@ghostlytools/cli 1.1.6 → 1.2.0

package/dist/assets/{src-DtxVo2Rm.js → src-BMUcYQ7b.js}

@@ -38,11 +38,38 @@ function bytesEqual(a, b) {
 	for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];
 	return diff === 0;
 }
+/** `Uint8Array.prototype.toBase64` (Node 25+, Chrome 140+, Firefox 133+, Safari 18.2+): ~200x the JS below. */
+var nativeToBase64 = Uint8Array.prototype.toBase64;
+var tableOf = (chars) => Uint8Array.from(chars, (c) => c.charCodeAt(0));
+var BASE64_TABLE = tableOf("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/");
+var BASE64URL_TABLE = tableOf("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_");
+/**
+* Base64 where the runtime has no native encoder (Node 22 and 24, older WebViews): the characters go into bytes and
+* become one string at the end. Every file chunk is encoded (files/3 `pf-data`), so this is on a transfer's path.
+*/
+function encodeBase64(bytes, table, pad) {
+	const out = new Uint8Array(Math.ceil(bytes.length / 3) * 4);
+	let o = 0, i = 0;
+	for (; i + 2 < bytes.length; i += 3) {
+		const n = bytes[i] << 16 | bytes[i + 1] << 8 | bytes[i + 2];
+		out[o++] = table[n >>> 18];
+		out[o++] = table[n >>> 12 & 63];
+		out[o++] = table[n >>> 6 & 63];
+		out[o++] = table[n & 63];
+	}
+	const rest = bytes.length - i;
+	if (rest) {
+		const n = bytes[i] << 16 | (rest === 2 ? bytes[i + 1] << 8 : 0);
+		out[o++] = table[n >>> 18];
+		out[o++] = table[n >>> 12 & 63];
+		if (rest === 2) out[o++] = table[n >>> 6 & 63];
+		else if (pad) out[o++] = 61;
+		if (pad) out[o++] = 61;
+	}
+	return textDecoder$1.decode(out.subarray(0, o));
+}
 function toBase64(bytes) {
-	let binary = "";
-	const CHUNK = 32768;
-	for (let i = 0; i < bytes.length; i += CHUNK) binary += String.fromCharCode(...bytes.subarray(i, i + CHUNK));
-	return btoa(binary);
+	return nativeToBase64 ? nativeToBase64.call(bytes) : encodeBase64(bytes, BASE64_TABLE, true);
 }
 function fromBase64(str) {
 	const binary = atob(str);
@@ -51,7 +78,10 @@ function fromBase64(str) {
 	return bytes;
 }
 function toBase64Url(bytes) {
-	return toBase64(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+	return nativeToBase64 ? nativeToBase64.call(bytes, {
+		alphabet: "base64url",
+		omitPadding: true
+	}) : encodeBase64(bytes, BASE64URL_TABLE, false);
 }
 function fromBase64Url(str) {
 	let b = str.replace(/-/g, "+").replace(/_/g, "/");
@@ -108,9 +138,13 @@ function randomBytes(length) {
 var HIDDEN = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu;
 /** Zero-width non-joiner and zero-width joiner. */
 var KEEP = /[\u200c\u200d]/;
+/** `text` without its invisible and direction-changing characters, at any length: for display text with a cut of its own. */
+function stripHidden(text) {
+	return text.replace(HIDDEN, (char) => KEEP.test(char) ? char : "");
+}
 /** Undefined when nothing visible is left, so callers can fall back. */
 function sanitizeDisplayText(text, max) {
-	return [...text.replace(HIDDEN, (char) => KEEP.test(char) ? char : "")].slice(0, max).join("").trim() || void 0;
+	return [...stripHidden(text)].slice(0, max).join("").trim() || void 0;
 }
 /** A nickname as it arrived from a peer, ready to show. */
 function sanitizeNick(nick) {
@@ -1952,9 +1986,11 @@ var isZero = (bytes) => bytes.every((b) => b === 0);
 /**
 * A device's name as its slot holds it: UTF-8, cut at a character boundary to 16 bytes, and with no NUL (the padding).
 * A character is what a person sees as one (a grapheme), so a cut never leaves half an emoji or a lone joiner.
+* A name is display text a device chooses for itself and every device of the set shows: it is cleaned as a nickname is
+* (`sanitizeDisplayText`: no control, invisible or direction-changing character) and trimmed, made and read alike.
 */
 function turnName(name) {
-	const clean = name.replace(/\0/g, "");
+	const clean = stripHidden(name).trim();
 	const Segmenter = typeof Intl === "undefined" ? void 0 : Intl.Segmenter;
 	const characters = Segmenter ? Array.from(new Segmenter(void 0, { granularity: "grapheme" }).segment(clean), (s) => s.segment) : Array.from(clean);
 	let out = "", length = 0;
@@ -1964,7 +2000,7 @@ function turnName(name) {
 		out += character;
 		length += size;
 	}
-	return out;
+	return out.trimEnd();
 }
 function u32$3(value) {
 	return Uint8Array.of(value >>> 24 & 255, value >>> 16 & 255, value >>> 8 & 255, value & 255);
@@ -2069,7 +2105,7 @@ function readTurnBody(body, address) {
 		if (slots.some((other) => other && bytesEqual(other.key, key))) refuse("slots", "one key in two slots");
 		slots.push({
 			key,
-			name: text
+			name: turnName(text)
 		});
 	}
 	if (slots.filter(Boolean).length !== count) refuse("count");
@@ -3212,13 +3248,17 @@ function encodeSetSlots(set) {
 }
 /** The bytes the remover signs: the old turn address, then the frame's fields, the tombstone by its digest. */
 function setUpdateMessage(oldAddress, update) {
+	return signedBytes(oldAddress, update, encodeSetSlots(update.set));
+}
+/** `slots`: the set as the frame carries it. A reader hands over the frame's own, a name cleaned for display is not what was signed. */
+function signedBytes(oldAddress, update, slots) {
 	if (oldAddress.length !== 32) throw new Error("A turn address is 32 bytes");
 	if (update.d.length !== 32) throw new Error("The device-set secret is 32 bytes");
 	return utf8Encode(JSON.stringify([
 		"ghostly-set-update",
 		toBase64Url(oldAddress),
 		toBase64Url(update.d),
-		encodeSetSlots(update.set),
+		slots,
 		update.turn,
 		update.rev,
 		toBase64Url(sha256(update.tomb))
@@ -3254,16 +3294,19 @@ function readSetUpdate(frame) {
 	if (!Number.isInteger(frame.turn) || frame.turn < 0 || frame.turn > TURN_MAX) return null;
 	if (!Number.isInteger(frame.rev) || frame.rev < 0 || frame.rev >= TURN_REV_LIMIT) return null;
 	const set = [];
+	const signed = [];
 	for (const slot of frame.set) {
 		if (slot === null) {
 			set.push(null);
+			signed.push(null);
 			continue;
 		}
 		if (!Array.isArray(slot) || slot.length !== 2 || typeof slot[0] !== "string" || !KEY$4.test(slot[0]) || typeof slot[1] !== "string" || slot[1].length > 64) return null;
-		if (turnName(slot[1]) !== slot[1]) return null;
+		if (utf8Encode(slot[1]).length > 16 || slot[1].includes("\0")) return null;
+		signed.push([slot[0], slot[1]]);
 		set.push({
 			key: fromBase64Url(slot[0]),
-			name: slot[1]
+			name: turnName(slot[1])
 		});
 	}
 	const keys = set.flatMap((slot) => slot ? [toBase64Url(slot.key)] : []);
@@ -3271,6 +3314,7 @@ function readSetUpdate(frame) {
 	return {
 		d: fromBase64Url(frame.d),
 		set,
+		signed,
 		turn: frame.turn,
 		rev: frame.rev,
 		tomb: fromBase64Url(frame.tomb),
@@ -3282,7 +3326,7 @@ function readSetUpdate(frame) {
 /** Whether `by` signed this update for the turn address `oldAddress`. */
 function verifySetUpdate(update, oldAddress) {
 	try {
-		return verify(update.signature, setUpdateMessage(oldAddress, update), update.by);
+		return verify(update.signature, signedBytes(oldAddress, update, update.signed ?? encodeSetSlots(update.set)), update.by);
 	} catch {
 		return false;
 	}
@@ -4438,6 +4482,13 @@ function waitForIceGathering(pc, timeoutMs = 1e4, { stallMs, fresh = false, sett
 }
 //#endregion
 //#region ../core/src/signal.ts
+/**
+* Signaling for the WebRTC data link, carried in the `_rtc` record. It follows
+* the convention `_call` established: only what is unique to the session
+* travels through Pkarr and the SDP is rebuilt locally. The DTLS fingerprint
+* arrives inside a packet that is signed by the peer's key and encrypted with
+* the link key, which is what binds the WebRTC connection to the peer identity.
+*/
 var DATA_CHANNEL_LABEL = "ghostly/1";
 /** An offer older than this is ignored. */
 var RTC_SIGNAL_MAX_AGE_MS = 12e4;
@@ -4484,17 +4535,34 @@ var CANDIDATE_TYPE_NAME = {
 	s: "srflx",
 	r: "relay"
 };
+/**
+* The signal carries two host candidates, and a computer often has more interfaces than that: Wi-Fi, Ethernet, VM
+* bridges, Tailscale, a VPN. The browser lists them in its own order, and the first two are not always ones the
+* contact can reach: on a Mac with two VM bridges they are the bridges (addresses that exist on that Mac only), and
+* the Wi-Fi and Ethernet addresses never left it, so a contact on the same network was reached only if the router
+* sends a packet for its own public address back in (2026-10-02). So host candidates go in this order of preference:
+* those a server reflexive candidate was gathered from (`raddr`: an interface with a way out, the network a contact
+* nearby shares), then the others, and in each case those the browser marks as costly last (`network-cost` 50 or
+* more: a VPN, or an interface it does not know), as a call's candidates do (`pickCallCandidates`). A host on a
+* global IPv4 address has a way out too: it gets no reflexive candidate (Chromium drops one equal to a host), and the
+* gathering wait ends on it (`isGlobalIpv4Host`). That wait ends 400 ms after the first reflexive candidate, so only
+* the interfaces whose STUN answer came by then are known to have a way out. With no reflexive candidate, or none
+* that says where it came from, the order is the browser's, as before.
+*/
+function hostRank(parts, reflexiveBases) {
+	const cost = Number(parts[parts.indexOf("network-cost") + 1]);
+	const costly = parts.includes("network-cost") && cost >= 50;
+	const wayOut = reflexiveBases.has(parts[4]) || isGlobalIpv4Host(parts.join(" "));
+	return (costly ? 2 : 0) + (wayOut ? 0 : 1);
+}
 function extractRtcParams(sdp) {
 	let u = "";
 	let p = "";
 	let f = "";
 	let s = "";
-	const candidates = [];
-	const counts = {
-		h: 0,
-		s: 0,
-		r: 0
-	};
+	/** UDP component-1 candidates of a type the signal carries, in the SDP's order. */
+	const found = [];
+	const reflexiveBases = /* @__PURE__ */ new Set();
 	for (const line of sdp.split(/\r?\n/)) if (line.startsWith("a=ice-ufrag:") && !u) u = line.slice(12);
 	else if (line.startsWith("a=ice-pwd:") && !p) p = line.slice(10);
 	else if (line.toLowerCase().startsWith("a=fingerprint:sha-256 ") && !f) f = line.slice(22).replace(/:/g, "").toLowerCase();
@@ -4503,11 +4571,33 @@ function extractRtcParams(sdp) {
 		const parts = line.slice(12).split(" ");
 		if (parts.length < 8 || parts[1] !== "1" || parts[2].toLowerCase() !== "udp") continue;
 		const type = CANDIDATE_TYPES[parts[7]];
-		if (!type || counts[type] >= CANDIDATE_LIMITS[type]) continue;
+		if (!type) continue;
 		const compact = `${type},${parts[4]},${parts[5]}`;
-		if (candidates.includes(compact)) continue;
-		counts[type]++;
-		candidates.push(compact);
+		if (found.some((c) => c.compact === compact)) continue;
+		found.push({
+			type,
+			parts,
+			compact
+		});
+		const base = type === "s" && parts.includes("raddr") ? parts[parts.indexOf("raddr") + 1] : void 0;
+		if (base && base !== "0.0.0.0" && base !== "::") reflexiveBases.add(base);
+	}
+	const hosts = found.filter((c) => c.type === "h");
+	const preferred = new Set(hosts.map((c, at) => ({
+		c,
+		at,
+		rank: hostRank(c.parts, reflexiveBases)
+	})).sort((a, b) => a.rank - b.rank || a.at - b.at).slice(0, CANDIDATE_LIMITS.h).map(({ c }) => c));
+	const candidates = [];
+	const counts = {
+		h: 0,
+		s: 0,
+		r: 0
+	};
+	for (const c of found) {
+		if (c.type === "h" ? !preferred.has(c) : counts[c.type] >= CANDIDATE_LIMITS[c.type]) continue;
+		counts[c.type]++;
+		candidates.push(c.compact);
 	}
 	return {
 		u,
@@ -4589,6 +4679,8 @@ function buildDataSdp(signal) {
 var LIMITS = {
 	/** Largest control frame accepted, headers included. */
 	maxControlFrameBytes: 61440,
+	/** Longest payment endpoint value (a Cashu token, an invoice) a payment frame may carry; a longer one is dropped. */
+	maxPaymentEndpointChars: 32768,
 	/** Largest DataChannel message sent. 16 KiB is safe across WebRTC stacks. */
 	maxChunkMessageBytes: 16384,
 	maxRequestBodyBytes: 8388608,
@@ -4642,7 +4734,7 @@ function isUnit(value) {
 	return typeof value === "string" && /^[a-z0-9]{1,12}$/.test(value);
 }
 function isEndpoint(value) {
-	return Array.isArray(value) && value.length === 2 && typeof value[0] === "string" && value[0].length <= 64 && /^[a-z0-9][a-z0-9-]*(?:\/[1-9][0-9]*)?$/.test(value[0]) && typeof value[1] === "string" && value[1].length <= 32768;
+	return Array.isArray(value) && value.length === 2 && typeof value[0] === "string" && value[0].length <= 64 && /^[a-z0-9][a-z0-9-]*(?:\/[1-9][0-9]*)?$/.test(value[0]) && typeof value[1] === "string" && value[1].length <= LIMITS.maxPaymentEndpointChars;
 }
 /** Returns null for anything malformed; callers drop the frame. */
 function decodeControl(text) {
@@ -5435,6 +5527,11 @@ var EXPECT_PEER_MS = 3e4;
 * or the session dropped): an app that restarts is back within this, and its dial or offer is seen in seconds.
 */
 var WATCH_PEER_MS = 12e4;
+/**
+* The longest a link reads fast for a data link whose connection went `disconnected` (`setDataLinkStalled`): a little
+* past the 12 s such a connection is given (`DISCONNECT_GRACE_MS`), by when it is back or the session is gone.
+*/
+var STALLED_LOOK_MS = 15e3;
 var PUBLISH_RETRY_MS = 4e3;
 /**
 * A packet the relays' request budget held back goes again when the budget frees a request, and at least this often
@@ -5471,6 +5568,9 @@ var LinkSession = class {
 	/** A group link's `_tr` value this side publishes (`setTransports`), and the last the peer's packet carried. */
 	transports = null;
 	lastTransportsIn = null;
+	/** When a read first found the peer's packet advertising with no `_tr` (0: the last packet that said carried one). */
+	transportsAbsentSince = 0;
+	transportsGone = false;
 	running = false;
 	/** Stopped without a last packet (`stop(false)`): nothing more goes out. */
 	silent = false;
@@ -5495,6 +5595,8 @@ var LinkSession = class {
 	publishRetryTimer = null;
 	active = false;
 	connected = false;
+	/** The open data link's connection is `disconnected`, and read fast until then (`setDataLinkStalled`). */
+	stalledUntil = 0;
 	firstPublish;
 	firstPublishTimer = null;
 	firstPollDone = false;
@@ -5584,6 +5686,10 @@ var LinkSession = class {
 		if (!this.running || this.lastPublishedAt > 0 || this.publishing) return;
 		this.publish().catch(() => {});
 	}
+	/** This side's packet goes out again as it is: another writer of its key (a second device on a device code) may have replaced it. */
+	republish() {
+		if (this.running) this.publish().catch(() => {});
+	}
 	/** Stops the loops. With `announce`, first tells the peer we are gone. */
 	async stop(announce = true) {
 		if (!this.running) return;
@@ -5648,8 +5754,22 @@ var LinkSession = class {
 	/** The data link carries chat and services while it is up. */
 	setDataLinkOpen(open) {
 		this.connected = open;
+		this.stalledUntil = 0;
 		if (!open) this.pollNow();
 	}
+	/**
+	* The open data link's connection went `disconnected` (true), or came back: the contact's app may have crashed, and
+	* once it starts again its offer is on Pkarr, which nothing on a dead data link says. Read fast for as long as it
+	* lasts (the connection is given up or back within seconds), not at the connected pace. One read as it went
+	* `disconnected` found only an offer already out: an app back a moment later (a tab opened again by hand) waited for
+	* the connection's grace to run out (web/restart-relink.spec.ts, 20 s on a busy machine). Never longer than
+	* `STALLED_LOOK_MS`, whatever becomes of the connection.
