@ghostlytools/cli 1.1.7 → 1.2.0

package/dist/ghostly.mjs

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { t as __exportAll } from "./assets/rolldown-runtime-8H4AJuhK.js";
-import { $ as parseSshPublicKey, $a as signAppRevocation, $n as GROUP_FILE_LIMITS, Aa as replySnippet, An as nip05RootKey, At as didWebDocumentUrl, Bc as sanitizeAvatar, Bn as engineText, Bt as staticDidDocument, Cc as setLinkTraceSink, Cn as DOMAIN_FILE_MAX_BYTES, Co as callRtcConfig, Dn as domainWellKnownFile, Do as signalHasVideo, Dt as didGhostlyServiceEntry, En as domainTxtRecord, Eo as parseCallSignal, Et as checkDidSignature, Fa as buttonLabelClash, Fn as txtValue, Ft as normalizeDid, Ga as APP_STATEMENT_LIMITS, Gc as toZ32, Gi as irohRelayUrl, Hc as fromBase64Url$1, Hr as TYPING_REFRESH_MS, Ia as checkStatusCard, In as wellKnownUrl, It as parseDid, Ja as checkAppRevokeStatement, Ka as appFingerprint, Kc as utf8Decode, Ks as inviteLink, Kt as resolveDidDht, Ln as requestLnurlInvoice, Lr as ChatFiles, Lt as parseDidDocument, Ma as ITEM_STATES, Mc as openRelayPayload, Mn as recordsFromTxt, Mt as didWebFileNames, Na as RUN_RESULTS, Nn as recordsFromWellKnown, Nt as didWebFileUrl, On as encodeDnsQuery, Ot as didJwsAlg, Pa as STATUS_CARD_LIMITS, Pi as identityStatement, Pn as recordsName, Pt as didWebHost, Q as SshSigError, Qa as signAppObject, Qi as readImageMeta, Rn as resolveLightningDestination, Rt as parseDidSignaturePaste, Sn as pubkyHomeserverOf, So as buildSdpFromSignal, St as DID_FILE_MAX_BYTES, Tn as dnsProofName, To as extractParamsFromSdp, Tt as checkDidJws, Uc as randomBytes$1, Vn as decodeBolt11, Vr as TYPING_KINDS, Vt as strictBase64Url, Wa as APP_PREFIXES, Wc as toBase64Url$1, Wi as irohDescriptor, Wr as sanitizeTypingStatus, Y as groupName, Z as SSHSIG_NAMESPACE, Za as readAppRevocations, _n as normalizePubkyKey, _t as parseAtprotoDidDocument, a as checkAppStoreIndex, aa as baseMime, ar as isGroupMessageId, at as BitcoinAddressError, bn as pubkyProofPath, bo as RTC_CONFIG, bt as verifyAtprotoRecordProof, c as APP_BUNDLE_LIMITS, ca as voicePeaksOf, cr as readGroupWant, ct as ATPROTO_FULL_SCOPE, di as BUTTONS_CAPABILITY, dt as atprotoDidMethod, eo as canonicalJson, er as GROUP_HAVE_FRAME, et as parseSshSignature, f as assembleAppBundle, fa as RateWindow, fo as GhostlyHttpError, ft as atprotoProofRecord, gn as newPubkyProofFolder, go as LIMITS, gt as normalizeAtprotoHandle, h as readAppBundle, hn as isPubkyProofFolder, ht as isAtprotoDid, ia as VOICE_LIMITS, ir as groupFileFallback, it as verifyBitcoinMessage, ji as boundVerifiedIdentity, jn as normalizeDomain, jt as didWebFile, kc as RELAY_PAYLOAD_MAX_BYTES, ki as IdentityCheckUnavailable, kn as isPublicAddress, kt as didSignedMessages, lr as readGroupWantNo, lt as ATPROTO_PROOF_COLLECTION, m as isAppUrl, mn as isPubkyKey, mt as checkAtprotoProofRecord, na as sanitizeMime, nn as WALLET_NETWORKS, nr as GROUP_WANT_NO_FRAME, nt as sshSignCommand, o as readAppStore, oa as fileMessageText, oi as checkPushEndpoint, ot as decodeAnyBitcoinAddress, p as checkAppManifest, pn as PUBKY_PROOF_MAX_BYTES, pt as atprotoProofRkey, qa as appRef, qc as utf8Encode, ra as PLAYABLE_AUDIO, rc as seedSigner, rr as fetchesByItself, rt as verifySshSignature, s as signAppStore, sa as parseVoiceMeta, sn as walletNetworkOf, sr as readGroupHave, st as ATPROTO_DECLARED_SCOPE, t as appStoreDecision, ta as sanitizeFileName, to as canonicalJsonBytes, tt as sameSshKey, ut as ATPROTO_PROOF_SCOPE, vn as pubkyProofCapability, vt as shortAtprotoDid, wn as decodeDnsResponse, wo as callSignalHeardAt, wt as DidError, xn as homeserverWebEndpoint, xo as answersOffer, xt as DID_DOCUMENT_MAX_BYTES$1, yn as pubkyProofFile, yo as CALL_SIGNAL_MAX_AGE_MS, yt as AtprotoProofError, zc as MAX_AVATAR_LENGTH, zn as engineError, zr as transferEnded, zt as signingKeys } from "./assets/src-Cp3o_yHN.js";
-import { c as fileStore, d as store$1, f as transact, i as STORES, l as openDb, o as databaseName, p as wrap } from "./assets/idb-BIdus0WX.js";
-import { a as fileBytesOf, i as fileBytes, l as FILE_BYTES_STEP } from "./assets/fileBytes-3AQ2tJzW.js";
+import { $ as SSHSIG_NAMESPACE, $a as readAppRevocations, $n as engineError, An as encodeDnsQuery, Ao as signalHasVideo, At as didJwsAlg, Bn as resolveLightningDestination, Bt as parseDidSignaturePaste, Cn as homeserverWebEndpoint, Co as RTC_CONFIG, Ct as DID_DOCUMENT_MAX_BYTES$1, Dn as dnsProofName, Do as callSignalHeardAt, Dt as checkDidJws, Ec as setLinkTraceSink, En as decodeDnsResponse, Eo as callRtcConfig, Et as DidError, Fa as RUN_RESULTS, Fc as openRelayPayload, Fn as recordsFromWellKnown, Ft as didWebFileUrl, Gc as fromBase64Url$1, Hc as MAX_AVATAR_LENGTH, Ht as staticDidDocument, Ia as STATUS_CARD_LIMITS, Ii as identityStatement, In as recordsName, It as didWebHost, Ja as appFingerprint, Jc as toZ32, Jt as resolveDidDht, Ka as APP_PREFIXES, Kc as randomBytes$1, Ki as irohDescriptor, Kr as sanitizeTypingStatus, La as buttonLabelClash, Ln as txtValue, Lt as normalizeDid, Ma as replySnippet, Mc as RELAY_PAYLOAD_MAX_BYTES, Mn as nip05RootKey, Mt as didWebDocumentUrl, Ni as boundVerifiedIdentity, Nn as normalizeDomain, Nt as didWebFile, On as domainTxtRecord, Oo as extractParamsFromSdp, Ot as checkDidSignature, Pa as ITEM_STATES, Pn as recordsFromTxt, Pt as didWebFileNames, Ra as checkStatusCard, Rn as wellKnownUrl, Rt as parseDid, Sn as pubkyProofPath, So as CALL_SIGNAL_MAX_AGE_MS, St as verifyAtprotoRecordProof, Tn as DOMAIN_FILE_MAX_BYTES, To as buildSdpFromSignal, Uc as sanitizeAvatar, Ur as TYPING_KINDS, Ut as strictBase64Url, Vn as decodeBolt11, Vr as transferEnded, Vt as signingKeys, Wr as TYPING_REFRESH_MS, Xa as checkAppRevokeStatement, Xc as utf8Encode, Ya as appRef, Yc as utf8Decode, Ys as inviteLink, Z as groupName, _ as readAppBundle, _n as isPubkyProofFolder, _t as isAtprotoDid, aa as PLAYABLE_AUDIO, ar as fetchesByItself, at as verifySshSignature, bn as pubkyProofCapability, bt as shortAtprotoDid, c as signAppStore, ca as fileMessageText, ci as checkPushEndpoint, ct as decodeAnyBitcoinAddress, dr as readGroupWantNo, dt as ATPROTO_PROOF_COLLECTION, ea as readImageMeta, eo as signAppObject, er as engineText, et as SshSigError, ft as ATPROTO_PROOF_SCOPE, g as isAppUrl, gn as isPubkyKey, gt as checkAtprotoProofRecord, h as checkAppManifest, hn as PUBKY_PROOF_MAX_BYTES, ho as GhostlyHttpError, ht as atprotoProofRkey, ia as sanitizeMime, in as WALLET_NETWORKS, ir as GROUP_WANT_NO_FRAME, it as sshSignCommand, ji as IdentityCheckUnavailable, jn as isPublicAddress, jt as didSignedMessages, kn as domainWellKnownFile, ko as parseCallSignal, kt as didGhostlyServiceEntry, l as APP_BUNDLE_LIMITS, la as parseVoiceMeta, ln as walletNetworkOf, lr as readGroupHave, lt as ATPROTO_DECLARED_SCOPE, m as assembleAppBundle, ma as RateWindow, mt as atprotoProofRecord, n as appStoreDecision, no as canonicalJson, nr as GROUP_HAVE_FRAME, nt as parseSshSignature, o as checkAppStoreIndex, oa as VOICE_LIMITS, oc as seedSigner, or as groupFileFallback, ot as verifyBitcoinMessage, pi as BUTTONS_CAPABILITY, pt as atprotoDidMethod, qa as APP_STATEMENT_LIMITS, qc as toBase64Url, qi as irohRelayUrl, ra as sanitizeFileName, ro as canonicalJsonBytes, rt as sameSshKey, s as readAppStore, sa as baseMime, sr as isGroupMessageId, st as BitcoinAddressError, to as signAppRevocation, tr as GROUP_FILE_LIMITS, tt as parseSshPublicKey, ua as voicePeaksOf, ur as readGroupWant, ut as ATPROTO_FULL_SCOPE, vn as newPubkyProofFolder, vt as normalizeAtprotoHandle, wn as pubkyHomeserverOf, wo as answersOffer, wt as DID_FILE_MAX_BYTES, xn as pubkyProofFile, xt as AtprotoProofError, yn as normalizePubkyKey, yo as LIMITS, yt as parseAtprotoDidDocument, zn as requestLnurlInvoice, zr as ChatFiles, zt as parseDidDocument } from "./assets/src-BMUcYQ7b.js";
+import { c as fileStore, f as store$1, i as STORES, m as wrap, o as databaseName, p as transact, u as openDb } from "./assets/idb-CTF6LF5B.js";
+import { a as fileBytesOf, i as fileBytes, l as FILE_BYTES_STEP } from "./assets/fileBytes-BcYZhNgF.js";
 import { createRequire } from "node:module";
 import { spawn } from "node:child_process";
 import { connect, createServer, isIP } from "node:net";
@@ -12,8 +12,8 @@ import { sha256 } from "@noble/hashes/sha2.js";
 import { createBase58check } from "@scure/base";
 import { schnorr } from "@noble/curves/secp256k1.js";
 import { wordlist } from "@scure/bip39/wordlists/english.js";
-import { link, mkdir, open, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
-import { basename, dirname, extname, join, relative, resolve, sep } from "node:path";
+import { access, constants, link, mkdir, open, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
+import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { decode, npubEncode } from "nostr-tools/nip19";
 import { BunkerSigner } from "nostr-tools/nip46";
 import { SimplePool } from "nostr-tools/pool";
@@ -35,7 +35,7 @@ import { IDBFactory, IDBKeyRange as IDBKeyRange$1, IDBTransaction } from "fake-i
 import { format } from "node:util";
 var package_default = {
 	name: "@ghostlytools/cli",
-	version: "1.1.7",
+	version: "1.2.0",
 	type: "module",
 	description: "Ghostly for bots and terminals: the app's own engine, headless on Node, behind a daemon and a `ghostly` command with JSON output.",
 	license: "MIT",
@@ -63,7 +63,7 @@ var package_default = {
 	dependencies: {
 		"@arkade-os/sdk": "0.4.78",
 		"@atproto/jwk-webcrypto": "^0.3.4",
-		"@atproto/oauth-client": "^0.8.8",
+		"@atproto/oauth-client": "^0.8.9",
 		"@bitcoindevkit/bdk-wallet-web": "0.3.0",
 		"@bitcoinerlab/descriptors-scure": "^3.2.0",
 		"@cashu/cashu-ts": "^4.11.0",
@@ -87,7 +87,7 @@ var package_default = {
 		"ethers": "6.17.0",
 		"eventsource": "^5.1.2",
 		"fake-indexeddb": "6.2.5",
-		"hyperdht": "6.34.0",
+		"hyperdht": "6.34.1",
 		"keet-identity-key": "3.2.0",
 		"mpg123-decoder": "1.0.3",
 		"node-datachannel": "^0.33.4",
@@ -101,7 +101,7 @@ var package_default = {
 		"@ghostly/iroh-web": "*",
 		"@types/node": "^26.6.4",
 		"typescript": "^5.9.3",
-		"vite": "^8.3.2",
+		"vite": "^8.3.3",
 		"vitest": "^5.0.3"
 	}
 };
@@ -176,6 +176,7 @@ function localFileError(error) {
 	if (code === "ENOENT" || code === "ENOTDIR") return new CliError("not_found", `No such file or folder: ${where}`);
 	if (code === "EACCES" || code === "EPERM" || code === "EROFS") return new CliError("refused", `Not allowed to write or read ${where}`);
 	if (code === "EISDIR") return new CliError("bad_request", `${where} is a folder: name a file`);
+	if (code === "ENAMETOOLONG") return new CliError("bad_request", `A name in ${where} is too long for this file system (at most 255 bytes)`);
 }
 //#endregion
 //#region src/args.ts
@@ -282,6 +283,12 @@ function parseArgs(argv, spec, idSlot = () => false) {
 		options
 	};
 }
+/** The global option a word names (`--profile`, `--profile=bot`, `-p`), else undefined. */
+function globalOption(arg) {
+	const eq = arg.indexOf("=");
+	const name = arg.startsWith("--") ? arg.slice(2, eq === -1 ? void 0 : eq) : arg.length === 2 && arg.startsWith("-") ? Object.entries(GLOBAL_OPTIONS).find(([, o]) => o.short === arg.slice(1))?.[0] : void 0;
+	return name && Object.hasOwn(GLOBAL_OPTIONS, name) ? GLOBAL_OPTIONS[name] : void 0;
+}
 /**
 * Global options given before the command (`ghostly --profile bot send …`) move after it, where every command's
 * parser reads them. Stops at `--` and at the first word that is not a global option.
