@ghostlytools/cli 1.2.0 → 1.2.2

package/dist/assets/{server-BGXmSYx_.js → server-Cy4ox7oD.js}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { $a as readAppRevocations, $i as parseImageMeta, $n as engineError, $o as handoffContextProof, $r as pinNumberHolds, $s as HANDOFF_CAPABILITY, $t as PaymentPreflightError, A as decodeGroupEntryLink, Aa as pairedReplyAuthor, Ac as withRequestOptions, Ai as IDENTITY_REVOCATION_LABEL, Ar as mergeBeacon, B as groupWakes, Ba as statusCardText, Bc as publicKeyFromZ32, Bi as lastSharedWithMe, Bo as HANDOFF_OFFER, Br as FILE_LIMITS, Bs as readEnrollHello, C as COMMUNITY_LIMITS, Ca as nextReactionNumber, Cc as RelayTransport, Ci as readManifest, Co as RTC_CONFIG, Cr as COMMUNITY_TOPOLOGY, Cs as readSetUpdate, D as decodeCommunityLink, Da as readReaction, Dc as traceLink, Di as dialDescriptors, Dr as freshHubs, Ds as verifySetUpdate, E as communityHasFrame, Ea as reactionIsNewer, Ei as capsDescriptors, Er as doorHubs, Es as signTombstone, F as mergeKnocks, Fi as identityRevocationValue, Fo as HANDOFF_ACK, Fr as readBeacon, Fs as enrollDoneFrame, Ga as shownTime, Gc as fromBase64Url, Gi as automaticTransport, Gn as findEndpoint, Go as HANDOFF_VERIFIED, Gr as TypingSender, Gs as OwnInviteError, Gt as didDhtFromPublicKey, Ha as claimedTime, Hi as emptyProofLedger, Hn as ENDPOINT, Ho as HANDOFF_PIECE_BYTES, Hr as transferStalled, Hs as createDeviceInvite, I as readKnocks, Ia as STATUS_CARD_LIMITS, Ii as identityStatement, Io as HANDOFF_CANCEL, Ir as readBeaconHead, Is as enrollGrantFrame, J as carryMentions, Ja as appFingerprint, Jc as toZ32, Jn as parseFedimintRequestPayload, Jo as handoffAttemptFailed, Js as encodeInviteCode, Kc as randomBytes, Kn as isFederationId, Ko as filePartName, Ks as createChatInvite, Kt as encodeDidDhtDeactivated, Lc as createIdentity, Li as newIdentityBinding, Lo as HANDOFF_DONE, Lr as readLobby, Ls as enrollHelloFrame, M as entryParams, Ma as replySnippet, Mi as IdentityExchange, Mo as HTTP_SERVICE_PROTO, Mr as newerHead, Ms as enrollCancelFrame, N as knockIdentity, Na as BUTTON_ID, Nc as createRelayPayload, No as LEGACY_SERVICES, Nr as pickHubs, Ns as enrollCancelReason, O as encodeCommunityLink, Oa as validReactionNumber, Oc as budgetRetryMs, Or as lobbyKeys, P as knockRecords, Pi as emptyIdentityLedger, Po as serviceIdFromName, Pr as rankHubs, Ps as enrollDigits, Qa as isAppRef, Qi as dhtFileId, Qn as pairedMessageFrame, Qo as handoffContext, Qr as pinIsNewer, Qs as ENROLL_CAPABILITY, Qt as ONCHAIN_PROVIDER, R as GroupWakeLimiter, Ra as checkStatusCard, Rc as identityFromSeed, Ri as receivedIdentityStatus, Ro as HANDOFF_HAVE, Rr as shouldBeHub, Rs as enrollProofFrame, S as sealGroupTyping, Sa as ReactionWindow, Sc as DEFAULT_RELAYS, Si as newMailbox, Sr as pickMeshHubs, T as GROUP_READ_NOTE_COMMUNITY, Ta as reactionEmoji, Tc as normalizeRelayUrl, Ti as DHT_TEXT_CAPABILITY, Tr as beaconRecords, Ts as setUpdateFrame, U as GROUP_READ_NOTE, Ua as heardTime, Uc as sanitizeAvatar, Ui as validExternalKey, Un as cashuRequestPayload, Uo as HANDOFF_REQUEST, Us as deviceInviteJoinerParams, V as parseGroupWakeFrame, Va as arrivalKey, Vc as verify, Vi as PeerProofs, Vn as decodeBolt11, Vo as HANDOFF_PAKE, Vr as transferEnded, Vs as verifyEnrollProof, W as GroupSession, Wa as receivedTimestamp, Wc as bytesEqual, Wi as TRANSPORTS, Wn as fedimintRequestPayload, Wo as HANDOFF_TIMINGS, Ws as readDeviceInvite, Wt as didDhtDocument, X as mentionsMember, Xc as utf8Encode, Xi as peekDhtMailbox, Xn as INVITE_TAKEN, Xo as handoffBusyFrame, Xr as mayPin, Xs as inviteOwnership, Xt as ETHEREUM_USDT, Y as parseCommunityEdit, Ya as appRef, Yc as utf8Decode, Yi as DHT_MESSAGE_TTL, Yn as GhostLink, Yo as handoffAttemptSucceeded, Yr as PIN_LIMITS, Yt as signDidDhtPacket, Z as groupName, Za as isAppKey, Zi as DHT_FILE_CAPABILITY, Zn as LIVENESS_PING_MS, Zo as handoffCancelFrame, Zr as nextPinNumber, Zs as DEVICES_CAPABILITY, Zt as EVM_TEST_CHAINS, _ as readAppBundle, _a as forwardedAgain, _c as readTurnPacket, _i as HOLD_CAPABILITY, _o as parseLocalTarget, _r as groupSignalFrame, _s as readHandoffPake, _t as isAtprotoDid, a as planAppUpdate, ac as newDeviceSetSecret, ai as parseWakeFrame, an as assertTokenUnits, as as handoffOfferFrame, b as groupTypingEpoch, ba as GROUP_REACTION_FRAME, bc as turnKeys, bi as HoldKeys, bo as decodeControl, br as mayBeHub, bs as sealHandoffPiece, ca as fileMessageText, ci as checkPushEndpoint, cn as validatePaymentTarget, co as verifyCommitSignature, cr as readGroupFileMeta, cs as handoffRetryAfter, da as parseVideoMeta, dc as classifyTurnRead, di as isAppVersion, dn as SPARK_PROVIDER, do as DHT_POLL_INTERVALS, ds as newHandoffId, ec as deviceEchoFrame, ei as readPin, en as SEPOLIA_TEST_USDT, er as engineText, es as handoffDataFrame, f as appDigest, fa as EDIT_BUFFER_MS, fc as turnPutSummary, fi as APPS_CAPABILITY, fn as sparkAddressKind, fr as CarriedTransport, fs as readHandoffAck, g as isAppUrl, ga as parseLinkPreview, gc as nextTurnPosition, gi as UPGRADE_CAPABILITY, gn as isPubkyKey, go as formatLocalTarget, gs as readHandoffHello, ha as dhtEditId, hc as firstDeviceSetSecret, hi as STATUS_CARD_CAPABILITY, ho as GhostlyHttpError, hs as readHandoffHave, i as checkAppBeforeRun, ia as sanitizeMime, ic as devicePingFrame, ii as newWakeToken, in as WALLET_NETWORKS, io as GROUP_MEMBER_CAP, is as handoffManifestFrames, j as encodeGroupEntryLink, ja as readReply, jc as PacketTooLargeError, jo as emptyLinkRecords, jr as mergeLobby, ka as wireReaction, kc as isDiscoveryBudgetError, ko as parseCallSignal, kr as lobbyRecords, l as APP_BUNDLE_LIMITS, la as parseVoiceMeta, lc as TURN_RAISE_READ_TIMEOUT_MS, li as vapidKeysMatch, ln as walletNetworkOf, lo as edgeParams, ls as handoffStreamKey, ma as RateWindow, mc as TURN_MAX, mi as EDIT_CAPABILITY, mn as isBitcoinAddress, mo as presenceSeenAt, ms as readHandoffDone, n as appStoreDecision, na as safeBlobType, nc as deviceKeyZ32, ni as WakeLimiter, nn as TEST_USDT_FAUCET_AMOUNT, no as canonicalJson, ns as handoffEphemeral, oc as seedSigner, oi as relayRequest, on as assertWholeSats, oo as MEMBER_KEY, or as groupFileFallback, os as handoffPakeFrame, p as appViewOf, pa as EDIT_RATE_WINDOW_MS, pc as TURN_LAST_SEQUENCE, pi as BUTTONS_CAPABILITY, pn as sparkInvoiceDetails, po as RELAY_POLL_INTERVALS, ps as readHandoffCancel, q as GROUP_EDIT_TEXT_BYTES, qc as toBase64Url, qn as parseCashuRequestPayload, qo as handoffAttemptAllowed, qr as typingActivity, qs as decodeInviteCode, qt as encodeDidDhtPacket, r as appUpdateDecision, ra as sanitizeFileName, rc as deviceLinkPairing, ri as deviceWakeRequest, rn as USDT_PUBLIC_RPC, rs as handoffHelloFrame, s as readAppStore, sc as webCryptoSigner, si as wakeRequest, sn as formatPaymentAmount, so as rosterHas, ss as handoffReleaseFrame, t as appRevocationFor, ta as formatFileSize, tc as deviceEchoNonce, ti as WAKE_CALL_INTERVAL_MS, tr as GROUP_FILE_LIMITS, ts as handoffDigest, u as APP_BUNDLE_MAGIC, uc as TURN_SETTLE_MS, ui as chatAppId, un as SPARK_NETWORKS, uo as DirectPathWatch, us as handoffVersions, va as readForwarded, vc as signTurnPacket, vi as HOLD_DATED_BACK_MS, vo as webLocalFetch, vr as readGroupSignal, vs as readHandoffTurnFrame, vt as normalizeAtprotoHandle, w as CommunitySession, wa as queueReaction, wc as currentRelays, wi as CapsExchange, wr as beaconKeys, ws as setAckFrame, x as openGroupTyping, xa as REACTION_LIMITS, xc as turnName, xi as HoldRefusedError, xo as encodeControl, xr as meshHubs, y as GroupTypingBoard, ya as COMMUNITY_REACTION_FRAME, yc as signTurnRelease, yi as HOLD_LIMITS, yo as LIMITS, yr as MESH_HUBS, ys as readHandoffVerified, z as groupWakeFrame, za as sameButtonText, zc as identityFromSeedB64, zi as revokesIdentity, zo as HANDOFF_HELLO, zr as ChatFiles, zs as readEnrollGrant } from "./src-BMUcYQ7b.js";
+import { $ as groupName, $c as sanitizeAvatar, $i as peekDhtMailbox, $o as HANDOFF_REQUEST, $r as isAppVersion, $s as deviceInviteJoinerParams, $t as EVM_TEST_CHAINS, A as encodeCommunityLink, Aa as readReaction, Ac as turnKeys, Ai as dialDescriptors, An as ENDPOINT, Ao as decodeControl, Ar as transferStalled, As as sealHandoffPiece, B as GroupWakeLimiter, Bc as withRequestOptions, Bi as newIdentityBinding, Bn as pairedMessageFrame, Br as pinIsNewer, C as openGroupTyping, Ca as GROUP_REACTION_FRAME, Cc as TURN_LAST_SEQUENCE, Co as RELAY_POLL_INTERVALS, Cr as readBeacon, Cs as readHandoffCancel, D as GROUP_READ_NOTE_COMMUNITY, Da as queueReaction, Dc as readTurnPacket, Di as CapsExchange, Do as parseLocalTarget, Dr as ChatFiles, Ds as readHandoffPake, E as CommunitySession, Ea as nextReactionNumber, Ec as nextTurnPosition, Eo as formatLocalTarget, Er as shouldBeHub, Es as readHandoffHello, F as knockIdentity, Fa as replySnippet, Fc as normalizeRelayUrl, Fi as IdentityExchange, Fn as parseCashuRequestPayload, Fr as typingActivity, Fs as setUpdateFrame, G as GROUP_READ_NOTE, Ga as checkStatusCard, Gi as emptyProofLedger, Go as HANDOFF_ACK, Gr as deviceWakeRequest, Gs as enrollDoneFrame, H as groupWakes, Hi as revokesIdentity, Hn as engineText, Ho as HTTP_SERVICE_PROTO, Hr as readPin, Hs as enrollCancelFrame, I as knockRecords, Ia as BUTTON_ID, In as parseFedimintRequestPayload, Is as signTombstone, Ja as arrivalKey, Jc as identityFromSeed, Ji as automaticTransport, Jn as groupFileFallback, Jo as HANDOFF_HAVE, Jr as relayRequest, Js as enrollProofFrame, Jt as encodeDidDhtDeactivated, K as GroupSession, Ka as sameButtonText, Ki as validExternalKey, Ko as HANDOFF_CANCEL, Kr as newWakeToken, Ks as enrollGrantFrame, Kt as didDhtDocument, L as mergeKnocks, Lc as traceLink, Li as emptyIdentityLedger, Ln as GhostLink, Lr as PIN_LIMITS, Ls as verifySetUpdate, M as decodeGroupEntryLink, Ma as wireReaction, Mc as DEFAULT_RELAYS, Mn as fedimintRequestPayload, N as encodeGroupEntryLink, Na as pairedReplyAuthor, Nc as RelayTransport, Ni as IDENTITY_REVOCATION_LABEL, Nn as findEndpoint, No as RTC_CONFIG, Nr as TypingSender, Ns as readSetUpdate, O as communityHasFrame, Oa as reactionEmoji, Oc as signTurnPacket, Oi as DHT_TEXT_CAPABILITY, Oo as webLocalFetch, Or as FILE_LIMITS, Os as readHandoffTurnFrame, P as entryParams, Pa as readReply, Pc as currentRelays, Pn as isFederationId, Ps as setAckFrame, Q as mentionsMember, Qa as shownTime, Qi as DHT_MESSAGE_TTL, Qo as HANDOFF_PIECE_BYTES, Qr as chatAppId, Qs as createDeviceInvite, Qt as ETHEREUM_USDT, R as readKnocks, Rc as budgetRetryMs, Ri as identityRevocationValue, Rn as INVITE_TAKEN, Rr as mayPin, S as groupTypingEpoch, Sa as COMMUNITY_REACTION_FRAME, Sc as turnPutSummary, Sr as rankHubs, Ss as readHandoffAck, T as COMMUNITY_LIMITS, Ta as ReactionWindow, Tc as firstDeviceSetSecret, To as GhostlyHttpError, Tr as readLobby, Ts as readHandoffHave, U as parseGroupWakeFrame, Uc as createRelayPayload, Ui as lastSharedWithMe, Un as GROUP_FILE_LIMITS, Uo as LEGACY_SERVICES, Ur as WAKE_CALL_INTERVAL_MS, Us as enrollCancelReason, V as groupWakeFrame, Va as STATUS_CARD_LIMITS, Vc as PacketTooLargeError, Vi as receivedIdentityStatus, Vn as engineError, Vo as emptyLinkRecords, Vr as pinNumberHolds, Wi as PeerProofs, Wo as serviceIdFromName, Wr as WakeLimiter, Ws as enrollDigits, X as carryMentions, Xa as heardTime, Xc as publicKeyFromZ32, Xn as readGroupFileMeta, Xo as HANDOFF_OFFER, Xr as checkPushEndpoint, Xs as readEnrollHello, Y as GROUP_EDIT_TEXT_BYTES, Ya as claimedTime, Yc as identityFromSeedB64, Yo as HANDOFF_HELLO, Yr as wakeRequest, Ys as readEnrollGrant, Yt as encodeDidDhtPacket, Z as parseCommunityEdit, Za as receivedTimestamp, Zc as verify, Zo as HANDOFF_PAKE, Zr as vapidKeysMatch, Zs as verifyEnrollProof, Zt as signDidDhtPacket, _a as RateWindow, _c as webCryptoSigner, _o as rosterHas, _r as lobbyRecords, _s as handoffReleaseFrame, a as planAppUpdate, aa as safeBlobType, ai as HOLD_CAPABILITY, al as utf8Decode, an as USDT_PUBLIC_RPC, ao as isAppRef, ar as groupSignalFrame, as as handoffAttemptSucceeded, ba as forwardedAgain, bc as TURN_SETTLE_MS, bo as DirectPathWatch, br as newerHead, bs as handoffVersions, bt as normalizeAtprotoHandle, cc as ENROLL_CAPABILITY, ci