@ghostlytools/cli 1.2.0 → 1.2.2

package/dist/ghostly.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { t as __exportAll } from "./assets/rolldown-runtime-8H4AJuhK.js";
-import { $ as SSHSIG_NAMESPACE, $a as readAppRevocations, $n as engineError, An as encodeDnsQuery, Ao as signalHasVideo, At as didJwsAlg, Bn as resolveLightningDestination, Bt as parseDidSignaturePaste, Cn as homeserverWebEndpoint, Co as RTC_CONFIG, Ct as DID_DOCUMENT_MAX_BYTES$1, Dn as dnsProofName, Do as callSignalHeardAt, Dt as checkDidJws, Ec as setLinkTraceSink, En as decodeDnsResponse, Eo as callRtcConfig, Et as DidError, Fa as RUN_RESULTS, Fc as openRelayPayload, Fn as recordsFromWellKnown, Ft as didWebFileUrl, Gc as fromBase64Url$1, Hc as MAX_AVATAR_LENGTH, Ht as staticDidDocument, Ia as STATUS_CARD_LIMITS, Ii as identityStatement, In as recordsName, It as didWebHost, Ja as appFingerprint, Jc as toZ32, Jt as resolveDidDht, Ka as APP_PREFIXES, Kc as randomBytes$1, Ki as irohDescriptor, Kr as sanitizeTypingStatus, La as buttonLabelClash, Ln as txtValue, Lt as normalizeDid, Ma as replySnippet, Mc as RELAY_PAYLOAD_MAX_BYTES, Mn as nip05RootKey, Mt as didWebDocumentUrl, Ni as boundVerifiedIdentity, Nn as normalizeDomain, Nt as didWebFile, On as domainTxtRecord, Oo as extractParamsFromSdp, Ot as checkDidSignature, Pa as ITEM_STATES, Pn as recordsFromTxt, Pt as didWebFileNames, Ra as checkStatusCard, Rn as wellKnownUrl, Rt as parseDid, Sn as pubkyProofPath, So as CALL_SIGNAL_MAX_AGE_MS, St as verifyAtprotoRecordProof, Tn as DOMAIN_FILE_MAX_BYTES, To as buildSdpFromSignal, Uc as sanitizeAvatar, Ur as TYPING_KINDS, Ut as strictBase64Url, Vn as decodeBolt11, Vr as transferEnded, Vt as signingKeys, Wr as TYPING_REFRESH_MS, Xa as checkAppRevokeStatement, Xc as utf8Encode, Ya as appRef, Yc as utf8Decode, Ys as inviteLink, Z as groupName, _ as readAppBundle, _n as isPubkyProofFolder, _t as isAtprotoDid, aa as PLAYABLE_AUDIO, ar as fetchesByItself, at as verifySshSignature, bn as pubkyProofCapability, bt as shortAtprotoDid, c as signAppStore, ca as fileMessageText, ci as checkPushEndpoint, ct as decodeAnyBitcoinAddress, dr as readGroupWantNo, dt as ATPROTO_PROOF_COLLECTION, ea as readImageMeta, eo as signAppObject, er as engineText, et as SshSigError, ft as ATPROTO_PROOF_SCOPE, g as isAppUrl, gn as isPubkyKey, gt as checkAtprotoProofRecord, h as checkAppManifest, hn as PUBKY_PROOF_MAX_BYTES, ho as GhostlyHttpError, ht as atprotoProofRkey, ia as sanitizeMime, in as WALLET_NETWORKS, ir as GROUP_WANT_NO_FRAME, it as sshSignCommand, ji as IdentityCheckUnavailable, jn as isPublicAddress, jt as didSignedMessages, kn as domainWellKnownFile, ko as parseCallSignal, kt as didGhostlyServiceEntry, l as APP_BUNDLE_LIMITS, la as parseVoiceMeta, ln as walletNetworkOf, lr as readGroupHave, lt as ATPROTO_DECLARED_SCOPE, m as assembleAppBundle, ma as RateWindow, mt as atprotoProofRecord, n as appStoreDecision, no as canonicalJson, nr as GROUP_HAVE_FRAME, nt as parseSshSignature, o as checkAppStoreIndex, oa as VOICE_LIMITS, oc as seedSigner, or as groupFileFallback, ot as verifyBitcoinMessage, pi as BUTTONS_CAPABILITY, pt as atprotoDidMethod, qa as APP_STATEMENT_LIMITS, qc as toBase64Url, qi as irohRelayUrl, ra as sanitizeFileName, ro as canonicalJsonBytes, rt as sameSshKey, s as readAppStore, sa as baseMime, sr as isGroupMessageId, st as BitcoinAddressError, to as signAppRevocation, tr as GROUP_FILE_LIMITS, tt as parseSshPublicKey, ua as voicePeaksOf, ur as readGroupWant, ut as ATPROTO_FULL_SCOPE, vn as newPubkyProofFolder, vt as normalizeAtprotoHandle, wn as pubkyHomeserverOf, wo as answersOffer, wt as DID_FILE_MAX_BYTES, xn as pubkyProofFile, xt as AtprotoProofError, yn as normalizePubkyKey, yo as LIMITS, yt as parseAtprotoDidDocument, zn as requestLnurlInvoice, zr as ChatFiles, zt as parseDidDocument } from "./assets/src-BMUcYQ7b.js";