@@ -292,8 +299,7 @@ function liftGlobals(argv) {
 	while (i < argv.length) {
 		const arg = argv[i];
 		const eq = arg.indexOf("=");
-		const name = arg.startsWith("--") ? arg.slice(2, eq === -1 ? void 0 : eq) : arg.length === 2 && arg.startsWith("-") ? Object.entries(GLOBAL_OPTIONS).find(([, o]) => o.short === arg.slice(1))?.[0] : void 0;
-		const option = name ? GLOBAL_OPTIONS[name] : void 0;
+		const option = globalOption(arg);
 		if (!option || arg === "--") break;
 		const takesValue = option.type !== "boolean" && eq === -1;
 		lifted.push(...argv.slice(i, i + (takesValue ? 2 : 1)));
@@ -675,6 +681,7 @@ var ENGINE_METHODS = [
 	"joinGroupByLink",
 	"sendGroupMessage",
 	"sendGroupFile",
+	"groupFileCheck",
 	"pressButton",
 	"groupMessages",
 	"messagePage",
@@ -1043,7 +1050,7 @@ function groupReply(reply, myKey) {
 //#endregion
 //#region ../browser/src/engine/groupFiles.ts
 /** A group file's local id: its group's and a random part, never anything a member sends. */
-var groupFileId = (groupId, direction, random = toBase64Url$1(randomBytes$1(12))) => `group-${groupId}-${direction}-${random}`;
+var groupFileId = (groupId, direction, random = toBase64Url(randomBytes$1(12))) => `group-${groupId}-${direction}-${random}`;
 /** The group a local file id names, among `groupIds`. */
 var groupOfFile = (fileId, groupIds) => [...groupIds].find((g) => fileId.startsWith(`group-${g}-in-`) || fileId.startsWith(`group-${g}-out-`));
 /** What a file's message says: its caption, or (when the author wrote none) the file itself, not the line older apps show. */
@@ -1051,23 +1058,28 @@ var groupFileText = (text, meta) => text === groupFileFallback(meta) ? fileMessa
 /** The profile's files store and file storage, as a 1:1 chat's files use them. */
 var storedGroupFiles = {
 	list: (groupId) => fileStore.listForLink(`group:${groupId}`),
+	groups: () => fileStore.groupIds(),
 	get: (id) => fileStore.get(id),
 	put: (file) => fileStore.put(file),
 	patch: (id, fields) => fileStore.patch(id, fields),
 	remove: (id) => removeStored(id),
-	async write(id) {
+	async write(id, resume = false) {
 		const stored = await fileStore.get(id);
 		const bytes = stored?.bytes && await fileBytesOf(stored.bytes) || await fileBytes();
-		if (await bytes.size(id) !== null) await bytes.truncate(id, 0);
+		const size = await bytes.size(id);
+		const offset = resume && size !== null ? size : 0;
+		if (size !== null && size !== offset) await bytes.truncate(id, offset);
 		if (stored && stored.bytes !== bytes.kind) await fileStore.patch(id, { bytes: bytes.kind });
-		const appender = new FileAppender(bytes, id, 0);
+		const appender = new FileAppender(bytes, id, offset);
 		return {
+			offset,
 			append: (chunk) => appender.append(chunk),
 			flush: () => appender.flush(),
 			digest: async () => {
 				await appender.close();
 				return bytes.digest(id);
 			},
+			close: () => appender.close(),
 			discard: async () => {
 				await appender.close().catch(() => {});
 				await bytes.remove(id);
@@ -1077,8 +1089,14 @@ var storedGroupFiles = {
 	read: (file, offset, length) => readStored(file, offset, length),
 	room: async () => (await fileBytes()).room()
 };
-/** Why a want waits, as the person reads it. */
-var NOBODY_CONNECTED = "Nobody you are connected to has this file yet";
+/** Why a want waits, as the person reads it (the app shows its own words for each `wait`). */
+var WAITING_NOTES = {
+	nobody: "Nobody you are connected to has this file yet",
+	busy: "Its holders are busy; asking again soon",
+	damaged: "It arrived damaged; ask again"
+};
+/** Why a want stopped: every holder served bytes that are not the author's file. */
+var DAMAGED$1 = "Every copy of this file arrived damaged and was deleted. Ask for it again later.";
 var GroupFileDesk = class {
 	deps;
 	kept = /* @__PURE__ */ new Map();
@@ -1090,6 +1108,7 @@ var GroupFileDesk = class {
 	own = /* @__PURE__ */ new Map();
 	/** Announcements sent per group, and taken per member of a group (WISP 503 § Rules for both, Pace). */
 	sentPace = /* @__PURE__ */ new Map();
+	sentTaken = /* @__PURE__ */ new Map();
 	takenPace = /* @__PURE__ */ new Map();
 	/** `<group>\n<message id>` a `group-have` named before its message came → its holders, newest first. */
 	ahead = /* @__PURE__ */ new Map();
@@ -1126,7 +1145,8 @@ var GroupFileDesk = class {
 				auto: !!file.group.auto,
 				asked: !!file.group.asked,
 				held: file.transfer?.state === "done",
-				holders: []
+				holders: [],
+				damaged: /* @__PURE__ */ new Set()
 			};
 			this.add(kept);
 			if (kept.held) this.show(kept, {
@@ -1135,6 +1155,14 @@ var GroupFileDesk = class {
 				size,
 				direction: kept.mine ? "out" : "in"
 			});
+			else if (file.transfer?.state === "failed") this.show(kept, {
+				state: "failed",
+				transferred: 0,
+				size,
+				direction: "in",
+				retry: true,
+				error: file.transfer.error ?? DAMAGED$1
+			});
 			else if (kept.auto || kept.asked) this.wants.set(kept.id, this.newWant());
 			else this.show(kept, {
 				state: "transferring",
@@ -1147,9 +1175,27 @@ var GroupFileDesk = class {
 		for (const [id] of this.wants) this.ask(this.kept.get(id));
 		this.deps.changed();
 	}
-	/** An error when this group took as many announcements of mine as it takes in a minute; null when one may go now. */
+	/**
+	* At start, once every group was read: the files of a group this device no longer has (`groupIds` are the groups it
+	* has, a tombstone or a join under way among them) go, with their bytes. A group left before Leave took its files
+	* left them behind, where nothing lists them.
+	*/
+	async sweep(groupIds) {
+		const here = new Set(groupIds);
+		for (const groupId of await this.deps.store.groups().catch(() => [])) {
+			if (here.has(groupId)) continue;
+			for (const file of await this.deps.store.list(groupId).catch(() => [])) await this.deps.store.remove(file.id).catch(() => {});
+		}
+	}
+	/**
+	* An error when this group took as many announcements of mine as it takes in a minute, or as its members take from
+	* one member in `announceWindowMs` (past that they would get the text, not the file); null when one may go now.
+	*/
 	mayAnnounce(groupId) {
-		return this.pace(this.sentPace, groupId, GROUP_FILE_LIMITS.announcePerMinute, 6e4).wait() ? "You sent many files to this group just now. Wait a minute." : null;
+		const wait = Math.max(...this.sentPaces(groupId).map((pace) => pace.wait()));
+		if (!wait) return null;
+		const minutes = Math.ceil(wait / 6e4);
+		return `You sent many files to this group just now. Wait ${minutes > 1 ? `${minutes} minutes` : "a minute"}.`;
 	}
 	/** My file, stored under `fileId` with the author's digest, is about to be announced in the group: its message takes it. */
 	outgoing(groupId, fileId, meta) {
@@ -1170,7 +1216,7 @@ var GroupFileDesk = class {
 		const ownId = m.sender === me ? this.own.get(`${groupId}\n${m.file.d}`) : void 0;
 		if (ownId) {
 			this.own.delete(`${groupId}\n${m.file.d}`);
-			this.pace(this.sentPace, groupId, GROUP_FILE_LIMITS.announcePerMinute, 6e4).take();
+			for (const pace of this.sentPaces(groupId)) pace.take();
 			const kept = {
 				id: ownId,
 				groupId,
@@ -1181,7 +1227,8 @@ var GroupFileDesk = class {
 				auto: false,
 				asked: false,
 				held: true,
-				holders: []
+				holders: [],
+				damaged: /* @__PURE__ */ new Set()
 			};
 			this.add(kept);
 			const transfer = {
@@ -1218,7 +1265,8 @@ var GroupFileDesk = class {
 			auto,
 			asked: false,
 			held: false,
-			holders
+			holders,
+			damaged: /* @__PURE__ */ new Set()
 		};
 		const { name, size, mime, voice, video, image } = m.file;
 		this.add(kept);
@@ -1271,9 +1319,18 @@ var GroupFileDesk = class {
 			kept.asked = true;
 			await this.deps.store.patch(kept.id, { group: this.groupField(kept) }).catch(() => {});
 		}
+		kept.damaged.clear();
+		if (this.deps.transfers.get(kept.id)?.state === "failed") await this.deps.store.patch(kept.id, { transfer: {
+			state: "transferring",
+			transferred: 0,
+			size: kept.meta.size
+		} }).catch(() => {});
 		const want = this.wants.get(kept.id);
 		if (!want) this.wants.set(kept.id, this.newWant());
-		else if (!want.wire) want.tried.clear();
+		else if (!want.wire) {
+			want.tried.clear();
+			want.why = void 0;
+		}
 		this.ask(kept);
 	}
 	/** The group is gone from this device: its files go too. */
@@ -1348,6 +1405,7 @@ var GroupFileDesk = class {
 			}
 			edge.taking.set(frame.id, kept.id);
 			want.wire = frame.id;
+			want.why = void 0;
 			want.movedAt = this.deps.now();
 		}
 		return edge.files.handle(frame);
@@ -1371,9 +1429,13 @@ var GroupFileDesk = class {
 				want.wire = void 0;
 			}
 			if (want.holder) want.tried.add(want.holder);
-			else want.tried.clear();
+			else {
+				want.tried.clear();
+				want.why = void 0;
+			}
 			this.ask(kept);
 		}
+		this.letGo();
 		for (const edge of this.edgesById.values()) {
 			if (!edge.have.size || now - edge.haveAt < GROUP_FILE_LIMITS.haveEveryMs || !this.deps.ready(edge.linkId)) continue;
 			this.sendHave(edge, [...edge.have]);
@@ -1415,10 +1477,20 @@ var GroupFileDesk = class {
 		if (!want || kept.held || want.wire) return;
 		const membership = this.deps.membership(kept.groupId);
 		const edges = this.deps.edges(kept.groupId);
-		const order = [kept.author, ...kept.holders.filter((key) => key !== kept.author)].filter((key) => membership && key !== membership.me && membership.inRoster(key) && !want.tried.has(key));
+		const known = [kept.author, ...kept.holders.filter((key) => key !== kept.author)].filter((key) => membership && key !== membership.me && membership.inRoster(key));
+		if (known.length && known.every((key) => kept.damaged.has(key))) {
+			this.stopDamaged(kept);
+			return;
+		}
+		const order = known.filter((key) => !want.tried.has(key) && !kept.damaged.has(key));
+		let behind = false;
 		for (const key of order) {
 			const linkId = edges.get(key);
 			if (!linkId || !this.deps.ready(linkId) || !this.edgesById.get(linkId)?.files.live) continue;
+			if (this.askedOf(linkId, want)) {