as HoldKeys, cn as assertWholeSats, cr as mayBeHub, cs as handoffContext, d as APP_BUNDLE_LIMITS, da as fileMessageText, dc as deviceEchoNonce, di as newMailbox, dn as walletNetworkOf, dr as COMMUNITY_TOPOLOGY, ds as handoffDigest, ea as DHT_FILE_CAPABILITY, ec as readDeviceInvite, ei as APPS_CAPABILITY, el as bytesEqual, en as ONCHAIN_PROVIDER, eo as APP_STATEMENT_LIMITS, er as CarriedTransport, es as HANDOFF_TIMINGS, f as APP_BUNDLE_MAGIC, fa as parseVoiceMeta, fc as deviceKeyZ32, fi as readManifest, fn as SPARK_NETWORKS, fo as readCanonicalJson, fr as beaconKeys, fs as handoffEphemeral, ga as EDIT_RATE_WINDOW_MS, gc as seedSigner, gn as isBitcoinAddress, go as commitHash, gr as lobbyKeys, gs as handoffPakeFrame, h as appViewOf, ha as EDIT_BUFFER_MS, hc as newDeviceSetSecret, hn as sparkInvoiceDetails, ho as MEMBER_KEY, hr as freshHubs, hs as handoffOfferFrame, i as checkAppBeforeRun, ia as formatFileSize, ic as encodeInviteCode, ii as UPGRADE_CAPABILITY, il as toZ32, in as TEST_USDT_FAUCET_AMOUNT, io as isAppKey, is as handoffAttemptFailed, ja as validReactionNumber, jc as turnName, jn as cashuRequestPayload, jo as encodeControl, k as decodeCommunityLink, ka as reactionIsNewer, kc as signTurnRelease, ki as capsDescriptors, kn as decodeBolt11, ko as LIMITS, kr as transferEnded, ks as readHandoffVerified, l as readAppStoreSteps, lc as HANDOFF_CAPABILITY, li as HoldRefusedError, ln as formatPaymentAmount, lr as meshHubs, ls as handoffContextProof, m as appDigest, ma as parseVideoMeta, mc as devicePingFrame, mn as sparkAddressKind, mr as doorHubs, ms as handoffManifestFrames, n as appStoreDecision, na as parseImageMeta, nc as createChatInvite, ni as EDIT_CAPABILITY, nl as randomBytes, nn as SEPOLIA_TEST_USDT, no as appRef, ns as filePartName, o as APP_STORE_LIMITS, oa as sanitizeFileName, oc as inviteOwnership, oi as HOLD_DATED_BACK_MS, ol as utf8Encode, on as WALLET_NETWORKS, oo as readAppRevocation, or as readGroupSignal, os as handoffBusyFrame, pc as deviceLinkPairing, pn as SPARK_PROVIDER, po as GROUP_MEMBER_CAP, pr as beaconRecords, ps as handoffHelloFrame, qa as statusCardText, qc as createIdentity, qi as TRANSPORTS, qo as HANDOFF_DONE, qr as parseWakeFrame, qs as enrollHelloFrame, qt as didDhtFromPublicKey, r as appUpdateDecision, rc as decodeInviteCode, ri as STATUS_CARD_CAPABILITY, rl as toBase64Url, rs as handoffAttemptAllowed, sa as sanitizeMime, sc as DEVICES_CAPABILITY, si as HOLD_LIMITS, sn as assertTokenUnits, sr as MESH_HUBS, ss as handoffCancelFrame, t as appRevocationFor, ta as dhtFileId, tc as OwnInviteError, ti as BUTTONS_CAPABILITY, tl as fromBase64Url, tn as PaymentPreflightError, to as appFingerprint, ts as HANDOFF_VERIFIED, uc as deviceEchoFrame, ui as isHoldUrl, un as validatePaymentTarget, uo as canonicalJson, ur as pickMeshHubs, us as handoffDataFrame, v as isAppUrl, va as dhtEditId, vn as isPubkyKey, vo as verifyCommitSignature, vr as mergeBeacon, vs as handoffRetryAfter, w as sealGroupTyping, wa as REACTION_LIMITS, wc as TURN_MAX, wo as presenceSeenAt, wr as readBeaconHead, ws as readHandoffDone, x as GroupTypingBoard, xa as readForwarded, xc as classifyTurnRead, xo as DHT_POLL_INTERVALS, xr as pickHubs, xs as newHandoffId, y as readAppBundle, ya as parseLinkPreview, yc as TURN_RAISE_READ_TIMEOUT_MS, yo as edgeParams, yr as mergeLobby, ys as handoffStreamKey, yt as isAtprotoDid, zc as isDiscoveryBudgetError, zi as identityStatement, zn as LIVENESS_PING_MS, zo as parseCallSignal, zr as nextPinNumber } from "./src-XzcHzneo.js";
 import { a as clearProfileStores, c as fileStore, d as profileOpenFailure, f as store, i as STORES$1, l as newestWalletTx, m as wrap, n as APP_STORAGE_SCOPE_INDEX, o as databaseName, p as transact, r as CARD_INDEX, s as deleteDatabase, t as APP_STORAGE_CHAT_INDEX, u as openDb } from "./idb-CTF6LF5B.js";
 import { a as fileBytesOf, c as removeFileBytes, i as fileBytes, l as FILE_BYTES_STEP, n as blobDigest } from "./fileBytes-BcYZhNgF.js";
 import { $ as BACKUP_MEDIA_TYPE, A as requireTurn, At as paymentWireId, B as networkLabel, C as breezDatabasesFor, Ct as storedGroupFiles, D as sourceKey, Dt as replyRef, E as ProviderSources, Et as receivedPairedReply, F as sealSeed, Ft as streamStored, G as BITCOIN_INVOICE_ON_TESTNET, H as cashuMint, I as unsealSeed, J as fakesLightning, K as DEFAULT_MINTS, L as ModeChanged, M as setSingleWriterGate, Mt as readStored$1, N as intentRepository, Nt as removeStored, O as awayFrom, Ot as replyTo, P as newDeviceKey, Pt as storedSize, Q as paysItsOwnInvoices, R as ModeGate, S as breezDatabaseInUse, St as groupOfFile, T as lightningPaying, Tt as pairedWireReply, V as CASHU_MINT_SOURCE, W as WALLET_TYPES, X as isWorthlessMint, Y as isTestMint, Z as mintNetwork, _ as LightningCards, _t as verifyIdentity, a as irohRelayProblem, at as reserveAdapterIds, b as normalizePhrase, bt as groupFileId, c as createFailure, ct as SourceConfigError, d as paymentNetwork, dt as networkMode, et as MAX_BACKUP_BYTES, f as paymentNetworksOf, ft as redact, g as CASHU_CARD, gt as boundedIdentityFetch, ht as setOwnDidSource, i as createIrohWebEndpoint, it as registeredOnchainProviders, j as setAwayWallets, jt as FileAppender, k as refuseAway, kt as paymentAlias, l as createTiming, lt as SourceUnreachableError, mt as resolveAtprotoDid, n as loadFedimintSdk, nt as onAdaptersChanged, o as WALLET_NAMES, ot as NothingSpentError, p as walletInstances, pt as assertPublicServer, q as TEST_MINT, r as DEFAULT_IROH_RELAYS, rt as registeredLightningProviders, s as assertConfirmedReal, st as PROVIDER_PLATFORMS, t as fedimintDatabase, tt as identityProviders, u as crossNetwork, ut as isNothingSpentError, v as cardsKey, vt as chosenResolver, w as dropBreezDatabase, wt as groupReply, x as breezDatabase, xt as groupFileText, y as isRecoveryPhrase, yt as GroupFileDesk, z as WrongNetworkError } from "../ghostly.mjs";
@@ -180,7 +180,7 @@ async function migrateWalletNetworks(now = Date.now()) {
 //#endregion
 //#region ../browser/src/engine/paymentAdapters/usdtWallet.ts
 /** The Ethereum libraries, a large part of the app: loaded once a USDT wallet is made, opened or restored, not with the engine. */
-var loadUsdt = () => import("./usdt-DklGBSeq.js");
+var loadUsdt = () => import("./usdt-Deo3g0Nq.js");
 /** Every new profile starts with this wallet: an address to receive on, nothing to set up. */
 var DEFAULT_USDT = {
 	network: "ethereum",
@@ -642,7 +642,9 @@ async function restoreArkDatabase(walletId, snapshot) {
 //#endregion
 //#region ../browser/src/engine/paymentAdapters/arkWallet.ts
 /** The Ark SDK, a large part of the app: loaded once an Ark wallet is made, opened or restored, not with the engine. */
-var loadArkade = () => import("./arkade-3szZ1IpP.js");
+var loadArkade = () => import("./arkade-_gS9wShF.js");
+/** How long a Testnet wallet about to make way for another waits for its server to say what it holds. */
+var RETIRE_READ_MS = 1e4;
 /** Every new profile starts with this wallet: nothing to set up before receiving. */
 var DEFAULT_ARK = {
 	network: "bitcoin",
@@ -1048,10 +1050,23 @@ var ArkWallet = class {
 	async retirable(refusal) {
 		const saved = this.saved;
 		if ((await wrap((await store(STORES$1.intents, "readonly")).getAll())).some((i) => this.ours(i))) throw new Error(refusal);
-		if (this.adapter && await this.gate.within(this.adapter.balance()) > 0) throw new Error(refusal);
+		if (this.adapter && await this.gate.within(this.held(this.adapter)) > 0) throw new Error(refusal);
 		await this.lock();
 		return saved;
 	}
+	/**
+	* What the wallet holds, asked of its server. A test network's server that stopped answering must not hold the
+	* wallet on it (one that never answered does not either): past RETIRE_READ_MS the last balance read stands.
+	* Mainnet waits for its server's own word.
+	*/
+	held(adapter) {
+		const asked = adapter.balance();
+		if (this.network !== "testnet") return asked;
+		return new Promise((resolve, reject) => {
+			const timer = setTimeout(() => resolve(this.view.balance), RETIRE_READ_MS);
+			asked.then(resolve, reject).finally(() => clearTimeout(timer));
+		});
+	}
 	/** A payment of this wallet's network (the other network's wallet has its own). */
 	ours(intent) {
 		return intent.review.method === "arkade" && arkMode(intent.review.network) === this.network;
@@ -1876,13 +1891,24 @@ var BarkWallet = class {
 	async retirable(refusal) {
 		const saved = this.saved;
 		if ((await intentRepository.list()).some((i) => this.ours(i))) throw new Error(refusal);
-		if (this.adapter) {
-			const b = await this.gate.within(this.adapter.balance());
-			if (b.spendableSats + b.pendingInRoundSats + b.pendingBoardSats + b.pendingExitSats + b.pendingLightningSendSats + b.claimableLightningReceiveSats > 0) throw new Error(refusal);
-		}
+		if (this.adapter && await this.gate.within(this.held(this.adapter)) > 0) throw new Error(refusal);
 		await this.lock();
 		return saved;
 	}
+	/**
+	* What the wallet holds, asked of its server: spendable, on its way in and on its way out. A test network's server
+	* that stopped answering must not hold the wallet on it (one that never answered does not either): past
+	* RETIRE_READ_MS the last reading stands, whose three sums are those same six parts. Mainnet waits for its
+	* server's own word.
+	*/
+	held(adapter) {
+		const asked = adapter.balance().then((b) => b.spendableSats + b.pendingInRoundSats + b.pendingBoardSats + b.pendingExitSats + b.pendingLightningSendSats + b.claimableLightningReceiveSats);
+		if (this.network !== "testnet") return asked;
+		return new Promise((resolve, reject) => {
+			const timer = setTimeout(() => resolve(this.view.balance + (this.view.pending ?? 0) + (this.view.exiting ?? 0)), RETIRE_READ_MS);
+			asked.then(resolve, reject).finally(() => clearTimeout(timer));
+		});
+	}
 	/** A payment of this wallet's network (the other network's wallet has its own). */
 	ours(intent) {
 		return intent.review.method === "bark" && barkMode(intent.review.network) === this.network;
@@ -11143,6 +11169,15 @@ var APP_CHECK_TIMINGS = {
 	/** A check at start is skipped when every app was checked this recently (a page reloaded several times). */
 	freshMs: 36e5
 };
+/** Revocations are checked this long at a time before the page's thread is let go. */
+var REVOCATIONS_SLICE_MS = 10;
+/**
+* Revocations of store indexes whose signature was checked, kept by `appRevocationId` so an index that changes around
+* them does not have each checked again (the one read longest ago dropped first): four indexes' worth, about 1 MiB.
+*/
+var STORE_REVOCATIONS_KEPT = 4 * APP_STORE_LIMITS.revoked;
+/** `ghostly-revoke.json` files whose result is kept, so an unchanged one is not checked again (the oldest dropped first). */
+var REVOCATION_FILES_KEPT = 64;
 /** A fetched bundle kept for its install screen: at most this many, for this long. */
 var STAGED = {
 	max: 4,
@@ -11227,7 +11262,7 @@ var Apps = class {
 	/** Reads of a bundle under way, by digest: icons drawn at once share one read. */
 	verifying = /* @__PURE__ */ new Map();
 	/**
-	* The `icon.png` of each checked bundle, by digest (at most 256 KiB, or null for none): every icon shown on the Apps
+	* The `icon.png` of each checked bundle, by digest (at most 256 KiB and 1024 × 1024 pixels, or null for none): every icon shown on the Apps
 	* page, in a chat's cards and in the composer's Apps is read without the whole bundle again.
 	*/
 	icons = /* @__PURE__ */ new Map();
@@ -11240,12 +11275,36 @@ var Apps = class {
 	checking = null;
 	/** Runs the person started with Run anyway (`<ref> <digest>`), for this engine's life: a removal does not cut them off. */
 	anyway = /* @__PURE__ */ new Set();
+	/** The apps started here (`entry`), for this engine's life: one of them uninstalled since may still have a frame open. */
+	ran = /* @__PURE__ */ new Set();
+	/**
+	* The versions started here (`entry`), by reference: digest to `sequence`, for this engine's life. A frame goes on
+	* running the version it started with whatever is installed since, so that version is the one judged when it asks.
