref: app.ref,
+				outcome,
+				run: await this.runCheckOf(app, stores)
+			});
+		}
+		return out;
+	}
+	/**
+	* Fetches an installed app's bundle again when it is not on this device (a profile restored from a backup, which
+	* carries the installed list but no bundle: WISP 1200 § Where installed apps live). Only the installed digest is
+	* taken, checked whole: from the URL it was installed from, the listings of the person's stores that name that digest,
+	* then its `sources`. Nothing answers: it stays `needs-files`, and it never runs unchecked.
+	*/
+	async fetchFiles({ ref }) {
+		const app = await this.installedOrFail(ref);
+		const stores = await this.stores();
+		if (await this.hasBundle(app.bytes, app.digest)) return this.runCheckOf(app, stores);
+		const urls = [app.from];
+		for (const s of stores) for (const listing of s.index?.apps ?? []) if (listing.ref === app.ref && listing.digest === app.digest) urls.push(...listing.urls);
+		urls.push(...app.manifest.sources ?? []);
+		for (const url of new Set(urls.filter(isAppFetchUrl))) {
+			let fetched;
+			try {
+				fetched = await this.fetchBundle(url);
+			} catch {
+				continue;
+			}
+			if (fetched.bundle.digest !== app.digest) continue;
+			const kind = await this.writeBundle(app.digest, fetched.bytes);
+			const now = await this.app(app.ref);
+			if (!now || now.digest !== app.digest) {
+				await this.removeBundle(kind, app.digest);
+				fail("not-installed", "This app is not installed");
+			}
+			if (now.bytes !== kind) await this.putApp({
+				...now,
+				bytes: kind
+			});
+			return this.runCheckOf({
+				...now,
+				bytes: kind
+			}, stores);
+		}
+		return { status: "needs-files" };
+	}
+	async runCheckOf(app, stores) {
+		if (!await this.hasBundle(app.bytes, app.digest)) return { status: "needs-files" };
+		return this.runStatus(app, stores, app.revocations);
+	}
+	/** Before an app runs (WISP 1200 § Takedowns): revoked stops it, removed by a store of the person's warns. No request. */
+	async runCheck({ ref }) {
+		return this.runCheckOf(await this.installedOrFail(ref), await this.stores());
+	}
+	/**
+	* What the runner writes into its frame: the entry, from the bundle read back and checked again. A revoked version
+	* never runs; one a store removed runs only when the person chose "Run anyway" (`runAnyway`).
+	*/
+	async entry({ ref, runAnyway }) {
+		let app = await this.installedOrFail(ref);
+		let run = await this.runCheckOf(app, await this.stores());
+		if (run.status === "needs-files") {
+			run = await this.fetchFiles({ ref });
+			app = await this.installedOrFail(ref);
+		}
+		if (run.status === "revoked") fail("revoked", "Its publisher revoked this version");
+		if (run.status === "removed" && runAnyway !== true) fail("removed", `Removed by ${run.by[0].name}: ${run.by[0].reason}`);
+		if (run.status === "needs-files") fail("needs-files", "This app's files are not on this device yet");
+		if (run.status === "removed") this.anyway.add(`${app.ref} ${app.digest}`);
+		const bundle = await this.verifiedBundle(app);
+		const entry = bundle.files.get(bundle.manifest.entry) ?? fail("damaged", "The entry is missing");
+		return {
+			ref: app.ref,
+			digest: app.digest,
+			version: app.manifest.version,
+			title: app.manifest.title,
+			permissions: [...app.permissions],
+			entry: utf8Decode(entry)
+		};
+	}
+	/** A file of the installed bundle, for the broker's `file` (`ghostly.file(path)`). */
+	async file({ ref, path }) {
+		const app = path === "icon.png" ? await this.installedOrFail(ref) : await this.runningOrFail(ref);
+		const bundle = await this.verifiedBundle(app);
+		if (typeof path !== "string" || !bundle.files.has(path)) fail("no-file", "No such file in this app");
+		return bundle.files.get(path).slice();
+	}
+	async view(app, stores) {
+		const { manifest } = app;
+		const listedBy = this.listedBy(app.ref, stores);
+		return {
+			ref: app.ref,
+			name: app.name,
+			publisher: app.publisher,
+			fingerprint: appFingerprint(app.publisher),
+			title: manifest.title,
+			tagline: manifest.tagline,
+			...manifest.description !== void 0 && { description: manifest.description },
+			version: manifest.version,
+			sequence: app.sequence,
+			digest: app.digest,
+			permissions: [...app.permissions],
+			from: app.from,
+			icon: manifest.files.some((f) => f.path === "icon.png"),
+			installedAt: app.installedAt,
+			updatedAt: app.updatedAt,
+			run: await this.runCheckOf(app, stores),
+			listedBy,
+			unknownPublisher: !listedBy.some((s) => s.kind === "curated"),
+			...app.pending && { pending: {
+				sequence: app.pending.sequence,
+				version: app.pending.manifest.version,
+				added: [...app.pending.added]
+			} },
+			...app.equivocation && { equivocation: {
+				sequence: app.equivocation.sequence,
+				at: app.equivocation.at
+			} },
+			...app.checkedAt !== void 0 && { checkedAt: app.checkedAt }
+		};
+	}
+	async list() {
+		const [apps, stores] = await Promise.all([this.installed(), this.stores()]);
+		return Promise.all(apps.sort((a, b) => a.installedAt - b.installedAt).map((a) => this.view(a, stores)));
+	}
+	/**
+	* Uninstalls an app: its bundle (and a waiting update's), its record and its storage in every scope. The person chose
+	* it, after the offer of an export (`exportData`).