+import { $ as groupName, $a as APP_PREFIXES, $c as sanitizeAvatar, $n as readGroupWantNo, At as checkDidSignature, Ba as RUN_RESULTS, Bo as signalHasVideo, Bt as parseDid, Ci as recordsFromWellKnown, Cn as pubkyProofFile, Ct as AtprotoProofError, Dn as requestLnurlInvoice, Dr as ChatFiles, Ei as wellKnownUrl, En as pubkyHomeserverOf, Et as DID_FILE_MAX_BYTES, Fa as replySnippet, Fo as buildSdpFromSignal, Ft as didWebFile, Ga as checkStatusCard, Gc as openRelayPayload, Gt as strictBase64Url, Ha as buttonLabelClash, Hc as RELAY_PAYLOAD_MAX_BYTES, Hn as engineText, Ht as parseDidSignaturePaste, Ic as setLinkTraceSink, Ii as boundVerifiedIdentity, Io as callRtcConfig, It as didWebFileNames, Jn as groupFileFallback, Kn as GROUP_WANT_NO_FRAME, La as ITEM_STATES, Lo as callSignalHeardAt, Lt as didWebFileUrl, Mo as CALL_SIGNAL_MAX_AGE_MS, Mr as TYPING_REFRESH_MS, Mt as didJwsAlg, No as RTC_CONFIG, Nt as didSignedMessages, On as resolveLightningDestination, Ot as DidError, Pi as IdentityCheckUnavailable, Po as answersOffer, Pr as sanitizeTypingStatus, Pt as didWebDocumentUrl, Qc as MAX_AVATAR_LENGTH, Qn as readGroupWant, Ra as PR_CHECKS, Ro as extractParamsFromSdp, Rt as didWebHost, Si as recordsFromTxt, Sn as pubkyProofCapability, St as shortAtprotoDid, Ti as txtValue, Tn as homeserverWebEndpoint, To as GhostlyHttpError, Tt as DID_DOCUMENT_MAX_BYTES$1, Ua as cardLine, Un as GROUP_FILE_LIMITS, Ut as signingKeys, Va as STATUS_CARD_LIMITS, Vn as engineError, Vt as parseDidDocument, Wa as cardUrl, Wn as GROUP_HAVE_FRAME, Wt as staticDidDocument, Xi as irohRelayUrl, Xr as checkPushEndpoint, Xt as resolveDidDht, Yi as irohDescriptor, Yn as isGroupMessageId, Zn as readGroupHave, _ as checkAppManifest, _a as RateWindow, _i as domainWellKnownFile, _n as PUBKY_PROOF_MAX_BYTES, _t as atprotoProofRkey, ac as inviteLink, al as utf8Decode, at as sameSshKey, bi as nip05RootKey, bn as newPubkyProofFolder, bt as normalizeAtprotoHandle, c as readAppStore, ca as PLAYABLE_AUDIO, co as signAppObject, ct as verifyBitcoinMessage, d as APP_BUNDLE_LIMITS, da as fileMessageText, dn as walletNetworkOf, do as canonicalJsonBytes, dt as ATPROTO_DECLARED_SCOPE, eo as APP_STATEMENT_LIMITS, fa as parseVoiceMeta, ft as ATPROTO_FULL_SCOPE, g as assembleAppBundle, gc as seedSigner, gi as domainTxtRecord, gt as atprotoProofRecord, hi as dnsProofName, ht as atprotoDidMethod, il as toZ32, it as parseSshSignature, jr as TYPING_KINDS, jt as didGhostlyServiceEntry, kn as decodeBolt11, ko as LIMITS, kr as transferEnded, kt as checkDidJws, la as VOICE_LIMITS, lo as signAppRevocation, lt as BitcoinAddressError, mi as decodeDnsResponse, mt as ATPROTO_PROOF_SCOPE, n as appStoreDecision, nl as randomBytes$1, no as appRef, nt as SshSigError, oa as sanitizeFileName, ol as utf8Encode, on as WALLET_NETWORKS, ot as sshSignCommand, pa as voicePeaksOf, pi as DOMAIN_FILE_MAX_BYTES, pt as ATPROTO_PROOF_COLLECTION, qn as fetchesByItself, ra as readImageMeta, rl as toBase64Url, ro as checkAppRevokeStatement, rt as parseSshPublicKey, s as checkAppStoreIndex, sa as sanitizeMime, so as readAppRevocations, st as verifySshSignature, ti as BUTTONS_CAPABILITY, tl as fromBase64Url$1, to as appFingerprint, tt as SSHSIG_NAMESPACE, u as signAppStore, ua as baseMime, uo as canonicalJson, ut as decodeAnyBitcoinAddress, v as isAppUrl, vi as encodeDnsQuery, vn as isPubkyKey, vt as checkAtprotoProofRecord, wi as recordsName, wn as pubkyProofPath, wt as verifyAtprotoRecordProof, xi as normalizeDomain, xn as normalizePubkyKey, xt as parseAtprotoDidDocument, y as readAppBundle, yi as isPublicAddress, yn as isPubkyProofFolder, yt as isAtprotoDid, za as PR_STATES, zi as identityStatement, zo as parseCallSignal, zt as normalizeDid } from "./assets/src-XzcHzneo.js";
 import { c as fileStore, f as store$1, i as STORES, m as wrap, o as databaseName, p as transact, u as openDb } from "./assets/idb-CTF6LF5B.js";
 import { a as fileBytesOf, i as fileBytes, l as FILE_BYTES_STEP } from "./assets/fileBytes-BcYZhNgF.js";
 import { createRequire } from "node:module";
@@ -14,11 +14,11 @@ import { schnorr } from "@noble/curves/secp256k1.js";
 import { wordlist } from "@scure/bip39/wordlists/english.js";
 import { access, constants, link, mkdir, open, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { createHash, createPrivateKey, generateKeyPairSync, randomBytes, timingSafeEqual } from "node:crypto";
 import { decode, npubEncode } from "nostr-tools/nip19";
 import { BunkerSigner } from "nostr-tools/nip46";
 import { SimplePool } from "nostr-tools/pool";
 import { generateSecretKey } from "nostr-tools/pure";
-import { createHash, createPrivateKey, generateKeyPairSync, randomBytes, timingSafeEqual } from "node:crypto";
 import { createServer as createServer$1 } from "node:http";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
@@ -35,7 +35,7 @@ import { IDBFactory, IDBKeyRange as IDBKeyRange$1, IDBTransaction } from "fake-i
 import { format } from "node:util";
