@ghostlytools/cli 1.1.7 → 1.2.1

package/dist/ghostly.mjs

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { t as __exportAll } from "./assets/rolldown-runtime-8H4AJuhK.js";
-import { $ as parseSshPublicKey, $a as signAppRevocation, $n as GROUP_FILE_LIMITS, Aa as replySnippet, An as nip05RootKey, At as didWebDocumentUrl, Bc as sanitizeAvatar, Bn as engineText, Bt as staticDidDocument, Cc as setLinkTraceSink, Cn as DOMAIN_FILE_MAX_BYTES, Co as callRtcConfig, Dn as domainWellKnownFile, Do as signalHasVideo, Dt as didGhostlyServiceEntry, En as domainTxtRecord, Eo as parseCallSignal, Et as checkDidSignature, Fa as buttonLabelClash, Fn as txtValue, Ft as normalizeDid, Ga as APP_STATEMENT_LIMITS, Gc as toZ32, Gi as irohRelayUrl, Hc as fromBase64Url$1, Hr as TYPING_REFRESH_MS, Ia as checkStatusCard, In as wellKnownUrl, It as parseDid, Ja as checkAppRevokeStatement, Ka as appFingerprint, Kc as utf8Decode, Ks as inviteLink, Kt as resolveDidDht, Ln as requestLnurlInvoice, Lr as ChatFiles, Lt as parseDidDocument, Ma as ITEM_STATES, Mc as openRelayPayload, Mn as recordsFromTxt, Mt as didWebFileNames, Na as RUN_RESULTS, Nn as recordsFromWellKnown, Nt as didWebFileUrl, On as encodeDnsQuery, Ot as didJwsAlg, Pa as STATUS_CARD_LIMITS, Pi as identityStatement, Pn as recordsName, Pt as didWebHost, Q as SshSigError, Qa as signAppObject, Qi as readImageMeta, Rn as resolveLightningDestination, Rt as parseDidSignaturePaste, Sn as pubkyHomeserverOf, So as buildSdpFromSignal, St as DID_FILE_MAX_BYTES, Tn as dnsProofName, To as extractParamsFromSdp, Tt as checkDidJws, Uc as randomBytes$1, Vn as decodeBolt11, Vr as TYPING_KINDS, Vt as strictBase64Url, Wa as APP_PREFIXES, Wc as toBase64Url$1, Wi as irohDescriptor, Wr as sanitizeTypingStatus, Y as groupName, Z as SSHSIG_NAMESPACE, Za as readAppRevocations, _n as normalizePubkyKey, _t as parseAtprotoDidDocument, a as checkAppStoreIndex, aa as baseMime, ar as isGroupMessageId, at as BitcoinAddressError, bn as pubkyProofPath, bo as RTC_CONFIG, bt as verifyAtprotoRecordProof, c as APP_BUNDLE_LIMITS, ca as voicePeaksOf, cr as readGroupWant, ct as ATPROTO_FULL_SCOPE, di as BUTTONS_CAPABILITY, dt as atprotoDidMethod, eo as canonicalJson, er as GROUP_HAVE_FRAME, et as parseSshSignature, f as assembleAppBundle, fa as RateWindow, fo as GhostlyHttpError, ft as atprotoProofRecord, gn as newPubkyProofFolder, go as LIMITS, gt as normalizeAtprotoHandle, h as readAppBundle, hn as isPubkyProofFolder, ht as isAtprotoDid, ia as VOICE_LIMITS, ir as groupFileFallback, it as verifyBitcoinMessage, ji as boundVerifiedIdentity, jn as normalizeDomain, jt as didWebFile, kc as RELAY_PAYLOAD_MAX_BYTES, ki as IdentityCheckUnavailable, kn as isPublicAddress, kt as didSignedMessages, lr as readGroupWantNo, lt as ATPROTO_PROOF_COLLECTION, m as isAppUrl, mn as isPubkyKey, mt as checkAtprotoProofRecord, na as sanitizeMime, nn as WALLET_NETWORKS, nr as GROUP_WANT_NO_FRAME, nt as sshSignCommand, o as readAppStore, oa as fileMessageText, oi as checkPushEndpoint, ot as decodeAnyBitcoinAddress, p as checkAppManifest, pn as PUBKY_PROOF_MAX_BYTES, pt as atprotoProofRkey, qa as appRef, qc as utf8Encode, ra as PLAYABLE_AUDIO, rc as seedSigner, rr as fetchesByItself, rt as verifySshSignature, s as signAppStore, sa as parseVoiceMeta, sn as walletNetworkOf, sr as readGroupHave, st as ATPROTO_DECLARED_SCOPE, t as appStoreDecision, ta as sanitizeFileName, to as canonicalJsonBytes, tt as sameSshKey, ut as ATPROTO_PROOF_SCOPE, vn as pubkyProofCapability, vt as shortAtprotoDid, wn as decodeDnsResponse, wo as callSignalHeardAt, wt as DidError, xn as homeserverWebEndpoint, xo as answersOffer, xt as DID_DOCUMENT_MAX_BYTES$1, yn as pubkyProofFile, yo as CALL_SIGNAL_MAX_AGE_MS, yt as AtprotoProofError, zc as MAX_AVATAR_LENGTH, zn as engineError, zr as transferEnded, zt as signingKeys } from "./assets/src-Cp3o_yHN.js";
-import { c as fileStore, d as store$1, f as transact, i as STORES, l as openDb, o as databaseName, p as wrap } from "./assets/idb-BIdus0WX.js";
-import { a as fileBytesOf, i as fileBytes, l as FILE_BYTES_STEP } from "./assets/fileBytes-3AQ2tJzW.js";
+import { $ as SSHSIG_NAMESPACE, $a as appRef, $c as randomBytes$1, $n as engineError, An as encodeDnsQuery, Ao as RTC_CONFIG, At as didJwsAlg, Ba as cardLine, Bn as resolveLightningDestination, Bt as parseDidSignaturePaste, Cn as homeserverWebEndpoint, Ct as DID_DOCUMENT_MAX_BYTES$1, Dn as dnsProofName, Dt as checkDidJws, En as decodeDnsResponse, Eo as LIMITS, Et as DidError, Fa as PR_CHECKS, Fn as recordsFromWellKnown, Fo as extractParamsFromSdp, Ft as didWebFileUrl, Ha as checkStatusCard, Hc as openRelayPayload, Ht as staticDidDocument, Ia as PR_STATES, Ii as identityStatement, In as recordsName, Io as parseCallSignal, It as didWebHost, Jt as resolveDidDht, Ki as irohDescriptor, Kr as sanitizeTypingStatus, La as RUN_RESULTS, Ln as txtValue, Lo as signalHasVideo, Lt as normalizeDid, Ma as replySnippet, Mn as nip05RootKey, Mo as buildSdpFromSignal, Mt as didWebDocumentUrl, Nc as setLinkTraceSink, Ni as boundVerifiedIdentity, Nn as normalizeDomain, No as callRtcConfig, Nt as didWebFile, On as domainTxtRecord, Ot as checkDidSignature, Pa as ITEM_STATES, Pn as recordsFromTxt, Po as callSignalHeardAt, Pt as didWebFileNames, Qa as appFingerprint, Qc as fromBase64Url$1, Ra as STATUS_CARD_LIMITS, Rn as wellKnownUrl, Rt as parseDid, Sn as pubkyProofPath, So as GhostlyHttpError, St as verifyAtprotoRecordProof, Tn as DOMAIN_FILE_MAX_BYTES, Ur as TYPING_KINDS, Ut as strictBase64Url, Va as cardUrl, Vn as decodeBolt11, Vr as transferEnded, Vt as signingKeys, Wr as TYPING_REFRESH_MS, Xa as APP_PREFIXES, Xc as sanitizeAvatar, Yc as MAX_AVATAR_LENGTH, Z as groupName, Za as APP_STATEMENT_LIMITS, _ as readAppBundle, _n as isPubkyProofFolder, _t as isAtprotoDid, aa as PLAYABLE_AUDIO, ao as signAppObject, ar as fetchesByItself, at as verifySshSignature, bn as pubkyProofCapability, bt as shortAtprotoDid, c as signAppStore, ca as fileMessageText, ci as checkPushEndpoint, co as canonicalJsonBytes, ct as decodeAnyBitcoinAddress, dr as readGroupWantNo, dt as ATPROTO_PROOF_COLLECTION, ea as readImageMeta, el as toBase64Url, eo as checkAppRevokeStatement, er as engineText, et as SshSigError, ft as ATPROTO_PROOF_SCOPE, g as isAppUrl, gn as isPubkyKey, gt as checkAtprotoProofRecord, h as checkAppManifest, hn as PUBKY_PROOF_MAX_BYTES, ht as atprotoProofRkey, ia as sanitizeMime, in as WALLET_NETWORKS, io as readAppRevocations, ir as GROUP_WANT_NO_FRAME, it as sshSignCommand, ji as IdentityCheckUnavailable, jn as isPublicAddress, jo as answersOffer, jt as didSignedMessages, kn as domainWellKnownFile, ko as CALL_SIGNAL_MAX_AGE_MS, kt as didGhostlyServiceEntry, l as APP_BUNDLE_LIMITS, la as parseVoiceMeta, ln as walletNetworkOf, lr as readGroupHave, lt as ATPROTO_DECLARED_SCOPE, m as assembleAppBundle, ma as RateWindow, mt as atprotoProofRecord, n as appStoreDecision, nc as inviteLink, nl as utf8Decode, nr as GROUP_HAVE_FRAME, nt as parseSshSignature, o as checkAppStoreIndex, oa as VOICE_LIMITS, oo as signAppRevocation, or as groupFileFallback, ot as verifyBitcoinMessage, pc as seedSigner, pi as BUTTONS_CAPABILITY, pt as atprotoDidMethod, qi as irohRelayUrl, ra as sanitizeFileName, rl as utf8Encode, rt as sameSshKey, s as readAppStore, sa as baseMime, so as canonicalJson, sr as isGroupMessageId, st as BitcoinAddressError, tl as toZ32, tr as GROUP_FILE_LIMITS, tt as parseSshPublicKey, ua as voicePeaksOf, ur as readGroupWant, ut as ATPROTO_FULL_SCOPE, vn as newPubkyProofFolder, vt as normalizeAtprotoHandle, wn as pubkyHomeserverOf, wt as DID_FILE_MAX_BYTES, xn as pubkyProofFile, xt as AtprotoProofError, yn as normalizePubkyKey, yt as parseAtprotoDidDocument, za as buttonLabelClash, zc as RELAY_PAYLOAD_MAX_BYTES, zn as requestLnurlInvoice, zr as ChatFiles, zt as parseDidDocument } from "./assets/src-aKGjb_yz.js";
+import { c as fileStore, f as store$1, i as STORES, m as wrap, o as databaseName, p as transact, u as openDb } from "./assets/idb-CTF6LF5B.js";
+import { a as fileBytesOf, i as fileBytes, l as FILE_BYTES_STEP } from "./assets/fileBytes-BcYZhNgF.js";
 import { createRequire } from "node:module";
 import { spawn } from "node:child_process";
 import { connect, createServer, isIP } from "node:net";
@@ -12,13 +12,13 @@ import { sha256 } from "@noble/hashes/sha2.js";
 import { createBase58check } from "@scure/base";
 import { schnorr } from "@noble/curves/secp256k1.js";
 import { wordlist } from "@scure/bip39/wordlists/english.js";
-import { link, mkdir, open, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
-import { basename, dirname, extname, join, relative, resolve, sep } from "node:path";
+import { access, constants, link, mkdir, open, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
+import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { createHash, createPrivateKey, generateKeyPairSync, randomBytes, timingSafeEqual } from "node:crypto";
 import { decode, npubEncode } from "nostr-tools/nip19";
 import { BunkerSigner } from "nostr-tools/nip46";
 import { SimplePool } from "nostr-tools/pool";
 import { generateSecretKey } from "nostr-tools/pure";
-import { createHash, createPrivateKey, generateKeyPairSync, randomBytes, timingSafeEqual } from "node:crypto";
 import { createServer as createServer$1 } from "node:http";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
@@ -35,7 +35,7 @@ import { IDBFactory, IDBKeyRange as IDBKeyRange$1, IDBTransaction } from "fake-i
 import { format } from "node:util";
 var package_default = {
 	name: "@ghostlytools/cli",
-	version: "1.1.7",
+	version: "1.2.1",
 	type: "module",
 	description: "Ghostly for bots and terminals: the app's own engine, headless on Node, behind a daemon and a `ghostly` command with JSON output.",
 	license: "MIT",
@@ -63,7 +63,7 @@ var package_default = {
 	dependencies: {
 		"@arkade-os/sdk": "0.4.78",
 		"@atproto/jwk-webcrypto": "^0.3.4",
-		"@atproto/oauth-client": "^0.8.8",
+		"@atproto/oauth-client": "^0.8.9",
 		"@bitcoindevkit/bdk-wallet-web": "0.3.0",
 		"@bitcoinerlab/descriptors-scure": "^3.2.0",
 		"@cashu/cashu-ts": "^4.11.0",
@@ -87,7 +87,7 @@ var package_default = {
 		"ethers": "6.17.0",
 		"eventsource": "^5.1.2",
 		"fake-indexeddb": "6.2.5",
-		"hyperdht": "6.34.0",
+		"hyperdht": "6.34.1",
 		"keet-identity-key": "3.2.0",
 		"mpg123-decoder": "1.0.3",
 		"node-datachannel": "^0.33.4",
@@ -101,7 +101,7 @@ var package_default = {
 		"@ghostly/iroh-web": "*",
 		"@types/node": "^26.6.4",
 		"typescript": "^5.9.3",
-		"vite": "^8.3.2",
+		"vite": "^8.3.3",
 		"vitest": "^5.0.3"
 	}
 };
@@ -139,7 +139,7 @@ var CliError = class extends Error {
 /** Anything thrown, as the error a bot sees: the engine's own refusals keep their words. */
 function asCliError(error) {
 	if (error instanceof CliError) return error;
-	if (error && typeof error === "object" && "code" in error && "message" in error && typeof error.code === "string" && error.code in EXIT) return new CliError(error.code, String(error.message));
+	if (error && typeof error === "object" && "code" in error && "message" in error && typeof error.code === "string" && Object.hasOwn(EXIT, error.code)) return new CliError(error.code, String(error.message));
 	const local = localFileError(error);
 	if (local) return local;
 	const unopened = profileOpenError(error);
@@ -176,6 +176,7 @@ function localFileError(error) {
 	if (code === "ENOENT" || code === "ENOTDIR") return new CliError("not_found", `No such file or folder: ${where}`);
 	if (code === "EACCES" || code === "EPERM" || code === "EROFS") return new CliError("refused", `Not allowed to write or read ${where}`);
 	if (code === "EISDIR") return new CliError("bad_request", `${where} is a folder: name a file`);
+	if (code === "ENAMETOOLONG") return new CliError("bad_request", `A name in ${where} is too long for this file system (at most 255 bytes)`);
 }
 //#endregion
 //#region src/args.ts
@@ -282,9 +283,17 @@ function parseArgs(argv, spec, idSlot = () => false) {
 		options
 	};
 }
+/** The global option a word names (`--profile`, `--profile=bot`, `-p`), else undefined. */
+function globalOption(arg) {
+	const eq = arg.indexOf("=");
+	const name = arg.startsWith("--") ? arg.slice(2, eq === -1 ? void 0 : eq) : arg.length === 2 && arg.startsWith("-") ? Object.entries(GLOBAL_OPTIONS).find(([, o]) => o.short === arg.slice(1))?.[0] : void 0;
+	return name && Object.hasOwn(GLOBAL_OPTIONS, name) ? GLOBAL_OPTIONS[name] : void 0;
+}
 /**
 * Global options given before the command (`ghostly --profile bot send …`) move after it, where every command's
-* parser reads them. Stops at `--` and at the first word that is not a global option.
+* parser reads them. Stops at `--` and at the first word that is not a global option. They go before the first word
+* after the command's that starts with a dash (its first option, or the `--` that ends them), else at the end: never
+* between an option and its value, which may itself be `--` (`--pretty profile set --name --`).
 */
 function liftGlobals(argv) {
 	const lifted = [];
@@ -292,19 +301,18 @@ function liftGlobals(argv) {
 	while (i < argv.length) {
 		const arg = argv[i];
 		const eq = arg.indexOf("=");
-		const name = arg.startsWith("--") ? arg.slice(2, eq === -1 ? void 0 : eq) : arg.length === 2 && arg.startsWith("-") ? Object.entries(GLOBAL_OPTIONS).find(([, o]) => o.short === arg.slice(1))?.[0] : void 0;
-		const option = name ? GLOBAL_OPTIONS[name] : void 0;
+		const option = globalOption(arg);
 		if (!option || arg === "--") break;
 		const takesValue = option.type !== "boolean" && eq === -1;
 		lifted.push(...argv.slice(i, i + (takesValue ? 2 : 1)));
 		i += takesValue ? 2 : 1;
 	}
 	const rest = argv.slice(i);
-	const end = rest.indexOf("--");
-	return end === -1 ? [...rest, ...lifted] : [
-		...rest.slice(0, end),
+	const dash = rest[0] === "--" ? 0 : rest.findIndex((word, i) => i > 0 && word.startsWith("-"));
+	return dash === -1 ? [...rest, ...lifted] : [
+		...rest.slice(0, dash),
 		...lifted,
-		...rest.slice(end)
+		...rest.slice(dash)
 	];
 }
 //#endregion
@@ -675,6 +683,7 @@ var ENGINE_METHODS = [
 	"joinGroupByLink",
 	"sendGroupMessage",
 	"sendGroupFile",
+	"groupFileCheck",
 	"pressButton",
 	"groupMessages",
 	"messagePage",
@@ -807,64 +816,104 @@ var CONTACT_KEY = /^[ybndrfg8ejkmcpqxot1uwisza345h769]{52}$/;
 * itself (which the contact controls, so it never wins over a label).
 */
 function findChat(links, ref) {
+	return chatBy(links, ref).link;
+}
+/** `findChat`, and whether only the name the contact gave itself (`theirName`) found the chat. */
+function chatBy(links, ref) {
 	const exact = links.find((link) => link.id === ref);
-	if (exact) return exact;
+	if (exact) return {
+		link: exact,
+		theirName: false
+	};
 	if (CONTACT_KEY.test(ref)) {
 		const byKey = links.filter((link) => link.peerPubKeyZ32 === ref);
-		if (byKey.length === 1) return byKey[0];
+		if (byKey.length === 1) return {
+			link: byKey[0],
+			theirName: false
+		};
 		if (byKey.length > 1) throw new CliError("bad_request", `${JSON.stringify(ref)} names more than one chat: use its id`, { matches: byKey.map((link) => link.id) });
 		throw new CliError("not_found", `No chat with ${JSON.stringify(ref)}`);
 	}
 	const byPrefix = links.filter((link) => link.id.startsWith(ref));
-	if (byPrefix.length === 1) return byPrefix[0];
+	if (byPrefix.length === 1) return {
+		link: byPrefix[0],
+		theirName: false
+	};
 	const lower = ref.toLowerCase();
 	const named = (name) => name?.trim().toLowerCase() === lower;
 	const byLabel = links.filter((link) => named(link.label));
 	const byName = byLabel.length ? byLabel : links.filter((link) => named(link.peerNick));
-	if (byName.length === 1) return byName[0];
+	if (byName.length === 1) return {
+		link: byName[0],
+		theirName: !byLabel.length
+	};
 	if (byPrefix.length > 1 || byName.length > 1) throw new CliError("bad_request", `${JSON.stringify(ref)} names more than one chat: use its id`, { matches: [...byPrefix, ...byName].map((link) => link.id) });
 	throw new CliError("not_found", `No chat ${JSON.stringify(ref)}`);
 }
+/** Only an invitation so far: this profile is not in the group (yet), and whoever invited chose its name. */
+var invitedOnly = (group) => group.status === void 0 && !!group.invitation;
+/**
+* A group by its id, by a unique prefix of its id, or by its name. A group this profile is in wins over an invitation
+* with the same prefix or name (the one who invites chooses those); an invitation is still found by its id, and by
+* prefix or name where no group of this profile has it.
