@ghostlytools/cli 1.1.4 → 1.1.6

package/dist/assets/{server-CXFTDnFI.js → server-HMzdsyn_.js}

@@ -1,7 +1,9 @@
-import { a as fileBytesOf, c as removeFileBytes, d as __exportAll, i as fileBytes, n as blobDigest } from "./fileBytes-DxiJHmTk.js";
-import { $a as HANDOFF_VERIFIED, $i as replySnippet, $n as freshHubs, $o as OwnInviteError, $s as fromBase64Url, $t as isPubkyKey, A as GROUP_EDIT_TEXT_BYTES, Ai as parseVoiceMeta, An as findEndpoint, Ar as newWakeToken, As as DEFAULT_RELAYS, At as encodeDidDhtPacket, Ba as HTTP_SERVICE_PROTO, Bi as COMMUNITY_REACTION_FRAME, Bo as enrollCancelFrame, Br as HOLD_DATED_BACK_MS, Bt as USDT_PUBLIC_RPC, C as groupWakes, Ca as GhostlyHttpError, Ci as safeBlobType, Co as readHandoffHave, Cr as nextPinNumber, Cs as firstDeviceSetSecret, D as GroupSession, Da as LIMITS, Dn as ENDPOINT, Do as readHandoffVerified, Dr as WAKE_CALL_INTERVAL_MS, Ds as signTurnRelease, Dt as didDhtDocument, E as GROUP_READ_NOTE, Ea as webLocalFetch, En as decodeBolt11, Eo as readHandoffTurnFrame, Er as readPin, Es as signTurnPacket, Fi as RateWindow, Fn as INVITE_TAKEN, Fo as verifySetUpdate, Fr as vapidKeysMatch, Fs as traceLink, Ft as ONCHAIN_PROVIDER, Ga as HANDOFF_DONE, Gi as queueReaction, Gn as MESH_HUBS, Go as enrollHelloFrame, Gr as readManifest, Gs as createIdentity, Gt as validatePaymentTarget, Ha as serviceIdFromName, Hi as REACTION_LIMITS, Ho as enrollDigits, Hr as HoldKeys, Ht as assertTokenUnits, Ii as dhtEditId, In as LIVENESS_PING_MS, Is as budgetRetryMs, It as PaymentPreflightError, Ja as HANDOFF_OFFER, Ji as readReaction, Jn as pickMeshHubs, Jo as readEnrollHello, Jr as capsDescriptors, Js as publicKeyFromZ32, Jt as SPARK_PROVIDER, Ka as HANDOFF_HAVE, Ki as reactionEmoji, Kn as mayBeHub, Ko as enrollProofFrame, Kr as CapsExchange, Ks as identityFromSeed, Kt as walletNetworkOf, La as parseCallSignal, Li as parseLinkPreview, Ln as pairedMessageFrame, Lr as EDIT_CAPABILITY, Ls as isDiscoveryBudgetError, Lt as SEPOLIA_TEST_USDT, M as parseCommunityEdit, Mi as parseVideoMeta, Mn as parseCashuRequestPayload, Mo as setAckFrame, Mr as relayRequest, Ms as currentRelays, Mt as signDidDhtPacket, N as mentionsMember, Ni as EDIT_BUFFER_MS, Nn as parseFedimintRequestPayload, No as setUpdateFrame, Nr as wakeRequest, Ns as normalizeRelayUrl, Nt as ETHEREUM_USDT, Oa as decodeControl, On as cashuRequestPayload, Oo as sealHandoffPiece, Or as WakeLimiter, Os as turnKeys, Ot as didDhtFromPublicKey, P as groupName, Pi as EDIT_RATE_WINDOW_MS, Pn as GhostLink, Po as signTombstone, Pr as checkPushEndpoint, Pt as EVM_TEST_CHAINS, Qa as HANDOFF_TIMINGS, Qi as readReply, Qn as doorHubs, Qo as readDeviceInvite, Qr as IDENTITY_REVOCATION_LABEL, Qs as bytesEqual, Ri as forwardedAgain, Rn as CarriedTransport, Rr as UPGRADE_CAPABILITY, Rs as withRequestOptions, Rt as SEPOLIA_TEST_USDT_FAUCET, S as groupWakeFrame, Sa as presenceSeenAt, So as readHandoffDone, Sr as mayPin, Ss as TURN_MAX, Ta as parseLocalTarget, Tn as engineText, To as readHandoffPake, Tr as pinNumberHolds, Ts as readTurnPacket, Ua as HANDOFF_ACK, Ui as ReactionWindow, Un as groupSignalFrame, Uo as enrollDoneFrame, Ur as HoldRefusedError, Ut as assertWholeSats, Va as LEGACY_SERVICES, Vi as GROUP_REACTION_FRAME, Vo as enrollCancelReason, Vr as HOLD_LIMITS, Vs as createRelayPayload, Vt as WALLET_NETWORKS, Wa as HANDOFF_CANCEL, Wi as nextReactionNumber, Wn as readGroupSignal, Wo as enrollGrantFrame, Wr as newMailbox, Wt as formatPaymentAmount, Xa as HANDOFF_PIECE_BYTES, Xi as wireReaction, Xn as beaconKeys, Xo as createDeviceInvite, Xt as sparkInvoiceDetails, Ya as HANDOFF_PAKE, Yi as validReactionNumber, Yn as COMMUNITY_TOPOLOGY, Yo as verifyEnrollProof, Yr as dialDescriptors, Ys as verify, Yt as sparkAddressKind, Za as HANDOFF_REQUEST, Zi as pairedReplyAuthor, Zn as beaconRecords, Zo as deviceInviteJoinerParams, Zs as sanitizeAvatar, Zt as isBitcoinAddress, _ as knockRecords, _a as verifyCommitSignature, _i as DHT_MESSAGE_TTL, _o as handoffStreamKey, _r as TypingSender, _s as TURN_RAISE_READ_TIMEOUT_MS, a as sealGroupTyping, aa as checkStatusCard, ai as newIdentityBinding, ao as handoffCancelFrame, ar as pickHubs, as as DEVICES_CAPABILITY, bi as dhtFileId, bo as readHandoffAck, bs as turnPutSummary, c as GROUP_READ_NOTE_COMMUNITY, ca as arrivalKey, ci as lastSharedWithMe, co as handoffDataFrame, cr as readBeaconHead, cs as deviceEchoFrame, d as encodeCommunityLink, da as receivedTimestamp, di as validExternalKey, do as handoffHelloFrame, dr as ChatFiles, ds as deviceLinkPairing, ea as BUTTON_ID, ec as randomBytes, ei as IdentityExchange, eo as filePartName, er as lobbyKeys, es as createChatInvite, et as isAtprotoDid, fa as shownTime, fi as TRANSPORTS, fo as handoffManifestFrames, fr as FILE_LIMITS, fs as devicePingFrame, g as knockIdentity, ga as rosterHas, go as handoffRetryAfter, h as entryParams, ha as MEMBER_KEY, hi as irohRelayUrl, ho as handoffReleaseFrame, hs as webCryptoSigner, i as openGroupTyping, ic as utf8Encode, ii as identityStatement, io as handoffBusyFrame, ir as newerHead, is as inviteOwnership, j as carryMentions, ja as RTC_CONFIG, jn as isFederationId, jo as readSetUpdate, jr as parseWakeFrame, js as RelayTransport, ka as encodeControl, ki as fileMessageText, kn as fedimintRequestPayload, kr as deviceWakeRequest, ks as turnName, kt as encodeDidDhtDeactivated, l as communityHasFrame, la as claimedTime, li as PeerProofs, lo as handoffDigest, lr as readLobby, ls as deviceEchoNonce, m as encodeGroupEntryLink, mi as irohDescriptor, mo as handoffPakeFrame, mr as transferStalled, ms as seedSigner, n as GroupTypingBoard, nc as toZ32, ni as emptyIdentityLedger, no as handoffAttemptFailed, nr as mergeBeacon, ns as encodeInviteCode, o as COMMUNITY_LIMITS, oa as sameButtonText, oi as receivedIdentityStatus, oo as handoffContext, or as rankHubs, os as ENROLL_CAPABILITY, p as decodeGroupEntryLink, pa as GROUP_MEMBER_CAP, pi as automaticTransport, po as handoffOfferFrame, pr as transferEnded, ps as newDeviceSetSecret, qa as HANDOFF_HELLO, qi as reactionIsNewer, qn as meshHubs, qo as readEnrollGrant, qr as DHT_TEXT_CAPABILITY, qs as identityFromSeedB64, qt as SPARK_NETWORKS, r as groupTypingEpoch, ra as STATUS_CARD_LIMITS, rc as utf8Decode, ri as identityRevocationValue, ro as handoffAttemptSucceeded, rr as mergeLobby, s as CommunitySession, sa as statusCardText, si as revokesIdentity, so as handoffContextProof, sr as readBeacon, ss as HANDOFF_CAPABILITY, tc as toBase64Url, to as handoffAttemptAllowed, tr as lobbyRecords, ts as decodeInviteCode, tt as normalizeAtprotoHandle, u as decodeCommunityLink, ua as heardTime, ui as emptyProofLedger, uo as handoffEphemeral, ur as shouldBeHub, us as deviceKeyZ32, v as mergeKnocks, va as edgeParams, vi as peekDhtMailbox, vo as handoffVersions, vs as TURN_SETTLE_MS, w as parseGroupWakeFrame, wa as formatLocalTarget, wn as engineError, wo as readHandoffHello, wr as pinIsNewer, ws as nextTurnPosition, x as GroupWakeLimiter, xa as RELAY_POLL_INTERVALS, xi as parseImageMeta, xo as readHandoffCancel, xr as PIN_LIMITS, xs as TURN_LAST_SEQUENCE, y as readKnocks, ya as DirectPathWatch, yi as DHT_FILE_CAPABILITY, yo as newHandoffId, yr as typingActivity, ys as classifyTurnRead, za as emptyLinkRecords, zi as readForwarded, zr as HOLD_CAPABILITY, zs as PacketTooLargeError, zt as TEST_USDT_FAUCET_AMOUNT } from "./src-K3NijMq-.js";
-import { a as deleteDatabase, c as profileOpenFailure, d as wrap, i as databaseName, l as store, n as STORES$1, o as fileStore, r as clearProfileStores, s as openDb, t as CARD_INDEX, u as transact } from "./idb-Co2lObpU.js";
-import { $ as onAdaptersChanged, A as intentRepository, C as ProviderSources, Ct as FileAppender, D as requireTurn, Dt as streamStored, E as refuseAway, Et as storedSize, F as ModeGate, G as fakesLightning, H as BITCOIN_INVOICE_ON_TESTNET, I as WrongNetworkError, J as mintNetwork, K as isTestMint, L as networkLabel, M as sealSeed, N as unsealSeed, O as setAwayWallets, P as ModeChanged, Q as identityProviders, R as CASHU_MINT_SOURCE, S as lightningPaying, St as paymentWireId, T as awayFrom, Tt as removeStored, U as DEFAULT_MINTS, V as WALLET_TYPES, W as TEST_MINT, X as BACKUP_MEDIA_TYPE, Y as paysItsOwnInvoices, Z as MAX_BACKUP_BYTES, _ as normalizePhrase, _t as pairedWireReply, a as createFailure, at as SourceConfigError, b as breezDatabasesFor, bt as replyTo, c as paymentNetwork, ct as networkMode, d as networkReason, dt as resolveAtprotoDid, et as registeredLightningProviders, f as rpcHost, ft as setOwnDidSource, g as isRecoveryPhrase, gt as groupReply, h as cardsKey, ht as chosenResolver, i as assertConfirmedReal, it as PROVIDER_PLATFORMS, j as newDeviceKey, k as setSingleWriterGate, l as paymentNetworksOf, lt as redact, m as LightningCards, mt as verifyIdentity, n as loadFedimintSdk, nt as reserveAdapterIds, o as createTiming, ot as SourceUnreachableError, p as CASHU_CARD, pt as boundedIdentityFetch, q as isWorthlessMint, r as WALLET_NAMES, rt as NothingSpentError, s as crossNetwork, st as isNothingSpentError, t as fedimintDatabase, tt as registeredOnchainProviders, u as walletInstances, ut as assertPublicServer, v as breezDatabase, vt as receivedPairedReply, w as sourceKey, wt as readStored$1, x as dropBreezDatabase, xt as paymentAlias, y as breezDatabaseInUse, yt as replyRef, z as cashuMint } from "../ghostly.mjs";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { $i as formatFileSize, $n as GROUP_FILE_LIMITS, $o as handoffEphemeral, $r as WAKE_CALL_INTERVAL_MS, $s as deviceKeyZ32, $t as SEPOLIA_TEST_USDT_FAUCET, A as entryParams, Aa as replySnippet, Ac as createRelayPayload, Ai as IdentityExchange, Ao as LEGACY_SERVICES, Ar as newerHead, As as enrollCancelReason, Ba as claimedTime, Bc as sanitizeAvatar, Bi as emptyProofLedger, Bn as engineText, Bo as HANDOFF_REQUEST, Br as transferStalled, Bs as deviceInviteJoinerParams, C as GROUP_READ_NOTE_COMMUNITY, Ca as reactionEmoji, Ci as DHT_TEXT_CAPABILITY, Cr as beaconRecords, Cs as signTombstone, Da as wireReaction, Dc as withRequestOptions, Dr as lobbyRecords, E as encodeCommunityLink, Ea as validReactionNumber, Ec as isDiscoveryBudgetError, Eo as parseCallSignal, Er as lobbyKeys, Fc as identityFromSeed, Fi as newIdentityBinding, Fo as HANDOFF_HAVE, Fr as readLobby, Fs as enrollProofFrame, G as GROUP_EDIT_TEXT_BYTES, Gc as toZ32, Gn as findEndpoint, Go as handoffAttemptFailed, Gr as typingActivity, Gs as encodeInviteCode, Gt as encodeDidDhtPacket, H as GroupSession, Ha as receivedTimestamp, Hc as fromBase64Url, Hi as TRANSPORTS, Hn as ENDPOINT, Ho as HANDOFF_VERIFIED, Hs as OwnInviteError, Ht as didDhtDocument, I as GroupWakeLimiter, Ia as checkStatusCard, Ic as identityFromSeedB64, Ii as receivedIdentityStatus, Io as HANDOFF_HELLO, Ir as shouldBeHub, Is as readEnrollGrant, J as mentionsMember, Ji as peekDhtMailbox, Jn as parseFedimintRequestPayload, Jo as handoffCancelFrame, Jr as mayPin, Js as DEVICES_CAPABILITY, Jt as ETHEREUM_USDT, K as carryMentions, Ka as appFingerprint, Kc as utf8Decode, Kn as isFederationId, Ko as handoffAttemptSucceeded, L as groupWakeFrame, La as sameButtonText, Lc as publicKeyFromZ32, Li as revokesIdentity, Lo as HANDOFF_OFFER, Lr as ChatFiles, Ls as readEnrollHello, M as knockRecords, Mi as emptyIdentityLedger, Mo as HANDOFF_ACK, Mr as rankHubs, Ms as enrollDoneFrame, N as mergeKnocks, Ni as identityRevocationValue, No as HANDOFF_CANCEL, Nr as readBeacon, Ns as enrollGrantFrame, O as decodeGroupEntryLink, Oa as pairedReplyAuthor, Oc as PacketTooLargeError, Oi as IDENTITY_REVOCATION_LABEL, Oo as emptyLinkRecords, Or as mergeBeacon, P as readKnocks, Pa as STATUS_CARD_LIMITS, Pc as createIdentity, Pi as identityStatement, Po as HANDOFF_DONE, Pr as readBeaconHead, Ps as enrollHelloFrame, Qn as pairedMessageFrame, Qo as handoffDigest, Qr as readPin, Qs as deviceEchoNonce, Qt as SEPOLIA_TEST_USDT, R as groupWakes, Ra as statusCardText, Rc as verify, Ri as lastSharedWithMe, Ro as HANDOFF_PAKE, Rr as FILE_LIMITS, Rs as verifyEnrollProof, S as CommunitySession, Sa as queueReaction, Sc as normalizeRelayUrl, Si as CapsExchange, Sr as beaconKeys, Ss as setUpdateFrame, T as decodeCommunityLink, Ta as readReaction, Tc as budgetRetryMs, Ti as dialDescriptors, Tr as freshHubs, Ua as shownTime, Uc as randomBytes, Ui as automaticTransport, Un as cashuRequestPayload, Uo as filePartName, Ur as TypingSender, Us as createChatInvite, Ut as didDhtFromPublicKey, V as GROUP_READ_NOTE, Va as heardTime, Vc as bytesEqual, Vi as validExternalKey, Vn as decodeBolt11, Vo as HANDOFF_TIMINGS, Vs as readDeviceInvite, Wc as toBase64Url, Wn as fedimintRequestPayload, Wo as handoffAttemptAllowed, Ws as decodeInviteCode, Wt as encodeDidDhtDeactivated, Xa as isAppRef, Xi as dhtFileId, Xn as INVITE_TAKEN, Xo as handoffContextProof, Xr as pinIsNewer, Xs as HANDOFF_CAPABILITY, Xt as ONCHAIN_PROVIDER, Y as groupName, Ya as isAppKey, Yi as DHT_FILE_CAPABILITY, Yn as GhostLink, Yo as handoffContext, Yr as nextPinNumber, Ys as ENROLL_CAPABILITY, Yt as EVM_TEST_CHAINS, Za as readAppRevocations, Zi as parseImageMeta, Zn as LIVENESS_PING_MS, Zo as handoffDataFrame, Zr as pinNumberHolds, Zs as deviceEchoFrame, Zt as PaymentPreflightError, _ as GroupTypingBoard, _a as COMMUNITY_REACTION_FRAME, _c as turnKeys, _i as HOLD_LIMITS, _o as decodeControl, _r as MESH_HUBS, _s as sealHandoffPiece, ai as wakeRequest, an as formatPaymentAmount, ao as rosterHas, as as handoffRetryAfter, b as sealGroupTyping, ba as ReactionWindow, bc as RelayTransport, bi as newMailbox, bo as RTC_CONFIG, br as pickMeshHubs, bs as readSetUpdate, c as APP_BUNDLE_LIMITS, cc as classifyTurnRead, ci as chatAppId, cn as SPARK_NETWORKS, co as DirectPathWatch, cs as newHandoffId, d as appViewOf, da as EDIT_RATE_WINDOW_MS, dc as TURN_MAX, di as BUTTONS_CAPABILITY, dn as sparkInvoiceDetails, do as presenceSeenAt, ds as readHandoffDone, ea as safeBlobType, ec as deviceLinkPairing, ei as WakeLimiter, en as TEST_USDT_FAUCET_AMOUNT, eo as canonicalJson, es as handoffHelloFrame, fa as RateWindow, fc as firstDeviceSetSecret, fi as EDIT_CAPABILITY, fn as isBitcoinAddress, fo as GhostlyHttpError, fs as readHandoffHave, ga as readForwarded, gc as signTurnRelease, gi as HOLD_DATED_BACK_MS, go as LIMITS, gr as readGroupSignal, gs as readHandoffVerified, gt as normalizeAtprotoHandle, h as readAppBundle, ha as