 var package_default = {
 	name: "@ghostlytools/cli",
-	version: "1.2.0",
+	version: "1.2.2",
 	type: "module",
 	description: "Ghostly for bots and terminals: the app's own engine, headless on Node, behind a daemon and a `ghostly` command with JSON output.",
 	license: "MIT",
@@ -139,7 +139,7 @@ var CliError = class extends Error {
 /** Anything thrown, as the error a bot sees: the engine's own refusals keep their words. */
 function asCliError(error) {
 	if (error instanceof CliError) return error;
-	if (error && typeof error === "object" && "code" in error && "message" in error && typeof error.code === "string" && error.code in EXIT) return new CliError(error.code, String(error.message));
+	if (error && typeof error === "object" && "code" in error && "message" in error && typeof error.code === "string" && Object.hasOwn(EXIT, error.code)) return new CliError(error.code, String(error.message));
 	const local = localFileError(error);
 	if (local) return local;
 	const unopened = profileOpenError(error);
@@ -285,13 +285,21 @@ function parseArgs(argv, spec, idSlot = () => false) {
 }
 /** The global option a word names (`--profile`, `--profile=bot`, `-p`), else undefined. */
 function globalOption(arg) {
+	const name = globalName(arg);
+	return name ? GLOBAL_OPTIONS[name] : void 0;
+}
+/** The name of the global option a word names (`profile` for `-p`), else undefined. */
+function globalName(arg) {
 	const eq = arg.indexOf("=");
 	const name = arg.startsWith("--") ? arg.slice(2, eq === -1 ? void 0 : eq) : arg.length === 2 && arg.startsWith("-") ? Object.entries(GLOBAL_OPTIONS).find(([, o]) => o.short === arg.slice(1))?.[0] : void 0;
-	return name && Object.hasOwn(GLOBAL_OPTIONS, name) ? GLOBAL_OPTIONS[name] : void 0;
+	return name && Object.hasOwn(GLOBAL_OPTIONS, name) ? name : void 0;
 }
 /**
 * Global options given before the command (`ghostly --profile bot send …`) move after it, where every command's
-* parser reads them. Stops at `--` and at the first word that is not a global option.
+* parser reads them. Stops at `--` and at the first word that is not a global option. They go before the first word
+* after the command's that starts with a dash (its first option, or the `--` that ends them), else at the end: never
+* between an option and its value, which may itself be `--` (`--pretty profile set --name --`). One that takes a value
+* and is the last word has none: a usage error.
 */
 function liftGlobals(argv) {
 	const lifted = [];
@@ -302,15 +310,16 @@ function liftGlobals(argv) {
 		const option = globalOption(arg);
 		if (!option || arg === "--") break;
 		const takesValue = option.type !== "boolean" && eq === -1;
+		if (takesValue && i + 1 >= argv.length) throw new CliError("usage", `--${globalName(arg)} needs a value`);
 		lifted.push(...argv.slice(i, i + (takesValue ? 2 : 1)));
 		i += takesValue ? 2 : 1;
 	}
 	const rest = argv.slice(i);
-	const end = rest.indexOf("--");
-	return end === -1 ? [...rest, ...lifted] : [
-		...rest.slice(0, end),
+	const dash = rest[0] === "--" ? 0 : rest.findIndex((word, i) => i > 0 && word.startsWith("-"));
+	return dash === -1 ? [...rest, ...lifted] : [
+		...rest.slice(0, dash),
 		...lifted,
-		...rest.slice(end)
+		...rest.slice(dash)
 	];
 }
 //#endregion
@@ -333,14 +342,26 @@ var SECRET_CONTEXT = /priv(?:ate)?[\s_-]*key|secret|seed|mnemonic|nsec|xprv|\bwi
 /** How far from a 64-hex string a word like "seed" still counts as saying what it is. */
 var CONTEXT_REACH = 48;
 var CASHU_TOKEN = /\bcashu([AB])([A-Za-z0-9_\-+/]{20,}={0,2})/g;
+/**
+* Characters that take no room on screen: format characters (zero-width space, soft hyphen, word joiner, the joiners,
+* direction marks), control characters that are not white space, variation selectors, the grapheme joiner and the
+* Hangul fillers. A page, a PDF or a terminal puts some of them into long strings as places to break a line.
+*/
+var INVISIBLE = /(?![\t\n\v\f\r\x85])[\p{Cc}\p{Cf}]|\u034f|[\u115f\u1160\u3164\uffa0]|[\ufe00-\ufe0f]|[\u{e0100}-\u{e01ef}]/gu;
 var base58check = createBase58check(sha256);
-/** The first secret in `text`, keys and seeds before ecash; null for anything else. */
+/**
+* The first secret in `text`, keys and seeds before ecash; null for anything else. The text is read as it is and as
+* it reads without its invisible characters: a key with one inside is whole again once the reader takes it out.