+	*/
+	async uninstall({ ref }) {
+		const app = await this.installedOrFail(ref);
+		const tx = (await openDb()).transaction([STORES$1.apps, STORES$1.appStorage], "readwrite");
+		tx.objectStore(STORES$1.apps).delete(app.ref);
+		tx.objectStore(STORES$1.appStorage).delete(rowsOf(app.ref));
+		await done(tx);
+		for (const key of [...this.usage.keys()]) if (key.startsWith(`${app.ref}\0`)) this.usage.delete(key);
+		await this.removeBundle(app.bytes, app.digest);
+		if (app.pending) await this.removeBundle(app.pending.bytes, app.pending.digest);
+	}
+	scopeOf(scope) {
+		if (scope === "alone" || typeof scope === "string" && this.host.isChat(scope)) return scope;
+		fail("bad-scope", "Not a chat of this profile");
+	}
+	keyOf(key) {
+		if (typeof key !== "string" || !key.length || byteLength(key) > APP_STORAGE_LIMITS.keyBytes) fail("bad-key", "A key is 1 to 256 bytes of text");
+		return key;
+	}
+	/** One scope's writes, one after another, so the count of bytes used stays true. */
+	serial(id, work) {
+		const run = (this.queues.get(id) ?? Promise.resolve()).then(work, work);
+		const settled = run.catch(() => {});
+		this.queues.set(id, settled);
+		settled.then(() => {
+			if (this.queues.get(id) === settled) this.queues.delete(id);
+		});
+		return run;
+	}
+	async usageOf(ref, scope) {
+		const id = `${ref}\0${scope}`;
+		let used = this.usage.get(id);
+		if (used === void 0) {
+			used = (await wrap((await store(STORES$1.appStorage, "readonly")).index(APP_STORAGE_SCOPE_INDEX).getAll([ref, scope]))).reduce((sum, r) => sum + r.size, 0);
+			this.usage.set(id, used);
+		}
+		return used;
+	}
+	async storageGet({ ref, scope, key }) {
+		const app = await this.runningOrFail(ref);
+		const row = await wrap((await store(STORES$1.appStorage, "readonly")).get([
+			app.ref,
+			this.scopeOf(scope),
+			this.keyOf(key)
+		]));
+		return row ? { value: JSON.parse(row.value) } : null;
+	}
+	/** Keeps a JSON value under a key: at most 64 KiB, and 5 MiB for every key of this app in this scope. */
+	async storageSet({ ref, scope, key, value }) {
+		const app = await this.runningOrFail(ref);
+		const where = this.scopeOf(scope), name = this.keyOf(key);
+		let text;
+		try {
+			text = JSON.stringify(value);
+		} catch {
+			text = void 0;
+		}
+		if (typeof text !== "string") fail("bad-value", "A value is JSON");
+		const valueBytes = byteLength(text);
+		if (valueBytes > APP_STORAGE_LIMITS.valueBytes) fail("too-large", "A value is at most 64 KiB");
+		const size = byteLength(name) + valueBytes;
+		await this.serial(`${app.ref}\0${where}`, async () => {
+			const used = await this.usageOf(app.ref, where);
+			const rows = await store(STORES$1.appStorage, "readonly");
+			const next = used - ((await wrap(rows.get([
+				app.ref,
+				where,
+				name
+			])))?.size ?? 0) + size;
+			if (next > APP_STORAGE_LIMITS.scopeBytes) fail("full", "This app's storage in this chat is full (5 MiB)");
+			await wrap((await store(STORES$1.appStorage, "readwrite")).put({
+				ref: app.ref,
+				scope: where,
+				key: name,
+				value: text,
+				size
+			}));
+			this.usage.set(`${app.ref}\0${where}`, next);
+		});
+	}
+	async storageDelete({ ref, scope, key }) {
+		const app = await this.runningOrFail(ref);
+		const where = this.scopeOf(scope), name = this.keyOf(key);
+		await this.serial(`${app.ref}\0${where}`, async () => {
+			const used = await this.usageOf(app.ref, where);
+			const old = await wrap((await store(STORES$1.appStorage, "readonly")).get([
+				app.ref,
+				where,
+				name
+			]));
+			if (!old) return;
+			await wrap((await store(STORES$1.appStorage, "readwrite")).delete([
+				app.ref,
+				where,
+				name
+			]));
+			this.usage.set(`${app.ref}\0${where}`, used - old.size);
+		});
+	}
+	async storageKeys({ ref, scope }) {
+		const app = await this.runningOrFail(ref);
+		return (await wrap((await store(STORES$1.appStorage, "readonly")).getAllKeys(rowsOf(app.ref, this.scopeOf(scope))))).map((k) => k[2]);
+	}
+	/** An app's storage in every scope, as export files (WISP 1200 § Where installed apps live), offered before an uninstall. */
+	async exportData({ ref }) {
+		const app = await this.installedOrFail(ref);
+		const rows = await wrap((await store(STORES$1.appStorage, "readonly")).getAll(rowsOf(app.ref)));
+		const scopes = /* @__PURE__ */ new Map();
+		for (const row of rows) {
+			const out = scopes.get(row.scope) ?? {
+				ghostlyAppData: 1,
+				app: app.ref,
+				scope: row.scope,
+				entries: {}
+			};
+			out.entries[row.key] = JSON.parse(row.value);
+			scopes.set(row.scope, out);
+		}
+		return [...scopes.values()];
+	}
+};
+//#endregion
 //#region ../browser/src/devices/state.ts