+	*/
+	setDataLinkStalled(stalled) {
+		if (stalled === Date.now() < this.stalledUntil) return;
+		this.stalledUntil = stalled ? Date.now() + STALLED_LOOK_MS : 0;
+		if (stalled) this.pollNow();
+	}
 	async setCallSignal(signal) {
 		this.callSignal = signal;
 		this.lastActivity = Date.now();
@@ -5773,6 +5893,7 @@ var LinkSession = class {
 	}
 	/** How urgently this link looks right now. */
 	pace() {
+		if (Date.now() < this.stalledUntil) return "fast";
 		if (this.connected) return "connected";
 		if (Date.now() < this.fastPollUntil) return "fast";
 		if (Date.now() < this.watchUntil) return "active";
@@ -5845,7 +5966,10 @@ var LinkSession = class {
 				ms,
 				rtc: !!rtcSignal,
 				error: error instanceof Error ? error.message : String(error),
-				...waiting && { waiting }
+				...waiting && {
+					waiting,
+					retryInMs: error.retryInMs
+				}
 			});
 			throw error;
 		}
@@ -5939,9 +6063,20 @@ var LinkSession = class {
 					nick: batch.nick,
 					services: online ? batch.services : null
 				};
-				if (batch.transports !== null && batch.transports !== this.lastTransportsIn) {
-					this.lastTransportsIn = batch.transports;
-					this.events.onPeerTransports?.(batch.transports);
+				if (batch.transports !== null) {
+					this.transportsAbsentSince = 0;
+					this.transportsGone = false;
+					if (batch.transports !== this.lastTransportsIn) {
+						this.lastTransportsIn = batch.transports;
+						this.events.onPeerTransports?.(batch.transports);
+					}
+				} else if (batch.services !== null && !this.transportsGone) {
+					this.transportsAbsentSince ||= Date.now();
+					if (Date.now() - this.transportsAbsentSince >= 12e4) {
+						this.transportsGone = true;
+						this.lastTransportsIn = null;
+						this.events.onPeerTransportsGone?.();
+					}
 				}
 				this.events.onPresence?.(this.presence);
 				if (read && readBefore && batch.packetTimestamp !== wasSeen) this.events.onPeerClock?.(batch.packetTimestamp, readBefore, Date.now());
@@ -6125,6 +6260,29 @@ var GATHER_STALL_MS = 3e3;
 var DISCONNECT_GRACE_MS = 12e3;
 /** An offer this close to the end of the offerer's attempt is not answered again: the new answer would come too late. */
 var REANSWER_MARGIN_MS = 15e3;
+/**
+* Traces the candidate pair an opened data link uses, by type only (host, srflx, prflx, relay; never an address): two
+* devices on one network should meet host to host. A connection without stats (a test's fake) traces nothing.
+*/
+async function tracePair(me, pc) {
+	try {
+		if (typeof pc.getStats !== "function") return;
+		const stats = await pc.getStats();
+		const byId = /* @__PURE__ */ new Map();
+		stats.forEach((s) => byId.set(s.id, s));
+		let pairId;
+		for (const s of byId.values()) if (s.type === "transport" && s.selectedCandidatePairId) pairId = s.selectedCandidatePairId;
+		const pair = pairId !== void 0 ? byId.get(pairId) : [...byId.values()].find((s) => s.type === "candidate-pair" && s.nominated && s.state === "succeeded");
+		if (!pair) return;
+		const kind = (id) => byId.get(id)?.candidateType ?? "?";
+		const rtt = typeof pair.currentRoundTripTime === "number" ? Math.round(pair.currentRoundTripTime * 1e3) : void 0;
+		traceLink(me, "rtc-pair", {
+			local: kind(pair.localCandidateId),
+			remote: kind(pair.remoteCandidateId),
+			...rtt !== void 0 && { rttMs: rtt }
+		});
+	} catch {}
+}
 var DataLink = class {
 	options;
 	state = "idle";
@@ -6224,7 +6382,7 @@ var DataLink = class {
 		if (signal.t === "o") {
 			if (this.state === "offering") {
 				if (this.options.myPubKeyZ32 < this.options.peerPubKeyZ32) return;
-			} else if (this.state === "answering") return;
+			}
 			this.lastSignalTs = signal.ts;
 			const wasOpen = this.state === "open";
 			this.teardown();
@@ -6354,7 +6512,7 @@ var DataLink = class {
 			this.options.publishSignal(JSON.stringify(signal));
 			this.setState("connecting");
 		} catch {
-			this.reset();
+			if (this.answered?.offer === offer) this.reset();
 		}
 	}
 	/**
@@ -6418,6 +6576,7 @@ var DataLink = class {
 			this.options.publishSignal(null);
 			this.options.onDirect?.("open");
 			this.options.onOpen(wrapDataChannel(dc));
+			tracePair(this.options.myPubKeyZ32, pc);
 		});
 		dc.addEventListener("close", () => {
 			if (this.pc === pc) this.failed();
@@ -7844,8 +8003,12 @@ var REACTION_LIMITS = {
 	/** Reactions a sender says per window on one chat; the newest of each message waits for room. */
 	send: 20,
 	windowMs: 1e4,
-	/** A reaction to a message not here yet waits this long for it, at most `buffer` of them per chat. */
-	bufferMs: 6e4,
+	/**
+	* A reaction to a message not here yet waits this long for it, at most `buffer` of them per sender in each chat: a
+	* member back in a busy group hears every member's latest reactions as their edges open, before the catch-up (over a
+	* minute for a full log) brings what they name.
+	*/
+	bufferMs: 3e5,
 	buffer: 64,
 	/** Reactions of this side not confirmed yet, per chat: the oldest is dropped past it. */
 	pending: 32,
@@ -8966,11 +9129,19 @@ var DhtDelivery = class DhtDelivery {
 	timer = null;
 	/** The first control envelope of a start that waits (`firstControlAfterMs`). */
 	controlTimer = null;
+	/** A new capability revision to name once the publication spacing allows (`announce`). */
+	announceTimer = null;
 	chain = Promise.resolve();
 	lastPublish = 0;
 	/** The sequence of the last envelope of the contact that was past its expiry (traced once). */
 	expiredSeen = 0;
 	controlDue = 0;
+	/**
+	* This side's envelope in the invite's mailbox is sealed with the invite key alone (published before the pin). Once the
+	* contact is pinned, one sealed to it replaces it as soon as the publication spacing allows (`resealDue`): another
+	* holder of the invite reads there that it was taken (`sealedToAnother`), instead of pinning this side on it.
+	*/
+	unsealedOut;
 	/** Until when the relays' request budget holds publications back: what is due then goes at once. */
 	budgetUntil = 0;
 	errors = {};
@@ -8995,6 +9166,7 @@ var DhtDelivery = class DhtDelivery {
 		const { peerRejected: _peerRejected, ...state } = structuredClone(options.state ?? emptyDhtDeliveryState());
 		this.state = state;
 		this.mode = options.mode;
+		this.unsealedOut = state.sequence > 0 && !options.credentials.peerKey;
 		this.from = identityFromSeedB64(options.params.seedB64).pubKeyZ32;
 		this.to = options.params.peerPubKeyZ32;
 		this.participation = identityFromSeedB64(options.credentials.seedB64);
@@ -9010,7 +9182,7 @@ var DhtDelivery = class DhtDelivery {
 			mode: this.mode,
 			peerMode: this.state.peerMode,
 			authenticated: !!this.options.credentials.peerKey,
-			error: Object.values(this.errors).join(". ") || void 0,
+			error: [this.errors.read, this.errors.publish].filter(Boolean).join(". ") || void 0,
 			pendingUntil: this.state.pending?.expires,
 			maxTextBytes: 256,
 			...this.lastPublished && { lastPublished: this.lastPublished },
@@ -9144,7 +9316,8 @@ var DhtDelivery = class DhtDelivery {
 		this.running = false;
 		if (this.timer) clearTimeout(this.timer);
 		if (this.controlTimer) clearTimeout(this.controlTimer);
-		this.timer = this.controlTimer = null;
+		if (this.announceTimer) clearTimeout(this.announceTimer);
+		this.timer = this.controlTimer = this.announceTimer = null;
 		await this.chain;
 	}
 	async setMode(mode) {
@@ -9417,6 +9590,14 @@ var DhtDelivery = class DhtDelivery {
 		await this.serialize(async () => {
 			const rev = this.options.capsRev?.();
 			if (rev === void 0 || rev === this.namedRev) return;
+			const wait = this.lastPublish + 4e3 - Date.now();
+			if (wait > 0) {
+				this.announceTimer ??= setTimeout(() => {
+					this.announceTimer = null;
+					if (!this.live) this.announce();
+				}, wait);
+				return;
+			}
 			try {
 				await this.publish(true);
 			} catch {}
@@ -9509,13 +9690,14 @@ var DhtDelivery = class DhtDelivery {
 		const pending = this.state.pending && this.state.pending.expires > now && this.state.pending.attempts < MAX_ATTEMPTS ? this.state.pending : void 0;
 		const receipt = this.state.receipt && this.state.receipt.expires > now && this.state.receipt.attempts < MAX_ATTEMPTS ? this.state.receipt : void 0;
 		const receiptDue = !!receipt && !receipt.settled && (receipt.next ?? 0) <= now;
-		if (!force && (!pending || pending.next > now) && !receiptDue && !this.reactionsDue && this.controlDue > now) return;
+		const reseal = this.resealDue;
+		if (!force && (!pending || pending.next > now) && !receiptDue && !this.reactionsDue && !reseal && this.controlDue > now) return;
 		const expires = pending?.expires ?? now - 12e4 + CONTROL_TTL;
 		const issued = Math.min(now, Math.max(now - DHT_ISSUED_BACK_MS, expires - (pending ? DHT_MESSAGE_TTL : CONTROL_TTL), (pending?.message[1] ?? 0) - 3e4));
 		const { body, records, reactions } = this.fitted(this.state.sequence + 1, issued, expires, pending?.message ?? null, receipt?.id ?? null, pending?.reply, pending?.edit, pending?.forwarded, pending?.file);
 		const reactionsWereDue = this.reactionsDue;
 		this.reactionsDue = !reactions && !!this.options.reactions?.().length;
-		const identity = this.state.peerPinned && this.state.peerPinned !== "can" && this.pinned()?.identity || this.identity;
+		const identity = !reseal && this.state.peerPinned && this.state.peerPinned !== "can" && this.pinned()?.identity || this.identity;
 		await this.persist({
 			...this.state,
 			sequence: body[1],
@@ -9550,9 +9732,14 @@ var DhtDelivery = class DhtDelivery {
 			throw error;
 		}
 		this.namedRev = body[8] ?? void 0;
+		if (identity === this.identity) this.unsealedOut = !this.options.credentials.peerKey;
 		delete this.errors.publish;
 		this.changed();
 	}
+	/** The contact is pinned and this side's envelope in the invite's mailbox is still unsealed (`unsealedOut`). */
+	get resealDue() {
+		return this.unsealedOut && !!this.options.credentials.peerKey;
+	}
 	/**
 	* The relays' request budget held the envelope back: nothing went out, so it was no attempt (a text keeps its eight),
 	* and what it carried (a text, a receipt, a new mode) goes the moment the budget frees a request: the text and the
@@ -9823,6 +10010,7 @@ var DhtDelivery = class DhtDelivery {
 				const signal = this.signalReads > 0;
 				this.urgent = false;
 				if (signal) this.signalReads--;
+				if (!this.options.credentials.peerKey && !this.options.credentials.expectedPeerKey && !this.state.sequence) await this.publishOnTick();
 				const readAt = Date.now();
 				try {
 					await this.read(background, signal);
@@ -9832,12 +10020,7 @@ var DhtDelivery = class DhtDelivery {
 					if (!isDiscoveryBudgetError(error) && readAt >= this.networkBackAt) this.errors.read = `Could not read DHT delivery: ${error instanceof Error ? error.message : String(error)}`;
 				}
 				if (this.state.peerMode !== "dht") this.signalReads = 0;
-				const publishAt = Date.now();
-				try {
-					await this.publish();
-				} catch (error) {
-					if (!isDiscoveryBudgetError(error) && publishAt >= this.networkBackAt) this.errors.publish = `Could not publish DHT delivery: ${error instanceof Error ? error.message : String(error)}`;
-				}
+				await this.publishOnTick();
 				this.changed();
 			});
 		} finally {
@@ -9850,6 +10033,14 @@ var DhtDelivery = class DhtDelivery {
 		}
 		this.schedule();
 	}
+	async publishOnTick() {
+		const publishAt = Date.now();
+		try {
+			await this.publish();
+		} catch (error) {
+			if (!isDiscoveryBudgetError(error) && publishAt >= this.networkBackAt) this.errors.publish = `Could not publish DHT delivery: ${error instanceof Error ? error.message : String(error)}`;
+		}
+	}
 	/** How long until the next read of the contact's mailbox (WISP 403, poll pace). */
 	get pollMs() {
 		if (this.options.pollMs) return this.options.pollMs;
@@ -9863,7 +10054,7 @@ var DhtDelivery = class DhtDelivery {
 		if (!this.running || this.ticking) return;
 		if (this.timer) clearTimeout(this.timer);
 		const held = this.budgetUntil - Date.now();
-		const due = this.reactionsDue ? Math.max(0, this.lastPublish + 4e3 - Date.now()) : Infinity;
+		const due = this.reactionsDue || this.resealDue && !this.errors.publish ? Math.max(0, this.lastPublish + 4e3 - Date.now(), held) : Infinity;
 		this.timer = setTimeout(() => void this.tick(), Math.min(held > 0 ? Math.min(this.pollMs, held) : this.pollMs, due));
 	}
 };
@@ -12044,7 +12235,7 @@ var CapsKeys = class {
 			capabilities,
 			extensions,
 			descriptors,
-			name,
+			name: sanitizeNick(name) ?? "",
 			...choice !== void 0 ? { choice } : {}
 		};
 	}
@@ -12053,14 +12244,17 @@ var emptyCapsState = () => ({ rev: 0 });
 var digestOf = (content) => toBase64Url(sha256(utf8Encode(JSON.stringify(content)))).slice(0, 22);
 /**
 * Publishes this side's record (at first start, at every change, hourly) and reads the contact's (at
-* pairing, when an envelope names a newer revision, when the chat drops to the DHT). Every read and
-* publish goes through one queue; reads close together are merged.
+* pairing, when an envelope names a newer revision, when the chat drops to the DHT). Publications go one
+* at a time, and reads one at a time beside them (a read never waits for a put); reads close together are merged.