+				behind = true;
+				continue;
+			}
 			if (!this.deps.send(linkId, {
 				t: "group-want",
 				g: kept.groupId,
@@ -1435,7 +1507,7 @@ var GroupFileDesk = class {
 			this.show(kept, {
 				state: "transferring",
 				stage: "queued",
-				transferred: 0,
+				transferred: kept.stored ?? 0,
 				size: kept.meta.size,
 				direction: "in"
 			});
@@ -1446,13 +1518,50 @@ var GroupFileDesk = class {
 			linkId: void 0,
 			at: this.deps.now()
 		});
+		if (behind) {
+			this.show(kept, {
+				state: "transferring",
+				stage: "queued",
+				transferred: kept.stored ?? 0,
+				size: kept.meta.size,
+				direction: "in"
+			});
+			return;
+		}
+		const wait = want.why ?? "nobody";
 		this.show(kept, {
 			state: "transferring",
 			stage: "waiting",
-			transferred: 0,
+			transferred: kept.stored ?? 0,
 			size: kept.meta.size,
 			direction: "in",
-			note: NOBODY_CONNECTED
+			wait,
+			note: WAITING_NOTES[wait],
+			...wait === "damaged" && { stalled: true }
+		});
+	}
+	/** Another file is asked of, or coming from, the member at the other end of this edge. */
+	askedOf(linkId, except) {
+		for (const want of this.wants.values()) if (want !== except && want.linkId === linkId) return true;
+		return false;
+	}
+	/** No holder serves the author's bytes: the want stops, and stays stopped after a restart, until Download. */
+	stopDamaged(kept) {
+		this.wants.delete(kept.id);
+		const { size } = kept.meta;
+		this.deps.store.patch(kept.id, { transfer: {
+			state: "failed",
+			transferred: 0,
+			size,
+			error: DAMAGED$1
+		} }).catch(() => {});
+		this.show(kept, {
+			state: "failed",
+			transferred: 0,
+			size,
+			direction: "in",
+			retry: true,
+			error: DAMAGED$1
 		});
 	}
 	/** A holder's no: the next one is asked. One that deleted the file is no holder any more. */
@@ -1461,9 +1570,11 @@ var GroupFileDesk = class {
 		const want = kept && this.wants.get(kept.id);
 		if (!kept || !want || want.linkId !== linkId || want.wire) return;
 		if (why === "gone") kept.holders = kept.holders.filter((key) => key !== peer);
+		if (why === "busy") want.why = "busy";
 		want.tried.add(peer);
 		want.holder = want.linkId = void 0;
 		this.ask(kept);
+		this.retry(groupId);
 	}
 	/** A member says it holds these files: remembered as a holder of each (newest first), and asked when a want waits. */
 	heard(groupId, from, ids) {
@@ -1499,8 +1610,12 @@ var GroupFileDesk = class {
 			});
 			return;
 		}
-		const wire = toBase64Url$1(randomBytes$1(12));
+		const wire = toBase64Url(randomBytes$1(12));
 		edge.serving.set(wire, kept.id);
+		edge.servedMoved.set(wire, {
+			confirmed: 0,
+			at: this.deps.now()
+		});
 		const { name, mime, size, voice, video, image } = kept.meta;
 		const file = {
 			id: wire,
@@ -1524,8 +1639,13 @@ var GroupFileDesk = class {
 		if (!membership || !membership.couldRead(edge.peer, messageId)) return "refused";
 		if (!kept) return "gone";
 		if (!this.deps.settings().serveFiles || !edge.files.live) return "busy";
+		this.letGo();
 		const active = this.servingNow();
-		if (active.length >= GROUP_FILE_LIMITS.serveAtOnce || active.some((a) => a.peer === edge.peer)) return "busy";
+		if (active.length >= GROUP_FILE_LIMITS.serveAtOnce) {
+			edge.busy.add(messageId);
+			return "busy";
+		}
+		if (active.some((a) => a.peer === edge.peer && a.sending)) return "busy";
 		const today = Math.floor(this.deps.now() / 864e5);
 		if (this.served.day !== today) this.served = {
 			day: today,
@@ -1534,18 +1654,37 @@ var GroupFileDesk = class {
 		const reserved = active.reduce((sum, a) => sum + a.size, 0);
 		return this.served.bytes + reserved + kept.meta.size > GROUP_FILE_LIMITS.serveBytesPerDay ? "busy" : null;
 	}
-	/** Transfers served now, all groups together: to whom, and their size. */
+	/** Transfers served now, all groups together: to whom, their size, and whether bytes are still to go. */
 	servingNow() {
 		const active = [];
 		for (const edge of this.edgesById.values()) for (const wire of edge.serving.keys()) {
 			const record = edge.files.get("out", wire);
 			if (record && !transferEnded(record)) active.push({
 				peer: edge.peer,
-				size: record.file.size
+				size: record.file.size,
+				sending: record.confirmed < record.file.size
 			});
 		}
 		return active;
 	}
+	/**
+	* Served transfers that no longer count end, their places free for others (WISP 503 § Serving limits): the asker's
+	* session closed, it is not in the roster any more, or its bytes have not moved for `wantWaitMs` (the asker has moved
+	* on by then).
+	*/
+	letGo() {
+		const now = this.deps.now();
+		for (const edge of this.edgesById.values()) for (const wire of [...edge.serving.keys()]) {
+			const record = edge.files.get("out", wire);
+			if (!record || transferEnded(record)) continue;
+			let moved = edge.servedMoved.get(wire);
+			if (!moved || moved.confirmed !== record.confirmed) edge.servedMoved.set(wire, moved = {
+				confirmed: record.confirmed,
+				at: now
+			});
+			if (!edge.files.live || !this.deps.membership(edge.groupId)?.inRoster(edge.peer) || now - moved.at >= GROUP_FILE_LIMITS.wantWaitMs) edge.files.cancel("out", wire);
+		}
+	}
 	/** Says on an edge which files this device holds. */
 	sendHave(edge, ids) {
 		for (let i = 0; i < ids.length; i += GROUP_FILE_LIMITS.haveIds) if (!this.deps.send(edge.linkId, {
@@ -1579,9 +1718,11 @@ var GroupFileDesk = class {
 			peer,
 			files: void 0,
 			serving: /* @__PURE__ */ new Map(),
+			servedMoved: /* @__PURE__ */ new Map(),
 			taking: /* @__PURE__ */ new Map(),
 			have: /* @__PURE__ */ new Set(),
-			haveAt: 0
+			haveAt: 0,
+			busy: /* @__PURE__ */ new Set()
 		};
 		edge.files = new ChatFiles({
 			send: (frame) => {
@@ -1615,13 +1756,28 @@ var GroupFileDesk = class {
 		const kept = this.kept.get(edge.taking.get(record.id) ?? "");
 		if (!kept) throw new Error("No such file");
 		await kept.idle;
-		const writer = await this.deps.store.write(kept.id);
+		const writer = await this.deps.store.write(kept.id, !kept.fresh);
+		kept.fresh = false;
+		const resumed = writer.offset > 0;
+		let damaged = false;
 		return {
-			offset: 0,
+			offset: writer.offset,
 			append: (bytes) => writer.append(bytes),
 			flush: () => writer.flush(),
-			verify: async () => await writer.digest() === kept.meta.d,
-			discard: () => kept.idle = writer.discard().catch(() => {})
+			verify: async () => {
+				damaged = await writer.digest() !== kept.meta.d;
+				const want = this.wants.get(kept.id);
+				if (damaged && want) want.why = "damaged";
+				return !damaged;
+			},
+			discard: () => {
+				if (damaged) {
+					kept.stored = 0;
+					if (resumed) kept.fresh = kept.unclear = true;
+					else kept.damaged.add(edge.peer);
+				}
+				return kept.idle = (damaged ? writer.discard() : writer.close()).catch(() => {});
+			}
 		};
 	}
 	async openSource(edge, record) {
@@ -1643,6 +1799,12 @@ var GroupFileDesk = class {
 				};
 				this.served.bytes += record.confirmed;
 				edge.serving.delete(record.id);
+				edge.servedMoved.delete(record.id);
+				const serving = this.deps.settings().serveFiles;
+				for (const other of this.edgesById.values()) {
+					if (serving) for (const id of other.busy) other.have.add(id);
+					other.busy.clear();
+				}
 			}
 			return;
 		}
@@ -1652,6 +1814,7 @@ var GroupFileDesk = class {
 			want.moved = transferred;
 			want.movedAt = this.deps.now();
 		}
+		if (record.state !== "failed" && record.state !== "declined" && record.state !== "cancelled") kept.stored = transferred;
 		const { size } = kept.meta;
 		switch (record.state) {
 			case "done":
@@ -1670,12 +1833,14 @@ var GroupFileDesk = class {
 					direction: "in"
 				});
 				this.queueHave(kept);
+				this.retry(kept.groupId);
 				return;
 			case "failed":
 			case "declined":
 			case "cancelled":
 				edge.taking.delete(record.id);
-				if (want.holder) want.tried.add(want.holder);
+				if (want.holder && !kept.unclear) want.tried.add(want.holder);
+				kept.unclear = false;
 				Object.assign(want, {
 					wire: void 0,
 					holder: void 0,
@@ -1683,6 +1848,7 @@ var GroupFileDesk = class {
 					moved: 0
 				});
 				this.ask(kept);
+				this.retry(kept.groupId);
 				return;
 			case "verifying":
 				this.show(kept, {
@@ -1724,6 +1890,10 @@ var GroupFileDesk = class {
 		if (!window) windows.set(key, window = new RateWindow(limit, ms, () => this.deps.now()));
 		return window;
 	}
+	/** My announcements in a group, in a minute and in the window the members count them over. */
+	sentPaces(groupId) {
+		return [this.pace(this.sentPace, groupId, GROUP_FILE_LIMITS.announcePerMinute, 6e4), this.pace(this.sentTaken, groupId, GROUP_FILE_LIMITS.announceTaken, GROUP_FILE_LIMITS.announceWindowMs)];
+	}
 	show(kept, view) {
 		this.deps.transfers.set(kept.id, view);
 		this.deps.changed();
@@ -2283,6 +2453,8 @@ async function sendToGroup(ctx, params, group, path, size) {
 	if (replyTo) {
 		if (!(await node(ctx).groupMessages({ groupId: group.id })).some((m) => m.id === replyTo || replyRef(m) === replyTo)) throw new CliError("not_found", "That message is not in this group, or cannot be replied to");
 	}
+	const check = await node(ctx).groupFileCheck({ groupId: group.id });
+	if (check.error) throw check.refused ? new CliError("refused", check.error) : groupSendRefused(check.error);
 	const { voice, warning } = await voiceOf(params, path, mime);
 	const source = await openAsBlob(path, { type: mime });
 	const image = voice ? void 0 : await readImageMeta(source, mime);
@@ -2343,6 +2515,20 @@ async function sendToGroup(ctx, params, group, path, size) {
 		...warning ? { warning } : {}
 	};
 }
+/** Bytes a file system takes in one name: 255 on ext4, btrfs, APFS (NTFS counts 255 UTF-16 units, within this too). */
+var NAME_BYTES = 255;
+/**
+* `name` as an entry of a folder: an app's name may have 200 characters, which in UTF-8 can be 800 bytes. The end of
+* its stem goes until it fits, its extension stays (as `sanitizeFileName` shortens it), so "文…文.txt" is saved as a text.