 /** WISP 06 § States of a device. */
 var DEVICE_STATES = [
@@ -17561,7 +18716,7 @@ async function room() {
 async function handoffSelf(profileHost) {
 	return {
 		app: profileHost.app.replace(/[^0-9A-Za-z.+_-]/g, "").slice(0, 40) || "0",
-		db: 13,
+		db: 14,
 		pins: { ...WALLET_SDK_PINS },
 		kind: profileHost.kind,
 		room: await room(),
@@ -20447,6 +21602,9 @@ var db = {
 		await fileStore.deleteForLink(linkId);
 		await removeFileBytes(`${linkId}-in-`);
 		await removeFileBytes(`${linkId}-out-`);
+		const appStorage = await store(STORES$1.appStorage, "readwrite");
+		const appKeys = await wrap(appStorage.index(APP_STORAGE_CHAT_INDEX).getAllKeys(linkId));
+		await Promise.all(appKeys.map((key) => wrap(appStorage.delete(key))));
 	},
 	async getMessages(linkId) {
 		return (await wrap((await store(STORES$1.messages, "readonly")).index("byLink").getAll(linkId))).sort((a, b) => a.timestamp - b.timestamp);
@@ -20854,22 +22012,6 @@ async function myPin(host, chat, messageId, remove, current, now = Date.now()) {
 	};
 }
 //#endregion
-//#region ../browser/src/engine/joinTrace.ts
-/**
-* Timestamps along a join through a group's link, for measuring where the time goes. Silent unless
-* the page sets `globalThis.__ghostlyJoinTrace` (the e2e measurement does): each step is then one
-* `console.debug` line, `[ghostly:join] {"t":…,"g":…,"step":…}`, read back by the test.
-*/
-function traceJoin(group, step, detail) {
-	if (!globalThis.__ghostlyJoinTrace) return;
-	console.debug(`[ghostly:join] ${JSON.stringify({
-		t: Date.now(),
-		g: group,
-		step,
-		...detail
-	})}`);
-}
-//#endregion
 //#region ../browser/src/engine/hubClocks.ts
 /**
 * A hub dates its beacon entry by its own clock, and a reader judges it by its own. A hub's time closer than this to
@@ -21038,6 +22180,14 @@ var HUB_GRACE_MS = 18e4;
 var CUT_OFF_STEP_UP_MS = 15e3;
 /** A lobby request this recent is from a member still looking fast for my side of the edge: mine opens expecting it. */
 var LOBBY_EXPECT_MS = 3e4;
+/**
+* A lobby is one record every member asking a hub writes, each reading it and writing it back with its own request: two
+* members writing at once (both cut off by the same leave, in the same second) each write what they read, and the later
+* write drops the earlier request. So a member reads the lobby back this long after its write (plus up to `LOBBY_CHECK_JITTER_MS`, so
+* the members who wrote together do not read and write together again) and asks again at once if its request is gone.
+*/
+var LOBBY_CHECK_MS = 2e3;
+var LOBBY_CHECK_JITTER_MS = 3e3;
 var REFUSED_FOR_MS$1 = 6e5;
 var ENTRY_LINGER_MS$1 = 2e4;
 var RELAYED_KEPT = 4096;
@@ -21096,6 +22246,8 @@ var Communities = class {
 	knockAt = /* @__PURE__ */ new Map();
 	/** Joiners: how many others had a knock still being refreshed in the record I last read (they wait with me). */
 	knockingWith = /* @__PURE__ */ new Map();
+	/** Joiners: the knock record a knock read whose write the relays refused, and when it was read (`knock`). */
+	knockRead = /* @__PURE__ */ new Map();
 	/** My frames an edge took, and which of them carry an edit (`frame id → editKey`). */
 	frames = new FramesTaken();
 	carriers = /* @__PURE__ */ new Map();
@@ -21281,6 +22433,7 @@ var Communities = class {
 		this.knocked.delete(link.g);
 		this.knockAt.delete(link.g);
 		this.knockingWith.delete(link.g);
+		this.knockRead.delete(link.g);
 		const before = this.stored.get(link.g)?.joining;
 		const linkId = await this.host.openEntry(link, "guest", seedB64, link.host);
 		if (before && before.linkId !== linkId) await this.host.closeEdge(before.linkId);
@@ -21314,6 +22467,7 @@ var Communities = class {
 		this.knocked.delete(group.id);
 		this.knockAt.delete(group.id);
 		this.knockingWith.delete(group.id);
+		this.knockRead.delete(group.id);
 		await this.host.closeEdge(joining.linkId);
 		await this.store.putGroup(group);
 		this.host.emit();
@@ -21454,6 +22608,7 @@ var Communities = class {
 		this.lastPeerMessageAt.delete(groupId);
 		this.lastMentionAt.delete(groupId);
 		this.knockingWith.delete(groupId);
+		this.knockRead.delete(groupId);
 		for (const linkId of [...this.host.edges(groupId).values(), ...this.host.entries(groupId).values()]) await this.host.closeEdge(linkId);
 		await this.store.deleteGroup(groupId);
 		this.host.historyGone?.(groupId);
@@ -21472,7 +22627,7 @@ var Communities = class {
 			if (group.joining && (this.knocking(group, live) || group.joining.check)) {
 				const waited = now - group.joining.since, every = waited > this.timings.patienceMs ? this.timings.slowKnockMs : this.timings.knockMs;
 				if (!this.knocking(group, live) && waited > CHECK_MS) await this.endCheck(group);