+*/
 function findSecret(text) {
-	if (hasMnemonic(text)) return { kind: "mnemonic" };
-	if (NSEC.test(text)) return { kind: "nsec" };
-	if (EXTENDED_PRIVATE.test(text) || hasWif(text)) return { kind: "bitcoin-key" };
-	if (hasHexSecret(text)) return { kind: "hex-key" };
-	return findCashu(text);
+	const visible = text.replace(INVISIBLE, "");
+	const readings = visible === text ? [text] : [text, visible];
+	if (readings.some(hasMnemonic)) return { kind: "mnemonic" };
+	if (readings.some((reading) => NSEC.test(reading))) return { kind: "nsec" };
+	if (readings.some((reading) => EXTENDED_PRIVATE.test(reading) || hasWif(reading))) return { kind: "bitcoin-key" };
+	if (readings.some(hasHexSecret)) return { kind: "hex-key" };
+	const tokens = readings.map(findCashu);
+	return tokens.find((found) => found?.kind === "cashu" && found.amount !== null) ?? tokens.find((found) => found) ?? null;
 }
 /**
 * 12 to 24 words in a row from the English BIP39 list whose checksum holds, anywhere in the text; or a message that
@@ -814,66 +835,119 @@ var CONTACT_KEY = /^[ybndrfg8ejkmcpqxot1uwisza345h769]{52}$/;
 * itself (which the contact controls, so it never wins over a label).
 */
 function findChat(links, ref) {
+	return chatBy(links, ref).link;
+}
+/** `findChat`, and whether only the name the contact gave itself (`theirName`) found the chat. */
+function chatBy(links, ref) {
 	const exact = links.find((link) => link.id === ref);
-	if (exact) return exact;
+	if (exact) return {
+		link: exact,
+		theirName: false
+	};
 	if (CONTACT_KEY.test(ref)) {
 		const byKey = links.filter((link) => link.peerPubKeyZ32 === ref);
-		if (byKey.length === 1) return byKey[0];
+		if (byKey.length === 1) return {
+			link: byKey[0],
+			theirName: false
+		};
 		if (byKey.length > 1) throw new CliError("bad_request", `${JSON.stringify(ref)} names more than one chat: use its id`, { matches: byKey.map((link) => link.id) });
 		throw new CliError("not_found", `No chat with ${JSON.stringify(ref)}`);
 	}
 	const byPrefix = links.filter((link) => link.id.startsWith(ref));
-	if (byPrefix.length === 1) return byPrefix[0];
+	if (byPrefix.length === 1) return {
+		link: byPrefix[0],
+		theirName: false
+	};
 	const lower = ref.toLowerCase();
 	const named = (name) => name?.trim().toLowerCase() === lower;
 	const byLabel = links.filter((link) => named(link.label));
 	const byName = byLabel.length ? byLabel : links.filter((link) => named(link.peerNick));
-	if (byName.length === 1) return byName[0];
+	if (byName.length === 1) return {
+		link: byName[0],
+		theirName: !byLabel.length
+	};
 	if (byPrefix.length > 1 || byName.length > 1) throw new CliError("bad_request", `${JSON.stringify(ref)} names more than one chat: use its id`, { matches: [...byPrefix, ...byName].map((link) => link.id) });
 	throw new CliError("not_found", `No chat ${JSON.stringify(ref)}`);
 }
+/** Only an invitation so far: this profile is not in the group (yet), and whoever invited chose its name. */
+var invitedOnly = (group) => group.status === void 0 && !!group.invitation;
+/**
+* A group by its id, by a unique prefix of its id, or by its name. A group this profile is in wins over an invitation
+* with the same prefix or name (the one who invites chooses those); an invitation is still found by its id, and by
+* prefix or name where no group of this profile has it.
+*/
 function findGroup(groups, ref) {
 	const exact = groups.find((group) => group.id === ref);
 	if (exact) return exact;
-	const byPrefix = groups.filter((group) => group.id.startsWith(ref));
+	const mineFirst = (found) => {
+		const mine = found.filter((group) => !invitedOnly(group));
+		return mine.length ? mine : found;
+	};
+	const byPrefix = mineFirst(groups.filter((group) => group.id.startsWith(ref)));
 	if (byPrefix.length === 1) return byPrefix[0];
-	const byName = groups.filter((group) => group.name.trim().toLowerCase() === ref.toLowerCase());
+	const byName = mineFirst(groups.filter((group) => group.name.trim().toLowerCase() === ref.toLowerCase()));
 	if (byName.length === 1) return byName[0];
 	if (byPrefix.length > 1 || byName.length > 1) throw new CliError("bad_request", `${JSON.stringify(ref)} names more than one group: use its id`, { matches: [...byPrefix, ...byName].map((group) => group.id) });
 	throw new CliError("not_found", `No group ${JSON.stringify(ref)}`);
 }
-var chatOf = (ctx, params) => findChat(state(ctx).links, str(params, "chat", true));
 /**
-* A chat or a group, as `forward` names them: `group:<id>` is a group; anything else a chat first (id, prefix or name),
-* then a group. `linkId` is what the engine calls it.
+* A chat or a group, where a command takes either: `group:<id>` is a group; anything else a chat first (`findChat`),
+* then a group. A chat found only by the name its contact gave itself never takes what also names a group: a group's
+* own id is that group, and a prefix or the name of a group this profile is in is refused, with both ids. With neither,
+* one `not_found` names both and where to look (a contact's key: no chat with it); a name that matches more than one
+* chat or group stays that error.