+*/
+function fitName(name) {
+	const fits = (candidate) => Buffer.byteLength(candidate) <= NAME_BYTES;
+	if (fits(name)) return name;
+	const extension = /\.[^.\s]{1,15}$/u.exec(name)?.[0] ?? "";
+	const stem = [...name.slice(0, name.length - extension.length)];
+	while (stem.length && !fits(stem.join("").trimEnd() + extension)) stem.pop();
+	return (stem.join("").trimEnd() || "file") + extension;
+}
 var ACTIONS = [
 	"accept",
 	"decline",
@@ -2363,6 +2549,7 @@ var FILE_METHODS = {
 			throw new CliError("not_found", `No file ${path}`);
 		}
 		if (!info.isFile()) throw new CliError("bad_request", `${path} is not a file`);
+		await access(path, constants.R_OK);
 		if ("group" in target) return sendToGroup(ctx, params, target.group, path, info.size);
 		const { link } = target;
 		if (link.profile && link.dataLink === "open" && !link.capabilities?.files) throw new CliError("unavailable", "The contact's app takes no files");
@@ -2376,7 +2563,7 @@ var FILE_METHODS = {
 		const { voice, warning } = await voiceOf(params, path, mime);
 		const source = await openAsBlob(path, { type: mime });
 		const image = voice ? void 0 : await readImageMeta(source, mime);
-		const wireId = toBase64Url$1(randomBytes$1(12));
+		const wireId = toBase64Url(randomBytes$1(12));
 		const file = {
 			id: `${link.id}-out-${wireId}`,
 			name: sanitizeFileName(str(params, "name") ?? basename(path)),
@@ -2543,7 +2730,7 @@ var FILE_METHODS = {
 		if (stored.leftOut) throw new CliError("not_found", "Not in this backup: the light backup this profile was restored from left the file out");
 		const transfer = state(ctx).transfers[fileId] ?? stored.transfer;
 		if (transfer && transfer.state !== "done") throw new CliError("unavailable", `The file is not all here yet (${transfer.transferred} of ${transfer.size} bytes)`);
-		const target = str(params, "path") ? resolve(str(params, "path", true)) : join(resolve(str(params, "dir") ?? "."), sanitizeFileName(stored.metadata.name));
+		const target = str(params, "path") ? resolve(str(params, "path", true)) : join(resolve(str(params, "dir") ?? "."), fitName(sanitizeFileName(stored.metadata.name)));
 		const flags = bool(params, "force") ? "w" : "wx";
 		let out;
 		try {
@@ -2596,7 +2783,7 @@ var DELIVERY_RANK = {
 async function waitForEdit(ctx, chat, messageId, ms) {
 	const until = Date.now() + ms;
 	for (;;) {
-		const message = (await node(ctx).getMessages(chat)).find((m) => m.id === messageId);
+		const message = await node(ctx).getMessage(chat, messageId);
 		if (!message) throw new CliError("not_found", `No message ${messageId} in this chat`);
 		if (!message.edit?.pending) return message;
 		if (Date.now() >= until) throw new CliError("timeout", `Timed out after ${Math.round(ms / 1e3)} s: the contact has not confirmed the edit yet. It goes by itself once the chat is live and the contact's app shows edits, while this profile is online`, {
@@ -2648,8 +2835,7 @@ async function waitForMessage(ctx, chat, messageId, target, ms) {
 			if (error) reject(error);
 			else resolve(message);
 		};
-		const check = (last = false) => void node(ctx).getMessages(chat).then((messages) => {
-			const message = messages.find((m) => m.id === messageId);
+		const check = (last = false) => void node(ctx).getMessage(chat, messageId).then((message) => {
 			try {
 				const done = look(message);
 				if (done) finish(null, done);
@@ -2770,7 +2956,7 @@ async function sendCard(ctx, params, kind) {
 	const target = chatOrGroup(ctx, str(params, "chat", true));
 	const fields = fieldsOf(params);
 	const now = Date.now();
-	const id = typeof fields.id === "string" && fields.id ? fields.id : `${kind}-${toBase64Url$1(randomBytes$1(6))}`;
+	const id = typeof fields.id === "string" && fields.id ? fields.id : `${kind}-${toBase64Url(randomBytes$1(6))}`;
 	const card = checked$1(withRun({
 		...kind === "task" ? {
 			status: "running",
@@ -2812,7 +2998,7 @@ async function sendCard(ctx, params, kind) {
 	});
 	if (result.error) throw new CliError(result.refused ? "refused" : "unavailable", result.error);
 	if (!result.messageId) throw new CliError("bad_request", "Nothing to send");
-	let message = (await node(ctx).getMessages(target.linkId)).find((m) => m.id === result.messageId);
+	let message = await node(ctx).getMessage(target.linkId, result.messageId);
 	if (wait !== "none") message = await waitForMessage(ctx, target.linkId, result.messageId, wait, ms);
 	return answer(target, kind, id, result.messageId, {
 		card,
@@ -2879,7 +3065,7 @@ async function updateCard(ctx, params, kind) {
 		pace.last = Date.now();
 		await editCard(ctx, target, message.id, card, text);
 	}
-	let edited = target.group ? (await node(ctx).groupMessages({ groupId: target.id })).find((m) => m.id === message.id) : (await node(ctx).getMessages(target.linkId)).find((m) => m.id === message.id);
+	let edited = target.group ? (await node(ctx).groupMessages({ groupId: target.id })).find((m) => m.id === message.id) : await node(ctx).getMessage(target.linkId, message.id);
 	if (wait === "confirmed" && edited?.edit?.pending) edited = await waitForEdit(ctx, target.linkId, message.id, ms);
 	const edges = wait === "sent" && edited?.edit ? await waitForGroupFrame(ctx, target.id, message.id, edited.edit.seq, ms) : void 0;
 	return answer(target, kind, id, message.id, {
@@ -3049,7 +3235,7 @@ function buttonsCard(params) {
 	if (!Array.isArray(buttons)) throw new CliError("bad_request", "buttons must be a list of {id, label, style?, once?}");
 	return checked({
 		kind: "buttons",
-		id: str(params, "buttonsId") ?? `ask-${toBase64Url$1(randomBytes$1(6))}`,
+		id: str(params, "buttonsId") ?? `ask-${toBase64Url(randomBytes$1(6))}`,
 		buttons
 	});
 }
@@ -3104,7 +3290,7 @@ async function updateButtons(ctx, params) {
 		card
 	});
 	if (result.error) throw new CliError(result.refused ? "refused" : "unavailable", result.error);
-	let edited = (target.group ? await node(ctx).groupMessages({ groupId: target.id }) : await node(ctx).getMessages(target.linkId)).find((m) => m.id === message.id);
+	let edited = target.group ? (await node(ctx).groupMessages({ groupId: target.id })).find((m) => m.id === message.id) : await node(ctx).getMessage(target.linkId, message.id);
 	if (wait === "confirmed" && edited?.edit?.pending) edited = await waitForEdit(ctx, target.linkId, message.id, ms);
 	const edges = wait === "sent" && edited?.edit ? await waitForGroupFrame(ctx, target.id, message.id, edited.edit.seq, ms) : void 0;
 	return {
@@ -3167,7 +3353,7 @@ async function pressButton(ctx, params) {
 			edges
 		};
 	}
-	const reply = wait === "none" ? (await node(ctx).getMessages(target.linkId)).find((m) => m.id === replyId) : await waitForMessage(ctx, target.linkId, replyId, wait, ms);
+	const reply = wait === "none" ? await node(ctx).getMessage(target.linkId, replyId) : await waitForMessage(ctx, target.linkId, replyId, wait, ms);
 	return {
 		...answer,
 		delivery: reply?.delivery ?? null
@@ -4135,7 +4321,7 @@ var ResolverUnavailable = class extends DomainCheckError {};
 async function askResolver(resolver, name, type, options) {
 	let response;
 	try {
-		response = await options.fetch(`${resolver.url}?dns=${toBase64Url$1(encodeDnsQuery(name, type))}`, {
+		response = await options.fetch(`${resolver.url}?dns=${toBase64Url(encodeDnsQuery(name, type))}`, {
 			headers: { accept: "application/dns-message" },
 			maxBytes: DNS_MAX_BYTES,
 			signal: options.signal,
@@ -4845,8 +5031,8 @@ async function preparePgpEvidence(input, options = {}) {
 	return {
 		evidence: {
 			scheme: PGP_SCHEME,
-			key: toBase64Url$1(await minimalKey(pgp, key, signer, at, config(pgp))),
-			signature: toBase64Url$1(signature)
+			key: toBase64Url(await minimalKey(pgp, key, signer, at, config(pgp))),
+			signature: toBase64Url(signature)
 		},
 		verified: info
 	};
@@ -4858,7 +5044,7 @@ function parsePgpEvidence(raw) {
 	if (!e || typeof e !== "object" || Array.isArray(e) || e.scheme !== "openpgp/1" || Object.keys(e).sort().join(",") !== "key,scheme,signature" || typeof e.key !== "string" || typeof e.signature !== "string" || !b64.test(e.key) || !b64.test(e.signature) || e.key.length > Math.ceil(PGP_LIMITS.sharedKey * 4 / 3) || e.signature.length > Math.ceil(PGP_LIMITS.sharedSignature * 4 / 3)) throw new PgpProofError("Invalid OpenPGP proof");
 	let canonical;
 	try {
-		canonical = toBase64Url$1(fromBase64Url$1(e.key)) === e.key && toBase64Url$1(fromBase64Url$1(e.signature)) === e.signature;
+		canonical = toBase64Url(fromBase64Url$1(e.key)) === e.key && toBase64Url(fromBase64Url$1(e.signature)) === e.signature;
 	} catch {
 		canonical = false;
 	}
@@ -5580,7 +5766,7 @@ function segment(value) {
 	} catch {
 		return refuse("Malformed ID token");
 	}
-	if (toBase64Url$1(bytes) !== value) refuse("Malformed ID token");
+	if (toBase64Url(bytes) !== value) refuse("Malformed ID token");
 	return bytes;
 }
 function json(value) {
@@ -5728,7 +5914,7 @@ async function authorizationRequest(options) {
 	if (!clientId) throw new Error(`${provider.name} sign-in is not set up in this Ghostly build yet.`);
 	const { nonce } = options;
 	if (!/^[A-Za-z0-9_-]{16,128}$/.test(nonce)) throw new Error("Invalid sign-in nonce");
-	const state = `${options.statePrefix ?? ""}${toBase64Url$1(randomBytes$1(32))}`;
+	const state = `${options.statePrefix ?? ""}${toBase64Url(randomBytes$1(32))}`;
 	const url = new URL(provider.authorizationEndpoint);
 	const { scope, claims } = scopeFor$1(provider, options.reveal);
 	const params = {
@@ -5743,8 +5929,8 @@ async function authorizationRequest(options) {
 	};
 	let verifier;
 	if (provider.responseType === "code") {
-		verifier = toBase64Url$1(randomBytes$1(32));
-		params.code_challenge = toBase64Url$1(new Uint8Array(await crypto.subtle.digest("SHA-256", utf8Encode(verifier))));
+		verifier = toBase64Url(randomBytes$1(32));
+		params.code_challenge = toBase64Url(new Uint8Array(await crypto.subtle.digest("SHA-256", utf8Encode(verifier))));
 		params.code_challenge_method = "S256";
 	}
 	for (const [k, v] of Object.entries(params)) url.searchParams.set(k, v);
@@ -6319,7 +6505,7 @@ var signer = {
 		return {
 			method: "sig",
 			vm: check.key.id,
-			sig: toBase64Url$1(check.signature)
+			sig: toBase64Url(check.signature)
 		};
 	}
 };
@@ -7571,7 +7757,7 @@ var exactKeys = (raw, keys) => !!raw && typeof raw === "object" && !Array.isArra
 /** The key behind the fake in-app signer. Tests may replace it. */
 var fakeKeyring = { seed: ed25519.utils.randomSecretKey() };
 var fakeKeySubject = (seed = fakeKeyring.seed) => hex$3(ed25519.getPublicKey(seed));
-var fakeKeySign = (statement, seed = fakeKeyring.seed) => ({ sig: toBase64Url$1(ed25519.sign(statement.bytes, seed)) });
+var fakeKeySign = (statement, seed = fakeKeyring.seed) => ({ sig: toBase64Url(ed25519.sign(statement.bytes, seed)) });
 var fakeKey = {
 	id: "fake-key",
 	label: "Test key",
@@ -7654,13 +7840,13 @@ var ISSUER_SEED = unhex("7a".repeat(32));
 var FAKE_ISSUER = "https://issuer.ghostly.test";
 /** What the fake login page signs: iss, sub, nonce (= statement id), iat. */
 function fakeAccountToken(statement, account = "alice", seed = ISSUER_SEED, iat = statement.binding.issuedAt) {
-	const payload = toBase64Url$1(utf8Encode(JSON.stringify({
+	const payload = toBase64Url(utf8Encode(JSON.stringify({
 		iss: FAKE_ISSUER,
 		sub: account,
 		nonce: statement.id,
 		iat
 	})));
-	return { token: `${payload}.${toBase64Url$1(ed25519.sign(utf8Encode(payload), seed))}` };
+	return { token: `${payload}.${toBase64Url(ed25519.sign(utf8Encode(payload), seed))}` };
 }
 var fakeAccount = {
 	id: "fake-account",
@@ -8623,12 +8809,6 @@ var SERVICE_METHODS = {
 };
 //#endregion
 //#region ../browser/src/backup/codec.ts
-/** Base64url without padding, in chunks: bundles can be many megabytes. */
-function toBase64Url(bytes) {
-	let binary = "";
-	for (let i = 0; i < bytes.length; i += 32768) binary += String.fromCharCode(...bytes.subarray(i, i + 32768));
-	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
 function fromBase64Url(text) {
 	if (!/^[A-Za-z0-9_-]*$/.test(text)) throw new Error("Invalid base64url");
 	const binary = atob(text.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - text.length % 4) % 4));
@@ -12343,14 +12523,19 @@ var METHODS = {
 			label
 		});
 		node(ctx).setActiveLink({ linkId });
-		await waitForState(ctx, (s) => {
-			const stage = s.links.find((l) => l.id === linkId)?.pairingProgress?.stage;
-			return stage && stage !== "publishing" ? true : void 0;
-		}, 2e4, "the invite to be published").catch(() => {});
+		const progressOf = (s) => s.links.find((l) => l.id === linkId)?.pairingProgress;
+		const progress = await waitForState(ctx, (s) => {
+			const p = progressOf(s);
+			return p && (p.stage !== "publishing" || ctx.mode === "daemon" && p.relayWaitUntil) ? p : void 0;
+		}, 2e4, "the invite to be published").catch(() => progressOf(state(ctx)));
+		const published = !!progress && progress.stage !== "publishing" && progress.reason !== "publish";
+		const waitUntil = published ? void 0 : progress?.relayWaitUntil;
 		return {
 			chat: linkId,
 			invite: inviteCode,
-			link: inviteLink(inviteCode)
+			link: inviteLink(inviteCode),
+			published,
+			...waitUntil !== void 0 && { retryInMs: Math.max(0, waitUntil - Date.now()) }
 		};
 	},
 	async "invite.join"(ctx, params) {
@@ -12412,7 +12597,7 @@ var METHODS = {
 		});
 		if (result.error) throw new CliError(result.refused ? "refused" : "unavailable", result.error);
 		if (!result.messageId) throw new CliError("bad_request", "Nothing to send");
-		let message = (await node(ctx).getMessages(link.id)).find((m) => m.id === result.messageId);
+		let message = await node(ctx).getMessage(link.id, result.messageId);
 		if (wait !== "none") message = await waitForMessage(ctx, link.id, result.messageId, wait, num(params, "timeout", 30, {
 			min: 1,
 			max: 3600
@@ -12448,7 +12633,7 @@ var METHODS = {
 		});
 		if (result.error) throw editRefused(await node(ctx).getMessages(link.id), messageId, "chat", result.error, result.refused);
 		const id = result.messageId ?? messageId;
-		let message = (await node(ctx).getMessages(link.id)).find((m) => m.id === id);
+		let message = await node(ctx).getMessage(link.id, id);
 		if (wait === "confirmed" && message?.edit?.pending) message = await waitForEdit(ctx, link.id, id, num(params, "timeout", 30, {
 			min: 1,
 			max: 3600
@@ -13149,6 +13334,229 @@ function connectDaemon(path, timeoutMs = 2e3) {
 	});
 }
 //#endregion
+//#region src/appTemplate.ts
+var html = (text) => text.replace(/[&<>"]/g, (c) => ({
+	"&": "&amp;",
+	"<": "&lt;",
+	">": "&gt;",
+	"\"": "&quot;"
+})[c]);
+/** `ghostly-app.json`: the manifest without `publisher`, `sequence` and `files`, which `app publish` writes. */
+function templateManifest({ name, title }) {
+	return {
+		name,
+		version: "0.1.0",
+		kind: "mini-app",
+		title,
+		tagline: "Say hello to a contact",
+		description: "Open it in a chat and your contact gets a card to join. Each side can then say hello to the other.",
+		entry: "index.html",
+		permissions: ["chat"],
+		view: "chat",
+		runtime: {
+			host: ">=1.2",
+			clients: ["web", "desktop"]
+		},
+		license: "MIT"
+	};
+}
+/**
+* `index.html`: the whole app in one file, as the sandbox needs it (no network, so nothing is loaded from elsewhere).