+	*/
+	started = /* @__PURE__ */ new Map();
 	views = null;
+	held = /* @__PURE__ */ new Map();
+	heldStores = null;
 	/**
 	* Listing URLs whose peek showed nothing to take (`<store> <ref> <url>` → `<index digest> <listed digest>`): the same
 	* index listing the same is not peeked again at every check.
 	*/
 	listingMisses = /* @__PURE__ */ new Map();
+	/** `ghostly-revoke.json` files checked, by the SHA-256 of their bytes: their revocations, or null when refused. */
+	revocationFiles = /* @__PURE__ */ new Map();
+	/** Revocations read in a store's index and verified, by `appRevocationId`: at most `STORE_REVOCATIONS_KEPT`. */
+	storeRevocations = /* @__PURE__ */ new Set();
+	checkedRevocations = {
+		has: (id) => {
+			if (!this.storeRevocations.delete(id)) return false;
+			this.storeRevocations.add(id);
+			return true;
+		},
+		add: (id) => {
+			this.storeRevocations.add(id);
+			if (this.storeRevocations.size > STORE_REVOCATIONS_KEPT) this.storeRevocations.delete(this.storeRevocations.values().next().value);
+		}
+	};
 	stopped = false;
 	constructor(host) {
 		this.host = host;
@@ -11269,6 +11328,9 @@ var Apps = class {
 		if (this.sweep) clearTimeout(this.sweep);
 		this.sweep = null;
 		this.staged.clear();
+		this.held.clear();
+		this.heldStores = null;
+		this.views = null;
 	}
 	schedule(ms, atStart = false) {
 		if (this.timer) clearTimeout(this.timer);
@@ -11300,8 +11362,22 @@ var Apps = class {
 	async installed() {
 		return wrap((await store(STORES$1.apps, "readonly")).getAll());
 	}
-	async app(ref) {
-		return wrap((await store(STORES$1.apps, "readonly")).get(ref));
+	/**
+	* An installed app's record, read once and again after it is written here (the only writer, as for `heldViews`). An
+	* app's every storage call, file read and chat frame asks for it. A reference not installed is not kept.
+	*/
+	app(ref) {
+		const kept = this.held.get(ref);
+		if (kept) return kept;
+		const read = store(STORES$1.apps, "readonly").then((s) => wrap(s.get(ref)));
+		this.held.set(ref, read);
+		const drop = () => {
+			if (this.held.get(ref) === read) this.held.delete(ref);
+		};
+		read.then((app) => {
+			if (!app) drop();
+		}, drop);
+		return read;
 	}
 	async installedOrFail(ref) {
 		if (!isAppRef(ref)) fail("bad-ref", "Not an app reference");
@@ -11312,25 +11388,55 @@ var Apps = class {
 	* a store of the person's removed (unless this run was started with Run anyway), is cut off with `stopped`, whether
 	* or not the page stops its frame.
 	*/
-	async stillRunnable(app) {
-		const run = this.runStatus(app, await this.heldViews(), app.revocations);
+	async stillRunnable(app, digest) {
+		const version = this.versionRunning(app, digest);
+		const run = this.runStatus(version, await this.heldViews(), app.revocations);
 		if (run.status === "revoked") fail("stopped", "Its publisher revoked this version");
-		if (run.status === "removed" && !this.anyway.has(`${app.ref} ${app.digest}`)) fail("stopped", `Removed by ${run.by[0].name}: ${run.by[0].reason}`);
+		if (run.status === "removed" && !this.anyway.has(`${version.ref} ${version.digest}`)) fail("stopped", `Removed by ${run.by[0].name}: ${run.by[0].reason}`);
 		return app;
 	}
-	async runningOrFail(ref) {
-		return this.stillRunnable(await this.installedOrFail(ref));
+	/**
+	* The version a frame runs: the one it names by `digest` (what `entry` gave it), which an update installed since does
+	* not change. None named: the installed one. One never started here does not run.
+	*/
+	versionRunning(app, digest) {
+		if (digest === void 0 || digest === app.digest) return app;
+		const sequence = typeof digest === "string" ? this.started.get(app.ref)?.get(digest) : void 0;
+		if (sequence === void 0) fail("stopped", "This version is not running");
+		return {
+			ref: app.ref,
+			sequence,
+			digest
+		};
+	}
+	/** The versions started here that are not the installed one any more. */
+	startedBefore(app) {
+		return [...this.started.get(app.ref) ?? []].filter(([digest]) => digest !== app.digest).map(([digest, sequence]) => ({
+			ref: app.ref,
+			sequence,
+			digest
+		}));
+	}
+	async runningOrFail(ref, digest) {
+		return this.stillRunnable(await this.installedOrFail(ref), digest);
 	}
 	/**
 	* Before an app's frames go to a contact (`appOpen`, `appSend`): refused with `stopped` as its storage is. A reference
-	* not installed here (a bot that speaks an app's messages) is not this store's to refuse.
+	* not installed here (a bot that speaks an app's messages) is not this store's to refuse, unless it ran here and was
+	* uninstalled since: the person removed it, so a frame of it still open says nothing more (`not-installed`). `digest`:
+	* the version the frame runs (`versionRunning`).
 	*/
-	async chatRunnable({ ref }) {
+	async chatRunnable({ ref, digest }) {
 		const app = isAppRef(ref) ? await this.app(ref) : void 0;
-		if (app) await this.stillRunnable(app);
+		if (!app && this.ran.has(ref)) fail("not-installed", "This app is not installed");
+		if (app) await this.stillRunnable(app, digest);
 	}
 	async putApp(app) {
-		await wrap((await store(STORES$1.apps, "readwrite")).put(app));
+		try {
+			await wrap((await store(STORES$1.apps, "readwrite")).put(app));
+		} finally {
+			this.held.delete(app.ref);
+		}
 	}
 	/**
 	* Writes an app's record back only while that install is still there (the same `installedAt`), read and written in
@@ -11345,33 +11451,58 @@ var Apps = class {
 			tx.objectStore(STORES$1.apps).put(app);
 			put = true;
 		};
-		await done(tx);
+		try {
+			await done(tx);
+		} finally {
+			this.held.delete(app.ref);
+		}
 		return put;
 	}
+	/**
+	* The stores' records by key, read once and kept in step by the writes here (the only writer: pages in other tabs
+	* share this engine). A record holds its store's whole index, up to 4 MiB, and IndexedDB reads and writes it whole:
+	* the Apps page, the update check and an app's every storage call and chat frame ask for them.
+	*/
+	records() {
+		return this.heldStores ??= store(STORES$1.appStores, "readonly").then((s) => wrap(s.getAll())).then((all) => new Map(all.map((r) => [r.key, r])), (error) => {
+			this.heldStores = null;
+			throw error;
+		});
+	}
 	async storeRecord(key) {
-		return wrap((await store(STORES$1.appStores, "readonly")).get(key));
+		return (await this.records()).get(key);
+	}
+	/** A write of the stores' records: what is asked while it runs waits for it, as a read of IndexedDB would; one that fails leaves what was held. */
+	async writeStores(write, apply) {
+		const before = this.records();
+		const written = before.then(async (held) => {
+			await wrap(write(await store(STORES$1.appStores, "readwrite")));
+			apply(held);
+			this.views = null;
+		});
+		const after = written.then(() => before, () => before);
+		this.heldStores = after;
+		after.catch(() => {
+			if (this.heldStores === after) this.heldStores = null;
+		});
+		await written;
 	}
-	async putStore(record) {
-		await wrap((await store(STORES$1.appStores, "readwrite")).put(record));
-		this.views = null;
+	putStore(record) {
+		return this.writeStores((records) => records.put(record), (held) => held.set(record.key, record));
 	}
-	async deleteStore(key) {
-		await wrap((await store(STORES$1.appStores, "readwrite")).delete(key));
-		this.views = null;
+	deleteStore(key) {
+		return this.writeStores((records) => records.delete(key), (held) => held.delete(key));
 	}
-	/**
-	* The stores' views, read once and again after a store is written here (the only writer: pages in other tabs share
-	* this engine). An app's every storage call and chat frame checks them, and an index may be 4 MiB.
-	*/
+	/** The stores' views, made once and again after a store is written here: an app's every storage call and chat frame checks them. */
 	heldViews() {
 		return this.views ??= this.stores().then((s) => this.storeViews(s), (error) => {
 			this.views = null;
 			throw error;
 		});
 	}
-	/** The stores the person has (a removed default is not one). */
+	/** The stores the person has (a removed default is not one), in the order of their keys, as IndexedDB lists them. */
 	async stores() {
-		return (await wrap((await store(STORES$1.appStores, "readonly")).getAll())).filter((s) => !s.removed);
+		return [...(await this.records()).values()].filter((s) => !s.removed).sort((a, b) => a.key < b.key ? -1 : 1);
 	}
 	storeViews(stores) {
 		return stores.filter((s) => s.index).map((s) => ({
@@ -11489,7 +11620,10 @@ var Apps = class {
 	}
 	/**
 	* Reads the index at `url`. With the index held for this store, bytes equal to it (by digest) are the held index: its
-	* signature and every revocation in it were checked when it was read, so only its expiry is taken again.
+	* signature and every revocation in it were checked when it was read, so only its expiry is taken again. Any other
+	* index is read with a pause every few ms (the engine shares the page's thread, and an index holds up to 4096
+	* listings and 4096 revocations, each of these a signature check), and a revocation checked in an earlier read, of
+	* this store or another, a preview included, is not checked again.
 	*/
 	async readStoreAt(url, heldKey, held) {
 		const [indexBytes, sigBytes] = await Promise.all([this.host.fetch(url, { maxBytes: APP_FETCH_LIMITS.storeIndexBytes }), this.host.fetch(besideUrl(url, "ghostly-store.sig"), { maxBytes: APP_FETCH_LIMITS.sigBytes })]);
@@ -11501,7 +11635,16 @@ var Apps = class {
 				expired: held.index.expires < this.nowS()
 			}
 		};
-		return readAppStore(indexBytes, sigBytes, this.nowS(), heldKey);
+		const steps = readAppStoreSteps(indexBytes, sigBytes, this.nowS(), heldKey, this.checkedRevocations);
+		let since = performance.now();
+		for (;;) {
+			const step = steps.next();
+			if (step.done) return step.value;
+			if (performance.now() - since >= REVOCATIONS_SLICE_MS) {
+				await new Promise((resolve) => setTimeout(resolve, 0));
+				since = performance.now();
+			}
+		}
 	}
 	/**
 	* The revocations its publisher signed, read beside each URL (`ghostly-revoke.json`); none there is not an error.
@@ -11513,12 +11656,43 @@ var Apps = class {
 			if (read.has(url)) continue;
 			read.add(url);
 			try {
-				const read = readAppRevocations(await this.host.fetch(url, { maxBytes: APP_FETCH_LIMITS.revocationsBytes }));
-				if (read.ok) (out ??= []).push(...read.revocations.filter((r) => r.statement.app === ref));
+				const file = await this.readRevocationsFile(await this.host.fetch(url, { maxBytes: APP_FETCH_LIMITS.revocationsBytes }));
+				if (file) (out ??= []).push(...file.filter((r) => r.statement.app === ref));
 			} catch {}
 		}
 		return out;
 	}
+	/**
+	* `readAppRevocations` (one entry that does not verify refuses the file, null here), with a pause every few ms: the
+	* engine shares the page's thread, and each entry is a signature check. The same bytes are not checked again.