+*/
 function findGroup(groups, ref) {
 	const exact = groups.find((group) => group.id === ref);
 	if (exact) return exact;
-	const byPrefix = groups.filter((group) => group.id.startsWith(ref));
+	const mineFirst = (found) => {
+		const mine = found.filter((group) => !invitedOnly(group));
+		return mine.length ? mine : found;
+	};
+	const byPrefix = mineFirst(groups.filter((group) => group.id.startsWith(ref)));
 	if (byPrefix.length === 1) return byPrefix[0];
-	const byName = groups.filter((group) => group.name.trim().toLowerCase() === ref.toLowerCase());
+	const byName = mineFirst(groups.filter((group) => group.name.trim().toLowerCase() === ref.toLowerCase()));
 	if (byName.length === 1) return byName[0];
 	if (byPrefix.length > 1 || byName.length > 1) throw new CliError("bad_request", `${JSON.stringify(ref)} names more than one group: use its id`, { matches: [...byPrefix, ...byName].map((group) => group.id) });
 	throw new CliError("not_found", `No group ${JSON.stringify(ref)}`);
 }
-var chatOf = (ctx, params) => findChat(state(ctx).links, str(params, "chat", true));
 /**
-* A chat or a group, as `forward` names them: `group:<id>` is a group; anything else a chat first (id, prefix or name),
-* then a group. `linkId` is what the engine calls it.
+* A chat or a group, where a command takes either: `group:<id>` is a group; anything else a chat first (`findChat`),
+* then a group. A chat found only by the name its contact gave itself never takes what also names a group: a group's
+* own id is that group, and a prefix or the name of a group this profile is in is refused, with both ids. With neither,
+* the error says what `findChat` would.
 */
-function chatOrGroup(ctx, ref) {
-	if (ref.startsWith("group:")) {
-		const group = findGroup(state(ctx).groups, ref.slice(6));
-		return {
-			id: group.id,
-			linkId: `group:${group.id}`,
-			group: true
-		};
-	}
+function findChatOrGroup(links, groups, ref) {
+	if (ref.startsWith("group:")) return { group: findGroup(groups, ref.slice(6)) };
+	let chat;
 	try {
-		const link = findChat(state(ctx).links, ref);
-		return {
-			id: link.id,
-			linkId: link.id,
-			group: false
-		};
+		chat = chatBy(links, ref);
 	} catch (error) {
 		if (!(error instanceof CliError) || error.code !== "not_found") throw error;
-		const group = findGroup(state(ctx).groups, ref);
-		return {
-			id: group.id,
-			linkId: `group:${group.id}`,
-			group: true
-		};
+		try {
+			return { group: findGroup(groups, ref) };
+		} catch (inner) {
+			throw inner instanceof CliError && inner.code !== "not_found" ? inner : error;
+		}
 	}
+	if (!chat.theirName) return { link: chat.link };
+	const exact = groups.find((group) => group.id === ref);
+	if (exact) return { group: exact };
+	const lower = ref.toLowerCase();
+	const also = groups.filter((group) => !invitedOnly(group) && (group.id.startsWith(ref) || group.name.trim().toLowerCase() === lower));
+	if (also.length) throw new CliError("bad_request", `${JSON.stringify(ref)} names a chat (the name its contact chose) and a group: use the chat's id or group:<id>`, {
+		chat: chat.link.id,
+		groups: also.map((group) => group.id)
+	});
+	return { link: chat.link };
+}
+var chatOf = (ctx, params) => findChat(state(ctx).links, str(params, "chat", true));
+/** A chat or a group as `findChatOrGroup` reads it. `linkId` is what the engine calls it. */
+function chatOrGroup(ctx, ref) {
+	const found = findChatOrGroup(state(ctx).links, state(ctx).groups, ref);
+	return "group" in found ? {
+		id: found.group.id,
+		linkId: `group:${found.group.id}`,
+		group: true
+	} : {
+		id: found.link.id,
+		linkId: found.link.id,
+		group: false
+	};
 }
 var groupOf = (ctx, params) => findGroup(state(ctx).groups, str(params, "group", true));
 /** Resolves with `check`'s first defined answer: now, or on a later state; `timeout` error after `ms`. */
@@ -1043,7 +1092,7 @@ function groupReply(reply, myKey) {
 //#endregion
 //#region ../browser/src/engine/groupFiles.ts
 /** A group file's local id: its group's and a random part, never anything a member sends. */
-var groupFileId = (groupId, direction, random = toBase64Url$1(randomBytes$1(12))) => `group-${groupId}-${direction}-${random}`;
+var groupFileId = (groupId, direction, random = toBase64Url(randomBytes$1(12))) => `group-${groupId}-${direction}-${random}`;
 /** The group a local file id names, among `groupIds`. */
 var groupOfFile = (fileId, groupIds) => [...groupIds].find((g) => fileId.startsWith(`group-${g}-in-`) || fileId.startsWith(`group-${g}-out-`));
 /** What a file's message says: its caption, or (when the author wrote none) the file itself, not the line older apps show. */
@@ -1051,23 +1100,28 @@ var groupFileText = (text, meta) => text === groupFileFallback(meta) ? fileMessa
 /** The profile's files store and file storage, as a 1:1 chat's files use them. */
 var storedGroupFiles = {
 	list: (groupId) => fileStore.listForLink(`group:${groupId}`),
+	groups: () => fileStore.groupIds(),
 	get: (id) => fileStore.get(id),
 	put: (file) => fileStore.put(file),
 	patch: (id, fields) => fileStore.patch(id, fields),
 	remove: (id) => removeStored(id),
-	async write(id) {
+	async write(id, resume = false) {
 		const stored = await fileStore.get(id);
 		const bytes = stored?.bytes && await fileBytesOf(stored.bytes) || await fileBytes();
-		if (await bytes.size(id) !== null) await bytes.truncate(id, 0);
+		const size = await bytes.size(id);
+		const offset = resume && size !== null ? size : 0;
+		if (size !== null && size !== offset) await bytes.truncate(id, offset);
 		if (stored && stored.bytes !== bytes.kind) await fileStore.patch(id, { bytes: bytes.kind });
-		const appender = new FileAppender(bytes, id, 0);
+		const appender = new FileAppender(bytes, id, offset);
 		return {
+			offset,
 			append: (chunk) => appender.append(chunk),
 			flush: () => appender.flush(),
 			digest: async () => {
 				await appender.close();
 				return bytes.digest(id);
 			},
+			close: () => appender.close(),
 			discard: async () => {
 				await appender.close().catch(() => {});
 				await bytes.remove(id);
@@ -1077,8 +1131,14 @@ var storedGroupFiles = {
 	read: (file, offset, length) => readStored(file, offset, length),
 	room: async () => (await fileBytes()).room()
 };
-/** Why a want waits, as the person reads it. */
-var NOBODY_CONNECTED = "Nobody you are connected to has this file yet";
+/** Why a want waits, as the person reads it (the app shows its own words for each `wait`). */
+var WAITING_NOTES = {
+	nobody: "Nobody you are connected to has this file yet",
+	busy: "Its holders are busy; asking again soon",
+	damaged: "It arrived damaged; ask again"
+};
+/** Why a want stopped: every holder served bytes that are not the author's file. */
+var DAMAGED$1 = "Every copy of this file arrived damaged and was deleted. Ask for it again later.";
 var GroupFileDesk = class {
 	deps;
 	kept = /* @__PURE__ */ new Map();
@@ -1090,6 +1150,7 @@ var GroupFileDesk = class {
 	own = /* @__PURE__ */ new Map();
 	/** Announcements sent per group, and taken per member of a group (WISP 503 § Rules for both, Pace). */
 	sentPace = /* @__PURE__ */ new Map();
+	sentTaken = /* @__PURE__ */ new Map();
 	takenPace = /* @__PURE__ */ new Map();
 	/** `<group>\n<message id>` a `group-have` named before its message came → its holders, newest first. */
 	ahead = /* @__PURE__ */ new Map();
@@ -1126,7 +1187,8 @@ var GroupFileDesk = class {
 				auto: !!file.group.auto,
 				asked: !!file.group.asked,
 				held: file.transfer?.state === "done",
-				holders: []
+				holders: [],
+				damaged: /* @__PURE__ */ new Set()
 			};
 			this.add(kept);
 			if (kept.held) this.show(kept, {
@@ -1135,6 +1197,14 @@ var GroupFileDesk = class {
 				size,
 				direction: kept.mine ? "out" : "in"
 			});
+			else if (file.transfer?.state === "failed") this.show(kept, {
+				state: "failed",
+				transferred: 0,
+				size,
+				direction: "in",
+				retry: true,
+				error: file.transfer.error ?? DAMAGED$1
+			});
 			else if (kept.auto || kept.asked) this.wants.set(kept.id, this.newWant());
 			else this.show(kept, {
 				state: "transferring",
@@ -1147,9 +1217,27 @@ var GroupFileDesk = class {
 		for (const [id] of this.wants) this.ask(this.kept.get(id));
 		this.deps.changed();
 	}
-	/** An error when this group took as many announcements of mine as it takes in a minute; null when one may go now. */
+	/**
+	* At start, once every group was read: the files of a group this device no longer has (`groupIds` are the groups it
+	* has, a tombstone or a join under way among them) go, with their bytes. A group left before Leave took its files
+	* left them behind, where nothing lists them.
+	*/
+	async sweep(groupIds) {
+		const here = new Set(groupIds);
+		for (const groupId of await this.deps.store.groups().catch(() => [])) {
+			if (here.has(groupId)) continue;
+			for (const file of await this.deps.store.list(groupId).catch(() => [])) await this.deps.store.remove(file.id).catch(() => {});
+		}
+	}
+	/**
+	* An error when this group took as many announcements of mine as it takes in a minute, or as its members take from
+	* one member in `announceWindowMs` (past that they would get the text, not the file); null when one may go now.
+	*/
 	mayAnnounce(groupId) {
-		return this.pace(this.sentPace, groupId, GROUP_FILE_LIMITS.announcePerMinute, 6e4).wait() ? "You sent many files to this group just now. Wait a minute." : null;
+		const wait = Math.max(...this.sentPaces(groupId).map((pace) => pace.wait()));
+		if (!wait) return null;
+		const minutes = Math.ceil(wait / 6e4);
+		return `You sent many files to this group just now. Wait ${minutes > 1 ? `${minutes} minutes` : "a minute"}.`;
 	}
 	/** My file, stored under `fileId` with the author's digest, is about to be announced in the group: its message takes it. */
 	outgoing(groupId, fileId, meta) {
@@ -1170,7 +1258,7 @@ var GroupFileDesk = class {
 		const ownId = m.sender === me ? this.own.get(`${groupId}\n${m.file.d}`) : void 0;
 		if (ownId) {
 			this.own.delete(`${groupId}\n${m.file.d}`);
-			this.pace(this.sentPace, groupId, GROUP_FILE_LIMITS.announcePerMinute, 6e4).take();
+			for (const pace of this.sentPaces(groupId)) pace.take();
 			const kept = {
 				id: ownId,
 				groupId,
@@ -1181,7 +1269,8 @@ var GroupFileDesk = class {
 				auto: false,
 				asked: false,
 				held: true,
-				holders: []
+				holders: [],
+				damaged: /* @__PURE__ */ new Set()
 			};
 			this.add(kept);
 			const transfer = {
@@ -1218,7 +1307,8 @@ var GroupFileDesk = class {
 			auto,
 			asked: false,
 			held: false,
-			holders
+			holders,
+			damaged: /* @__PURE__ */ new Set()
 		};
 		const { name, size, mime, voice, video, image } = m.file;
 		this.add(kept);
@@ -1271,9 +1361,18 @@ var GroupFileDesk = class {
 			kept.asked = true;
 			await this.deps.store.patch(kept.id, { group: this.groupField(kept) }).catch(() => {});
 		}
+		kept.damaged.clear();
+		if (this.deps.transfers.get(kept.id)?.state === "failed") await this.deps.store.patch(kept.id, { transfer: {
+			state: "transferring",
+			transferred: 0,
+			size: kept.meta.size
+		} }).catch(() => {});
 		const want = this.wants.get(kept.id);
 		if (!want) this.wants.set(kept.id, this.newWant());
-		else if (!want.wire) want.tried.clear();
+		else if (!want.wire) {
+			want.tried.clear();
+			want.why = void 0;
+		}
 		this.ask(kept);
 	}
 	/** The group is gone from this device: its files go too. */
@@ -1348,6 +1447,7 @@ var GroupFileDesk = class {
 			}
 			edge.taking.set(frame.id, kept.id);
 			want.wire = frame.id;
+			want.why = void 0;
 			want.movedAt = this.deps.now();
 		}
 		return edge.files.handle(frame);
@@ -1371,9 +1471,13 @@ var GroupFileDesk = class {
 				want.wire = void 0;
 			}
 			if (want.holder) want.tried.add(want.holder);
-			else want.tried.clear();
+			else {
+				want.tried.clear();
+				want.why = void 0;
+			}
 			this.ask(kept);
 		}
+		this.letGo();
 		for (const edge of this.edgesById.values()) {
 			if (!edge.have.size || now - edge.haveAt < GROUP_FILE_LIMITS.haveEveryMs || !this.deps.ready(edge.linkId)) continue;
 			this.sendHave(edge, [...edge.have]);
@@ -1415,10 +1519,20 @@ var GroupFileDesk = class {
 		if (!want || kept.held || want.wire) return;
 		const membership = this.deps.membership(kept.groupId);
 		const edges = this.deps.edges(kept.groupId);
-		const order = [kept.author, ...kept.holders.filter((key) => key !== kept.author)].filter((key) => membership && key !== membership.me && membership.inRoster(key) && !want.tried.has(key));
+		const known = [kept.author, ...kept.holders.filter((key) => key !== kept.author)].filter((key) => membership && key !== membership.me && membership.inRoster(key));
+		if (known.length && known.every((key) => kept.damaged.has(key))) {
+			this.stopDamaged(kept);
+			return;
+		}
+		const order = known.filter((key) => !want.tried.has(key) && !kept.damaged.has(key));
+		let behind = false;
 		for (const key of order) {
 			const linkId = edges.get(key);
 			if (!linkId || !this.deps.ready(linkId) || !this.edgesById.get(linkId)?.files.live) continue;
+			if (this.askedOf(linkId, want)) {
+				behind = true;
+				continue;
+			}
 			if (!this.deps.send(linkId, {
 				t: "group-want",
 				g: kept.groupId,
@@ -1435,7 +1549,7 @@ var GroupFileDesk = class {
 			this.show(kept, {
 				state: "transferring",
 				stage: "queued",
-				transferred: 0,
+				transferred: kept.stored ?? 0,
 				size: kept.meta.size,
 				direction: "in"
 			});
@@ -1446,13 +1560,50 @@ var GroupFileDesk = class {
 			linkId: void 0,
 			at: this.deps.now()
 		});
+		if (behind) {
+			this.show(kept, {
+				state: "transferring",
+				stage: "queued",
+				transferred: kept.stored ?? 0,
+				size: kept.meta.size,
+				direction: "in"
+			});
+			return;
+		}
+		const wait = want.why ?? "nobody";
 		this.show(kept, {
 			state: "transferring",
 			stage: "waiting",
-			transferred: 0,
+			transferred: kept.stored ?? 0,
 			size: kept.meta.size,
 			direction: "in",
-			note: NOBODY_CONNECTED
+			wait,
+			note: WAITING_NOTES[wait],
+			...wait === "damaged" && { stalled: true }
+		});
+	}
+	/** Another file is asked of, or coming from, the member at the other end of this edge. */
+	askedOf(linkId, except) {
+		for (const want of this.wants.values()) if (want !== except && want.linkId === linkId) return true;
+		return false;
+	}
+	/** No holder serves the author's bytes: the want stops, and stays stopped after a restart, until Download. */
+	stopDamaged(kept) {
+		this.wants.delete(kept.id);
+		const { size } = kept.meta;
+		this.deps.store.patch(kept.id, { transfer: {
+			state: "failed",
+			transferred: 0,
+			size,
+			error: DAMAGED$1
+		} }).catch(() => {});
+		this.show(kept, {
+			state: "failed",
+			transferred: 0,
+			size,
+			direction: "in",
+			retry: true,
+			error: DAMAGED$1
 		});
 	}
 	/** A holder's no: the next one is asked. One that deleted the file is no holder any more. */
@@ -1461,9 +1612,11 @@ var GroupFileDesk = class {
 		const want = kept && this.wants.get(kept.id);
 		if (!kept || !want || want.linkId !== linkId || want.wire) return;
 		if (why === "gone") kept.holders = kept.holders.filter((key) => key !== peer);
+		if (why === "busy") want.why = "busy";
 		want.tried.add(peer);
 		want.holder = want.linkId = void 0;
 		this.ask(kept);
+		this.retry(groupId);
 	}
 	/** A member says it holds these files: remembered as a holder of each (newest first), and asked when a want waits. */
 	heard(groupId, from, ids) {
@@ -1499,8 +1652,12 @@ var GroupFileDesk = class {
 			});
 			return;
 		}
-		const wire = toBase64Url$1(randomBytes$1(12));
+		const wire = toBase64Url(randomBytes$1(12));
 		edge.serving.set(wire, kept.id);
+		edge.servedMoved.set(wire, {
+			confirmed: 0,
+			at: this.deps.now()
+		});
 		const { name, mime, size, voice, video, image } = kept.meta;
 		const file = {
 			id: wire,
@@ -1524,8 +1681,13 @@ var GroupFileDesk = class {
 		if (!membership || !membership.couldRead(edge.peer, messageId)) return "refused";
 		if (!kept) return "gone";
 		if (!this.deps.settings().serveFiles || !edge.files.live) return "busy";
+		this.letGo();
 		const active = this.servingNow();
-		if (active.length >= GROUP_FILE_LIMITS.serveAtOnce || active.some((a) => a.peer === edge.peer)) return "busy";
+		if (active.length >= GROUP_FILE_LIMITS.serveAtOnce) {
+			edge.busy.add(messageId);
+			return "busy";
+		}
+		if (active.some((a) => a.peer === edge.peer && a.sending)) return "busy";
 		const today = Math.floor(this.deps.now() / 864e5);
 		if (this.served.day !== today) this.served = {
 			day: today,
@@ -1534,18 +1696,37 @@ var GroupFileDesk = class {
 		const reserved = active.reduce((sum, a) => sum + a.size, 0);
 		return this.served.bytes + reserved + kept.meta.size > GROUP_FILE_LIMITS.serveBytesPerDay ? "busy" : null;
 	}
-	/** Transfers served now, all groups together: to whom, and their size. */
+	/** Transfers served now, all groups together: to whom, their size, and whether bytes are still to go. */
 	servingNow() {
 		const active = [];
 		for (const edge of this.edgesById.values()) for (const wire of edge.serving.keys()) {
 			const record = edge.files.get("out", wire);
 			if (record && !transferEnded(record)) active.push({
 				peer: edge.peer,
-				size: record.file.size
+				size: record.file.size,
+				sending: record.confirmed < record.file.size
 			});
 		}
 		return active;
 	}
+	/**
+	* Served transfers that no longer count end, their places free for others (WISP 503 § Serving limits): the asker's
+	* session closed, it is not in the roster any more, or its bytes have not moved for `wantWaitMs` (the asker has moved
+	* on by then).