 */
-function chatOrGroup(ctx, ref) {
-	if (ref.startsWith("group:")) {
-		const group = findGroup(state(ctx).groups, ref.slice(6));
-		return {
-			id: group.id,
-			linkId: `group:${group.id}`,
-			group: true
-		};
-	}
+function findChatOrGroup(links, groups, ref) {
+	if (ref.startsWith("group:")) return { group: findGroup(groups, ref.slice(6)) };
+	let chat;
 	try {
-		const link = findChat(state(ctx).links, ref);
-		return {
-			id: link.id,
-			linkId: link.id,
-			group: false
-		};
+		chat = chatBy(links, ref);
 	} catch (error) {
 		if (!(error instanceof CliError) || error.code !== "not_found") throw error;
-		const group = findGroup(state(ctx).groups, ref);
-		return {
-			id: group.id,
-			linkId: `group:${group.id}`,
-			group: true
-		};
+		try {
+			return { group: findGroup(groups, ref) };
+		} catch (inner) {
+			if (!(inner instanceof CliError) || inner.code !== "not_found") throw inner;
+			if (CONTACT_KEY.test(ref)) throw error;
+			throw new CliError("not_found", `No chat or group ${JSON.stringify(ref)} (ghostly chat list, ghostly group list)`);
+		}
 	}
+	if (!chat.theirName) return { link: chat.link };
+	const exact = groups.find((group) => group.id === ref);
+	if (exact) return { group: exact };
+	const lower = ref.toLowerCase();
+	const also = groups.filter((group) => !invitedOnly(group) && (group.id.startsWith(ref) || group.name.trim().toLowerCase() === lower));
+	if (also.length) throw new CliError("bad_request", `${JSON.stringify(ref)} names a chat (the name its contact chose) and a group: use the chat's id or group:<id>`, {
+		chat: chat.link.id,
+		groups: also.map((group) => group.id)
+	});
+	return { link: chat.link };
+}
+var chatOf = (ctx, params) => findChat(state(ctx).links, str(params, "chat", true));
+/** A chat or a group as `findChatOrGroup` reads it. `linkId` is what the engine calls it. */
+function chatOrGroup(ctx, ref) {
+	const found = findChatOrGroup(state(ctx).links, state(ctx).groups, ref);
+	return "group" in found ? {
+		id: found.group.id,
+		linkId: `group:${found.group.id}`,
+		group: true
+	} : {
+		id: found.link.id,
+		linkId: found.link.id,
+		group: false
+	};
 }
 var groupOf = (ctx, params) => findGroup(state(ctx).groups, str(params, "group", true));
+/**
+* A message of a chat or a group (`group:<id>`) named by its id here, read as one row; only a name that is no such
+* row's key (the id both sides know, `wireId`) reads the whole history. `keep`: only a message it accepts (mine, or
+* someone else's). The history is synchronous work on the daemon's one thread, about 120 ms at 10,000 messages.
+*/
+async function messageOf(ctx, linkId, ref, keep = () => true) {
+	const found = await node(ctx).getMessage(linkId, ref);
+	if (found && keep(found)) return found;
+	return (linkId.startsWith("group:") ? await node(ctx).groupMessages({ groupId: linkId.slice(6) }) : await node(ctx).getMessages(linkId)).find((m) => keep(m) && m.wireId === ref);
+}
 /** Resolves with `check`'s first defined answer: now, or on a later state; `timeout` error after `ms`. */
 function waitForState(ctx, check, ms, what) {
 	const now = check(state(ctx));
@@ -1089,6 +1163,12 @@ var storedGroupFiles = {
 	read: (file, offset, length) => readStored(file, offset, length),
 	room: async () => (await fileBytes()).room()
 };
+/**
+* Ended transfers an edge keeps the record of. A late frame for one of them is still answered as files/3 says (an abort
+* to an asker going on with a transfer cancelled here); older ones are forgotten, so an edge's records stay few
+* however many transfers it has seen.
+*/
+var ENDED_KEPT = 8;
 /** Why a want waits, as the person reads it (the app shows its own words for each `wait`). */
 var WAITING_NOTES = {
 	nobody: "Nobody you are connected to has this file yet",
@@ -1122,7 +1202,10 @@ var GroupFileDesk = class {
 	constructor(deps) {
 		this.deps = deps;
 	}
-	/** At start: each group's files as they were kept. One fetched by itself, or asked for, and not here yet is asked for again. */
+	/**
+	* At start: each group's files as they were kept. One fetched by itself, or asked for, and not here yet is asked for
+	* again; with automatic downloads off, one chosen by itself before waits for a Download instead.
+	*/
 	async load(groupIds) {
 		for (const groupId of groupIds) for (const file of await this.deps.store.list(groupId).catch(() => [])) {
 			if (!file.group || !file.metadata || !file.digest || this.kept.has(file.id)) continue;
@@ -1163,7 +1246,8 @@ var GroupFileDesk = class {
 				retry: true,
 				error: file.transfer.error ?? DAMAGED$1
 			});
-			else if (kept.auto || kept.asked) this.wants.set(kept.id, this.newWant());
+			else if (kept.asked || kept.auto && this.deps.settings().autoDownloads) this.wants.set(kept.id, this.newWant());
+			else if (kept.auto) await this.stop(kept, false);
 			else this.show(kept, {
 				state: "transferring",
 				stage: "asking",
@@ -1188,6 +1272,56 @@ var GroupFileDesk = class {
 		}
 	}
 	/**
+	* The person stops a file that is coming, or that this device would fetch (Cancel, Decline): nobody is asked for it
+	* any more, the transfer under way ends, what came of it is deleted, and it waits for a Download. Paused (`keep`),
+	* what came stays, and Resume (`download`) goes on from there.