-				else if (!this.host.linkReady(group.joining.linkId, 2) && !this.host.linkSeen?.(group.joining.linkId) && now - (this.lastKnock.get(group.id) ?? 0) >= every) await this.knock(group, now).catch(() => {});
+				else if (!this.host.linkReady(group.joining.linkId, 2) && !this.host.linkSeen?.(group.joining.linkId) && now - (this.lastKnock.get(group.id) ?? 0) >= (this.knocked.has(group.id) ? every : Math.min(every, 3e3))) await this.knock(group, now).catch(() => {});
 				if (!live) continue;
 			}
 			if (!live) continue;
@@ -21648,7 +22803,15 @@ var Communities = class {
 			live.forceHub = !kept.length && others.length < COMMUNITY_TOPOLOGY.maxHubs;
 			for (const hub of kept) {
 				const id = edges.get(hub);
-				if (id && this.host.linkReady(id, 2)) continue;
+				if (id && this.host.linkReady(id, 2)) {
+					live.lobbyChecks?.delete(hub);
+					continue;
+				}
+				const check = live.lobbyChecks?.get(hub);
+				if (check && now >= check.at) {
+					live.lobbyChecks.delete(hub);
+					if (await this.lobbyLost(groupId, live, hub, check.ts)) live.lobbyWrites.delete(hub);
+				}
 				if (now - (live.lobbyWrites.get(hub) ?? 0) >= this.timings.lobbyWriteMs) {
 					live.lobbyWrites.set(hub, now);
 					await this.askHub(groupId, live, hub, now).catch(() => {
@@ -21921,8 +23084,26 @@ var Communities = class {
 			key: live.session.myKey,
 			ts: theirs
 		}, theirs)), true, true);
+		(live.lobbyChecks ??= /* @__PURE__ */ new Map()).set(hub, {
+			at: now + LOBBY_CHECK_MS + Math.floor(this.random() * LOBBY_CHECK_JITTER_MS),
+			ts: Math.floor(theirs / 1e3) * 1e3
+		});
 		traceJoin(groupId, "lobby.written");
 	}
+	/**
+	* My request is not in the hub's lobby any more, and the lobby has room for it: another member's write, made from a
+	* reading from before mine, dropped it (`LOBBY_CHECK_MS`). A full lobby that pushed it out is left as it is: asking
+	* again there would push out someone else. A read that fails says nothing, and the usual refresh asks again.
+	*/
+	async lobbyLost(groupId, live, hub, ts) {
+		const keys = lobbyKeys(live.session.state.rv, groupId, hub);
+		const records = await this.host.resolve(keys.identity.pubKeyZ32, true, true).catch(() => void 0);
+		if (records === void 0) return false;
+		const entries = readLobby(keys, records ?? []);
+		const lost = !entries.some((e) => e.key === live.session.myKey && e.ts >= ts) && entries.length < COMMUNITY_TOPOLOGY.lobbyEntries;
+		if (lost) traceJoin(groupId, "lobby.lost");
+		return lost;
+	}
 	async pollLobby(groupId, live, now) {
 		const keys = lobbyKeys(live.session.state.rv, groupId, live.session.myKey);
 		const entries = readLobby(keys, await this.host.resolve(keys.identity.pubKeyZ32, true, true).catch(() => null) ?? []);
@@ -22047,10 +23228,19 @@ var Communities = class {
 		}
 		const records = this.knockRecordsToRead(live, door === s.myKey, busy, now);
 		if (!records.length) return;
+		let failed = 0;
 		const read = await Promise.all(records.map(async (n) => {
 			const record = knockRecord(link, n);
-			return readKnocks(record, await this.host.resolve(knockIdentity(record).pubKeyZ32, true, door === s.myKey && n === KNOCK_BELL).catch(() => null) ?? []);
+			return readKnocks(record, await this.host.resolve(knockIdentity(record).pubKeyZ32, true, door === s.myKey && n === KNOCK_BELL).catch(() => {
+				failed++;
+				return null;
+			}) ?? []);
 		}));
+		traceJoin(groupId, "knock.read", {
+			records: records.length,
+			knocks: read.flat().length,
+			...failed ? { failed } : {}
+		});
 		const bell = records.indexOf(KNOCK_BELL);
 		if (bell >= 0 && read[bell].filter((k) => now - k.ts < 18e4).length >= BELL_FULL) live.crowdUntil = now + CROWD_MS;
 		const newest = /* @__PURE__ */ new Map();
@@ -22109,10 +23299,16 @@ var Communities = class {
 	* Leaves (or refreshes) my knock: in the bell while it has room, in my own record once a crowd has
 	* filled it. The first one goes out at once; refreshes are background requests, and keep my side of
 	* the entry session looking fast while I still expect a member to answer soon.
+	*
+	* "The first" is the first of this run that the relays took (`knocked`), not the first tried: a knock the relays'
+	* budget refused is tried again as one, every `UNKNOCKED_RETRY_MS`. Taken for a refresh, it went as a background
+	* request, every `knockMs`, and background requests are held to a few a minute while a link of this app signals: its
+	* own entry session, looking fast for the door's answer. A CLI that was the door of another community, its budget
+	* spent, never knocked at all (groupCompat, with the budget scaled down to 12 requests a minute).