+	*/
+	async readRevocationsFile(bytes) {
+		const id = toBase64Url(sha256(bytes));
+		const known = this.revocationFiles.get(id);
+		if (known !== void 0) return known;
+		const read = readCanonicalJson(bytes);
+		let out = null;
+		if (read.ok && Array.isArray(read.value) && read.value.length <= APP_STATEMENT_LIMITS.revocations) {
+			out = [];
+			let since = performance.now();
+			for (const entry of read.value) {
+				if (performance.now() - since >= REVOCATIONS_SLICE_MS) {
+					await new Promise((resolve) => setTimeout(resolve, 0));
+					since = performance.now();
+				}
+				const one = readAppRevocation(entry);
+				if (!one.ok) {
+					out = null;
+					break;
+				}
+				out.push(one.revocation);
+			}
+		}
+		this.revocationFiles.delete(id);
+		this.revocationFiles.set(id, out);
+		for (const old of this.revocationFiles.keys()) if (this.revocationFiles.size > REVOCATION_FILES_KEPT) this.revocationFiles.delete(old);
+		return out;
+	}
 	summary(s) {
 		const index = s.index;
 		return {
@@ -11675,8 +11849,10 @@ var Apps = class {
 					problem: error instanceof AppFetchError ? error.code : "network"
 				};
 			}
-			if (!await this.storeRecord(s.key) || (await this.storeRecord(s.key))?.removed) continue;
-			await this.putStore(next);
+			const now = await this.storeRecord(s.key);
+			if (!now || now.removed) continue;
+			if (now === s && next.index === s.index && next.digest === s.digest && next.problem === s.problem && next.equivocation === s.equivocation) (await this.records()).set(s.key, next);
+			else await this.putStore(next);
 			out.push(this.summary(next));
 		}
 		return out;
@@ -12055,7 +12231,11 @@ var Apps = class {
 			}
 			const after = await this.readRevocations(app.ref, [app.from, ...app.manifest.sources ?? []], revokeRead);
 			const revocations = before || after ? [...before ?? [], ...after ?? []] : null;
-			const versions = [app, ...app.pending ? [versionOf(app.pending.manifest, app.pending.digest)] : []];
+			const versions = [
+				app,
+				...app.pending ? [versionOf(app.pending.manifest, app.pending.digest)] : [],
+				...this.startedBefore(app)
+			];
 			const stays = (app.revocations ?? []).filter((r) => !revocations || versions.some((v) => appRevocationFor(v, [r])));
 			const merged = new Map([...stays, ...revocations ?? []].map((r) => [canonicalJson(r), r]));
 			if ((await this.app(app.ref))?.store === void 0 && app.store !== void 0) {
@@ -12146,6 +12326,9 @@ var Apps = class {
 		if (run.status === "removed") this.anyway.add(`${app.ref} ${app.digest}`);
 		const bundle = await this.verifiedBundle(app);
 		const entry = bundle.files.get(bundle.manifest.entry) ?? fail("damaged", "The entry is missing");
+		this.ran.add(app.ref);
+		const versions = this.started.get(app.ref) ?? /* @__PURE__ */ new Map();
+		this.started.set(app.ref, versions.set(app.digest, app.sequence));
 		return {
 			ref: app.ref,
 			digest: app.digest,
@@ -12156,9 +12339,10 @@ var Apps = class {
 			entry: utf8Decode(entry)
 		};
 	}
-	/** A file of the installed bundle, for the broker's `file` (`ghostly.file(path)`). */
-	async file({ ref, path }) {
-		const app = path === "icon.png" ? await this.installedOrFail(ref) : await this.runningOrFail(ref);
+	/** A file of the installed bundle, for the broker's `file` (`ghostly.file(path)`). `digest`: the version the frame runs. */
+	async file({ ref, path, digest }) {
+		const app = path === "icon.png" ? await this.installedOrFail(ref) : await this.runningOrFail(ref, digest);
+		if (path !== "icon.png" && digest !== void 0 && digest !== app.digest) fail("no-file", "No such file in this app");
 		const icon = path === "icon.png" ? this.icons.get(app.digest) : void 0;
 		if (icon) return icon.slice();
 		if (icon === null) fail("no-file", "No such file in this app");
@@ -12169,6 +12353,10 @@ var Apps = class {
 	async view(app, stores) {
 		const { manifest } = app;
 		const listedBy = this.listedBy(app.ref, stores);
+		const stopped = this.startedBefore(app).map((v) => ({
+			digest: v.digest,
+			run: this.runStatus(v, this.storeViews(stores), app.revocations)
+		})).filter((v) => v.run.status !== "ok");
 		return {
 			ref: app.ref,
 			name: app.name,
@@ -12198,7 +12386,8 @@ var Apps = class {
 				sequence: app.equivocation.sequence,
 				at: app.equivocation.at
 			} },
-			...app.checkedAt !== void 0 && { checkedAt: app.checkedAt }
+			...app.checkedAt !== void 0 && { checkedAt: app.checkedAt },
+			...stopped.length && { stopped }
 		};
 	}
 	async list() {
@@ -12214,8 +12403,13 @@ var Apps = class {
 		const tx = (await openDb()).transaction([STORES$1.apps, STORES$1.appStorage], "readwrite");
 		tx.objectStore(STORES$1.apps).delete(app.ref);
 		tx.objectStore(STORES$1.appStorage).delete(rowsOf(app.ref));
-		await done(tx);
+		try {
+			await done(tx);
+		} finally {
+			this.held.delete(app.ref);
+		}
 		for (const key of [...this.usage.keys()]) if (key.startsWith(`${app.ref}\0`)) this.usage.delete(key);
+		this.started.delete(app.ref);
 		await this.removeBundle(app.bytes, app.digest);
 		if (app.pending) await this.removeBundle(app.pending.bytes, app.pending.digest);
 	}
@@ -12246,8 +12440,8 @@ var Apps = class {
 		}
 		return used;
 	}
-	async storageGet({ ref, scope, key }) {
-		const app = await this.runningOrFail(ref);
+	async storageGet({ ref, scope, key, digest }) {
+		const app = await this.runningOrFail(ref, digest);
 		const row = await wrap((await store(STORES$1.appStorage, "readonly")).get([
 			app.ref,
 			this.scopeOf(scope),
@@ -12256,8 +12450,8 @@ var Apps = class {
 		return row ? { value: JSON.parse(row.value) } : null;
 	}
 	/** Keeps a JSON value under a key: at most 64 KiB, and 5 MiB for every key of this app in this scope. */
-	async storageSet({ ref, scope, key, value }) {
-		const app = await this.runningOrFail(ref);
+	async storageSet({ ref, scope, key, value, digest }) {
+		const app = await this.runningOrFail(ref, digest);
 		const where = this.scopeOf(scope), name = this.keyOf(key);
 		let text;
 		try {
@@ -12293,8 +12487,8 @@ var Apps = class {
 			this.usage.set(`${app.ref}\0${where}`, next);
 		});
 	}
-	async storageDelete({ ref, scope, key }) {
-		const app = await this.runningOrFail(ref);
+	async storageDelete({ ref, scope, key, digest }) {
+		const app = await this.runningOrFail(ref, digest);
 		const where = this.scopeOf(scope), name = this.keyOf(key);
 		await this.serial(`${app.ref}\0${where}`, async () => {
 			const used = await this.usageOf(app.ref, where);
@@ -12312,8 +12506,8 @@ var Apps = class {
 			this.usage.set(`${app.ref}\0${where}`, used - old.size);
 		});
 	}
-	async storageKeys({ ref, scope }) {
-		const app = await this.runningOrFail(ref);
+	async storageKeys({ ref, scope, digest }) {
+		const app = await this.runningOrFail(ref, digest);
 		return (await wrap((await store(STORES$1.appStorage, "readonly")).getAllKeys(rowsOf(app.ref, this.scopeOf(scope))))).map((k) => k[2]);
 	}
 	/** An app's storage in every scope, as export files (WISP 1200 § Where installed apps live), offered before an uninstall. */
@@ -14629,6 +14823,8 @@ var EnrollInviter = class extends Enrollment {
 	stopDoneWait = null;
 	/** A joiner was seen on the link: from then it has as long as a joiner waits for the proof to open a session. */
 	seen = false;
+	/** The person answered the digits: one answer is taken, before the record is read or written for it. */
+	answered = false;
 	constructor(options) {
 		super(options, {
 			role: "inviter",
@@ -14743,7 +14939,8 @@ var EnrollInviter = class extends Enrollment {
 	* and nothing was written.
 	*/
 	async confirm(match) {
-		if (this.over || this.view.step !== "confirm" || !this.joiner) throw new Error("There are no digits to confirm");
+		if (this.over || this.answered || this.view.step !== "confirm" || !this.joiner) throw new Error("There are no digits to confirm");
+		this.answered = true;
 		if (!match) {
 			await this.fail("digits", "digits", this.joiner.name);
 			return this.view;
@@ -20422,6 +20619,11 @@ var EditQueue = class {
 	sent = /* @__PURE__ */ new Map();
 	/** When a card that goes again last went (`CARD_RESTORE_GAP_MS`). */
 	restoredAt = -Infinity;
+	/** The rows known to have an edit on its way, each with when it was last told (`edited`), by `tick`. */
+	known = /* @__PURE__ */ new Map();
+	tick = 0;
+	/** The chat's history was read for the rows with an edit on its way: `known` has them all, until the next session. */
+	learnt = false;
 	timer;
 	flushing = null;
 	again = false;
@@ -20464,17 +20666,48 @@ var EditQueue = class {
 	*/
 	reopened() {
 		this.sent.clear();
+		this.learnt = false;
+	}
+	/** This row has an edit to send (it was just written so): the next look reads it. */
+	edited(id) {
+		this.known.set(id, ++this.tick);
+	}
+	/**
+	* My rows with an edit on its way, by time. `all`: the chat's whole history, when it was read for them (no `row` to
+	* read one by, or nothing learnt yet in this session). Otherwise the known rows are read alone, and one that waits
+	* no more is forgotten, unless it was told again while it was read.
+	*/
+	async pending() {
+		const waits = (m) => m.sender === "me" && !!m.edit?.pending;
+		const row = this.deps.row;
+		if (!row || !this.learnt) {
+			const all = await this.deps.read(), rows = all.filter(waits);
+			for (const m of rows) if (!this.known.has(m.id)) this.known.set(m.id, this.tick);
+			this.learnt = true;
+			return {
+				rows,
+				all
+			};
+		}
+		const asOf = this.tick, ids = [...this.known.keys()];
+		const read = await Promise.all(ids.map((id) => row(id)));
+		const rows = [];
+		read.forEach((m, i) => {
+			if (m && waits(m)) rows.push(m);
+			else if ((this.known.get(ids[i]) ?? 0) <= asOf) this.known.delete(ids[i]);
+		});
+		return { rows: rows.sort((a, b) => a.timestamp - b.timestamp) };
 	}
 	/** The contact confirmed edit `seq` of my message with this wire id. */
 	async received(wireId, seq) {
-		const row = (await this.deps.read()).find((m) => m.sender === "me" && m.wireId === wireId);
+		const row = (await this.pending()).rows.find((m) => m.wireId === wireId);
 		if (!row?.edit?.pending || row.edit.seq > seq) return;
 		this.sent.delete(row.id);
 		await this.deps.settle(row.id, row.edit.seq);
 	}
 	/** The contact confirmed, on the DHT floor, the edit that went there under this id (`dhtEditId`). */
 	async receivedOnDht(id) {
-		const row = (await this.deps.read()).find((m) => m.sender === "me" && m.edit?.pending && m.wireId && dhtEditId(m.wireId, m.edit.seq) === id);
+		const row = (await this.pending()).rows.find((m) => m.wireId && dhtEditId(m.wireId, m.edit.seq) === id);
 		if (!row) return;
 		this.sent.delete(row.id);
 		await this.deps.settle(row.id, row.edit.seq);
@@ -20488,13 +20721,13 @@ var EditQueue = class {
 		if (this.stopped) return;
 		const now = this.now();
 		const said = (m) => this.sent.get(m.id)?.seq === m.edit.seq ? 1 : 0;
-		const rows = await this.deps.read();
+		const { rows, all } = await this.pending();
+		const due = rows.filter((m) => m.wireId).sort((a, b) => said(a) - said(b) || a.edit.at - b.edit.at);
 		const newest = /* @__PURE__ */ new Map();
-		for (const m of rows) {
+		if (due.some((m) => m.edit.restore)) for (const m of all ?? await this.deps.read()) {
 			const key = m.sender === "me" && cardKey(m);
 			if (key && m.timestamp > (newest.get(key) ?? -Infinity)) newest.set(key, m.timestamp);
 		}
-		const due = rows.filter((m) => m.sender === "me" && m.edit?.pending && m.wireId).sort((a, b) => said(a) - said(b) || a.edit.at - b.edit.at);
 		const gap = this.deps.restoreGapMs ?? CARD_RESTORE_GAP_MS;
 		let next = Infinity;
 		for (const message of due) {
@@ -21297,9 +21530,8 @@ var db = {
 	/** The group and its history. */
 	async deleteGroup(groupId) {
 		await wrap((await store(STORES$1.groups, "readwrite")).delete(groupId));
-		const messages = await store(STORES$1.messages, "readwrite");
-		const keys = await wrap(messages.index("byLink").getAllKeys(`group:${groupId}`));
-		await Promise.all(keys.map((key) => wrap(messages.delete(key))));
+		const link = `group:${groupId}`;
+		await wrap((await store(STORES$1.messages, "readwrite")).delete(IDBKeyRange.bound([link], [link, []])));
 	},
 	async getServices() {
 		return wrap((await store(STORES$1.services, "readonly")).getAll());
@@ -21374,6 +21606,11 @@ function noteAfterChange(current, message) {
 		snippet
 	};
 }
+/** The note as its message's row has it now, when that reaction still stands there (not replaced, not taken back). */
+function noteIfStanding(current, message) {
+	const r = message.reactions?.[current.by];
+	return r?.e && r.e === current.emoji && r.at === current.at ? note(message, current.by, r.e, r.at) : void 0;
+}
 /**
 * My reactions in a private group to say again to an edge that opened, in case it missed them: the newest `limit`,
 * newest first (what the member is likeliest to have missed lands before its pace runs out), of this membership only.
@@ -21392,11 +21629,10 @@ function groupReactionsToResend(messages, limit) {
 		}] : [];
 	}).sort((a, b) => b.n - a.n).slice(0, limit);
 }
-/** This side's highest number in a chat: the next one goes past it (and past what still waits to be confirmed). */
-function lastMine(messages, pending = []) {
+/** This side's highest number in a chat's history: the next one goes past it. */
+function lastMine(messages) {
 	let last = 0;
 	for (const m of messages) last = Math.max(last, m.reactions?.me?.n ?? 0);
-	for (const p of pending) last = Math.max(last, p.n);
 	return last;
 }
 var Reactions = class {
@@ -21407,6 +21643,11 @@ var Reactions = class {
 	queue = Promise.resolve();
 	/** A group member's reactions taken per window (chat and member key), as a paired chat's session limits them. */
 	memberPace = /* @__PURE__ */ new Map();
+	/**
+	* This side's highest number per chat: read from its history the first time I react in it, then each number given
+	* out. It only has to grow, so a row deleted since leaves it too high and nothing is wrong.
+	*/
+	last = /* @__PURE__ */ new Map();
 	constructor(host) {
 		this.host = host;
 	}
@@ -21428,17 +21669,19 @@ var Reactions = class {
 			if (typeof messageId !== "string" || !messageId) return { error: "No message to react to" };
 			const e = emoji === "" ? "" : reactionEmoji(emoji);
 			if (e === null) return { error: "A reaction is one emoji" };
-			const messages = await this.host.messages(chat), group = isGroup$1(chat);
-			const target = messages.find((m) => m.id === messageId) ?? reactionTarget(messages, messageId, group);
-			const id = target && replyRef(target, group);
+			const target = await this.named(chat, messageId);
+			const id = target && replyRef(target, isGroup$1(chat));
 			if (!target || !id) return { error: "That message is not in this chat, or takes no reaction" };
 			const current = target.reactions?.me;
 			if (!e && !current?.e) return { error: "No reaction of yours to take back" };
+			let last = this.last.get(chat) ?? lastMine(await this.host.messages(chat));
+			for (const p of pending) last = Math.max(last, p.n);
 			const reaction = {
 				id,
 				e,
-				n: nextReactionNumber(lastMine(messages, pending), this.now())
+				n: nextReactionNumber(last, this.now())
 			};
+			this.last.set(chat, reaction.n);
 			return {
 				reaction,
 				message: await this.write(chat, target, "me", reaction) ?? target
@@ -21477,6 +21720,12 @@ var Reactions = class {
 			for (const { by, reaction } of mine) await this.write(message.linkId, message, by, reaction);
 		});
 	}
+	/** The row I react to: by its id here, as the pages name it, read alone; else by the id both sides know it by. */
+	async named(chat, id) {
+		if (this.host.message) return await this.host.message(chat, id) ?? this.find(chat, id);
+		const messages = await this.host.messages(chat);
+		return messages.find((m) => m.id === id) ?? reactionTarget(messages, id, isGroup$1(chat));
+	}
 	/**
 	* The row a received reaction names. Most often the row of that id (a group's), or of `peer_` or `me_` and that id (a
 	* chat's): those are read alone. Any other (a file's, a payment's, one not here yet) is looked for in the whole chat;
@@ -21493,9 +21742,10 @@ var Reactions = class {
 		}
 		return reactionTarget(await this.host.messages(chat), id, group);
 	}
-	/** A chat is gone: nothing waits for it any more. */
+	/** A chat is gone: nothing waits for it any more, and my highest number in it is read again if it comes back. */
 	forget(chat) {
 		this.waiting.delete(chat);
+		this.last.delete(chat);
 	}
 	wait(chat, by, reaction) {
 		const now = this.now();
@@ -21552,13 +21802,16 @@ function pinOfFormerMember(pin, inRoster) {
 function mayPinIn(group) {
 	return !!group?.myKey && group.status === "active" && mayPin(group.profile, group.myKey, group.members.find((m) => m.role === "admin")?.key);
 }
-/** The row a pin names, when it is here: the row of that id (a group's), or of `peer_`/`me_` and that id, or any other. */
+/** The row a pin names, when it is here: the row of that id (a group's), or of `peer_`/`me_` and that id, or any other of a chat's. */
 async function pinnedRow(host, chat, id) {
 	if (!id) return void 0;
 	const group = isGroup(chat);
-	if (host.message) for (const rowId of group ? [id] : [`peer_${id}`, `me_${id}`]) {
-		const row = await host.message(chat, rowId);
-		if (row && replyRef(row, group) === id) return row;
+	if (host.message) {
+		for (const rowId of group ? [id] : [`peer_${id}`, `me_${id}`]) {
+			const row = await host.message(chat, rowId);
+			if (row && replyRef(row, group) === id) return row;
+		}
+		if (group) return void 0;
 	}
 	return reactionTarget(await host.messages(chat), id, group);
 }
@@ -21783,6 +22036,17 @@ var FAREWELL_RETRY_MS = 6e4;
 var FAREWELL_TOLD_MS = 6e5;
 var FAREWELL_SAY_MS = 1e4;
 /**
+* A key asking in my lobby that no commit I hold names may be a member let in by a commit I have not heard yet: a hub
+* keeps an edge to it for a moment, on which it says where it is and takes commits (`wantAhead`). At most `AHEAD_EDGES`
+* at a time, each awaited `AHEAD_WAIT_MS` and closed `AHEAD_LINGER_MS` after it came up unless a commit named the key
+* by then; the same key is not waited for again for a while (longer once its edge was up).