+* Its script is plain JavaScript typed with JSDoc against `@ghostlytools/sdk/app`, so it runs as written and still type
+* checks (test/appInit.test.ts does). The title is the only thing put into it, as text. Its type imports are in single
+* quotes: they are text of the page, not imports of the CLI's own build (test/packageDeps.test.ts reads those).
+*/
+function templatePage({ title }) {
+	return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${html(title)}</title>
+<style>
+  :root { color-scheme: light dark; --bg: #ffffff; --fg: #16181d; --muted: #5b6270; --line: #d9dde3; --accent: #2f6fed; }
+  :root[data-theme="dark"] { --bg: #16181d; --fg: #f2f4f7; --muted: #a3abb8; --line: #343a45; --accent: #7aa5ff; }
+  body { margin: 0; padding: 20px; background: var(--bg); color: var(--fg); font: 16px/1.4 system-ui, sans-serif; }
+  h1 { margin: 0 0 4px; font-size: 20px; }
+  #status { margin: 0 0 16px; color: var(--muted); }
+  button { font: inherit; padding: 8px 16px; border: 1px solid var(--accent); border-radius: 8px; background: var(--accent); color: var(--bg); }
+  button:disabled { opacity: 0.5; }
+  ul { margin: 16px 0 0; padding: 0; list-style: none; }
+  li { padding: 8px 0; border-top: 1px solid var(--line); }
+</style>
+</head>
+<body>
+<h1>${html(title)}</h1>
+<p id="status" role="status">Starting</p>
+<button id="hello" type="button" disabled>Say hello</button>
+<ul id="log" aria-label="Messages"></ul>
+<script type="module">
+// The types of the API come from the SDK (npm install --save-dev @ghostlytools/sdk); nothing of it runs here.
+/** @typedef {import('@ghostlytools/sdk/app').MiniAppApi} MiniAppApi */
+/** @typedef {import('@ghostlytools/sdk/app').MiniAppJson} MiniAppJson */
+
+/** The longest text shown from a contact's frame. */
+const MAX_TEXT = 200;
+
+const status = /** @type {HTMLElement} */ (document.getElementById("status"));
+const button = /** @type {HTMLButtonElement} */ (document.getElementById("hello"));
+const log = /** @type {HTMLElement} */ (document.getElementById("log"));
+
+/** @param {string} text */
+function show(text) {
+  const line = document.createElement("li");
+  line.textContent = text;
+  log.append(line);
+}
+
+/**
+ * What the contact's app sent, when it is a hello. A frame comes from another device: read only what this app sends,
+ * and never put it in the page as HTML.
+ * @param {MiniAppJson} data
+ * @returns {string | null}
+ */
+function helloOf(data) {
+  if (!data || typeof data !== "object" || Array.isArray(data) || data.type !== "hello") return null;
+  return typeof data.text === "string" && data.text.length <= MAX_TEXT ? data.text : null;
+}
+
+/**
+ * Why a send was refused, in words. The code is the rejection's message (MINI_APP_ERROR_CODES in the SDK); a later
+ * client may add one.
+ * @param {unknown} error
+ */
+function refusal(error) {
+  switch (error instanceof Error ? error.message : "") {
+    case "offline": return "Not sent: you are not both online";
+    case "peer-closed": case "not-open": return "Not sent: your contact has not opened this app";
+    case "not-allowed": return "Open this app in a chat to say hello";
+    default: return "Not sent";
+  }
+}
+
+/** @param {MiniAppApi} ghostly */
+async function start(ghostly) {
+  // Listen before anything is awaited, so no frame is missed.
+  ghostly.chat.on("message", (data) => {
+    const text = helloOf(data);
+    if (text !== null) show("Your contact: " + text);
+  });
+  ghostly.chat.on("peer", (peer) => {
+    status.textContent = peer.open ? "Your contact has this app open" : "Waiting for your contact to open this app";
+  });
+
+  const context = await ghostly.context();
+  const dark = context.theme ? context.theme === "dark" : matchMedia("(prefers-color-scheme: dark)").matches;
+  document.documentElement.dataset.theme = dark ? "dark" : "light";
+  status.textContent = !context.inChat ? "Open this app in a chat to say hello"
+    : context.peer ? "Your contact has this app open" : "Waiting for your contact to open this app";
+
+  button.disabled = false;
+  button.addEventListener("click", async () => {
+    try {
+      await ghostly.chat.send({ type: "hello", text: "Hello!" });
+      show("You: Hello!");
+    } catch (error) {
+      show(refusal(error));
+    }
+  });
+}
+
+/** Ghostly's runner gives the app \`window.ghostly\`; a browser tab has none. */
+const ghostly = /** @type {{ ghostly?: MiniAppApi }} */ (window).ghostly;
+if (ghostly) void start(ghostly);
+else status.textContent = "This page is a Ghostly app: publish it and open it in Ghostly";
+<\/script>
+</body>
+</html>
+`;
+}
+/** `README.md`: what the folder holds and the way from it to a store. */
+function templateReadme({ name, title }) {
+	return `# ${title}
+
+A [Ghostly](https://github.com/MiguelMedeiros/ghostly) app, started with \`ghostly app init\`. Opened in a 1:1 chat, it
+gives your contact a card to join, and each side can say hello to the other.
+
+A Ghostly app ([WISP 1200](https://github.com/MiguelMedeiros/ghostly/blob/dev/docs/wisps/1200-marketplace.md)) is a
+page that runs in the client's sandbox. It has no network, and talks to Ghostly only through \`window.ghostly\`:
+frames of at most 32 KiB to the same app on the contact's side (\`chat.send\`, \`chat.on\`), storage per app and per
+chat, and the files of its own bundle. Apps run in Ghostly from release 1.2.
+
+| File | What it is |
+|---|---|
+| \`ghostly-app.json\` | The manifest, without \`publisher\`, \`sequence\` and \`files\`: \`ghostly app publish\` writes those |
+| \`index.html\` | The app, whole: styles and script inline |
+| \`README.md\` | This file |
+
+## Write it
+
+\`index.html\` is plain JavaScript, typed with JSDoc against \`@ghostlytools/sdk/app\`: \`MiniAppApi\` is
+\`window.ghostly\`, and the same module has the limits (\`MINI_APP_LIMITS\`) and the codes a refused call rejects with
+(\`MINI_APP_ERROR_CODES\`). For the types in your editor:
+
+\`\`\`sh
+npm install --save-dev @ghostlytools/sdk
+\`\`\`
+
+- What a contact's app sends is untrusted: check its shape, bound its size, and show it as text, never as HTML.
+- \`"view": "chat"\` runs the app inside a chat with one contact. \`"full"\` is a full-screen app opened from the Apps page.
+- \`permissions\` lists what the person is asked for: \`chat\` (frames to the contact's app), \`name\` (the person's
+  display name) and \`internet\`. Adding one later makes every install ask before it updates.
+
+## Build
+
+There is nothing to build yet: the page is the app. Once it grows into several source files, or TypeScript, build it
+into one self-contained \`index.html\` (scripts, styles and images inline) and put that file and \`ghostly-app.json\`
+alone in a folder of their own, which is the folder you publish.
+[ghostly-chess](https://github.com/MiguelMedeiros/ghostly-chess) does it with Vite and a small
+\`scripts/stage.mjs\`. \`ghostly app publish\` takes every file of the folder it is given but dot files, this README
+included, so do not run it on a repository with sources, \`node_modules\` or anything private in it.
+
+## Publish
+
+\`\`\`sh
+ghostly app publish . --key ~/ghostly-keys/${name}-publisher.key
+ghostly app verify app.ghostlyapp
+\`\`\`
+
+\`publish\` signs the folder into \`app.ghostlyapp\`. The first run makes the publisher key at the path you name:
+
+- Keep it **outside this folder** and its repository (\`publish\` refuses a key inside it), and never commit it.
+- Back it up. An app is updated only with the key that signed it; a lost key means a new app.
+
+\`verify\` checks the bundle as Ghostly will and prints its \`ref\` (\`<publisher key>/${name}\`), \`sequence\` and
+\`digest\`. For the next version, raise \`version\` in \`ghostly-app.json\` and publish again: the sequence goes up
+by one by itself.
+
+## Try it
+
+Commit \`app.ghostlyapp\` to a public GitHub repository, then in Ghostly open Apps, choose Add, and paste its URL
+(\`https://raw.githubusercontent.com/<owner>/<repo>/HEAD/app.ghostlyapp\`). Set \`sources\` in \`ghostly-app.json\`
+to that URL, in a list, so installs made from it find your updates. Open the app from a chat's + menu; your contact
+gets a card to install and open it.
+
+## List it in a store
+
+A store is a signed list of apps. The official one is a Git repository,
+[ghostly-store](https://github.com/MiguelMedeiros/ghostly-store), and apps enter it by pull request:
+
+1. Commit \`app.ghostlyapp\` to your public repository and note that commit.
+2. Add \`apps/${name}.<first 16 characters of your publisher key>/listing.json\` with the \`ref\`, \`sequence\`
+   and \`digest\` that \`ghostly app verify\` printed. Its \`urls\` start with a jsDelivr URL pinned to the full commit
+   (\`https://cdn.jsdelivr.net/gh/<owner>/<repo>@<40-character commit>/app.ghostlyapp\`).
+3. Open the pull request. Its check verifies the bundle; a maintainer reviews the app and the owner signs the index.
+
+The store's [CONTRIBUTING](https://github.com/MiguelMedeiros/ghostly-store/blob/main/CONTRIBUTING.md) has the rules.
+An app installed from a store updates only to the version that store lists, so each new version is a pull request too.
+
+## If something goes wrong
+
+If a version is harmful, \`ghostly app revoke . --key <your key> --up-to <sequence>\` writes \`ghostly-revoke.json\`;
+publish it beside \`app.ghostlyapp\` and Ghostly stops those versions.
+`;
+}
+//#endregion
 //#region src/apps.ts
 var APP_SOURCE = "ghostly-app.json";
 var APP_REVOKE_FILE = "ghostly-revoke.json";
@@ -13316,7 +13724,7 @@ function described(bundle, bytes) {
 		sequence: m.sequence,
 		digest: bundle.digest,
 		bytes: bytes.length,
-		sha256: toBase64Url$1(createHash("sha256").update(bytes).digest())
+		sha256: toBase64Url(createHash("sha256").update(bytes).digest())
 	};
 }
 /** `app verify <bundle|url>`: every check a client makes before it stores a bundle (WISP 1200 · Reading a bundle). */
@@ -13330,6 +13738,70 @@ async function verifyApp(source) {
 		manifest: read.bundle.manifest
 	};
 }
+/** A folder's name as an app's: lower case, anything else a hyphen (`My App` is `my-app`). */
+var nameFrom = (folder) => folder.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+/** An app's name as a title: `my-app` is `My app`. */
+var titleFrom = (name) => (name[0].toUpperCase() + name.slice(1)).replace(/-/g, " ");
+/**
+* `app init <dir> [--name <name>] [--title <title>] [--force]`: a small working app in `<dir>` (made when missing),
+* which `app publish <dir>` signs as it is: `ghostly-app.json`, an `index.html` that says hello to the contact, and a
+* README with the way to a store (./appTemplate.ts). The name is `--name`, else the folder's; the title `--title`, else
+* the name's. Nothing is written when one of the three files is there, unless `--force`, which replaces those three only.