 	*/
 	async knock(group, now = this.now()) {
 		const joining = group.joining;
-		const first = !this.lastKnock.has(group.id);
+		const first = !this.knocked.has(group.id);
 		this.lastKnock.set(group.id, now);
 		if (first || now - joining.since < this.timings.patienceMs) this.host.expectPeer?.(joining.linkId);
 		const me = identityFromSeedB64(joining.seedB64).pubKeyZ32, link = {
@@ -22127,16 +23323,37 @@ var Communities = class {
 				knocks: readKnocks(record, await this.host.resolve(knockIdentity(record).pubKeyZ32, !first) ?? [])
 			};
 		};
-		let n = this.knockAt.get(group.id) ?? KNOCK_BELL, { record, knocks } = await read(n);
-		if (n === KNOCK_BELL && !knocks.some((k) => k.key === me) && knocks.filter((k) => k.key !== me && now - k.ts < 18e4).length >= BELL_FULL) ({record, knocks} = await read(n = ownKnockRecord(me)));
-		await this.host.publish(knockIdentity(record), knockRecords(record, mergeKnocks(knocks, {
-			key: me,
-			ts: now
-		}, now)), !first);
+		const kept = this.knockRead.get(group.id);
+		this.knockRead.delete(group.id);
+		const reuse = kept && now - kept.at < this.timings.knockMs ? kept : void 0;
+		let n, record, knocks;
+		if (reuse) {
+			n = reuse.n;
+			knocks = reuse.knocks;
+			record = knockRecord(link, n);
+		} else {
+			n = this.knockAt.get(group.id) ?? KNOCK_BELL;
+			({record, knocks} = await read(n));
+			if (n === KNOCK_BELL && !knocks.some((k) => k.key === me) && knocks.filter((k) => k.key !== me && now - k.ts < 18e4).length >= BELL_FULL) ({record, knocks} = await read(n = ownKnockRecord(me)));
+		}
+		try {
+			await this.host.publish(knockIdentity(record), knockRecords(record, mergeKnocks(knocks, {
+				key: me,
+				ts: now
+			}, now)), !first);
+		} catch (error) {
+			this.knockRead.set(group.id, {
+				n,
+				knocks,
+				at: reuse?.at ?? now
+			});
+			throw error;
+		}
 		this.knockAt.set(group.id, n);
 		traceJoin(group.id, "knock.published", {
 			ms: Date.now() - started,
-			record: n
+			record: n,
+			...reuse && { kept: true }
 		});
 		const others = knocks.filter((k) => k.key !== me && now - k.ts < 2 * this.timings.slowKnockMs).length;
 		const moved = (this.knockingWith.get(group.id) ?? 0) !== others;
@@ -22273,6 +23490,7 @@ var Communities = class {
 				this.knocked.delete(g);
 				this.knockAt.delete(g);
 				this.knockingWith.delete(g);
+				this.knockRead.delete(g);
 				await this.host.closeEdge(linkId);
 				await this.reconcile(g, live, now);
 				this.host.emit();
@@ -32194,203 +33412,6 @@ var WalletSetup = class {
 	}
 };
 //#endregion
-//#region ../browser/src/platform/irohWeb.ts
-/**
-* Iroh (WISP 102) in a browser: the same QUIC/TLS session and binding as the
-* Desktop's native Iroh, but relay only. A page cannot send UDP, so every
-* packet goes through an Iroh relay over a WebSocket; the relay sees who talks
-* to whom and when, never the frames.
-*
-* The wasm (about 1 MB gzip) loads on the first chat that starts an endpoint,
-* never on the app's first load.
-*/
-/**
-* n0's public relays, the same ones the Desktop's Iroh homes on by default. Iroh itself names them with the trailing
-* dot of a full domain name (`use1-1.relay.n0.iroh.link.`), and compares relay URLs as text; here they have none,
-* because WebKit opens no host name that ends in a dot. `BROWSER_SPELLING` is what keeps the two one relay.
-*/
-var DEFAULT_IROH_RELAYS = [
-	"https://use1-1.relay.n0.iroh.link/",
-	"https://euc1-1.relay.n0.iroh.link/",
-	"https://aps1-1.relay.n0.iroh.link/",
-	"https://usw1-1.relay.n0.iroh.link/"
-];
-/**
-* The spelling of every relay URL handed to the wasm Iroh (`irohRelayUrl`): the relays it homes on and a contact's
-* relay before a dial. One spelling, so a contact on this endpoint's relay is reached over the connection already
-* open to it; without the dot, so Safari can open it (a Desktop's record names its relay with the dot).
-*/
-var BROWSER_SPELLING = "plain";
-/**
-* Why a relay URL cannot be used, or null. TLS, except on this machine (a local `iroh-relay --dev`): a page
-* may not open plain WebSockets elsewhere, and the relay's operator would see traffic metadata in the clear.