 */
 var CapsExchange = class {
 	options;
 	state;
 	keys;
+	/** Publications, one at a time; reads of the contact's record (another key) have their own, so neither waits for the other. */
 	chain = Promise.resolve();
+	readChain = Promise.resolve();
+	saveChain = Promise.resolve();
 	timer = null;
 	running = false;
 	lastRead = 0;
@@ -12090,14 +12284,21 @@ var CapsExchange = class {
 	get address() {
 		return this.keys.identity.pubKeyZ32;
 	}
-	serialize(run) {
-		const next = this.chain.then(run);
-		this.chain = next.catch(() => {});
+	serialize(run, chain = "chain") {
+		const next = this[chain].then(run);
+		this[chain] = next.catch(() => {});
 		return next;
 	}
-	async persist(next) {
-		await this.options.save(structuredClone(next));
-		this.state = next;
+	/** Saves are one at a time, each over the state as it is then: a read and a publication change different fields. */
+	persist(patch) {
+		return this.serialize(async () => {
+			const next = {
+				...this.state,
+				...patch
+			};
+			await this.options.save(structuredClone(next));
+			this.state = next;
+		}, "saveChain");
 	}
 	start() {
 		if (this.running || this.ended) return;
@@ -12114,7 +12315,8 @@ var CapsExchange = class {
 		if (this.readTimer) clearTimeout(this.readTimer);
 		if (this.retryTimer) clearTimeout(this.retryTimer);
 		this.timer = this.readTimer = this.retryTimer = null;
-		await this.chain.catch(() => {});
+		await Promise.all([this.chain, this.readChain]);
+		await this.saveChain;
 	}
 	/**
 	* Publishes when the content changed, when the contact was pinned since the last publication (the
@@ -12139,7 +12341,6 @@ var CapsExchange = class {
 				const { records, dropped } = this.keys.seal(content, rev, peerKey, now);
 				this.dropped = dropped;
 				await this.persist({
-					...this.state,
 					rev,
 					digest,
 					sealedFor: peerKey,
@@ -12151,10 +12352,7 @@ var CapsExchange = class {
 					this.schedule(isDiscoveryBudgetError(error) ? budgetRetryMs(error, 1e3, 6e4) : 6e4);
 					throw error;
 				}
-				await this.persist({
-					...this.state,
-					publishedAt: now
-				});
+				await this.persist({ publishedAt: now });
 				this.lastOut = content;
 				if (changed || unpublished) this.options.published?.(rev);
 				if (dialable) {
@@ -12212,14 +12410,11 @@ var CapsExchange = class {
 				return this.state.peer;
 			}
 			if (this.state.peer && record.rev === this.state.peer.rev && record.author === this.state.peer.author) return this.state.peer;
-			await this.persist({
-				...this.state,
-				peer: record
-			});
+			await this.persist({ peer: record });
 			this.retries = 0;
 			this.options.changed?.(record);
 			return record;
-		}).finally(() => this.readAgainIfBehind());
+		}, "readChain").finally(() => this.readAgainIfBehind());
 	}
 	/**
 	* Read again in a moment, a few times at most, while the record known is short of what the contact has: of the
@@ -14420,9 +14615,14 @@ var ChatFiles = class {
 	/**
 	* Removes what this side stored of an incoming file that ends here. Through its target, opened now if need be: after
 	* a restart a transfer has none until bytes arrive again, and one cancelled before that kept its part on the disk.
+	* After the write under way, and with the ones queued behind it stopped: a write landing after the removal would
+	* store a part of the file again.
 	*/
 	discardStored(entry) {
-		return entry.in ? this.target(entry).then((t) => t.discard()).catch(() => {}) : Promise.resolve();
+		const incoming = entry.in;
+		if (!incoming) return Promise.resolve();
+		incoming.dropped = true;
+		return incoming.writing.then(() => this.target(entry)).then((t) => t.discard()).catch(() => {});
 	}
 	target(entry) {
 		const incoming = entry.in;
@@ -14736,7 +14936,7 @@ var ChatFiles = class {
 		incoming.written += bytes.length;
 		const target = incoming.target;
 		incoming.writing = incoming.writing.then(async () => {
-			if (transferEnded(record)) return;
+			if (transferEnded(record) || incoming.dropped) return;
 			await (await target).append(bytes);
 			incoming.stored = offset + bytes.length;
 			if (incoming.stored === incoming.written || incoming.stored - incoming.acked >= FILE_LIMITS.ackEveryBytes) {
@@ -14906,7 +15106,10 @@ var ChatFiles = class {
 		switch (frame.t) {
 			case "pf-accept":
 				if (!isInt$1(frame.offset, record.file.size)) return;
-				if (record.state === "paused" && record.pausedBy === "me") return;
+				if (record.state === "paused" && record.pausedBy === "me") {
+					this.send(this.offerFrame(record, true));
+					return;
+				}
 				out.generation++;
 				record.confirmed = frame.offset;
 				out.next = frame.offset;
@@ -14920,6 +15123,7 @@ var ChatFiles = class {
 				}
 				return;
 			case "pf-wait":
+				if (record.state === "paused" && record.pausedBy === "me") return;
 				out.generation++;
 				out.next = record.confirmed;
 				clearTimeout(out.timer);
@@ -14966,7 +15170,13 @@ var ChatFiles = class {
 			entry.out.block = void 0;
 			entry.out.source = void 0;
 		}
-		if (entry.in) clearTimeout(entry.in.timer);
+		if (entry.in) {
+			const incoming = entry.in;
+			clearTimeout(incoming.timer);
+			incoming.writing.finally(() => {
+				if (transferEnded(record)) incoming.target = void 0;
+			});
+		}
 		this.changed(entry);
 	}
 	entry(direction, id) {
@@ -16014,6 +16224,15 @@ var PairingTracker = class {
 		const { stage, reason } = this.progress;
 		if (stage === "publishing" || stage === "failed" && reason === "publish") this.set(this.idle());
 	}
+	/** This side's first packet waits for the relays' request budget, which frees one at `until`: said, still `publishing`. */
+	heldBack(until) {
+		if (this.progress.stage !== "publishing") return;
+		this.progress = {
+			...this.progress,
+			relayWaitUntil: until
+		};
+		this.changed(this.progress);
+	}
 	/** The contact's packet was seen: they are on the network. */
 	sawPeer() {
 		if (this.peerSeen) return;
@@ -16045,7 +16264,7 @@ var PairingTracker = class {
 				retryable: true,
 				...detail ? { detail } : {}
 			});
-			else this.set(this.idle(), { detail: detail ?? (reason === "timeout" ? "The offer was not answered in time; trying again." : "No connection came up; trying again.") });
+			else this.set(this.idle(), { detail: detail ?? reason });
 			return;
 		}
 		this.set("failed", {
@@ -16127,6 +16346,124 @@ var PairingTracker = class {
 	}
 };
 //#endregion
+//#region ../core/src/engineErrors.ts
+/**
+* The engine's known errors: a stable code each, and its English text with the values in it. The engine throws
+* `engineError(code, values)`; the text is the one it always wrote, so the CLI and every log keep printing the same.
+* The app's pages get only the text (it crosses the engine's RPC and is kept on payments and operations as a string),
+* and `parseEngineError` finds the code and the values back in it, to say it in the app's language. A text that is
+* none of these (a mint's own words, a provider's) stays as it is.
+*
+* `{name}` in a template is a value: a host or domain (no spaces), a network ("Mainnet" or "Testnet"), a chain's name,
+* an ecash unit ("usd"), or an amount (digits, with the separators of whatever locale wrote it).
+*/
+var ENGINE_ERRORS = {
+	mintUnreachable: "Could not reach {host}. Check the address: it should be a Cashu mint.",
+	lnurlUnreachable: "Could not reach {host}. It may be down, or not allow web apps to read it (CORS).",
+	hostUnreachable: "Could not reach {host}",
+	networkUnreachable: "Could not reach the network",
+	hostTimedOut: "{host} did not answer in time",
+	networkTimedOut: "The network did not answer in time",
+	testMintOnMainnet: "This is a test mint, and its sats are worth nothing: add it to a Testnet Cashu wallet",
+	realMintOnTestnet: "This mint holds real sats: add it to a Mainnet Cashu wallet",
+	mintHoldsSats: "Move your sats out of this mint before removing it",
+	lastMint: "This is the last mint of your {network} Cashu wallet: remove the wallet to remove it",
+	invalidMintUrl: "That is not a valid mint URL",
+	mintNotHttps: "Mints must use https",
+	notEnoughSats: "Not enough sats in your wallet",
+	noSharedMint: "You share no mint with this contact",
+	ecashAlreadySpent: "This ecash was already spent somewhere else",
+	ecashOtherUnit: "This ecash is in {unit}: only sat ecash can be redeemed here",
+	reviewedEcashSpent: "The ecash for this payment was already spent somewhere else. Nothing was sent, and your balance now shows what the mint still holds.",
+	reviewedSatsGone: "The sats this payment was reviewed with went to another payment. Nothing was sent: review it again.",
+	lightningFeeTooHigh: "The Lightning fee ({fee} sats) is too high",
+	invoiceExpired: "That invoice has expired",
+	lnurlExactly: "{domain} asks for exactly {amount} sats",
+	lnurlRange: "{domain} takes between {min} and {max} sats",
+	feeAboveLimit: "The fee exceeds your limit",
+	cashuFeeAboveLimit: "Cashu fee exceeds your limit",
+	invalidMaxFee: "Invalid maximum fee",
+	methodUnavailable: "This payment method is unavailable",
+	unknownPaymentIntent: "Unknown payment intent",
+	paymentExpired: "Payment request expired or has an invalid expiry",
+	requestHasPayment: "This request already has a payment. Reconcile it before trying again.",
+	requestPaymentInFlight: "This request already has a payment; reconcile it instead",
+	requestNotAwaiting: "This request is no longer awaiting payment. Check its status before spending.",
+	reconnectBeforeApprove: "Reconnect the data link before approving. Your review was saved.",
+	cannotSubmitAgain: "This payment cannot be submitted again. Reconcile its existing transaction.",
+	alreadySubmitted: "This payment was already submitted or could not be saved",
+	sentAfterReview: "A payment from this wallet was sent after this review was made. Create a new review",
+	cannotCancelSubmitted: "A submitted payment cannot be cancelled; reconcile it instead",
+	outcomeUnknown: "Outcome unknown. Check the existing payment; do not send another.",
+	notYetConfirmed: "Not yet confirmed. No second payment was sent.",
+	couldNotVerify: "Could not verify this payment yet. No second payment was sent.",
+	paymentTakenBack: "This payment was taken back. The sats are in your wallet.",
+	parkedSigned: "Needs your decision: this payment was signed before this copy of your profile took over. It is never sent again from here. Check it before you pay again.",
+	contactAway: "Your contact is offline. Nothing was sent: pay once the chat is live.",
+	realMoneyUnconfirmed: "This pays with real money: confirm it with Send real money first. Nothing was sent.",
+	mainnetPaymentOnTestnet: "This is a Mainnet payment (real money): a Testnet wallet never pays it. Use a Mainnet wallet.",
+	testnetPaymentOnMainnet: "This is a Testnet payment (test coins): a Mainnet wallet never pays it. Use a Testnet wallet.",
+	usdtRpcUnavailable: "USDT RPC unavailable",
+	usdtNotEnoughTokens: "Insufficient token balance",
+	usdtNotEnoughGas: "Insufficient ETH for gas",
+	usdtGasAboveLimit: "Estimated maximum gas exceeds your limit",
+	usdtNeedsSepoliaGas: "This needs a little Sepolia ETH for gas first",
+	fedimintNotInvite: "That is not a Fedimint invite code: it starts with fed1",
+	fedimintAlreadyJoined: "You already joined this federation",
+	fedimintConnecting: "Wait for the federation to connect",
+	fedimintNotEnough: "Not enough in this federation",
+	fedimintRealOnTestnet: "This federation holds real bitcoin: it belongs in a Mainnet Fedimint wallet",
+	fedimintTestOnMainnet: "This federation is on {chain}, a test network: it belongs in a Testnet Fedimint wallet",
+	walletAway: "{wallet} can't be used here. Use it on {device}.",
+	walletAwayUnnamed: "{wallet} can't be used here: its home is another device.",
+	groupTurnUnconfirmed: "Can't check which device is active, so the group was not changed. Try again in a moment."
+};
+/**
+* An error the engine knows: `engineCode` travels with it inside the engine, the text everywhere. Not `code`: the
+* CLI reads a `code` as its own exit code, and Node's errors carry one of theirs.
+*/
+var EngineError = class extends Error {
+	engineCode;
+	values;
+	constructor(engineCode, values = {}) {
+		super(engineText(engineCode, values));
+		this.engineCode = engineCode;
+		this.values = values;
+	}
+};
+/** The English text of `code` with its values in it, exactly as the engine writes it. */
+function engineText(code, values = {}) {
+	return ENGINE_ERRORS[code].replace(/\{(\w+)\}/g, (_, name) => name in values ? String(values[name]) : `{${name}}`);
+}
+var engineError = (code, values) => new EngineError(code, values);
+/** What each kind of value looks like in a text: never a space in a host, a network by its name, an amount as digits. */
+var VALUE = {
+	host: "(\\S+)",
+	domain: "(\\S+)",
+	chain: "(\\S+)",
+	unit: "(\\S+)",
+	network: "(Mainnet|Testnet)",
+	amount: "(\\d[\\d.,\\u00a0\\u202f' ]*?)",
+	fee: "(\\d[\\d.,\\u00a0\\u202f' ]*?)",
+	min: "(\\d[\\d.,\\u00a0\\u202f' ]*?)",
+	max: "(\\d[\\d.,\\u00a0\\u202f' ]*?)"
+};
+var escape = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+Object.keys(ENGINE_ERRORS).map((code) => {
+	const names = [];
+	const source = ENGINE_ERRORS[code].split(/(\{\w+\})/).map((part) => {
+		const value = /^\{(\w+)\}$/.exec(part);
+		if (!value) return escape(part);
+		names.push(value[1]);
+		return VALUE[value[1]] ?? "(.+?)";
+	}).join("");
+	return {
+		code,
+		names,
+		pattern: new RegExp(`^${source}$`)
+	};
+});
+//#endregion
 //#region ../core/src/ghostlink.ts
 /**
 * One link to one peer, complete: Pkarr presence and signaling, the WebRTC
@@ -16258,7 +16595,7 @@ var QUIET_FRAMES = /* @__PURE__ */ new Set([
 * `disconnected`) otherwise went on until its consent checks gave up, 27 s after the crash (CI run 36741701666).
 */
 var PONG_WAIT_MS = 4e3;
-/** How long `handled` waits for the contact to answer its ping before it says it cannot tell. */
+/** How long `handled` waits for the contact to answer its ping before it says it is late. */
 var HANDLED_WAIT_MS = 1e4;
 /**
 * Back in front after an absence (`wake`), a live session that ends this soon after it was lost while the app was
@@ -16321,6 +16658,8 @@ function recordDescriptor(transport, known, record, newer, listed) {
 		relay: r.relay
 	} : record;
 }
+/** How many keys' signals a one-time enrollment link remembers: past these, further keys are not counted. */
+var SIGNAL_SIGNERS_MAX = 16;
 var PAYMENT_METHODS = [
 	"cashu",
 	"lightning",
@@ -16388,6 +16727,10 @@ var GhostLink = class {
 	signalPublishFailed = false;
 	peerDescriptors;
 	peerTransports;
+	/** A group link: this side published a `_tr` on it, in this run or an earlier one (`packetTransportsSaid`). */
+	saidTransports;
+	/** A group link: what is known of the member's transports came from its packet (`_tr`), read now or kept from before. */
+	peerPacketSaid;
 	peerFallback;
 	preferred;
 	fallback;
@@ -16534,6 +16877,30 @@ var GhostLink = class {
 	lostUntil = 0;
 	/** Counts the signals a signer was asked to sign: only the latest one goes out. */
 	signalTurn = 0;
+	/** Puts this side's packet out again as it is: another writer of its key may have replaced it. */
+	republish() {
+		if (!this.stopped) this.session.republish();
+	}
+	/** The keys that signed a signal in the other end's packet, on a link that tells of refused keys (`onPeerKeyRefused`). */
+	signalSigners = /* @__PURE__ */ new Set();
+	/**
+	* A one-time enrollment link (WISP 06 § Adding a device: one session per invite): every device that reads the code
+	* writes the same packet, each signing its signals with its own device signing key, and the later one replaces the
+	* earlier. A validly signed signal by a key other than the one pinned, or than the first one seen there, is a second
+	* device on the code: said once per key, before a pin as after it.