+	*/
+	letGo() {
+		const now = this.deps.now();
+		for (const edge of this.edgesById.values()) for (const wire of [...edge.serving.keys()]) {
+			const record = edge.files.get("out", wire);
+			if (!record || transferEnded(record)) continue;
+			let moved = edge.servedMoved.get(wire);
+			if (!moved || moved.confirmed !== record.confirmed) edge.servedMoved.set(wire, moved = {
+				confirmed: record.confirmed,
+				at: now
+			});
+			if (!edge.files.live || !this.deps.membership(edge.groupId)?.inRoster(edge.peer) || now - moved.at >= GROUP_FILE_LIMITS.wantWaitMs) edge.files.cancel("out", wire);
+		}
+	}
 	/** Says on an edge which files this device holds. */
 	sendHave(edge, ids) {
 		for (let i = 0; i < ids.length; i += GROUP_FILE_LIMITS.haveIds) if (!this.deps.send(edge.linkId, {
@@ -1579,9 +1760,11 @@ var GroupFileDesk = class {
 			peer,
 			files: void 0,
 			serving: /* @__PURE__ */ new Map(),
+			servedMoved: /* @__PURE__ */ new Map(),
 			taking: /* @__PURE__ */ new Map(),
 			have: /* @__PURE__ */ new Set(),
-			haveAt: 0
+			haveAt: 0,
+			busy: /* @__PURE__ */ new Set()
 		};
 		edge.files = new ChatFiles({
 			send: (frame) => {
@@ -1615,13 +1798,28 @@ var GroupFileDesk = class {
 		const kept = this.kept.get(edge.taking.get(record.id) ?? "");
 		if (!kept) throw new Error("No such file");
 		await kept.idle;
-		const writer = await this.deps.store.write(kept.id);
+		const writer = await this.deps.store.write(kept.id, !kept.fresh);
+		kept.fresh = false;
+		const resumed = writer.offset > 0;
+		let damaged = false;
 		return {
-			offset: 0,
+			offset: writer.offset,
 			append: (bytes) => writer.append(bytes),
 			flush: () => writer.flush(),
-			verify: async () => await writer.digest() === kept.meta.d,
-			discard: () => kept.idle = writer.discard().catch(() => {})
+			verify: async () => {
+				damaged = await writer.digest() !== kept.meta.d;
+				const want = this.wants.get(kept.id);
+				if (damaged && want) want.why = "damaged";
+				return !damaged;
+			},
+			discard: () => {
+				if (damaged) {
+					kept.stored = 0;
+					if (resumed) kept.fresh = kept.unclear = true;
+					else kept.damaged.add(edge.peer);
+				}
+				return kept.idle = (damaged ? writer.discard() : writer.close()).catch(() => {});
+			}
 		};
 	}
 	async openSource(edge, record) {
@@ -1643,6 +1841,12 @@ var GroupFileDesk = class {
 				};
 				this.served.bytes += record.confirmed;
 				edge.serving.delete(record.id);
+				edge.servedMoved.delete(record.id);
+				const serving = this.deps.settings().serveFiles;
+				for (const other of this.edgesById.values()) {
+					if (serving) for (const id of other.busy) other.have.add(id);
+					other.busy.clear();
+				}
 			}
 			return;
 		}
@@ -1652,6 +1856,7 @@ var GroupFileDesk = class {
 			want.moved = transferred;
 			want.movedAt = this.deps.now();
 		}
+		if (record.state !== "failed" && record.state !== "declined" && record.state !== "cancelled") kept.stored = transferred;
 		const { size } = kept.meta;
 		switch (record.state) {
 			case "done":
@@ -1670,12 +1875,14 @@ var GroupFileDesk = class {
 					direction: "in"
 				});
 				this.queueHave(kept);
+				this.retry(kept.groupId);
 				return;
 			case "failed":
 			case "declined":
 			case "cancelled":
 				edge.taking.delete(record.id);
-				if (want.holder) want.tried.add(want.holder);
+				if (want.holder && !kept.unclear) want.tried.add(want.holder);
+				kept.unclear = false;
 				Object.assign(want, {
 					wire: void 0,
 					holder: void 0,
@@ -1683,6 +1890,7 @@ var GroupFileDesk = class {
 					moved: 0
 				});
 				this.ask(kept);
+				this.retry(kept.groupId);
 				return;
 			case "verifying":
 				this.show(kept, {
@@ -1724,6 +1932,10 @@ var GroupFileDesk = class {
 		if (!window) windows.set(key, window = new RateWindow(limit, ms, () => this.deps.now()));
 		return window;
 	}
+	/** My announcements in a group, in a minute and in the window the members count them over. */
+	sentPaces(groupId) {
+		return [this.pace(this.sentPace, groupId, GROUP_FILE_LIMITS.announcePerMinute, 6e4), this.pace(this.sentTaken, groupId, GROUP_FILE_LIMITS.announceTaken, GROUP_FILE_LIMITS.announceWindowMs)];
+	}
 	show(kept, view) {
 		this.deps.transfers.set(kept.id, view);
 		this.deps.changed();
@@ -2205,24 +2417,8 @@ function filesOf(messages, transfers) {
 		transfer: transfers[m.file.id] ?? null
 	}));
 }
-/**
-* The chat a file command names, or else a group (`group:<id>`, or a group's id, prefix or name where no chat has it),
-* as `forward` reads them. A name that is neither says what a chat would.
-*/
-function chatOrGroupOf(ctx, params) {
-	const ref = str(params, "chat", true);
-	if (ref.startsWith("group:")) return { group: findGroup(state(ctx).groups, ref.slice(6)) };
-	try {
-		return { link: chatOf(ctx, params) };
-	} catch (error) {
-		if (!(error instanceof CliError) || error.code !== "not_found") throw error;
-		try {
-			return { group: findGroup(state(ctx).groups, ref) };
-		} catch {
-			throw error;
-		}
-	}
-}
+/** The chat or the group a file command names (`findChatOrGroup`). */
+var chatOrGroupOf = (ctx, params) => findChatOrGroup(state(ctx).links, state(ctx).groups, str(params, "chat", true));
 /**
 * The chat or group a file belongs to: a file id starts with its chat's id (a group's file with `group-<id>-`), so it
 * may be left out; given, it must be the file's own. `where` is what the answer names it by.
@@ -2283,6 +2479,8 @@ async function sendToGroup(ctx, params, group, path, size) {
 	if (replyTo) {
 		if (!(await node(ctx).groupMessages({ groupId: group.id })).some((m) => m.id === replyTo || replyRef(m) === replyTo)) throw new CliError("not_found", "That message is not in this group, or cannot be replied to");
 	}
+	const check = await node(ctx).groupFileCheck({ groupId: group.id });
+	if (check.error) throw check.refused ? new CliError("refused", check.error) : groupSendRefused(check.error);
 	const { voice, warning } = await voiceOf(params, path, mime);
 	const source = await openAsBlob(path, { type: mime });
 	const image = voice ? void 0 : await readImageMeta(source, mime);
@@ -2343,6 +2541,29 @@ async function sendToGroup(ctx, params, group, path, size) {
 		...warning ? { warning } : {}
 	};
 }
+/** Bytes a file system takes in one name: 255 on ext4, btrfs, APFS (NTFS counts 255 UTF-16 units, within this too). */
+var NAME_BYTES = 255;
+/**
+* `name` as an entry of a folder: an app's name may have 200 characters, which in UTF-8 can be 800 bytes. The end of
+* its stem goes until it fits, its extension stays (as `sanitizeFileName` shortens it), so "文…文.txt" is saved as a text.
+*/
+function fitName(name) {
+	const fits = (candidate) => Buffer.byteLength(candidate) <= NAME_BYTES;
+	if (fits(name)) return name;
+	const extension = /\.[^.\s]{1,15}$/u.exec(name)?.[0] ?? "";
+	const stem = [...name.slice(0, name.length - extension.length)];
+	while (stem.length && !fits(stem.join("").trimEnd() + extension)) stem.pop();
+	return (stem.join("").trimEnd() || "file") + extension;
+}
+/**
+* The name `file save --dir` writes a file under. Its sender chose it, and the folder is one scripts and people run
+* tools in: a name that starts with a dash is an option to the tool a `*` hands it to ("-rf", "--checkpoint-action=…"),
+* so it gets a `_` first, as a Windows device name does in `sanitizeFileName`.
+*/
+function saveName(name) {
+	const clean = sanitizeFileName(name);
+	return fitName(clean.startsWith("-") ? `_${clean}` : clean);
+}
 var ACTIONS = [
 	"accept",
 	"decline",
@@ -2363,6 +2584,7 @@ var FILE_METHODS = {
 			throw new CliError("not_found", `No file ${path}`);
 		}
 		if (!info.isFile()) throw new CliError("bad_request", `${path} is not a file`);
+		await access(path, constants.R_OK);
 		if ("group" in target) return sendToGroup(ctx, params, target.group, path, info.size);
 		const { link } = target;
 		if (link.profile && link.dataLink === "open" && !link.capabilities?.files) throw new CliError("unavailable", "The contact's app takes no files");
@@ -2376,7 +2598,7 @@ var FILE_METHODS = {
 		const { voice, warning } = await voiceOf(params, path, mime);
 		const source = await openAsBlob(path, { type: mime });
 		const image = voice ? void 0 : await readImageMeta(source, mime);
-		const wireId = toBase64Url$1(randomBytes$1(12));
+		const wireId = toBase64Url(randomBytes$1(12));
 		const file = {
 			id: `${link.id}-out-${wireId}`,
 			name: sanitizeFileName(str(params, "name") ?? basename(path)),
@@ -2530,7 +2752,7 @@ var FILE_METHODS = {
 			size: transfer.size
 		};
 	},
-	/** Writes a received (or sent) file to disk: into `dir` under its own name, or to `path`. Never over a file unless `force`. */
+	/** Writes a received (or sent) file to disk: into `dir` under its own name (`saveName`), or to `path`. Never over a file unless `force`. */
 	async "file.save"(ctx, params) {
 		const fileId = str(params, "file", true);
 		if (params.chat !== void 0) fileChat(ctx, params, fileId);
@@ -2543,7 +2765,7 @@ var FILE_METHODS = {
 		if (stored.leftOut) throw new CliError("not_found", "Not in this backup: the light backup this profile was restored from left the file out");
 		const transfer = state(ctx).transfers[fileId] ?? stored.transfer;
 		if (transfer && transfer.state !== "done") throw new CliError("unavailable", `The file is not all here yet (${transfer.transferred} of ${transfer.size} bytes)`);
-		const target = str(params, "path") ? resolve(str(params, "path", true)) : join(resolve(str(params, "dir") ?? "."), sanitizeFileName(stored.metadata.name));
+		const target = str(params, "path") ? resolve(str(params, "path", true)) : join(resolve(str(params, "dir") ?? "."), saveName(stored.metadata.name));
 		const flags = bool(params, "force") ? "w" : "wx";
 		let out;
 		try {
@@ -2596,7 +2818,7 @@ var DELIVERY_RANK = {
 async function waitForEdit(ctx, chat, messageId, ms) {
 	const until = Date.now() + ms;
 	for (;;) {
-		const message = (await node(ctx).getMessages(chat)).find((m) => m.id === messageId);
+		const message = await node(ctx).getMessage(chat, messageId);
 		if (!message) throw new CliError("not_found", `No message ${messageId} in this chat`);
 		if (!message.edit?.pending) return message;
 		if (Date.now() >= until) throw new CliError("timeout", `Timed out after ${Math.round(ms / 1e3)} s: the contact has not confirmed the edit yet. It goes by itself once the chat is live and the contact's app shows edits, while this profile is online`, {
@@ -2648,8 +2870,7 @@ async function waitForMessage(ctx, chat, messageId, target, ms) {
 			if (error) reject(error);
 			else resolve(message);
 		};
-		const check = (last = false) => void node(ctx).getMessages(chat).then((messages) => {
-			const message = messages.find((m) => m.id === messageId);
+		const check = (last = false) => void node(ctx).getMessage(chat, messageId).then((message) => {
 			try {
 				const done = look(message);
 				if (done) finish(null, done);
@@ -2736,12 +2957,74 @@ function checked$1(card) {
 	if ("error" in result) throw new CliError("bad_request", `Status card: ${result.error}`, { card });
 	return result.card;
 }
-/** The latest message of mine in this chat or group with a card of this kind and id: the one an update edits. */
+/** Every text in a card's fields (title, step, items, runs, links…), as the contact's app may show it. */
+function cardTexts(value, out = []) {
+	if (typeof value === "string") out.push(value);
+	else if (Array.isArray(value)) for (const item of value) cardTexts(item, out);
+	else if (isObject(value)) for (const item of Object.values(value)) cardTexts(item, out);
+	return out;
+}
+/**
+* The secret guard `send` has (docs/CLI.md § Safety): a card whose text looks like a seed, a private key or a Cashu
+* token goes only with `--force`. `fields` are what this command gives (an update's own, not the card it merges over).
+* A card's text is read as given and as the card carries it (`cardLine`): a line loses its invisible characters on the
+* way, so a key one of them broke in two is whole again on the card. The fallback text goes as it is, as `send`'s.
+*/
+function guardSecrets(fields, params, verb) {
+	if (bool(params, "force")) return;
+	const check = (text) => {
+		const secret = findSecret(text);
+		if (secret) throw new CliError("confirm", `The card's text looks like ${secret.kind === "cashu" ? "a Cashu token (money anyone who reads it can take)" : "a secret (a seed or a private key)"}; ${verb} it with --force if you mean to`, { kind: secret.kind });
+	};
+	for (const text of cardTexts([fields, params.run])) {
+		check(text);
+		check(cardLine(text, Infinity) ?? "");
+	}
+	if (typeof params.text === "string") check(params.text);
+}
+/** Per card (its chat or group, its kind and its id): the message of mine that carries it, as this process last saw it. */
+var carriers = /* @__PURE__ */ new WeakMap();
+var carrierKey = (linkId, kind, id) => `${linkId}\n${kind}\n${id}`;
+function carriersOf(ctx) {
+	let map = carriers.get(ctx);
+	if (map) return map;
+	carriers.set(ctx, map = /* @__PURE__ */ new Map());
+	const cards = map;
+	ctx.hub.onEvent((event) => {
+		if (event.type !== "message.sent" && event.type !== "group.sent") return;
+		const message = event.message;
+		const card = message?.card;
+		if (typeof message?.id !== "string" || typeof card?.id !== "string" || card.kind !== "task" && card.kind !== "routine" && card.kind !== "usage") return;
+		carried(cards, carrierKey(event.type === "group.sent" ? `group:${String(event.group)}` : String(event.chat), card.kind, card.id), message.id);
+	});
+	return map;
+}
+function carried(cards, key, messageId) {
+	cards.delete(key);
+	cards.set(key, messageId);
+	if (cards.size > 1e3) cards.delete(cards.keys().next().value);
+}
+/**
+* The latest message of mine in this chat or group with a card of this kind and id: the one an update edits. A card
+* this process sent or found before is read by its message's key, so its updates cost the same in a long chat as in a
+* short one; only a card not seen yet (the first update after a start, a one-shot) is looked for in the whole history.
+*/
 async function cardMessage(ctx, target, kind, id) {
+	const cards = carriersOf(ctx), key = carrierKey(target.linkId, kind, id);
+	const carries = (message) => message?.sender === "me" && message.card?.kind === kind && message.card.id === id;
+	const known = cards.get(key);
+	if (known !== void 0) {
+		const message = await node(ctx).getMessage(target.linkId, known);
+		if (carries(message)) return message;
+		cards.delete(key);
+	}
 	const messages = target.group ? await node(ctx).groupMessages({ groupId: target.id }) : await node(ctx).getMessages(target.linkId);
+	if (cards.has(key)) return cardMessage(ctx, target, kind, id);
 	for (let i = messages.length - 1; i >= 0; i--) {
 		const message = messages[i];
-		if (message.sender === "me" && message.card?.kind === kind && message.card.id === id) return message;
+		if (!carries(message)) continue;
+		carried(cards, key, message.id);
+		return message;
 	}
 	throw new CliError("not_found", `No ${kind} ${JSON.stringify(id)} of yours in this ${target.group ? "group" : "chat"}: send it first with ghostly ${kind} send`);
 }
@@ -2769,8 +3052,9 @@ async function parentThere(ctx, target, card) {
 async function sendCard(ctx, params, kind) {
 	const target = chatOrGroup(ctx, str(params, "chat", true));
 	const fields = fieldsOf(params);
+	guardSecrets(fields, params, "send");
 	const now = Date.now();
-	const id = typeof fields.id === "string" && fields.id ? fields.id : `${kind}-${toBase64Url$1(randomBytes$1(6))}`;
+	const id = typeof fields.id === "string" && fields.id ? fields.id : `${kind}-${toBase64Url(randomBytes$1(6))}`;
 	const card = checked$1(withRun({
 		...kind === "task" ? {
 			status: "running",
@@ -2799,6 +3083,7 @@ async function sendCard(ctx, params, kind) {
 			card
 		});
 		if (result.error || !result.messageId) throw new CliError(result.refused ? "refused" : "unavailable", result.error ?? "Nothing to send");
+		carried(carriersOf(ctx), carrierKey(target.linkId, kind, id), result.messageId);
 		const edges = wait === "sent" ? await waitForGroupFrame(ctx, target.id, result.messageId, void 0, ms) : void 0;
 		return answer(target, kind, id, result.messageId, {
 			card,
@@ -2812,7 +3097,8 @@ async function sendCard(ctx, params, kind) {
 	});
 	if (result.error) throw new CliError(result.refused ? "refused" : "unavailable", result.error);
 	if (!result.messageId) throw new CliError("bad_request", "Nothing to send");
-	let message = (await node(ctx).getMessages(target.linkId)).find((m) => m.id === result.messageId);
+	carried(carriersOf(ctx), carrierKey(target.linkId, kind, id), result.messageId);
+	let message = await node(ctx).getMessage(target.linkId, result.messageId);
 	if (wait !== "none") message = await waitForMessage(ctx, target.linkId, result.messageId, wait, ms);
 	return answer(target, kind, id, result.messageId, {
 		card,
@@ -2838,6 +3124,7 @@ async function updateCard(ctx, params, kind) {
 	const target = chatOrGroup(ctx, str(params, "chat", true));
 	const id = str(params, kind, true);
 	const patch = fieldsOf(params);
+	guardSecrets(patch, params, "update");
 	const message = await cardMessage(ctx, target, kind, id);
 	if ((message.edit?.seq ?? 0) >= STATUS_CARD_LIMITS.edits) throw new CliError("refused", `This ${kind}'s message took ${STATUS_CARD_LIMITS.edits} updates, the most one takes: start a new card with ghostly ${kind} send (a new --id, or the same one: the newest card of an id stands for it)`, {
 		messageId: message.id,
@@ -2879,7 +3166,7 @@ async function updateCard(ctx, params, kind) {
 		pace.last = Date.now();
 		await editCard(ctx, target, message.id, card, text);
 	}
-	let edited = target.group ? (await node(ctx).groupMessages({ groupId: target.id })).find((m) => m.id === message.id) : (await node(ctx).getMessages(target.linkId)).find((m) => m.id === message.id);
+	let edited = await node(ctx).getMessage(target.linkId, message.id);
 	if (wait === "confirmed" && edited?.edit?.pending) edited = await waitForEdit(ctx, target.linkId, message.id, ms);
 	const edges = wait === "sent" && edited?.edit ? await waitForGroupFrame(ctx, target.id, message.id, edited.edit.seq, ms) : void 0;
 	return answer(target, kind, id, message.id, {
@@ -3049,7 +3336,7 @@ function buttonsCard(params) {
 	if (!Array.isArray(buttons)) throw new CliError("bad_request", "buttons must be a list of {id, label, style?, once?}");
 	return checked({
 		kind: "buttons",
-		id: str(params, "buttonsId") ?? `ask-${toBase64Url$1(randomBytes$1(6))}`,
+		id: str(params, "buttonsId") ?? `ask-${toBase64Url(randomBytes$1(6))}`,
 		buttons
 	});
 }
@@ -3086,6 +3373,7 @@ async function updateButtons(ctx, params) {
 		edits: message.edit.seq
 	});
 	const before = message.card;
+	if (chosen !== void 0 && !before.buttons.some((b) => b.id === chosen)) throw new CliError("bad_request", `That message has no button ${JSON.stringify(chosen)}; its buttons: ${before.buttons.map((b) => b.id).join(", ")}`, { card: before });
 	const card = checked({
 		...before,
 		...chosen !== void 0 && { chosen },
@@ -3104,7 +3392,7 @@ async function updateButtons(ctx, params) {
 		card
 	});
 	if (result.error) throw new CliError(result.refused ? "refused" : "unavailable", result.error);
-	let edited = (target.group ? await node(ctx).groupMessages({ groupId: target.id }) : await node(ctx).getMessages(target.linkId)).find((m) => m.id === message.id);
+	let edited = target.group ? (await node(ctx).groupMessages({ groupId: target.id })).find((m) => m.id === message.id) : await node(ctx).getMessage(target.linkId, message.id);
 	if (wait === "confirmed" && edited?.edit?.pending) edited = await waitForEdit(ctx, target.linkId, message.id, ms);
 	const edges = wait === "sent" && edited?.edit ? await waitForGroupFrame(ctx, target.id, message.id, edited.edit.seq, ms) : void 0;
 	return {
@@ -3167,7 +3455,7 @@ async function pressButton(ctx, params) {
 			edges
 		};
 	}
-	const reply = wait === "none" ? (await node(ctx).getMessages(target.linkId)).find((m) => m.id === replyId) : await waitForMessage(ctx, target.linkId, replyId, wait, ms);
+	const reply = wait === "none" ? await node(ctx).getMessage(target.linkId, replyId) : await waitForMessage(ctx, target.linkId, replyId, wait, ms);
 	return {
 		...answer,
 		delivery: reply?.delivery ?? null
@@ -3483,10 +3771,15 @@ function groupJson(group, showSecret = false) {
 * Group administration and pictures (WISP 1100, phase 3): what the app's group menu and profile screen do. The
 * engine enforces who may do what (the admin); these check the arguments and name members.