-*/
-function irohRelayProblem(value) {
-	let url;
-	try {
-		url = new URL(value);
-	} catch {
-		return `Not a relay address: ${value}`;
-	}
-	const local = [
-		"localhost",
-		"127.0.0.1",
-		"[::1]"
-	].includes(url.hostname);
-	if (url.protocol !== "https:" && !(url.protocol === "http:" && local)) return `Use an https:// relay address: ${value}`;
-	if (url.username || url.password || url.search || url.hash || value.length > 256) return `Not a relay address: ${value}`;
-	return null;
-}
-var loaded = null;
-/** Loads the wasm once per page. Tests pass their own `load` (Node reads the file). */
-function loadIrohWasm() {
-	loaded ??= import("./ghostly_iroh_web-Dvzh3Y6E.js").then(async (module) => {
-		await module.default();
-		return module;
-	}).catch((error) => {
-		loaded = null;
-		throw error;
-	});
-	return loaded;
-}
-var SEND_BUDGET = 122880;
-var MAX_FRAME = 61440;
-/** One paired channel over one QUIC stream. Sends are queued in order. */
-var IrohWebChannel = class {
-	conn;
-	forget;
-	reader = null;
-	buffered = [];
-	queue = Promise.resolve();
-	closed = false;
-	bufferedAmount = 0;
-	sendBudget = SEND_BUDGET;
-	onClose = null;
-	constructor(conn, forget) {
-		this.conn = conn;
-		this.forget = forget;
-		this.read();
-	}
-	get onMessage() {
-		return this.reader;
-	}
-	set onMessage(reader) {
-		this.reader = reader;
-		if (reader) for (const text of this.buffered.splice(0)) reader(text);
-	}
-	async read() {
-		try {
-			for (;;) {
-				const text = await this.conn.recv();
-				if (text === void 0 || this.closed) break;
-				if (this.reader) this.reader(text);
-				else if (this.buffered.length < 64) this.buffered.push(text);
-				else break;
-			}
-		} catch {}
-		this.close();
-	}
-	send(data) {
-		if (typeof data !== "string" || this.closed || !data.length || data.length > MAX_FRAME || this.bufferedAmount + data.length > SEND_BUDGET) throw new Error("Iroh channel is closed or its send budget is full");
-		this.bufferedAmount += data.length;
-		this.queue = this.queue.then(() => this.closed ? void 0 : this.conn.send(data)).catch(() => this.close()).finally(() => {
-			this.bufferedAmount -= data.length;
-		});
-	}
-	drained() {
-		return this.queue;
-	}
-	get rttMs() {
-		const rtt = this.conn.rtt();
-		return rtt >= 0 ? rtt : void 0;
-	}
-	close() {
-		if (this.closed) return;
-		this.closed = true;
-		this.buffered = [];
-		try {
-			this.conn.close();
-		} catch {}
-		this.forget();
-		this.onClose?.();
-	}
-};
-/** A NativeEndpoint for `iroh/1`, as the Desktop's is, for one chat's transport seed. */
-async function createIrohWebEndpoint(seedB64, options = {}) {
-	const seed = fromBase64Url(seedB64);
-	if (seed.length !== 32) throw new Error("Invalid transport seed");
-	const relays = [...new Set((options.relays?.length ? options.relays : DEFAULT_IROH_RELAYS).map((relay) => irohRelayUrl(relay, BROWSER_SPELLING)))];
-	const node = await (await (options.load ?? loadIrohWasm)()).IrohNode.start(seed, relays, options.onlineMs ?? 1e4);
-	const channels = /* @__PURE__ */ new Set();
-	let stopped = false;
-	let handler = null;
-	const early = [];
-	const bind = (conn) => {
-		const channel = new IrohWebChannel(conn, () => channels.delete(channel));
-		channels.add(channel);
-		return {
-			channel,
-			binding: conn.binding()
-		};
-	};
-	const endpoint = {
-		transport: "iroh/1",
-		descriptor: {
-			...node.address(),
-			relayed: true
-		},
-		onDescriptor: null,
-		get onConnection() {
-			return handler;
-		},
-		set onConnection(value) {
-			handler = value;
-			if (value) for (const bound of early.splice(0)) value(bound);
-		},
-		async connect(descriptor) {
-			if (stopped) throw new Error("Iroh endpoint is stopped");
-			const conn = await node.connect(irohDescriptor(descriptor, BROWSER_SPELLING), options.connectMs ?? 2e4);
-			if (stopped) {
-				conn.close();
-				throw new Error("Iroh endpoint is stopped");
-			}
-			return bind(conn);
-		},
-		async close() {
-			if (stopped) return;
-			stopped = true;
-			for (const channel of [...channels]) channel.close();
-			for (const bound of early.splice(0)) bound.channel.close();
-			await node.close().catch(() => {});
-		}
-	};
-	(async () => {
-		while (!stopped) {
-			let conn;
-			try {
-				conn = await node.accept();
-			} catch {
-				break;
-			}
-			if (!conn) break;
-			if (stopped) {
-				conn.close();
-				break;
-			}
-			const bound = bind(conn);
-			const accept = endpoint.onConnection;
-			if (accept) accept(bound);
-			else if (early.length < 4) early.push(bound);
-			else bound.channel.close();
-		}
-		if (!stopped) {
-			endpoint.onUnavailable?.();
-			await endpoint.close();