+	*/
+	noteSignalSigner(signal) {
+		const events = this.options.events, credentials = this.options.pairing?.credentials;
+		if (!events?.onPeerKeyRefused || !credentials?.signer || !this.options.params.profile || this.signalSigners.size >= SIGNAL_SIGNERS_MAX) return;
+		if (!verifyPairedSignal(signal, this.options.params.peerPubKeyZ32, this.myPubKeyZ32, void 0, true)) return;
+		const key = JSON.parse(signal).auth.key;
+		if (this.signalSigners.has(key)) return;
+		this.signalSigners.add(key);
+		if (this.signalSigners.size > 1 || credentials.peerKey && key !== credentials.peerKey) {
+			traceLink(this.myPubKeyZ32, "signal-second-key", { keys: this.signalSigners.size });
+			events.onPeerKeyRefused();
+		}
+	}
 	/** A signal ready to go: on the live session during a switch to WebRTC, in this side's packet otherwise. */
 	signalOut(signed, report) {
 		if (this.switcher?.pending?.choices.includes("webrtc/1") && this.channel && this.paired?.state.status === "ready") {
@@ -16652,6 +17019,8 @@ var GhostLink = class {
 		this.streamWasBlocked = this.streamBlocked;
 		this.peerDescriptors = options.native?.peerDescriptors ?? {};
 		this.peerTransports = options.native?.peerTransports;
+		this.saidTransports = !!options.packetTransports && !!options.packetTransportsSaid;
+		this.peerPacketSaid = !!options.packetTransports && !!options.native?.peerTransports;
 		this.peerFallback = options.native?.peerFallback ?? false;
 		this.preferred = options.native?.preferred ?? "webrtc/1";
 		this.fallback = options.native?.fallback ?? true;
@@ -16665,7 +17034,7 @@ var GhostLink = class {
 			lastSeenTimestamp: options.lastSeenTimestamp,
 			pollIntervals: options.pollIntervals,
 			getServices: options.getServices,
-			firstPublish: options.firstPublish ?? (this.tracker && options.pairingProgress?.role === "joiner" || this.resuming ? "after-first-poll" : "at-start"),
+			firstPublish: options.firstPublish ?? (this.tracker && options.pairingProgress?.role === "joiner" && options.rtcAvailable !== false || this.resuming ? "after-first-poll" : "at-start"),
 			events: {
 				onFirstPoll: () => {
 					const online = this.session.peerPresence.online, early = this.firstLookDone;
@@ -16690,7 +17059,10 @@ var GhostLink = class {
 					this.maybeAutoConnect(presence);
 				},
 				onPublish: (result) => {
-					if (result.waiting) return;
+					if (result.waiting) {
+						if (result.retryInMs !== void 0) this.tracker?.heldBack(Date.now() + result.retryInMs);
+						return;
+					}
 					if (result.error) {
 						this.tracker?.failed("publish", true, result.error);
 						return;
@@ -16722,6 +17094,7 @@ var GhostLink = class {
 				},
 				onPeerClock: (packetAt, readBefore, readAt) => events.onPeerClock?.(packetAt, readBefore, readAt),
 				onPeerTransports: (value) => this.peerPacketTransports(value),
+				onPeerTransportsGone: () => this.peerPacketTransportsGone(),
 				onDiscoveryError: (error) => events.onDiscoveryError?.(error),
 				onStatus: (status) => events.onStatus?.(status),
 				onPoll: (poll) => events.onPoll?.(poll)
@@ -16836,9 +17209,13 @@ var GhostLink = class {
 			},
 			attemptTimeoutMs: () => this.tracker && !this.tracker.done ? PAIRING_ATTEMPT_MS : void 0,
 			onDisconnected: (disconnected) => {
-				if (!disconnected || this.activeBinding || !this.channel) return;
+				if (!disconnected) {
+					this.session.setDataLinkStalled(false);
+					return;
+				}
+				if (this.activeBinding || !this.channel) return;
 				traceLink(this.myPubKeyZ32, "rtc-disconnected", {});
-				this.session.pollNow();
+				this.session.setDataLinkStalled(true);
 			}
 		});
 		this.switcher = new TransportSwitch({
@@ -16955,6 +17332,7 @@ var GhostLink = class {
 		const firstContact = !!this.options.ownRecords || !!this.options.pairing && !this.options.pairing.credentials.peerKey;
 		const sight = seen && seen.after === null && !firstContact ? void 0 : seen;
 		const options = this.options, credentials = options.pairing?.credentials;
+		this.noteSignalSigner(signal);
 		const verified = options.params.profile ? verifyPairedSignal(signal, options.params.peerPubKeyZ32, this.myPubKeyZ32, credentials?.peerKey, credentials?.requireSignedSignals) : signal;
 		if (verified && this.predatesLastSession(verified, sight)) return;
 		if (verified) this.dataLink.handleSignal(verified, sight);
@@ -17091,6 +17469,13 @@ var GhostLink = class {
 	unproven(channel) {
 		return this.dialedIn.has(channel) && !!this.options.pairing?.credentials.peerKey;
 	}
+	/**
+	* A session that started before the pin and was refused for another key: the pin came by another path meanwhile (the
+	* DHT's first contact), and whoever this session reached held only a copy of the invite. It proves nothing either.
+	*/
+	pinnedSince(channel, paired) {
+		return this.openedUnpinned.has(channel) && !!paired.state.keyMismatch;
+	}
 	get textDelivery() {
 		if (this.isDataLinkOpen) return "stream";
 		if (!this.dht || this.securityRejected || this.keyStopped) return "unavailable";
@@ -17152,6 +17537,7 @@ var GhostLink = class {
 		this.emitDeliveryState();
 	}
 	start() {
+		if (this.saidTransports) this.publishPacketTransports();
 		if (this.deliveryMode !== "dht") this.session.start();
 		if (this.resuming && this.deliveryMode !== "dht") {
 			this.session.expectPeer();
@@ -17170,6 +17556,7 @@ var GhostLink = class {
 	*/
 	dialEarly() {
 		if (!this.options.params.profile || !this.options.autoConnect || this.deliveryMode === "dht" || this.streamBlocked || this.dialing || this.channel) return;
+		if (this.options.rtcAvailable === false) return;
 		const startedAt = this.options.pairingProgress?.startedAt ?? 0;
 		if (Date.now() - startedAt > 6e4) return;
 		this.dialGate = new Promise((resolve) => {
@@ -17619,11 +18006,20 @@ var GhostLink = class {
 			this.maybeAutoConnect(this.presence);
 		}
 	}
-	/** A group link's `_tr` in its packet: what this side runs and how to dial it, once it runs a native endpoint there. */
+	/**
+	* A group link's `_tr` in its packet: what this side runs and how to dial it, once it runs a native endpoint there.
+	* Having said one, it goes on saying what it runs with no endpoint up too (`["webrtc/1"]`): the member's app keeps the
+	* last value it read and acts only on a packet that carries one, so a `_tr` that just stopped left it dialling a
+	* native transport nobody listens on, across restarts of both apps (an edge whose WebRTC failed once, node.ts
+	* `edgeWithoutRtc`, in the next run of the app). Never an empty list: an app with no WebRTC whose endpoint is not up
+	* yet says nothing, as before, and what it said in the run before holds.
+	*/
 	publishPacketTransports() {
 		if (!this.options.packetTransports) return;
-		const value = this.endpoints.size ? encodePacketTransports(this.availableTransports, this.localDescriptors()) : null;
 		const signer = this.options.pairing?.credentials.signer;
+		if (this.endpoints.size && !signer) this.saidTransports = true;
+		const available = this.availableTransports;
+		const value = this.endpoints.size || this.saidTransports && available.length ? encodePacketTransports(available, this.localDescriptors()) : null;
 		if (!signer) {
 			this.session.setTransports(value);
 			return;
@@ -17666,10 +18062,42 @@ var GhostLink = class {
 		if (!said) return;
 		const transports = said.transports, descriptors = dialDescriptors(said.descriptors);
 		traceLink(this.myPubKeyZ32, "packet-transports", { transports });
+		this.peerPacketSaid = true;
 		if (!transports.includes("webrtc/1") && !this.channel && WEBRTC_ATTEMPT.has(this.dataLink.state)) this.disconnect();
 		this.options.events?.onPacketTransports?.(transports, descriptors);
 		this.learnPeerTransports(transports, descriptors, true);
 	}
+	/**
+	* The member's packet advertises and has carried no `_tr` for `TRANSPORTS_GONE_MS`: its app publishes none, which is
+	* what an app with WebRTC that runs no native endpoint on this link does. What an earlier packet said (kept by the
+	* owner across restarts) no longer holds: an app that said `["iroh/1"]` while its WebRTC failed and came back with
+	* WebRTC, from before it said so itself (`packetTransportsSaid`). Left as it was, this side ranked its transports
+	* against that list, found a native one nobody listens on or none at all, and never offered WebRTC again.
+	* Not on a device link: there only a signed value counts, and a missing one is signed by nobody.
+	*/
+	peerPacketTransportsGone() {
+		if (!this.options.packetTransports || this.stopped || !this.peerPacketSaid || this.options.pairing?.credentials.signer) return;
+		this.peerPacketSaid = false;
+		traceLink(this.myPubKeyZ32, "packet-transports-gone", {});
+		this.options.events?.onPacketTransportsGone?.();
+		if (this.channel) return;
+		this.peerTransports = void 0;
+		this.peerRecordTransports = void 0;
+		this.peerFallback = false;
+		this.peerDescriptors = {};
+		this.undescribed.clear();
+		for (const t of TRANSPORTS) if (t !== "webrtc/1") {
+			this.nativeFailures.delete(t);
+			this.demotedUntil.delete(t);
+		}
+		if (this.resuming && this.resuming !== "webrtc/1") {
+			this.resuming = void 0;
+			this.resumingWoke = false;
+		}
+		this.autoConnectFailures = 0;
+		this.lastAutoConnectAt = 0;
+		this.notifyWait();
+	}
 	/** A connection the contact dialled on one of this side's native endpoints. */
 	takeDialIn(channel, binding) {
 		if (this.streamBlocked) {
@@ -18195,6 +18623,15 @@ var GhostLink = class {
 	canDial(transport) {
 		return transport !== "webrtc/1" && this.endpoints.has(transport) && !!this.peerDescriptors[transport];
 	}
+	/**
+	* Whether a dial has anything to try: WebRTC here (the contact's record, once read, listing it), or a native transport
+	* both apps run with this side's endpoint up and the contact's descriptor read. A group link counts every dial: its
+	* fast looks for the member's `_tr` end after a few (`PACKET_TRANSPORTS_FAST_ATTEMPTS`).
+	*/
+	anythingToDial() {
+		if (!this.options.params.profile || this.options.packetTransports) return true;
+		return this.transportOffer().some((t) => t === "webrtc/1" ? !this.peerTransports || this.peerTransports.includes(t) : this.canDial(t) && !!this.peerTransports?.includes(t));
+	}
 	clearRace() {
 		if (this.raceTimer) clearTimeout(this.raceTimer);
 		this.raceTimer = null;
@@ -18378,7 +18815,7 @@ var GhostLink = class {
 	async request(serviceId, request) {
 		if (this.options.params.profile) {
 			await this.connect();
-			if (!this.supportsServices) throw new GhostlyHttpError("unavailable", this.isDataLinkOpen ? "Your contact's app cannot share web apps in this chat, or needs an updated Ghostly" : "Shared apps need a live connection");
+			if (!this.supportsServices) throw new GhostlyHttpError("unavailable", this.isDataLinkOpen ? "Your contact's app cannot share services in this chat, or needs an updated Ghostly" : "Shared services need a live connection");
 			if (!this.pairedHttp) throw new GhostlyHttpError("closed", "Data link is closed");
 			return this.pairedHttp.client.request(serviceId, request);
 		}
@@ -18508,10 +18945,20 @@ var GhostLink = class {
 			return;
 		}
 		traceLink(this.myPubKeyZ32, "dial", { failures: this.autoConnectFailures });
+		this.autoDial();
+	}
+	/**
+	* An automatic dial. One with nothing to try (`anythingToDial`) still says why (`liveAttempt`) and keeps the pace, but
+	* is no failed attempt: the wait between attempts does not grow, and a first pairing does not turn `on-dht` for it.
+	* Two Linux Desktops pairing over a slow DHT, neither having read the other's record yet, counted three such dials in
+	* 12 s: the pairing turned `on-dht` and the next dial waited 160 s, though nothing had been tried.
+	*/
+	autoDial() {
+		const tries = this.anythingToDial();
 		this.lastAutoConnectAt = Date.now();
-		this.autoConnectFailures++;
+		if (tries) this.autoConnectFailures++;
 		this.dial().catch((error) => {
-			this.tracker?.failed("transport", true);
+			if (tries) this.tracker?.failed("transport", true);
 			this.dialFailed(error instanceof Error ? error.message : String(error));
 			this.lookAtRetry();
 		});
@@ -18528,13 +18975,7 @@ var GhostLink = class {
 			failures: this.autoConnectFailures,
 			again: true
 		});
-		this.lastAutoConnectAt = Date.now();
-		this.autoConnectFailures++;
-		this.dial().catch((error) => {
-			this.tracker?.failed("transport", true);
-			this.dialFailed(error instanceof Error ? error.message : String(error));
-			this.lookAtRetry();
-		});
+		this.autoDial();
 	}
 	/**
 	* A failed dial waits `dialWait` before the next, and only a look at the contact's record dials: the next one came at
@@ -19183,8 +19624,17 @@ var GhostLink = class {
 			}));
 		} catch {}
 	}
+	/**
+	* The contact said goodbye on the last live session (its app quit or stopped) and has published nothing since but its
+	* leave packet: its app is not running, so a dial now waits for nobody until it gives up.
+	*/
+	get contactAway() {
+		const presence = this.session.peerPresence;
+		return !this.isDataLinkOpen && !!this.departed && (presence.lastPacketAt === this.departed.packet || !presence.online);
+	}
 	async requirePaymentSupport() {
 		if (!PAYMENT_METHODS.some((m) => this.paymentEnabled(m))) throw new Error("Payments are turned off in this chat.");
+		if (this.contactAway) throw engineError("contactAway");
 		await this.connect();
 		if (!this.supportsPayments) throw new Error("This contact does not support payments. Both peers need an updated Ghostly.");
 	}
@@ -19386,6 +19836,8 @@ var GhostLink = class {
 	* no more than on the DHT, so it closes that connection and nothing else.
 	*/
 	dialedIn = /* @__PURE__ */ new WeakSet();
+	/** Connections whose session started with no key pinned nor named by the invite. */
+	openedUnpinned = /* @__PURE__ */ new WeakSet();
 	/**
 	* `migration`: the channel is a candidate that takes over from the session open now once it authenticated. With a
 	* `plan`, a live switch both sides agreed; without one, a replacement (`attachReplacement`): the contact dialled
@@ -19414,6 +19866,7 @@ var GhostLink = class {
 				}
 			};
 			const unproven = this.unproven(channel);
+			if (!this.options.pairing.credentials.peerKey && !this.options.pairing.credentials.expectedPeerKey) this.openedUnpinned.add(channel);
 			if (!migration) {
 				this.activeBinding = binding;
 				this.channel = channel;
@@ -19441,13 +19894,14 @@ var GhostLink = class {
 				lightningPaymentsSupport: this.paymentEnabled("lightning"),
 				paymentsSupport: PAYMENT_METHODS.some((m) => this.paymentEnabled(m)) && !!this.options.events?.onPayment && !!this.options.events?.onPaymentRequest && !!this.options.events?.onPaymentResult,
 				onState: () => {
-					if (this.channel === channel && (!this.unproven(channel) || paired.state.status === "ready")) this.emitPairingState();
+					if (this.channel === channel && (!this.unproven(channel) && !this.pinnedSince(channel, paired) || paired.state.status === "ready")) this.emitPairingState();
 				},
 				onFailure: () => {
 					if (paired.state.keyMismatch) this.options.events?.onPeerKeyRefused?.();
-					if (this.unproven(channel) || paired.authTimedOut || paired.overloaded) {
+					if (this.unproven(channel) || this.pinnedSince(channel, paired) || paired.authTimedOut || paired.overloaded) {
 						if (paired.state.keyMismatch) this.dht?.foreignKeySeen("stream");
 						if (this.unproven(channel)) traceLink(this.myPubKeyZ32, "dialed-in-refused", { keyMismatch: !!paired.state.keyMismatch });
+						else if (this.pinnedSince(channel, paired)) traceLink(this.myPubKeyZ32, "pinned-since-refused", { transport: binding?.transport ?? "webrtc/1" });
 						else if (paired.overloaded) traceLink(this.myPubKeyZ32, "receive-overload", { transport: binding?.transport ?? "webrtc/1" });
 						else traceLink(this.myPubKeyZ32, "auth-timeout", { transport: binding?.transport ?? "webrtc/1" });
 						migration?.reject(new Error(paired.state.error ?? "Candidate authentication failed"));
@@ -19966,7 +20420,8 @@ var GhostLink = class {
 	* Resolves once the contact's app handled every frame sent on this session so far: it answers a ping in the order
 	* frames come (every app since 1.0), so the pong to one sent now says so, however slowly it handles them. A group
 	* member's catch-up answer goes a slice at a time on it (`GroupSessionHooks.handled`). `false` when it cannot tell:
-	* no session, a contact that answers no ping, or no answer within `HANDLED_WAIT_MS`.
+	* no session, or a contact that answers no ping. `"late"` with no answer within `HANDLED_WAIT_MS`: a contact that
+	* answers pings is still handling what came before (a phone with a long history), not one that cannot say.
 	*/
 	handled() {
 		const channel = this.channel;
@@ -19986,7 +20441,7 @@ var GhostLink = class {
 					resolve(exact);
 				}
 			};
-			const timer = setTimeout(() => waiter.done(false), HANDLED_WAIT_MS);
+			const timer = setTimeout(() => waiter.done("late"), HANDLED_WAIT_MS);
 			this.handledWaiters.push(waiter);
 		});
 	}
@@ -20480,121 +20935,6 @@ function decodeBolt11(text) {
 	};
 }
 //#endregion
-//#region ../core/src/engineErrors.ts
-/**
-* The engine's known errors: a stable code each, and its English text with the values in it. The engine throws
-* `engineError(code, values)`; the text is the one it always wrote, so the CLI and every log keep printing the same.