 */
-/** A member by key, unique key prefix or name; never this profile itself. */
+/**
+* A member by key, unique key prefix or name; never this profile itself. A whole key is that member, whatever another
+* member calls itself; a prefix and a name stand side by side (two members is an error, not a guess).
+*/
 function findMember(group, ref) {
 	const lower = ref.toLowerCase();
-	const matches = group.members.filter((m) => !m.me && (m.key === ref || m.key.startsWith(ref) || m.nick?.trim().toLowerCase() === lower));
+	const others = group.members.filter((m) => !m.me);
+	const byKey = others.filter((m) => m.key === ref);
+	const matches = byKey.length ? byKey : others.filter((m) => m.key.startsWith(ref) || m.nick?.trim().toLowerCase() === lower);
 	if (matches.length === 1) return matches[0];
 	throw new CliError(matches.length ? "bad_request" : "not_found", matches.length ? `${JSON.stringify(ref)} names more than one member` : `No member ${JSON.stringify(ref)} in ${group.name}`);
 }
@@ -3603,6 +3896,63 @@ var GROUP_ADMIN_METHODS = {
 	}
 };
 //#endregion
+//#region src/turnRefs.ts
+/**
+* The id an agent turn names its message by (docs/CLI.md § Agent turns). A message is stored under an id its sender
+* chose most of (`peer_<the id they sent>`), so a turn carries this one instead, made here from the chat (or group) and
+* that id: `t_` and 32 hex digits, in which nobody can write a word. Every command that takes a message's id takes it.
+*/
+function turnRef(where, messageId) {
+	return "t_" + createHash("sha256").update(`${where}\n${messageId}`).digest("hex").slice(0, 32);
+}
+var TURN_REF = /^t_[0-9a-f]{32}$/;
+var isRef = (value) => typeof value === "string" && TURN_REF.test(value);
+/**
+* `params` with each turn's id in `message`, `reply` and `messages` as the id its message is stored under: looked for
+* among the chat's (or group's) newest messages first, where a turn's almost always is, then in all of them. One that
+* names no message stays as given, and its command says so as for any unknown id.
+*/
+async function withStoredIds(ctx, params) {
+	const wanted = new Set([
+		params.message,
+		params.reply,
+		...Array.isArray(params.messages) ? params.messages : []
+	].filter(isRef));
+	if (!wanted.size) return params;
+	let target = null;
+	try {
+		if (typeof params.group === "string") {
+			const group = findGroup(state(ctx).groups, params.group);
+			target = {
+				id: group.id,
+				linkId: `group:${group.id}`,
+				group: true
+			};
+		} else if (typeof params.chat === "string") target = chatOrGroup(ctx, params.chat);
+	} catch {}
+	if (!target) return params;
+	const { id, linkId, group } = target;
+	const found = /* @__PURE__ */ new Map();
+	const look = (messages) => {
+		for (const message of messages) {
+			const ref = turnRef(id, message.id);
+			if (wanted.has(ref)) found.set(ref, message.id);
+		}
+		return found.size === wanted.size;
+	};
+	if (!look((await node(ctx).messagePage({
+		linkId,
+		limit: 200
+	})).messages)) look(group ? await node(ctx).groupMessages({ groupId: id }) : await node(ctx).getMessages(linkId));
+	const stored = (value) => isRef(value) ? found.get(value) ?? value : value;
+	return {
+		...params,
+		...params.message !== void 0 && { message: stored(params.message) },
+		...params.reply !== void 0 && { reply: stored(params.reply) },
+		...Array.isArray(params.messages) && { messages: params.messages.map(stored) }
+	};
+}
+//#endregion
 //#region ../browser/src/proofs/bitcoinWallets.ts
 /** What a proof proves and what it does not; shown next to every Bitcoin proof, given or received. */
 var BITCOIN_PROOF_LIMITS = [
@@ -4135,7 +4485,7 @@ var ResolverUnavailable = class extends DomainCheckError {};
 async function askResolver(resolver, name, type, options) {
 	let response;
 	try {
-		response = await options.fetch(`${resolver.url}?dns=${toBase64Url$1(encodeDnsQuery(name, type))}`, {
+		response = await options.fetch(`${resolver.url}?dns=${toBase64Url(encodeDnsQuery(name, type))}`, {
 			headers: { accept: "application/dns-message" },
 			maxBytes: DNS_MAX_BYTES,
 			signal: options.signal,
@@ -4845,8 +5195,8 @@ async function preparePgpEvidence(input, options = {}) {
 	return {
 		evidence: {
 			scheme: PGP_SCHEME,
-			key: toBase64Url$1(await minimalKey(pgp, key, signer, at, config(pgp))),
-			signature: toBase64Url$1(signature)
+			key: toBase64Url(await minimalKey(pgp, key, signer, at, config(pgp))),
+			signature: toBase64Url(signature)
 		},
 		verified: info
 	};
@@ -4858,7 +5208,7 @@ function parsePgpEvidence(raw) {
 	if (!e || typeof e !== "object" || Array.isArray(e) || e.scheme !== "openpgp/1" || Object.keys(e).sort().join(",") !== "key,scheme,signature" || typeof e.key !== "string" || typeof e.signature !== "string" || !b64.test(e.key) || !b64.test(e.signature) || e.key.length > Math.ceil(PGP_LIMITS.sharedKey * 4 / 3) || e.signature.length > Math.ceil(PGP_LIMITS.sharedSignature * 4 / 3)) throw new PgpProofError("Invalid OpenPGP proof");
 	let canonical;
 	try {
-		canonical = toBase64Url$1(fromBase64Url$1(e.key)) === e.key && toBase64Url$1(fromBase64Url$1(e.signature)) === e.signature;
+		canonical = toBase64Url(fromBase64Url$1(e.key)) === e.key && toBase64Url(fromBase64Url$1(e.signature)) === e.signature;
 	} catch {
 		canonical = false;
 	}
@@ -5580,7 +5930,7 @@ function segment(value) {
 	} catch {
 		return refuse("Malformed ID token");
 	}
-	if (toBase64Url$1(bytes) !== value) refuse("Malformed ID token");
+	if (toBase64Url(bytes) !== value) refuse("Malformed ID token");
 	return bytes;
 }
 function json(value) {
@@ -5728,7 +6078,7 @@ async function authorizationRequest(options) {
 	if (!clientId) throw new Error(`${provider.name} sign-in is not set up in this Ghostly build yet.`);
 	const { nonce } = options;
 	if (!/^[A-Za-z0-9_-]{16,128}$/.test(nonce)) throw new Error("Invalid sign-in nonce");
-	const state = `${options.statePrefix ?? ""}${toBase64Url$1(randomBytes$1(32))}`;
+	const state = `${options.statePrefix ?? ""}${toBase64Url(randomBytes$1(32))}`;
 	const url = new URL(provider.authorizationEndpoint);
 	const { scope, claims } = scopeFor$1(provider, options.reveal);
 	const params = {
@@ -5743,8 +6093,8 @@ async function authorizationRequest(options) {
 	};
 	let verifier;
 	if (provider.responseType === "code") {
-		verifier = toBase64Url$1(randomBytes$1(32));
-		params.code_challenge = toBase64Url$1(new Uint8Array(await crypto.subtle.digest("SHA-256", utf8Encode(verifier))));
+		verifier = toBase64Url(randomBytes$1(32));
+		params.code_challenge = toBase64Url(new Uint8Array(await crypto.subtle.digest("SHA-256", utf8Encode(verifier))));
 		params.code_challenge_method = "S256";
 	}
 	for (const [k, v] of Object.entries(params)) url.searchParams.set(k, v);
@@ -6319,7 +6669,7 @@ var signer = {
 		return {
 			method: "sig",
 			vm: check.key.id,
-			sig: toBase64Url$1(check.signature)
+			sig: toBase64Url(check.signature)
 		};
 	}
 };
@@ -7571,7 +7921,7 @@ var exactKeys = (raw, keys) => !!raw && typeof raw === "object" && !Array.isArra
 /** The key behind the fake in-app signer. Tests may replace it. */
 var fakeKeyring = { seed: ed25519.utils.randomSecretKey() };
 var fakeKeySubject = (seed = fakeKeyring.seed) => hex$3(ed25519.getPublicKey(seed));
-var fakeKeySign = (statement, seed = fakeKeyring.seed) => ({ sig: toBase64Url$1(ed25519.sign(statement.bytes, seed)) });
+var fakeKeySign = (statement, seed = fakeKeyring.seed) => ({ sig: toBase64Url(ed25519.sign(statement.bytes, seed)) });
 var fakeKey = {
 	id: "fake-key",
 	label: "Test key",
@@ -7654,13 +8004,13 @@ var ISSUER_SEED = unhex("7a".repeat(32));
 var FAKE_ISSUER = "https://issuer.ghostly.test";
 /** What the fake login page signs: iss, sub, nonce (= statement id), iat. */
 function fakeAccountToken(statement, account = "alice", seed = ISSUER_SEED, iat = statement.binding.issuedAt) {
-	const payload = toBase64Url$1(utf8Encode(JSON.stringify({
+	const payload = toBase64Url(utf8Encode(JSON.stringify({
 		iss: FAKE_ISSUER,
 		sub: account,
 		nonce: statement.id,
 		iat
 	})));
-	return { token: `${payload}.${toBase64Url$1(ed25519.sign(utf8Encode(payload), seed))}` };
+	return { token: `${payload}.${toBase64Url(ed25519.sign(utf8Encode(payload), seed))}` };
 }
 var fakeAccount = {
 	id: "fake-account",
@@ -8623,12 +8973,6 @@ var SERVICE_METHODS = {
 };
 //#endregion
 //#region ../browser/src/backup/codec.ts
-/** Base64url without padding, in chunks: bundles can be many megabytes. */
-function toBase64Url(bytes) {
-	let binary = "";
-	for (let i = 0; i < bytes.length; i += 32768) binary += String.fromCharCode(...bytes.subarray(i, i + 32768));
-	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
 function fromBase64Url(text) {
 	if (!/^[A-Za-z0-9_-]*$/.test(text)) throw new Error("Invalid base64url");
 	const binary = atob(text.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - text.length % 4) % 4));
@@ -12324,7 +12668,7 @@ var METHODS = {
 	async "settings.set"(ctx, params) {
 		const patch = {};
 		for (const [key, value] of Object.entries(params)) {
-			const kind = SETTABLE[key];
+			const kind = Object.hasOwn(SETTABLE, key) ? SETTABLE[key] : void 0;
 			if (!kind) throw new CliError("bad_request", `${key} is not a setting the CLI changes (${Object.keys(SETTABLE).join(", ")})`);
 			if (kind === "strings" && !(Array.isArray(value) && value.every((v) => typeof v === "string"))) throw new CliError("bad_request", `${key} must be a list of strings`);
 			if (kind === "string" && typeof value !== "string") throw new CliError("bad_request", `${key} must be a string`);
@@ -12343,14 +12687,19 @@ var METHODS = {
 			label
 		});
 		node(ctx).setActiveLink({ linkId });
-		await waitForState(ctx, (s) => {
-			const stage = s.links.find((l) => l.id === linkId)?.pairingProgress?.stage;
-			return stage && stage !== "publishing" ? true : void 0;
-		}, 2e4, "the invite to be published").catch(() => {});
+		const progressOf = (s) => s.links.find((l) => l.id === linkId)?.pairingProgress;
+		const progress = await waitForState(ctx, (s) => {
+			const p = progressOf(s);
+			return p && (p.stage !== "publishing" || ctx.mode === "daemon" && p.relayWaitUntil) ? p : void 0;
+		}, 2e4, "the invite to be published").catch(() => progressOf(state(ctx)));
+		const published = !!progress && progress.stage !== "publishing" && progress.reason !== "publish";
+		const waitUntil = published ? void 0 : progress?.relayWaitUntil;
 		return {
 			chat: linkId,
 			invite: inviteCode,
-			link: inviteLink(inviteCode)
+			link: inviteLink(inviteCode),
+			published,
+			...waitUntil !== void 0 && { retryInMs: Math.max(0, waitUntil - Date.now()) }
 		};
 	},
 	async "invite.join"(ctx, params) {
@@ -12412,7 +12761,7 @@ var METHODS = {
 		});
 		if (result.error) throw new CliError(result.refused ? "refused" : "unavailable", result.error);
 		if (!result.messageId) throw new CliError("bad_request", "Nothing to send");
-		let message = (await node(ctx).getMessages(link.id)).find((m) => m.id === result.messageId);
+		let message = await node(ctx).getMessage(link.id, result.messageId);
 		if (wait !== "none") message = await waitForMessage(ctx, link.id, result.messageId, wait, num(params, "timeout", 30, {
 			min: 1,
 			max: 3600
@@ -12448,7 +12797,7 @@ var METHODS = {
 		});
 		if (result.error) throw editRefused(await node(ctx).getMessages(link.id), messageId, "chat", result.error, result.refused);
 		const id = result.messageId ?? messageId;
-		let message = (await node(ctx).getMessages(link.id)).find((m) => m.id === id);
+		let message = await node(ctx).getMessage(link.id, id);
 		if (wait === "confirmed" && message?.edit?.pending) message = await waitForEdit(ctx, link.id, id, num(params, "timeout", 30, {
 			min: 1,
 			max: 3600
@@ -12641,7 +12990,8 @@ var METHODS = {
 	},
 	async "chat.transport"(ctx, params) {
 		const link = chatOf(ctx, params);
-		const transport = TRANSPORT_NAMES[str(params, "transport", true)];
+		const name = str(params, "transport", true);
+		const transport = Object.hasOwn(TRANSPORT_NAMES, name) ? TRANSPORT_NAMES[name] : void 0;
 		if (!transport) throw new CliError("bad_request", `transport must be one of auto, dht, webrtc, iroh, hyperdht`);
 		await node(ctx).setChatTransport({
 			linkId: link.id,
@@ -13024,12 +13374,12 @@ function history(messages, params, json = messageJson) {
 	};
 }
 Object.keys(METHODS);
-/** Runs one method of the API. */
+/** Runs one method of the API: one the table lists itself (`constructor`, which every object has, is none). */
 async function callApi(ctx, method, params = {}) {
-	const run = METHODS[method];
+	const run = Object.hasOwn(METHODS, method) ? METHODS[method] : void 0;
 	if (!run) throw new CliError("not_found", `No method ${method}`);
 	if (params === null || typeof params !== "object" || Array.isArray(params)) throw new CliError("bad_request", "params must be an object");
-	return run(ctx, params);
+	return run(ctx, await withStoredIds(ctx, params));
 }
 //#endregion
 //#region src/privateFolder.ts
@@ -13149,6 +13499,229 @@ function connectDaemon(path, timeoutMs = 2e3) {
 	});
 }
 //#endregion
+//#region src/appTemplate.ts
+var html = (text) => text.replace(/[&<>"]/g, (c) => ({
+	"&": "&amp;",
+	"<": "&lt;",
+	">": "&gt;",
+	"\"": "&quot;"
+})[c]);
+/** `ghostly-app.json`: the manifest without `publisher`, `sequence` and `files`, which `app publish` writes. */
+function templateManifest({ name, title }) {
+	return {
+		name,
+		version: "0.1.0",
+		kind: "mini-app",
+		title,
+		tagline: "Say hello to a contact",
+		description: "Open it in a chat and your contact gets a card to join. Each side can then say hello to the other.",
+		entry: "index.html",
+		permissions: ["chat"],
+		view: "chat",
+		runtime: {
+			host: ">=1.2",
+			clients: ["web", "desktop"]
+		},
+		license: "MIT"
+	};
+}
+/**
+* `index.html`: the whole app in one file, as the sandbox needs it (no network, so nothing is loaded from elsewhere).
+* Its script is plain JavaScript typed with JSDoc against `@ghostlytools/sdk/app`, so it runs as written and still type
+* checks (test/appInit.test.ts does). The title is the only thing put into it, as text. Its type imports are in single
+* quotes: they are text of the page, not imports of the CLI's own build (test/packageDeps.test.ts reads those).