forwardedAgain, hc as signTurnPacket, hi as HOLD_CAPABILITY, ho as webLocalFetch, hr as groupSignalFrame, hs as readHandoffTurnFrame, ht as isAtprotoDid, i as planAppUpdate, ic as webCryptoSigner, ii as relayRequest, in as assertWholeSats, io as MEMBER_KEY, ir as groupFileFallback, is as handoffReleaseFrame, j as knockIdentity, ja as BUTTON_ID, jo as serviceIdFromName, jr as pickHubs, js as enrollDigits, k as encodeGroupEntryLink, ka as readReply, ko as HTTP_SERVICE_PROTO, kr as mergeLobby, ks as enrollCancelFrame, l as APP_BUNDLE_MAGIC, la as parseVideoMeta, lc as turnPutSummary, li as isAppVersion, ln as SPARK_PROVIDER, ls as readHandoffAck, m as isAppUrl, ma as parseLinkPreview, mc as readTurnPacket, mi as UPGRADE_CAPABILITY, mn as isPubkyKey, mo as parseLocalTarget, ms as readHandoffPake, n as appUpdateDecision, nc as newDeviceSetSecret, ni as newWakeToken, nn as WALLET_NETWORKS, no as GROUP_MEMBER_CAP, ns as handoffOfferFrame, o as readAppStore, oa as fileMessageText, oc as TURN_RAISE_READ_TIMEOUT_MS, oi as checkPushEndpoint, on as validatePaymentTarget, oo as verifyCommitSignature, or as readGroupFileMeta, os as handoffStreamKey, pa as dhtEditId, pc as nextTurnPosition, pi as STATUS_CARD_CAPABILITY, po as formatLocalTarget, ps as readHandoffHello, q as parseCommunityEdit, qa as appRef, qc as utf8Encode, qi as DHT_MESSAGE_TTL, qn as parseCashuRequestPayload, qo as handoffBusyFrame, qr as PIN_LIMITS, qs as inviteOwnership, qt as signDidDhtPacket, r as checkAppBeforeRun, rc as seedSigner, ri as parseWakeFrame, rn as assertTokenUnits, rs as handoffPakeFrame, sa as parseVoiceMeta, sc as TURN_SETTLE_MS, si as vapidKeysMatch, sn as walletNetworkOf, so as edgeParams, ss as handoffVersions, t as appStoreDecision, tc as devicePingFrame, ti as deviceWakeRequest, tn as USDT_PUBLIC_RPC, ts as handoffManifestFrames, u as appDigest, ua as EDIT_BUFFER_MS, uc as TURN_LAST_SEQUENCE, ui as APPS_CAPABILITY, un as sparkAddressKind, uo as RELAY_POLL_INTERVALS, ur as CarriedTransport, us as readHandoffCancel, v as groupTypingEpoch, va as GROUP_REACTION_FRAME, vc as turnName, vi as HoldKeys, vo as encodeControl, vr as mayBeHub, w as communityHasFrame, wa as reactionIsNewer, wc as traceLink, wi as capsDescriptors, wr as doorHubs, ws as verifySetUpdate, x as COMMUNITY_LIMITS, xa as nextReactionNumber, xc as currentRelays, xi as readManifest, xr as COMMUNITY_TOPOLOGY, xs as setAckFrame, y as openGroupTyping, ya as REACTION_LIMITS, yc as DEFAULT_RELAYS, yi as HoldRefusedError, yr as meshHubs, z as parseGroupWakeFrame, za as arrivalKey, zi as PeerProofs, zn as engineError, zo as HANDOFF_PIECE_BYTES, zr as transferEnded, zs as createDeviceInvite } from "./src-DtxVo2Rm.js";
+import { a as clearProfileStores, c as fileStore, d as store, f as transact, i as STORES$1, l as openDb, n as APP_STORAGE_SCOPE_INDEX, o as databaseName, p as wrap, r as CARD_INDEX, s as deleteDatabase, t as APP_STORAGE_CHAT_INDEX, u as profileOpenFailure } from "./idb-BIdus0WX.js";
+import { a as fileBytesOf, c as removeFileBytes, i as fileBytes, l as FILE_BYTES_STEP, n as blobDigest } from "./fileBytes-3AQ2tJzW.js";
+import { $ as BACKUP_MEDIA_TYPE, A as requireTurn, At as paymentWireId, B as networkLabel, C as breezDatabasesFor, Ct as storedGroupFiles, D as sourceKey, Dt as replyRef, E as ProviderSources, Et as receivedPairedReply, F as sealSeed, Ft as streamStored, G as BITCOIN_INVOICE_ON_TESTNET, H as cashuMint, I as unsealSeed, J as fakesLightning, K as DEFAULT_MINTS, L as ModeChanged, M as setSingleWriterGate, Mt as readStored$1, N as intentRepository, Nt as removeStored, O as awayFrom, Ot as replyTo, P as newDeviceKey, Pt as storedSize, Q as paysItsOwnInvoices, R as ModeGate, S as breezDatabaseInUse, St as groupOfFile, T as lightningPaying, Tt as pairedWireReply, V as CASHU_MINT_SOURCE, W as WALLET_TYPES, X as isWorthlessMint, Y as isTestMint, Z as mintNetwork, _ as LightningCards, _t as verifyIdentity, a as irohRelayProblem, at as reserveAdapterIds, b as normalizePhrase, bt as groupFileId, c as createFailure, ct as SourceConfigError, d as paymentNetwork, dt as networkMode, et as MAX_BACKUP_BYTES, f as paymentNetworksOf, ft as redact, g as CASHU_CARD, gt as boundedIdentityFetch, h as rpcHost, ht as setOwnDidSource, i as createIrohWebEndpoint, it as registeredOnchainProviders, j as setAwayWallets, jt as FileAppender, k as refuseAway, kt as paymentAlias, l as createTiming, lt as SourceUnreachableError, m as networkReason, mt as resolveAtprotoDid, n as loadFedimintSdk, nt as onAdaptersChanged, o as WALLET_NAMES, ot as NothingSpentError, p as walletInstances, pt as assertPublicServer, q as TEST_MINT, r as DEFAULT_IROH_RELAYS, rt as registeredLightningProviders, s as assertConfirmedReal, st as PROVIDER_PLATFORMS, t as fedimintDatabase, tt as identityProviders, u as crossNetwork, ut as isNothingSpentError, v as cardsKey, vt as chosenResolver, w as dropBreezDatabase, wt as groupReply, x as breezDatabase, xt as groupFileText, y as isRecoveryPhrase, yt as GroupFileDesk, z as WrongNetworkError } from "../ghostly.mjs";
+import { n as traceJoin } from "./joinTrace-CO8mlhNO.js";
 import { hkdf } from "@noble/hashes/hkdf.js";
 import { sha256 } from "@noble/hashes/sha2.js";
 import { base64, base64url, base64urlnopad, bech32, hex } from "@scure/base";
@@ -6175,7 +6177,7 @@ var COMMANDO_NOT_RUN = {
 };
 var MAX_REPLY = 4194304;
 /** One websocket frame may carry many Lightning messages; one this large is not an answer to anything. */
-var MAX_FRAME$1 = 4259840;
+var MAX_FRAME = 4259840;
 var text$1 = new TextDecoder();
 /**
 * One connection to a node, opened on first use and again after it drops. Calls run concurrently, matched
@@ -6279,7 +6281,7 @@ var CommandoClient = class {
 			ws.onmessage = ({ data }) => {
 				if (!(data instanceof ArrayBuffer) && !ArrayBuffer.isView(data)) return fail("The node sent something that is not binary");
 				const chunk = data instanceof ArrayBuffer ? new Uint8Array(data) : new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
-				if (chunk.length > MAX_FRAME$1) return fail("The node sent more than it was asked for");
+				if (chunk.length > MAX_FRAME) return fail("The node sent more than it was asked for");
 				buffer = concatBytes(buffer, chunk);
 				try {
 					if (stage === "act2") {
@@ -11703,6 +11705,1161 @@ var eachNetwork = (value) => "mainnet" in value && "testnet" in value ? value :
 	testnet: value
 };
 //#endregion
+//#region ../browser/src/engine/appFetch.ts
+/** The hosts phase 1 reads from. A jsDelivr URL must also name a 40-character commit (`isAppUrl`). */
+var APP_FETCH_HOSTS = ["raw.githubusercontent.com", "cdn.jsdelivr.net"];
+var APP_FETCH_LIMITS = {
+	/**
+	* A store index as read (WISP 1200 § Stores, Privacy): 4 MiB in phase 1, under the format's 16 MiB. Counted on the body
+	* as it arrives, after the browser undid any compression, since a page never sees the compressed size.
+	*/
+	storeIndexBytes: 4194304,
+	/** A store's signature statement, `ghostly-store.sig` (canonical, at most 1 KiB). */
+	sigBytes: 1024,
+	/** `ghostly-revoke.json`: at most 4096 signed revocations. */
+	revocationsBytes: 16777216,
+	timeoutMs: 3e4
+};
+/** A URL this client may read an app, a store or a revocation list from. */
+function isAppFetchUrl(value) {
+	if (!isAppUrl(value)) return false;
+	const url = new URL(value);
+	return url.port === "" && APP_FETCH_HOSTS.includes(url.hostname.toLowerCase());
+}
+var AppFetchError = class extends Error {
+	code;
+	status;
+	constructor(code, message, status) {
+		super(`${code}: ${message}`);
+		this.code = code;
+		this.status = status;
+		this.name = "AppFetchError";
+	}
+};
+function boundedAppFetch(options = {}) {
+	return async (url, { maxBytes, peek = false }) => {
+		if (!isAppFetchUrl(url)) throw new AppFetchError("host", "Apps are read only from raw.githubusercontent.com, or from cdn.jsdelivr.net at a commit, over HTTPS");
+		if (options.online && !options.online()) throw new AppFetchError("offline", "Offline");
+		const fetcher = options.fetcher ?? globalThis.fetch.bind(globalThis);
+		let response;
+		try {
+			response = await fetcher(url, {
+				signal: AbortSignal.timeout(options.timeoutMs ?? APP_FETCH_LIMITS.timeoutMs),
+				credentials: "omit",
+				referrerPolicy: "no-referrer",
+				cache: "no-store",
+				redirect: "error",
+				...peek && { headers: { range: `bytes=0-${maxBytes - 1}` } }
+			});
+		} catch (error) {
+			throw new AppFetchError("network", error instanceof Error ? error.message : String(error));
+		}
+		if (response.url && response.url !== url && !isAppFetchUrl(response.url)) throw new AppFetchError("host", "The host sent the request elsewhere");
+		if (!response.ok) {
+			await response.body?.cancel().catch(() => {});
+			throw new AppFetchError("status", `The host answered ${response.status}`, response.status);
+		}
+		if (!peek && Number(response.headers.get("content-length")) > maxBytes) {
+			await response.body?.cancel().catch(() => {});
+			throw new AppFetchError("too-large", "Too large");
+		}
+		const parts = [];
+		let length = 0;
+		const reader = response.body?.getReader();
+		if (reader) try {
+			for (;;) {
+				const { done, value } = await reader.read();
+				if (done) break;
+				if (length + value.length > maxBytes) {
+					if (!peek) throw new AppFetchError("too-large", "Too large");
+					parts.push(value.subarray(0, maxBytes - length));
+					length = maxBytes;
+					break;
+				}
+				parts.push(value);
+				length += value.length;
+			}
+		} catch (error) {
+			if (error instanceof AppFetchError) throw error;
+			throw new AppFetchError("network", error instanceof Error ? error.message : String(error));
+		} finally {
+			await reader.cancel().catch(() => {});
+		}
+		const bytes = new Uint8Array(length);
+		let at = 0;
+		for (const part of parts) {
+			bytes.set(part, at);
+			at += part.length;
+		}
+		return bytes;
+	};
+}
+var NAME = /^[A-Za-z0-9_.-]+$/;
+/**
+* The URL a pasted address reads `file` from (WISP 1200 § Paste a URL), or null when it is not one this client reads:
+* - `https://github.com/<owner>/<repo>`, or `/tree/<ref>`: `raw.githubusercontent.com/<owner>/<repo>/<ref or HEAD>/<file>`,
+*   with no request to `github.com` or `api.github.com`;
+* - a file as GitHub shows it, `https://github.com/<owner>/<repo>/blob/<ref>/<path>` (or `/raw/`), naming a `.ghostlyapp`
+*   or `.json` file: `raw.githubusercontent.com/<owner>/<repo>/<ref>/<path>`, again with no request to `github.com`;
+* - a URL of the list that names a file (`….ghostlyapp`, `….json`): itself;
+* - a URL of the list that names a folder: `<file>` in it.
+*/
+function appPasteUrl(input, file) {
+	let url;
+	try {
+		url = new URL(input.trim());
+	} catch {
+		return null;
+	}
+	if (url.protocol !== "https:" || url.username || url.password || url.port) return null;
+	const host = url.hostname.toLowerCase();
+	if (host === "github.com" || host === "www.github.com") {
+		const parts = url.pathname.split("/").filter(Boolean);
+		if (parts.length < 2) return null;
+		const owner = parts[0], repo = parts[1].replace(/\.git$/, "");
+		if (!NAME.test(owner) || !NAME.test(repo)) return null;
+		let ref = "HEAD";
+		if (parts.length > 2) {
+			const rest = parts.slice(3);
+			if (!rest.length || !rest.every((p) => NAME.test(p) && p !== "." && p !== "..")) return null;
+			if (parts[2] === "blob" || parts[2] === "raw") {
+				if (rest.length < 2 || !/\.(ghostlyapp|json)$/.test(rest[rest.length - 1])) return null;
+				const raw = `https://raw.githubusercontent.com/${owner}/${repo}/${rest.join("/")}`;
+				return isAppFetchUrl(raw) ? raw : null;
+			}
+			if (parts[2] !== "tree") return null;
+			ref = rest.join("/");
+		}
+		const raw = `https://raw.githubusercontent.com/${owner}/${repo}/${ref}/${file}`;
+		return isAppFetchUrl(raw) ? raw : null;
+	}
+	const last = url.pathname.split("/").pop() ?? "";
+	const named = /\.(ghostlyapp|json)$/.test(last) ? url.href : new URL(`${url.pathname.replace(/\/?$/, "/")}${file}`, url).href;
+	return isAppFetchUrl(named) ? named : null;
+}
+/** A page of github.com (any scheme): a link `appPasteUrl` could not read is still GitHub, and is answered as such. */
+function isGitHubPage(input) {
+	try {
+		const host = new URL(input.trim()).hostname.toLowerCase();
+		return host === "github.com" || host === "www.github.com";
+	} catch {
+		return false;
+	}
+}
+/** A file beside another (`ghostly-store.sig` beside the index, `ghostly-revoke.json` beside a bundle). */
+function besideUrl(url, name) {
+	const target = new URL(url);
+	target.search = "";
+	target.hash = "";
+	return new URL(name, target).href;
+}
+/**
+* The stores a new profile starts with (WISP 1200 § Stores: the default store, preloaded and removable), each a URL and
+* the store key it is pinned to. Preloading one makes no request; the first read comes when the person opens the Apps
+* page or once an app is installed.
+*/
+var DEFAULT_APP_STORES = [{
+	url: "https://raw.githubusercontent.com/MiguelMedeiros/ghostly-store/HEAD/ghostly-store.json",
+	key: "y379ia3t1urwudj8o4w1qwmuwp1mcxyf956b5r7pqup7stce6diy"
+}];
+var APP_STORAGE_LIMITS = {
+	/** A key, in UTF-8 bytes. */
+	keyBytes: 256,
+	/** A value, as compact JSON in UTF-8 bytes. */
+	valueBytes: 65536,
+	/** Every key and value of one app in one scope. */
+	scopeBytes: 5242880
+};
+var APP_CHECK_TIMINGS = {
+	/** After the engine starts, so the chats come up first. */
+	afterStartMs: 6e4,
+	everyMs: 864e5,
+	/** A check at start is skipped when every app was checked this recently (a page reloaded several times). */
+	freshMs: 36e5
+};
+/** A fetched bundle kept for its install screen: at most this many, for this long. */
+var STAGED = {
+	max: 4,
+	ms: 6e5
+};
+/** The first bytes of a bundle: magic, the manifest's length and the largest manifest. */
+var PEEK_BYTES = APP_BUNDLE_MAGIC.length + 4 + APP_BUNDLE_LIMITS.manifestBytes;
+var bundleId = (digest) => `app-${digest}`;
+/** An error whose message starts with its code (`<code>: words`), as it crosses the engine's RPC. */
+function fail(code, words) {
+	throw new Error(`${code}: ${words}`);
+}
+/**
+* Why a pasted link is not read: a github.com page that is neither a repository nor a file of one (`github-link`), so
+* the person is not told GitHub is off the list; any other host (`host`).