+	*/
+	async halt(fileId, keep = false) {
+		const kept = this.kept.get(fileId);
+		if (!kept) throw new Error("No such file");
+		if (keep && !this.wants.has(fileId)) return;
+		await this.stop(kept, keep);
+	}
+	/** Automatic downloads were turned off: files chosen by themselves and not here yet stop coming, and wait for a Download. */
+	async autoDownloadsOff() {
+		for (const kept of [...this.kept.values()]) if (kept.auto && !kept.asked && this.wants.has(kept.id)) await this.stop(kept, false);
+	}
+	async stop(kept, keep) {
+		if (kept.held || kept.mine) return;
+		const want = this.wants.get(kept.id);
+		this.wants.delete(kept.id);
+		const edge = want?.wire && want.linkId ? this.edgesById.get(want.linkId) : void 0;
+		const record = edge?.files.get("in", want.wire);
+		const { size } = kept.meta;
+		if (!keep) {
+			kept.stored = 0;
+			kept.fresh = true;
+		}
+		if (edge && record && !transferEnded(record)) {
+			if (!keep) kept.dropped = record.id;
+			edge.files.cancel("in", record.id);
+			edge.taking.delete(record.id);
+		} else if (!keep) kept.idle = (kept.idle ?? Promise.resolve()).then(() => this.deps.store.write(kept.id)).then((writer) => writer.discard()).catch(() => {});
+		this.show(kept, keep ? {
+			state: "transferring",
+			stage: "paused",
+			pausedBy: "me",
+			transferred: kept.stored ?? 0,
+			size,
+			direction: "in"
+		} : {
+			state: "transferring",
+			stage: "asking",
+			transferred: 0,
+			size,
+			direction: "in"
+		});
+		if (kept.auto || kept.asked) {
+			kept.auto = kept.asked = false;
+			await this.deps.store.patch(kept.id, { group: this.groupField(kept) }).catch(() => {});
+		}
+	}
+	/**
 	* An error when this group took as many announcements of mine as it takes in a minute, or as its members take from
 	* one member in `announceWindowMs` (past that they would get the text, not the file); null when one may go now.
 	*/
@@ -1654,20 +1788,35 @@ var GroupFileDesk = class {
 		const reserved = active.reduce((sum, a) => sum + a.size, 0);
 		return this.served.bytes + reserved + kept.meta.size > GROUP_FILE_LIMITS.serveBytesPerDay ? "busy" : null;
 	}
-	/** Transfers served now, all groups together: to whom, their size, and whether bytes are still to go. */
+	/**
+	* Transfers served now, all groups together: to whom, what each takes of the day (its size, or what it sent when that
+	* is more), and whether bytes are still to go.
+	*/
 	servingNow() {
 		const active = [];
 		for (const edge of this.edgesById.values()) for (const wire of edge.serving.keys()) {
 			const record = edge.files.get("out", wire);
 			if (record && !transferEnded(record)) active.push({
 				peer: edge.peer,
-				size: record.file.size,
+				size: Math.max(record.file.size, edge.files.sent(wire)),
 				sending: record.confirmed < record.file.size
 			});
 		}
 		return active;
 	}
 	/**
+	* An asker has a served transfer send parts again (WISP 503 § Serving limits): every byte sent counts toward the day,
+	* so it goes on only while the day has room for it.
+	*/
+	mayResend() {
+		const today = Math.floor(this.deps.now() / 864e5);
+		if (this.served.day !== today) this.served = {
+			day: today,
+			bytes: 0
+		};
+		return this.served.bytes + this.servingNow().reduce((sum, a) => sum + a.size, 0) < GROUP_FILE_LIMITS.serveBytesPerDay;
+	}
+	/**
 	* Served transfers that no longer count end, their places free for others (WISP 503 § Serving limits): the asker's
 	* session closed, it is not in the roster any more, or its bytes have not moved for `wantWaitMs` (the asker has moved
 	* on by then).
@@ -1720,6 +1869,7 @@ var GroupFileDesk = class {
 			serving: /* @__PURE__ */ new Map(),
 			servedMoved: /* @__PURE__ */ new Map(),
 			taking: /* @__PURE__ */ new Map(),
+			ended: [],
 			have: /* @__PURE__ */ new Set(),
 			haveAt: 0,
 			busy: /* @__PURE__ */ new Set()
@@ -1737,7 +1887,8 @@ var GroupFileDesk = class {
 			openSource: (record) => this.openSource(edge, record),
 			changed: (record, transferred) => this.transferChanged(edge, record, transferred),
 			room: () => this.deps.store.room(),
-			writable: () => this.deps.writable?.(linkId)
+			writable: () => this.deps.writable?.(linkId),
+			resend: (record) => !edge.serving.has(record.id) || this.mayResend()
 		});
 		this.edgesById.set(linkId, edge);
 		return edge;
@@ -1776,7 +1927,7 @@ var GroupFileDesk = class {
 					if (resumed) kept.fresh = kept.unclear = true;
 					else kept.damaged.add(edge.peer);
 				}
-				return kept.idle = (damaged ? writer.discard() : writer.close()).catch(() => {});
+				return kept.idle = (damaged || kept.dropped === record.id ? writer.discard() : writer.close()).catch(() => {});
 			}
 		};
 	}
@@ -1789,7 +1940,14 @@ var GroupFileDesk = class {
 			digest: async () => kept.meta.d
 		};
 	}
+	/** A transfer on the edge ended: its record stays among the last `ENDED_KEPT`, and the oldest past that is forgotten. */
+	transferOver(edge, record) {
+		if (edge.ended.some(([direction, id]) => direction === record.direction && id === record.id)) return;
+		edge.ended.push([record.direction, record.id]);
+		while (edge.ended.length > ENDED_KEPT) edge.files.forget(...edge.ended.shift());
+	}
 	transferChanged(edge, record, transferred) {
+		if (transferEnded(record)) this.transferOver(edge, record);
 		if (record.direction === "out") {
 			if (transferEnded(record) && edge.serving.has(record.id)) {
 				const today = Math.floor(this.deps.now() / 864e5);
@@ -1797,7 +1955,7 @@ var GroupFileDesk = class {
 					day: today,
 					bytes: 0
 				};
-				this.served.bytes += record.confirmed;
+				this.served.bytes += edge.files.sent(record.id);
 				edge.serving.delete(record.id);
 				edge.servedMoved.delete(record.id);
 				const serving = this.deps.settings().serveFiles;
@@ -2375,24 +2533,8 @@ function filesOf(messages, transfers) {
 		transfer: transfers[m.file.id] ?? null
 	}));
 }
-/**
-* The chat a file command names, or else a group (`group:<id>`, or a group's id, prefix or name where no chat has it),
-* as `forward` reads them. A name that is neither says what a chat would.