+*/
+var AHEAD_EDGES = 4;
+var AHEAD_WAIT_MS = 12e4;
+var AHEAD_LINGER_MS = 2e4;
+var AHEAD_RETRY_MS = 6e4;
+var AHEAD_HEARD_MS = 6e5;
+/**
 * A key asking from before the commit that took it out was there and was sent that commit: not waited for. The two
 * times are two devices' clocks (the asker's, the commit's signer's), so "before" allows this much between them:
 * a returning member whose clock runs behind the admin's is told all the same.
@@ -22254,6 +22518,7 @@ var Communities = class {
 					await this.publishBeacon(group.id, live, now, false).catch(() => {});
 				}
 				live.farewells.clear();
+				live.ahead.clear();
 				await this.reconcile(group.id, live, now);
 				continue;
 			}
@@ -22347,6 +22612,7 @@ var Communities = class {
 			if (this.leftItself(live, h.key) ? h.ts - FAREWELL_SKEW_MS > out : h.ts + FAREWELL_SKEW_MS > out) this.wantFarewell(groupId, live, h.key, now);
 		}
 		this.endFarewells(live, now);
+		this.endAhead(groupId, live, now);
 		if (live.hub) {
 			const busy = this.admitting(groupId, live, now);
 			if (s.state.pendingLeaves.some((r) => r.s !== me && this.recentHub(live, r.s))) live.lobbyBusyUntil = Math.max(live.lobbyBusyUntil, now + this.timings.lobbyBusyMs);
@@ -22425,8 +22691,9 @@ var Communities = class {
 		}
 		await this.keepLooking(groupId, live, now);
 		for (const [key, since] of live.pendingEntries) {
-			const linkId = this.host.entries(groupId).get(key);
-			if (!(!!linkId && this.host.linkReady(linkId, 2)) && now - since > ENTRY_UNANSWERED_MS) live.pendingEntries.delete(key);
+			const linkId = this.host.entries(groupId).get(key), up = !!linkId && this.host.linkReady(linkId, 2);
+			const elsewhere = rosterHas(s.roster, key) && since < this.addedAt(s, key) + this.timings.knockFallbackMs;
+			if (!up && (elsewhere || now - since > ENTRY_UNANSWERED_MS)) live.pendingEntries.delete(key);
 			else if (now - since > ENTRY_TIMEOUT_MS$1) {
 				live.pendingEntries.delete(key);
 				this.refused.set(key, now + REFUSED_FOR_MS$1);
@@ -22485,7 +22752,7 @@ var Communities = class {
 		const edges = this.host.edges(groupId);
 		if (now - live.beaconAt <= 2 * this.timings.beaconReadMs) {
 			const hubs = new Set(freshHubs(this.hubs(live), now).map((h) => h.key));
-			for (const [key, id] of edges) if (!hubs.has(key) && !live.members.has(key) && this.host.linkReady(id, 2) && !this.gone(live, key)) live.members.set(key, now);
+			for (const [key, id] of edges) if (!hubs.has(key) && !live.members.has(key) && this.host.linkReady(id, 2) && rosterHas(live.session.roster, key) && !this.gone(live, key)) live.members.set(key, now);
 			for (const key of [...live.members.keys()]) if (hubs.has(key)) live.members.delete(key);
 		}
 		for (const [key, since] of live.members) {
@@ -22623,16 +22890,21 @@ var Communities = class {
 		for (let i = chain.length - 1; i >= 0; i--) if ((chain[i].k === "leave" || chain[i].k === "remove") && chain[i].s === key) return chain[i].k === "leave";
 		return false;
 	}
-	/** A frame goes on an edge to a member; to someone the chain took out, only the commit that took it out. */
-	mayHear(live, key, frame) {
-		if (!live?.session.wasRemoved(key)) return true;
+	/**
+	* A frame goes on an edge to a member; to someone the chain took out, only the commit that took it out. What the
+	* group says (`said`: a frame of mine for everyone, or one a hub relays) goes to the members of the roster only:
+	* a key no commit names hears none of it, and one let in on a branch that lost hears the commits.
+	*/
+	mayHear(live, key, frame, said = false) {
 		const f = frame;
-		return f.t === "group-commit" && (f.commit?.k === "remove" || f.commit?.k === "leave") && f.commit.s === key;
+		if (live?.session.wasRemoved(key)) return f.t === "group-commit" && (f.commit?.k === "remove" || f.commit?.k === "leave") && f.commit.s === key;
+		if (!live || !said || rosterHas(live.session.roster, key)) return true;
+		return f.t === "group-commit" && live.session.isRecentMember(key);
 	}
-	/** The edges of the group that may hear `frame`. */
+	/** The edges of the group that may hear `frame`, said to everyone. */
 	hearers(groupId, frame) {
 		const live = this.live.get(groupId);
-		return [...this.host.edges(groupId)].filter(([key]) => this.mayHear(live, key, frame));
+		return [...this.host.edges(groupId)].filter(([key]) => this.mayHear(live, key, frame, true));
 	}
 	/** As a hub: someone the chain took out is asking (in my lobby, or listing itself as a hub). An edge to tell it, within bounds. */
 	wantFarewell(groupId, live, key, now) {
@@ -22653,6 +22925,34 @@ var Communities = class {
 		for (const [key, at] of live.farewellSaid) if (now - at >= FAREWELL_SAY_MS) live.farewellSaid.delete(key);
 	}
 	/**
+	* As a hub: a key no commit I hold names is asking in my lobby. It may be a member ahead of me on the roster, who needs
+	* the edge for me to find out (its answer to my `group-sync` carries the commit); or nobody, since whoever was once
+	* given the group's rendezvous secret can write a key there. An edge, within bounds, that is no member's: it takes
+	* no place among my members, and nothing the group says goes on it (`mayHear`).
+	*/
+	wantAhead(groupId, live, key, now) {
+		if (live.ahead.has(key) || now < (live.aheadQuiet.get(key) ?? 0)) return;
+		if (live.ahead.size >= AHEAD_EDGES || this.capacity(groupId, live, now) <= 0) return;
+		live.ahead.set(key, { since: now });
+		if (!this.host.edges(groupId).has(key)) live.expect.add(key);
+	}
+	/** Those edges end: a commit named the key (a member of mine now, or out), it never came, or its moment is over; and a hub no more keeps none. */
+	endAhead(groupId, live, now) {
+		const edges = this.host.edges(groupId);
+		for (const [key, a] of live.ahead) {
+			const member = rosterHas(live.session.roster, key), named = member || live.session.wasRemoved(key);
+			if (!named && live.hub) {
+				const id = edges.get(key);
+				if (!a.up && id && this.host.linkReady(id, 2)) a.up = now;
+				if (a.up ? now - a.up < AHEAD_LINGER_MS : now - a.since < AHEAD_WAIT_MS) continue;
+			}
+			live.ahead.delete(key);
+			if (!named) live.aheadQuiet.set(key, now + (a.up ? AHEAD_HEARD_MS : AHEAD_RETRY_MS));
+			else if (member && live.hub && live.members.size < this.capacity(groupId, live, now)) live.members.set(key, now);
+		}
+		for (const [key, until] of live.aheadQuiet) if (until <= now) live.aheadQuiet.delete(key);
+	}
+	/**
 	* Someone the chain took out says where it is (`group-sync`): it is handed the commits up to the one that took it
 	* out, and nothing else (`CommunitySession.farewell`). Nothing else it says is heard.
 	*/
@@ -22716,6 +23016,10 @@ var Communities = class {
 				if (ts + FAREWELL_SKEW_MS > (live.session.outAt(key) ?? Infinity)) this.wantFarewell(groupId, live, key, now);
 				continue;
 			}
+			if (!rosterHas(live.session.roster, key)) {
+				this.wantAhead(groupId, live, key, now);
+				continue;
+			}
 			live.emptySince = now;
 			if (!live.members.has(key) && live.members.size >= this.capacity(groupId, live, now)) continue;
 			if (!live.members.has(key)) {
@@ -22736,6 +23040,7 @@ var Communities = class {
 				for (const h of freshHubs(this.hubs(live), now)) if (h.key !== s.myKey && !this.hubDead(groupId, live, h, now)) wanted.add(h.key);
 				for (const key of live.members.keys()) wanted.add(key);
 				for (const key of live.farewells.keys()) wanted.add(key);
+				for (const key of live.ahead.keys()) wanted.add(key);
 			} else for (const key of live.myHubs) wanted.add(key);
 			for (const [key, id] of existing) if (this.host.linkReady(id, 2) && (live.members.has(key) || this.recentHub(live, key)) && !s.wasRemoved(key)) wanted.add(key);
 		}
@@ -22856,8 +23161,7 @@ var Communities = class {
 			if (now - ts > 18e4 || this.refused.has(key) || live.pendingEntries.has(key) || key === link.host || key === s.myKey) continue;
 			const stillKnocking = now - ts < 2 * this.timings.slowKnockMs;
 			if (rosterHas(s.roster, key)) {
-				const added = [...s.state.chain].reverse().find((c) => c.k === "add" && c.s === key)?.ts ?? 0;
-				if (!stillKnocking || ts < added + this.timings.knockFallbackMs) continue;
+				if (!stillKnocking || ts < this.addedAt(s, key) + this.timings.knockFallbackMs) continue;
 			}
 			const seen = live.knocksSeen.get(key);
 			const changed = !!seen && seen.doors !== doorSig;
@@ -22887,6 +23191,10 @@ var Communities = class {
 		}
 		for (const [key, { first }] of live.knocksSeen) if (now - first > 36e4) live.knocksSeen.delete(key);
 	}
+	/** When the chain last added this member (0: never). */
+	addedAt(s, key) {
+		return [...s.state.chain].reverse().find((c) => c.k === "add" && c.s === key)?.ts ?? 0;
+	}
 	/** Leave requests: the door commits them (see `answerKnocks`); any hub after a while. */
 	async commitLeaves(live, otherHubs, now) {
 		const s = live.session;
@@ -23133,6 +23441,7 @@ var Communities = class {
 			if (f.t === "group-sync" && live.session.isMember) this.sayFarewell(groupId, live, peerKey, f);
 			return;
 		}
+		if (!live.session.isRecentMember(peerKey) && f.t !== "group-commit" && f.t !== "group-msg" && f.t !== "group-secrets" && !(f.t === "group-secret" && f.to === live.session.myKey)) return;
 		if ((f.t === "group-secret" || f.t === "group-entry") && typeof f.to === "string" && f.to !== live.session.myKey) {
 			if (!live.hub) return;
 			const id = `${String(f.t)}:${f.to}:${String(f.h ?? f.x)}`;
@@ -23187,7 +23496,7 @@ var Communities = class {
 	edgeReady(groupId, peerKey, linkId) {
 		const live = this.live.get(groupId);
 		if (!live || live.session.wasRemoved(peerKey)) return;
-		if (live.hub && !this.peerIsHub(live, peerKey)) live.members.set(peerKey, this.now());
+		if (live.hub && !this.peerIsHub(live, peerKey) && rosterHas(live.session.roster, peerKey)) live.members.set(peerKey, this.now());
 		this.sendTo(linkId, live.session.syncFrame());
 		this.host.emit();
 	}
@@ -23302,6 +23611,8 @@ var Communities = class {
 			farewells: /* @__PURE__ */ new Map(),
 			farewellQuiet: /* @__PURE__ */ new Map(),
 			farewellSaid: /* @__PURE__ */ new Map(),
+			ahead: /* @__PURE__ */ new Map(),
+			aheadQuiet: /* @__PURE__ */ new Map(),
 			knocksScanned: false,
 			knockCursor: 0,
 			lastShardPoll: 0,
@@ -24506,6 +24817,8 @@ var Groups = class {
 	removedAt = /* @__PURE__ */ new Map();
 	/** Who is typing in each private group, and this side's word there (WISP 902 · Group Mesh § Typing). */
 	typings;
+	/** A member's pins taken per window in a private group (group and member key). */
+	pinPaces = /* @__PURE__ */ new Map();
 	/** Edge signaling through members (WISP 902 · Group Mesh § Signaling through members). */
 	signals;
 	/** Files and voice messages in every group, private or community (WISP 503 · Group Files). */
@@ -24571,6 +24884,13 @@ var Groups = class {
 		if (!asItIs) await this.files?.sweep(all.map((g) => g.id));
 		for (const group of this.stored.values()) for (const [, linkId] of this.host.entries(group.id)) if (!group.invitation?.entry || group.invitation.linkId !== linkId) await this.host.closeEdge(linkId);
 	}
+	/** The pins taken per window from one member's edge in a private group, as a paired chat's session limits them. */
+	pinPace(groupId, member) {
+		const key = `${groupId}\n${member}`;
+		let pace = this.pinPaces.get(key);
+		if (!pace) this.pinPaces.set(key, pace = new ReactionWindow(PIN_LIMITS.receive, PIN_LIMITS.windowMs));
+		return pace;
+	}
 	/** A group's pin now (WISP 400 § Pinned message), the latest one taken, unpinned or not. */
 	pinOf(groupId) {
 		return this.record(groupId)?.pin;
@@ -24883,6 +25203,15 @@ var Groups = class {
 		if (!groupOfFile(fileId, [...this.stored.keys(), ...this.communities.ids()]) || !this.files) throw new Error("No such file");
 		return this.files.download(fileId);
 	}
+	/** The person stops a group's file that is coming or would be fetched (Cancel, Decline), or pauses it (`keep`). */
+	haltFile(fileId, keep = false) {
+		if (!groupOfFile(fileId, [...this.stored.keys(), ...this.communities.ids()]) || !this.files) throw new Error("No such file");
+		return this.files.halt(fileId, keep);
+	}
+	/** Automatic downloads were turned off: the groups' files chosen by themselves and not here yet stop coming. */
+	autoDownloadsOff() {
+		return this.files?.autoDownloadsOff() ?? Promise.resolve();
+	}
 	/** An edge's files/3 session opened or closed (WISP 503: the bytes of a group's files go over it). */
 	fileSession(groupId, peerKey, linkId, open) {
 		this.files?.session(groupId, peerKey, linkId, open);
@@ -25181,6 +25510,7 @@ var Groups = class {
 		this.gapsAsked.delete(groupId);
 		this.gapsLooked.delete(groupId);
 		this.typings.forget(groupId);
+		for (const key of this.pinPaces.keys()) if (key.startsWith(`${groupId}\n`)) this.pinPaces.delete(key);
 		this.downSince.delete(groupId);
 		this.hereHeard.delete(groupId);
 		this.hereActed.delete(groupId);
@@ -25569,6 +25899,8 @@ var Groups = class {
 					return;
 				}
 				if (existing?.invitation?.seedB64 && (existing.invitation.linkId !== linkId || existing.invitation.admin !== frame.admin)) return;
+				if (existing?.left && (existing.left.admin !== frame.admin || existing.contacts?.[existing.left.admin] !== linkId)) return;
+				if (existing?.invitation && !existing.state && existing.invitation.linkId !== linkId && !existing.invitation.genesis) return;
 				if ([...this.stored.values()].filter((x) => x.invitation).length >= 32) return;
 				if (!existing?.invitation && [...this.stored.values()].filter((x) => x.invitation?.linkId === linkId).length >= MAX_INVITATIONS_PER_CHAT) {
 					try {
@@ -25584,6 +25916,7 @@ var Groups = class {
 					...existing?.state?.nicks
 				};
 				const previous = existing?.state ? existing : existing?.previous;
+				const genesis = existing?.state ? commitHash(existing.state.chain[0]) : existing?.invitation?.genesis;
 				const invitation = {
 					id: g,
 					createdAt: Date.now(),
@@ -25592,7 +25925,8 @@ var Groups = class {
 						admin: frame.admin,
 						linkId,
 						...invitationClaims(frame),
-						pieces: []
+						pieces: [],
+						...genesis ? { genesis } : {}
 					},
 					...Object.keys(known).length ? { formerNames: known } : {},
 					...previous ? { previous } : {}
@@ -25676,6 +26010,20 @@ var Groups = class {
 					group.invitation.pieces = [];
 					return;
 				}
+				if (group.invitation.genesis && commitHash(joined.state.chain[0]) !== group.invitation.genesis) {
+					try {
+						this.host.sendOnLink(linkId, {
+							t: "group-decline",
+							g
+						});
+					} catch {}
+					delete group.invitation.seedB64;
+					group.invitation.pieces = [];
+					this.acceptSaid.delete(g);
+					await this.store.putGroup(group);
+					this.host.emit();
+					return;
+				}
 				const viaLink = !!group.invitation.entry;
 				this.meet(g, group.invitation.admin);
 				const member = {
@@ -25791,6 +26139,8 @@ var Groups = class {
 			return;
 		}
 		if (t === "group-pin") {
+			const said = this.pinPace(groupId, peerKey).take() ? readPin(frame) : null;
+			if (!said || !pinIsNewer(this.record(groupId)?.pin, said)) return;
 			const signed = session.signedPin(frame);
 			if (signed && rosterHas(session.roster, peerKey)) await this.host.groupPin?.(groupId, peerKey, signed);
 			return;
@@ -26708,6 +27058,14 @@ var GroupEdits = class {
 	receivePace = /* @__PURE__ */ new Map();
 	timers = /* @__PURE__ */ new Map();
 	flushing = /* @__PURE__ */ new Map();
+	/** Per group: my rows known to have an edit to say, each with when it was last told (`edit`), by `tick`. */
+	known = /* @__PURE__ */ new Map();
+	tick = 0;
+	/**
+	* The groups whose history was read for the rows with an edit to say: `known` has them all, and from then on those
+	* rows alone are read (`host.message`). An edit costs what it does in a short group, however long this one is.