+*/
+function notReadable(url, words) {
+	if (typeof url === "string" && isGitHubPage(url)) fail("github-link", "Paste the repository's link, or the link to its app file");
+	fail("host", words);
+}
+var versionOf = (manifest, digest) => ({
+	ref: appRef(manifest.publisher, manifest.name),
+	sequence: manifest.sequence,
+	digest
+});
+var byteLength = (text) => utf8Encode(text).length;
+/** Rows of one app (`[ref]`), or of one app in one scope (`[ref, scope]`), in `STORES.appStorage`. */
+var rowsOf = (...prefix) => IDBKeyRange.bound(prefix, [...prefix, []]);
+function done(tx) {
+	return new Promise((resolve, reject) => {
+		tx.oncomplete = () => resolve();
+		tx.onerror = tx.onabort = () => reject(tx.error ?? /* @__PURE__ */ new Error("App storage failed"));
+	});
+}
+/**
+* The manifest of a bundle's first bytes, unchecked: only to see whether a source holds something newer before reading
+* all of it. Whatever it says, the whole bundle is checked before anything is kept.
+*/
+function peekAppManifest(bytes) {
+	const magic = utf8Encode(APP_BUNDLE_MAGIC);
+	if (bytes.length < magic.length + 4 || !magic.every((b, i) => bytes[i] === b)) return null;
+	const length = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength).getUint32(magic.length);
+	if (length > APP_BUNDLE_LIMITS.manifestBytes || bytes.length < magic.length + 4 + length) return null;
+	const manifestBytes = bytes.subarray(magic.length + 4, magic.length + 4 + length);
+	try {
+		const manifest = JSON.parse(utf8Decode(manifestBytes));
+		const ref = typeof manifest.publisher === "string" && typeof manifest.name === "string" ? appRef(manifest.publisher, manifest.name) : "";
+		if (!isAppRef(ref) || typeof manifest.sequence !== "number" || !Number.isSafeInteger(manifest.sequence)) return null;
+		return {
+			ref,
+			sequence: manifest.sequence,
+			digest: appDigest(manifestBytes)
+		};
+	} catch {
+		return null;
+	}
+}
+var Apps = class {
+	host;
+	staged = /* @__PURE__ */ new Map();
+	/** Bundles read back and checked, by digest: the one running is read once, not on every `file`. */
+	verified = /* @__PURE__ */ new Map();
+	/** Bytes used per `ref\0scope`, counted once from the rows and kept in step by the writes here. */
+	usage = /* @__PURE__ */ new Map();
+	queues = /* @__PURE__ */ new Map();
+	timer = null;
+	checking = null;
+	/** Runs the person started with Run anyway (`<ref> <digest>`), for this engine's life: a removal does not cut them off. */
+	anyway = /* @__PURE__ */ new Set();
+	stopped = false;
+	constructor(host) {
+		this.host = host;
+	}
+	now() {
+		return (this.host.now ?? Date.now)();
+	}
+	nowS() {
+		return Math.floor(this.now() / 1e3);
+	}
+	/** Preloads the default stores (no request), then checks for updates soon after start and every 24 hours. */
+	async start() {
+		this.stopped = false;
+		await this.seedDefaults();
+		this.schedule(APP_CHECK_TIMINGS.afterStartMs, true);
+	}
+	stop() {
+		this.stopped = true;
+		if (this.timer) clearTimeout(this.timer);
+		this.timer = null;
+	}
+	schedule(ms, atStart = false) {
+		if (this.timer) clearTimeout(this.timer);
+		this.timer = setTimeout(() => {
+			this.timer = null;
+			(async () => {
+				if (this.stopped) return;
+				if (this.host.online()) {
+					const apps = await this.installed();
+					const fresh = atStart && apps.length > 0 && apps.every((a) => a.checkedAt !== void 0 && this.now() - a.checkedAt < APP_CHECK_TIMINGS.freshMs);
+					if (apps.length && !fresh) await this.checkUpdates().catch(() => {});
+				}
+				if (!this.stopped) this.schedule(APP_CHECK_TIMINGS.everyMs);
+			})();
+		}, ms);
+	}
+	async seedDefaults() {
+		for (const d of this.host.defaults ?? DEFAULT_APP_STORES) {
+			if (!isAppKey(d.key) || !isAppFetchUrl(d.url)) continue;
+			if (await this.storeRecord(d.key)) continue;
+			await this.putStore({
+				key: d.key,
+				url: d.url,
+				addedAt: this.now(),
+				preloaded: true
+			});
+		}
+	}
+	async installed() {
+		return wrap((await store(STORES$1.apps, "readonly")).getAll());
+	}
+	async app(ref) {
+		return wrap((await store(STORES$1.apps, "readonly")).get(ref));
+	}
+	async installedOrFail(ref) {
+		if (!isAppRef(ref)) fail("bad-ref", "Not an app reference");
+		return await this.app(ref) ?? fail("not-installed", "This app is not installed");
+	}
+	/**
+	* An installed app that may still run (WISP 1200 § Takedowns): a running app whose version its publisher revoked, or
+	* a store of the person's removed (unless this run was started with Run anyway), is cut off with `stopped`, whether
+	* or not the page stops its frame.
+	*/
+	async stillRunnable(app) {
+		const run = this.runStatus(app, await this.stores(), app.revocations);
+		if (run.status === "revoked") fail("stopped", "Its publisher revoked this version");
+		if (run.status === "removed" && !this.anyway.has(`${app.ref} ${app.digest}`)) fail("stopped", `Removed by ${run.by[0].name}: ${run.by[0].reason}`);
+		return app;
+	}
+	async runningOrFail(ref) {
+		return this.stillRunnable(await this.installedOrFail(ref));
+	}
+	/**
+	* Before an app's frames go to a contact (`appOpen`, `appSend`): refused with `stopped` as its storage is. A reference
+	* not installed here (a bot that speaks an app's messages) is not this store's to refuse.
+	*/
+	async chatRunnable({ ref }) {
+		const app = isAppRef(ref) ? await this.app(ref) : void 0;
+		if (app) await this.stillRunnable(app);
+	}
+	async putApp(app) {
+		await wrap((await store(STORES$1.apps, "readwrite")).put(app));
+	}
+	async storeRecord(key) {
+		return wrap((await store(STORES$1.appStores, "readonly")).get(key));
+	}
+	async putStore(record) {
+		await wrap((await store(STORES$1.appStores, "readwrite")).put(record));
+	}
+	/** The stores the person has (a removed default is not one). */
+	async stores() {
+		return (await wrap((await store(STORES$1.appStores, "readonly")).getAll())).filter((s) => !s.removed);
+	}
+	storeViews(stores) {
+		return stores.filter((s) => s.index).map((s) => ({
+			key: s.key,
+			name: s.index.name,
+			kind: s.index.kind,
+			removed: s.index.removed,
+			revoked: s.index.revoked
+		}));
+	}
+	listedBy(ref, stores) {
+		return stores.filter((s) => s.index?.apps.some((a) => a.ref === ref)).map((s) => ({
+			key: s.key,
+			name: s.index.name,
+			kind: s.index.kind
+		}));
+	}
+	runStatus(version, stores, revocations = []) {
+		const check = checkAppBeforeRun(version, this.storeViews(stores), revocations);
+		if (check.status === "revoked") return {
+			status: "revoked",
+			...check.revocation.statement.reason && { reason: check.revocation.statement.reason }
+		};
+		return check;
+	}
+	/**
+	* Stores a bundle's bytes. A browser that keeps no files fails here: Safari's Private Browsing (and WebKit's in-memory
+	* contexts) refuses a Blob in IndexedDB with "Error preparing Blob/File data to be stored in object store". Any such
+	* failure is `storage`, with the browser's own words after it for the logs, and leaves no piece behind.
+	*/
+	async writeBundle(digest, bytes) {
+		const id = bundleId(digest);
+		const expected = toBase64Url(sha256(bytes));
+		let files;
+		let stored;
+		try {
+			files = await fileBytes();
+			const size = await files.size(id);
+			if (size === bytes.length && await files.digest(id) === expected) return files.kind;
+			if (size !== null) await files.remove(id);
+			for (let at = 0; at < bytes.length; at += FILE_BYTES_STEP) await files.append(id, at, bytes.subarray(at, at + FILE_BYTES_STEP));
+			await files.flush(id);
+			await files.close(id);
+			stored = await files.digest(id);
+		} catch (e) {
+			await files?.close(id).catch(() => {});
+			await files?.remove(id).catch(() => {});
+			const words = e instanceof Error ? `${e.name}: ${e.message}` : String(e);
+			console.warn("[apps] storage:", words);
+			fail("storage", `The app's files could not be stored on this device (${words})`);
+		}
+		if (stored !== expected) {
+			await files.remove(id).catch(() => {});
+			fail("storage", "The app's files could not be stored on this device");
+		}
+		return files.kind;
+	}
+	async readBundleBytes(kind, digest) {
+		const files = await fileBytesOf(kind);
+		const id = bundleId(digest);
+		const size = files ? await files.size(id) : null;
+		if (!files || size === null || size > APP_BUNDLE_LIMITS.bundleBytes) return null;
+		const out = new Uint8Array(size);
+		for (let at = 0; at < size;) {
+			const part = await files.read(id, at, Math.min(FILE_BYTES_STEP, size - at));
+			if (!part.length) return null;
+			out.set(part, at);
+			at += part.length;
+		}
+		return out;
+	}
+	async hasBundle(kind, digest) {
+		const files = await fileBytesOf(kind);
+		return !!files && await files.size(bundleId(digest)) !== null;
+	}
+	async removeBundle(kind, digest) {
+		this.verified.delete(digest);
+		await (await fileBytesOf(kind))?.remove(bundleId(digest)).catch(() => {});
+	}
+	/** The installed bundle read back and checked again before it runs (WISP 1200 § Signatures: "again before it runs one"). */
+	async verifiedBundle(app) {
+		const kept = this.verified.get(app.digest);
+		if (kept) return kept;
+		const bytes = await this.readBundleBytes(app.bytes, app.digest);
+		if (!bytes) fail("needs-files", "This app's files are not on this device yet");
+		const read = readAppBundle(bytes);
+		if (!read.ok || read.bundle.digest !== app.digest) fail("damaged", "This app's stored files do not match what was installed");
+		if (this.verified.size >= 2) this.verified.delete(this.verified.keys().next().value);
+		this.verified.set(app.digest, read.bundle);
+		return read.bundle;
+	}
+	async fetchBundle(url) {
+		const bytes = await this.host.fetch(url, { maxBytes: APP_BUNDLE_LIMITS.bundleBytes });
+		const read = readAppBundle(bytes);
+		if (!read.ok) fail(read.reason, `This is not an app Ghostly can install${read.detail ? ` (${read.detail})` : ""}`);
+		return {
+			bundle: read.bundle,
+			bytes
+		};
+	}
+	async readStoreAt(url, heldKey) {
+		const [indexBytes, sigBytes] = await Promise.all([this.host.fetch(url, { maxBytes: APP_FETCH_LIMITS.storeIndexBytes }), this.host.fetch(besideUrl(url, "ghostly-store.sig"), { maxBytes: APP_FETCH_LIMITS.sigBytes })]);
+		return readAppStore(indexBytes, sigBytes, this.nowS(), heldKey);
+	}
+	/** The revocations its publisher signed, read beside each URL (`ghostly-revoke.json`); none there is not an error. */
+	async readRevocations(ref, urls) {
+		const out = [];
+		for (const url of new Set(urls.filter(isAppFetchUrl).map((u) => besideUrl(u, "ghostly-revoke.json")))) try {
+			const read = readAppRevocations(await this.host.fetch(url, { maxBytes: APP_FETCH_LIMITS.revocationsBytes }));
+			if (read.ok) out.push(...read.revocations.filter((r) => r.statement.app === ref));
+		} catch {}
+		return out;
+	}
+	summary(s) {
+		const index = s.index;
+		return {
+			key: s.key,
+			fingerprint: appFingerprint(s.key),
+			url: s.url,
+			preloaded: !!s.preloaded,
+			...index && {
+				name: index.name,
+				kind: index.kind,
+				sequence: index.sequence,
+				expires: index.expires,
+				...index.description !== void 0 && { description: index.description }
+			},
+			expired: !!index && index.expires < this.nowS(),
+			...s.fetchedAt !== void 0 && { fetchedAt: s.fetchedAt },
+			apps: index?.apps ?? [],
+			removed: index?.removed ?? [],
+			...s.equivocation && { equivocation: {
+				sequence: s.equivocation.sequence,
+				at: s.equivocation.at
+			} },
+			...s.problem && { problem: s.problem }
+		};
+	}
+	async listStores() {
+		return (await this.stores()).sort((a, b) => a.addedAt - b.addedAt).map((s) => this.summary(s));
+	}
+	storeUrl(url) {
+		return typeof url === "string" && appPasteUrl(url, "ghostly-store.json") || notReadable(url, "Stores are read only from raw.githubusercontent.com, or from cdn.jsdelivr.net at a commit, over HTTPS");
+	}
+	/** Reads a store at a URL for the person to see before adding it. Nothing is kept. */
+	async previewStore({ url }) {
+		const at = this.storeUrl(url);
+		const read = await this.readStoreAt(at);
+		if (!read.ok) fail(read.reason, "This is not a store Ghostly can read");
+		const { index } = read.store;
+		return {
+			url: at,
+			key: index.key,
+			fingerprint: appFingerprint(index.key),
+			name: index.name,
+			kind: index.kind,
+			sequence: index.sequence,
+			expires: index.expires,
+			expired: read.store.expired,
+			apps: index.apps.length,
+			...index.description !== void 0 && { description: index.description }
+		};
+	}
+	/**
+	* Adds a store the person chose: read at its URL and pinned to its key (`key`, when given, is the key the person saw,
+	* and another one is refused). A store already added under that key takes the URL and the newer index.
+	*/
+	async addStore({ url, key }) {
+		if (key !== void 0 && !isAppKey(key)) fail("store-key", "Not a store key");
+		const at = this.storeUrl(url);
+		const read = await this.readStoreAt(at, key);
+		if (!read.ok) fail(read.reason, "This is not a store Ghostly can read");
+		const { index, digest } = read.store;
+		const held = await this.storeRecord(index.key);
+		const record = held && !held.removed ? {
+			...held,
+			url: at
+		} : {
+			key: index.key,
+			url: at,
+			addedAt: this.now(),
+			...held?.preloaded && { preloaded: true }
+		};
+		await this.putStore(this.withIndex(record, index, digest));
+		return this.summary(await this.storeRecord(index.key));
+	}
+	/** The update rule for indexes (WISP 1200 § Stores): a lower `sequence` or the same one with other bytes is refused, the held one kept. */
+	withIndex(record, index, digest) {
+		const held = record.index ? {
+			key: record.key,
+			sequence: record.index.sequence,
+			digest: record.digest ?? ""
+		} : null;
+		const decision = appStoreDecision(held, {
+			key: index.key,
+			sequence: index.sequence,
+			digest
+		});
+		const { problem: _problem, ...rest } = record;
+		switch (decision) {
+			case "new":
+			case "update": {
+				const { equivocation: _e, ...clean } = rest;
+				return {
+					...clean,
+					index,
+					digest,
+					fetchedAt: this.now()
+				};
+			}
+			case "same": return {
+				...rest,
+				fetchedAt: this.now()
+			};
+			case "rollback": return {
+				...rest,
+				problem: "rollback"
+			};
+			case "equivocation": return {
+				...rest,
+				equivocation: {
+					sequence: index.sequence,
+					digest,
+					at: this.now()
+				},
+				problem: "equivocation"
+			};
+			default: return {
+				...rest,
+				problem: "store-key"
+			};
+		}
+	}
+	async removeStore({ key }) {
+		const held = await this.storeRecord(key);
+		if (!held) return;
+		if (held.preloaded) await this.putStore({
+			key: held.key,
+			url: held.url,
+			addedAt: held.addedAt,
+			preloaded: true,
+			removed: true
+		});
+		else await wrap((await store(STORES$1.appStores, "readwrite")).delete(key));
+	}
+	/** Reads one store again, or every store (the person opened the Apps page, or the update check). */
+	async refreshStores({ key } = {}) {
+		const stores = (await this.stores()).filter((s) => key === void 0 || s.key === key);
+		if (key !== void 0 && !stores.length) fail("no-store", "No such store");
+		const out = [];
+		for (const s of stores) {
+			let next;
+			try {
+				const read = await this.readStoreAt(s.url, s.key);
+				next = read.ok ? this.withIndex(s, read.store.index, read.store.digest) : {
+					...s,
+					problem: read.reason
+				};
+			} catch (error) {
+				next = {
+					...s,
+					problem: error instanceof AppFetchError ? error.code : "network"
+				};
+			}
+			if (!await this.storeRecord(s.key) || (await this.storeRecord(s.key))?.removed) continue;
+			await this.putStore(next);
+			out.push(this.summary(next));
+		}
+		return out;
+	}
+	/**
+	* Fetches an app and checks it, for the install screen: from a pasted URL, a store's listing (its URLs in order) or a
+	* chat card's pointer. A store's or a card's `sequence` and digest must hold: the same app, and that version or a newer
+	* one. Nothing is stored: the checked bundle waits in memory for `install`.