-*/
-function chatOrGroupOf(ctx, params) {
-	const ref = str(params, "chat", true);
-	if (ref.startsWith("group:")) return { group: findGroup(state(ctx).groups, ref.slice(6)) };
-	try {
-		return { link: chatOf(ctx, params) };
-	} catch (error) {
-		if (!(error instanceof CliError) || error.code !== "not_found") throw error;
-		try {
-			return { group: findGroup(state(ctx).groups, ref) };
-		} catch {
-			throw error;
-		}
-	}
-}
+/** The chat or the group a file command names (`findChatOrGroup`). */
+var chatOrGroupOf = (ctx, params) => findChatOrGroup(state(ctx).links, state(ctx).groups, str(params, "chat", true));
 /**
 * The chat or group a file belongs to: a file id starts with its chat's id (a group's file with `group-<id>-`), so it
 * may be left out; given, it must be the file's own. `where` is what the answer names it by.
@@ -2529,6 +2671,15 @@ function fitName(name) {
 	while (stem.length && !fits(stem.join("").trimEnd() + extension)) stem.pop();
 	return (stem.join("").trimEnd() || "file") + extension;
 }
+/**
+* The name `file save --dir` writes a file under. Its sender chose it, and the folder is one scripts and people run
+* tools in: a name that starts with a dash is an option to the tool a `*` hands it to ("-rf", "--checkpoint-action=…"),
+* so it gets a `_` first, as a Windows device name does in `sanitizeFileName`.
+*/
+function saveName(name) {
+	const clean = sanitizeFileName(name);
+	return fitName(clean.startsWith("-") ? `_${clean}` : clean);
+}
 var ACTIONS = [
 	"accept",
 	"decline",
@@ -2636,15 +2787,16 @@ var FILE_METHODS = {
 	/**
 	* files/3: answer an offer, or pause, resume or cancel a transfer, either way; `resend` a file sent from here that
 	* stopped moving (or failed), `request` again one that stopped arriving. Without a chat, the file's id names it.
-	* A group's file (WISP 503) takes `accept` (download one this device did not fetch by itself) and `request`.
+	* A group's file (WISP 503) takes `accept` (download one this device did not fetch by itself), `request`, and `cancel`,
+	* `decline`, `pause` and `resume` for one that is coming.
 	*/
 	async "file.action"(ctx, params) {
 		const fileId = str(params, "file", true);
 		const { linkId, where } = fileChat(ctx, params, fileId);
 		const action = oneOf(params, "action", ACTIONS, "accept");
 		if ("group" in where) {
-			if (action !== "accept" && action !== "request") throw new CliError("bad_request", "A group's file is downloaded (file accept) or asked for again (file request)");
-			if (state(ctx).transfers[fileId]?.state === "done") throw new CliError("refused", "Nothing to ask for: the file is all here");
+			if (action === "resend") throw new CliError("bad_request", "A group's file is downloaded (file accept) or asked for again (file request)");
+			if (state(ctx).transfers[fileId]?.state === "done") throw new CliError("refused", action === "accept" || action === "request" || action === "resume" ? "Nothing to ask for: the file is all here" : "Nothing to stop: the file is all here");
 			try {
 				await node(ctx).fileAction({
 					linkId,
@@ -2717,7 +2869,7 @@ var FILE_METHODS = {
 			size: transfer.size
 		};
 	},
-	/** Writes a received (or sent) file to disk: into `dir` under its own name, or to `path`. Never over a file unless `force`. */
+	/** Writes a received (or sent) file to disk: into `dir` under its own name (`saveName`), or to `path`. Never over a file unless `force`. */
 	async "file.save"(ctx, params) {
 		const fileId = str(params, "file", true);
 		if (params.chat !== void 0) fileChat(ctx, params, fileId);
@@ -2730,7 +2882,7 @@ var FILE_METHODS = {
 		if (stored.leftOut) throw new CliError("not_found", "Not in this backup: the light backup this profile was restored from left the file out");
 		const transfer = state(ctx).transfers[fileId] ?? stored.transfer;
 		if (transfer && transfer.state !== "done") throw new CliError("unavailable", `The file is not all here yet (${transfer.transferred} of ${transfer.size} bytes)`);
-		const target = str(params, "path") ? resolve(str(params, "path", true)) : join(resolve(str(params, "dir") ?? "."), fitName(sanitizeFileName(stored.metadata.name)));
+		const target = str(params, "path") ? resolve(str(params, "path", true)) : join(resolve(str(params, "dir") ?? "."), saveName(stored.metadata.name));
 		const flags = bool(params, "force") ? "w" : "wx";
 		let out;
 		try {
@@ -2922,12 +3074,74 @@ function checked$1(card) {
 	if ("error" in result) throw new CliError("bad_request", `Status card: ${result.error}`, { card });
 	return result.card;
 }
-/** The latest message of mine in this chat or group with a card of this kind and id: the one an update edits. */
+/** Every text in a card's fields (title, step, items, runs, links…), as the contact's app may show it. */
+function cardTexts(value, out = []) {
+	if (typeof value === "string") out.push(value);
+	else if (Array.isArray(value)) for (const item of value) cardTexts(item, out);
+	else if (isObject(value)) for (const item of Object.values(value)) cardTexts(item, out);
+	return out;
+}
+/**
+* The secret guard `send` has (docs/CLI.md § Safety): a card whose text looks like a seed, a private key or a Cashu
+* token goes only with `--force`. `fields` are what this command gives (an update's own, not the card it merges over).