-* The app's pages get only the text (it crosses the engine's RPC and is kept on payments and operations as a string),
-* and `parseEngineError` finds the code and the values back in it, to say it in the app's language. A text that is
-* none of these (a mint's own words, a provider's) stays as it is.
-*
-* `{name}` in a template is a value: a host or domain (no spaces), a network ("Mainnet" or "Testnet"), a chain's name,
-* or an amount (digits, with the separators of whatever locale wrote it).
-*/
-var ENGINE_ERRORS = {
-	mintUnreachable: "Could not reach {host}. Check the address: it should be a Cashu mint.",
-	lnurlUnreachable: "Could not reach {host}. It may be down, or not allow web apps to read it (CORS).",
-	hostUnreachable: "Could not reach {host}",
-	networkUnreachable: "Could not reach the network",
-	hostTimedOut: "{host} did not answer in time",
-	networkTimedOut: "The network did not answer in time",
-	testMintOnMainnet: "This is a test mint, and its sats are worth nothing: add it to a Testnet Cashu wallet",
-	realMintOnTestnet: "This mint holds real sats: add it to a Mainnet Cashu wallet",
-	mintHoldsSats: "Move your sats out of this mint before removing it",
-	lastMint: "This is the last mint of your {network} Cashu wallet: remove the wallet to remove it",
-	invalidMintUrl: "That is not a valid mint URL",
-	mintNotHttps: "Mints must use https",
-	notEnoughSats: "Not enough sats in your wallet",
-	noSharedMint: "You share no mint with this contact",
-	ecashAlreadySpent: "This ecash was already spent somewhere else",
-	reviewedEcashSpent: "The ecash for this payment was already spent somewhere else. Nothing was sent, and your balance now shows what the mint still holds.",
-	reviewedSatsGone: "The sats this payment was reviewed with went to another payment. Nothing was sent: review it again.",
-	lightningFeeTooHigh: "The Lightning fee ({fee} sats) is too high",
-	invoiceExpired: "That invoice has expired",
-	lnurlExactly: "{domain} asks for exactly {amount} sats",
-	lnurlRange: "{domain} takes between {min} and {max} sats",
-	feeAboveLimit: "The fee exceeds your limit",
-	cashuFeeAboveLimit: "Cashu fee exceeds your limit",
-	invalidMaxFee: "Invalid maximum fee",
-	methodUnavailable: "This payment method is unavailable",
-	unknownPaymentIntent: "Unknown payment intent",
-	paymentExpired: "Payment request expired or has an invalid expiry",
-	requestHasPayment: "This request already has a payment. Reconcile it before trying again.",
-	requestPaymentInFlight: "This request already has a payment; reconcile it instead",
-	requestNotAwaiting: "This request is no longer awaiting payment. Check its status before spending.",
-	reconnectBeforeApprove: "Reconnect the data link before approving. Your review was saved.",
-	cannotSubmitAgain: "This payment cannot be submitted again. Reconcile its existing transaction.",
-	alreadySubmitted: "This payment was already submitted or could not be saved",
-	sentAfterReview: "A payment from this wallet was sent after this review was made. Create a new review",
-	cannotCancelSubmitted: "A submitted payment cannot be cancelled; reconcile it instead",
-	outcomeUnknown: "Outcome unknown. Check the existing payment; do not send another.",
-	notYetConfirmed: "Not yet confirmed. No second payment was sent.",
-	couldNotVerify: "Could not verify this payment yet. No second payment was sent.",
-	paymentTakenBack: "This payment was taken back. The sats are in your wallet.",
-	parkedSigned: "Needs your decision: this payment was signed before this copy of your profile took over. It is never sent again from here. Check it before you pay again.",
-	realMoneyUnconfirmed: "This pays with real money: confirm it with Send real money first. Nothing was sent.",
-	mainnetPaymentOnTestnet: "This is a Mainnet payment (real money): a Testnet wallet never pays it. Use a Mainnet wallet.",
-	testnetPaymentOnMainnet: "This is a Testnet payment (test coins): a Mainnet wallet never pays it. Use a Testnet wallet.",
-	usdtRpcUnavailable: "USDT RPC unavailable",
-	usdtNotEnoughTokens: "Insufficient token balance",
-	usdtNotEnoughGas: "Insufficient ETH for gas",
-	usdtGasAboveLimit: "Estimated maximum gas exceeds your limit",
-	usdtNeedsSepoliaGas: "This needs a little Sepolia ETH for gas first",
-	fedimintNotInvite: "That is not a Fedimint invite code: it starts with fed1",
-	fedimintAlreadyJoined: "You already joined this federation",
-	fedimintConnecting: "Wait for the federation to connect",
-	fedimintNotEnough: "Not enough in this federation",
-	fedimintRealOnTestnet: "This federation holds real bitcoin: it belongs in a Mainnet Fedimint wallet",
-	fedimintTestOnMainnet: "This federation is on {chain}, a test network: it belongs in a Testnet Fedimint wallet",
-	walletAway: "{wallet} can't be used here. Use it on {device}.",
-	walletAwayUnnamed: "{wallet} can't be used here: its home is another device.",
-	groupTurnUnconfirmed: "Can't check which device is active, so the group was not changed. Try again in a moment."
-};
-/**
-* An error the engine knows: `engineCode` travels with it inside the engine, the text everywhere. Not `code`: the
-* CLI reads a `code` as its own exit code, and Node's errors carry one of theirs.
-*/
-var EngineError = class extends Error {
-	engineCode;
-	values;
-	constructor(engineCode, values = {}) {
-		super(engineText(engineCode, values));
-		this.engineCode = engineCode;
-		this.values = values;
-	}
-};
-/** The English text of `code` with its values in it, exactly as the engine writes it. */
-function engineText(code, values = {}) {
-	return ENGINE_ERRORS[code].replace(/\{(\w+)\}/g, (_, name) => name in values ? String(values[name]) : `{${name}}`);
-}
-var engineError = (code, values) => new EngineError(code, values);
-/** What each kind of value looks like in a text: never a space in a host, a network by its name, an amount as digits. */
-var VALUE = {
-	host: "(\\S+)",
-	domain: "(\\S+)",
-	chain: "(\\S+)",
-	network: "(Mainnet|Testnet)",
-	amount: "(\\d[\\d.,\\u00a0\\u202f' ]*?)",
-	fee: "(\\d[\\d.,\\u00a0\\u202f' ]*?)",
-	min: "(\\d[\\d.,\\u00a0\\u202f' ]*?)",
-	max: "(\\d[\\d.,\\u00a0\\u202f' ]*?)"
-};
-var escape = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-Object.keys(ENGINE_ERRORS).map((code) => {
-	const names = [];
-	const source = ENGINE_ERRORS[code].split(/(\{\w+\})/).map((part) => {
-		const value = /^\{(\w+)\}$/.exec(part);
-		if (!value) return escape(part);
-		names.push(value[1]);
-		return VALUE[value[1]] ?? "(.+?)";
-	}).join("");
-	return {
-		code,
-		names,
-		pattern: new RegExp(`^${source}$`)
-	};
-});
-//#endregion
 //#region ../core/src/lnurl.ts
 var LNURL_LIMITS = {
 	timeoutMs: 15e3,
@@ -24393,9 +24733,10 @@ var CatchUpAnswers = class {
 			return;
 		}
 		const rest = [...frames], told = [];
+		const ask = () => handled(to).catch(() => false);
 		const next = () => {
 			if (!this.sendSlice(to, rest)) return false;
-			if (rest.length) told.push(handled(to).catch(() => false));
+			if (rest.length) told.push(ask());
 			return true;
 		};
 		if (!next() || !next() || !rest.length) return;
@@ -24403,7 +24744,9 @@ var CatchUpAnswers = class {
 		(async () => {
 			try {
 				while (rest.length) {
-					if (!await told.shift()) await new Promise((resolve) => setTimeout(resolve, 500));
+					let answer = await told.shift();
+					while (answer === "late" && this.hooks.active()) answer = await ask();
+					if (!answer) await new Promise((resolve) => setTimeout(resolve, 500));
 					if (!this.hooks.active() || !next()) break;
 				}
 			} finally {
@@ -24772,6 +25115,8 @@ var GroupSession = class {
 	pendingCommits = /* @__PURE__ */ new Map();
 	/** When each member was last asked to catch me up, so a stream of unreadable frames is one question, not a loop. */
 	asked = /* @__PURE__ */ new Map();
+	/** The signed leave of each member I last passed on, kept for an admin that was away (`byesHeld`). In memory only. */
+	byesPassed = /* @__PURE__ */ new Map();
 	queue = Promise.resolve();
 	/** One metadata frame that names a commit or an epoch I do not have yet: tried again when the chain moves. */
 	pendingMeta;
@@ -24987,6 +25332,38 @@ var GroupSession = class {
 		const lowest = Math.max(0, entry.high - GROUP_LIMITS.window + 1);
 		return Math.max(0, entry.high - lowest + 1 - (1 + entry.window.filter((n) => n >= lowest).length));
 	}
+	/**
+	* The other members some of whose messages below the highest seen never arrived (what a sync names in `miss`), each
+	* with a mark that changes when what is missing does: an author answers only from its own last `outlog`, so the rest
+	* is for another member to hand on.
+	*/
+	lacking() {
+		const out = /* @__PURE__ */ new Map();
+		for (const [sender, epochs] of Object.entries(this.state.seen)) {
+			if (sender === this.myKey || !rosterHas(this.roster, sender)) continue;
+			const marks = Object.entries(epochs).filter(([, entry]) => this.gaps(entry).length).map(([e, entry]) => `${e}:${entry.high}:${entry.window.length}`);
+			if (marks.length) out.set(sender, marks.join(","));
+		}
+		return out;
+	}
+	/** What a sync names in `miss` for one sender now: per epoch, the newest `GROUP_LIMITS.miss` numbers that never arrived. */
+	missOf(sender) {
+		const out = {};
+		for (const [e, entry] of Object.entries(this.state.seen[sender] ?? {})) {
+			const gaps = this.gaps(entry);
+			if (gaps.length) out[e] = gaps;
+		}
+		return out;
+	}
+	/** Whether any of `asked` (per epoch, as `missOf` gave them) arrived since: the member asked holds what is missing. */
+	filledSince(sender, asked) {
+		return Object.entries(asked).some(([e, numbers]) => {
+			const entry = this.state.seen[sender]?.[e];
+			if (!entry) return false;
+			const got = new Set(entry.window);
+			return numbers.some((n) => got.has(n));
+		});
+	}
 	serialize(run) {
 		const operation = this.queue.then(run);
 		this.queue = operation.then(() => {}, () => {});
@@ -25619,10 +25996,29 @@ var GroupSession = class {
 		} catch {
 			return;
 		}
+		if (bye.e < this.admittedAt(bye.k)) return;
 		if (this.isAdmin && this.hooks.adminWork?.() !== false && await this.commitUnlessTurnUnconfirmed("remove", bye.k)) return;
+		if (from !== bye.k && this.byesPassed.get(bye.k)?.sig === bye.sig) return;
+		this.byesPassed.set(bye.k, bye);
 		this.took(bye);
 	}
 	/**
+	* The signed leaves I passed on whose members are still in the roster: the admin was away when they went round, so
+	* they are handed to it again when its edge opens. One goes with the commit that removes its member.
+	*/
+	byesHeld() {
+		const held = [];
+		for (const [key, bye] of this.byesPassed) if (rosterHas(this.roster, key) && bye.e >= this.admittedAt(key)) held.push(bye);
+		else this.byesPassed.delete(key);
+		return held;
+	}
+	/** The epoch of the commit that last admitted `key` (0 for the creator, whom no commit admits). */
+	admittedAt(key) {
+		const chain = this.state.chain;
+		for (let e = chain.length - 1; e > 0; e--) if (chain[e].k === "add" && chain[e].s === key) return e;
+		return 0;
+	}
+	/**
 	* An automatic commit (a member's leave): made, or not made when no fresh turn read says this device is the active
 	* one (`adminTurn`). Then false, and the caller goes on as a member would. Any other refusal is thrown as before.
 	*/
@@ -26137,7 +26533,7 @@ var GroupSession = class {
 		this.state.meta = opened.meta;
 		await this.persist();
 		const change = !before && !rosterHas(commit.m, this.myKey) ? null : groupMetaChange(before, opened.meta, this.state.name);
-		if (change) this.hooks.metaChanged?.(s.by, change, opened.meta.ts);
+		if (change) this.hooks.metaChanged?.(this.metaAuthor(before, s), change, opened.meta.ts);
 		this.hooks.changed();
 		this.took({
 			t: "group-meta",
@@ -26147,6 +26543,16 @@ var GroupSession = class {
 			c: frame.c
 		});
 	}
+	/**
+	* Who made the change a statement brings me: its signer, when they were the admin all along since the statement I
+	* held (or, with none, since I got in). A new admin signs again what the last one set (`metaFollowsChain`): to a
+	* member that missed that, it is no change of theirs it can tell apart, so nobody is named.
+	*/
+	metaAuthor(before, s) {
+		const chain = this.state.chain, from = before ? before.e : chain.findIndex((c) => rosterHas(c.m, this.myKey));
+		for (let e = Math.max(0, from); e <= s.e; e++) if (rosterAdmin(chain[e].m) !== s.by) return void 0;
+		return s.by;
+	}
 	/** After the chain or my secrets moved: the waiting statement, and, if I became the admin, the name and picture signed again as mine. */
 	async metaFollowsChain() {
 		const pending = this.pendingMeta;
@@ -26510,8 +26916,11 @@ function parseCommit(raw) {
 	if (c.ls !== void 0) out.ls = c.ls;
 	return out;
 }
-/** The roster a commit of this kind makes of the previous one; null when it is not allowed. */
-function communityRoster(previous, c) {
+/**
+* The roster a commit of this kind makes of the previous one; null when it is not allowed. `trusted`: the commit was
+* verified when it was accepted (a replay of the stored main branch), so a leave's statement is not checked again.
+*/
+function communityRoster(previous, c, trusted = false) {
 	if (c.k === "create") return previous === null && !c.s && !!c.x && !!c.n ? [[c.by, "admin"]] : null;
 	if (!previous || !rosterHas(previous, c.by)) return null;
 	const admin = rosterAdmin(previous);
@@ -26521,7 +26930,7 @@ function communityRoster(previous, c) {
 			return sortRoster([...previous, [c.s, "member"]]);
 		case "leave":
 			if (!c.s || c.s === c.by || c.s === admin || !rosterHas(previous, c.s) || !c.ls) return null;
-			if (!verify(fromBase64Url(c.ls), leaveStatement(c.g, c.s), publicKeyFromZ32(c.s))) return null;
+			if (!trusted && !verify(fromBase64Url(c.ls), leaveStatement(c.g, c.s), publicKeyFromZ32(c.s))) return null;
 			return previous.filter(([k]) => k !== c.s);
 		case "remove":
 			if (c.by !== admin || !c.s || c.s === c.by || !rosterHas(previous, c.s)) return null;
@@ -26694,6 +27103,8 @@ var CommunitySession = class {
 	known = /* @__PURE__ */ new Map();
 	/** Commit hash → roster after it, for the window of the main branch and the side commits. */
 	rosters = /* @__PURE__ */ new Map();
+	/** Commit hash → roster after it, for a few main-branch commits older than the window that `couldRead` was asked about. */
+	pastRosters = /* @__PURE__ */ new Map();
 	mainIndex = /* @__PURE__ */ new Map();
 	pendingCommits = /* @__PURE__ */ new Map();
 	pendingSecrets = /* @__PURE__ */ new Map();
@@ -26702,6 +27113,8 @@ var CommunitySession = class {
 	asked = /* @__PURE__ */ new Map();
 	/** Syncs answered per member, a few a minute (`COMMUNITY_LIMITS.syncAnswers`). In memory only. */
 	syncsAnswered = /* @__PURE__ */ new Map();
+	/** The entry seed sealed to each member, for the seed it seals (`entryFrame`): every sync answer carries it. In memory only. */
+	sealedEntries = /* @__PURE__ */ new Map();
 	/** Catch-up answers still going out, a slice at a time (`receiveSync`). */
 	answers;
 	queue = Promise.resolve();
@@ -26900,8 +27313,26 @@ var CommunitySession = class {
 	*/
 	couldRead(key, messageId) {
 		const [, e, h] = messageId.split(":");
-		const found = h === void 0 ? void 0 : this.commitByShort(Number(e), h);
-		return !!found && rosterHas(this.rosterAt(found.hash) ?? [], key) && rosterHas(this.roster, key);
+		if (h === void 0 || !rosterHas(this.roster, key)) return false;
+		const found = this.commitByShort(Number(e), h);
+		if (found) return rosterHas(this.rosterAt(found.hash) ?? [], key);
+		const i = this.state.chain.length - 1 - (this.epoch - Number(e));
+		const commit = Number.isSafeInteger(i) && i >= 0 ? this.state.chain[i] : void 0;
+		const hash = commit && communityCommitHash(commit);
+		return !!hash && hash.startsWith(h) && rosterHas(this.pastRoster(i, hash), key);
+	}
+	/** The roster after an old commit of the main branch, replayed and kept apart from the window's (a few, the latest asked). */
+	pastRoster(i, hash) {
+		const known = this.pastRosters.get(hash);
+		if (known) return known;
+		let roster = null;
+		for (let j = 0; j <= i && (j === 0 || roster); j++) roster = communityRoster(roster, this.state.chain[j]);
+		this.pastRosters.set(hash, roster ?? []);
+		for (const old of this.pastRosters.keys()) {
+			if (this.pastRosters.size <= 8) break;
+			this.pastRosters.delete(old);
+		}
+		return roster ?? [];
 	}
 	/** Someone the chain took out (removed or left) and who is not back in. */
 	wasRemoved(key) {
@@ -26950,7 +27381,10 @@ var CommunitySession = class {
 		const lowest = Math.max(0, entry.high - COMMUNITY_LIMITS.replay + 1);
 		return Math.max(0, entry.high - lowest + 1 - (1 + entry.window.filter((n) => n >= lowest).length));
 	}
-	/** Replays the main branch (rosters kept for its window) and places the side commits. */
+	/**
+	* Replays the main branch (rosters kept for its window) and places the side commits. The main branch was verified
+	* commit by commit when it was accepted: its signatures are not checked again.