+	*/
+	async preview(source) {
+		let urls;
+		let expect = null;
+		if ("url" in source) urls = [typeof source.url === "string" && appPasteUrl(source.url, "app.ghostlyapp") || notReadable(source.url, "Apps are read only from raw.githubusercontent.com, or from cdn.jsdelivr.net at a commit, over HTTPS")];
+		else if ("store" in source) {
+			const s = await this.storeRecord(source.store);
+			const listing = s && !s.removed ? s.index?.apps.find((a) => a.ref === source.ref) : void 0;
+			if (!listing) fail("not-listed", "This store does not list this app");
+			urls = listing.urls.filter(isAppFetchUrl);
+			expect = {
+				ref: listing.ref,
+				sequence: listing.sequence,
+				digest: listing.digest
+			};
+		} else if ("card" in source && source.card) {
+			const { ref, url, sequence, digest } = source.card;
+			if (!isAppRef(ref)) fail("bad-ref", "Not an app reference");
+			if (!isAppFetchUrl(url)) fail("host", "A card's app is read only from raw.githubusercontent.com, or from cdn.jsdelivr.net at a commit");
+			urls = [url];
+			expect = {
+				ref,
+				...typeof sequence === "number" && { sequence },
+				...typeof digest === "string" && { digest }
+			};
+		} else fail("bad-source", "No app to fetch");
+		if (!urls.length) fail("host", "This listing has no URL Ghostly reads from");
+		let last = null;
+		for (const url of urls) try {
+			const { bundle, bytes } = await this.fetchBundle(url);
+			const version = versionOf(bundle.manifest, bundle.digest);
+			if (expect) {
+				if (version.ref !== expect.ref) fail("other-app", "The URL holds another app");
+				if (expect.sequence !== void 0 && version.sequence < expect.sequence) fail("rollback", "The URL holds an older version than the one named");
+				if (expect.sequence === version.sequence && expect.digest !== void 0 && expect.digest !== version.digest) fail("equivocation", "The URL holds another version under the same number");
+			}
+			return this.stage(bundle, bytes, url);
+		} catch (error) {
+			last = error;
+		}
+		throw last instanceof Error ? last : new Error(String(last));
+	}
+	async stage(bundle, bytes, from) {
+		for (const [digest, s] of this.staged) if (this.now() - s.at > STAGED.ms) this.staged.delete(digest);
+		this.staged.delete(bundle.digest);
+		while (this.staged.size >= STAGED.max) this.staged.delete(this.staged.keys().next().value);
+		this.staged.set(bundle.digest, {
+			bundle,
+			bytes,
+			from,
+			at: this.now()
+		});
+		const { manifest, digest } = bundle;
+		const version = versionOf(manifest, digest);
+		const [installed, stores] = await Promise.all([this.app(version.ref), this.stores()]);
+		const decision = installed ? appUpdateDecision(installed, version) : "new";
+		const install = decision === "other-app" ? "new" : decision;
+		const asks = install === "new" ? [...manifest.permissions] : install === "update" ? manifest.permissions.filter((p) => !installed.permissions.includes(p)) : [];
+		const listedBy = this.listedBy(version.ref, stores);
+		return {
+			digest,
+			ref: version.ref,
+			publisher: manifest.publisher,
+			fingerprint: appFingerprint(manifest.publisher),
+			manifest,
+			from,
+			icon: bundle.files.get("icon.png")?.slice() ?? null,
+			install,
+			asks,
+			run: this.runStatus(version, stores, installed?.revocations),
+			listedBy,
+			unknownPublisher: !listedBy.some((s) => s.kind === "curated")
+		};
+	}
+	/**
+	* Installs the bundle `preview` fetched, once the person pressed Install: `grant` must hold every permission it asks
+	* for (WISP 1200 § Permissions: none is granted by a store or a contact). A revoked or removed version is not
+	* installed; neither is a rollback, nor another bundle under an installed `sequence` (marked on the app).
+	*/
+	async install({ digest, grant }) {
+		const staged = this.staged.get(digest);
+		if (!staged || this.now() - staged.at > STAGED.ms) {
+			this.staged.delete(digest);
+			fail("expired", "Fetch the app again");
+		}
+		const { bundle, bytes, from } = staged;
+		const { manifest } = bundle;
+		if (!Array.isArray(grant) || !manifest.permissions.every((p) => grant.includes(p))) fail("permissions", "Every permission the app asks for must be granted");
+		const version = versionOf(manifest, digest);
+		const [installed, stores] = await Promise.all([this.app(version.ref), this.stores()]);
+		const run = this.runStatus(version, stores, installed?.revocations);
+		if (run.status === "revoked") fail("revoked", "Its publisher revoked this version");
+		if (run.status === "removed") fail("removed", `Removed by ${run.by[0].name}: ${run.by[0].reason}`);
+		const pendingClash = installed?.pending && installed.pending.sequence === version.sequence && installed.pending.digest !== digest;
+		const decision = installed ? pendingClash ? "equivocation" : appUpdateDecision(installed, version) : "new";
+		if (decision === "rollback") fail("rollback", "A newer version of this app is installed");
+		if (decision === "equivocation") {
+			await this.putApp({
+				...installed,
+				equivocation: {
+					sequence: version.sequence,
+					digest,
+					at: this.now()
+				}
+			});
+			fail("equivocation", `Two different versions ${version.sequence} exist. Ghostly kept the one you have.`);
+		}
+		if (decision === "same" && installed) {
+			if (!await this.hasBundle(installed.bytes, digest)) await this.putApp({
+				...installed,
+				bytes: await this.writeBundle(digest, bytes)
+			});
+			this.staged.delete(digest);
+			return this.view(await this.app(version.ref), stores);
+		}
+		const kind = await this.writeBundle(digest, bytes);
+		const next = this.versionRecord(installed, bundle, kind, from);
+		await this.putApp(next);
+		if (installed && installed.digest !== digest) await this.removeBundle(installed.bytes, installed.digest);
+		if (installed?.pending && installed.pending.sequence <= version.sequence && installed.pending.digest !== digest) await this.removeBundle(installed.pending.bytes, installed.pending.digest);
+		this.staged.delete(digest);
+		return this.view(next, stores);
+	}
+	/** The record of a version installed now, keeping what the app had (its revocations, a newer version waiting). */
+	versionRecord(installed, bundle, kind, from) {
+		const { manifest, digest } = bundle;
+		const now = this.now();
+		const keepPending = installed?.pending && installed.pending.sequence > manifest.sequence ? installed.pending : void 0;
+		return {
+			ref: appRef(manifest.publisher, manifest.name),
+			publisher: manifest.publisher,
+			name: manifest.name,
+			sequence: manifest.sequence,
+			digest,
+			permissions: [...manifest.permissions],
+			manifest,
+			bytes: kind,
+			from,
+			installedAt: installed?.installedAt ?? now,
+			updatedAt: now,
+			...installed?.revocations?.length && { revocations: installed.revocations },
+			...installed?.equivocation && installed.equivocation.sequence >= manifest.sequence && { equivocation: installed.equivocation },
+			...keepPending && { pending: keepPending },
+			...installed?.checkedAt !== void 0 && { checkedAt: installed.checkedAt }
+		};
+	}
+	/** The person accepted the permissions a waiting update adds: it is installed now. */
+	async acceptUpdate({ ref }) {
+		const installed = await this.installedOrFail(ref);
+		const pending = installed.pending ?? fail("no-update", "No update waits for this app");
+		const bytes = await this.readBundleBytes(pending.bytes, pending.digest);
+		const read = bytes ? readAppBundle(bytes) : null;
+		if (!read?.ok || read.bundle.digest !== pending.digest) {
+			const { pending: _p, ...rest } = installed;
+			await this.putApp(rest);
+			fail("needs-files", "The update's files are gone; it is fetched again at the next check");
+		}
+		const stores = await this.stores();
+		const run = this.runStatus(versionOf(read.bundle.manifest, pending.digest), stores, installed.revocations);
+		if (run.status === "revoked") fail("revoked", "Its publisher revoked this version");
+		if (run.status === "removed") fail("removed", `Removed by ${run.by[0].name}: ${run.by[0].reason}`);
+		const plan = planAppUpdate(installed, {
+			...versionOf(read.bundle.manifest, pending.digest),
+			permissions: read.bundle.manifest.permissions
+		});
+		if (plan.action === "refuse") fail(plan.decision, "This update can no longer be installed");
+		const { pending: _p, ...without } = installed;
+		const next = this.versionRecord(without, read.bundle, pending.bytes, pending.from);
+		await this.putApp(next);
+		await this.removeBundle(installed.bytes, installed.digest);
+		return this.view(next, stores);
+	}
+	/**
+	* The update check (WISP 1200 § Updates and rollback): only with an app installed; every store read again, then each
+	* app's newer versions looked for in the stores' listings and its manifest's `sources`, and its publisher's
+	* revocations read beside its sources. An update that keeps or drops permissions installs by itself; one that adds
+	* some waits for the person. One check at a time.
+	*/
+	checkUpdates() {
+		this.checking ??= this.checkNow().then((results) => {
+			try {
+				this.host.checked?.(results);
+			} catch {}
+			return results;
+		}).finally(() => {
+			this.checking = null;
+		});
+		return this.checking;
+	}
+	async checkNow() {
+		const apps = await this.installed();
+		if (!apps.length) return [];
+		await this.refreshStores();
+		const stores = await this.stores();
+		const out = [];
+		for (const listed of apps) {
+			if (!await this.hasBundle(listed.bytes, listed.digest)) await this.fetchFiles({ ref: listed.ref }).catch(() => {});
+			const first = await this.app(listed.ref);
+			if (!first) continue;
+			let app = first;
+			let outcome = "none";
+			const highest = Math.max(app.sequence, app.pending?.sequence ?? 0);
+			const known = /* @__PURE__ */ new Set([app.digest, ...app.pending ? [app.pending.digest] : []]);
+			const candidates = [];
+			for (const s of stores) {
+				const listing = s.index?.apps.find((a) => a.ref === app.ref);
+				if (listing && (listing.sequence > highest || listing.sequence >= app.sequence && !known.has(listing.digest))) candidates.push(...listing.urls.filter(isAppFetchUrl));
+			}
+			for (const url of (app.manifest.sources ?? []).filter(isAppFetchUrl)) try {
+				const peek = peekAppManifest(await this.host.fetch(url, {
+					maxBytes: PEEK_BYTES,
+					peek: true
+				}));
+				if (peek && peek.ref === app.ref && (peek.sequence > highest || peek.sequence >= app.sequence && !known.has(peek.digest))) candidates.push(url);
+			} catch {}
+			for (const url of new Set(candidates)) {
+				let fetched;
+				try {
+					fetched = await this.fetchBundle(url);
+				} catch {
+					continue;
+				}
+				const { bundle, bytes } = fetched;
+				const version = versionOf(bundle.manifest, bundle.digest);
+				if (version.ref !== app.ref || known.has(version.digest)) continue;
+				if (app.pending && version.sequence === app.pending.sequence) {
+					app = {
+						...app,
+						equivocation: {
+							sequence: version.sequence,
+							digest: version.digest,
+							at: this.now()
+						}
+					};
+					outcome = "equivocation";
+					continue;
+				}
+				const plan = planAppUpdate(app, {
+					...version,
+					permissions: bundle.manifest.permissions
+				});
+				if (plan.action === "refuse") {
+					if (plan.decision === "equivocation") {
+						app = {
+							...app,
+							equivocation: {
+								sequence: version.sequence,
+								digest: version.digest,
+								at: this.now()
+							}
+						};
+						outcome = "equivocation";
+					}
+					continue;
+				}
+				if (this.runStatus(version, stores, app.revocations).status !== "ok") continue;
+				if (app.pending && version.sequence < app.pending.sequence) continue;
+				const kind = await this.writeBundle(version.digest, bytes);
+				if (plan.action === "install") {
+					const old = app;
+					app = this.versionRecord(app, bundle, kind, url);
+					if (old.pending && old.pending.sequence <= version.sequence) {
+						await this.removeBundle(old.pending.bytes, old.pending.digest);
+						delete app.pending;
+					}
+					await this.putApp(app);
+					await this.removeBundle(old.bytes, old.digest);
+					outcome = "updated";
+				} else {
+					if (app.pending) await this.removeBundle(app.pending.bytes, app.pending.digest);
+					app = {
+						...app,
+						pending: {
+							sequence: version.sequence,
+							digest: version.digest,
+							manifest: bundle.manifest,
+							added: plan.added,
+							bytes: kind,
+							from: url,
+							at: this.now()
+						}
+					};
+					outcome = "ask";
+				}
+				break;
+			}
+			const revocations = await this.readRevocations(app.ref, [app.from, ...app.manifest.sources ?? []]);
+			const merged = new Map((app.revocations ?? []).map((r) => [canonicalJson(r), r]));
+			for (const r of revocations) merged.set(canonicalJson(r), r);
+			if (!await this.app(app.ref)) continue;
+			app = {
+				...app,
+				...merged.size && { revocations: [...merged.values()] },
+				checkedAt: this.now()
+			};
+			await this.putApp(app);
+			out.push({
+				ref: app.ref,
+				outcome,
+				run: await this.runCheckOf(app, stores)
+			});
+		}
+		return out;
+	}
+	/**
+	* Fetches an installed app's bundle again when it is not on this device (a profile restored from a backup, which
+	* carries the installed list but no bundle: WISP 1200 § Where installed apps live). Only the installed digest is
+	* taken, checked whole: from the URL it was installed from, the listings of the person's stores that name that digest,
+	* then its `sources`. Nothing answers: it stays `needs-files`, and it never runs unchecked.
+	*/
+	async fetchFiles({ ref }) {
+		const app = await this.installedOrFail(ref);
+		const stores = await this.stores();
+		if (await this.hasBundle(app.bytes, app.digest)) return this.runCheckOf(app, stores);
+		const urls = [app.from];
+		for (const s of stores) for (const listing of s.index?.apps ?? []) if (listing.ref === app.ref && listing.digest === app.digest) urls.push(...listing.urls);
+		urls.push(...app.manifest.sources ?? []);
+		for (const url of new Set(urls.filter(isAppFetchUrl))) {
+			let fetched;
+			try {
+				fetched = await this.fetchBundle(url);
+			} catch {
+				continue;
+			}
+			if (fetched.bundle.digest !== app.digest) continue;
+			const kind = await this.writeBundle(app.digest, fetched.bytes);
+			const now = await this.app(app.ref);
+			if (!now || now.digest !== app.digest) {
+				await this.removeBundle(kind, app.digest);
+				fail("not-installed", "This app is not installed");
+			}
+			if (now.bytes !== kind) await this.putApp({
+				...now,
+				bytes: kind
+			});
+			return this.runCheckOf({
+				...now,
+				bytes: kind
+			}, stores);
+		}
+		return { status: "needs-files" };
+	}
+	async runCheckOf(app, stores) {
+		if (!await this.hasBundle(app.bytes, app.digest)) return { status: "needs-files" };
+		return this.runStatus(app, stores, app.revocations);
+	}
+	/** Before an app runs (WISP 1200 § Takedowns): revoked stops it, removed by a store of the person's warns. No request. */
+	async runCheck({ ref }) {
+		return this.runCheckOf(await this.installedOrFail(ref), await this.stores());
+	}
+	/**
+	* What the runner writes into its frame: the entry, from the bundle read back and checked again. A revoked version
+	* never runs; one a store removed runs only when the person chose "Run anyway" (`runAnyway`).
+	*/
+	async entry({ ref, runAnyway }) {
+		let app = await this.installedOrFail(ref);
+		let run = await this.runCheckOf(app, await this.stores());
+		if (run.status === "needs-files") {
+			run = await this.fetchFiles({ ref });
+			app = await this.installedOrFail(ref);
+		}
+		if (run.status === "revoked") fail("revoked", "Its publisher revoked this version");
+		if (run.status === "removed" && runAnyway !== true) fail("removed", `Removed by ${run.by[0].name}: ${run.by[0].reason}`);
+		if (run.status === "needs-files") fail("needs-files", "This app's files are not on this device yet");
+		if (run.status === "removed") this.anyway.add(`${app.ref} ${app.digest}`);
+		const bundle = await this.verifiedBundle(app);
+		const entry = bundle.files.get(bundle.manifest.entry) ?? fail("damaged", "The entry is missing");
+		return {
+			ref: app.ref,
+			digest: app.digest,
+			version: app.manifest.version,
+			title: app.manifest.title,
+			permissions: [...app.permissions],
+			view: appViewOf(bundle.manifest),
+			entry: utf8Decode(entry)
+		};
+	}
+	/** A file of the installed bundle, for the broker's `file` (`ghostly.file(path)`). */
+	async file({ ref, path }) {
+		const app = path === "icon.png" ? await this.installedOrFail(ref) : await this.runningOrFail(ref);
+		const bundle = await this.verifiedBundle(app);
+		if (typeof path !== "string" || !bundle.files.has(path)) fail("no-file", "No such file in this app");
+		return bundle.files.get(path).slice();
+	}
+	async view(app, stores) {
+		const { manifest } = app;
+		const listedBy = this.listedBy(app.ref, stores);
+		return {
+			ref: app.ref,
+			name: app.name,
+			publisher: app.publisher,
+			fingerprint: appFingerprint(app.publisher),
+			title: manifest.title,
+			tagline: manifest.tagline,
+			...manifest.description !== void 0 && { description: manifest.description },
+			version: manifest.version,
+			sequence: app.sequence,
+			digest: app.digest,
+			permissions: [...app.permissions],
+			view: appViewOf(manifest),
+			from: app.from,
+			icon: manifest.files.some((f) => f.path === "icon.png"),
+			installedAt: app.installedAt,
+			updatedAt: app.updatedAt,
+			run: await this.runCheckOf(app, stores),
+			listedBy,
+			unknownPublisher: !listedBy.some((s) => s.kind === "curated"),
+			...app.pending && { pending: {
+				sequence: app.pending.sequence,
+				version: app.pending.manifest.version,
+				added: [...app.pending.added]
+			} },
+			...app.equivocation && { equivocation: {
+				sequence: app.equivocation.sequence,
+				at: app.equivocation.at
+			} },
+			...app.checkedAt !== void 0 && { checkedAt: app.checkedAt }
+		};
+	}
+	async list() {
+		const [apps, stores] = await Promise.all([this.installed(), this.stores()]);
+		return Promise.all(apps.sort((a, b) => a.installedAt - b.installedAt).map((a) => this.view(a, stores)));
+	}
+	/**
+	* Uninstalls an app: its bundle (and a waiting update's), its record and its storage in every scope. The person chose
+	* it, after the offer of an export (`exportData`).