+	*/
+	learnt = /* @__PURE__ */ new Set();
 	stopped = false;
 	constructor(host) {
 		this.host = host;
@@ -26758,6 +27116,7 @@ var GroupEdits = class {
 				mentions: mentions.length ? mentions : void 0
 			};
 		});
+		if (this.host.message) this.told(groupId).set(messageId, ++this.tick);
 		await this.host.changed(chat, messageId);
 		await this.flush(groupId).catch(() => {});
 		return {
@@ -26778,7 +27137,7 @@ var GroupEdits = class {
 		this.timers.delete(groupId);
 		if (this.stopped || !this.host.membership(groupId)) return;
 		const chat = chatOf(groupId), now = this.now();
-		const due = (await this.host.messages(chat)).filter((m) => m.sender === "me" && m.edit?.pending).sort((a, b) => a.edit.at - b.edit.at);
+		const due = (await this.pending(groupId)).sort((a, b) => a.edit.at - b.edit.at);
 		let pace = this.sendPace.get(groupId);
 		if (!pace) this.sendPace.set(groupId, pace = new RateWindow(10, EDIT_RATE_WINDOW_MS, this.now));
 		let retry = Infinity;
@@ -26809,6 +27168,33 @@ var GroupEdits = class {
 			this.flush(groupId).catch(() => {});
 		}, Math.max(50, retry)));
 	}
+	/**
+	* My rows of a group with an edit to say. The group's whole history is read for them once (always, with no
+	* `host.message` to read one by); after that the known rows alone, and one that waits no more is forgotten, unless
+	* it was told again while it was read.
+	*/
+	async pending(groupId) {
+		const waits = (m) => m.sender === "me" && !!m.edit?.pending;
+		const chat = chatOf(groupId), read = this.host.message;
+		if (!read || !this.learnt.has(groupId)) {
+			const rows = (await this.host.messages(chat)).filter(waits);
+			if (!read) return rows;
+			for (const m of rows) if (!this.told(groupId).has(m.id)) this.told(groupId).set(m.id, this.tick);
+			this.learnt.add(groupId);
+			return rows;
+		}
+		const known = this.told(groupId), asOf = this.tick, ids = [...known.keys()];
+		return (await Promise.all(ids.map((id) => read(chat, id)))).filter((m, i) => {
+			if (m && waits(m)) return true;
+			if ((known.get(ids[i]) ?? 0) <= asOf) known.delete(ids[i]);
+			return false;
+		});
+	}
+	told(groupId) {
+		let known = this.known.get(groupId);
+		if (!known) this.known.set(groupId, known = /* @__PURE__ */ new Map());
+		return known;
+	}
 	async find(chat, id) {
 		return this.host.message ? this.host.message(chat, id) : (await this.host.messages(chat)).find((m) => m.id === id);
 	}
@@ -26894,6 +27280,8 @@ var GroupEdits = class {
 	forget(groupId) {
 		clearTimeout(this.timers.get(groupId));
 		this.timers.delete(groupId);
+		this.known.delete(groupId);
+		this.learnt.delete(groupId);
 		this.buffer.forget(chatOf(groupId));
 	}
 	stop() {
@@ -27865,7 +28253,7 @@ var HoldEngine = class {
 			this.host.changed();
 			return;
 		}
-		const pointer = packet ? keys.readPointer(packet) : null;
+		const pointer = packet ? keys.readPointer(packet, this.host.loopbackStorage?.()) : null;
 		if (!pointer) return;
 		let hold = this.state(linkId);
 		if (pointer.rev < hold.peerPointerRev) return;
@@ -27904,11 +28292,12 @@ var HoldEngine = class {
 		try {
 			const manifest = keys.open(await this.fetchBytes(pointer.manifestUrl, HOLD_LIMITS.maxManifestBytes), {
 				maxBytes: HOLD_LIMITS.maxManifestBytes,
-				now
+				now,
+				loopback: this.host.loopbackStorage?.()
 			});
 			if (manifest.header.kind !== "manifest") throw new HoldRefusedError("format", "Not a manifest");
 			mailbox = manifest.header.mailbox;
-			entries = readManifest(manifest.header.meta).filter(([seq]) => seq > this.state(linkId).inSeq).sort((a, b) => a[0] - b[0]);
+			entries = readManifest(manifest.header.meta, this.host.loopbackStorage?.()).filter(([seq]) => seq > this.state(linkId).inSeq).sort((a, b) => a[0] - b[0]);
 		} catch (error) {
 			if (error instanceof HoldRefusedError) {
 				await this.save(linkId, {
@@ -28050,9 +28439,11 @@ var HoldEngine = class {
 		}
 	}
 	async readBytes(url, max, signal) {
+		if (!isHoldUrl(url, this.host.loopbackStorage?.())) throw new Error("The storage address is not one this app reads");
 		const response = await (this.host.fetch ?? ((...args) => fetch(...args)))(url, {
 			cache: "no-store",
 			credentials: "omit",
+			redirect: "error",
 			signal
 		});
 		if (!response.ok) throw new Error(`The storage answered ${response.status}`);
@@ -30682,6 +31073,9 @@ var CashuWallet = class CashuWallet {
 * taken back.
 */
 var UNIT = "sat";
+/** A contact's requests in one chat: the new ones taken per minute, and how many may wait to be paid. */
+var REQUESTS_PER_MINUTE = 20;
+var OPEN_REQUESTS = 50;
 var satsWord = (n) => `${n} sat${n === 1 ? "" : "s"}`;
 /**
 * A refused send's review, once its ecash came back: why, and exactly what came back. Taking ecash back is a swap at
@@ -30748,10 +31142,32 @@ var allows = (link, method) => method === "arkade" ? link.supportsArkPayments :
 var fedimintSats = (msats) => Math.floor(msats / 1e3);
 /** The distinct wallets of a per-network set (one object may stand for both). */
 var distinct = (each) => [...new Set(WALLET_NETWORKS.map((n) => each[n]))];
+/**
+* Every payment this device keeps, with the copy of them the pages get. The copy is made again only after a payment
+* changed: a state about anything else (typing, a file's progress) carries the one already made.
+*/
+var PaymentBook = class extends Map {
+	shown = null;
+	set(id, payment) {
+		this.shown = null;
+		return super.set(id, payment);
+	}
+	delete(id) {
+		this.shown = null;
+		return super.delete(id);
+	}
+	clear() {
+		this.shown = null;
+		super.clear();
+	}
+	views() {
+		return this.shown ??= Object.fromEntries([...this].map(([id, { token: _token, ...view }]) => [id, view]));
+	}
+};
 var PaymentDesk = class {
 	wallet;
 	host;
-	payments = /* @__PURE__ */ new Map();
+	payments = new PaymentBook();
 	paying = /* @__PURE__ */ new Map();
 	receiving = /* @__PURE__ */ new Map();
 	reclaims = /* @__PURE__ */ new Map();
@@ -30813,8 +31229,9 @@ var PaymentDesk = class {
 	records() {
 		return [...this.payments.values()];
 	}
+	/** What the pages see of every payment. The same record until a payment changes: read it, never write to it. */
 	views() {
-		return Object.fromEntries([...this.payments].map(([id, { token: _token, ...view }]) => [id, view]));
+		return this.payments.views();
 	}
 	async forgetLink(linkId) {
 		const paymentStore = await store(STORES$1.payments, "readwrite");
@@ -30823,6 +31240,7 @@ var PaymentDesk = class {
 			this.payments.delete(payment.id);
 			wrap(paymentStore.delete(payment.id));
 		}
+		this.requestsFrom.delete(linkId);
 	}
 	/** `confirmedReal`: the person confirmed a Mainnet send as real money; without it one is refused. */
 	async send(params) {
@@ -31477,9 +31895,24 @@ var PaymentDesk = class {
 			endpoints: [...payment.invoice ? [[ENDPOINT.bolt11, payment.invoice]] : [], ...payment.mints?.length ? [[ENDPOINT.cashu, cashuRequestPayload(payment.mints)]] : []]
 		};
 	}
+	/** New requests taken from each chat's contact lately. */
+	requestsFrom = /* @__PURE__ */ new Map();
+	/**
+	* Whether this chat has room for one more request of its contact: twenty new ones a minute, and fifty waiting to be
+	* paid at most. One left out is not lost: the contact's app sends its open requests again on every session.
+	*/
+	roomForRequest(linkId) {
+		let recent = this.requestsFrom.get(linkId);
+		if (!recent) this.requestsFrom.set(linkId, recent = new RateWindow(REQUESTS_PER_MINUTE, 6e4));
+		if (!recent.take()) return false;
+		let open = 0;
+		for (const p of this.payments.values()) if (p.linkId === linkId && p.kind === "request" && p.direction === "in" && p.state === "pending" && ++open >= OPEN_REQUESTS) return false;
+		return true;
+	}
 	/** `held`: picked up from the contact's storage while it was away (WISP 404): only what this device allows counts, and only Cashu or Lightning. */
 	async onPaymentRequest(linkId, request, held = false) {
 		if (this.find(linkId, request.id)?.linkId === linkId) return;
+		if (!this.roomForRequest(linkId)) return;
 		if (held && (findEndpoint(request.endpoints, ENDPOINT.usdt) || findEndpoint(request.endpoints, ENDPOINT.arkade) || findEndpoint(request.endpoints, ENDPOINT.bark) || findEndpoint(request.endpoints, ENDPOINT.bitcoin) || findEndpoint(request.endpoints, ENDPOINT.fedimint) || findEndpoint(request.endpoints, ENDPOINT.spark))) return;
 		if (findEndpoint(request.endpoints, ENDPOINT.usdt)) return this.receiveUsdtRequest(linkId, request);
 		const amount = parseSats(request.amount.value, request.amount.asset);
@@ -32043,6 +32476,22 @@ var PaymentDesk = class {
 			endpoint: [ENDPOINT.usdt, JSON.stringify({ txid: review.txid })]
 		});
 	}
+	/**
+	* One payment pays one request: a receipt for a request that already has one, under another payment id,
+	* is not another payment. Nothing is stored or shown for it; a paid request is answered again.
+	*/
+	repeatedReceipt(link, request, id) {
+		let repeated = false;
+		for (const p of this.payments.values()) if (p.id !== id && p.kind === "payment" && p.direction === "in" && p.requestId === request.id && p.linkId === request.linkId && p.state !== "failed") {
+			repeated = true;
+			break;
+		}
+		if (repeated && request.state === "settled") link?.sendPaymentResult({
+			id: request.id,
+			ok: true
+		});
+		return repeated;
+	}
 	async receiveUsdt(linkId, payment) {
 		const request = payment.requestId ? this.payments.get(payment.requestId) : void 0;
 		if (!this.host.getLink(linkId)?.supportsUsdtPayments || request?.target?.method !== "usdt" || request.linkId !== linkId || request.direction !== "out" || request.kind !== "request" || payment.amount.asset !== request.unit || payment.amount.value !== String(request.amount)) return;
@@ -32055,6 +32504,7 @@ var PaymentDesk = class {
 			return;
 		}
 		if (typeof txid !== "string" || !/^0x[a-fA-F0-9]{64}$/.test(txid) || existing?.state === "settled") return;
+		if (this.repeatedReceipt(this.host.getLink(linkId), request, payment.id)) return;
 		txid = txid.toLowerCase();
 		if ([...this.payments.values()].some((p) => p.txid?.toLowerCase() === txid && (p.linkId !== linkId || (p.kind === "request" ? p.id !== request.id : p.requestId !== request.id)))) return;
 		await this.save({
@@ -32222,7 +32672,7 @@ var PaymentDesk = class {
 		}
 		if ([...this.payments.values()].some((p) => p.txid === txid && (p.linkId !== linkId || (p.kind === "request" ? p.id !== request.id : p.requestId !== request.id)))) return;
 		if (typeof txid !== "string" || !/^[a-f0-9]{64}$/.test(txid) || existing?.state === "settled") return;
-		if (!existing && [...this.payments.values()].some((p) => p.kind === "payment" && p.direction === "in" && p.requestId === request.id && p.state === "pending")) return;
+		if (this.repeatedReceipt(link, request, payment.id)) return;
 		await this.save({
 			id: payment.id,
 			linkId,
@@ -32340,6 +32790,7 @@ var PaymentDesk = class {
 		const existing = this.payments.get(payment.id);
 		if (existing && (existing.linkId !== linkId || existing.direction !== "in" || existing.requestId !== request.id)) return;
 		if (existing || parseSats(payment.amount.value, payment.amount.asset) !== request.amount) return;
+		if (this.repeatedReceipt(link, request, payment.id)) return;
 		await this.save({
 			id: payment.id,
 			linkId,
@@ -32476,6 +32927,7 @@ var PaymentDesk = class {
 			return;
 		}
 		if (typeof hint !== "string" || !/^[0-9a-f]{64}$/.test(hint)) return;
+		if (this.repeatedReceipt(link, request, payment.id)) return;
 		const settled = request.state === "settled";
 		await this.save({
 			id: payment.id,
@@ -32824,6 +33276,7 @@ var PaymentDesk = class {
 		const existing = this.payments.get(payment.id);
 		if (existing && (existing.linkId !== linkId || existing.direction !== "in" || existing.requestId !== request.id)) return;
 		if (existing || parseSats(payment.amount.value, payment.amount.asset) !== request.amount) return;
+		if (this.repeatedReceipt(link, request, payment.id)) return;
 		const settled = request.state === "settled";
 		await this.save({
 			id: payment.id,
@@ -32947,6 +33400,20 @@ var PaymentDesk = class {
 		});
 	}
 	/**
+	* A contact's receipt that still waits for its money, dropped by hand (its chat line was deleted here): the
+	* request it answers can take another receipt. Money that does arrive still pays the request.