+*/
+function templatePage({ title }) {
+	return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${html(title)}</title>
+<style>
+  :root { color-scheme: light dark; --bg: #ffffff; --fg: #16181d; --muted: #5b6270; --line: #d9dde3; --accent: #2f6fed; }
+  :root[data-theme="dark"] { --bg: #16181d; --fg: #f2f4f7; --muted: #a3abb8; --line: #343a45; --accent: #7aa5ff; }
+  body { margin: 0; padding: 20px; background: var(--bg); color: var(--fg); font: 16px/1.4 system-ui, sans-serif; }
+  h1 { margin: 0 0 4px; font-size: 20px; }
+  #status { margin: 0 0 16px; color: var(--muted); }
+  button { font: inherit; padding: 8px 16px; border: 1px solid var(--accent); border-radius: 8px; background: var(--accent); color: var(--bg); }
+  button:disabled { opacity: 0.5; }
+  ul { margin: 16px 0 0; padding: 0; list-style: none; }
+  li { padding: 8px 0; border-top: 1px solid var(--line); }
+</style>
+</head>
+<body>
+<h1>${html(title)}</h1>
+<p id="status" role="status">Starting</p>
+<button id="hello" type="button" disabled>Say hello</button>
+<ul id="log" aria-label="Messages"></ul>
+<script type="module">
+// The types of the API come from the SDK (npm install --save-dev @ghostlytools/sdk); nothing of it runs here.
+/** @typedef {import('@ghostlytools/sdk/app').MiniAppApi} MiniAppApi */
+/** @typedef {import('@ghostlytools/sdk/app').MiniAppJson} MiniAppJson */
+
+/** The longest text shown from a contact's frame. */
+const MAX_TEXT = 200;
+
+const status = /** @type {HTMLElement} */ (document.getElementById("status"));
+const button = /** @type {HTMLButtonElement} */ (document.getElementById("hello"));
+const log = /** @type {HTMLElement} */ (document.getElementById("log"));
+
+/** @param {string} text */
+function show(text) {
+  const line = document.createElement("li");
+  line.textContent = text;
+  log.append(line);
+}
+
+/**
+ * What the contact's app sent, when it is a hello. A frame comes from another device: read only what this app sends,
+ * and never put it in the page as HTML.
+ * @param {MiniAppJson} data
+ * @returns {string | null}
+ */
+function helloOf(data) {
+  if (!data || typeof data !== "object" || Array.isArray(data) || data.type !== "hello") return null;
+  return typeof data.text === "string" && data.text.length <= MAX_TEXT ? data.text : null;
+}
+
+/**
+ * Why a send was refused, in words. The code is the rejection's message (MINI_APP_ERROR_CODES in the SDK); a later
+ * client may add one.
+ * @param {unknown} error
+ */
+function refusal(error) {
+  switch (error instanceof Error ? error.message : "") {
+    case "offline": return "Not sent: you are not both online";
+    case "peer-closed": case "not-open": return "Not sent: your contact has not opened this app";
+    case "not-allowed": return "Open this app in a chat to say hello";
+    default: return "Not sent";
+  }
+}
+
+/** @param {MiniAppApi} ghostly */
+async function start(ghostly) {
+  // Listen before anything is awaited, so no frame is missed.
+  ghostly.chat.on("message", (data) => {
+    const text = helloOf(data);
+    if (text !== null) show("Your contact: " + text);
+  });
+  ghostly.chat.on("peer", (peer) => {
+    status.textContent = peer.open ? "Your contact has this app open" : "Waiting for your contact to open this app";
+  });
+
+  const context = await ghostly.context();
+  const dark = context.theme ? context.theme === "dark" : matchMedia("(prefers-color-scheme: dark)").matches;
+  document.documentElement.dataset.theme = dark ? "dark" : "light";
+  status.textContent = !context.inChat ? "Open this app in a chat to say hello"
+    : context.peer ? "Your contact has this app open" : "Waiting for your contact to open this app";
+
+  button.disabled = false;
+  button.addEventListener("click", async () => {
+    try {
+      await ghostly.chat.send({ type: "hello", text: "Hello!" });
+      show("You: Hello!");
+    } catch (error) {
+      show(refusal(error));
+    }
+  });
+}
+
+/** Ghostly's runner gives the app \`window.ghostly\`; a browser tab has none. */
+const ghostly = /** @type {{ ghostly?: MiniAppApi }} */ (window).ghostly;
+if (ghostly) void start(ghostly);
+else status.textContent = "This page is a Ghostly app: publish it and open it in Ghostly";
+<\/script>
+</body>
+</html>
+`;
+}
+/** `README.md`: what the folder holds and the way from it to a store. */
+function templateReadme({ name, title }) {
+	return `# ${title}
+
+A [Ghostly](https://github.com/MiguelMedeiros/ghostly) app, started with \`ghostly app init\`. Opened in a 1:1 chat, it
+gives your contact a card to join, and each side can say hello to the other.
+
+A Ghostly app ([WISP 1200](https://github.com/MiguelMedeiros/ghostly/blob/dev/docs/wisps/1200-marketplace.md)) is a
+page that runs in the client's sandbox. It has no network, and talks to Ghostly only through \`window.ghostly\`:
+frames of at most 32 KiB to the same app on the contact's side (\`chat.send\`, \`chat.on\`), storage per app and per
+chat, and the files of its own bundle. Apps run in Ghostly from release 1.2.
+
+| File | What it is |
+|---|---|
+| \`ghostly-app.json\` | The manifest, without \`publisher\`, \`sequence\` and \`files\`: \`ghostly app publish\` writes those |
+| \`index.html\` | The app, whole: styles and script inline |
+| \`README.md\` | This file |
+
+## Write it
+
+\`index.html\` is plain JavaScript, typed with JSDoc against \`@ghostlytools/sdk/app\`: \`MiniAppApi\` is
+\`window.ghostly\`, and the same module has the limits (\`MINI_APP_LIMITS\`) and the codes a refused call rejects with
+(\`MINI_APP_ERROR_CODES\`). For the types in your editor:
+
+\`\`\`sh
+npm install --save-dev @ghostlytools/sdk
+\`\`\`
+
+- What a contact's app sends is untrusted: check its shape, bound its size, and show it as text, never as HTML.
+- \`"view": "chat"\` runs the app inside a chat with one contact. \`"full"\` is a full-screen app opened from the Apps page.
+- \`permissions\` lists what the person is asked for: \`chat\` (frames to the contact's app), \`name\` (the person's
+  display name) and \`internet\`. Adding one later makes every install ask before it updates.
+
+## Build
+
+There is nothing to build yet: the page is the app. Once it grows into several source files, or TypeScript, build it
+into one self-contained \`index.html\` (scripts, styles and images inline) and put that file and \`ghostly-app.json\`
+alone in a folder of their own, which is the folder you publish.
+[ghostly-chess](https://github.com/MiguelMedeiros/ghostly-chess) does it with Vite and a small
+\`scripts/stage.mjs\`. \`ghostly app publish\` takes every file of the folder it is given but dot files, this README
+included, so do not run it on a repository with sources, \`node_modules\` or anything private in it.
+
+## Publish
+
+\`\`\`sh
+ghostly app publish . --key ~/ghostly-keys/${name}-publisher.key
+ghostly app verify app.ghostlyapp
+\`\`\`
+
+\`publish\` signs the folder into \`app.ghostlyapp\`. The first run makes the publisher key at the path you name:
+
+- Keep it **outside this folder** and its repository (\`publish\` refuses a key inside it), and never commit it.
+- Back it up. An app is updated only with the key that signed it; a lost key means a new app.
+
+\`verify\` checks the bundle as Ghostly will and prints its \`ref\` (\`<publisher key>/${name}\`), \`sequence\` and
+\`digest\`. For the next version, raise \`version\` in \`ghostly-app.json\` and publish again: the sequence goes up
+by one by itself.
+
+## Try it
+
+Commit \`app.ghostlyapp\` to a public GitHub repository, then in Ghostly open Apps, choose Add, and paste its URL
+(\`https://raw.githubusercontent.com/<owner>/<repo>/HEAD/app.ghostlyapp\`). Set \`sources\` in \`ghostly-app.json\`
+to that URL, in a list, so installs made from it find your updates. Open the app from a chat's + menu; your contact
+gets a card to install and open it.
+
+## List it in a store
+
+A store is a signed list of apps. The official one is a Git repository,
+[ghostly-store](https://github.com/MiguelMedeiros/ghostly-store), and apps enter it by pull request:
+
+1. Commit \`app.ghostlyapp\` to your public repository and note that commit.
+2. Add \`apps/${name}.<first 16 characters of your publisher key>/listing.json\` with the \`ref\`, \`sequence\`
+   and \`digest\` that \`ghostly app verify\` printed. Its \`urls\` start with a jsDelivr URL pinned to the full commit
+   (\`https://cdn.jsdelivr.net/gh/<owner>/<repo>@<40-character commit>/app.ghostlyapp\`).
+3. Open the pull request. Its check verifies the bundle; a maintainer reviews the app and the owner signs the index.
+
+The store's [CONTRIBUTING](https://github.com/MiguelMedeiros/ghostly-store/blob/main/CONTRIBUTING.md) has the rules.
+An app installed from a store updates only to the version that store lists, so each new version is a pull request too.
+
+## If something goes wrong
+
+If a version is harmful, \`ghostly app revoke . --key <your key> --up-to <sequence>\` writes \`ghostly-revoke.json\`;
+publish it beside \`app.ghostlyapp\` and Ghostly stops those versions.
+`;
+}
+//#endregion
 //#region src/apps.ts
 var APP_SOURCE = "ghostly-app.json";
 var APP_REVOKE_FILE = "ghostly-revoke.json";
@@ -13316,7 +13889,7 @@ function described(bundle, bytes) {
 		sequence: m.sequence,
 		digest: bundle.digest,
 		bytes: bytes.length,
-		sha256: toBase64Url$1(createHash("sha256").update(bytes).digest())
+		sha256: toBase64Url(createHash("sha256").update(bytes).digest())
 	};
 }
 /** `app verify <bundle|url>`: every check a client makes before it stores a bundle (WISP 1200 · Reading a bundle). */
@@ -13330,6 +13903,70 @@ async function verifyApp(source) {
 		manifest: read.bundle.manifest
 	};
 }
+/** A folder's name as an app's: lower case, anything else a hyphen (`My App` is `my-app`). */
+var nameFrom = (folder) => folder.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+/** An app's name as a title: `my-app` is `My app`. */
+var titleFrom = (name) => (name[0].toUpperCase() + name.slice(1)).replace(/-/g, " ");
+/**
+* `app init <dir> [--name <name>] [--title <title>] [--force]`: a small working app in `<dir>` (made when missing),
+* which `app publish <dir>` signs as it is: `ghostly-app.json`, an `index.html` that says hello to the contact, and a
+* README with the way to a store (./appTemplate.ts). The name is `--name`, else the folder's; the title `--title`, else
+* the name's. Nothing is written when one of the three files is there, unless `--force`, which replaces those three only.
+*/
+async function initApp(dirArg, what = {}) {
+	const usage = "ghostly app init <dir> [--name <name>] [--title <title>] [--force]";
+	const dir = resolve(dirArg);
+	const name = what.name ?? nameFrom(basename(dir));
+	const title = what.title ?? (name ? titleFrom(name) : "");
+	const page = templatePage({
+		name,
+		title
+	});
+	const pageBytes = new TextEncoder().encode(page);
+	const checked = checkAppManifest({
+		...templateManifest({
+			name,
+			title
+		}),
+		ghostlyApp: 1,
+		publisher: toZ32(/* @__PURE__ */ new Uint8Array(32)),
+		sequence: 1,
+		files: [{
+			path: "index.html",
+			size: pageBytes.length,
+			sha256: toBase64Url(createHash("sha256").update(pageBytes).digest())
+		}]
+	}, { strict: true });
+	if (!checked.ok) {
+		if (checked.detail === "name is not valid") throw new CliError("usage", what.name === void 0 ? `The folder's name gives no app name (${JSON.stringify(basename(dir))}): give --name, a lowercase letter then up to 31 lowercase letters, digits or hyphens: ${usage}` : `--name is a lowercase letter then up to 31 lowercase letters, digits or hyphens, not ${JSON.stringify(what.name)}`);
+		if (checked.detail === "title is not valid") throw new CliError("usage", `--title is one line of 1 to ${APP_BUNDLE_LIMITS.title} characters, not ${JSON.stringify(title)}`);
+		throw refused("The template makes no valid manifest", checked);
+	}
+	if (existsSync(dir) && !statSync(dir).isDirectory()) throw new CliError("bad_request", `${dir} is a file: name a folder for the app`);
+	const files = [
+		[APP_SOURCE, `${JSON.stringify(templateManifest({
+			name,
+			title
+		}), null, 2)}\n`],
+		["index.html", page],
+		["README.md", templateReadme({
+			name,
+			title
+		})]
+	];
+	const held = files.map(([path]) => path).filter((path) => existsSync(join(dir, path)));
+	if (held.length && !what.force) throw refused(`${dir} already holds ${held.join(", ")}: nothing was written (--force replaces ${held.length > 1 ? "them" : "it"})`, { reason: "exists" }, { files: held });
+	mkdirSync(dir, { recursive: true });
+	for (const [path, text] of files) writeWhole(join(dir, path), new TextEncoder().encode(text));
+	return {
+		dir,
+		name,
+		title,
+		files: files.map(([path]) => path),
+		...held.length ? { replaced: held } : {},
+		next: `ghostly app publish ${dirArg} --key <a key file outside ${dirArg}>`
+	};
+}
 /** Every file of the folder, as the bundle names it; dot files and folders are left out and listed. */
 function collectFiles(dir, leaveOut) {
 	const files = [];
@@ -13368,11 +14005,22 @@ function collectFiles(dir, leaveOut) {
 		}
 	};
 	walk(dir);
+	files.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
 	return {
 		files,
 		skipped
 	};
 }
+/**
+* A private key in a file: a PEM private key block with its body (PKCS #8, OpenSSH, RSA, EC, encrypted), or a Ghostly
+* key file's first line. A library that only names the block's header in its code does not match.
+*/
+var PRIVATE_KEY = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----\r?\n[A-Za-z0-9+/=\r\n:,-]{40,}-----END [A-Z0-9 ]*PRIVATE KEY-----|^Ghostly (publisher|store) key \(WISP 1200\)/;
+/** Whether `path` is `dir` or anything under it. */
+var isInside = (dir, path) => {
+	const rel = relative(dir, path);
+	return !rel.startsWith("..") && !isAbsolute(rel);
+};
 /** Fields of `ghostly-app.json` the command writes itself. */
 var WRITTEN = ["publisher", "files"];
 function readSource(path) {
@@ -13412,6 +14060,7 @@ async function publishApp(dirArg, keyArg, outArg, sequenceArg) {
 	const dir = resolve(dirArg);
 	if (!statSync(dir).isDirectory()) throw new CliError("bad_request", `${dir} is not a folder`);
 	const keyPath = resolve(keyArg);
+	if (isInside(dir, keyPath)) throw refused(`${keyPath} is inside ${dir}, which is published: keep the publisher key outside the app's folder (and its repository)`, { reason: "private-key" });
 	const out = resolve(outArg ?? join(dir, "app.ghostlyapp"));
 	const sourcePath = join(dir, APP_SOURCE);
 	const draft = readSource(sourcePath);
@@ -13438,6 +14087,11 @@ async function publishApp(dirArg, keyArg, outArg, sequenceArg) {
 		path: f.path,
 		bytes: new Uint8Array(readFileSync(f.full))
 	}));
+	const keyFile = contents.find((f) => PRIVATE_KEY.test(Buffer.from(f.bytes).toString("latin1")));
+	if (keyFile) throw refused(`${keyFile.path} in ${dir} holds a private key, and a bundle is public: move it out of the app's folder`, {
+		reason: "private-key",
+		detail: keyFile.path
+	});
 	const manifest = {
 		...draft,
 		ghostlyApp: 1,
@@ -13446,10 +14100,10 @@ async function publishApp(dirArg, keyArg, outArg, sequenceArg) {
 		files: contents.map((f) => ({
 			path: f.path,
 			size: f.bytes.length,
-			sha256: toBase64Url$1(createHash("sha256").update(f.bytes).digest())
+			sha256: toBase64Url(createHash("sha256").update(f.bytes).digest())
 		}))
 	};
-	const checked = checkAppManifest(JSON.parse(JSON.stringify(manifest)));
+	const checked = checkAppManifest(JSON.parse(JSON.stringify(manifest)), { strict: true });
 	if (!checked.ok) throw refused(`${sourcePath} and the folder's files make no valid manifest`, checked);
 	const { bytes: manifestBytes, signature } = await signAppObject(APP_PREFIXES.app, checked.manifest, key.signer);
 	const bundle = assembleAppBundle(manifestBytes, canonicalJsonBytes(signature), contents.map((f) => f.bytes));
@@ -13564,7 +14218,7 @@ async function signStore(indexArg, keyArg, outArg, now = Math.floor(Date.now() /
 	else key = makeKey(keyPath, "store");
 	if (index.key !== void 0 && index.key !== key.key) throw refused(`${indexPath} names another store key than ${keyPath}'s (${appFingerprint(key.key)})`, { reason: "store-key" });
 	index.key = key.key;
-	const checked = checkAppStoreIndex(index);
+	const checked = checkAppStoreIndex(index, { strict: true });
 	if (!checked.ok) throw refused(`${indexPath} is not a valid store index`, checked);
 	const { indexBytes, sigBytes } = await signAppStore(index, key.signer);
 	const read = readAppStore(indexBytes, sigBytes, now, key.key);
@@ -13627,6 +14281,31 @@ var key = {
 * per command, in alphabetical order (test/commands.test.ts checks).
 */
 var commands$8 = {
+	"app init": {
+		method: "app.init",
+		usage: "app init <dir> [--name <name>] [--title <title>] [--force]",
+		summary: "Start an app (WISP 1200): a small working one in <dir>, its ghostly-app.json, an index.html that says hello to the contact and a README, ready for app publish",
+		args: ["dir"],
+		options: {
+			name: {
+				type: "string",
+				description: "The app's name, lowercase letters, digits and hyphens (default: the folder's)"
+			},
+			title: {
+				type: "string",
+				description: "The title people see, up to 40 characters (default: from the name)"
+			},
+			force: {
+				type: "boolean",
+				description: "Replace the three files when they are there"
+			}
+		},
+		run: ({ options }, a) => initApp(a.dir, {
+			name: options.name,
+			title: options.title,
+			force: options.force === true
+		})
+	},
 	"app publish": {
 		method: "app.publish",
 		usage: "app publish <dir> --key <file> [--out <file>]",
@@ -13804,6 +14483,17 @@ var showSecret = { "show-secret": {
 	description: "Print the group's entry link (anyone who has it can join)"
 } };
 var secret = (options) => options["show-secret"] === true ? { showSecret: true } : {};
+/**
+* `--for` of the typing commands: the seconds it is kept on, 1 to 600, and never with `--stop`. A usage error (exit 2)
+* that names the flag: before, the API's own check answered ("for must be a number from 1 to 600", exit 1).