+	*/
+	async uninstall({ ref }) {
+		const app = await this.installedOrFail(ref);
+		const tx = (await openDb()).transaction([STORES$1.apps, STORES$1.appStorage], "readwrite");
+		tx.objectStore(STORES$1.apps).delete(app.ref);
+		tx.objectStore(STORES$1.appStorage).delete(rowsOf(app.ref));
+		await done(tx);
+		for (const key of [...this.usage.keys()]) if (key.startsWith(`${app.ref}\0`)) this.usage.delete(key);
+		await this.removeBundle(app.bytes, app.digest);
+		if (app.pending) await this.removeBundle(app.pending.bytes, app.pending.digest);
+	}
+	scopeOf(scope) {
+		if (scope === "alone" || typeof scope === "string" && this.host.isChat(scope)) return scope;
+		fail("bad-scope", "Not a chat of this profile");
+	}
+	keyOf(key) {
+		if (typeof key !== "string" || !key.length || byteLength(key) > APP_STORAGE_LIMITS.keyBytes) fail("bad-key", "A key is 1 to 256 bytes of text");
+		return key;
+	}
+	/** One scope's writes, one after another, so the count of bytes used stays true. */
+	serial(id, work) {
+		const run = (this.queues.get(id) ?? Promise.resolve()).then(work, work);
+		const settled = run.catch(() => {});
+		this.queues.set(id, settled);
+		settled.then(() => {
+			if (this.queues.get(id) === settled) this.queues.delete(id);
+		});
+		return run;
+	}
+	async usageOf(ref, scope) {
+		const id = `${ref}\0${scope}`;
+		let used = this.usage.get(id);
+		if (used === void 0) {
+			used = (await wrap((await store(STORES$1.appStorage, "readonly")).index(APP_STORAGE_SCOPE_INDEX).getAll([ref, scope]))).reduce((sum, r) => sum + r.size, 0);
+			this.usage.set(id, used);
+		}
+		return used;
+	}
+	async storageGet({ ref, scope, key }) {
+		const app = await this.runningOrFail(ref);
+		const row = await wrap((await store(STORES$1.appStorage, "readonly")).get([
+			app.ref,
+			this.scopeOf(scope),
+			this.keyOf(key)
+		]));
+		return row ? { value: JSON.parse(row.value) } : null;
+	}
+	/** Keeps a JSON value under a key: at most 64 KiB, and 5 MiB for every key of this app in this scope. */
+	async storageSet({ ref, scope, key, value }) {
+		const app = await this.runningOrFail(ref);
+		const where = this.scopeOf(scope), name = this.keyOf(key);
+		let text;
+		try {
+			text = JSON.stringify(value);
+		} catch {
+			text = void 0;
+		}
+		if (typeof text !== "string") fail("bad-value", "A value is JSON");
+		const valueBytes = byteLength(text);
+		if (valueBytes > APP_STORAGE_LIMITS.valueBytes) fail("too-large", "A value is at most 64 KiB");
+		const size = byteLength(name) + valueBytes;
+		await this.serial(`${app.ref}\0${where}`, async () => {
+			const used = await this.usageOf(app.ref, where);
+			const rows = await store(STORES$1.appStorage, "readonly");
+			const next = used - ((await wrap(rows.get([
+				app.ref,
+				where,
+				name
+			])))?.size ?? 0) + size;
+			if (next > APP_STORAGE_LIMITS.scopeBytes) fail("full", "This app's storage in this chat is full (5 MiB)");
+			await wrap((await store(STORES$1.appStorage, "readwrite")).put({
+				ref: app.ref,
+				scope: where,
+				key: name,
+				value: text,
+				size
+			}));
+			this.usage.set(`${app.ref}\0${where}`, next);
+		});
+	}
+	async storageDelete({ ref, scope, key }) {
+		const app = await this.runningOrFail(ref);
+		const where = this.scopeOf(scope), name = this.keyOf(key);
+		await this.serial(`${app.ref}\0${where}`, async () => {
+			const used = await this.usageOf(app.ref, where);
+			const old = await wrap((await store(STORES$1.appStorage, "readonly")).get([
+				app.ref,
+				where,
+				name
+			]));
+			if (!old) return;
+			await wrap((await store(STORES$1.appStorage, "readwrite")).delete([
+				app.ref,
+				where,
+				name
+			]));
+			this.usage.set(`${app.ref}\0${where}`, used - old.size);
+		});
+	}
+	async storageKeys({ ref, scope }) {
+		const app = await this.runningOrFail(ref);
+		return (await wrap((await store(STORES$1.appStorage, "readonly")).getAllKeys(rowsOf(app.ref, this.scopeOf(scope))))).map((k) => k[2]);
+	}
+	/** An app's storage in every scope, as export files (WISP 1200 § Where installed apps live), offered before an uninstall. */
+	async exportData({ ref }) {
+		const app = await this.installedOrFail(ref);
+		const rows = await wrap((await store(STORES$1.appStorage, "readonly")).getAll(rowsOf(app.ref)));
+		const scopes = /* @__PURE__ */ new Map();
+		for (const row of rows) {
+			const out = scopes.get(row.scope) ?? {
+				ghostlyAppData: 1,
+				app: app.ref,
+				scope: row.scope,
+				entries: {}
+			};
+			out.entries[row.key] = JSON.parse(row.value);
+			scopes.set(row.scope, out);
+		}
+		return [...scopes.values()];
+	}
+};
+//#endregion
 //#region ../browser/src/devices/state.ts
 /** WISP 06 § States of a device. */
 var DEVICE_STATES = [
@@ -17561,7 +18718,7 @@ async function room() {
 async function handoffSelf(profileHost) {
 	return {
 		app: profileHost.app.replace(/[^0-9A-Za-z.+_-]/g, "").slice(0, 40) || "0",
-		db: 13,
+		db: 14,
 		pins: { ...WALLET_SDK_PINS },
 		kind: profileHost.kind,
 		room: await room(),
@@ -20447,6 +21604,9 @@ var db = {
 		await fileStore.deleteForLink(linkId);
 		await removeFileBytes(`${linkId}-in-`);
 		await removeFileBytes(`${linkId}-out-`);
+		const appStorage = await store(STORES$1.appStorage, "readwrite");
+		const appKeys = await wrap(appStorage.index(APP_STORAGE_CHAT_INDEX).getAllKeys(linkId));
+		await Promise.all(appKeys.map((key) => wrap(appStorage.delete(key))));
 	},
 	async getMessages(linkId) {
 		return (await wrap((await store(STORES$1.messages, "readonly")).index("byLink").getAll(linkId))).sort((a, b) => a.timestamp - b.timestamp);
@@ -20477,14 +21637,17 @@ var db = {
 		}
 	},
 	/**
-	* Every message of this profile that carries a task or a routine card, from every chat and group, oldest first (time,
+	* Every message of this profile that carries a task, a routine or a usage card, from every chat and group, oldest first (time,
 	* then id). Reads the card index only (`CARD_INDEX`): no chat's history is read, however long. The index follows the
 	* rows, so an edit's card, a deleted message and a deleted chat or group are in step with no bookkeeping.
 	*/
 	async getCardMessages() {
 		const index = (await store(STORES$1.messages, "readonly")).index(CARD_INDEX);
-		const [tasks, routines] = await Promise.all([wrap(index.getAll("task")), wrap(index.getAll("routine"))]);
-		return [...tasks, ...routines].sort((a, b) => a.timestamp - b.timestamp || (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+		return (await Promise.all([
+			"task",
+			"routine",
+			"usage"
+		].map((kind) => wrap(index.getAll(kind))))).flat().sort((a, b) => a.timestamp - b.timestamp || (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
 	},
 	/** Returns false when the message was already stored. */
 	async addMessage(message) {
@@ -20854,22 +22017,6 @@ async function myPin(host, chat, messageId, remove, current, now = Date.now()) {
 	};
 }
 //#endregion
-//#region ../browser/src/engine/joinTrace.ts
-/**
-* Timestamps along a join through a group's link, for measuring where the time goes. Silent unless
-* the page sets `globalThis.__ghostlyJoinTrace` (the e2e measurement does): each step is then one
-* `console.debug` line, `[ghostly:join] {"t":…,"g":…,"step":…}`, read back by the test.
-*/
-function traceJoin(group, step, detail) {
-	if (!globalThis.__ghostlyJoinTrace) return;
-	console.debug(`[ghostly:join] ${JSON.stringify({
-		t: Date.now(),
-		g: group,
-		step,
-		...detail
-	})}`);
-}
-//#endregion
 //#region ../browser/src/engine/hubClocks.ts
 /**
 * A hub dates its beacon entry by its own clock, and a reader judges it by its own. A hub's time closer than this to
@@ -21038,6 +22185,14 @@ var HUB_GRACE_MS = 18e4;
 var CUT_OFF_STEP_UP_MS = 15e3;
 /** A lobby request this recent is from a member still looking fast for my side of the edge: mine opens expecting it. */
 var LOBBY_EXPECT_MS = 3e4;
+/**
+* A lobby is one record every member asking a hub writes, each reading it and writing it back with its own request: two
+* members writing at once (both cut off by the same leave, in the same second) each write what they read, and the later
+* write drops the earlier request. So a member reads the lobby back this long after its write (plus up to `LOBBY_CHECK_JITTER_MS`, so
+* the members who wrote together do not read and write together again) and asks again at once if its request is gone.
+*/
+var LOBBY_CHECK_MS = 2e3;
+var LOBBY_CHECK_JITTER_MS = 3e3;
 var REFUSED_FOR_MS$1 = 6e5;
 var ENTRY_LINGER_MS$1 = 2e4;
 var RELAYED_KEPT = 4096;
@@ -21096,6 +22251,8 @@ var Communities = class {
 	knockAt = /* @__PURE__ */ new Map();
 	/** Joiners: how many others had a knock still being refreshed in the record I last read (they wait with me). */
 	knockingWith = /* @__PURE__ */ new Map();
+	/** Joiners: the knock record a knock read whose write the relays refused, and when it was read (`knock`). */
+	knockRead = /* @__PURE__ */ new Map();
 	/** My frames an edge took, and which of them carry an edit (`frame id → editKey`). */
 	frames = new FramesTaken();
 	carriers = /* @__PURE__ */ new Map();
@@ -21123,12 +22280,28 @@ var Communities = class {
 	now() {
 		return this.time || Date.now();
 	}
+	/** Files and voice messages (WISP 503), the desk `Groups` keeps for every group. */
+	files;
 	has(groupId) {
 		return this.stored.has(groupId);
 	}
+	ids() {
+		return [...this.stored.keys()];
+	}
 	session(groupId) {
 		return this.live.get(groupId)?.session;
 	}
+	/** Me in a community I am a member of, for its files: who is in it, and who could read one of its messages. */
+	fileMembership(groupId) {
+		const session = this.live.get(groupId)?.session;
+		if (!session?.isMember) return void 0;
+		return {
+			me: session.myKey,
+			community: true,
+			inRoster: (key) => rosterHas(session.roster, key),
+			couldRead: (key, messageId) => session.couldRead(key, messageId)
+		};
+	}
 	/** Is this device a hub of the group? (tests and the load harness) */
 	isHub(groupId) {
 		const live = this.live.get(groupId);
@@ -21281,6 +22454,7 @@ var Communities = class {
 		this.knocked.delete(link.g);
 		this.knockAt.delete(link.g);
 		this.knockingWith.delete(link.g);
+		this.knockRead.delete(link.g);
 		const before = this.stored.get(link.g)?.joining;
 		const linkId = await this.host.openEntry(link, "guest", seedB64, link.host);
 		if (before && before.linkId !== linkId) await this.host.closeEdge(before.linkId);
@@ -21314,11 +22488,12 @@ var Communities = class {
 		this.knocked.delete(group.id);
 		this.knockAt.delete(group.id);
 		this.knockingWith.delete(group.id);
+		this.knockRead.delete(group.id);
 		await this.host.closeEdge(joining.linkId);
 		await this.store.putGroup(group);
 		this.host.emit();
 	}
-	async send(groupId, text, mentions = [], reply, forwarded, card) {
+	async send(groupId, text, mentions = [], reply, forwarded, card, file) {
 		const live = this.live.get(groupId);
 		if (!live) return {
 			error: "You are not in this group yet",
@@ -21329,7 +22504,7 @@ var Communities = class {
 			refused: true
 		};
 		const now = this.now();
-		const result = card ? await live.session.sendText(text, this.host.myNick?.(), now, mentions, reply, forwarded, card) : await live.session.sendText(text, this.host.myNick?.(), now, mentions, reply, forwarded);
+		const result = card || file ? await live.session.sendText(text, this.host.myNick?.(), now, mentions, reply, forwarded, card, file) : await live.session.sendText(text, this.host.myNick?.(), now, mentions, reply, forwarded);
 		return "error" in result ? { error: result.error } : {
 			error: null,
 			messageId: result.id
@@ -21454,6 +22629,7 @@ var Communities = class {
 		this.lastPeerMessageAt.delete(groupId);
 		this.lastMentionAt.delete(groupId);
 		this.knockingWith.delete(groupId);
+		this.knockRead.delete(groupId);
 		for (const linkId of [...this.host.edges(groupId).values(), ...this.host.entries(groupId).values()]) await this.host.closeEdge(linkId);
 		await this.store.deleteGroup(groupId);
 		this.host.historyGone?.(groupId);
@@ -21472,7 +22648,7 @@ var Communities = class {
 			if (group.joining && (this.knocking(group, live) || group.joining.check)) {
 				const waited = now - group.joining.since, every = waited > this.timings.patienceMs ? this.timings.slowKnockMs : this.timings.knockMs;
 				if (!this.knocking(group, live) && waited > CHECK_MS) await this.endCheck(group);
-				else if (!this.host.linkReady(group.joining.linkId, 2) && !this.host.linkSeen?.(group.joining.linkId) && now - (this.lastKnock.get(group.id) ?? 0) >= every) await this.knock(group, now).catch(() => {});
+				else if (!this.host.linkReady(group.joining.linkId, 2) && !this.host.linkSeen?.(group.joining.linkId) && now - (this.lastKnock.get(group.id) ?? 0) >= (this.knocked.has(group.id) ? every : Math.min(every, 3e3))) await this.knock(group, now).catch(() => {});
 				if (!live) continue;
 			}
 			if (!live) continue;
@@ -21648,7 +22824,15 @@ var Communities = class {
 			live.forceHub = !kept.length && others.length < COMMUNITY_TOPOLOGY.maxHubs;
 			for (const hub of kept) {
 				const id = edges.get(hub);
-				if (id && this.host.linkReady(id, 2)) continue;
+				if (id && this.host.linkReady(id, 2)) {
+					live.lobbyChecks?.delete(hub);
+					continue;
+				}
+				const check = live.lobbyChecks?.get(hub);
+				if (check && now >= check.at) {
+					live.lobbyChecks.delete(hub);
+					if (await this.lobbyLost(groupId, live, hub, check.ts)) live.lobbyWrites.delete(hub);
+				}
 				if (now - (live.lobbyWrites.get(hub) ?? 0) >= this.timings.lobbyWriteMs) {
 					live.lobbyWrites.set(hub, now);
 					await this.askHub(groupId, live, hub, now).catch(() => {
@@ -21921,8 +23105,26 @@ var Communities = class {
 			key: live.session.myKey,
 			ts: theirs
 		}, theirs)), true, true);
+		(live.lobbyChecks ??= /* @__PURE__ */ new Map()).set(hub, {
+			at: now + LOBBY_CHECK_MS + Math.floor(this.random() * LOBBY_CHECK_JITTER_MS),
+			ts: Math.floor(theirs / 1e3) * 1e3
+		});
 		traceJoin(groupId, "lobby.written");
 	}
+	/**
+	* My request is not in the hub's lobby any more, and the lobby has room for it: another member's write, made from a
+	* reading from before mine, dropped it (`LOBBY_CHECK_MS`). A full lobby that pushed it out is left as it is: asking
+	* again there would push out someone else. A read that fails says nothing, and the usual refresh asks again.
+	*/
+	async lobbyLost(groupId, live, hub, ts) {
+		const keys = lobbyKeys(live.session.state.rv, groupId, hub);
+		const records = await this.host.resolve(keys.identity.pubKeyZ32, true, true).catch(() => void 0);
+		if (records === void 0) return false;
+		const entries = readLobby(keys, records ?? []);
+		const lost = !entries.some((e) => e.key === live.session.myKey && e.ts >= ts) && entries.length < COMMUNITY_TOPOLOGY.lobbyEntries;
+		if (lost) traceJoin(groupId, "lobby.lost");
+		return lost;
+	}
 	async pollLobby(groupId, live, now) {
 		const keys = lobbyKeys(live.session.state.rv, groupId, live.session.myKey);
 		const entries = readLobby(keys, await this.host.resolve(keys.identity.pubKeyZ32, true, true).catch(() => null) ?? []);
@@ -22047,10 +23249,19 @@ var Communities = class {
 		}
 		const records = this.knockRecordsToRead(live, door === s.myKey, busy, now);
 		if (!records.length) return;
+		let failed = 0;
 		const read = await Promise.all(records.map(async (n) => {
 			const record = knockRecord(link, n);
-			return readKnocks(record, await this.host.resolve(knockIdentity(record).pubKeyZ32, true, door === s.myKey && n === KNOCK_BELL).catch(() => null) ?? []);
+			return readKnocks(record, await this.host.resolve(knockIdentity(record).pubKeyZ32, true, door === s.myKey && n === KNOCK_BELL).catch(() => {
+				failed++;
+				return null;
+			}) ?? []);
 		}));
+		traceJoin(groupId, "knock.read", {
+			records: records.length,
+			knocks: read.flat().length,
+			...failed ? { failed } : {}
+		});
 		const bell = records.indexOf(KNOCK_BELL);
 		if (bell >= 0 && read[bell].filter((k) => now - k.ts < 18e4).length >= BELL_FULL) live.crowdUntil = now + CROWD_MS;
 		const newest = /* @__PURE__ */ new Map();
@@ -22109,10 +23320,16 @@ var Communities = class {
 	* Leaves (or refreshes) my knock: in the bell while it has room, in my own record once a crowd has
 	* filled it. The first one goes out at once; refreshes are background requests, and keep my side of
 	* the entry session looking fast while I still expect a member to answer soon.