+*/
+async function initApp(dirArg, what = {}) {
+	const usage = "ghostly app init <dir> [--name <name>] [--title <title>] [--force]";
+	const dir = resolve(dirArg);
+	const name = what.name ?? nameFrom(basename(dir));
+	const title = what.title ?? (name ? titleFrom(name) : "");
+	const page = templatePage({
+		name,
+		title
+	});
+	const pageBytes = new TextEncoder().encode(page);
+	const checked = checkAppManifest({
+		...templateManifest({
+			name,
+			title
+		}),
+		ghostlyApp: 1,
+		publisher: toZ32(/* @__PURE__ */ new Uint8Array(32)),
+		sequence: 1,
+		files: [{
+			path: "index.html",
+			size: pageBytes.length,
+			sha256: toBase64Url(createHash("sha256").update(pageBytes).digest())
+		}]
+	}, { strict: true });
+	if (!checked.ok) {
+		if (checked.detail === "name is not valid") throw new CliError("usage", what.name === void 0 ? `The folder's name gives no app name (${JSON.stringify(basename(dir))}): give --name, a lowercase letter then up to 31 lowercase letters, digits or hyphens: ${usage}` : `--name is a lowercase letter then up to 31 lowercase letters, digits or hyphens, not ${JSON.stringify(what.name)}`);
+		if (checked.detail === "title is not valid") throw new CliError("usage", `--title is one line of 1 to ${APP_BUNDLE_LIMITS.title} characters, not ${JSON.stringify(title)}`);
+		throw refused("The template makes no valid manifest", checked);
+	}
+	if (existsSync(dir) && !statSync(dir).isDirectory()) throw new CliError("bad_request", `${dir} is a file: name a folder for the app`);
+	const files = [
+		[APP_SOURCE, `${JSON.stringify(templateManifest({
+			name,
+			title
+		}), null, 2)}\n`],
+		["index.html", page],
+		["README.md", templateReadme({
+			name,
+			title
+		})]
+	];
+	const held = files.map(([path]) => path).filter((path) => existsSync(join(dir, path)));
+	if (held.length && !what.force) throw refused(`${dir} already holds ${held.join(", ")}: nothing was written (--force replaces ${held.length > 1 ? "them" : "it"})`, { reason: "exists" }, { files: held });
+	mkdirSync(dir, { recursive: true });
+	for (const [path, text] of files) writeWhole(join(dir, path), new TextEncoder().encode(text));
+	return {
+		dir,
+		name,
+		title,
+		files: files.map(([path]) => path),
+		...held.length ? { replaced: held } : {},
+		next: `ghostly app publish ${dirArg} --key <a key file outside ${dirArg}>`
+	};
+}
 /** Every file of the folder, as the bundle names it; dot files and folders are left out and listed. */
 function collectFiles(dir, leaveOut) {
 	const files = [];
@@ -13368,11 +13840,22 @@ function collectFiles(dir, leaveOut) {
 		}
 	};
 	walk(dir);
+	files.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
 	return {
 		files,
 		skipped
 	};
 }
+/**
+* A private key in a file: a PEM private key block with its body (PKCS #8, OpenSSH, RSA, EC, encrypted), or a Ghostly
+* key file's first line. A library that only names the block's header in its code does not match.
+*/
+var PRIVATE_KEY = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----\r?\n[A-Za-z0-9+/=\r\n:,-]{40,}-----END [A-Z0-9 ]*PRIVATE KEY-----|^Ghostly (publisher|store) key \(WISP 1200\)/;
+/** Whether `path` is `dir` or anything under it. */
+var isInside = (dir, path) => {
+	const rel = relative(dir, path);
+	return !rel.startsWith("..") && !isAbsolute(rel);
+};
 /** Fields of `ghostly-app.json` the command writes itself. */
 var WRITTEN = ["publisher", "files"];
 function readSource(path) {
@@ -13412,6 +13895,7 @@ async function publishApp(dirArg, keyArg, outArg, sequenceArg) {
 	const dir = resolve(dirArg);
 	if (!statSync(dir).isDirectory()) throw new CliError("bad_request", `${dir} is not a folder`);
 	const keyPath = resolve(keyArg);
+	if (isInside(dir, keyPath)) throw refused(`${keyPath} is inside ${dir}, which is published: keep the publisher key outside the app's folder (and its repository)`, { reason: "private-key" });
 	const out = resolve(outArg ?? join(dir, "app.ghostlyapp"));
 	const sourcePath = join(dir, APP_SOURCE);
 	const draft = readSource(sourcePath);
@@ -13438,6 +13922,11 @@ async function publishApp(dirArg, keyArg, outArg, sequenceArg) {
 		path: f.path,
 		bytes: new Uint8Array(readFileSync(f.full))
 	}));
+	const keyFile = contents.find((f) => PRIVATE_KEY.test(Buffer.from(f.bytes).toString("latin1")));
+	if (keyFile) throw refused(`${keyFile.path} in ${dir} holds a private key, and a bundle is public: move it out of the app's folder`, {
+		reason: "private-key",
+		detail: keyFile.path
+	});
 	const manifest = {
 		...draft,
 		ghostlyApp: 1,
@@ -13446,10 +13935,10 @@ async function publishApp(dirArg, keyArg, outArg, sequenceArg) {
 		files: contents.map((f) => ({
 			path: f.path,
 			size: f.bytes.length,
-			sha256: toBase64Url$1(createHash("sha256").update(f.bytes).digest())
+			sha256: toBase64Url(createHash("sha256").update(f.bytes).digest())
 		}))
 	};
-	const checked = checkAppManifest(JSON.parse(JSON.stringify(manifest)));
+	const checked = checkAppManifest(JSON.parse(JSON.stringify(manifest)), { strict: true });
 	if (!checked.ok) throw refused(`${sourcePath} and the folder's files make no valid manifest`, checked);
 	const { bytes: manifestBytes, signature } = await signAppObject(APP_PREFIXES.app, checked.manifest, key.signer);
 	const bundle = assembleAppBundle(manifestBytes, canonicalJsonBytes(signature), contents.map((f) => f.bytes));
@@ -13564,7 +14053,7 @@ async function signStore(indexArg, keyArg, outArg, now = Math.floor(Date.now() /
 	else key = makeKey(keyPath, "store");
 	if (index.key !== void 0 && index.key !== key.key) throw refused(`${indexPath} names another store key than ${keyPath}'s (${appFingerprint(key.key)})`, { reason: "store-key" });
 	index.key = key.key;
-	const checked = checkAppStoreIndex(index);
+	const checked = checkAppStoreIndex(index, { strict: true });
 	if (!checked.ok) throw refused(`${indexPath} is not a valid store index`, checked);
 	const { indexBytes, sigBytes } = await signAppStore(index, key.signer);
 	const read = readAppStore(indexBytes, sigBytes, now, key.key);
@@ -13627,6 +14116,31 @@ var key = {
 * per command, in alphabetical order (test/commands.test.ts checks).
 */
 var commands$8 = {
+	"app init": {
+		method: "app.init",
+		usage: "app init <dir> [--name <name>] [--title <title>] [--force]",
+		summary: "Start an app (WISP 1200): a small working one in <dir>, its ghostly-app.json, an index.html that says hello to the contact and a README, ready for app publish",
+		args: ["dir"],
+		options: {
+			name: {
+				type: "string",
+				description: "The app's name, lowercase letters, digits and hyphens (default: the folder's)"
+			},
+			title: {
+				type: "string",
+				description: "The title people see, up to 40 characters (default: from the name)"
+			},
+			force: {
+				type: "boolean",
+				description: "Replace the three files when they are there"
+			}
+		},
+		run: ({ options }, a) => initApp(a.dir, {
+			name: options.name,
+			title: options.title,
+			force: options.force === true
+		})
+	},
 	"app publish": {
 		method: "app.publish",
 		usage: "app publish <dir> --key <file> [--out <file>]",
@@ -14142,7 +14656,7 @@ var commands$7 = {
 		method: "call.answer",
 		usage: "call answer [<chat|call>] [--rate 48000]",
 		summary: "Answer a call that rings (the only one, or the one named)",
-		args: ["call..."],
+		args: ["call...?"],
 		options: { rate },
 		params: ({ options }, a) => ({
 			call: a.call,
@@ -14153,7 +14667,7 @@ var commands$7 = {
 		method: "call.auto",
 		usage: "call auto [on|off] [--from <chat>]... [--rate 48000]",
 		summary: "Answer calls by themselves: from anyone, or the chats named (kept in the profile)",
-		args: ["mode..."],
+		args: ["mode...?"],
 		options: {
 			from: {
 				type: "list",
@@ -14175,14 +14689,14 @@ var commands$7 = {
 		method: "call.flush",
 		usage: "call flush [<chat|call>]",
 		summary: "Drop the audio queued and not played yet (barge-in)",
-		args: ["call..."],
+		args: ["call...?"],
 		params: (_, a) => ({ call: a.call })
 	},
 	"call hangup": {
 		method: "call.hangup",
 		usage: "call hangup [<chat|call>]",
 		summary: "Hang up, or decline a call that rings",
-		args: ["call..."],
+		args: ["call...?"],
 		params: (_, a) => ({ call: a.call })
 	},
 	"call list": {
@@ -14336,7 +14850,7 @@ var commands$6 = {
 		method: "chat.rename",
 		usage: "chat rename <chat> <name...>",
 		summary: "Name a chat on this side (empty: the contact's name)",
-		args: ["chat", "name..."],
+		args: ["chat", "name...?"],
 		params: (_, { chat, name }) => ({
 			chat,
 			name: name ?? ""
@@ -14414,14 +14928,17 @@ var commands$6 = {
 			},
 			timeout: groupWait.timeout
 		},
-		params: ({ options }, a) => ({
-			chat: a.chat,
-			messages: (a.message ?? "").split(" ").filter(Boolean),
-			to: options.to,
-			force: options.force === true,
-			wait: options.wait,
-			timeout: options.timeout
-		})
+		params: ({ options }, a) => {
+			if (!Array.isArray(options.to) || !options.to.length) throw new CliError("usage", "Missing --to: ghostly forward <chat|group> <message>... --to <chat|group>... [--force] [--wait none|sent] [--timeout s]");
+			return {
+				chat: a.chat,
+				messages: (a.message ?? "").split(" ").filter(Boolean),
+				to: options.to,
+				force: options.force === true,
+				wait: options.wait,
+				timeout: options.timeout
+			};
+		}
 	},
 	"invite create": {
 		method: "invite.create",
@@ -14499,7 +15016,7 @@ var commands$6 = {
 		args: [
 			"chat",
 			"message",
-			"emoji..."
+			"emoji...?"
 		],
 		options: { remove: {
 			type: "boolean",
@@ -14849,15 +15366,18 @@ var commands$4 = {
 		method: "profile.picture",
 		usage: "profile picture <jpeg> | --clear",
 		summary: "The picture contacts see (a square JPEG, 128 px is what the app sends)",
-		args: ["path..."],
+		args: ["path...?"],
 		options: { clear: {
 			type: "boolean",
 			description: "Remove the picture"
 		} },
-		params: ({ options }, a) => ({
-			path: here(a.path),
-			clear: options.clear === true
-		})
+		params: ({ options }, a) => {
+			if (a.path === void 0 && options.clear !== true) throw new CliError("usage", "Missing <jpeg>: ghostly profile picture <jpeg> | --clear");
+			return {
+				path: here(a.path),
+				clear: options.clear === true
+			};
+		}
 	},
 	"status": {
 		method: "status",
@@ -15034,16 +15554,19 @@ var commands$3 = {
 		method: "group.picture",
 		usage: "group picture <group> <jpeg> | --clear",
 		summary: "Set or clear the group's picture (admin; a square JPEG)",
-		args: ["group", "path..."],
+		args: ["group", "path...?"],
 		options: { clear: {
 			type: "boolean",
 			description: "Remove the picture"
 		} },
-		params: ({ options }, a) => ({
-			group: a.group,
-			path: here(a.path),
-			clear: options.clear === true
-		})
+		params: ({ options }, a) => {
+			if (a.path === void 0 && options.clear !== true) throw new CliError("usage", "Missing <jpeg>: ghostly group picture <group> <jpeg> | --clear");
+			return {
+				group: a.group,
+				path: here(a.path),
+				clear: options.clear === true
+			};
+		}
 	},
 	"group react": {
 		method: "group.react",
@@ -15052,7 +15575,7 @@ var commands$3 = {
 		args: [
 			"group",
 			"message",
-			"emoji..."
+			"emoji...?"
 		],
 		options: { remove: {
 			type: "boolean",
@@ -15662,7 +16185,7 @@ var TEXT_COMMANDS = {
 	"send": {
 		method: "chat.send",
 		target: "chat",
-		args: ["chat", "text..."],
+		args: ["chat", "text...?"],
 		usage: "send <chat> [text...] [--reply <message>] [--button id:Label]... [--style id=primary|neutral|danger]... [--once] [--id id] [--stdin] [--force] [--wait none|sent|delivered]",
 		summary: "Send a message (text from arguments or stdin); --button puts buttons under it, each label its own (case aside)",
 		options: {
@@ -15683,7 +16206,7 @@ var TEXT_COMMANDS = {
 		args: [
 			"chat",
 			"message",
-			"text..."
+			"text...?"
 		],
 		usage: "edit <chat> <message> [text... | --text <text> | --stdin] [--force] [--wait none|confirmed]",
 		summary: "Replace the text of a message you sent (the id send gave; in a group, group edit)",
@@ -15707,7 +16230,7 @@ var TEXT_COMMANDS = {
 	"group send": {
 		method: "group.send",
 		target: "group",
-		args: ["group", "text..."],
+		args: ["group", "text...?"],
 		usage: "group send <group> [text...] [--mention <member>]... [--reply <message>] [--button id:Label]... [--style id=primary|neutral|danger]... [--once] [--id id] [--stdin] [--force] [--wait none|sent] [--timeout s]",
 		summary: "Send to a group; mention members written as @name in the text; --button puts buttons under it",
 		options: {
@@ -15732,7 +16255,7 @@ var TEXT_COMMANDS = {
 		args: [
 			"group",
 			"message",
-			"text..."
+			"text...?"
 		],
 		usage: "group edit <group> <message> [text... | --text <text> | --stdin] [--mention <member>]... [--force] [--wait none|sent] [--timeout s]",
 		summary: "Replace the text of a message you sent to a group (the id group send gave)",
@@ -15773,13 +16296,15 @@ var ID_ARGS = /* @__PURE__ */ new Set([
 	"service",
 	"call"
 ]);
+/** A leading positional that may be left out (`name?`); a trailing one that may (`text...?`) shifts nothing. */
+var leadingOptional = (name) => name.endsWith("?") && !name.endsWith("...?");
 /**
 * Which of a command's positionals take an id, by index (a trailing `...` one covers the rest). An optional `name?`
 * shifts the others, so it counts only where it and what may come in its place are all ids.