+	*/
 	rebuild() {
 		this.known.clear();
 		this.rosters.clear();
@@ -26958,7 +27392,7 @@ var CommunitySession = class {
 		let roster = null;
 		const keepFrom = Math.max(0, this.state.chain.length - 1 - COMMUNITY_LIMITS.window);
 		this.state.chain.forEach((commit, i) => {
-			roster = communityRoster(roster, commit);
+			roster = communityRoster(roster, commit, true);
 			if (!roster) throw new Error("Stored membership chain does not replay");
 			const h = communityCommitHash(commit);
 			this.known.set(h, commit);
@@ -26987,7 +27421,7 @@ var CommunitySession = class {
 		const i = this.mainIndex.get(h);
 		if (i === void 0) return void 0;
 		let roster = null;
-		for (let j = 0; j <= i; j++) roster = communityRoster(roster, this.state.chain[j]);
+		for (let j = 0; j <= i; j++) roster = communityRoster(roster, this.state.chain[j], true);
 		if (roster) this.rosters.set(h, roster);
 		return roster ?? void 0;
 	}
@@ -28091,13 +28525,14 @@ var CommunitySession = class {
 		const handed = /* @__PURE__ */ new Set();
 		const unheard = new Set(this.state.unheard ?? []);
 		for (const stored of this.state.store) {
-			if (stored.s === from || this.wasRemoved(stored.s)) continue;
+			if (stored.s === from) continue;
+			const high = have[stored.s]?.[seenKey(stored.e, stored.h)];
+			if (Number.isSafeInteger(high) && high >= stored.n) continue;
+			if (this.wasRemoved(stored.s)) continue;
 			const found = this.commitByShort(stored.e, stored.h);
 			if (!found) continue;
 			const reads = rosterHas(this.rosterAt(found.hash) ?? [], from), mine = stored.s === this.myKey && unheard.has(frameKey(stored));
 			if (!reads && !(mine && rosterHas(this.roster, from))) continue;
-			const high = have[stored.s]?.[seenKey(stored.e, stored.h)];
-			if (Number.isSafeInteger(high) && high >= stored.n) continue;
 			if (!this.mainIndex.has(found.hash)) this.handSide(from, found.hash, handed, answer);
 			answer.push(stored);
 			if (mine && reads) unheard.delete(frameKey(stored));
@@ -28143,11 +28578,13 @@ var CommunitySession = class {
 			});
 		}
 	}
-	/** The current entry seed sealed to a member, when I hold it. */
+	/** The current entry seed sealed to a member, when I hold it: sealed once per seed, not on every sync answer. */
 	entryFrame(to) {
 		const { key, seedB64 } = this.state.entry;
 		if (!key || !seedB64) return null;
-		return {
+		const sealed = this.sealedEntries.get(to);
+		if (sealed?.seedB64 === seedB64 && sealed.frame.x === key) return { ...sealed.frame };
+		const frame = {
 			t: "group-entry",
 			v: 2,
 			g: this.id,
@@ -28155,6 +28592,11 @@ var CommunitySession = class {
 			x: key,
 			s: sealSecret(to, fromBase64Url(seedB64), entryAad(this.id, to))
 		};
+		this.sealedEntries.set(to, {
+			seedB64,
+			frame
+		});
+		return { ...frame };
 	}
 	/** A newer entry seed, from a member who holds it (see `replaceLink`): only the one the chain names. */
 	takeEntrySeed(seedB64) {
@@ -28276,10 +28718,26 @@ var CommunitySession = class {
 		this.state.meta = opened.meta;
 		await this.persist();
 		const change = !before && !rosterHas(this.rosterAt(s.h) ?? [], this.myKey) ? null : groupMetaChange(before, opened.meta, this.state.name);
-		if (change) this.hooks.metaChanged?.(s.by, change, opened.meta.ts);
+		if (change) this.hooks.metaChanged?.(this.metaAuthor(before, s, at), change, opened.meta.ts);
 		this.hooks.changed();
 		return true;
 	}
+	/**
+	* Who made the change a statement brings me (`at`: its commit's place on my main branch): its signer, when they were
+	* the admin all along since the statement I held (or, with none, since I got in). A new admin signs again what the
+	* last one set (`metaFollowsChain`): to a member that missed that, it is no change of theirs it can tell apart.
+	*/
+	metaAuthor(before, s, at) {
+		const from = before ? this.mainIndex.get(before.h) : void 0;
+		let roster = before && from !== void 0 ? this.rosterAt(before.h) ?? null : null, counted = from !== void 0;
+		for (let i = from ?? 0; i <= at; i++) {
+			if (i !== from) roster = communityRoster(roster, this.state.chain[i]);
+			if (!roster) return void 0;
+			counted ||= rosterHas(roster, this.myKey);
+			if (counted && rosterAdmin(roster) !== s.by) return void 0;
+		}
+		return s.by;
+	}
 	/** After the chain or my secrets moved: the waiting statement, and, if I became the admin, the name and picture signed again as mine. */
 	async metaFollowsChain() {
 		const pending = this.pendingMeta;
@@ -28442,11 +28900,18 @@ var APP_PERMISSIONS = [
 	"internet",
 	"name"
 ];
+/**
+* The clients a writer may name in `runtime.clients` (WISP 1200 · Manifest). A reader also accepts a client name it does
+* not know (`APP_CLIENT_NAME`), since `runtime` is advisory and a later client (Android, say) must not make every older
+* reader refuse the bundle.
+*/
 var APP_CLIENTS = [
 	"web",
 	"desktop",
 	"extension"
 ];
+/** A client name a reader accepts in `runtime.clients`, a later client's included. */
+var APP_CLIENT_NAME = /^[a-z][a-z0-9-]{0,31}$/;
 /**
 * Where an app shows (WISP 1200 · Manifest, `view`). `chat`, the default when the manifest has none: inside a 1:1 chat
 * only, beside it on a wide screen. `full`: full screen, alone or from a chat, never beside one.
@@ -28478,8 +28943,39 @@ var OPTIONAL = [
 	"support",
 	"releaseNotes"
 ];
-/** Reserved for phase 2 and refused in phase 1. */
+/**
+* Reserved for phase 2 and refused in phase 1, by a reader too: an app that names a price or a recovery key asks for
+* something this client cannot honour, so it is not one to ignore.
+*/
 var RESERVED = ["price", "recovery"];
+/**
+* Keys refused in every mode and at any level, wherever a reader ignores unknown keys: kept and passed on, they would
+* name an object's prototype the moment anything spreads or assigns a manifest or a listing.
+*/
+var APP_FORBIDDEN_KEYS = [
+	"__proto__",
+	"constructor",
+	"prototype"
+];
+/**
+* The path of an `APP_FORBIDDEN_KEYS` key anywhere in a parsed JSON value (`later.0.__proto__`), the values of ignored
+* keys included, or undefined: WISP 1200 refuses them at any level. `JSON.parse` makes `__proto__` an own key, so
+* `Object.keys` sees it. A stack, not recursion: a `listing.json` is read with `JSON.parse` alone, at any depth.
+*/
+function findAppForbiddenKey(value) {
+	const stack = [[value, ""]];
+	for (let next = stack.pop(); next; next = stack.pop()) {
+		const [v, path] = next;
+		if (typeof v !== "object" || v === null) continue;
+		for (const key of Object.keys(v)) {
+			const at = path ? `${path}.${key}` : key;
+			if (APP_FORBIDDEN_KEYS.includes(key)) return at;
+			stack.push([v[key], at]);
+		}
+	}
+}
+/** At most this many clients in `runtime.clients`. */
+var MAX_CLIENTS = 16;
 var SEMVER = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$/;
 var HOST = /^>=(0|[1-9]\d*)\.(0|[1-9]\d*)(\.(0|[1-9]\d*))?$/;
 var SEGMENT = /^[A-Za-z0-9._-]+$/;
@@ -28563,21 +29059,30 @@ var bad = (field, detail = `${field} is not valid`) => ({
 	reason: "bad-field",
 	detail
 });
-/** Checks a parsed manifest against every rule and bound of WISP 1200 that the manifest alone decides. */
-function checkAppManifest(value) {
+/**
+* Checks a parsed manifest against every rule and bound of WISP 1200 that the manifest alone decides. An unknown key is
+* ignored unless `strict` (`AppManifestOptions`).
+*/
+function checkAppManifest(value, options = {}) {
 	if (!isObject$1(value)) return bad("manifest", "The manifest is not an object");
 	if (value.ghostlyApp !== void 0 && value.ghostlyApp !== 1) return {
 		ok: false,
 		reason: "unsupported-format",
 		detail: "ghostlyApp is not 1"
 	};
+	const forbidden = findAppForbiddenKey(value);
+	if (forbidden !== void 0) return {
+		ok: false,
+		reason: "unknown-key",
+		detail: forbidden
+	};
 	for (const key of Object.keys(value)) {
 		if (RESERVED.includes(key)) return {
 			ok: false,
 			reason: "reserved-key",
 			detail: key
 		};
-		if (!REQUIRED.includes(key) && !OPTIONAL.includes(key)) return {
+		if (options.strict && !REQUIRED.includes(key) && !OPTIONAL.includes(key)) return {
 			ok: false,
 			reason: "unknown-key",
 			detail: key
@@ -28602,9 +29107,18 @@ function checkAppManifest(value) {
 	if (!Array.isArray(permissions) || new Set(permissions).size !== permissions.length || !permissions.every((p) => APP_PERMISSIONS.includes(p))) return bad("permissions");
 	if (m.view !== void 0 && !APP_VIEWS.includes(m.view)) return bad("view", `view is "chat" or "full"`);
 	const runtime = m.runtime;
-	if (!isObject$1(runtime) || Object.keys(runtime).length !== 2 || typeof runtime.host !== "string" || !HOST.test(runtime.host)) return bad("runtime");
+	if (!isObject$1(runtime)) return bad("runtime");
+	for (const key of Object.keys(runtime)) {
+		if (key === "host" || key === "clients") continue;
+		if (options.strict) return {
+			ok: false,
+			reason: "unknown-key",
+			detail: `runtime.${key}`
+		};
+	}
+	if (typeof runtime.host !== "string" || !HOST.test(runtime.host)) return bad("runtime");
 	const clients = runtime.clients;
-	if (!Array.isArray(clients) || clients.length < 1 || new Set(clients).size !== clients.length || !clients.every((c) => APP_CLIENTS.includes(c))) return bad("runtime");
+	if (!Array.isArray(clients) || clients.length < 1 || clients.length > MAX_CLIENTS || new Set(clients).size !== clients.length || !clients.every((c) => options.strict ? APP_CLIENTS.includes(c) : typeof c === "string" && APP_CLIENT_NAME.test(c))) return bad("runtime");
 	if (!isAppLicense(m.license)) return bad("license");
 	if (m.sources !== void 0 && (!Array.isArray(m.sources) || m.sources.length > APP_BUNDLE_LIMITS.sources || !m.sources.every(isAppUrl))) return bad("sources");
 	if (m.homepage !== void 0 && !isAppUrl(m.homepage)) return bad("homepage");
@@ -28817,8 +29331,14 @@ var isLine = (v, max, min = 0) => typeof v === "string" && [...v].length >= min
 var isText = (v, max) => typeof v === "string" && [...v].length <= max && !/[^\P{Cc}\n]/u.test(v);
 var isCount = (v, min) => typeof v === "number" && Number.isSafeInteger(v) && v >= min;
 var fine = { ok: true };
-function keysOf(value, required, optional) {
-	for (const k of Object.keys(value)) if (!required.includes(k) && !optional.includes(k)) return {
+function keysOf(value, required, optional, options = {}) {
+	const forbidden = findAppForbiddenKey(value);
+	if (forbidden !== void 0) return {
+		ok: false,
+		reason: "unknown-key",
+		detail: forbidden
+	};
+	for (const k of Object.keys(value)) if (options.strict && !required.includes(k) && !optional.includes(k)) return {
 		ok: false,
 		reason: "unknown-key",
 		detail: k
@@ -28845,14 +29365,14 @@ var LISTING_OPTIONAL = [
 	"repo",
 	"support"
 ];
-/** Checks one entry of `apps`, which is also the whole of a `listing.json`. */
-function checkAppListing(value) {
+/** Checks one entry of `apps`, which is also the whole of a `listing.json`. An unknown key is ignored unless `strict`. */
+function checkAppListing(value, options = {}) {
 	if (!isObject(value)) return {
 		ok: false,
 		reason: "bad-field",
 		detail: "A listing is not an object"
 	};
-	const keys = keysOf(value, LISTING_REQUIRED, LISTING_OPTIONAL);
+	const keys = keysOf(value, LISTING_REQUIRED, LISTING_OPTIONAL, options);
 	if (!keys.ok) return keys;
 	const bad = (field) => ({
 		ok: false,
@@ -28874,7 +29394,7 @@ function checkAppListing(value) {
 	for (const k of ["repo", "support"]) if (value[k] !== void 0 && !isAppUrl(value[k])) return bad(k);
 	return fine;
 }
-function checkRemoval(value) {
+function checkRemoval(value, options) {
 	if (!isObject(value)) return {
 		ok: false,
 		reason: "bad-field",
@@ -28885,7 +29405,7 @@ function checkRemoval(value) {
 		"digest",
 		"reason",
 		"at"
-	], []);
+	], [], options);
 	if (!keys.ok) return keys;
 	if (!isAppRef(value.ref) || !isAppHash(value.digest) || !isLine(value.reason, APP_STORE_LIMITS.reason, 1) || !isCount(value.at, 0)) return {
 		ok: false,
@@ -28907,9 +29427,11 @@ var STORE_REQUIRED = [
 ];
 /**
 * Checks an index's fields and bounds, and every revocation it carries (one that does not verify refuses the index:
-* the store copied it, so a broken one is the store's fault). The signature and `expires` are `readAppStore`'s.
+* the store copied it, so a broken one is the store's fault). The signature and `expires` are `readAppStore`'s. An
+* unknown key of the index, a listing or a removal is ignored unless `strict`; a revocation is its publisher's signed
+* statement and keeps its exact keys.