+	*/
+	async dropReceipt(id) {
+		const payment = this.payments.get(id), request = payment?.requestId ? this.payments.get(payment.requestId) : void 0;
+		if (payment?.kind !== "payment" || payment.direction !== "in" || payment.state !== "pending" || !payment.target) return;
+		if (request?.kind !== "request" || request.direction !== "out" || request.linkId !== payment.linkId || request.target?.method !== payment.target.method) return;
+		await this.save({
+			...payment,
+			state: "failed",
+			error: "Removed here"
+		});
+	}
+	/**
 	* A request of ours closed for good: the wallet it was paid through was removed. Nothing sends it again (replay,
 	* a group edge opening), and the contact is told now when the chat is open (a request to a group: every member
 	* reachable), so their app stops offering to pay it. `reason`: shown here; `told`: what the contact reads. Returns
@@ -33847,7 +34314,7 @@ var GhostlyNode = class GhostlyNode {
 				cue: "downloaded",
 				key: fileId
 			}, this.chatOf(linkId));
-			this.noteFileEnd(linkId, fileId, record.state === "done" ? void 0 : record.error ?? record.state);
+			this.noteFileEnd(linkId, fileId, record.state === "done" ? void 0 : record.error ?? record.state, !seen);
 		}
 	});
 	stateTimer = null;
@@ -34029,6 +34496,7 @@ var GhostlyNode = class GhostlyNode {
 		descriptors: () => this.providers().lightning,
 		host: () => this.providerHost(network),
 		hasMints: () => this.networkMints(network).length > 0,
+		fetch: (...request) => (this.options.lnurlFetch ?? globalThis.fetch)(...request),
 		events: {
 			changed: () => void this.refreshWallet(),
 			received: (op) => void this.desk.onLightningPaid(op),
@@ -34180,12 +34648,12 @@ var GhostlyNode = class GhostlyNode {
 			await this.messagesChanged(linkId, [messageId]);
 			this.emitState();
 		},
-		text: async (linkId, messageId) => (await db.getMessages(linkId)).find((m) => m.id === messageId)?.text ?? null,
+		text: async (linkId, messageId) => (await db.getMessage(linkId, messageId))?.text ?? null,
 		reply: async (linkId, messageId) => {
-			const message = (await db.getMessages(linkId)).find((m) => m.id === messageId);
+			const message = await db.getMessage(linkId, messageId);
 			return message && GhostlyNode.wireReply(message);
 		},
-		forwarded: async (linkId, messageId) => (await db.getMessages(linkId)).find((m) => m.id === messageId)?.forwarded,
+		forwarded: async (linkId, messageId) => (await db.getMessage(linkId, messageId))?.forwarded,
 		file: async (fileId) => {
 			const stored = await fileStore.get(fileId);
 			if (!stored?.metadata) return null;
@@ -34289,6 +34757,7 @@ var GhostlyNode = class GhostlyNode {
 		},
 		receivePaymentRequest: (linkId, request) => this.desk.onPaymentRequest(linkId, request, true),
 		changed: () => this.emitState(),
+		loopbackStorage: () => this.options.holdLoopback === true,
 		ttlMs: () => {
 			try {
 				const raw = typeof localStorage !== "undefined" ? localStorage.getItem("ghostly-test-hold-ttl") : null;
@@ -34459,6 +34928,8 @@ var GhostlyNode = class GhostlyNode {
 	* again those not confirmed after a while.
 	*/
 	reactionNotes = /* @__PURE__ */ new Map();
+	/** Each chat's notes shown before the one shown now, oldest first, the latest `REACTION_NOTES_KEPT` of this run. */
+	reactionNotesBefore = /* @__PURE__ */ new Map();
 	reactionsSent = /* @__PURE__ */ new Map();
 	reactionPace = /* @__PURE__ */ new Map();
 	reactionTimers = /* @__PURE__ */ new Map();
@@ -34480,9 +34951,12 @@ var GhostlyNode = class GhostlyNode {
 		message: (chat, id) => db.getMessage(chat, id),
 		patch: (chat, id, change) => db.patchMessage(chat, id, change),
 		changed: async (chat, id, note) => {
-			if (note) this.reactionNotes.set(chat, note);
-			else if (this.reactionNotes.get(chat)?.message === id) {
-				const before = latestReaction(await db.getMessages(chat));
+			const shown = this.reactionNotes.get(chat);
+			if (note) {
+				if (shown && (shown.message !== note.message || shown.by !== note.by)) this.reactionNotesBefore.set(chat, [...this.reactionNotesBefore.get(chat) ?? [], shown].slice(-8));
+				this.reactionNotes.set(chat, note);
+			} else if (shown?.message === id) {
+				const before = await this.reactionNoteNow(chat, shown);
 				if (before) this.reactionNotes.set(chat, before);
 				else this.reactionNotes.delete(chat);
 			}
@@ -34491,6 +34965,19 @@ var GhostlyNode = class GhostlyNode {
 		},
 		notify: (chat, key) => this.feedback("reaction", `${chat}:${key}`, chat)
 	});
+	/**
+	* The chat list's reaction once one to its message was taken back: the same one if it still stands, else the latest
+	* shown before it that does, each read from its own row. Only past those is the whole history read for an older one.
+	*/
+	async reactionNoteNow(chat, shown) {
+		const before = this.reactionNotesBefore.get(chat) ?? [];
+		for (let note = shown; note; note = before.pop()) {
+			const row = note.message ? await db.getMessage(chat, note.message) : void 0;
+			const standing = row && noteIfStanding(note, row);
+			if (standing) return standing;
+		}
+		return latestReaction(await db.getMessages(chat));
+	}
 	/** Private groups (WISP 900): sessions, admission on contact chats, and the pairwise edges that carry them. */
 	groups = new Groups({
 		sendOnLink: (linkId, frame) => {
@@ -35507,8 +35994,11 @@ var GhostlyNode = class GhostlyNode {
 	appCheckUpdates() {
 		return this.appStore.checkUpdates();
 	}
-	appUninstall(params) {
-		return this.appStore.uninstall(params);
+	/** Uninstalls an app. One running then is closed in every chat (the contact hears `close`), and the pages are told, to stop its frames. */
+	async appUninstall(params) {
+		await this.appStore.uninstall(params);
+		this.appsCloseOf(params.ref);
+		this.events.onAppsChecked?.();
 	}
 	appRunCheck(params) {
 		return this.appStore.runCheck(params);
@@ -35594,17 +36084,27 @@ var GhostlyNode = class GhostlyNode {
 			...this.settings.wakeMutedGroups?.includes(group.id) && { wakeMuted: true }
 		};
 	}
+	/** Per community, the members a payment here names, as read from one copy of the payments (`PaymentDesk.views`). */
+	communityPaid;
 	/** Community members payments go to (or came from), as links the payment bubbles and the composer look up by key. */
 	communityPayViews(groups) {
-		const withPayments = /* @__PURE__ */ new Map();
-		for (const p of Object.values(this.desk.views())) {
-			const at = parsePayLink(p.linkId);
-			if (at?.member) {
-				const set = withPayments.get(at.groupId) ?? /* @__PURE__ */ new Set();
-				set.add(at.member);
-				withPayments.set(at.groupId, set);
+		const payments = this.desk.views();
+		if (this.communityPaid?.of !== payments) {
+			const members = /* @__PURE__ */ new Map();
+			for (const p of Object.values(payments)) {
+				const at = parsePayLink(p.linkId);
+				if (at?.member) {
+					const set = members.get(at.groupId) ?? /* @__PURE__ */ new Set();
+					set.add(at.member);
+					members.set(at.groupId, set);
+				}
 			}
+			this.communityPaid = {
+				of: payments,
+				members
+			};
 		}
+		const withPayments = this.communityPaid.members;
 		return groups.filter((g) => g.profile === "community" && g.status === "active" && g.myKey).flatMap((g) => this.communityPay.views(g.id, g.myKey, g.members.map((m) => m.key), withPayments.get(g.id) ?? /* @__PURE__ */ new Set()));
 	}
 	/** The payment composer opened on a member of a community: ask what they take, if they did not say lately. */
@@ -36187,6 +36687,7 @@ var GhostlyNode = class GhostlyNode {
 		this.newestAt.delete(linkId);
 		this.placedAt.delete(linkId);
 		this.reactionNotes.delete(linkId);
+		this.reactionNotesBefore.delete(linkId);
 		this.events.onMessages(linkId, []);
 	}
 	async setGroupWakeMuted(groupId, muted) {
@@ -36734,7 +37235,9 @@ var GhostlyNode = class GhostlyNode {
 			card: edited.card
 		}));
 		await this.messagesChanged(linkId, [message.id]);
-		this.editsFor(linkId).flush().catch(() => {});
+		const edits = this.editsFor(linkId);
+		edits.edited(message.id);
+		edits.flush().catch(() => {});
 		return {
 			error: null,
 			messageId: message.id
@@ -36855,7 +37358,10 @@ var GhostlyNode = class GhostlyNode {
 					},
 					...done
 				};
-			}))?.edit?.pending) changed.push(message.id);
+			}))?.edit?.pending) {
+				changed.push(message.id);
+				this.editsFor(linkId).edited(message.id);
+			}
 		}
 		if (changed.length) await this.messagesChanged(linkId, changed);
 	}
@@ -36865,6 +37371,7 @@ var GhostlyNode = class GhostlyNode {
 		if (!queue) {
 			queue = new EditQueue({
 				read: () => db.getMessages(linkId),
+				row: (id) => db.getMessage(linkId, id),
 				ready: () => {
 					const live = this.links.get(linkId), link = live?.link;
 					return !!link && (link.supportsEdits || link.textDelivery === "dht" && this.takesDhtEdits(live));
@@ -36891,7 +37398,7 @@ var GhostlyNode = class GhostlyNode {
 	async retryMessage({ linkId, messageId }) {
 		const live = this.links.get(linkId);
 		if (!live?.stored.profile) throw new Error("Retry is only available for paired chat messages");
-		const message = (await db.getMessages(linkId)).find((m) => m.id === messageId);
+		const message = await db.getMessage(linkId, messageId);
 		if (message?.via === "hold") {
 			if (await this.hold.retry(linkId, messageId)) return;
 			if (!this.holdingFor(live)) throw new Error("Held messages need S3 storage (Profile → Backups) and a contact that allows them.");
@@ -37011,7 +37518,7 @@ var GhostlyNode = class GhostlyNode {
 	*/
 	async messageDetails({ linkId, messageId }) {
 		if (typeof linkId !== "string" || typeof messageId !== "string") throw new Error("Chat not found");
-		const message = (await db.getMessages(linkId)).find((m) => m.id === messageId);
+		const message = await db.getMessage(linkId, messageId);
 		if (!message) return null;
 		const live = this.links.get(linkId), stored = live?.stored;
 		const group = linkId.startsWith("group:") ? (await db.getGroups()).find((g) => g.id === linkId.slice(6)) : void 0;
@@ -37168,12 +37675,34 @@ var GhostlyNode = class GhostlyNode {
 		}));
 		return Promise.resolve();
 	}
-	/** A file transfer ended: when, on the message that carries the file. */
-	async noteFileEnd(linkId, fileId, error) {
-		const message = (await db.getMessages(linkId)).find((m) => m.file?.id === fileId);
+	/**
+	* The message that carries a file, read by its id: a file of mine is `me_<its time>`, a received one is named by its
+	* wire id (files/3, a held file) or by its sender's time (files/2). The chat's history is read only when none of
+	* those rows carries it, so a file costs the same in a long chat as in a short one.
+	*/
+	async fileMessage(linkId, fileId) {
+		const stored = await fileStore.get(fileId).catch(() => void 0);
+		const at = stored?.metadata?.timestamp, wireId = stored?.wireId;
+		const ids = !stored ? [] : fileId.startsWith(`${linkId}-out-`) ? [`me_${at}`] : [
+			`peer_${wireId}`,
+			`peer_${at}`,
+			`peer_${at}_${wireId}`
+		];
+		for (const id of ids) {
+			const message = await db.getMessage(linkId, id);
+			if (message?.file?.id === fileId) return message;
+		}
+		return (await db.getMessages(linkId)).find((m) => m.file?.id === fileId);
+	}
+	/**
+	* A file transfer ended: when, on the message that carries the file. `again`: it ended in an earlier run and is shown
+	* again as the chat connects, so what its message says of its end stays (only a receipt it never got is given).
+	*/
+	async noteFileEnd(linkId, fileId, error, again = false) {
+		const message = await this.fileMessage(linkId, fileId);
 		if (!message) return;
 		const now = Date.now();
-		await this.noteDetails(linkId, message.id, (details) => error ? message.sender === "me" && details.sends?.length ? {
+		if (!again) await this.noteDetails(linkId, message.id, (details) => error ? message.sender === "me" && details.sends?.length ? {
 			...details,
 			sends: details.sends.map((s, i) => i === details.sends.length - 1 ? {
 				...s,
@@ -37196,12 +37725,22 @@ var GhostlyNode = class GhostlyNode {
 		}
 	}
 	/**
+	* The message of mine that carries a payment or a request, read by its id: `me_<the time the desk keeps for it>`.
+	* The chat's history is read only when that row does not carry it, so it costs the same in a long chat as in a short one.
+	*/
+	async paymentMessage(linkId, paymentId) {
+		const at = this.desk.payment(paymentId)?.createdAt;
+		const message = at === void 0 ? void 0 : await db.getMessage(linkId, `me_${at}`);
+		if (message?.sender === "me" && message.paymentId === paymentId) return message;
+		return (await db.getMessages(linkId)).find((m) => m.sender === "me" && m.paymentId === paymentId);
+	}
+	/**
 	* The contact's app answered for a payment of mine (`pay-res`): its message gets two ticks, as a text gets from its
 	* receipt. A payment goes with no delivery state of its own, so its mark read one tick for good. 1:1 chats only: a
 	* group's payments live in the group's history, under other ids.