+	*
+	* "The first" is the first of this run that the relays took (`knocked`), not the first tried: a knock the relays'
+	* budget refused is tried again as one, every `UNKNOCKED_RETRY_MS`. Taken for a refresh, it went as a background
+	* request, every `knockMs`, and background requests are held to a few a minute while a link of this app signals: its
+	* own entry session, looking fast for the door's answer. A CLI that was the door of another community, its budget
+	* spent, never knocked at all (groupCompat, with the budget scaled down to 12 requests a minute).
 	*/
 	async knock(group, now = this.now()) {
 		const joining = group.joining;
-		const first = !this.lastKnock.has(group.id);
+		const first = !this.knocked.has(group.id);
 		this.lastKnock.set(group.id, now);
 		if (first || now - joining.since < this.timings.patienceMs) this.host.expectPeer?.(joining.linkId);
 		const me = identityFromSeedB64(joining.seedB64).pubKeyZ32, link = {
@@ -22127,16 +23344,37 @@ var Communities = class {
 				knocks: readKnocks(record, await this.host.resolve(knockIdentity(record).pubKeyZ32, !first) ?? [])
 			};
 		};
-		let n = this.knockAt.get(group.id) ?? KNOCK_BELL, { record, knocks } = await read(n);
-		if (n === KNOCK_BELL && !knocks.some((k) => k.key === me) && knocks.filter((k) => k.key !== me && now - k.ts < 18e4).length >= BELL_FULL) ({record, knocks} = await read(n = ownKnockRecord(me)));
-		await this.host.publish(knockIdentity(record), knockRecords(record, mergeKnocks(knocks, {
-			key: me,
-			ts: now
-		}, now)), !first);
+		const kept = this.knockRead.get(group.id);
+		this.knockRead.delete(group.id);
+		const reuse = kept && now - kept.at < this.timings.knockMs ? kept : void 0;
+		let n, record, knocks;
+		if (reuse) {
+			n = reuse.n;
+			knocks = reuse.knocks;
+			record = knockRecord(link, n);
+		} else {
+			n = this.knockAt.get(group.id) ?? KNOCK_BELL;
+			({record, knocks} = await read(n));
+			if (n === KNOCK_BELL && !knocks.some((k) => k.key === me) && knocks.filter((k) => k.key !== me && now - k.ts < 18e4).length >= BELL_FULL) ({record, knocks} = await read(n = ownKnockRecord(me)));
+		}
+		try {
+			await this.host.publish(knockIdentity(record), knockRecords(record, mergeKnocks(knocks, {
+				key: me,
+				ts: now
+			}, now)), !first);
+		} catch (error) {
+			this.knockRead.set(group.id, {
+				n,
+				knocks,
+				at: reuse?.at ?? now
+			});
+			throw error;
+		}
 		this.knockAt.set(group.id, n);
 		traceJoin(group.id, "knock.published", {
 			ms: Date.now() - started,
-			record: n
+			record: n,
+			...reuse && { kept: true }
 		});
 		const others = knocks.filter((k) => k.key !== me && now - k.ts < 2 * this.timings.slowKnockMs).length;
 		const moved = (this.knockingWith.get(group.id) ?? 0) !== others;
@@ -22273,6 +23511,7 @@ var Communities = class {
 				this.knocked.delete(g);
 				this.knockAt.delete(g);
 				this.knockingWith.delete(g);
+				this.knockRead.delete(g);
 				await this.host.closeEdge(linkId);
 				await this.reconcile(g, live, now);
 				this.host.emit();
@@ -22369,9 +23608,7 @@ var Communities = class {
 				await this.store.putGroup(group);
 			},
 			broadcast: (frame) => this.hearers(id, frame).filter(([, linkId]) => this.sendTo(linkId, frame)).length,
-			direct: (to, frame) => {
-				if (this.mayHear(this.live.get(id), to, frame)) this.sendTo(this.host.edges(id).get(to), frame);
-			},
+			direct: (to, frame) => this.mayHear(this.live.get(id), to, frame) ? this.sendTo(this.host.edges(id).get(to), frame) : void 0,
 			addressed: (to, frame) => {
 				const edges = this.host.edges(id), live = this.live.get(id);
 				const direct = edges.get(to);
@@ -22386,10 +23623,15 @@ var Communities = class {
 			message: async (m) => {
 				const timestamp = m.timestamp;
 				const mentioned = m.sender !== session.myKey && mentionsMember(m.mentions, session.myKey);
+				const file = m.file && this.files ? await this.files.announced(id, {
+					id: m.id,
+					sender: m.sender,
+					file: m.file
+				}, session.myKey) : void 0;
 				const stored = await this.host.storeMessage({
 					linkId: MESSAGE_LINK$1(id),
 					id: m.id,
-					text: m.text,
+					text: file ? groupFileText(m.text, m.file) : m.text,
 					sender: m.sender === session.myKey ? "me" : "peer",
 					member: m.sender,
 					timestamp,
@@ -22397,7 +23639,8 @@ var Communities = class {
 					...mentionFields(m.mentions, mentioned),
 					...m.reply && { replyTo: groupReply(m.reply, session.myKey) },
 					...m.forwarded && { forwarded: m.forwarded },
-					...m.card && { card: m.card }
+					...m.card && { card: m.card },
+					...file && { file }
 				});
 				const came = m.sender === session.myKey ? timestamp : cameAt(timestamp, stored, arrivalNow(this.now()));
 				this.lastMessageAt.set(id, Math.max(this.lastMessageAt.get(id) ?? 0, came));
@@ -22405,7 +23648,7 @@ var Communities = class {
 				if (m.sender !== session.myKey) this.lastPeerMessageAt.set(id, Math.max(this.lastPeerMessageAt.get(id) ?? 0, came));
 				noteCame(this.stored.get(id), came, m.sender !== session.myKey, mentioned);
 			},
-			app: (m) => this.deliver(id, () => this.host.communityApp?.(id, m.sender, m.frame)),
+			app: (m) => this.deliver(id, () => m.frame.t === "group-have" ? this.files?.communityApp(id, m.sender, m.frame) : this.host.communityApp?.(id, m.sender, m.frame)),
 			pair: (m) => this.deliver(id, () => this.host.communityPair?.(id, m.sender, m.payload)),
 			changed: () => {
 				this.membershipChanged(id);
@@ -22424,7 +23667,11 @@ var Communities = class {
 			adminTurn: () => this.host.adminTurn?.(id) ?? Promise.resolve(true),
 			relay: (frame) => {
 				if (this.live.get(id)?.hub) for (const [, linkId] of this.hearers(id, frame)) this.sendTo(linkId, frame);
-			}
+			},
+			...this.host.linkHandled && { handled: (to) => {
+				const edge = this.host.edges(id).get(to);
+				return edge && this.host.linkHandled ? this.host.linkHandled(edge) : Promise.resolve(false);
+			} }
 		});
 		this.live.set(id, {
 			session,
@@ -23611,6 +24858,8 @@ var Groups = class {
 	typings;
 	/** Edge signaling through members (WISP 902 · Group Mesh § Signaling through members). */
 	signals;
+	/** Files and voice messages in every group, private or community (WISP 503 · Group Files). */
+	files;
 	constructor(host, store = db, timings = ENTRY_TIMINGS, communityTimings = COMMUNITY_TIMINGS, random, hubTimings = MESH_HUB_TIMINGS) {
 		this.host = host;
 		this.store = store;
@@ -23628,6 +24877,27 @@ var Groups = class {
 			stored: (id) => this.stored.get(id),
 			now: () => this.now()
 		});
+		const files = host.groupFiles;
+		if (files) {
+			this.files = new GroupFileDesk({
+				...files,
+				send: (linkId, frame) => {
+					try {
+						host.sendOnLink(linkId, frame);
+						return true;
+					} catch {
+						return false;
+					}
+				},
+				edges: (groupId) => host.edges(groupId),
+				ready: (linkId) => host.linkReady(linkId, 6),
+				membership: (groupId) => this.fileMembership(groupId),
+				sendApp: (groupId, frame) => this.communities.sendApp(groupId, frame),
+				changed: () => host.emit(),
+				now: () => this.now()
+			});
+			this.communities.files = this.files;
+		}
 	}
 	async load() {
 		const all = await this.store.getGroups();
@@ -23645,6 +24915,7 @@ var Groups = class {
 			if (mentionAt) this.lastMentionAt.set(group.id, mentionAt);
 		}
 		for (const id of this.sessions.keys()) this.reconcileEdges(id);
+		await this.files?.load(all.map((g) => g.id));
 		for (const group of this.stored.values()) for (const [, linkId] of this.host.entries(group.id)) if (!group.invitation?.entry || group.invitation.linkId !== linkId) await this.host.closeEdge(linkId);
 	}
 	/** A group's pin now (WISP 400 § Pinned message), the latest one taken, unpinned or not. */
@@ -23889,6 +25160,58 @@ var Groups = class {
 		};
 	}
 	/**
+	* Announces a file or voice message of mine (WISP 503): `text` is its caption, or the line older apps show
+	* (`groupFileFallback`), `file` its description with the digest of the bytes kept under `fileId`, which this device
+	* then holds and serves. `messageId` is the announcement's.
+	*/
+	async sendFile(groupId, text, file, fileId, reply, forwarded) {
+		if (!this.files) return {
+			error: "This app takes no group files",
+			refused: true
+		};
+		const paced = this.files.mayAnnounce(groupId);
+		if (paced) return { error: paced };
+		this.files.outgoing(groupId, fileId, file);
+		let result;
+		if (this.isCommunity(groupId)) result = await this.communities.send(groupId, text, [], reply, forwarded, void 0, file);
+		else {
+			const session = this.sessions.get(groupId);
+			const sent = session ? await session.sendText(text, Date.now(), [], reply, forwarded, void 0, file) : { error: "You are not in this group yet" };
+			if (session) this.typings.say(session, false);
+			result = "error" in sent ? { error: sent.error } : {
+				error: null,
+				messageId: sent.id
+			};
+		}
+		if (result.error) this.files.notSent(groupId, file);
+		return result;
+	}
+	/** The person asks for a group file this device did not fetch by itself, or asks again for one that stopped coming. */
+	downloadFile(fileId) {
+		if (!groupOfFile(fileId, [...this.stored.keys(), ...this.communities.ids()]) || !this.files) throw new Error("No such file");
+		return this.files.download(fileId);
+	}
+	/** An edge's files/3 session opened or closed (WISP 503: the bytes of a group's files go over it). */
+	fileSession(groupId, peerKey, linkId, open) {
+		this.files?.session(groupId, peerKey, linkId, open);
+	}
+	/** A files/3 frame on an edge, from the member it is pinned to. */
+	filesFrame(groupId, peerKey, linkId, frame) {
+		return this.files?.filesFrame(groupId, peerKey, linkId, frame) ?? Promise.resolve();
+	}
+	/** Me in a group I am active in, for its files: who is in it, and who could read one of its messages. */
+	fileMembership(groupId) {
+		if (this.isCommunity(groupId)) return this.communities.fileMembership(groupId);
+		const session = this.sessions.get(groupId);
+		if (session?.status !== "active") return void 0;
+		return {
+			me: session.myKey,
+			community: false,
+			inRoster: (key) => rosterHas(session.roster, key),
+			couldRead: (key, messageId) => session.couldRead(key, messageId)
+		};
+	}
+	/**
 	* This side is typing in a private group (with what it is doing), or stopped (WISP 902 · Group Mesh § Typing).
 	* Nothing for a community: it does not carry typing yet.
 	*/
@@ -24129,7 +25452,11 @@ var Groups = class {
 		await this.session(groupId).rename(name);
 	}
 	async forget(groupId) {
-		if (this.isCommunity(groupId)) return this.communities.forget(groupId);
+		if (this.isCommunity(groupId)) {
+			await this.communities.forget(groupId);
+			await this.files?.drop(groupId);
+			return;
+		}
 		if (this.sessions.get(groupId)?.status === "active") try {
 			await this.leave(groupId);
 		} catch {}
@@ -24156,6 +25483,7 @@ var Groups = class {
 		this.signals.forget(groupId);
 		for (const linkId of [...this.host.edges(groupId).values(), ...this.host.entries(groupId).values()]) await this.host.closeEdge(linkId);
 		await this.store.deleteGroup(groupId);
+		await this.files?.drop(groupId);
 		this.host.historyGone?.(groupId);
 		this.host.membersChanged?.(groupId);
 		this.host.emit();
@@ -24281,6 +25609,7 @@ var Groups = class {
 			this.meshTick(now);
 			await this.communities.tick(now);
 			await this.hubsTick(now);
+			this.files?.tick();
 		} finally {
 			this.ticking = false;
 		}
@@ -24654,6 +25983,12 @@ var Groups = class {
 	}
 	/** A `group-*` frame on an edge: from the member the edge is pinned to. */
 	async handleEdgeFrame(groupId, peerKey, frame) {
+		const t = frame && typeof frame === "object" ? frame.t : void 0;
+		if (t === "group-want" || t === "group-want-no" || t === "group-have") {
+			const linkId = this.host.edges(groupId).get(peerKey);
+			if (linkId && !this.stored.get(groupId)?.left) await this.files?.frame(groupId, peerKey, linkId, frame);
+			return;
+		}
 		if (this.isCommunity(groupId)) return this.communities.handleEdgeFrame(groupId, peerKey, frame);
 		if (this.stored.get(groupId)?.left) {
 			if (this.removesMe(groupId, peerKey, frame)) await this.leaveConfirmed(groupId);
@@ -24682,7 +26017,6 @@ var Groups = class {
 			return;
 		}
 		if (!session) return;
-		const t = frame && typeof frame === "object" ? frame.t : void 0;
 		if (t === "group-react" || t === "group-reacted") {
 			await this.reaction(groupId, session, peerKey, frame);
 			return;
@@ -24743,6 +26077,7 @@ var Groups = class {
 	edgeReady(groupId, peerKey, linkId) {
 		if (this.isCommunity(groupId)) {
 			this.communities.edgeReady(groupId, peerKey, linkId);
+			this.files?.edgeReady(groupId, peerKey, linkId);
 			return;
 		}
 		const left = this.stored.get(groupId)?.left;
@@ -24782,6 +26117,7 @@ var Groups = class {
 		this.welcomed.get(groupId)?.delete(peerKey);
 		this.announceHere(groupId, session, peerKey);
 		this.signals.edgeReady(groupId, session, peerKey, linkId);
+		this.files?.edgeReady(groupId, peerKey, linkId);
 		this.host.edgeUp?.(groupId, peerKey);
 		this.host.emit();
 	}
@@ -24983,10 +26319,15 @@ var Groups = class {
 			message: async (m) => {
 				const timestamp = m.timestamp;
 				const mentioned = m.sender !== session.myKey && mentionsMember(m.mentions, session.myKey);
+				const file = m.file && this.files ? await this.files.announced(state.id, {
+					id: m.id,
+					sender: m.sender,
+					file: m.file
+				}, session.myKey) : void 0;
 				const message = {
 					linkId: MESSAGE_LINK(state.id),
 					id: m.id,
-					text: m.text,
+					text: file ? groupFileText(m.text, m.file) : m.text,
 					sender: m.sender === session.myKey ? "me" : "peer",
 					member: m.sender,
 					timestamp,
@@ -24994,7 +26335,8 @@ var Groups = class {
 					...mentionFields(m.mentions, mentioned),
 					...m.reply && { replyTo: groupReply(m.reply, session.myKey) },
 					...m.forwarded && { forwarded: m.forwarded },
-					...m.card && { card: m.card }
+					...m.card && { card: m.card },
+					...file && { file }
 				};
 				const stored = m.completes && this.host.completeMessage ? (await this.host.completeMessage(message), false) : await this.host.storeMessage(message);
 				const came = m.sender === session.myKey ? timestamp : cameAt(timestamp, stored, arrivalNow(this.now()));
@@ -25011,7 +26353,11 @@ var Groups = class {
 			},
 			metaChanged: (by, change, at) => {
 				this.metaChanged(state.id, session, by, change, at);
-			}
+			},
+			...this.host.linkHandled && { handled: (to) => {
+				const edge = this.host.edges(state.id).get(to);
+				return edge && this.host.linkHandled ? this.host.linkHandled(edge) : Promise.resolve(false);
+			} }
 		});
 		this.sessions.set(state.id, session);
 		this.lastRoster.set(state.id, session.roster);
@@ -25123,16 +26469,34 @@ function edgeView(live, now = Date.now(), noSlot = false) {
 		noSlot: true,
 		lastSeenAt: Math.max(presenceSeenAt(live.presence), live.lastSyncAt)
 	};
-	const error = open ? void 0 : live.pairing?.status === "error" ? live.pairing.error : live.discoveryError;
+	const pairingError = live.pairing?.status === "error" ? live.pairing.error : void 0;
+	const error = open ? void 0 : pairingError ?? live.discoveryError;
 	const state = open ? "open" : error ? "error" : live.dataLink !== "idle" ? "connecting" : "waiting";
 	return {
 		linkId: live.stored.id,
 		state,
 		...open && live.pairing?.transport ? { transport: live.pairing.transport } : {},
 		lastSeenAt: open ? now : Math.max(presenceSeenAt(live.presence), live.lastSyncAt),
-		...error ? { error } : {}
+		...error ? {
+			error,
+			cause: pairingError ? edgeErrorCause(pairingError) : "relays"
+		} : {}
 	};
 }
+/**
+* A pairing error the session ends with when nothing is wrong with the member: an attempt dialled again. Their
+* English is `PairedSession`'s and `GhostLink`'s (packages/core).
+*/
+var SESSION_DROPS = [
+	/^Session receive queue full$/,
+	/^The peer did not finish authentication\b/,
+	/^Invalid session negotiation$/
+];
+/** What an edge's pairing error comes down to: the relays (its signal could not go out), a session dropped, or else. */
+function edgeErrorCause(error) {
+	if (error.startsWith("Could not publish connection details:") || /^Could not (publish|read) discovery:/.test(error)) return "relays";
+	return SESSION_DROPS.some((drop) => drop.test(error)) ? "session" : "other";
+}
 //#endregion
 //#region ../browser/src/engine/groupPayments.ts
 /**
@@ -32194,203 +33558,6 @@ var WalletSetup = class {
 	}
 };
 //#endregion
-//#region ../browser/src/platform/irohWeb.ts
-/**
-* Iroh (WISP 102) in a browser: the same QUIC/TLS session and binding as the
-* Desktop's native Iroh, but relay only. A page cannot send UDP, so every
-* packet goes through an Iroh relay over a WebSocket; the relay sees who talks
-* to whom and when, never the frames.