+*/
+function typingFor(options) {
+	const seconds = options.for;
+	if (seconds === void 0) return void 0;
+	if (typeof seconds !== "number" || !(seconds >= 1 && seconds <= 600)) throw new CliError("usage", `--for takes a number of seconds from 1 to 600, not ${JSON.stringify(seconds)}`);
+	if (options.stop === true) throw new CliError("usage", "--for keeps it on: not with --stop");
+	return seconds;
+}
 /** A history cursor: a timestamp when it is all digits, else a message id. */
 function cursor(value) {
 	if (value === void 0) return void 0;
@@ -13845,6 +14535,10 @@ var cardOptions = {
 	text: {
 		type: "string",
 		description: "The text older apps show instead (default: written from the card)"
+	},
+	force: {
+		type: "boolean",
+		description: "Send even if the card's text looks like a seed, a key or ecash"
 	}
 };
 /** `--link label=https://…` or a bare link, as a card's links. */
@@ -13878,7 +14572,26 @@ function itemOf(value) {
 		text: value.slice(colon + 1).trim()
 	};
 }
-/** A task's fields from its flags; what was not given is left out, so an update changes only what it names. */
+/** `--progress`, `--left`: a percent, or a usage error that names the flag. */
+function percent(options, flag) {
+	const value = options[flag];
+	if (value !== void 0 && !(typeof value === "number" && value >= 0 && value <= 100)) throw new CliError("usage", `--${flag} takes a percent from 0 to 100, not ${JSON.stringify(value)}`);
+}
+/** The flags of a task's pull request, and the field of `pr` each one gives. */
+var PR_FLAGS = [
+	["pr-url", "url"],
+	["pr-number", "number"],
+	["additions", "additions"],
+	["deletions", "deletions"],
+	["files", "files"],
+	["pr-state", "state"],
+	["pr-checks", "checks"]
+];
+/**
+* A task's fields from its flags; what was not given is left out, so an update changes only what it names. What a flag
+* got wrong is a usage error (exit 2) that names the flag: before, it reached the card's own check and failed as
+* `bad_request` (exit 1) in the card's words ("Status card: done is at most total").
+*/
 function taskFields(options) {
 	const fields = { ...cardJson(options.json) };
 	const set = (key, value) => {
@@ -13887,6 +14600,7 @@ function taskFields(options) {
 	set("id", options.id);
 	set("title", options.title);
 	set("status", options.status);
+	percent(options, "progress");
 	set("progress", options.progress);
 	set("step", options.step);
 	set("branch", options.branch);
@@ -13895,22 +14609,18 @@ function taskFields(options) {
 		if (!match) throw new CliError("usage", `--steps takes done/total, like 2/5, not ${JSON.stringify(options.steps)}`);
 		fields.done = Number(match[1]);
 		fields.total = Number(match[2]);
+		if (Number(match[2]) < 1 || Number(match[1]) > Number(match[2])) throw new CliError("usage", `--steps takes done/total with done at most total, like 2/5, not ${JSON.stringify(options.steps)}`);
 	}
+	if (options["pr-url"] !== void 0 && !cardUrl(options["pr-url"])) throw new CliError("usage", `--pr-url takes an https link of at most ${STATUS_CARD_LIMITS.url} characters, not ${JSON.stringify(options["pr-url"])}`);
+	for (const [flag, words] of [["pr-state", PR_STATES], ["pr-checks", PR_CHECKS]]) if (options[flag] !== void 0 && !words.includes(options[flag])) throw new CliError("usage", `--${flag} takes ${listed(words)}, not ${JSON.stringify(options[flag])}`);
 	const pr = {};
-	for (const [flag, key] of [
-		["pr-url", "url"],
-		["pr-number", "number"],
-		["additions", "additions"],
-		["deletions", "deletions"],
-		["files", "files"],
-		["pr-state", "state"],
-		["pr-checks", "checks"]
-	]) if (options[flag] !== void 0) pr[key] = options[flag];
+	for (const [flag, key] of PR_FLAGS) if (options[flag] !== void 0) pr[key] = options[flag];
 	if (Object.keys(pr).length) fields.pr = {
 		...fields.pr && typeof fields.pr === "object" ? fields.pr : {},
 		...pr
 	};
 	if (Array.isArray(options.item) && options.item.length) fields.items = options.item.map(itemOf);
+	if (Array.isArray(options.tag) && options.tag.length > STATUS_CARD_LIMITS.tags) throw new CliError("usage", `--tag is given at most ${STATUS_CARD_LIMITS.tags} times, not ${options.tag.length}`);
 	if (Array.isArray(options.tag) && options.tag.length) fields.tags = options.tag;
 	set("parent", options.parent);
 	const links = cardLinks(options.link);
@@ -13927,6 +14637,25 @@ function needs(card, fields, usage) {
 	if (missing.length) throw new CliError("usage", `${missing.join(" and ")} ${missing.length > 1 ? "are" : "is"} needed: ghostly ${usage}`);
 	return card;
 }
+/**
+* A new task's pull request goes by its link: `--pr-state` and the like without `--pr-url` (or `pr.url` in `--json`)
+* are a usage error that names them. An update's card may have the link already, so only a send asks.
+*/
+function prLinked(card, options, usage) {
+	const given = PR_FLAGS.filter(([flag]) => options[flag] !== void 0).map(([flag]) => `--${flag}`);
+	if (!given.length || card.pr.url !== void 0) return card;
+	throw new CliError("usage", `${given.join(" and ")} ${given.length > 1 ? "go" : "goes"} with --pr-url: ghostly ${usage}`);
+}
+/**
+* A usage card says how much is left: `--left`, or `--used` with `--limit`, as flags or in `--json`. The one that is
+* missing is a usage error that names the flag.
+*/
+function quota(card, usage) {
+	const used = card.used !== void 0;
+	if (used !== (card.limit !== void 0)) throw new CliError("usage", `--${used ? "used" : "limit"} goes with --${used ? "limit" : "used"}: ghostly ${usage}`);
+	if (card.left === void 0 && !used) throw new CliError("usage", `--left is needed (or --used with --limit): ghostly ${usage}`);
+	return card;
+}
 /** A time a command names: milliseconds, or a date the JavaScript Date reads (`2026-09-30T01:00:00Z`). */
 function cardTime(value, flag) {
 	if (value === void 0) return void 0;
@@ -14075,6 +14804,7 @@ function usageWindowOf(value) {
 /** A usage card's fields from its flags (WISP 405 § Usage); `--json` gives any of them, the flags win over it. */
 function usageFields(options) {
 	const fields = { ...cardJson(options.json) };
+	percent(options, "left");
 	for (const key of [
 		"id",
 		"left",
@@ -14132,7 +14862,8 @@ var usageOptions = {
 		description: "Every 1:1 chat with a contact, instead of one chat"
 	},
 	json: cardOptions.json,
-	text: cardOptions.text
+	text: cardOptions.text,
+	force: cardOptions.force
 };
 //#endregion
 //#region src/commands/calls.ts
@@ -14142,7 +14873,7 @@ var commands$7 = {
 		method: "call.answer",
 		usage: "call answer [<chat|call>] [--rate 48000]",
 		summary: "Answer a call that rings (the only one, or the one named)",
-		args: ["call..."],
+		args: ["call...?"],
 		options: { rate },
 		params: ({ options }, a) => ({
 			call: a.call,
@@ -14153,7 +14884,7 @@ var commands$7 = {
 		method: "call.auto",
 		usage: "call auto [on|off] [--from <chat>]... [--rate 48000]",
 		summary: "Answer calls by themselves: from anyone, or the chats named (kept in the profile)",
-		args: ["mode..."],
+		args: ["mode...?"],
 		options: {
 			from: {
 				type: "list",
@@ -14175,14 +14906,14 @@ var commands$7 = {
 		method: "call.flush",
 		usage: "call flush [<chat|call>]",
 		summary: "Drop the audio queued and not played yet (barge-in)",
-		args: ["call..."],
+		args: ["call...?"],
 		params: (_, a) => ({ call: a.call })
 	},
 	"call hangup": {
 		method: "call.hangup",
 		usage: "call hangup [<chat|call>]",
 		summary: "Hang up, or decline a call that rings",
-		args: ["call..."],
+		args: ["call...?"],
 		params: (_, a) => ({ call: a.call })
 	},
 	"call list": {
@@ -14204,6 +14935,7 @@ var commands$7 = {
 };
 //#endregion
 //#region src/commands/chats.ts
+var BUTTON_UPDATE = "button update <chat|group> <message> [--chosen <button>] [--close] [--text <text>] [--force] [--wait none|confirmed|sent] [--timeout s]";
 /** Invites, chats and messages: one entry per command, in alphabetical order (test/commands.test.ts checks). */
 var commands$6 = {
 	"button press": {
@@ -14232,7 +14964,7 @@ var commands$6 = {
 	},
 	"button update": {
 		method: "button.update",
-		usage: "button update <chat|group> <message> [--chosen <button>] [--close] [--text <text>] [--force] [--wait none|confirmed|sent] [--timeout s]",
+		usage: BUTTON_UPDATE,
 		summary: "Show the answer on a message's buttons (--chosen), close them, or change its text (the messageId send --button gave)",
 		args: ["chat", "message"],
 		options: {
@@ -14255,16 +14987,19 @@ var commands$6 = {
 			},
 			timeout: groupWait.timeout
 		},
-		params: ({ options }, a) => ({
-			chat: a.chat,
-			message: a.message,
-			chosen: options.chosen,
-			close: options.close === true,
-			text: options.text,
-			force: options.force === true,
-			wait: options.wait,
-			timeout: options.timeout
-		})
+		params: ({ options }, a) => {
+			if (!options.chosen && options.close !== true && !options.text) throw new CliError("usage", `Give --chosen, --close or --text: ghostly ${BUTTON_UPDATE}`);
+			return {
+				chat: a.chat,
+				message: a.message,
+				chosen: options.chosen,
+				close: options.close === true,
+				text: options.text,
+				force: options.force === true,
+				wait: options.wait,
+				timeout: options.timeout
+			};
+		}
 	},
 	"chat connect": {
 		method: "chat.connect",
@@ -14336,7 +15071,7 @@ var commands$6 = {
 		method: "chat.rename",
 		usage: "chat rename <chat> <name...>",
 		summary: "Name a chat on this side (empty: the contact's name)",
-		args: ["chat", "name..."],
+		args: ["chat", "name...?"],
 		params: (_, { chat, name }) => ({
 			chat,
 			name: name ?? ""
@@ -14368,10 +15103,13 @@ var commands$6 = {
 			type: "string",
 			description: "The code the contact reads out"
 		} },
-		params: ({ options }, { chat }) => ({
-			chat,
-			code: options.code
-		})
+		params: ({ options }, { chat }) => {
+			if (typeof options.code !== "string" || !options.code.trim()) throw new CliError("usage", "--code is needed: ghostly chat verify <chat> --code <code>");
+			return {
+				chat,
+				code: options.code
+			};
+		}
 	},
 	"chat wait": {
 		method: "chat.wait",
@@ -14414,14 +15152,17 @@ var commands$6 = {
 			},
 			timeout: groupWait.timeout
 		},
-		params: ({ options }, a) => ({
-			chat: a.chat,
-			messages: (a.message ?? "").split(" ").filter(Boolean),
-			to: options.to,
-			force: options.force === true,
-			wait: options.wait,
-			timeout: options.timeout
-		})
+		params: ({ options }, a) => {
+			if (!Array.isArray(options.to) || !options.to.length) throw new CliError("usage", "Missing --to: ghostly forward <chat|group> <message>... --to <chat|group>... [--force] [--wait none|sent] [--timeout s]");
+			return {
+				chat: a.chat,
+				messages: (a.message ?? "").split(" ").filter(Boolean),
+				to: options.to,
+				force: options.force === true,
+				wait: options.wait,
+				timeout: options.timeout
+			};
+		}
 	},
 	"invite create": {
 		method: "invite.create",
@@ -14479,18 +15220,22 @@ var commands$6 = {
 	},
 	"pin": {
 		method: "chat.pin",
-		usage: "pin <chat|group> <message> [--remove]",
+		usage: "pin <chat|group> <message> | --remove",
 		summary: "Pin a message at the top of a chat or group (one per chat: it replaces the pinned one); --remove unpins",
-		args: ["chat", "message"],
+		args: ["chat", "message...?"],
 		options: { remove: {
 			type: "boolean",
-			description: "Unpin the chat's pinned message"
+			description: "Unpin the chat's pinned message (it names no message)"
 		} },
-		params: ({ options }, a) => ({
-			chat: a.chat,
-			message: a.message,
-			remove: options.remove === true
-		})
+		params: ({ options }, a) => {
+			if (a.message === void 0 && options.remove !== true) throw new CliError("usage", "Missing <message>: ghostly pin <chat|group> <message> | --remove");
+			if (a.message?.includes(" ")) throw new CliError("usage", "Too many arguments: ghostly pin <chat|group> <message> | --remove");
+			return {
+				chat: a.chat,
+				message: a.message,
+				remove: options.remove === true
+			};
+		}
 	},
 	"react": {
 		method: "chat.react",
@@ -14499,7 +15244,7 @@ var commands$6 = {
 		args: [
 			"chat",
 			"message",
-			"emoji..."
+			"emoji...?"
 		],
 		options: { remove: {
 			type: "boolean",
@@ -14514,7 +15259,7 @@ var commands$6 = {
 	},
 	"routine send": {
 		method: "routine.send",
-		usage: "routine send <chat|group> --name <name> --schedule \"every day 01:00\" [--cron \"0 1 * * *\"] [--state active|paused] [--next <time>] [--run ok|failed|skipped[:summary]] [--link url]... [--id id] [--json json|-|file] [--wait none|sent|delivered] [--timeout s]",
+		usage: "routine send <chat|group> --name <name> --schedule \"every day 01:00\" [--cron \"0 1 * * *\"] [--state active|paused] [--next <time>] [--run ok|failed|skipped[:summary]] [--link url]... [--id id] [--json json|-|file] [--force] [--wait none|sent|delivered] [--timeout s]",
 		summary: "Send a routine card (something a bot runs on a schedule: its last run and the next) to a chat or group",
 		args: ["chat"],
 		options: {
@@ -14531,13 +15276,14 @@ var commands$6 = {
 			card: needs(routineFields(options), [["name", "name"], ["schedule", "schedule"]], "routine send <chat|group> --name <name> --schedule \"every day 01:00\""),
 			run: runOf(options.run),
 			text: options.text,
+			force: options.force === true,
 			wait: options.wait,
 			timeout: options.timeout
 		})
 	},
 	"routine update": {
 		method: "routine.update",
-		usage: "routine update <chat|group> <routine> [--run ok|failed|skipped[:summary]] [--next <time>] [--state active|paused] [--schedule ...] [--json json|-|file] [--wait none|confirmed|sent] [--timeout s]",
+		usage: "routine update <chat|group> <routine> [--run ok|failed|skipped[:summary]] [--next <time>] [--state active|paused] [--schedule ...] [--json json|-|file] [--force] [--wait none|confirmed|sent] [--timeout s]",
 		summary: "Update a routine card you sent: record a run, the next one, a pause (at most one update per 2.5 s; sooner ones merge)",
 		args: ["chat", "routine"],
 		options: {
@@ -14554,13 +15300,14 @@ var commands$6 = {
 			card: routineFields(options),
 			run: runOf(options.run),
 			text: options.text,
+			force: options.force === true,
 			wait: options.wait,
 			timeout: options.timeout
 		})
 	},
 	"task send": {
 		method: "task.send",
-		usage: "task send <chat|group> --title <title> [--status s] [--progress n | --steps a/b] [--step \"...\"] [--item state:text]... [--pr-url url --pr-number n --additions n --deletions n --files n --pr-state s --pr-checks c] [--branch b] [--tag label]... [--parent task] [--link url]... [--id id] [--json json|-|file] [--wait none|sent|delivered] [--timeout s]",
+		usage: "task send <chat|group> --title <title> [--status s] [--progress n | --steps a/b] [--step \"...\"] [--item state:text]... [--pr-url url --pr-number n --additions n --deletions n --files n --pr-state s --pr-checks c] [--branch b] [--tag label]... [--parent task] [--link url]... [--id id] [--json json|-|file] [--force] [--wait none|sent|delivered] [--timeout s]",
 		summary: "Send a task card (a bot's work: status, progress, its PR) to a chat or group; prints its id and message",
 		args: ["chat"],
 		options: {
@@ -14574,15 +15321,16 @@ var commands$6 = {
 		},
 		params: ({ options }, { chat }) => ({
 			chat,
-			card: needs(taskFields(options), [["title", "title"]], "task send <chat|group> --title <title>"),
+			card: prLinked(needs(taskFields(options), [["title", "title"]], "task send <chat|group> --title <title>"), options, "task send <chat|group> --title <title> --pr-url <url>"),
 			text: options.text,
+			force: options.force === true,
 			wait: options.wait,
 			timeout: options.timeout
 		})
 	},
 	"task update": {
 		method: "task.update",
-		usage: "task update <chat|group> <task> [--status s] [--progress n | --steps a/b] [--step \"...\"] [--item state:text]... [--pr-url ...] [--pr-state s] [--pr-checks c] [--tag label]... [--parent task] [--json json|-|file] [--wait none|confirmed|sent] [--timeout s]",
+		usage: "task update <chat|group> <task> [--status s] [--progress n | --steps a/b] [--step \"...\"] [--item state:text]... [--pr-url ...] [--pr-state s] [--pr-checks c] [--tag label]... [--parent task] [--json json|-|file] [--force] [--wait none|confirmed|sent] [--timeout s]",
 		summary: "Update a task card you sent: the fields given, merged over it (at most one update per 2.5 s; sooner ones merge)",
 		args: ["chat", "task"],
 		options: {
@@ -14598,6 +15346,7 @@ var commands$6 = {
 			task: a.task,
 			card: taskFields(options),
 			text: options.text,
+			force: options.force === true,
 			wait: options.wait,
 			timeout: options.timeout
 		})
@@ -14630,12 +15379,12 @@ var commands$6 = {
 			stop: options.stop === true,
 			kind: options.kind,
 			status: options.status,
-			for: options.for
+			for: typingFor(options)
 		})
 	},
 	"usage send": {
 		method: "usage.send",
-		usage: "usage send [<chat|group>] [--all] --left <percent> [--window \"5 h\"] [--resets <time>] [--label Claude] [--account <name>] [--also week=80@<time>]... [--used n --limit n] [--id id] [--json json|-|file] [--wait none|sent] [--timeout s]",
+		usage: "usage send [<chat|group>] [--all] --left <percent> [--window \"5 h\"] [--resets <time>] [--label Claude] [--account <name>] [--also week=80@<time>]... [--used n --limit n] [--id id] [--json json|-|file] [--force] [--wait none|sent] [--timeout s]",
 		summary: "Say how much of your quota is left (a bot's usage card, one per chat, updated in place); --all for every 1:1 chat",
 		args: ["chat?"],
 		options: {
@@ -14647,8 +15396,9 @@ var commands$6 = {
 			return {
 				chat,
 				all: options.all === true,
-				card: usageFields(options),
+				card: quota(usageFields(options), "usage send <chat|--all> --left <percent>"),
 				text: options.text,
+				force: options.force === true,
 				wait: options.wait,
 				timeout: options.timeout
 			};
@@ -14849,15 +15599,18 @@ var commands$4 = {
 		method: "profile.picture",
 		usage: "profile picture <jpeg> | --clear",
 		summary: "The picture contacts see (a square JPEG, 128 px is what the app sends)",
-		args: ["path..."],
+		args: ["path...?"],
 		options: { clear: {
 			type: "boolean",
 			description: "Remove the picture"
 		} },
-		params: ({ options }, a) => ({
-			path: here(a.path),
-			clear: options.clear === true
-		})
+		params: ({ options }, a) => {
+			if (a.path === void 0 && options.clear !== true) throw new CliError("usage", "Missing <jpeg>: ghostly profile picture <jpeg> | --clear");
+			return {
+				path: here(a.path),
+				clear: options.clear === true
+			};
+		}
 	},
 	"status": {
 		method: "status",
@@ -15034,16 +15787,19 @@ var commands$3 = {
 		method: "group.picture",
 		usage: "group picture <group> <jpeg> | --clear",
 		summary: "Set or clear the group's picture (admin; a square JPEG)",
-		args: ["group", "path..."],
+		args: ["group", "path...?"],
 		options: { clear: {
 			type: "boolean",
 			description: "Remove the picture"
 		} },
-		params: ({ options }, a) => ({
-			group: a.group,
-			path: here(a.path),
-			clear: options.clear === true
-		})
+		params: ({ options }, a) => {
+			if (a.path === void 0 && options.clear !== true) throw new CliError("usage", "Missing <jpeg>: ghostly group picture <group> <jpeg> | --clear");
+			return {
+				group: a.group,
+				path: here(a.path),
+				clear: options.clear === true
+			};
+		}
 	},
 	"group react": {
 		method: "group.react",
@@ -15052,7 +15808,7 @@ var commands$3 = {
 		args: [
 			"group",
 			"message",
-			"emoji..."