-		}
-	})();
-	return endpoint;
-}
-//#endregion
 //#region ../browser/src/engine/node.ts
 /** How long a chat waits before listening again after its HyperDHT relay went away. */
 var RELAY_RETRY_MS = 3e4;
@@ -33873,6 +34894,7 @@ var GhostlyNode = class GhostlyNode {
 			this.prepareSpare(STARTUP_QUIET_MS);
 		}
 		if (!this.limitedMode) this.openStartedWallets(fresh);
+		if (this.appsOn) this.appStore.start().catch(() => {});
 		if (!this.options.singleDevice && this.networkOn && knownDeviceGate()?.state === "active") this.startDeviceSet().catch(() => {});
 		if (!this.options.singleDevice && this.limitedMode && knownDeviceGate()?.state === "active") this.readTurnWhileLimited();
 		if (this.restoreCheck === "checking" && this.limitedMode) this.checkRestoredTurn(0);
@@ -34257,6 +35279,7 @@ var GhostlyNode = class GhostlyNode {
 			clearTimeout(this.limitedTimer);
 			this.limitedTimer = null;
 		}
+		this.appShelf?.stop();
 		if (!quiet) this.depart();
 		this.directPath.close();
 		this.clock.close();
@@ -34329,6 +35352,83 @@ var GhostlyNode = class GhostlyNode {
 		await this.shutdown();
 		await clearProfileStores();
 	}
+	appShelf;
+	/** The installed apps and stores, refused while the apps feature is off. */
+	get appStore() {
+		if (!this.appsOn) throw new Error("Apps are unavailable in this release");
+		return this.appShelf ??= new Apps({
+			fetch: boundedAppFetch({
+				fetcher: this.options.appFetch,
+				online: () => this.networkOn
+			}),
+			isChat: (scope) => {
+				const stored = this.links.get(scope)?.stored;
+				return !!stored && !stored.group && !!stored.profile && !!stored.pairedPeerKey;
+			},
+			online: () => this.networkOn && !this.shuttingDown,
+			checked: () => this.events.onAppsChecked?.()
+		});
+	}
+	appList() {
+		return this.appStore.list();
+	}
+	appStoreList() {
+		return this.appStore.listStores();
+	}
+	appStorePreview(params) {
+		return this.appStore.previewStore(params);
+	}
+	appStoreAdd(params) {
+		return this.appStore.addStore(params);
+	}
+	appStoreRemove(params) {
+		return this.appStore.removeStore(params);
+	}
+	appStoreRefresh(params = {}) {
+		return this.appStore.refreshStores(params);
+	}
+	appPreview(params) {
+		return this.appStore.preview(params);
+	}
+	appInstall(params) {
+		return this.appStore.install(params);
+	}
+	appUpdateAccept(params) {
+		return this.appStore.acceptUpdate(params);
+	}
+	appCheckUpdates() {
+		return this.appStore.checkUpdates();
+	}
+	appUninstall(params) {
+		return this.appStore.uninstall(params);
+	}
+	appRunCheck(params) {
+		return this.appStore.runCheck(params);
+	}
+	appFetchFiles(params) {
+		return this.appStore.fetchFiles(params);
+	}
+	appEntry(params) {
+		return this.appStore.entry(params);
+	}
+	appFile(params) {
+		return this.appStore.file(params);
+	}
+	appStorageGet(params) {
+		return this.appStore.storageGet(params);
+	}
+	appStorageSet(params) {
+		return this.appStore.storageSet(params);
+	}
+	appStorageDelete(params) {
+		return this.appStore.storageDelete(params);
+	}
+	appStorageKeys(params) {
+		return this.appStore.storageKeys(params);
+	}
+	appDataExport(params) {
+		return this.appStore.exportData(params);
+	}
 	getState() {
 		const groups = this.groups.views();
 		return {
@@ -37113,6 +38213,58 @@ var GhostlyNode = class GhostlyNode {
 		this.flushPin(linkId);
 		return { error: null };
 	}
+	/** Mini-apps are on in this build (`APPS_ENABLED`) or for this engine (`apps`). */
+	get appsOn() {
+		return this.options.apps ?? false;
+	}
+	/** A paired 1:1 chat and the chat app id of `ref` in it, from the two pinned participation keys (WISP 1200 § In a chat). */
+	appChat(linkId, ref) {
+		if (!this.appsOn) throw new Error("Apps are unavailable in this release");
+		const live = typeof linkId === "string" ? this.links.get(linkId) : void 0;
+		if (!live || live.stored.group || !live.stored.profile) throw new Error("No such chat");
+		if (!isAppRef(ref)) throw new Error("Not an app reference");
+		const { participationSeed, pairedPeerKey } = live.stored;
+		if (!participationSeed || !pairedPeerKey) throw new Error("This chat is not paired yet");
+		return {
+			live,
+			app: chatAppId(identityFromSeedB64(participationSeed).publicKey, publicKeyFromZ32(pairedPeerKey), ref)
+		};
+	}
+	/** The chat app id of an app in a paired chat: how the contact's frames name it. */
+	appId({ linkId, ref }) {
+		return { app: this.appChat(linkId, ref).app };
+	}
+	/**
+	* This side opened an app in a paired chat, or updated it: `open` goes to the contact now when the session is live,
+	* and again on every session that comes back while it stays open.