-*
-* The wasm (about 1 MB gzip) loads on the first chat that starts an endpoint,
-* never on the app's first load.
-*/
-/**
-* n0's public relays, the same ones the Desktop's Iroh homes on by default. Iroh itself names them with the trailing
-* dot of a full domain name (`use1-1.relay.n0.iroh.link.`), and compares relay URLs as text; here they have none,
-* because WebKit opens no host name that ends in a dot. `BROWSER_SPELLING` is what keeps the two one relay.
-*/
-var DEFAULT_IROH_RELAYS = [
-	"https://use1-1.relay.n0.iroh.link/",
-	"https://euc1-1.relay.n0.iroh.link/",
-	"https://aps1-1.relay.n0.iroh.link/",
-	"https://usw1-1.relay.n0.iroh.link/"
-];
-/**
-* The spelling of every relay URL handed to the wasm Iroh (`irohRelayUrl`): the relays it homes on and a contact's
-* relay before a dial. One spelling, so a contact on this endpoint's relay is reached over the connection already
-* open to it; without the dot, so Safari can open it (a Desktop's record names its relay with the dot).
-*/
-var BROWSER_SPELLING = "plain";
-/**
-* Why a relay URL cannot be used, or null. TLS, except on this machine (a local `iroh-relay --dev`): a page
-* may not open plain WebSockets elsewhere, and the relay's operator would see traffic metadata in the clear.
-*/
-function irohRelayProblem(value) {
-	let url;
-	try {
-		url = new URL(value);
-	} catch {
-		return `Not a relay address: ${value}`;
-	}
-	const local = [
-		"localhost",
-		"127.0.0.1",
-		"[::1]"
-	].includes(url.hostname);
-	if (url.protocol !== "https:" && !(url.protocol === "http:" && local)) return `Use an https:// relay address: ${value}`;
-	if (url.username || url.password || url.search || url.hash || value.length > 256) return `Not a relay address: ${value}`;
-	return null;
-}
-var loaded = null;
-/** Loads the wasm once per page. Tests pass their own `load` (Node reads the file). */
-function loadIrohWasm() {
-	loaded ??= import("./ghostly_iroh_web-Dvzh3Y6E.js").then(async (module) => {
-		await module.default();
-		return module;
-	}).catch((error) => {
-		loaded = null;
-		throw error;
-	});
-	return loaded;
-}
-var SEND_BUDGET = 122880;
-var MAX_FRAME = 61440;
-/** One paired channel over one QUIC stream. Sends are queued in order. */
-var IrohWebChannel = class {
-	conn;
-	forget;
-	reader = null;
-	buffered = [];
-	queue = Promise.resolve();
-	closed = false;
-	bufferedAmount = 0;
-	sendBudget = SEND_BUDGET;
-	onClose = null;
-	constructor(conn, forget) {
-		this.conn = conn;
-		this.forget = forget;
-		this.read();
-	}
-	get onMessage() {
-		return this.reader;
-	}
-	set onMessage(reader) {
-		this.reader = reader;
-		if (reader) for (const text of this.buffered.splice(0)) reader(text);
-	}
-	async read() {
-		try {
-			for (;;) {
-				const text = await this.conn.recv();
-				if (text === void 0 || this.closed) break;
-				if (this.reader) this.reader(text);
-				else if (this.buffered.length < 64) this.buffered.push(text);
-				else break;
-			}
-		} catch {}
-		this.close();
-	}
-	send(data) {
-		if (typeof data !== "string" || this.closed || !data.length || data.length > MAX_FRAME || this.bufferedAmount + data.length > SEND_BUDGET) throw new Error("Iroh channel is closed or its send budget is full");
-		this.bufferedAmount += data.length;
-		this.queue = this.queue.then(() => this.closed ? void 0 : this.conn.send(data)).catch(() => this.close()).finally(() => {
-			this.bufferedAmount -= data.length;
-		});
-	}
-	drained() {
-		return this.queue;
-	}
-	get rttMs() {
-		const rtt = this.conn.rtt();
-		return rtt >= 0 ? rtt : void 0;
-	}
-	close() {
-		if (this.closed) return;
-		this.closed = true;
-		this.buffered = [];
-		try {
-			this.conn.close();
-		} catch {}
-		this.forget();
-		this.onClose?.();
-	}
-};
-/** A NativeEndpoint for `iroh/1`, as the Desktop's is, for one chat's transport seed. */
-async function createIrohWebEndpoint(seedB64, options = {}) {
-	const seed = fromBase64Url(seedB64);
-	if (seed.length !== 32) throw new Error("Invalid transport seed");
-	const relays = [...new Set((options.relays?.length ? options.relays : DEFAULT_IROH_RELAYS).map((relay) => irohRelayUrl(relay, BROWSER_SPELLING)))];
-	const node = await (await (options.load ?? loadIrohWasm)()).IrohNode.start(seed, relays, options.onlineMs ?? 1e4);
-	const channels = /* @__PURE__ */ new Set();
-	let stopped = false;
-	let handler = null;
-	const early = [];
-	const bind = (conn) => {
-		const channel = new IrohWebChannel(conn, () => channels.delete(channel));
-		channels.add(channel);
-		return {
-			channel,
-			binding: conn.binding()
-		};
-	};
-	const endpoint = {
-		transport: "iroh/1",
-		descriptor: {
-			...node.address(),
-			relayed: true
-		},
-		onDescriptor: null,
-		get onConnection() {
-			return handler;
-		},
-		set onConnection(value) {
-			handler = value;
-			if (value) for (const bound of early.splice(0)) value(bound);
-		},
-		async connect(descriptor) {
-			if (stopped) throw new Error("Iroh endpoint is stopped");
-			const conn = await node.connect(irohDescriptor(descriptor, BROWSER_SPELLING), options.connectMs ?? 2e4);
-			if (stopped) {
-				conn.close();
-				throw new Error("Iroh endpoint is stopped");
-			}
-			return bind(conn);
-		},
-		async close() {
-			if (stopped) return;
-			stopped = true;
-			for (const channel of [...channels]) channel.close();
-			for (const bound of early.splice(0)) bound.channel.close();
-			await node.close().catch(() => {});
-		}
-	};
-	(async () => {
-		while (!stopped) {
-			let conn;
-			try {
-				conn = await node.accept();
-			} catch {
-				break;
-			}
-			if (!conn) break;
-			if (stopped) {
-				conn.close();
-				break;
-			}
-			const bound = bind(conn);
-			const accept = endpoint.onConnection;
-			if (accept) accept(bound);
-			else if (early.length < 4) early.push(bound);
-			else bound.channel.close();
-		}
-		if (!stopped) {
-			endpoint.onUnavailable?.();
-			await endpoint.close();
-		}
-	})();
-	return endpoint;
-}
-//#endregion
 //#region ../browser/src/engine/node.ts
 /** How long a chat waits before listening again after its HyperDHT relay went away. */
 var RELAY_RETRY_MS = 3e4;
@@ -32420,6 +33587,12 @@ var DEFAULT_SETTINGS = {
 	mints: [],
 	mintsInitialized: false
 };
+/**
+* A card that went on the DHT floor or into a hold goes again live (`restoreCards`) only for the newest this many
+* messages of a chat, sent within this long: an old chat's cards are not worth a burst of edits.
+*/
+var CARD_RESTORE_MOST = 50;
+var CARD_RESTORE_MS = 6048e5;
 /** A reaction said on the live session and not confirmed is said again after this long. */
 var REACTION_RESEND_MS = 3e4;
 function emptyLinkFiles() {
@@ -33386,6 +34559,7 @@ var GhostlyNode = class GhostlyNode {
 			live.link.sendGroupFrame(frame);
 		},
 		linkReady: (linkId, version = 1) => !!this.links.get(linkId)?.link?.supportsGroupVersion(version),
+		linkHandled: (linkId) => this.links.get(linkId)?.link?.handled() ?? Promise.resolve(false),
 		linkOpen: (linkId) => !!this.links.get(linkId)?.link?.isDataLinkOpen,
 		myNick: () => this.sharedNick,
 		seqFloor: () => this.counterFloor,
@@ -33461,7 +34635,17 @@ var GhostlyNode = class GhostlyNode {
 			this.groupEdits.resend(groupId, peer).catch(() => {});
 			this.sendGroupPinFrame(groupId, peer);
 		},
-		communityPair: (groupId, sender, payload) => this.communityPay.receivePair(groupId, sender, payload)
+		communityPair: (groupId, sender, payload) => this.communityPay.receivePair(groupId, sender, payload),
+		groupFiles: {
+			store: storedGroupFiles,
+			transfers: this.transfers,
+			settings: () => ({
+				autoDownloads: this.settings.autoDownloads !== false,
+				serveFiles: this.settings.serveFiles !== false
+			}),
+			sendFiles: (linkId, frame) => this.links.get(linkId)?.link?.sendFilesFrame(frame) ?? false,
+			writable: (linkId) => this.links.get(linkId)?.link?.filesWritable()
+		}
 	});
 	/**
 	* Payments in community groups (WISP 903 · Group Community § Payments): the desk pays and requests over a link
@@ -33873,6 +35057,7 @@ var GhostlyNode = class GhostlyNode {
 			this.prepareSpare(STARTUP_QUIET_MS);
 		}
 		if (!this.limitedMode) this.openStartedWallets(fresh);
+		if (this.appsOn) this.appStore.start().catch(() => {});
 		if (!this.options.singleDevice && this.networkOn && knownDeviceGate()?.state === "active") this.startDeviceSet().catch(() => {});
 		if (!this.options.singleDevice && this.limitedMode && knownDeviceGate()?.state === "active") this.readTurnWhileLimited();
 		if (this.restoreCheck === "checking" && this.limitedMode) this.checkRestoredTurn(0);
@@ -34257,6 +35442,7 @@ var GhostlyNode = class GhostlyNode {
 			clearTimeout(this.limitedTimer);
 			this.limitedTimer = null;
 		}
+		this.appShelf?.stop();
 		if (!quiet) this.depart();
 		this.directPath.close();
 		this.clock.close();
@@ -34329,6 +35515,83 @@ var GhostlyNode = class GhostlyNode {
 		await this.shutdown();
 		await clearProfileStores();
 	}
+	appShelf;
+	/** The installed apps and stores, refused while the apps feature is off. */
+	get appStore() {
+		if (!this.appsOn) throw new Error("Apps are unavailable in this release");
+		return this.appShelf ??= new Apps({
+			fetch: boundedAppFetch({
+				fetcher: this.options.appFetch,
+				online: () => this.networkOn
+			}),
+			isChat: (scope) => {
+				const stored = this.links.get(scope)?.stored;
+				return !!stored && !stored.group && !!stored.profile && !!stored.pairedPeerKey;
+			},
+			online: () => this.networkOn && !this.shuttingDown,
+			checked: () => this.events.onAppsChecked?.()
+		});
+	}
+	appList() {
+		return this.appStore.list();
+	}
+	appStoreList() {
+		return this.appStore.listStores();
+	}
+	appStorePreview(params) {
+		return this.appStore.previewStore(params);
+	}
+	appStoreAdd(params) {
+		return this.appStore.addStore(params);
+	}
+	appStoreRemove(params) {
+		return this.appStore.removeStore(params);
+	}
+	appStoreRefresh(params = {}) {
+		return this.appStore.refreshStores(params);
+	}
+	appPreview(params) {
+		return this.appStore.preview(params);
+	}
+	appInstall(params) {
+		return this.appStore.install(params);
+	}
+	appUpdateAccept(params) {
+		return this.appStore.acceptUpdate(params);
+	}
+	appCheckUpdates() {
+		return this.appStore.checkUpdates();
+	}
+	appUninstall(params) {
+		return this.appStore.uninstall(params);
+	}
+	appRunCheck(params) {
+		return this.appStore.runCheck(params);
+	}
+	appFetchFiles(params) {
+		return this.appStore.fetchFiles(params);
+	}
+	appEntry(params) {
+		return this.appStore.entry(params);
+	}
+	appFile(params) {
+		return this.appStore.file(params);
+	}
+	appStorageGet(params) {
+		return this.appStore.storageGet(params);
+	}
+	appStorageSet(params) {
+		return this.appStore.storageSet(params);
+	}
+	appStorageDelete(params) {
+		return this.appStore.storageDelete(params);
+	}
+	appStorageKeys(params) {
+		return this.appStore.storageKeys(params);
+	}
+	appDataExport(params) {
+		return this.appStore.exportData(params);
+	}
 	getState() {
 		const groups = this.groups.views();
 		return {
@@ -34431,7 +35694,7 @@ var GhostlyNode = class GhostlyNode {
 	async statusCardIndex() {
 		const rows = [];
 		for (const m of await db.getCardMessages()) {
-			if (m.card?.kind !== "task" && m.card?.kind !== "routine") continue;
+			if (m.card?.kind !== "task" && m.card?.kind !== "routine" && m.card?.kind !== "usage") continue;
 			rows.push({
 				linkId: m.linkId,
 				id: m.id,
@@ -35348,7 +36611,7 @@ var GhostlyNode = class GhostlyNode {
 				delivery: "sending",
 				...preview && { preview },
 				...answers,
-				...card?.kind === "buttons" && { buttonsRestore: "due" }
+				...card && { cardRestore: "due" }
 			});
 			this.hold.hold(linkId, {
 				kind: "text",
@@ -35560,34 +36823,49 @@ var GhostlyNode = class GhostlyNode {
 		return !!live?.caps?.peer?.capabilities.includes(EDIT_CAPABILITY);
 	}
 	/**
-	* A question of mine with buttons went on the DHT floor or into a hold, which carry its text alone (WISP 406 · Message
-	* Buttons): its buttons are due to go again live. Once: a row that had them restored already stays so.
+	* A card of mine went on the DHT floor or into a hold, which carry its text alone (WISP 405 · Status Cards, WISP 406 ·
+	* Message Buttons): the card is due to go again live. Once: a row that had it restored already stays so.
 	*/
-	async buttonsWentBare(linkId, message) {
-		if (message.card?.kind !== "buttons" || message.buttonsRestore) return;
-		await db.patchMessage(linkId, message.id, (current) => current.sender === "me" && current.card?.kind === "buttons" && !current.buttonsRestore ? { buttonsRestore: "due" } : null);
+	async cardWentBare(linkId, message) {
+		if (!message.card || message.cardRestore || message.buttonsRestore) return;
+		await db.patchMessage(linkId, message.id, (current) => current.sender === "me" && current.card && !current.cardRestore && !current.buttonsRestore ? { cardRestore: "due" } : null);
+	}
+	/** The session capability a contact's app lists when it shows a card of this kind, so a restore edit reads as a card there. */
+	static cardCapability(card) {
+		return card.kind === "buttons" ? BUTTONS_CAPABILITY : card.kind === "app" ? APPS_CAPABILITY : STATUS_CARD_CAPABILITY;
 	}
 	/**
-	* Buttons the contact may not have (WISP 406 · Message Buttons): a question whose text went on the DHT floor or into a
-	* hold reached the contact as text alone, and a copy under the same id that comes live later is taken as the one
-	* already there. Once the chat is live with an app that shows buttons (`buttons/1`) and takes edits, each such
-	* question goes again as an edit of its buttons alone: the same text, so no version and no edit mark. Once per
-	* message (the row says so, across restarts); the edit queue carries it (a card's edit goes only live, and a later
-	* edit of the bot's replaces it, the highest number winning). An app without `buttons/1` (1.0.0 would mark it edited)
-	* gets none: the row waits for one that shows buttons. The edit is marked `restore`: the bot's own event stream says
-	* nothing of it, while its number counts, so a later edit of the bot's takes the next one.
+	* Cards the contact may not have (WISP 405 · Status Cards, WISP 406 · Message Buttons): a message whose text went on
+	* the DHT floor or into a hold reached the contact as text alone, and a copy under the same id that comes live later
+	* is taken as the one already there. An app card or a finished task gets no later update to carry its card. So once
+	* the chat is live with an app that shows the kind (`buttons/1`, `status-card/1`, `apps/1`) and takes edits, each such
+	* message goes again as an edit of its card alone: the same text, so no version and no edit mark. Once per message (the
+	* row says so, across restarts); the edit queue carries it (a card's edit goes only live, and a later edit of the
+	* author's replaces it, the highest number winning). A contact whose app does not show the kind (it would drop the card
+	* and mark the text edited) gets none: the row waits for one that does. Bounded: the newest `CARD_RESTORE_MOST` such
+	* messages of the last `CARD_RESTORE_MS`; older ones are given up. The edit is marked `restore`: the bot's own event
+	* stream says nothing of it, while its number counts, so a later edit of the bot's takes the next one.