+			"emoji...?"
 		],
 		options: { remove: {
 			type: "boolean",
@@ -15139,7 +15895,7 @@ var commands$3 = {
 			stop: options.stop === true,
 			kind: options.kind,
 			status: options.status,
-			for: options.for
+			for: typingFor(options)
 		})
 	}
 };
@@ -15662,7 +16418,7 @@ var TEXT_COMMANDS = {
 	"send": {
 		method: "chat.send",
 		target: "chat",
-		args: ["chat", "text..."],
+		args: ["chat", "text...?"],
 		usage: "send <chat> [text...] [--reply <message>] [--button id:Label]... [--style id=primary|neutral|danger]... [--once] [--id id] [--stdin] [--force] [--wait none|sent|delivered]",
 		summary: "Send a message (text from arguments or stdin); --button puts buttons under it, each label its own (case aside)",
 		options: {
@@ -15683,7 +16439,7 @@ var TEXT_COMMANDS = {
 		args: [
 			"chat",
 			"message",
-			"text..."
+			"text...?"
 		],
 		usage: "edit <chat> <message> [text... | --text <text> | --stdin] [--force] [--wait none|confirmed]",
 		summary: "Replace the text of a message you sent (the id send gave; in a group, group edit)",
@@ -15707,7 +16463,7 @@ var TEXT_COMMANDS = {
 	"group send": {
 		method: "group.send",
 		target: "group",
-		args: ["group", "text..."],
+		args: ["group", "text...?"],
 		usage: "group send <group> [text...] [--mention <member>]... [--reply <message>] [--button id:Label]... [--style id=primary|neutral|danger]... [--once] [--id id] [--stdin] [--force] [--wait none|sent] [--timeout s]",
 		summary: "Send to a group; mention members written as @name in the text; --button puts buttons under it",
 		options: {
@@ -15732,7 +16488,7 @@ var TEXT_COMMANDS = {
 		args: [
 			"group",
 			"message",
-			"text..."
+			"text...?"
 		],
 		usage: "group edit <group> <message> [text... | --text <text> | --stdin] [--mention <member>]... [--force] [--wait none|sent] [--timeout s]",
 		summary: "Replace the text of a message you sent to a group (the id group send gave)",
@@ -15773,13 +16529,15 @@ var ID_ARGS = /* @__PURE__ */ new Set([
 	"service",
 	"call"
 ]);
+/** A leading positional that may be left out (`name?`); a trailing one that may (`text...?`) shifts nothing. */
+var leadingOptional = (name) => name.endsWith("?") && !name.endsWith("...?");
 /**
 * Which of a command's positionals take an id, by index (a trailing `...` one covers the rest). An optional `name?`
 * shifts the others, so it counts only where it and what may come in its place are all ids.
 */
 function idSlot(command) {
 	const names = (command.args ?? []).map((name) => name.replace(/\?$/, ""));
-	const shift = (command.args ?? []).filter((name) => name.endsWith("?")).length;
+	const shift = (command.args ?? []).filter(leadingOptional).length;
 	const rest = names.findIndex((name) => name.endsWith("..."));
 	const at = (index) => {
 		const name = rest !== -1 && index >= rest ? names[rest].slice(0, -3) : names[index];
@@ -15789,29 +16547,36 @@ function idSlot(command) {
 }
 /**
 * The positionals of a command, by name; missing required ones are a usage error. A leading `name?` is optional: it
-* is given only when every required one is there too (`file accept [<chat>] <file>`).
+* is given only when every required one is there too (`file accept [<chat>] <file>`). A trailing `name...` takes the
+* rest and needs at least one word; `name...?` may take none (text from stdin, `chat rename`'s name back to the
+* contact's).
 */
 function positionals(command, values) {
 	let names = command.args ?? [];
-	const optional = names.filter((name) => name.endsWith("?"));
+	const optional = names.filter(leadingOptional);
 	if (optional.length) {
 		const skip = Math.max(0, optional.length - Math.max(0, values.length - (names.length - optional.length)));
-		names = [...optional.slice(skip).map((name) => name.slice(0, -1)), ...names.filter((name) => !name.endsWith("?"))];
+		names = [...optional.slice(skip).map((name) => name.slice(0, -1)), ...names.filter((name) => !leadingOptional(name))];
 	}
 	const out = {};
 	for (let i = 0; i < names.length; i++) {
-		const name = names[i];
+		const name = names[i].replace(/\?$/, "");
 		if (name.endsWith("...")) {
 			const rest = values.slice(i);
+			if (!rest.length && !names[i].endsWith("?")) throw new CliError("usage", `Missing <${name.slice(0, -3)}>: ghostly ${command.usage}`);
 			out[name.slice(0, -3)] = rest.length ? rest.join(" ") : void 0;
 			return out;
 		}
 		if (values[i] === void 0) throw new CliError("usage", `Missing <${name}>: ghostly ${command.usage}`);
 		out[name] = values[i];
 	}
-	if (values.length > names.length) throw new CliError("usage", `Too many arguments: ghostly ${command.usage}`);
+	noMoreThan(names.length, values, command.usage);
 	return out;
 }
+/** Words past a usage's arguments are refused, never dropped: `profile use my bot` would select `my`. */
+function noMoreThan(count, values, usage) {
+	if (values.length > count) throw new CliError("usage", `Too many arguments: ghostly ${usage}`);
+}
 //#endregion
 //#region src/announce.ts
 /**
@@ -15923,6 +16688,12 @@ var PlaybackQueue = class {
 		this.length = 0;
 		return ms;
 	}
+	/** Drops up to that much from the front, in whole frames (audio whose time went by); returns how much, in milliseconds. */
+	skip(ms) {
+		const frames = Math.min(Math.floor(ms / 20), Math.floor(this.length / this.frame));
+		if (frames > 0) this.take(frames * this.frame);
+		return Math.max(0, frames) * 20;
+	}
 	take(bytes) {
 		const out = Buffer.allocUnsafe(bytes);
 		let filled = 0;
@@ -15955,6 +16726,19 @@ function audioSocketPath(profileDir, callId) {
 	return join("/tmp", `ghostly-calls-${createHash("sha256").update(profileDir).digest("hex").slice(0, 24)}`, `${callId}.sock`);
 }
 /**
+* Removes the call sockets a daemon that died during a call left in this profile's folder (`audioSocketPath`; call
+* ids are 12 hex digits): no call outlives its daemon. A folder that is a link or someone else's is left alone.
+*/
+function clearAudioSockets(profileDir) {
+	if (process.platform === "win32") return;
+	const folder = dirname(audioSocketPath(profileDir, "0".repeat(12)));
+	try {
+		const info = lstatSync(folder);
+		if (!info.isDirectory() || process.getuid && info.uid !== process.getuid()) return;
+		for (const entry of readdirSync(folder, { withFileTypes: true })) if (entry.name.endsWith(".sock") && !entry.isDirectory()) rmSync(join(folder, entry.name), { force: true });
+	} catch {}
+}
+/**
 * Serves one call's audio to one program at a time: what the program writes is handed to `onAudio` as it comes (raw
 * PCM, any amount); `write` gives it the caller's audio. A second connection replaces the first. `close` ends the
 * program's connection (it reads EOF) and removes the socket.
@@ -16139,6 +16923,8 @@ var ReorderBuffer = class {
 };
 //#endregion
 //#region src/calls/audio.ts
+/** The longest stall of the sender whose frames are still sent after it (see `catchUp`). */
+var MAX_CATCH_UP_MS = 1e3;
 /**
 * One call's audio: every 20 ms a frame from the queue (the program's audio, or silence) is encoded and sent; what
 * comes in is put back in order, decoded, and handed on in 20 ms frames as soon as it is. Nothing waits on a clock
@@ -16156,11 +16942,23 @@ var CallAudio = class {
 	timer = null;
 	startedAt = 0;
 	ticks = 0;
+	/** What was left in the queue after the last frame sent: the program's audio written ahead of the call. */
+	ahead = 0;
+	/** After a stall that was not replayed: how much of its audio is still to drop, down to what queue, and until when. */
+	owed = 0;
+	kept = 0;
+	owedUntil = 0;
 	talking = false;
+	/** The last silent frame's packet, how many silent frames in a row gave it, and that packet once it is kept (see `settle`). */
+	lastQuiet = null;
+	same = 0;
+	quiet = null;
 	stopped = false;
 	/** Frames sent and received, for `call list`. */
 	sent = 0;
 	received = 0;
+	/** When the last packet, RTP or RTCP, came from the contact (Date.now(); 0: none yet), for the call's watch. */
+	heardAt = 0;
 	constructor(options) {
 		this.options = options;
 		const now = options.now ?? Date.now;
@@ -16189,20 +16987,46 @@ var CallAudio = class {
 	tick() {
 		if (this.stopped) return;
 		const { frame, silent } = this.queue.next();
+		const still = silent || frame.equals(this.silence);
 		let payload;
-		try {
-			payload = this.options.encoder.encode(frame, this.samples);
-		} catch {
-			return;
+		if (still && this.quiet) payload = this.quiet;
+		else {
+			try {
+				payload = this.options.encoder.encode(frame, this.samples);
+			} catch {
+				return;
+			}
+			this.settle(still, payload);
 		}
 		const marker = !silent && !this.talking;
 		this.talking = !silent;
 		this.options.track.send(this.writer.packet(payload, marker));
 		this.sent++;
+		this.ahead = this.queue.queuedMs;
+	}
+	/**
+	* Keeps the packet silence encodes to once the encoder gave it SETTLED_FRAMES times in a row: it is sent again for
+	* the silent frames that follow, without the encoder, until the program's audio is back.
+	*/
+	settle(still, payload) {
+		if (!still) {
+			this.lastQuiet = null;
+			this.quiet = null;
+			this.same = 0;
+			return;
+		}
+		if (this.lastQuiet?.equals(payload)) {
+			if (++this.same >= 25) this.quiet = this.lastQuiet;
+			return;
+		}
+		this.lastQuiet = Buffer.from(payload);
+		this.same = 1;
 	}
 	/** Handles one packet from the track. Exposed for tests. */
 	receive(packet) {
-		if (this.stopped || isRtcp(packet)) return;
+		if (this.stopped) return;
+		this.heardAt = (this.options.now ?? Date.now)();
+		if (isRtcp(packet)) return;
 		const rtp = parseRtp(packet);
 		if (!rtp || rtp.payloadType !== this.options.payloadType) return;
 		for (const item of this.reorder.push(rtp)) {
@@ -16231,14 +17055,57 @@ var CallAudio = class {
 		const due = this.startedAt + (this.ticks + 1) * 20;
 		this.timer = setTimeout(() => {
 			if (this.stopped) return;
-			if (now() - due > 100) {
-				this.startedAt = now();
-				this.ticks = 0;
-			} else this.ticks++;
-			this.tick();
-			this.schedule();
+			if (now() - due < 20) {
+				this.ticks++;
+				this.drop();
+				this.tick();
+				this.schedule();
+				return;
+			}
+			setImmediate(() => {
+				if (this.stopped) return;
+				this.catchUp(now() - due);
+				this.schedule();
+			});
 		}, Math.max(0, due - now()));
 	}
+	/**
+	* Meets the clock again after the loop was busy: every frame that is due goes out at once, so a loop that turns
+	* slower than a frame for a while (every 40 ms under a large file) keeps up, and a program writing at real time
+	* stays there. The contact's jitter buffer takes the short burst. A stall past MAX_CATCH_UP_MS is not replayed: the
+	* clock starts again and what the program wrote during it is dropped, or it would be heard that much late for the
+	* rest of the call.
+	*/
+	catchUp(late) {
+		const now = this.options.now ?? Date.now;
+		if (late > 1e3) {
+			this.owed = late;
+			this.kept = this.ahead;
+			this.owedUntil = now() + MAX_CATCH_UP_MS;
+			this.startedAt = now();
+			this.ticks = 0;
+			this.drop();
+			this.tick();
+			return;
+		}
+		do {
+			this.ticks++;
+			this.drop();
+			this.tick();
+		} while (this.startedAt + (this.ticks + 1) * 20 <= now());
+	}
+	/**
+	* Drops the audio of a stall that was not replayed, as it is read: a long one does not fit the program's socket, so
+	* the rest of it comes over the next turns. What was queued before the stall (a clip written ahead) is kept.
+	*/
+	drop() {
+		if (this.owed <= 0) return;
+		if ((this.options.now ?? Date.now)() > this.owedUntil) {
+			this.owed = 0;
+			return;
+		}
+		this.owed -= this.queue.skip(Math.min(this.owed, this.queue.queuedMs - this.kept));
+	}
 };
 //#endregion
 //#region src/calls/media.ts
@@ -16524,6 +17391,7 @@ var CallManager = class {
 		this.host = host;
 		this.configPath = join(host.profileDir, "calls.json");
 		this.auto = readAuto(this.configPath);
+		if (host.answers !== false) clearAudioSockets(host.profileDir);
 	}
 	get now() {
 		return (this.host.now ?? Date.now)();
@@ -16710,6 +17578,8 @@ var CallManager = class {
 		this.callable(call.chat);
 		call.rate = rateOf(options.rate, call.rate);
 		const stack = await this.stack();
+		if (call.ended) throw new CliError("unavailable", "The call ended before it was answered");
+		if (call.state !== "ringing") throw new CliError("refused", "That call is not ringing here");
 		call.state = "connecting";
 		this.disarm(call);
 		try {
@@ -16808,15 +17678,26 @@ var CallManager = class {
 			startedAt: this.now,
 			connectedAt: null,
 			timer: null,
+			watcher: null,
+			stalledFrom: null,
+			stalls: 0,
 			ended: false
 		};
 		this.calls.set(call.id, call);
 		return call;
 	}
-	/** The call's socket (open from now on: a program may connect before the media is up) and its media. */
+	/**
+	* The call's socket (open from now on: a program may connect before the media is up) and its media. A call that
+	* ended while its socket opened closes it here: `end` found none to close, and nothing lists the call any more.
+	*/
 	async attach(call, create) {
 		const queue = call.queue = new PlaybackQueue(call.rate);
-		call.socket = await AudioSocket.open(audioSocketPath(this.host.profileDir, call.id), call.rate, { onAudio: (chunk) => queue.push(chunk) });
+		const socket = await AudioSocket.open(audioSocketPath(this.host.profileDir, call.id), call.rate, { onAudio: (chunk) => queue.push(chunk) });
+		if (call.ended) {
+			await socket.close();
+			return;
+		}
+		call.socket = socket;
 		await this.connect(call, create);
 	}
 	/**
@@ -16824,6 +17705,7 @@ var CallManager = class {
 	* the call ended, or asked for a newer connection, while this one was made: then it is closed.
 	*/
 	async connect(call, create) {
+		if (call.ended) return false;
 		const attempt = ++call.attempt;
 		call.media?.close();
 		call.media = null;
@@ -16867,12 +17749,58 @@ var CallManager = class {
 			direction: call.direction,
 			audio: this.audioInfo(call)
 		});
+		this.watch(call);
+	}
+	/**
+	* libjuice says nothing of a contact whose side went away (a crash, a closed lid, a lost network) until its consent
+	* checks fail, about 30 s later: a connected call watches the contact's packets instead. An app sends them all along
+	* (silence while muted, and RTCP), and so does the CLI. Nothing for STALL_MS: `call.stalled`; packets again:
+	* `call.resumed`; nothing for STALL_END_MS: the call ends as `failed`, and the contact's app is told.
+	*/
+	watch(call) {
+		const { afterMs, endMs } = this.host.stall ?? {
+			afterMs: 5e3,
+			endMs: 15e3
+		};
+		const since = Date.now();
+		call.watcher = setInterval(() => {
+			if (call.ended) return;
+			const heardAt = Math.max(since, call.media?.audio.heardAt ?? 0);
+			const silentMs = Date.now() - heardAt;
+			const fields = {
+				call: call.id,
+				chat: call.chat,
+				direction: call.direction
+			};
+			if (silentMs >= endMs) {
+				process.stderr.write(`ghostly: call ${call.id}: nothing heard from the contact for ${Math.round(silentMs / 1e3)} s\n`);
+				this.end(call, "failed", true);
+			} else if (silentMs >= afterMs && call.stalledFrom === null) {
+				call.stalledFrom = heardAt;
+				call.stalls++;
+				process.stderr.write(`ghostly: call ${call.id}: stalled, nothing heard from the contact for ${silentMs} ms\n`);
+				this.host.emit("call.stalled", `call.stalled:${call.id}:${call.stalls}`, {
+					...fields,
+					silentMs
+				});
+			} else if (silentMs < afterMs && call.stalledFrom !== null) {
+				const gapMs = heardAt - call.stalledFrom;
+				call.stalledFrom = null;
+				process.stderr.write(`ghostly: call ${call.id}: resumed after ${gapMs} ms\n`);
+				this.host.emit("call.resumed", `call.resumed:${call.id}:${call.stalls}`, {
+					...fields,
+					silentMs: gapMs
+				});
+			}
+		}, Math.min(1e3, afterMs / 5));
+		call.watcher.unref?.();
 	}
 	async end(call, reason, tell, report = true) {
 		if (call.ended) return;
 		call.ended = true;
 		call.reason = reason;
 		this.disarm(call);
+		if (call.watcher) clearInterval(call.watcher);
 		this.calls.delete(call.id);
 		if (report) process.stderr.write(`ghostly: call ${call.id}: ended (${reason})${call.media ? `, ice ${call.media.ice.state}` : ""}\n`);
 		call.media?.close();
@@ -16943,6 +17871,7 @@ var CallManager = class {
 			chat: call.chat,
 			direction: call.direction,
 			state: call.state,
+			stalled: call.stalledFrom !== null,
 			video: call.video,
 			startedAt: call.startedAt,
 			connectedAt: call.connectedAt,
@@ -18428,10 +19357,11 @@ async function openPersistentIndexedDb(dir) {
 	const pending = /* @__PURE__ */ new WeakMap();
 	const snapshotPath = join(dir, SNAPSHOT);
 	const journalPath = join(dir, JOURNAL);
-	if (existsSync(snapshotPath)) restore(classes, raw._databases, deserialize(readFileSync(snapshotPath)));
-	if (existsSync(journalPath)) replay(raw._databases, readFileSync(journalPath));
+	const snapshotFound = existsSync(snapshotPath), journalFound = existsSync(journalPath);
+	if (snapshotFound) restore(classes, raw._databases, deserialize(readFileSync(snapshotPath)), (a, b) => factory.cmp(a, b));
+	if (journalFound) replay(raw._databases, readFileSync(journalPath));
 	restoring = false;
-	await writeSnapshot();
+	if (journalFound || !snapshotFound) await writeSnapshot();
 	const storeProto = classes.ObjectStore.prototype;
 	const storeRecord = storeProto.storeRecord;
 	const deleteRecord = storeProto.deleteRecord;
@@ -18614,7 +19544,12 @@ async function probeClasses(factory) {
 	});
 	return classes;
 }
-function restore(classes, databases, snapshot) {
+/**
+* The snapshot's records come in key order (as `writeSnapshot` walks them), so each store's tree and each index's are
+* built whole from sorted arrays: storing record by record compared every key down the tree, a 70,000-message profile
+* took seconds. A snapshot not in order (never written so) is stored record by record.