 */
 function idSlot(command) {
 	const names = (command.args ?? []).map((name) => name.replace(/\?$/, ""));
-	const shift = (command.args ?? []).filter((name) => name.endsWith("?")).length;
+	const shift = (command.args ?? []).filter(leadingOptional).length;
 	const rest = names.findIndex((name) => name.endsWith("..."));
 	const at = (index) => {
 		const name = rest !== -1 && index >= rest ? names[rest].slice(0, -3) : names[index];
@@ -15789,29 +16314,36 @@ function idSlot(command) {
 }
 /**
 * The positionals of a command, by name; missing required ones are a usage error. A leading `name?` is optional: it
-* is given only when every required one is there too (`file accept [<chat>] <file>`).
+* is given only when every required one is there too (`file accept [<chat>] <file>`). A trailing `name...` takes the
+* rest and needs at least one word; `name...?` may take none (text from stdin, `chat rename`'s name back to the
+* contact's).
 */
 function positionals(command, values) {
 	let names = command.args ?? [];
-	const optional = names.filter((name) => name.endsWith("?"));
+	const optional = names.filter(leadingOptional);
 	if (optional.length) {
 		const skip = Math.max(0, optional.length - Math.max(0, values.length - (names.length - optional.length)));
-		names = [...optional.slice(skip).map((name) => name.slice(0, -1)), ...names.filter((name) => !name.endsWith("?"))];
+		names = [...optional.slice(skip).map((name) => name.slice(0, -1)), ...names.filter((name) => !leadingOptional(name))];
 	}
 	const out = {};
 	for (let i = 0; i < names.length; i++) {
-		const name = names[i];
+		const name = names[i].replace(/\?$/, "");
 		if (name.endsWith("...")) {
 			const rest = values.slice(i);
+			if (!rest.length && !names[i].endsWith("?")) throw new CliError("usage", `Missing <${name.slice(0, -3)}>: ghostly ${command.usage}`);
 			out[name.slice(0, -3)] = rest.length ? rest.join(" ") : void 0;
 			return out;
 		}
 		if (values[i] === void 0) throw new CliError("usage", `Missing <${name}>: ghostly ${command.usage}`);
 		out[name] = values[i];
 	}
-	if (values.length > names.length) throw new CliError("usage", `Too many arguments: ghostly ${command.usage}`);
+	noMoreThan(names.length, values, command.usage);
 	return out;
 }
+/** Words past a usage's arguments are refused, never dropped: `profile use my bot` would select `my`. */
+function noMoreThan(count, values, usage) {
+	if (values.length > count) throw new CliError("usage", `Too many arguments: ghostly ${usage}`);
+}
 //#endregion
 //#region src/announce.ts
 /**
@@ -15955,6 +16487,19 @@ function audioSocketPath(profileDir, callId) {
 	return join("/tmp", `ghostly-calls-${createHash("sha256").update(profileDir).digest("hex").slice(0, 24)}`, `${callId}.sock`);
 }
 /**
+* Removes the call sockets a daemon that died during a call left in this profile's folder (`audioSocketPath`; call
+* ids are 12 hex digits): no call outlives its daemon. A folder that is a link or someone else's is left alone.
+*/
+function clearAudioSockets(profileDir) {
+	if (process.platform === "win32") return;
+	const folder = dirname(audioSocketPath(profileDir, "0".repeat(12)));
+	try {
+		const info = lstatSync(folder);
+		if (!info.isDirectory() || process.getuid && info.uid !== process.getuid()) return;
+		for (const entry of readdirSync(folder, { withFileTypes: true })) if (entry.name.endsWith(".sock") && !entry.isDirectory()) rmSync(join(folder, entry.name), { force: true });
+	} catch {}
+}
+/**
 * Serves one call's audio to one program at a time: what the program writes is handed to `onAudio` as it comes (raw
 * PCM, any amount); `write` gives it the caller's audio. A second connection replaces the first. `close` ends the
 * program's connection (it reads EOF) and removes the socket.
@@ -16137,8 +16682,6 @@ var ReorderBuffer = class {
 		}
 	}
 };
-//#endregion
-//#region src/calls/audio.ts
 /**
 * One call's audio: every 20 ms a frame from the queue (the program's audio, or silence) is encoded and sent; what
 * comes in is put back in order, decoded, and handed on in 20 ms frames as soon as it is. Nothing waits on a clock
@@ -16161,6 +16704,8 @@ var CallAudio = class {
 	/** Frames sent and received, for `call list`. */
 	sent = 0;
 	received = 0;
+	/** When the last packet, RTP or RTCP, came from the contact (Date.now(); 0: none yet), for the call's watch. */
+	heardAt = 0;
 	constructor(options) {
 		this.options = options;
 		const now = options.now ?? Date.now;
@@ -16202,7 +16747,9 @@ var CallAudio = class {
 	}
 	/** Handles one packet from the track. Exposed for tests. */
 	receive(packet) {
-		if (this.stopped || isRtcp(packet)) return;
+		if (this.stopped) return;
+		this.heardAt = (this.options.now ?? Date.now)();
+		if (isRtcp(packet)) return;
 		const rtp = parseRtp(packet);
 		if (!rtp || rtp.payloadType !== this.options.payloadType) return;
 		for (const item of this.reorder.push(rtp)) {
@@ -16231,7 +16778,7 @@ var CallAudio = class {
 		const due = this.startedAt + (this.ticks + 1) * 20;
 		this.timer = setTimeout(() => {
 			if (this.stopped) return;
-			if (now() - due > 100) {
+			if (now() - due > 1e3) {
 				this.startedAt = now();
 				this.ticks = 0;
 			} else this.ticks++;
@@ -16524,6 +17071,7 @@ var CallManager = class {
 		this.host = host;
 		this.configPath = join(host.profileDir, "calls.json");
 		this.auto = readAuto(this.configPath);
+		if (host.answers !== false) clearAudioSockets(host.profileDir);
 	}
 	get now() {
 		return (this.host.now ?? Date.now)();
@@ -16808,6 +17356,9 @@ var CallManager = class {
 			startedAt: this.now,
 			connectedAt: null,
 			timer: null,
+			watcher: null,
+			stalledFrom: null,
+			stalls: 0,
 			ended: false
 		};
 		this.calls.set(call.id, call);
@@ -16867,12 +17418,58 @@ var CallManager = class {
 			direction: call.direction,
 			audio: this.audioInfo(call)
 		});
+		this.watch(call);
+	}
+	/**
+	* libjuice says nothing of a contact whose side went away (a crash, a closed lid, a lost network) until its consent
+	* checks fail, about 30 s later: a connected call watches the contact's packets instead. An app sends them all along
+	* (silence while muted, and RTCP), and so does the CLI. Nothing for STALL_MS: `call.stalled`; packets again:
+	* `call.resumed`; nothing for STALL_END_MS: the call ends as `failed`, and the contact's app is told.
+	*/
+	watch(call) {
+		const { afterMs, endMs } = this.host.stall ?? {
+			afterMs: 5e3,
+			endMs: 15e3
+		};
+		const since = Date.now();
+		call.watcher = setInterval(() => {
+			if (call.ended) return;
+			const heardAt = Math.max(since, call.media?.audio.heardAt ?? 0);
+			const silentMs = Date.now() - heardAt;
+			const fields = {
+				call: call.id,
+				chat: call.chat,
+				direction: call.direction
+			};
+			if (silentMs >= endMs) {
+				process.stderr.write(`ghostly: call ${call.id}: nothing heard from the contact for ${Math.round(silentMs / 1e3)} s\n`);
+				this.end(call, "failed", true);
+			} else if (silentMs >= afterMs && call.stalledFrom === null) {
+				call.stalledFrom = heardAt;
+				call.stalls++;
+				process.stderr.write(`ghostly: call ${call.id}: stalled, nothing heard from the contact for ${silentMs} ms\n`);
+				this.host.emit("call.stalled", `call.stalled:${call.id}:${call.stalls}`, {
+					...fields,
+					silentMs
+				});
+			} else if (silentMs < afterMs && call.stalledFrom !== null) {
+				const gapMs = heardAt - call.stalledFrom;
+				call.stalledFrom = null;
+				process.stderr.write(`ghostly: call ${call.id}: resumed after ${gapMs} ms\n`);
+				this.host.emit("call.resumed", `call.resumed:${call.id}:${call.stalls}`, {
+					...fields,
+					silentMs: gapMs
+				});
+			}
+		}, Math.min(1e3, afterMs / 5));
+		call.watcher.unref?.();
 	}
 	async end(call, reason, tell, report = true) {
 		if (call.ended) return;
 		call.ended = true;
 		call.reason = reason;
 		this.disarm(call);
+		if (call.watcher) clearInterval(call.watcher);
 		this.calls.delete(call.id);
 		if (report) process.stderr.write(`ghostly: call ${call.id}: ended (${reason})${call.media ? `, ice ${call.media.ice.state}` : ""}\n`);
 		call.media?.close();
@@ -16943,6 +17540,7 @@ var CallManager = class {
 			chat: call.chat,
 			direction: call.direction,
 			state: call.state,
+			stalled: call.stalledFrom !== null,
 			video: call.video,
 			startedAt: call.startedAt,
 			connectedAt: call.connectedAt,
@@ -18428,10 +19026,11 @@ async function openPersistentIndexedDb(dir) {
 	const pending = /* @__PURE__ */ new WeakMap();
 	const snapshotPath = join(dir, SNAPSHOT);
 	const journalPath = join(dir, JOURNAL);
-	if (existsSync(snapshotPath)) restore(classes, raw._databases, deserialize(readFileSync(snapshotPath)));
-	if (existsSync(journalPath)) replay(raw._databases, readFileSync(journalPath));
+	const snapshotFound = existsSync(snapshotPath), journalFound = existsSync(journalPath);
+	if (snapshotFound) restore(classes, raw._databases, deserialize(readFileSync(snapshotPath)), (a, b) => factory.cmp(a, b));
+	if (journalFound) replay(raw._databases, readFileSync(journalPath));
 	restoring = false;
-	await writeSnapshot();
+	if (journalFound || !snapshotFound) await writeSnapshot();
 	const storeProto = classes.ObjectStore.prototype;
 	const storeRecord = storeProto.storeRecord;
 	const deleteRecord = storeProto.deleteRecord;
@@ -18614,7 +19213,12 @@ async function probeClasses(factory) {
 	});
 	return classes;
 }
-function restore(classes, databases, snapshot) {
+/**
+* The snapshot's records come in key order (as `writeSnapshot` walks them), so each store's tree and each index's are
+* built whole from sorted arrays: storing record by record compared every key down the tree, a 70,000-message profile
+* took seconds. A snapshot not in order (never written so) is stored record by record.
+*/
+function restore(classes, databases, snapshot, cmp) {
 	if (snapshot?.format !== 1) throw new Error("This profile was last used by a newer version of ghostly (its store has a format this version does not read). Update ghostly to open it.");
 	for (const saved of snapshot.databases) {
 		const db = new classes.Database(saved.name, saved.version);
@@ -18627,16 +19231,103 @@ function restore(classes, databases, snapshot) {
 				store.rawIndexes.set(i.name, index);
 			}
 			db.rawObjectStores.set(s.name, store);
-			for (const [key, value] of s.records) store.storeRecord({
+			const records = s.records.map(([key, value]) => ({
 				key,
 				value: blobsFromDisk(value)
-			}, false);
+			}));
+			if (records.some((record, at) => at > 0 && cmp(records[at - 1].key, record.key) >= 0)) {
+				for (const record of records) store.storeRecord(record, false);
+				continue;
+			}
+			fill(store.records, records);
+			for (const index of store.rawIndexes.values()) fill(index.records, indexEntries(index, records, cmp));
 		}
 		databases.set(saved.name, db);
 	}
 }
-/** Replays whole entries; a torn last entry (the process died mid-write) was never acknowledged and is dropped. */
+/**
+* An index's entries for records in key order, sorted by the index's key: the index derives them itself (key path,
+* multi-entry, invalid keys skipped) into a list instead of its tree. A stable sort keeps equal index keys in the
+* records' key order, the tree's own tie-break.
+*/
+function indexEntries(index, records, cmp) {
+	const entries = [];
+	const tree = index.records;
+	index.records = {
+		get: () => void 0,
+		put: (entry) => {
+			entries.push(entry);
+		}
+	};
+	try {
+		for (const record of records) if (!absent(index.keyPath, record.value)) index.storeRecord(record);
+	} finally {
+		index.records = tree;
+	}
+	return entries.sort((a, b) => cmp(a.key, b.key));
+}
+/**
+* Whether a key path surely finds nothing in a value: a plain object along it lacks the step (most messages have no
+* `card` for the card index). The index would throw and catch a DataError for each of those; anything else it judges.
+*/
+function absent(keyPath, value) {
+	if (typeof keyPath !== "string" || keyPath === "") return false;
+	let object = value;
+	for (const step of keyPath.split(".")) {
+		if (object === null || typeof object !== "object" || Array.isArray(object) || object instanceof Blob) return false;
+		if (!Object.hasOwn(object, step)) return true;
+		object = object[step];
+	}
+	return false;
+}
+/**
+* fake-indexeddb's red-black tree, built balanced from sorted records: every level full but the last, whose nodes
+* are red, so each path holds the same number of black nodes and later inserts rebalance as usual.