 	*/
 	async notePaymentReceipt(linkId, paymentId) {
-		const message = (await db.getMessages(linkId)).find((m) => m.sender === "me" && m.paymentId === paymentId);
+		const message = await this.paymentMessage(linkId, paymentId);
 		if (!message || message.delivery === "delivered") return;
 		if (await db.patchMessage(linkId, message.id, (m) => m.delivery === "delivered" ? null : {
 			delivery: "delivered",
@@ -37223,6 +37762,7 @@ var GhostlyNode = class GhostlyNode {
 		(async () => {
 			const message = await db.getMessage(linkId, messageId);
 			if (message?.paymentId && message.delivery === "waiting") await this.desk.withdraw(message.paymentId).catch(() => {});
+			if (message?.paymentId && message.sender === "peer") await this.desk.dropReceipt(message.paymentId).catch(() => {});
 			if (message?.sender === "me" && message.file && message.delivery === "waiting" && (message.fileOnFloor === "sent" || message.fileOnFloor === "seen")) {
 				const wireId = message.file.id.slice(`${linkId}-out-`.length);
 				live.link?.settleDht(dhtFileId(wireId)).catch(() => {});
@@ -37371,7 +37911,7 @@ var GhostlyNode = class GhostlyNode {
 		});
 		(async () => {
 			if (!reply || !forwarded) {
-				const message = (await db.getMessages(live.stored.id)).find((m) => m.id === `me_${timestamp}`);
+				const message = await db.getMessage(live.stored.id, `me_${timestamp}`);
 				reply ??= message && GhostlyNode.wireReply(message);
 				forwarded ??= message?.forwarded;
 			}
@@ -37418,9 +37958,10 @@ var GhostlyNode = class GhostlyNode {
 	}
 	fileAction({ linkId, fileId, action }) {
 		if (typeof linkId === "string" && linkId.startsWith("group:")) {
-			if (action !== "accept" && action !== "request") throw new Error("A group's file is downloaded (accept) or asked for again (request)");
 			if (!fileId.startsWith(`group-${linkId.slice(6)}-`)) throw new Error("No such file in this group");
-			return this.groups.downloadFile(fileId);
+			if (action === "accept" || action === "request" || action === "resume") return this.groups.downloadFile(fileId);
+			if (action === "cancel" || action === "decline" || action === "pause") return this.groups.haltFile(fileId, action === "pause");
+			throw new Error("A group's file is not sent again from here");
 		}
 		const live = this.links.get(linkId);
 		if (!live) throw new Error("No such chat");
@@ -37509,7 +38050,7 @@ var GhostlyNode = class GhostlyNode {
 		const error = await link.announceFile(offer, message.timestamp, GhostlyNode.wireReply(message), message.forwarded);
 		const said = !error && link.dhtPendingId === dhtFileId(offer.wireId);
 		if (!said && error !== "This file's name is too long to say over the DHT. It is sent when you are live.") return;
-		await db.patchMessage(linkId, message.id, (current) => current.delivery !== "waiting" || current.fileOnFloor ? null : {
+		const noted = await db.patchMessage(linkId, message.id, (current) => current.delivery !== "waiting" || current.fileOnFloor ? null : {
 			fileOnFloor: said ? "sent" : "unfit",
 			...said && { details: withSend(current.details, {
 				at,
@@ -37517,17 +38058,32 @@ var GhostlyNode = class GhostlyNode {
 				result: "sent"
 			}) }
 		});
+		if (said && noted) await live.floorFiles?.then((known) => known.set(dhtFileId(offer.wireId), message.id), () => {});
 		await this.messagesChanged(linkId, [message.id]);
 	}
 	/** A receipt on the DHT floor that names a waiting file's offer (`dhtFileId`): its bubble is in place on the contact's side. */
 	async fileSeenOnFloor(linkId, id) {
-		const prefix = `${linkId}-out-`;
-		const message = (await db.getMessages(linkId)).find((m) => m.sender === "me" && m.file?.id.startsWith(prefix) && m.fileOnFloor === "sent" && dhtFileId(m.file.id.slice(prefix.length)) === id);
-		if (!message) return;
-		if (await db.patchMessage(linkId, message.id, (current) => current.fileOnFloor !== "sent" ? null : {
+		const live = this.links.get(linkId);
+		if (!live) return;
+		const said = await this.floorFilesOf(live), messageId = said.get(id);
+		if (!messageId) return;
+		said.delete(id);
+		if (await db.patchMessage(linkId, messageId, (current) => current.fileOnFloor !== "sent" ? null : {
 			fileOnFloor: "seen",
 			...current.delivery === "waiting" && { deliveryError: "Your contact sees it. The file goes when you are live." }
-		})) await this.messagesChanged(linkId, [message.id]);
+		})) await this.messagesChanged(linkId, [messageId]);
+	}
+	/**
+	* The files of mine said on the floor and not seen there yet, their message by their floor id (`dhtFileId`). Read from
+	* the chat's history once in a run, then kept as files are said (`sayFileOnFloor`): a receipt that names none of them
+	* costs the same in a long chat as in a short one.
+	*/
+	floorFilesOf(live) {
+		const linkId = live.stored.id, prefix = `${linkId}-out-`;
+		return live.floorFiles ??= db.getMessages(linkId).then((history) => new Map(history.filter((m) => m.sender === "me" && m.file?.id.startsWith(prefix) && m.fileOnFloor === "sent").map((m) => [dhtFileId(m.file.id.slice(prefix.length)), m.id])), (error) => {
+			live.floorFiles = void 0;
+			throw error;
+		});
 	}
 	/**
 	* A file the contact said on the DHT floor (WISP 403 § Files): its bubble takes its place now, waiting for its bytes,
@@ -38121,8 +38677,7 @@ var GhostlyNode = class GhostlyNode {
 			error: "No button to press",
 			refused: true
 		};
-		const history = await db.getMessages(linkId);
-		const message = history.find((m) => m.id === messageId);
+		const message = await db.getMessage(linkId, messageId);
 		if (!message) return {
 			error: "That message is not in this chat",
 			refused: true
@@ -38131,6 +38686,8 @@ var GhostlyNode = class GhostlyNode {
 			error: "Buttons on your own message do nothing",
 			refused: true
 		};
+		const card = messageButtons(message);
+		const history = card && !card.closed && card.buttons.some((b) => b.once) ? await db.getMessages(linkId) : [];
 		const state = buttonsState(message, replyRef(message), history);
 		const button = state?.card.buttons.find((b) => b.id === buttonId);
 		if (!state || !button) return {
@@ -38179,8 +38736,7 @@ var GhostlyNode = class GhostlyNode {
 		if (!targets.length) throw new Error("No chat to forward to");
 		if (targets.length > 5) throw new Error(`Forward to at most 5 chats at once`);
 		if (linkId.startsWith("group:") ? !this.membership(linkId.slice(6)) : this.links.get(linkId)?.stored.group !== void 0 || !this.links.has(linkId)) throw new Error("Chat not found");
-		const history = await db.getMessages(linkId);
-		const chosen = ids.map((id) => history.find((m) => m.id === id));
+		const chosen = await Promise.all(ids.map((id) => db.getMessage(linkId, id)));
 		if (chosen.some((m) => !m)) throw new Error("That message is not in this chat");
 		const messages = chosen.sort((a, b) => a.timestamp - b.timestamp);
 		for (const message of messages) {
@@ -38512,11 +39068,11 @@ var GhostlyNode = class GhostlyNode {
 		const live = typeof linkId === "string" ? this.links.get(linkId) : void 0;
 		if (!live || live.stored.group || !live.stored.profile) throw new Error("No such chat");
 		if (!isAppRef(ref)) throw new Error("Not an app reference");
-		const { participationSeed, pairedPeerKey } = live.stored;
-		if (!participationSeed || !pairedPeerKey) throw new Error("This chat is not paired yet");
+		const mine = participationKeyOf(live), { pairedPeerKey } = live.stored;
+		if (!mine || !pairedPeerKey) throw new Error("This chat is not paired yet");
 		return {
 			live,
-			app: chatAppId(identityFromSeedB64(participationSeed).publicKey, publicKeyFromZ32(pairedPeerKey), ref)
+			app: chatAppId(publicKeyFromZ32(mine), publicKeyFromZ32(pairedPeerKey), ref)
 		};
 	}
 	/** The chat app id of an app in a paired chat: how the contact's frames name it. */
@@ -38527,10 +39083,13 @@ var GhostlyNode = class GhostlyNode {
 	* This side opened an app in a paired chat, or updated it: `open` goes to the contact now when the session is live,
 	* and again on every session that comes back while it stays open.
 	*/
-	async appOpen({ linkId, ref, version }) {
+	async appOpen({ linkId, ref, version, digest }) {
 		const { live, app } = this.appChat(linkId, ref);
 		if (!isAppVersion(version)) throw new Error("Not an app version");
-		await this.appStore.chatRunnable({ ref });
+		await this.appStore.chatRunnable({
+			ref,
+			digest
+		});
 		const open = live.appsOpen ??= /* @__PURE__ */ new Map();
 		if (live.link) live.link.openApp(app, version);
 		else open.set(app, version);
@@ -38543,10 +39102,13 @@ var GhostlyNode = class GhostlyNode {
 		else live.appsOpen?.delete(app);
 	}
 	/** One data frame of an app open on both sides, on the live session only; nothing is kept to send later. */
-	async appSend({ linkId, ref, data }) {
+	async appSend({ linkId, ref, data, digest }) {
 		const { live, app } = this.appChat(linkId, ref);
 		if (!live.appsOpen?.has(app)) return { error: "not-open" };
-		await this.appStore.chatRunnable({ ref });
+		await this.appStore.chatRunnable({
+			ref,
+			digest
+		});
 		return { error: live.link ? live.link.sendAppData(app, data) : "offline" };
 	}
 	/** Every page went away: no app runs here any more, so each open one is closed (`close` goes where it can). */
@@ -38554,6 +39116,16 @@ var GhostlyNode = class GhostlyNode {
 		for (const live of this.links.values()) for (const app of [...live.appsOpen?.keys() ?? []]) if (live.link) live.link.closeApp(app);
 		else live.appsOpen?.delete(app);
 	}
+	/** An app that went (uninstalled) is closed in every chat it was open in, as `appClose` does. */
+	appsCloseOf(ref) {
+		for (const [linkId, live] of this.links) {
+			if (!live.appsOpen?.size) continue;
+			const { app } = this.appChat(linkId, ref);
+			if (!live.appsOpen.has(app)) continue;
+			if (live.link) live.link.closeApp(app);
+			else live.appsOpen.delete(app);
+		}
+	}
 	/** Keeps a pin of a 1:1 chat when it is newer than the chat's; `out`: mine, to say until the contact confirms it. */
 	async keepLinkPin(linkId, pin, out) {
 		const live = this.links.get(linkId);
@@ -38616,6 +39188,7 @@ var GhostlyNode = class GhostlyNode {
 		const view = this.groups.views().find((g) => g.id === groupId);
 		if (!pin || !view?.myKey || view.status !== "active" || !view.members.some((m) => m.key === member)) return;
 		if (!mayPin(view.profile, member, view.members.find((m) => m.role === "admin")?.key)) return;
+		if (!pinIsNewer(this.groups.pinOf(groupId), pin)) return;
 		const kept = await this.pinCame(`group:${groupId}`, member === view.myKey ? "me" : member, pin);
 		if (!await this.groups.setPin(groupId, {
 			...kept,
@@ -38903,7 +39476,7 @@ var GhostlyNode = class GhostlyNode {
 	async closeRequest(paymentId, reason) {
 		const request = this.desk.payment(paymentId);
 		if (!request || !await this.desk.close(paymentId, reason, "your contact removed the wallet it was paid to")) return;
-		const message = (await db.getMessages(request.linkId)).find((m) => m.paymentId === paymentId && m.sender === "me");
+		const message = await this.paymentMessage(request.linkId, paymentId);
 		if (message) await this.hold.forget(request.linkId, message.id).catch(() => {});
 	}
 	/**
@@ -39742,6 +40315,7 @@ var GhostlyNode = class GhostlyNode {
 			if (settings[key] !== false) delete this.settings[key];
 			else this.settings[key] = false;
 			await db.putSettings(this.settings);
+			if (key === "autoDownloads" && settings[key] === false) await this.groups.autoDownloadsOff();
 		}
 		if (settings.publicProfiles !== void 0) {
 			if (settings.publicProfiles !== false) delete this.settings.publicProfiles;
@@ -41289,10 +41863,11 @@ var GhostlyNode = class GhostlyNode {
 					this.notePaymentReceipt(linkId, result.id).catch(() => {});
 				},
 				onFileStored: async (wire) => {
-					const stored = (await fileStore.listForLink(linkId)).find((file) => file.direction === "in" && file.wireId === wire.id);
-					if (!stored?.digest || !stored.metadata) return void 0;
-					if (stored.metadata.name !== wire.name || stored.metadata.size !== wire.size || stored.metadata.mime !== wire.mime || stored.metadata.timestamp !== wire.timestamp) return void 0;
-					return stored.digest;
+					if (!stored.group && !this.links.get(linkId)?.files.wireIds.has(wire.id)) return void 0;
+					const held = (await fileStore.listForLink(linkId)).find((file) => file.direction === "in" && file.wireId === wire.id);
+					if (!held?.digest || !held.metadata) return void 0;
+					if (held.metadata.name !== wire.name || held.metadata.size !== wire.size || held.metadata.mime !== wire.mime || held.metadata.timestamp !== wire.timestamp) return void 0;
+					return held.digest;
 				},
 				onFileIncoming: (file) => this.receiveFile(linkId, file),
 				onFileProgress: (id, transferred, direction) => this.fileProgress(this.localFileId(linkId, id, direction), transferred),
@@ -41431,7 +42006,7 @@ var GhostlyNode = class GhostlyNode {
 	get nativeFactories() {
 		const relay = this.relaysHyperdht ? this.hyperdhtRelay : "";
 		return {
-			...relay ? { "hyperdht/1": async (seedB64) => (await import("./hyperdhtRelay-DmTrpmba.js")).createRelayedHyperEndpoint(seedB64, relay) } : {},
+			...relay ? { "hyperdht/1": async (seedB64) => (await import("./hyperdhtRelay-CgYLaQz3.js")).createRelayedHyperEndpoint(seedB64, relay) } : {},
 			...this.options.nativeTransports,
 			...this.ownIrohRelays ? { "iroh/1": (seedB64) => this.options.nativeTransports["iroh/1"](seedB64, this.settings.irohRelays?.length ? { relays: [...this.settings.irohRelays] } : {}) } : {},
 			...this.options.irohWeb ? { "iroh/1": (seedB64) => createIrohWebEndpoint(seedB64, { relays: this.irohRelays }) } : {}
@@ -42236,4 +42811,4 @@ function signalKind(signal) {
 //#endregion
 export { EngineServer, hyperdhtRelayProblem as n, server_exports as t };
 
-//# sourceMappingURL=server-BGXmSYx_.js.map
+//# sourceMappingURL=server-Cy4ox7oD.js.map