 */
-function checkAppStoreIndex(value) {
+function checkAppStoreIndex(value, options = {}) {
 	if (!isObject(value)) return {
 		ok: false,
 		reason: "bad-field",
@@ -28920,7 +29442,7 @@ function checkAppStoreIndex(value) {
 		reason: "unsupported-format",
 		detail: "ghostlyStore is not 1"
 	};
-	const keys = keysOf(value, STORE_REQUIRED, ["description"]);
+	const keys = keysOf(value, STORE_REQUIRED, ["description"], options);
 	if (!keys.ok) return keys;
 	const bad = (field) => ({
 		ok: false,
@@ -28937,7 +29459,7 @@ function checkAppStoreIndex(value) {
 	if (!Array.isArray(apps) || apps.length > APP_STORE_LIMITS.apps) return bad("apps");
 	const refs = /* @__PURE__ */ new Set();
 	for (const listing of apps) {
-		const checked = checkAppListing(listing);
+		const checked = checkAppListing(listing, options);
 		if (!checked.ok) return checked;
 		const ref = listing.ref;
 		if (refs.has(ref)) return {
@@ -28949,7 +29471,7 @@ function checkAppStoreIndex(value) {
 	}
 	if (!Array.isArray(removed) || removed.length > APP_STORE_LIMITS.removed) return bad("removed");
 	for (const entry of removed) {
-		const checked = checkRemoval(entry);
+		const checked = checkRemoval(entry, options);
 		if (!checked.ok) return checked;
 	}
 	if (!Array.isArray(revoked) || revoked.length > APP_STORE_LIMITS.revoked) return bad("revoked");
@@ -28966,7 +29488,8 @@ function checkAppStoreIndex(value) {
 /**
 * Reads `ghostly-store.json` with its `ghostly-store.sig`, in this order: size, JSON, canonical bytes, fields and
 * revocations, the signature statement, the key the reader holds for this store (when it holds one), the signature,
-* then `expires` against `now` (seconds): more than 90 days ahead is refused, past is `expired`.
+* then `expires` against `now` (seconds): more than 90 days ahead is refused, past is `expired`. A key it does not know
+* is ignored (a later store's optional field) and stays in the bytes the signature covers.
 */
 function readAppStore(indexBytes, sigBytes, now, heldKey) {
 	if (indexBytes.length > APP_STORE_LIMITS.indexBytes) return {
@@ -29000,10 +29523,13 @@ function readAppStore(indexBytes, sigBytes, now, heldKey) {
 		}
 	};
 }
-/** Signs an index with the store key: its canonical bytes and the `ghostly-store.sig` bytes. Throws on a bad index. */
+/**
+* Signs an index with the store key: its canonical bytes and the `ghostly-store.sig` bytes. Throws on a bad index, and
+* on a key this format does not define: a writer is strict, so a misspelt key is never signed.
+*/
 async function signAppStore(index, signer) {
 	if (index.key !== toZ32(signer.publicKey)) throw new Error("A store index is signed by its own key");
-	const checked = checkAppStoreIndex(JSON.parse(JSON.stringify(index)));
+	const checked = checkAppStoreIndex(JSON.parse(JSON.stringify(index)), { strict: true });
 	if (!checked.ok) throw new Error(`Not a valid store index (${checked.reason}${checked.detail ? `: ${checked.detail}` : ""})`);
 	const { bytes, signature } = await signAppObject(APP_PREFIXES.store, index, signer);
 	return {
@@ -29074,6 +29600,6 @@ function appStoreDecision(held, read) {
 	return read.digest === held.digest ? "same" : "equivocation";
 }
 //#endregion
-export { parseSshPublicKey as $, signAppRevocation as $a, formatFileSize as $i, GROUP_FILE_LIMITS as $n, handoffEphemeral as $o, WAKE_CALL_INTERVAL_MS as $r, deviceKeyZ32 as $s, SEPOLIA_TEST_USDT_FAUCET as $t, entryParams as A, replySnippet as Aa, createRelayPayload as Ac, IdentityExchange as Ai, nip05RootKey as An, LEGACY_SERVICES as Ao, newerHead as Ar, enrollCancelReason as As, didWebDocumentUrl as At, GROUP_REACTED_FRAME as B, claimedTime as Ba, sanitizeAvatar as Bc, emptyProofLedger as Bi, engineText as Bn, HANDOFF_REQUEST as Bo, transferStalled as Br, deviceInviteJoinerParams as Bs, staticDidDocument as Bt, GROUP_READ_NOTE_COMMUNITY as C, reactionEmoji as Ca, setLinkTraceSink as Cc, DHT_TEXT_CAPABILITY as Ci, DOMAIN_FILE_MAX_BYTES as Cn, callRtcConfig as Co, beaconRecords as Cr, signTombstone as Cs, DID_JWS_MAX_LENGTH as Ct, KNOCK_TTL_MS as D, wireReaction as Da, withRequestOptions as Dc, IDENTITY_MAX_VALIDITY as Di, domainWellKnownFile as Dn, signalHasVideo as Do, lobbyRecords as Dr, ENROLL_HELLO as Ds, didGhostlyServiceEntry as Dt, encodeCommunityLink as E, validReactionNumber as Ea, isDiscoveryBudgetError as Ec, IDENTITY_MAX_EVIDENCE as Ei, domainTxtRecord as En, parseCallSignal as Eo, lobbyKeys as Er, ENROLL_GRANT as Es, checkDidSignature as Et, GROUP_WAKE_FRAME as F, buttonLabelClash as Fa, identityFromSeed as Fc, newIdentityBinding as Fi, txtValue as Fn, HANDOFF_HAVE as Fo, readLobby as Fr, enrollProofFrame as Fs, normalizeDid as Ft, GROUP_EDIT_TEXT_BYTES as G, APP_STATEMENT_LIMITS as Ga, toZ32 as Gc, irohRelayUrl as Gi, findEndpoint as Gn, handoffAttemptFailed as Go, typingActivity as Gr, encodeInviteCode as Gs, encodeDidDhtPacket as Gt, GroupSession as H, receivedTimestamp as Ha, fromBase64Url as Hc, TRANSPORTS as Hi, ENDPOINT as Hn, HANDOFF_VERIFIED as Ho, TYPING_REFRESH_MS as Hr, OwnInviteError as Hs, didDhtDocument as Ht, GroupWakeLimiter as I, checkStatusCard as Ia, identityFromSeedB64 as Ic, receivedIdentityStatus as Ii, wellKnownUrl as In, HANDOFF_HELLO as Io, shouldBeHub as Ir, readEnrollGrant as Is, parseDid as It, mentionsMember as J, checkAppRevokeStatement as Ja, peekDhtMailbox as Ji, parseFedimintRequestPayload as Jn, handoffCancelFrame as Jo, mayPin as Jr, DEVICES_CAPABILITY as Js, ETHEREUM_USDT as Jt, carryMentions as K, appFingerprint as Ka, utf8Decode as Kc, DHT_FILE_TOO_LARGE as Ki, isFederationId as Kn, handoffAttemptSucceeded as Ko, GROUP_PIN_FRAME as Kr, inviteLink as Ks, resolveDidDht as Kt, groupWakeFrame as L, sameButtonText as La, publicKeyFromZ32 as Lc, revokesIdentity as Li, requestLnurlInvoice as Ln, HANDOFF_OFFER as Lo, ChatFiles as Lr, readEnrollHello as Ls, parseDidDocument as Lt, knockRecords as M, ITEM_STATES as Ma, openRelayPayload as Mc, emptyIdentityLedger as Mi, recordsFromTxt as Mn, HANDOFF_ACK as Mo, rankHubs as Mr, enrollDoneFrame as Ms, didWebFileNames as Mt, mergeKnocks as N, RUN_RESULTS as Na, parseRelayPayload as Nc, identityRevocationValue as Ni, recordsFromWellKnown as Nn, HANDOFF_CANCEL as No, readBeacon as Nr, enrollGrantFrame as Ns, didWebFileUrl as Nt, decodeGroupEntryLink as O, pairedReplyAuthor as Oa, PacketTooLargeError as Oc, IDENTITY_REVOCATION_LABEL as Oi, encodeDnsQuery as On, emptyLinkRecords as Oo, mergeBeacon as Or, ENROLL_PROOF as Os, didJwsAlg as Ot, readKnocks as P, STATUS_CARD_LIMITS as Pa, createIdentity as Pc, identityStatement as Pi, recordsName as Pn, HANDOFF_DONE as Po, readBeaconHead as Pr, enrollHelloFrame as Ps, didWebHost as Pt, SshSigError as Q, signAppObject as Qa, readImageMeta as Qi, pairedMessageFrame as Qn, handoffDigest as Qo, readPin as Qr, deviceEchoNonce as Qs, SEPOLIA_TEST_USDT as Qt, groupWakes as R, statusCardText as Ra, verify as Rc, lastSharedWithMe as Ri, resolveLightningDestination as Rn, HANDOFF_PAKE as Ro, FILE_LIMITS as Rr, verifyEnrollProof as Rs, parseDidSignaturePaste as Rt, CommunitySession as S, queueReaction as Sa, normalizeRelayUrl as Sc, CapsExchange as Si, pubkyHomeserverOf as Sn, buildSdpFromSignal as So, beaconKeys as Sr, setUpdateFrame as Ss, DID_FILE_MAX_BYTES as St, decodeCommunityLink as T, readReaction as Ta, budgetRetryMs as Tc, dialDescriptors as Ti, dnsProofName as Tn, extractParamsFromSdp as To, freshHubs as Tr, ENROLL_DONE as Ts, checkDidJws as Tt, COMMUNITY_EDIT_FRAME as U, shownTime as Ua, randomBytes as Uc, automaticTransport as Ui, cashuRequestPayload as Un, filePartName as Uo, TypingSender as Ur, createChatInvite as Us, didDhtFromPublicKey as Ut, GROUP_READ_NOTE as V, heardTime as Va, bytesEqual as Vc, validExternalKey as Vi, decodeBolt11 as Vn, HANDOFF_TIMINGS as Vo, TYPING_KINDS as Vr, readDeviceInvite as Vs, strictBase64Url as Vt, GROUP_EDIT_FRAME as W, APP_PREFIXES as Wa, toBase64Url as Wc, irohDescriptor as Wi, fedimintRequestPayload as Wn, handoffAttemptAllowed as Wo, sanitizeTypingStatus as Wr, decodeInviteCode as Ws, encodeDidDhtDeactivated as Wt, SSHSIG_MAX_ARMOR as X, isAppRef as Xa, dhtFileId as Xi, INVITE_TAKEN as Xn, handoffContextProof as Xo, pinIsNewer as Xr, HANDOFF_CAPABILITY as Xs, ONCHAIN_PROVIDER as Xt, groupName as Y, isAppKey as Ya, DHT_FILE_CAPABILITY as Yi, GhostLink as Yn, handoffContext as Yo, nextPinNumber as Yr, ENROLL_CAPABILITY as Ys, EVM_TEST_CHAINS as Yt, SSHSIG_NAMESPACE as Z, readAppRevocations as Za, parseImageMeta as Zi, LIVENESS_PING_MS as Zn, handoffDataFrame as Zo, pinNumberHolds as Zr, deviceEchoFrame as Zs, PaymentPreflightError as Zt, GroupTypingBoard as _, COMMUNITY_REACTION_FRAME as _a, turnKeys as _c, HOLD_LIMITS as _i, normalizePubkyKey as _n, decodeControl as _o, MESH_HUBS as _r, sealHandoffPiece as _s, parseAtprotoDidDocument as _t, checkAppStoreIndex as a, baseMime as aa, TURN_PUT_WINDOW_MS as ac, wakeRequest as ai, formatPaymentAmount as an, rosterHas as ao, isGroupMessageId as ar, handoffRetryAfter as as, BitcoinAddressError as at, sealGroupTyping as b, ReactionWindow as ba, RelayTransport as bc, newMailbox as bi, pubkyProofPath as bn, RTC_CONFIG as bo, pickMeshHubs as br, readSetUpdate as bs, verifyAtprotoRecordProof as bt, APP_BUNDLE_LIMITS as c, voicePeaksOf as ca, classifyTurnRead as cc, chatAppId as ci, SPARK_NETWORKS as cn, DirectPathWatch as co, readGroupWant as cr, newHandoffId as cs, ATPROTO_FULL_SCOPE as ct, appViewOf as d, EDIT_RATE_WINDOW_MS as da, TURN_MAX as dc, BUTTONS_CAPABILITY as di, sparkInvoiceDetails as dn, presenceSeenAt as do, GROUP_SIGNAL_FRAME as dr, readHandoffDone as ds, atprotoDidMethod as dt, safeBlobType as ea, deviceLinkPairing as ec, WakeLimiter as ei, TEST_USDT_FAUCET_AMOUNT as en, canonicalJson as eo, GROUP_HAVE_FRAME as er, handoffHelloFrame as es, parseSshSignature as et, assembleAppBundle as f, RateWindow as fa, firstDeviceSetSecret as fc, EDIT_CAPABILITY as fi, isBitcoinAddress as fn, GhostlyHttpError as fo, SIGNAL_FRESH_MS as fr, readHandoffHave as fs, atprotoProofRecord as ft, GROUP_TYPING_FRAME as g, readForwarded as ga, signTurnRelease as gc, HOLD_DATED_BACK_MS as gi, newPubkyProofFolder as gn, LIMITS as go, readGroupSignal as gr, readHandoffVerified as gs, normalizeAtprotoHandle as gt, readAppBundle as h, forwardedAgain as ha, signTurnPacket as hc, HOLD_CAPABILITY as hi, isPubkyProofFolder as hn, webLocalFetch as ho, groupSignalFrame as hr, readHandoffTurnFrame as hs, isAtprotoDid as ht, planAppUpdate as i, VOICE_LIMITS as ia, webCryptoSigner as ic, relayRequest as ii, assertWholeSats as in, MEMBER_KEY as io, groupFileFallback as ir, handoffReleaseFrame as is, verifyBitcoinMessage as it, knockIdentity as j, BUTTON_ID as ja, newerPacket as jc, boundVerifiedIdentity as ji, normalizeDomain as jn, serviceIdFromName as jo, pickHubs as jr, enrollDigits as js, didWebFile as jt, encodeGroupEntryLink as k, readReply as ka, RELAY_PAYLOAD_MAX_BYTES as kc, IdentityCheckUnavailable as ki, isPublicAddress as kn, HTTP_SERVICE_PROTO as ko, mergeLobby as kr, enrollCancelFrame as ks, didSignedMessages as kt, APP_BUNDLE_MAGIC as l, parseVideoMeta as la, turnPutSummary as lc, isAppVersion as li, SPARK_PROVIDER as ln, EXPECT_PEER_MS as lo, readGroupWantNo as lr, readHandoffAck as ls, ATPROTO_PROOF_COLLECTION as lt, isAppUrl as m, parseLinkPreview as ma, readTurnPacket as mc, UPGRADE_CAPABILITY as mi, isPubkyKey as mn, parseLocalTarget as mo, SIGNAL_REPLY_MS as mr, readHandoffPake as ms, checkAtprotoProofRecord as mt, appUpdateDecision as n, sanitizeMime as na, newDeviceSetSecret as nc, newWakeToken as ni, WALLET_NETWORKS as nn, GROUP_MEMBER_CAP as no, GROUP_WANT_NO_FRAME as nr, handoffOfferFrame as ns, sshSignCommand as nt, readAppStore as o, fileMessageText as oa, TURN_RAISE_READ_TIMEOUT_MS as oc, checkPushEndpoint as oi, validatePaymentTarget as on, verifyCommitSignature as oo, readGroupFileMeta as or, handoffStreamKey as os, decodeAnyBitcoinAddress as ot, checkAppManifest as p, dhtEditId as pa, nextTurnPosition as pc, STATUS_CARD_CAPABILITY as pi, PUBKY_PROOF_MAX_BYTES as pn, formatLocalTarget as po, SIGNAL_HOLD_MS as pr, readHandoffHello as ps, atprotoProofRkey as pt, parseCommunityEdit as q, appRef as qa, utf8Encode as qc, DHT_MESSAGE_TTL as qi, parseCashuRequestPayload as qn, handoffBusyFrame as qo, PIN_LIMITS as qr, inviteOwnership as qs, signDidDhtPacket as qt, checkAppBeforeRun as r, PLAYABLE_AUDIO as ra, seedSigner as rc, parseWakeFrame as ri, assertTokenUnits as rn, MAX_GROUP_CHAIN as ro, fetchesByItself as rr, handoffPakeFrame as rs, verifySshSignature as rt, signAppStore as s, parseVoiceMeta as sa, TURN_SETTLE_MS as sc, vapidKeysMatch as si, walletNetworkOf as sn, edgeParams as so, readGroupHave as sr, handoffVersions as ss, ATPROTO_DECLARED_SCOPE as st, appStoreDecision as t, sanitizeFileName as ta, devicePingFrame as tc, deviceWakeRequest as ti, USDT_PUBLIC_RPC as tn, canonicalJsonBytes as to, GROUP_WANT_FRAME as tr, handoffManifestFrames as ts, sameSshKey as tt, appDigest as u, EDIT_BUFFER_MS as ua, TURN_LAST_SEQUENCE as uc, APPS_CAPABILITY as ui, sparkAddressKind as un, RELAY_POLL_INTERVALS as uo, CarriedTransport as ur, readHandoffCancel as us, ATPROTO_PROOF_SCOPE as ut, groupTypingEpoch as v, GROUP_REACTION_FRAME as va, turnName as vc, HoldKeys as vi, pubkyProofCapability as vn, encodeControl as vo, mayBeHub as vr, SET_ACK as vs, shortAtprotoDid as vt, communityHasFrame as w, reactionIsNewer as wa, traceLink as wc, capsDescriptors as wi, decodeDnsResponse as wn, callSignalHeardAt as wo, doorHubs as wr, verifySetUpdate as ws, DidError as wt, COMMUNITY_LIMITS as x, nextReactionNumber as xa, currentRelays as xc, readManifest as xi, homeserverWebEndpoint as xn, answersOffer as xo, COMMUNITY_TOPOLOGY as xr, setAckFrame as xs, DID_DOCUMENT_MAX_BYTES as xt, openGroupTyping as y, REACTION_LIMITS as ya, DEFAULT_RELAYS as yc, HoldRefusedError as yi, pubkyProofFile as yn, CALL_SIGNAL_MAX_AGE_MS as yo, meshHubs as yr, SET_UPDATE as ys, AtprotoProofError as yt, parseGroupWakeFrame as z, arrivalKey as za, MAX_AVATAR_LENGTH as zc, PeerProofs as zi, engineError as zn, HANDOFF_PIECE_BYTES as zo, transferEnded as zr, createDeviceInvite as zs, signingKeys as zt };