 	*/
-	async restoreButtons(linkId) {
+	async restoreCards(linkId) {
 		const live = this.links.get(linkId), link = live?.link;
-		if (!live?.stored.profile || live.stored.group || !link?.supportsEdits || !link.sessionOffers.peer?.includes("buttons/1")) return;
-		const due = (await db.getMessages(linkId)).filter((m) => m.sender === "me" && m.buttonsRestore === "due");
+		const offers = link?.sessionOffers.peer;
+		if (!live?.stored.profile || live.stored.group || !link?.supportsEdits || !offers) return;
+		const due = (await db.getMessages(linkId)).filter((m) => m.sender === "me" && (m.cardRestore ?? m.buttonsRestore) === "due").sort((a, b) => b.timestamp - a.timestamp);
+		const since = Date.now() - CARD_RESTORE_MS;
 		const changed = [];
-		for (const message of due) {
+		for (const [index, message] of due.entries()) {
+			const stale = index >= CARD_RESTORE_MOST || message.timestamp < since;
+			if (!stale && message.card && !offers.includes(GhostlyNode.cardCapability(message.card))) continue;
 			const at = Date.now();
 			if ((await db.patchMessage(linkId, message.id, (current) => {
-				if (current.sender !== "me" || current.buttonsRestore !== "due") return null;
+				if (current.sender !== "me" || (current.cardRestore ?? current.buttonsRestore) !== "due") return null;
+				const done = {
+					cardRestore: "sent",
+					buttonsRestore: void 0
+				};
 				const seq = (current.edit?.seq ?? 0) + 1;
-				if (current.card?.kind !== "buttons" || !current.wireId || seq > STATUS_CARD_LIMITS.edits) return { buttonsRestore: "sent" };
+				if (stale || !current.card || !current.wireId || seq > STATUS_CARD_LIMITS.edits) return done;
+				if (current.edit?.pending) return done;
 				return {
 					edit: {
 						...withEdit(current, {
@@ -35600,7 +36878,7 @@ var GhostlyNode = class GhostlyNode {
 						}).edit,
 						restore: true
 					},
-					buttonsRestore: "sent"
+					...done
 				};
 			}))?.edit?.pending) changed.push(message.id);
 		}
@@ -35706,7 +36984,7 @@ var GhostlyNode = class GhostlyNode {
 				const reply = GhostlyNode.wireReply(message);
 				const error = message.card ? await link.sendMessage(message.text, message.timestamp, message.wireId, message.preview, reply, message.forwarded, message.card) : message.forwarded ? await link.sendMessage(message.text, message.timestamp, message.wireId, message.preview, reply, message.forwarded) : reply ? await link.sendMessage(message.text, message.timestamp, message.wireId, message.preview, reply) : await link.sendMessage(message.text, message.timestamp, message.wireId, ...message.preview ? [message.preview] : []);
 				await this.noteTextSend(linkId, message, snapshot, at, error, link);
-				if (!error && message.via === "pkarr") await this.buttonsWentBare(linkId, message);
+				if (!error && message.via === "pkarr") await this.cardWentBare(linkId, message);
 				return error;
 			}, (message) => message.via === "pkarr" ? DHT_MESSAGE_TTL : 2e4, (message) => {
 				const pending = this.links.get(linkId)?.stored.dhtDeliveryState?.pending;
@@ -35731,7 +37009,7 @@ var GhostlyNode = class GhostlyNode {
 						via: "hold",
 						resendUntil: void 0
 					});
-					await this.buttonsWentBare(linkId, message);
+					await this.cardWentBare(linkId, message);
 					await this.messagesChanged(linkId, [message.id]);
 					this.hold.hold(linkId, {
 						kind: "text",
@@ -36164,6 +37442,11 @@ var GhostlyNode = class GhostlyNode {
 		return offered;
 	}
 	fileAction({ linkId, fileId, action }) {
+		if (typeof linkId === "string" && linkId.startsWith("group:")) {
+			if (action !== "accept" && action !== "request") throw new Error("A group's file is downloaded (accept) or asked for again (request)");
+			if (!fileId.startsWith(`group-${linkId.slice(6)}-`)) throw new Error("No such file in this group");
+			return this.groups.downloadFile(fileId);
+		}
 		const live = this.links.get(linkId);
 		if (!live) throw new Error("No such chat");
 		if (![
@@ -36772,6 +38055,58 @@ var GhostlyNode = class GhostlyNode {
 		if (!sent.error) this.wakeMentioned(groupId, text, named);
 		return sent;
 	}
+	/**
+	* Announces a file or voice message in a group (WISP 503 · Group Files): its bytes are in the files store under
+	* `file.id` (`group-<group>-out-…`), put there by the caller as a chat's file is (`sendFile`). The message carries its
+	* description and the SHA-256 of those bytes; its text is `caption`, or the line apps from before show. This device
+	* is its first holder: members fetch it from here, then from each other.
+	*/
+	async sendGroupFile({ groupId, file, caption, replyTo, forwarded: hops }) {
+		if (typeof groupId !== "string" || !file || typeof file.id !== "string" || !file.id.startsWith(`group-${groupId}-out-`)) return {
+			error: "Invalid file id",
+			refused: true
+		};
+		if (file.size > GROUP_FILE_LIMITS.maxBytes) return {
+			error: `A group takes files of up to ${formatFileSize(GROUP_FILE_LIMITS.maxBytes)}`,
+			refused: true
+		};
+		const stored = await fileStore.get(file.id);
+		if (!stored?.metadata || stored.linkId !== `group:${groupId}` || stored.direction !== "out") return {
+			error: "The file is gone",
+			refused: true
+		};
+		if (storedSize(stored) !== file.size) return {
+			error: "The file is not all here",
+			refused: true
+		};
+		const digest = stored.digest ?? (stored.blob ? await blobDigest(stored.blob) : await (await fileBytesOf(stored.bytes)).digest(file.id));
+		if (!stored.digest) await fileStore.patch(file.id, { digest });
+		const meta = readGroupFileMeta({
+			name: file.name,
+			mime: file.mime,
+			size: file.size,
+			d: digest,
+			...file.voice && { voice: file.voice },
+			...file.video && { video: file.video },
+			...file.image && { image: file.image }
+		});
+		if (!meta) return {
+			error: "That file cannot go to a group",
+			refused: true
+		};
+		if (file.voice && !meta.voice) return {
+			error: "That recording cannot be sent as a voice message",
+			refused: true
+		};
+		const reply = replyTo === void 0 ? void 0 : await this.replyFor(`group:${groupId}`, replyTo);
+		if (typeof reply === "string") return { error: reply };
+		const text = typeof caption === "string" && caption.trim() ? caption : groupFileFallback(meta);
+		return this.groups.sendFile(groupId, text, meta, file.id, reply && {
+			i: reply.id,
+			s: reply.snippet,
+			f: reply.member
+		}, readForwarded(hops));
+	}
 	groupMessages({ groupId }) {
 		return this.groups.messages(groupId);
 	}
@@ -36886,7 +38221,30 @@ var GhostlyNode = class GhostlyNode {
 						continue;
 					}
 					if (groupId) {
-						note("Groups take no files yet");
+						const original = message.file, file = {
+							id: groupFileId(groupId, "out"),
+							name: original.name,
+							size: original.size,
+							mime: original.mime,
+							...original.voice && { voice: original.voice },
+							...original.video && { video: original.video },
+							...original.image && { image: original.image }
+						};
+						await copyForForward(original.id, {
+							linkId: to,
+							wireId: file.id.slice(`group-${groupId}-out-`.length),
+							timestamp: now(),
+							file
+						});
+						const sent = await this.sendGroupFile({
+							groupId,
+							file,
+							forwarded: hops
+						});
+						if (sent.error) {
+							await removeStored(file.id).catch(() => {});
+							note(sent.error);
+						} else if (sent.messageId) result.messageIds.push(sent.messageId);
 						continue;
 					}
 					if (!live.link) {
@@ -37113,6 +38471,58 @@ var GhostlyNode = class GhostlyNode {
 		this.flushPin(linkId);
 		return { error: null };
 	}
+	/** Mini-apps are on in this build (`APPS_ENABLED`) or for this engine (`apps`). */
+	get appsOn() {
+		return this.options.apps ?? false;
+	}
+	/** A paired 1:1 chat and the chat app id of `ref` in it, from the two pinned participation keys (WISP 1200 § In a chat). */
+	appChat(linkId, ref) {
+		if (!this.appsOn) throw new Error("Apps are unavailable in this release");
+		const live = typeof linkId === "string" ? this.links.get(linkId) : void 0;
+		if (!live || live.stored.group || !live.stored.profile) throw new Error("No such chat");
+		if (!isAppRef(ref)) throw new Error("Not an app reference");
+		const { participationSeed, pairedPeerKey } = live.stored;
+		if (!participationSeed || !pairedPeerKey) throw new Error("This chat is not paired yet");
+		return {
+			live,
+			app: chatAppId(identityFromSeedB64(participationSeed).publicKey, publicKeyFromZ32(pairedPeerKey), ref)
+		};
+	}
+	/** The chat app id of an app in a paired chat: how the contact's frames name it. */
+	appId({ linkId, ref }) {
+		return { app: this.appChat(linkId, ref).app };
+	}
+	/**
+	* This side opened an app in a paired chat, or updated it: `open` goes to the contact now when the session is live,
+	* and again on every session that comes back while it stays open.
+	*/
+	async appOpen({ linkId, ref, version }) {
+		const { live, app } = this.appChat(linkId, ref);
+		if (!isAppVersion(version)) throw new Error("Not an app version");
+		await this.appStore.chatRunnable({ ref });
+		const open = live.appsOpen ??= /* @__PURE__ */ new Map();
+		if (live.link) live.link.openApp(app, version);
+		else open.set(app, version);
+		return { app };
+	}
+	/** This side closed an app in a paired chat: `close` goes now when the session is live. */
+	appClose({ linkId, ref }) {
+		const { live, app } = this.appChat(linkId, ref);
+		if (live.link) live.link.closeApp(app);
+		else live.appsOpen?.delete(app);
+	}
+	/** One data frame of an app open on both sides, on the live session only; nothing is kept to send later. */
+	async appSend({ linkId, ref, data }) {
+		const { live, app } = this.appChat(linkId, ref);
+		if (!live.appsOpen?.has(app)) return { error: "not-open" };
+		await this.appStore.chatRunnable({ ref });
+		return { error: live.link ? live.link.sendAppData(app, data) : "offline" };
+	}
+	/** Every page went away: no app runs here any more, so each open one is closed (`close` goes where it can). */
+	appsCloseAll() {
+		for (const live of this.links.values()) for (const app of [...live.appsOpen?.keys() ?? []]) if (live.link) live.link.closeApp(app);
+		else live.appsOpen?.delete(app);
+	}
 	/** Keeps a pin of a 1:1 chat when it is newer than the chat's; `out`: mine, to say until the contact confirms it. */
 	async keepLinkPin(linkId, pin, out) {
 		const live = this.links.get(linkId);
@@ -38268,7 +39678,7 @@ var GhostlyNode = class GhostlyNode {
 			...settings
 		};
 		if (!this.settings.irohRelays?.length) delete this.settings.irohRelays;
-		if (irohRelaysChanged) this.rehomeIroh();
+		if (irohRelaysChanged && !this.options.irohRelays?.length) this.rehomeIroh();
 		if (settings.relays) {
 			this.relays?.setRelays(settings.relays);
 			if (this.relays) this.settings.relays = this.relays.describe().relays;
@@ -38296,6 +39706,12 @@ var GhostlyNode = class GhostlyNode {
 				this.groups.stopTyping();
 			}
 		}
+		for (const key of ["autoDownloads", "serveFiles"]) {
+			if (settings[key] === void 0) continue;
+			if (settings[key] !== false) delete this.settings[key];
+			else this.settings[key] = false;
+			await db.putSettings(this.settings);
+		}
 		if (settings.publicProfiles !== void 0) {
 			if (settings.publicProfiles !== false) delete this.settings.publicProfiles;
 			else this.settings.publicProfiles = false;
@@ -39303,6 +40719,7 @@ var GhostlyNode = class GhostlyNode {
 			arkPaymentsSupport: !entry,
 			usdtPaymentsSupport: !entry,
 			barkPaymentsSupport: !entry,
+			largeFilesSupport: !entry,
 			params: stored,
 			rtcAvailable: typeof RTCPeerConnection !== "undefined" && !this.edgeRtcOff.has(linkId),
 			resume: !entry && stored.edgeLive ? resumeOn : void 0,
@@ -39379,7 +40796,9 @@ var GhostlyNode = class GhostlyNode {
 					onPaymentAsk: (ask) => member() ? this.desk.onPaymentAsk(linkId, ask) : void 0,
 					onPayment: (payment) => member() ? this.desk.onPayment(linkId, payment) : void 0,
 					onPaymentResult: (result) => member() ? this.desk.onPaymentResult(linkId, result) : void 0,
-					onPeerNick: (nick) => this.groups.edgeNick(group, peer, nick ?? void 0)
+					onPeerNick: (nick) => this.groups.edgeNick(group, peer, nick ?? void 0),
+					onFilesFrame: (frame) => member() ? this.groups.filesFrame(group, peer, linkId, frame) : void 0,
+					onFilesSession: (open) => this.groups.fileSession(group, peer, linkId, open)
 				},
 				onPresence: (presence) => {
 					if (presence.online && !seen) {
@@ -39491,6 +40910,8 @@ var GhostlyNode = class GhostlyNode {
 			wakeSupport: true,
 			upgradeSupport: true,
 			peerUpgrades: () => !!live.caps?.peer?.capabilities.includes(UPGRADE_CAPABILITY),
+			appsSupport: this.appsOn,
+			appsOpen: this.appsOn ? live.appsOpen ??= /* @__PURE__ */ new Map() : void 0,
 			servicesSupport: this.options.servicesSupport ?? (this.options.platform ?? "web") !== "web",
 			dht: stored.profile ? {
 				state: stored.dhtDeliveryState,
@@ -39679,7 +41100,7 @@ var GhostlyNode = class GhostlyNode {
 				onMessageEdit: stored.profile && !stored.group ? (edit) => this.receiveEdit(linkId, edit) : void 0,
 				onEditReceipt: stored.profile && !stored.group ? (id, e) => this.editsFor(linkId).received(id, e) : void 0,
 				onEditSupport: (supported) => {
-					if (supported && stored.profile && !stored.group) this.restoreButtons(linkId).catch(() => {}).then(() => this.editsFor(linkId).flush()).catch(() => {});
+					if (supported && stored.profile && !stored.group) this.restoreCards(linkId).catch(() => {}).then(() => this.editsFor(linkId).flush()).catch(() => {});
 				},
 				onWakeSupport: (supported) => {
 					if (supported && stored.profile && !stored.group) this.shareWake(linkId);
@@ -39796,6 +41217,7 @@ var GhostlyNode = class GhostlyNode {
 				onPinSupport: (supported) => {
 					if (supported) this.flushPin(linkId);
 				},
+				onAppFrame: this.appsOn ? (event) => this.events.onAppFrame?.(linkId, event) : void 0,
 				onPaymentRequest: (request) => this.desk.onPaymentRequest(linkId, request),
 				onPaymentAsk: (ask) => this.desk.onPaymentAsk(linkId, ask),
 				onPayment: (payment) => this.desk.onPayment(linkId, payment),
@@ -39946,7 +41368,7 @@ var GhostlyNode = class GhostlyNode {
 	get nativeFactories() {
 		const relay = this.relaysHyperdht ? this.hyperdhtRelay : "";
 		return {
-			...relay ? { "hyperdht/1": async (seedB64) => (await import("./hyperdhtRelay-BoxPHp7v.js")).createRelayedHyperEndpoint(seedB64, relay) } : {},
+			...relay ? { "hyperdht/1": async (seedB64) => (await import("./hyperdhtRelay-CnEkFl8R.js")).createRelayedHyperEndpoint(seedB64, relay) } : {},
 			...this.options.nativeTransports,
 			...this.ownIrohRelays ? { "iroh/1": (seedB64) => this.options.nativeTransports["iroh/1"](seedB64, this.settings.irohRelays?.length ? { relays: [...this.settings.irohRelays] } : {}) } : {},
 			...this.options.irohWeb ? { "iroh/1": (seedB64) => createIrohWebEndpoint(seedB64, { relays: this.irohRelays }) } : {}
@@ -39957,6 +41379,7 @@ var GhostlyNode = class GhostlyNode {
 		return !!this.options.nativeIrohRelays && !!this.options.nativeTransports?.["iroh/1"];
 	}
 	get irohRelays() {
+		if (this.options.irohRelays?.length) return [...this.options.irohRelays];
 		return this.settings.irohRelays?.length ? this.settings.irohRelays : [...DEFAULT_IROH_RELAYS];
 	}
 	/** New Iroh relays: idle endpoints move now; one carrying a chat keeps its relay until that session ends. */
@@ -40213,12 +41636,16 @@ var GhostlyNode = class GhostlyNode {
 			...whole.replyTo && { replyTo: whole.replyTo },
 			...whole.forwarded && { forwarded: whole.forwarded },
 			...whole.card && { card: whole.card },
-			...whole.press && { press: whole.press }
+			...whole.press && { press: whole.press },
+			...whole.file && {
+				file: whole.file,
+				text: whole.text
+			}
 		};
 		if (!Object.keys(added).length) return;
 		if (!await db.patchMessage(message.linkId, message.id, (stored) => {
 			if (stored.member !== message.member || stored.sender !== message.sender) return null;
-			const { card: _card, ...rest } = added;
+			const { card: _card, text: _text, ...rest } = added;
 			return stored.edit ? rest : added;
 		})) return;
 		await this.messagesChanged(message.linkId, [message.id]);
@@ -40524,6 +41951,12 @@ var EngineServer = class {
 					signal
 				});
 			},
+			onAppFrame: (linkId, event) => this.broadcast({
+				kind: "app-frame",
+				linkId,
+				event
+			}),
+			onAppsChecked: () => this.broadcast({ kind: "apps-checked" }),
 			onDeviceGate: (gate) => this.broadcast({
 				kind: "device-gate",
 				gate
@@ -40571,7 +42004,10 @@ var EngineServer = class {
 	detach(client) {
 		this.clients.delete(client);
 		this.histories.delete(client);
-		if (this.clients.size === 0) this.node.setActiveLink({ linkId: null });
+		if (this.clients.size === 0) {
+			this.node.setActiveLink({ linkId: null });
+			this.node.appsCloseAll();
+		}
 		if (this.onCall.delete(client)) this.node.setCallOn({ on: this.onCall.size > 0 });
 	}
 	async handle(client, request) {
@@ -40679,4 +42115,4 @@ function signalKind(signal) {
 //#endregion
 export { EngineServer, hyperdhtRelayProblem as n, server_exports as t };
 
-//# sourceMappingURL=server-CXFTDnFI.js.map
+//# sourceMappingURL=server-HMzdsyn_.js.map