+*/
+function fill(store, sorted) {
+	const deepest = sorted.length ? Math.floor(Math.log2(sorted.length)) : 0;
+	const build = (low, high, parent, depth) => {
+		if (low > high) return void 0;
+		const middle = low + high >>> 1;
+		const node = {
+			record: sorted[middle],
+			left: void 0,
+			right: void 0,
+			parent,
+			deleted: false,
+			red: depth > 0 && depth === deepest
+		};
+		node.left = build(low, middle - 1, node, depth + 1);
+		node.right = build(middle + 1, high, node, depth + 1);
+		return node;
+	};
+	store.records._root = build(0, sorted.length - 1, void 0, 0);
+	store.records._numNodes = sorted.length;
+	store.records._numTombstones = 0;
+}
+/**
+* Replays whole entries; a torn last entry (the process died mid-write) was never acknowledged and is dropped.
+*
+* A store's indexes are set aside while its ops replay and rebuilt once at the end: fake-indexeddb drops an
+* overwritten or deleted record from an index by walking every record of it, so a crash after a busy chat took
+* tens of seconds to minutes to start, one write at a time against the whole profile.
+*/
 function replay(databases, journal) {
+	const touched = /* @__PURE__ */ new Map();
+	try {
+		replayEntries(databases, journal, touched);
+	} finally {
+		for (const [store, indexes] of touched) {
+			store.rawIndexes = indexes;
+			for (const index of indexes.values()) {
+				index.records.clear();
+				if (!index.initialized) continue;
+				for (const record of store.records.values()) index.storeRecord(record);
+			}
+		}
+	}
+}
+function replayEntries(databases, journal, touched) {
 	let offset = 0;
 	while (offset + 4 <= journal.length) {
 		const length = journal.readUInt32BE(offset);
@@ -18651,6 +19342,10 @@ function replay(databases, journal) {
 		for (const op of ops) {
 			const store = databases.get(op.db)?.rawObjectStores.get(op.store);
 			if (!store) continue;
+			if (!touched.has(store)) {
+				touched.set(store, store.rawIndexes);
+				store.rawIndexes = /* @__PURE__ */ new Map();
+			}
 			if (op.kind === "put") store.storeRecord({
 				key: op.key,
 				value: blobsFromDisk(op.value)
@@ -18892,7 +19587,7 @@ async function startRuntime(paths, options = {}) {
 	const restored = join(paths.dir, RESTORED_MARK);
 	if (existsSync(restored)) {
 		try {
-			const rows = await import("./assets/restoredRows-lhTKGmCO.js");
+			const rows = await import("./assets/restoredRows-C_84q0Pd.js");
 			await rows.markRestoredWallet();
 			await rows.markLeftOutFiles(leftOutIn(restored));
 			await store.compact();
@@ -18911,16 +19606,16 @@ async function startRuntime(paths, options = {}) {
 	await installEventSource();
 	await preloadWalletModules();
 	(await import("./assets/ghostly_iroh_web-Dvzh3Y6E.js")).initSync({ module: irohWasmBytes() });
-	const [{ registerFileBytes }, { NodeFileBytes }] = await Promise.all([import("./assets/fileBytes-3AQ2tJzW.js").then((n) => n.o), import("./assets/fileBytes-CAZDydIe.js")]);
+	const [{ registerFileBytes }, { NodeFileBytes }] = await Promise.all([import("./assets/fileBytes-BcYZhNgF.js").then((n) => n.o), import("./assets/fileBytes-Dbifu5I5.js")]);
 	registerFileBytes("native", async () => new NodeFileBytes(paths.files), true);
-	const [{ EngineServer }, { createHyperEndpoint }] = await Promise.all([import("./assets/server-GJW_5wGI.js").then((n) => n.t), import("./assets/endpoint-D_3bYafG.js")]);
+	const [{ EngineServer }, { createHyperEndpoint }] = await Promise.all([import("./assets/server-BGXmSYx_.js").then((n) => n.t), import("./assets/endpoint-pgFkR2AS.js")]);
 	const network = hyperdhtNetwork();
 	const dht = mainlineNetwork();
-	const mainline = dht.off ? null : new (await (import("./assets/mainline-B7wHcLaW.js"))).Mainline({
+	const mainline = dht.off ? null : new (await (import("./assets/mainline-BueFJx3f.js"))).Mainline({
 		bootstrap: dht.bootstrap,
 		host: dht.host
 	});
-	const transport = mainline || pinned ? new (await (import("./assets/mainline-B7wHcLaW.js"))).RelaysAndDht(mainline, pinned ? { relays: pinned } : {}, !!pinned) : null;
+	const transport = mainline || pinned ? new (await (import("./assets/mainline-BueFJx3f.js"))).RelaysAndDht(mainline, pinned ? { relays: pinned } : {}, !!pinned) : null;
 	const server = new EngineServer({
 		...transport ? { transport } : {},
 		irohWeb: true,
@@ -18930,6 +19625,7 @@ async function startRuntime(paths, options = {}) {
 		automaticWallets: false,
 		fedimintSdk: nodeFedimintSdk(join(paths.dir, "fedimint")),
 		servicesSupport: true,
+		apps: false,
 		staysOnline: process.env.GHOSTLY_HUB !== "0",
 		localFetch: nodeLocalFetch,
 		pushSend: (request) => nodePushSend(request),
@@ -18979,6 +19675,7 @@ async function openHost(paths, mode, version, options = {}) {
 		await hub.open();
 		const node = runtime.server.node;
 		const now = node.getState();
+		const mark = runtime.server.historyMark;
 		const histories = /* @__PURE__ */ new Map();
 		for (const link of now.links) histories.set(link.id, await node.getMessages(link.id));
 		for (const group of now.groups) histories.set(`group:${group.id}`, await node.groupMessages({ groupId: group.id }));
@@ -18992,7 +19689,10 @@ async function openHost(paths, mode, version, options = {}) {
 		});
 		const manager = calls;
 		hub.onCallSignal((chat, signal) => manager.onSignal(chat, signal));
-		runtime.server.attach(hub.sink);
+		runtime.server.attach(hub.sink, {
+			mark,
+			ids: histories.keys()
+		});
 	} catch (error) {
 		await runtime.close().catch(() => {});
 		release();
@@ -19320,6 +20020,7 @@ async function post(url, event) {
 		try {
 			if ((await fetch(url, {
 				method: "POST",
+				redirect: "manual",
 				headers: {
 					"content-type": "application/json",
 					"x-ghostly-event": event.type,
@@ -19508,7 +20209,10 @@ var SPECIAL = [
 		{
 			out: o("string", "The backup file to write"),
 			"passphrase-file": o("string", "The passphrase, from this file (else GHOSTLY_BACKUP_PASSPHRASE)"),
-			passphrase: o("boolean", "--no-passphrase: do not encrypt. The file then holds the profile's keys and wallet secrets in the clear"),
+			passphrase: {
+				...o("boolean", "Do not encrypt. The file then holds the profile's keys and wallet secrets in the clear"),
+				negatedOnly: true
+			},
 			light: o("boolean", "Leave out files over 1 MB (voice messages over 4 MB); their messages stay")
 		}
 	],
@@ -19579,7 +20283,8 @@ var SPECIAL = [
 			days: o("number", "How long the proof holds"),
 			timeout: o("number", "Seconds to wait for an approval")
 		}
-	]
+	],
+	["version", "This CLI's version (also ghostly --version)"]
 ];
 function help() {
 	const rows = [
@@ -19645,7 +20350,9 @@ function commandHelp(words) {
 		const options = Object.entries(row.options ?? {}).filter(([, o]) => o.description);
 		if (options.length) {
 			lines.push("", "Options:");
-			for (const [name, o] of options) lines.push(`  --${name}${o.type === "boolean" ? "" : ` <${o.type === "number" ? "n" : "value"}>`}`.padEnd(26) + o.description);
+			const labels = options.map(([name, o]) => `  --${o.negatedOnly ? "no-" : ""}${name}${o.type === "boolean" ? "" : ` <${o.type === "number" ? "n" : "value"}>`}`);
+			const width = Math.max(26, ...labels.map((label) => label.length + 2));
+			options.forEach(([, o], i) => lines.push(labels[i].padEnd(width) + o.description));
 		}
 		if (Object.values(TEXT_COMMANDS).includes(row)) lines.push("", "  -- ends the options: everything after it is the text, options included (\"-- -1 --wait sent\" sends", "  all of it). Put options before --.");
 		lines.push("");
@@ -19733,6 +20440,7 @@ async function profileCommand(sub, argv) {
 			return;
 		}
 		case "list": {
+			noMoreThan(0, parsed.positionals, "profile list");
 			const current = currentProfile(g.home);
 			print({
 				profiles: listProfiles(g.home).map((name) => ({
@@ -19747,14 +20455,17 @@ async function profileCommand(sub, argv) {
 		case "use": {
 			const [name] = parsed.positionals;
 			if (!name) throw new CliError("usage", "ghostly profile use <name>");
+			noMoreThan(1, parsed.positionals, "profile use <name>");
 			selectProfile(g.home, name);
 			print({ current: name });
 			return;
 		}
 		case "show":
+			noMoreThan(0, parsed.positionals, "profile show");
 			print(await withSession(g, (s) => s.call("profile.get")));
 			return;
 		case "set": {
+			noMoreThan(0, parsed.positionals, "profile set [--name <name>] [--share-profile | --no-share-profile]");
 			const params = {};
 			if (parsed.options.name !== void 0) params.name = parsed.options.name;
 			if (parsed.options["share-profile"] !== void 0) params.shareProfile = parsed.options["share-profile"];
@@ -19763,6 +20474,7 @@ async function profileCommand(sub, argv) {
 			return;
 		}
 		case "backup": {
+			noMoreThan(0, parsed.positionals, "profile backup --out <file> [--passphrase-file f | --no-passphrase] [--light]");
 			const out = parsed.options.out;
 			if (typeof out !== "string") throw new CliError("usage", "ghostly profile backup --out <file> [--passphrase-file f | --no-passphrase] [--light] (or GHOSTLY_BACKUP_PASSPHRASE)");
 			const unsealed = parsed.options.passphrase === false;
@@ -19785,6 +20497,7 @@ async function profileCommand(sub, argv) {
 		case "restore": {
 			const [file, name] = parsed.positionals;
 			if (!file || !name) throw new CliError("usage", "ghostly profile restore <file> <new profile> [--passphrase-file f] [--use]");
+			noMoreThan(2, parsed.positionals, "profile restore <file> <new profile> [--passphrase-file f] [--use]");
 			const protection = await backupFileProtection(file);
 			const paths = await restoreProfile(g.home, checkProfileName(name), file, protection === "none" ? void 0 : backupPassphrase(parsed.options["passphrase-file"]));
 			if (parsed.options.use) selectProfile(g.home, name);
@@ -19872,6 +20585,11 @@ async function daemonCommand(argv) {
 	});
 	const g = globals(parsed);
 	pretty = g.pretty;
+	if (!sub || [
+		"status",
+		"stop",
+		"restart"
+	].includes(sub)) noMoreThan(0, parsed.positionals, sub ? `daemon ${sub}` : "daemon [--detach]");
 	if (sub === "status") {
 		const client = await connectDaemon(g.paths.socket);
 		if (!client) {
@@ -20143,6 +20861,7 @@ async function engineCommand(argv) {
 	const g = globals(parsed);
 	pretty = g.pretty;
 	if (parsed.options.list) {
+		noMoreThan(0, parsed.positionals, "engine --list");
 		print({ methods: [...ENGINE_METHODS, ...ENGINE_READS].sort() });
 		return;
 	}
@@ -20186,6 +20905,7 @@ async function settingsCommand(sub, argv) {
 	const g = globals(parsed);
 	pretty = g.pretty;
 	if (sub === "get") {
+		noMoreThan(0, parsed.positionals, "settings get [--show-secret]");
 		print(await withSession(g, (s) => s.call("settings.get", { showSecret: parsed.options["show-secret"] === true })));
 		return;
 	}
@@ -20198,6 +20918,7 @@ async function settingsCommand(sub, argv) {
 		} catch {
 			parsedValue = value;
 		}
+		if (SETTABLE[key] === "string" && typeof parsedValue !== "string") parsedValue = value;
 		print(await withSession(g, (s) => s.call("settings.set", { [key]: parsedValue })));
 		return;
 	}
@@ -20358,7 +21079,7 @@ async function tableCommand(name, argv) {
 * contact's, raw PCM); what the command says goes to stderr. It ends when the call does.
 */
 async function callPipeCommand(argv) {
-	const parsed = parseArgs(argv, {}, idSlot({ args: ["call..."] }));
+	const parsed = parseArgs(argv, {}, idSlot({ args: ["call...?"] }));
 	const g = globals(parsed);
 	const ref = parsed.positionals.join(" ") || void 0;
 	const client = await connectDaemon(g.paths.socket);
@@ -20400,7 +21121,7 @@ function helpAsked(argv) {
 }
 async function main(input) {
 	const argv = liftGlobals(input);
-	const helpFor = argv.length === 0 ? [] : helpAsked(argv);
+	const helpFor = argv.length === 0 || globalOption(argv[0]) ? [] : helpAsked(argv);
 	if (helpFor) {
 		process.stdout.write((helpFor.length ? commandHelp(helpFor) : help()) + "\n");
 		return 0;