+export { SSHSIG_NAMESPACE as $, readAppRevocations as $a, parseImageMeta as $i, engineError as $n, handoffContextProof as $o, pinNumberHolds as $r, HANDOFF_CAPABILITY as $s, PaymentPreflightError as $t, decodeGroupEntryLink as A, pairedReplyAuthor as Aa, withRequestOptions as Ac, IDENTITY_REVOCATION_LABEL as Ai, encodeDnsQuery as An, signalHasVideo as Ao, mergeBeacon as Ar, ENROLL_HELLO as As, didJwsAlg as At, groupWakes as B, statusCardText as Ba, publicKeyFromZ32 as Bc, lastSharedWithMe as Bi, resolveLightningDestination as Bn, HANDOFF_OFFER as Bo, FILE_LIMITS as Br, readEnrollHello as Bs, parseDidSignaturePaste as Bt, COMMUNITY_LIMITS as C, nextReactionNumber as Ca, RelayTransport as Cc, readManifest as Ci, homeserverWebEndpoint as Cn, RTC_CONFIG as Co, COMMUNITY_TOPOLOGY as Cr, readSetUpdate as Cs, DID_DOCUMENT_MAX_BYTES as Ct, decodeCommunityLink as D, readReaction as Da, traceLink as Dc, dialDescriptors as Di, dnsProofName as Dn, callSignalHeardAt as Do, freshHubs as Dr, verifySetUpdate as Ds, checkDidJws as Dt, communityHasFrame as E, reactionIsNewer as Ea, setLinkTraceSink as Ec, capsDescriptors as Ei, decodeDnsResponse as En, callRtcConfig as Eo, doorHubs as Er, signTombstone as Es, DidError as Et, mergeKnocks as F, RUN_RESULTS as Fa, openRelayPayload as Fc, identityRevocationValue as Fi, recordsFromWellKnown as Fn, HANDOFF_ACK as Fo, readBeacon as Fr, enrollDoneFrame as Fs, didWebFileUrl as Ft, COMMUNITY_EDIT_FRAME as G, shownTime as Ga, fromBase64Url as Gc, automaticTransport as Gi, findEndpoint as Gn, HANDOFF_VERIFIED as Go, TypingSender as Gr, OwnInviteError as Gs, didDhtFromPublicKey as Gt, GROUP_REACTED_FRAME as H, claimedTime as Ha, MAX_AVATAR_LENGTH as Hc, emptyProofLedger as Hi, ENDPOINT as Hn, HANDOFF_PIECE_BYTES as Ho, transferStalled as Hr, createDeviceInvite as Hs, staticDidDocument as Ht, readKnocks as I, STATUS_CARD_LIMITS as Ia, parseRelayPayload as Ic, identityStatement as Ii, recordsName as In, HANDOFF_CANCEL as Io, readBeaconHead as Ir, enrollGrantFrame as Is, didWebHost as It, carryMentions as J, appFingerprint as Ja, toZ32 as Jc, DHT_FILE_TOO_LARGE as Ji, parseFedimintRequestPayload as Jn, handoffAttemptFailed as Jo, GROUP_PIN_FRAME as Jr, encodeInviteCode as Js, resolveDidDht as Jt, GROUP_EDIT_FRAME as K, APP_PREFIXES as Ka, randomBytes as Kc, irohDescriptor as Ki, isFederationId as Kn, filePartName as Ko, sanitizeTypingStatus as Kr, createChatInvite as Ks, encodeDidDhtDeactivated as Kt, GROUP_WAKE_FRAME as L, buttonLabelClash as La, createIdentity as Lc, newIdentityBinding as Li, txtValue as Ln, HANDOFF_DONE as Lo, readLobby as Lr, enrollHelloFrame as Ls, normalizeDid as Lt, entryParams as M, replySnippet as Ma, RELAY_PAYLOAD_MAX_BYTES as Mc, IdentityExchange as Mi, nip05RootKey as Mn, HTTP_SERVICE_PROTO as Mo, newerHead as Mr, enrollCancelFrame as Ms, didWebDocumentUrl as Mt, knockIdentity as N, BUTTON_ID as Na, createRelayPayload as Nc, boundVerifiedIdentity as Ni, normalizeDomain as Nn, LEGACY_SERVICES as No, pickHubs as Nr, enrollCancelReason as Ns, didWebFile as Nt, encodeCommunityLink as O, validReactionNumber as Oa, budgetRetryMs as Oc, IDENTITY_MAX_EVIDENCE as Oi, domainTxtRecord as On, extractParamsFromSdp as Oo, lobbyKeys as Or, ENROLL_DONE as Os, checkDidSignature as Ot, knockRecords as P, ITEM_STATES as Pa, newerPacket as Pc, emptyIdentityLedger as Pi, recordsFromTxt as Pn, serviceIdFromName as Po, rankHubs as Pr, enrollDigits as Ps, didWebFileNames as Pt, SSHSIG_MAX_ARMOR as Q, isAppRef as Qa, dhtFileId as Qi, pairedMessageFrame as Qn, handoffContext as Qo, pinIsNewer as Qr, ENROLL_CAPABILITY as Qs, ONCHAIN_PROVIDER as Qt, GroupWakeLimiter as R, checkStatusCard as Ra, identityFromSeed as Rc, receivedIdentityStatus as Ri, wellKnownUrl as Rn, HANDOFF_HAVE as Ro, shouldBeHub as Rr, enrollProofFrame as Rs, parseDid as Rt, sealGroupTyping as S, ReactionWindow as Sa, DEFAULT_RELAYS as Sc, newMailbox as Si, pubkyProofPath as Sn, CALL_SIGNAL_MAX_AGE_MS as So, pickMeshHubs as Sr, SET_UPDATE as Ss, verifyAtprotoRecordProof as St, GROUP_READ_NOTE_COMMUNITY as T, reactionEmoji as Ta, normalizeRelayUrl as Tc, DHT_TEXT_CAPABILITY as Ti, DOMAIN_FILE_MAX_BYTES as Tn, buildSdpFromSignal as To, beaconRecords as Tr, setUpdateFrame as Ts, DID_JWS_MAX_LENGTH as Tt, GROUP_READ_NOTE as U, heardTime as Ua, sanitizeAvatar as Uc, validExternalKey as Ui, cashuRequestPayload as Un, HANDOFF_REQUEST as Uo, TYPING_KINDS as Ur, deviceInviteJoinerParams as Us, strictBase64Url as Ut, parseGroupWakeFrame as V, arrivalKey as Va, verify as Vc, PeerProofs as Vi, decodeBolt11 as Vn, HANDOFF_PAKE as Vo, transferEnded as Vr, verifyEnrollProof as Vs, signingKeys as Vt, GroupSession as W, receivedTimestamp as Wa, bytesEqual as Wc, TRANSPORTS as Wi, fedimintRequestPayload as Wn, HANDOFF_TIMINGS as Wo, TYPING_REFRESH_MS as Wr, readDeviceInvite as Ws, didDhtDocument as Wt, mentionsMember as X, checkAppRevokeStatement as Xa, utf8Encode as Xc, peekDhtMailbox as Xi, INVITE_TAKEN as Xn, handoffBusyFrame as Xo, mayPin as Xr, inviteOwnership as Xs, ETHEREUM_USDT as Xt, parseCommunityEdit as Y, appRef as Ya, utf8Decode as Yc, DHT_MESSAGE_TTL as Yi, GhostLink as Yn, handoffAttemptSucceeded as Yo, PIN_LIMITS as Yr, inviteLink as Ys, signDidDhtPacket as Yt, groupName as Z, isAppKey as Za, DHT_FILE_CAPABILITY as Zi, LIVENESS_PING_MS as Zn, handoffCancelFrame as Zo, nextPinNumber as Zr, DEVICES_CAPABILITY as Zs, EVM_TEST_CHAINS as Zt, readAppBundle as _, forwardedAgain as _a, readTurnPacket as _c, HOLD_CAPABILITY as _i, isPubkyProofFolder as _n, parseLocalTarget as _o, groupSignalFrame as _r, readHandoffPake as _s, isAtprotoDid as _t, planAppUpdate as a, PLAYABLE_AUDIO as aa, newDeviceSetSecret as ac, parseWakeFrame as ai, assertTokenUnits as an, MAX_GROUP_CHAIN as ao, fetchesByItself as ar, handoffOfferFrame as as, verifySshSignature as at, groupTypingEpoch as b, GROUP_REACTION_FRAME as ba, turnKeys as bc, HoldKeys as bi, pubkyProofCapability as bn, decodeControl as bo, mayBeHub as br, sealHandoffPiece as bs, shortAtprotoDid as bt, signAppStore as c, fileMessageText as ca, TURN_PUT_WINDOW_MS as cc, checkPushEndpoint as ci, validatePaymentTarget as cn, verifyCommitSignature as co, readGroupFileMeta as cr, handoffRetryAfter as cs, decodeAnyBitcoinAddress as ct, APP_ICON_PATH as d, parseVideoMeta as da, classifyTurnRead as dc, isAppVersion as di, SPARK_PROVIDER as dn, DHT_POLL_INTERVALS as do, readGroupWantNo as dr, newHandoffId as ds, ATPROTO_PROOF_COLLECTION as dt, readImageMeta as ea, deviceEchoFrame as ec, readPin as ei, SEPOLIA_TEST_USDT as en, signAppObject as eo, engineText as er, handoffDataFrame as es, SshSigError as et, appDigest as f, EDIT_BUFFER_MS as fa, turnPutSummary as fc, APPS_CAPABILITY as fi, sparkAddressKind as fn, EXPECT_PEER_MS as fo, CarriedTransport as fr, readHandoffAck as fs, ATPROTO_PROOF_SCOPE as ft, isAppUrl as g, parseLinkPreview as ga, nextTurnPosition as gc, UPGRADE_CAPABILITY as gi, isPubkyKey as gn, formatLocalTarget as go, SIGNAL_REPLY_MS as gr, readHandoffHello as gs, checkAtprotoProofRecord as gt, checkAppManifest as h, dhtEditId as ha, firstDeviceSetSecret as hc, STATUS_CARD_CAPABILITY as hi, PUBKY_PROOF_MAX_BYTES as hn, GhostlyHttpError as ho, SIGNAL_HOLD_MS as hr, readHandoffHave as hs, atprotoProofRkey as ht, checkAppBeforeRun as i, sanitizeMime as ia, devicePingFrame as ic, newWakeToken as ii, WALLET_NETWORKS as in, GROUP_MEMBER_CAP as io, GROUP_WANT_NO_FRAME as ir, handoffManifestFrames as is, sshSignCommand as it, encodeGroupEntryLink as j, readReply as ja, PacketTooLargeError as jc, IdentityCheckUnavailable as ji, isPublicAddress as jn, emptyLinkRecords as jo, mergeLobby as jr, ENROLL_PROOF as js, didSignedMessages as jt, KNOCK_TTL_MS as k, wireReaction as ka, isDiscoveryBudgetError as kc, IDENTITY_MAX_VALIDITY as ki, domainWellKnownFile as kn, parseCallSignal as ko, lobbyRecords as kr, ENROLL_GRANT as ks, didGhostlyServiceEntry as kt, APP_BUNDLE_LIMITS as l, parseVoiceMeta as la, TURN_RAISE_READ_TIMEOUT_MS as lc, vapidKeysMatch as li, walletNetworkOf as ln, edgeParams as lo, readGroupHave as lr, handoffStreamKey as ls, ATPROTO_DECLARED_SCOPE as lt, assembleAppBundle as m, RateWindow as ma, TURN_MAX as mc, EDIT_CAPABILITY as mi, isBitcoinAddress as mn, presenceSeenAt as mo, SIGNAL_FRESH_MS as mr, readHandoffDone as ms, atprotoProofRecord as mt, appStoreDecision as n, safeBlobType as na, deviceKeyZ32 as nc, WakeLimiter as ni, TEST_USDT_FAUCET_AMOUNT as nn, canonicalJson as no, GROUP_HAVE_FRAME as nr, handoffEphemeral as ns, parseSshSignature as nt, checkAppStoreIndex as o, VOICE_LIMITS as oa, seedSigner as oc, relayRequest as oi, assertWholeSats as on, MEMBER_KEY as oo, groupFileFallback as or, handoffPakeFrame as os, verifyBitcoinMessage as ot, appViewOf as p, EDIT_RATE_WINDOW_MS as pa, TURN_LAST_SEQUENCE as pc, BUTTONS_CAPABILITY as pi, sparkInvoiceDetails as pn, RELAY_POLL_INTERVALS as po, GROUP_SIGNAL_FRAME as pr, readHandoffCancel as ps, atprotoDidMethod as pt, GROUP_EDIT_TEXT_BYTES as q, APP_STATEMENT_LIMITS as qa, toBase64Url as qc, irohRelayUrl as qi, parseCashuRequestPayload as qn, handoffAttemptAllowed as qo, typingActivity as qr, decodeInviteCode as qs, encodeDidDhtPacket as qt, appUpdateDecision as r, sanitizeFileName as ra, deviceLinkPairing as rc, deviceWakeRequest as ri, USDT_PUBLIC_RPC as rn, canonicalJsonBytes as ro, GROUP_WANT_FRAME as rr, handoffHelloFrame as rs, sameSshKey as rt, readAppStore as s, baseMime as sa, webCryptoSigner as sc, wakeRequest as si, formatPaymentAmount as sn, rosterHas as so, isGroupMessageId as sr, handoffReleaseFrame as ss, BitcoinAddressError as st, appRevocationFor as t, formatFileSize as ta, deviceEchoNonce as tc, WAKE_CALL_INTERVAL_MS as ti, SEPOLIA_TEST_USDT_FAUCET as tn, signAppRevocation as to, GROUP_FILE_LIMITS as tr, handoffDigest as ts, parseSshPublicKey as tt, APP_BUNDLE_MAGIC as u, voicePeaksOf as ua, TURN_SETTLE_MS as uc, chatAppId as ui, SPARK_NETWORKS as un, DirectPathWatch as uo, readGroupWant as ur, handoffVersions as us, ATPROTO_FULL_SCOPE as ut, GROUP_TYPING_FRAME as v, readForwarded as va, signTurnPacket as vc, HOLD_DATED_BACK_MS as vi, newPubkyProofFolder as vn, webLocalFetch as vo, readGroupSignal as vr, readHandoffTurnFrame as vs, normalizeAtprotoHandle as vt, CommunitySession as w, queueReaction as wa, currentRelays as wc, CapsExchange as wi, pubkyHomeserverOf as wn, answersOffer as wo, beaconKeys as wr, setAckFrame as ws, DID_FILE_MAX_BYTES as wt, openGroupTyping as x, REACTION_LIMITS as xa, turnName as xc, HoldRefusedError as xi, pubkyProofFile as xn, encodeControl as xo, meshHubs as xr, SET_ACK as xs, AtprotoProofError as xt, GroupTypingBoard as y, COMMUNITY_REACTION_FRAME as ya, signTurnRelease as yc, HOLD_LIMITS as yi, normalizePubkyKey as yn, LIMITS as yo, MESH_HUBS as yr, readHandoffVerified as ys, parseAtprotoDidDocument as yt, groupWakeFrame as z, sameButtonText as za, identityFromSeedB64 as zc, revokesIdentity as zi, requestLnurlInvoice as zn, HANDOFF_HELLO as zo, ChatFiles as zr, readEnrollGrant as zs, parseDidDocument as zt };
 
-//# sourceMappingURL=src-DtxVo2Rm.js.map
+//# sourceMappingURL=src-BMUcYQ7b.js.map