+	*/
+	async appOpen({ linkId, ref, version }) {
+		const { live, app } = this.appChat(linkId, ref);
+		if (!isAppVersion(version)) throw new Error("Not an app version");
+		await this.appStore.chatRunnable({ ref });
+		const open = live.appsOpen ??= /* @__PURE__ */ new Map();
+		if (live.link) live.link.openApp(app, version);
+		else open.set(app, version);
+		return { app };
+	}
+	/** This side closed an app in a paired chat: `close` goes now when the session is live. */
+	appClose({ linkId, ref }) {
+		const { live, app } = this.appChat(linkId, ref);
+		if (live.link) live.link.closeApp(app);
+		else live.appsOpen?.delete(app);
+	}
+	/** One data frame of an app open on both sides, on the live session only; nothing is kept to send later. */
+	async appSend({ linkId, ref, data }) {
+		const { live, app } = this.appChat(linkId, ref);
+		if (!live.appsOpen?.has(app)) return { error: "not-open" };
+		await this.appStore.chatRunnable({ ref });
+		return { error: live.link ? live.link.sendAppData(app, data) : "offline" };
+	}
+	/** Every page went away: no app runs here any more, so each open one is closed (`close` goes where it can). */
+	appsCloseAll() {
+		for (const live of this.links.values()) for (const app of [...live.appsOpen?.keys() ?? []]) if (live.link) live.link.closeApp(app);
+		else live.appsOpen?.delete(app);
+	}
 	/** Keeps a pin of a 1:1 chat when it is newer than the chat's; `out`: mine, to say until the contact confirms it. */
 	async keepLinkPin(linkId, pin, out) {
 		const live = this.links.get(linkId);
@@ -38268,7 +39420,7 @@ var GhostlyNode = class GhostlyNode {
 			...settings
 		};
 		if (!this.settings.irohRelays?.length) delete this.settings.irohRelays;
-		if (irohRelaysChanged) this.rehomeIroh();
+		if (irohRelaysChanged && !this.options.irohRelays?.length) this.rehomeIroh();
 		if (settings.relays) {
 			this.relays?.setRelays(settings.relays);
 			if (this.relays) this.settings.relays = this.relays.describe().relays;
@@ -39491,6 +40643,8 @@ var GhostlyNode = class GhostlyNode {
 			wakeSupport: true,
 			upgradeSupport: true,
 			peerUpgrades: () => !!live.caps?.peer?.capabilities.includes(UPGRADE_CAPABILITY),
+			appsSupport: this.appsOn,
+			appsOpen: this.appsOn ? live.appsOpen ??= /* @__PURE__ */ new Map() : void 0,
 			servicesSupport: this.options.servicesSupport ?? (this.options.platform ?? "web") !== "web",
 			dht: stored.profile ? {
 				state: stored.dhtDeliveryState,
@@ -39796,6 +40950,7 @@ var GhostlyNode = class GhostlyNode {
 				onPinSupport: (supported) => {
 					if (supported) this.flushPin(linkId);
 				},
+				onAppFrame: this.appsOn ? (event) => this.events.onAppFrame?.(linkId, event) : void 0,
 				onPaymentRequest: (request) => this.desk.onPaymentRequest(linkId, request),
 				onPaymentAsk: (ask) => this.desk.onPaymentAsk(linkId, ask),
 				onPayment: (payment) => this.desk.onPayment(linkId, payment),
@@ -39946,7 +41101,7 @@ var GhostlyNode = class GhostlyNode {
 	get nativeFactories() {
 		const relay = this.relaysHyperdht ? this.hyperdhtRelay : "";
 		return {
-			...relay ? { "hyperdht/1": async (seedB64) => (await import("./hyperdhtRelay-BoxPHp7v.js")).createRelayedHyperEndpoint(seedB64, relay) } : {},
+			...relay ? { "hyperdht/1": async (seedB64) => (await import("./hyperdhtRelay-w9cwVqGZ.js")).createRelayedHyperEndpoint(seedB64, relay) } : {},
 			...this.options.nativeTransports,
 			...this.ownIrohRelays ? { "iroh/1": (seedB64) => this.options.nativeTransports["iroh/1"](seedB64, this.settings.irohRelays?.length ? { relays: [...this.settings.irohRelays] } : {}) } : {},
 			...this.options.irohWeb ? { "iroh/1": (seedB64) => createIrohWebEndpoint(seedB64, { relays: this.irohRelays }) } : {}
@@ -39957,6 +41112,7 @@ var GhostlyNode = class GhostlyNode {
 		return !!this.options.nativeIrohRelays && !!this.options.nativeTransports?.["iroh/1"];
 	}
 	get irohRelays() {
+		if (this.options.irohRelays?.length) return [...this.options.irohRelays];
 		return this.settings.irohRelays?.length ? this.settings.irohRelays : [...DEFAULT_IROH_RELAYS];
 	}
 	/** New Iroh relays: idle endpoints move now; one carrying a chat keeps its relay until that session ends. */
@@ -40524,6 +41680,12 @@ var EngineServer = class {
 					signal
 				});
 			},
+			onAppFrame: (linkId, event) => this.broadcast({
+				kind: "app-frame",
+				linkId,
+				event
+			}),
+			onAppsChecked: () => this.broadcast({ kind: "apps-checked" }),
 			onDeviceGate: (gate) => this.broadcast({
 				kind: "device-gate",
 				gate
@@ -40571,7 +41733,10 @@ var EngineServer = class {
 	detach(client) {
 		this.clients.delete(client);
 		this.histories.delete(client);
-		if (this.clients.size === 0) this.node.setActiveLink({ linkId: null });
+		if (this.clients.size === 0) {
+			this.node.setActiveLink({ linkId: null });
+			this.node.appsCloseAll();
+		}
 		if (this.onCall.delete(client)) this.node.setCallOn({ on: this.onCall.size > 0 });
 	}
 	async handle(client, request) {
@@ -40679,4 +41844,4 @@ function signalKind(signal) {
 //#endregion
 export { EngineServer, hyperdhtRelayProblem as n, server_exports as t };
 
-//# sourceMappingURL=server-CXFTDnFI.js.map
+//# sourceMappingURL=server-TamKsfmC.js.map