+*/
+function restore(classes, databases, snapshot, cmp) {
 	if (snapshot?.format !== 1) throw new Error("This profile was last used by a newer version of ghostly (its store has a format this version does not read). Update ghostly to open it.");
 	for (const saved of snapshot.databases) {
 		const db = new classes.Database(saved.name, saved.version);
@@ -18627,16 +19562,103 @@ function restore(classes, databases, snapshot) {
 				store.rawIndexes.set(i.name, index);
 			}
 			db.rawObjectStores.set(s.name, store);
-			for (const [key, value] of s.records) store.storeRecord({
+			const records = s.records.map(([key, value]) => ({
 				key,
 				value: blobsFromDisk(value)
-			}, false);
+			}));
+			if (records.some((record, at) => at > 0 && cmp(records[at - 1].key, record.key) >= 0)) {
+				for (const record of records) store.storeRecord(record, false);
+				continue;
+			}
+			fill(store.records, records);
+			for (const index of store.rawIndexes.values()) fill(index.records, indexEntries(index, records, cmp));
 		}
 		databases.set(saved.name, db);
 	}
 }
-/** Replays whole entries; a torn last entry (the process died mid-write) was never acknowledged and is dropped. */
+/**
+* An index's entries for records in key order, sorted by the index's key: the index derives them itself (key path,
+* multi-entry, invalid keys skipped) into a list instead of its tree. A stable sort keeps equal index keys in the
+* records' key order, the tree's own tie-break.
+*/
+function indexEntries(index, records, cmp) {
+	const entries = [];
+	const tree = index.records;
+	index.records = {
+		get: () => void 0,
+		put: (entry) => {
+			entries.push(entry);
+		}
+	};
+	try {
+		for (const record of records) if (!absent(index.keyPath, record.value)) index.storeRecord(record);
+	} finally {
+		index.records = tree;
+	}
+	return entries.sort((a, b) => cmp(a.key, b.key));
+}
+/**
+* Whether a key path surely finds nothing in a value: a plain object along it lacks the step (most messages have no
+* `card` for the card index). The index would throw and catch a DataError for each of those; anything else it judges.
+*/
+function absent(keyPath, value) {
+	if (typeof keyPath !== "string" || keyPath === "") return false;
+	let object = value;
+	for (const step of keyPath.split(".")) {
+		if (object === null || typeof object !== "object" || Array.isArray(object) || object instanceof Blob) return false;
+		if (!Object.hasOwn(object, step)) return true;
+		object = object[step];
+	}
+	return false;
+}
+/**
+* fake-indexeddb's red-black tree, built balanced from sorted records: every level full but the last, whose nodes
+* are red, so each path holds the same number of black nodes and later inserts rebalance as usual.
+*/
+function fill(store, sorted) {
+	const deepest = sorted.length ? Math.floor(Math.log2(sorted.length)) : 0;
+	const build = (low, high, parent, depth) => {
+		if (low > high) return void 0;
+		const middle = low + high >>> 1;
+		const node = {
+			record: sorted[middle],
+			left: void 0,
+			right: void 0,
+			parent,
+			deleted: false,
+			red: depth > 0 && depth === deepest
+		};
+		node.left = build(low, middle - 1, node, depth + 1);
+		node.right = build(middle + 1, high, node, depth + 1);
+		return node;
+	};
+	store.records._root = build(0, sorted.length - 1, void 0, 0);
+	store.records._numNodes = sorted.length;
+	store.records._numTombstones = 0;
+}
+/**
+* Replays whole entries; a torn last entry (the process died mid-write) was never acknowledged and is dropped.
+*
+* A store's indexes are set aside while its ops replay and rebuilt once at the end: fake-indexeddb drops an
+* overwritten or deleted record from an index by walking every record of it, so a crash after a busy chat took
+* tens of seconds to minutes to start, one write at a time against the whole profile.
+*/
 function replay(databases, journal) {
+	const touched = /* @__PURE__ */ new Map();
+	try {
+		replayEntries(databases, journal, touched);
+	} finally {
+		for (const [store, indexes] of touched) {
+			store.rawIndexes = indexes;
+			for (const index of indexes.values()) {
+				index.records.clear();
+				if (!index.initialized) continue;
+				for (const record of store.records.values()) index.storeRecord(record);
+			}
+		}
+	}
+}
+function replayEntries(databases, journal, touched) {
 	let offset = 0;
 	while (offset + 4 <= journal.length) {
 		const length = journal.readUInt32BE(offset);
@@ -18651,6 +19673,10 @@ function replay(databases, journal) {
 		for (const op of ops) {
 			const store = databases.get(op.db)?.rawObjectStores.get(op.store);
 			if (!store) continue;
+			if (!touched.has(store)) {
+				touched.set(store, store.rawIndexes);
+				store.rawIndexes = /* @__PURE__ */ new Map();
+			}
 			if (op.kind === "put") store.storeRecord({
 				key: op.key,
 				value: blobsFromDisk(op.value)
@@ -18892,7 +19918,7 @@ async function startRuntime(paths, options = {}) {
 	const restored = join(paths.dir, RESTORED_MARK);
 	if (existsSync(restored)) {
 		try {
-			const rows = await import("./assets/restoredRows-lhTKGmCO.js");
+			const rows = await import("./assets/restoredRows-C_84q0Pd.js");
 			await rows.markRestoredWallet();
 			await rows.markLeftOutFiles(leftOutIn(restored));
 			await store.compact();
@@ -18911,16 +19937,16 @@ async function startRuntime(paths, options = {}) {
 	await installEventSource();
 	await preloadWalletModules();
 	(await import("./assets/ghostly_iroh_web-Dvzh3Y6E.js")).initSync({ module: irohWasmBytes() });
-	const [{ registerFileBytes }, { NodeFileBytes }] = await Promise.all([import("./assets/fileBytes-3AQ2tJzW.js").then((n) => n.o), import("./assets/fileBytes-CAZDydIe.js")]);
+	const [{ registerFileBytes }, { NodeFileBytes }] = await Promise.all([import("./assets/fileBytes-BcYZhNgF.js").then((n) => n.o), import("./assets/fileBytes-Dbifu5I5.js")]);
 	registerFileBytes("native", async () => new NodeFileBytes(paths.files), true);
-	const [{ EngineServer }, { createHyperEndpoint }] = await Promise.all([import("./assets/server-GJW_5wGI.js").then((n) => n.t), import("./assets/endpoint-D_3bYafG.js")]);
+	const [{ EngineServer }, { createHyperEndpoint }] = await Promise.all([import("./assets/server-D5FBZYW8.js").then((n) => n.t), import("./assets/endpoint-pgFkR2AS.js")]);
 	const network = hyperdhtNetwork();
 	const dht = mainlineNetwork();
-	const mainline = dht.off ? null : new (await (import("./assets/mainline-B7wHcLaW.js"))).Mainline({
+	const mainline = dht.off ? null : new (await (import("./assets/mainline-DVYdrus6.js"))).Mainline({
 		bootstrap: dht.bootstrap,
 		host: dht.host
 	});
-	const transport = mainline || pinned ? new (await (import("./assets/mainline-B7wHcLaW.js"))).RelaysAndDht(mainline, pinned ? { relays: pinned } : {}, !!pinned) : null;
+	const transport = mainline || pinned ? new (await (import("./assets/mainline-DVYdrus6.js"))).RelaysAndDht(mainline, pinned ? { relays: pinned } : {}, !!pinned) : null;
 	const server = new EngineServer({
 		...transport ? { transport } : {},
 		irohWeb: true,
@@ -18930,6 +19956,7 @@ async function startRuntime(paths, options = {}) {
 		automaticWallets: false,
 		fedimintSdk: nodeFedimintSdk(join(paths.dir, "fedimint")),
 		servicesSupport: true,
+		apps: false,
 		staysOnline: process.env.GHOSTLY_HUB !== "0",
 		localFetch: nodeLocalFetch,
 		pushSend: (request) => nodePushSend(request),
@@ -18979,6 +20006,7 @@ async function openHost(paths, mode, version, options = {}) {
 		await hub.open();
 		const node = runtime.server.node;
 		const now = node.getState();
+		const mark = runtime.server.historyMark;
 		const histories = /* @__PURE__ */ new Map();
 		for (const link of now.links) histories.set(link.id, await node.getMessages(link.id));
 		for (const group of now.groups) histories.set(`group:${group.id}`, await node.groupMessages({ groupId: group.id }));
@@ -18992,7 +20020,10 @@ async function openHost(paths, mode, version, options = {}) {
 		});
 		const manager = calls;
 		hub.onCallSignal((chat, signal) => manager.onSignal(chat, signal));
-		runtime.server.attach(hub.sink);
+		runtime.server.attach(hub.sink, {
+			mark,
+			ids: histories.keys()
+		});
 	} catch (error) {
 		await runtime.close().catch(() => {});
 		release();
@@ -19226,19 +20257,21 @@ function toTurn(event) {
 }
 function turn(event, source, where, message) {
 	const file = message.file;
+	const place = where.chat ?? where.group ?? "", messageId = turnRef(place, message.id);
 	return {
 		seq: event.seq,
-		id: `agent.turn:${event.id}`,
+		id: `agent.turn:${source}:${place}:${messageId}`,
 		type: "agent.turn",
 		at: event.at,
 		source,
 		...where,
-		messageId: message.id,
+		messageId,
 		timestamp: message.timestamp,
 		...message.press ? { press: message.press } : {},
 		untrusted: {
 			text: message.text,
 			name: message.nick ?? null,
+			messageId: message.id,
 			...message.replyTo ? { replyTo: {
 				id: message.replyTo.id,
 				snippet: message.replyTo.snippet
@@ -19320,6 +20353,7 @@ async function post(url, event) {
 		try {
 			if ((await fetch(url, {
 				method: "POST",
+				redirect: "manual",
 				headers: {
 					"content-type": "application/json",
 					"x-ghostly-event": event.type,
@@ -19426,7 +20460,14 @@ function requireProfile(g) {
 		createProfile(g.home, g.profile);
 		return;
 	}
-	throw new CliError("not_found", `No profile ${g.profile}: make it with \`ghostly profile create ${g.profile}\``);
+	throw noProfile(g);
+}
+function noProfile(g) {
+	return new CliError("not_found", `No profile ${g.profile}: make it with \`ghostly profile create ${g.profile}\``);
+}
+/** For a command that only reads: a mistyped profile is named as one, and `default` is not made by asking about it. */
+function knownProfile(g) {
+	if (g.profile !== "default" && !profileExists(g.home, g.profile)) throw noProfile(g);
 }
 /** Said on stderr when the daemon runs another release than this command (it started before an upgrade). */
 function versionWarning(daemon, cli) {
@@ -19508,7 +20549,10 @@ var SPECIAL = [
 		{
 			out: o("string", "The backup file to write"),
 			"passphrase-file": o("string", "The passphrase, from this file (else GHOSTLY_BACKUP_PASSPHRASE)"),
-			passphrase: o("boolean", "--no-passphrase: do not encrypt. The file then holds the profile's keys and wallet secrets in the clear"),
+			passphrase: {
+				...o("boolean", "Do not encrypt. The file then holds the profile's keys and wallet secrets in the clear"),
+				negatedOnly: true
+			},
 			light: o("boolean", "Leave out files over 1 MB (voice messages over 4 MB); their messages stay")
 		}
 	],
@@ -19579,7 +20623,8 @@ var SPECIAL = [
 			days: o("number", "How long the proof holds"),
 			timeout: o("number", "Seconds to wait for an approval")
 		}
-	]
+	],
+	["version", "This CLI's version (also ghostly --version)"]
 ];
 function help() {
 	const rows = [
@@ -19645,7 +20690,9 @@ function commandHelp(words) {
 		const options = Object.entries(row.options ?? {}).filter(([, o]) => o.description);
 		if (options.length) {
 			lines.push("", "Options:");
-			for (const [name, o] of options) lines.push(`  --${name}${o.type === "boolean" ? "" : ` <${o.type === "number" ? "n" : "value"}>`}`.padEnd(26) + o.description);
+			const labels = options.map(([name, o]) => `  --${o.negatedOnly ? "no-" : ""}${name}${o.type === "boolean" ? "" : ` <${o.type === "number" ? "n" : "value"}>`}`);
+			const width = Math.max(26, ...labels.map((label) => label.length + 2));
+			options.forEach(([, o], i) => lines.push(labels[i].padEnd(width) + o.description));
 		}
 		if (Object.values(TEXT_COMMANDS).includes(row)) lines.push("", "  -- ends the options: everything after it is the text, options included (\"-- -1 --wait sent\" sends", "  all of it). Put options before --.");
 		lines.push("");
@@ -19733,6 +20780,7 @@ async function profileCommand(sub, argv) {
 			return;
 		}
 		case "list": {
+			noMoreThan(0, parsed.positionals, "profile list");
 			const current = currentProfile(g.home);
 			print({
 				profiles: listProfiles(g.home).map((name) => ({
@@ -19747,14 +20795,17 @@ async function profileCommand(sub, argv) {
 		case "use": {
 			const [name] = parsed.positionals;
 			if (!name) throw new CliError("usage", "ghostly profile use <name>");
+			noMoreThan(1, parsed.positionals, "profile use <name>");
 			selectProfile(g.home, name);
 			print({ current: name });
 			return;
 		}
 		case "show":
+			noMoreThan(0, parsed.positionals, "profile show");
 			print(await withSession(g, (s) => s.call("profile.get")));
 			return;
 		case "set": {
+			noMoreThan(0, parsed.positionals, "profile set [--name <name>] [--share-profile | --no-share-profile]");
 			const params = {};
 			if (parsed.options.name !== void 0) params.name = parsed.options.name;
 			if (parsed.options["share-profile"] !== void 0) params.shareProfile = parsed.options["share-profile"];
@@ -19763,6 +20814,7 @@ async function profileCommand(sub, argv) {
 			return;
 		}
 		case "backup": {
+			noMoreThan(0, parsed.positionals, "profile backup --out <file> [--passphrase-file f | --no-passphrase] [--light]");
 			const out = parsed.options.out;
 			if (typeof out !== "string") throw new CliError("usage", "ghostly profile backup --out <file> [--passphrase-file f | --no-passphrase] [--light] (or GHOSTLY_BACKUP_PASSPHRASE)");
 			const unsealed = parsed.options.passphrase === false;
@@ -19785,6 +20837,7 @@ async function profileCommand(sub, argv) {
 		case "restore": {
 			const [file, name] = parsed.positionals;
 			if (!file || !name) throw new CliError("usage", "ghostly profile restore <file> <new profile> [--passphrase-file f] [--use]");
+			noMoreThan(2, parsed.positionals, "profile restore <file> <new profile> [--passphrase-file f] [--use]");
 			const protection = await backupFileProtection(file);
 			const paths = await restoreProfile(g.home, checkProfileName(name), file, protection === "none" ? void 0 : backupPassphrase(parsed.options["passphrase-file"]));
 			if (parsed.options.use) selectProfile(g.home, name);
@@ -19872,7 +20925,13 @@ async function daemonCommand(argv) {
 	});
 	const g = globals(parsed);
 	pretty = g.pretty;
+	if (!sub || [
+		"status",
+		"stop",
+		"restart"
+	].includes(sub)) noMoreThan(0, parsed.positionals, sub ? `daemon ${sub}` : "daemon [--detach]");
 	if (sub === "status") {
+		knownProfile(g);
 		const client = await connectDaemon(g.paths.socket);
 		if (!client) {
 			print({
@@ -19894,6 +20953,7 @@ async function daemonCommand(argv) {
 		return;
 	}
 	if (sub === "stop") {
+		knownProfile(g);
 		const client = await connectDaemon(g.paths.socket);
 		if (!client) throw new CliError("not_found", `No daemon runs profile ${g.profile}`);
 		print({
@@ -20143,6 +21203,7 @@ async function engineCommand(argv) {
 	const g = globals(parsed);
 	pretty = g.pretty;
 	if (parsed.options.list) {
+		noMoreThan(0, parsed.positionals, "engine --list");
 		print({ methods: [...ENGINE_METHODS, ...ENGINE_READS].sort() });
 		return;
 	}
@@ -20186,6 +21247,7 @@ async function settingsCommand(sub, argv) {
 	const g = globals(parsed);
 	pretty = g.pretty;
 	if (sub === "get") {
+		noMoreThan(0, parsed.positionals, "settings get [--show-secret]");
 		print(await withSession(g, (s) => s.call("settings.get", { showSecret: parsed.options["show-secret"] === true })));
 		return;
 	}
@@ -20198,6 +21260,7 @@ async function settingsCommand(sub, argv) {
 		} catch {
 			parsedValue = value;
 		}
+		if (SETTABLE[key] === "string" && typeof parsedValue !== "string") parsedValue = value;
 		print(await withSession(g, (s) => s.call("settings.set", { [key]: parsedValue })));
 		return;
 	}
@@ -20358,7 +21421,7 @@ async function tableCommand(name, argv) {
 * contact's, raw PCM); what the command says goes to stderr. It ends when the call does.
 */
 async function callPipeCommand(argv) {
-	const parsed = parseArgs(argv, {}, idSlot({ args: ["call..."] }));
+	const parsed = parseArgs(argv, {}, idSlot({ args: ["call...?"] }));
 	const g = globals(parsed);
 	const ref = parsed.positionals.join(" ") || void 0;
 	const client = await connectDaemon(g.paths.socket);
@@ -20400,7 +21463,7 @@ function helpAsked(argv) {
 }
 async function main(input) {
 	const argv = liftGlobals(input);
-	const helpFor = argv.length === 0 ? [] : helpAsked(argv);
+	const helpFor = argv.length === 0 || globalOption(argv[0]) ? [] : helpAsked(argv);
 	if (helpFor) {
 		process.stdout.write((helpFor.length ? commandHelp(helpFor) : help()) + "\n");
 		return 0;
@@ -20411,7 +21474,8 @@ async function main(input) {
 	}
 	const [first, second] = argv;
 	const two = second && !second.startsWith("-") ? `${first} ${second}` : "";
-	if (first === "profile" && !COMMANDS[two]) {
+	const text = (name) => Object.hasOwn(TEXT_COMMANDS, name), table = (name) => Object.hasOwn(COMMANDS, name);
+	if (first === "profile" && !table(two)) {
 		await profileCommand(second, argv.slice(2));
 		return 0;
 	}
@@ -20439,19 +21503,19 @@ async function main(input) {
 		await callPipeCommand(argv.slice(2));
 		return -1;
 	}
-	if (two && TEXT_COMMANDS[two]) {
+	if (two && text(two)) {
 		await textCommand(two, argv.slice(2));
 		return 0;
 	}
-	if (two && COMMANDS[two]) {
+	if (two && table(two)) {
 		await tableCommand(two, argv.slice(2));
 		return 0;
 	}
-	if (TEXT_COMMANDS[first]) {
+	if (text(first)) {
 		await textCommand(first, argv.slice(1));
 		return 0;
 	}
-	if (COMMANDS[first]) {
+	if (table(first)) {
 		await tableCommand(first, argv.slice(1));
 		return 0;
 	}