+* A card's text is read as given and as the card carries it (`cardLine`): a line loses its invisible characters on the
+* way, so a key one of them broke in two is whole again on the card. The fallback text goes as it is, as `send`'s.
+*/
+function guardSecrets(fields, params, verb) {
+	if (bool(params, "force")) return;
+	const check = (text) => {
+		const secret = findSecret(text);
+		if (secret) throw new CliError("confirm", `The card's text looks like ${secret.kind === "cashu" ? "a Cashu token (money anyone who reads it can take)" : "a secret (a seed or a private key)"}; ${verb} it with --force if you mean to`, { kind: secret.kind });
+	};
+	for (const text of cardTexts([fields, params.run])) {
+		check(text);
+		check(cardLine(text, Infinity) ?? "");
+	}
+	if (typeof params.text === "string") check(params.text);
+}
+/** Per card (its chat or group, its kind and its id): the message of mine that carries it, as this process last saw it. */
+var carriers = /* @__PURE__ */ new WeakMap();
+var carrierKey = (linkId, kind, id) => `${linkId}\n${kind}\n${id}`;
+function carriersOf(ctx) {
+	let map = carriers.get(ctx);
+	if (map) return map;
+	carriers.set(ctx, map = /* @__PURE__ */ new Map());
+	const cards = map;
+	ctx.hub.onEvent((event) => {
+		if (event.type !== "message.sent" && event.type !== "group.sent") return;
+		const message = event.message;
+		const card = message?.card;
+		if (typeof message?.id !== "string" || typeof card?.id !== "string" || card.kind !== "task" && card.kind !== "routine" && card.kind !== "usage") return;
+		carried(cards, carrierKey(event.type === "group.sent" ? `group:${String(event.group)}` : String(event.chat), card.kind, card.id), message.id);
+	});
+	return map;
+}
+function carried(cards, key, messageId) {
+	cards.delete(key);
+	cards.set(key, messageId);
+	if (cards.size > 1e3) cards.delete(cards.keys().next().value);
+}
+/**
+* The latest message of mine in this chat or group with a card of this kind and id: the one an update edits. A card
+* this process sent or found before is read by its message's key, so its updates cost the same in a long chat as in a
+* short one; only a card not seen yet (the first update after a start, a one-shot) is looked for in the whole history.
+*/
 async function cardMessage(ctx, target, kind, id) {
+	const cards = carriersOf(ctx), key = carrierKey(target.linkId, kind, id);
+	const carries = (message) => message?.sender === "me" && message.card?.kind === kind && message.card.id === id;
+	const known = cards.get(key);
+	if (known !== void 0) {
+		const message = await node(ctx).getMessage(target.linkId, known);
+		if (carries(message)) return message;
+		cards.delete(key);
+	}
 	const messages = target.group ? await node(ctx).groupMessages({ groupId: target.id }) : await node(ctx).getMessages(target.linkId);
+	if (cards.has(key)) return cardMessage(ctx, target, kind, id);
 	for (let i = messages.length - 1; i >= 0; i--) {
 		const message = messages[i];
-		if (message.sender === "me" && message.card?.kind === kind && message.card.id === id) return message;
+		if (!carries(message)) continue;
+		carried(cards, key, message.id);
+		return message;
 	}
 	throw new CliError("not_found", `No ${kind} ${JSON.stringify(id)} of yours in this ${target.group ? "group" : "chat"}: send it first with ghostly ${kind} send`);
 }
@@ -2955,6 +3169,7 @@ async function parentThere(ctx, target, card) {
 async function sendCard(ctx, params, kind) {
 	const target = chatOrGroup(ctx, str(params, "chat", true));
 	const fields = fieldsOf(params);
+	guardSecrets(fields, params, "send");
 	const now = Date.now();
 	const id = typeof fields.id === "string" && fields.id ? fields.id : `${kind}-${toBase64Url(randomBytes$1(6))}`;
 	const card = checked$1(withRun({
@@ -2985,6 +3200,7 @@ async function sendCard(ctx, params, kind) {
 			card
 		});
 		if (result.error || !result.messageId) throw new CliError(result.refused ? "refused" : "unavailable", result.error ?? "Nothing to send");
+		carried(carriersOf(ctx), carrierKey(target.linkId, kind, id), result.messageId);
 		const edges = wait === "sent" ? await waitForGroupFrame(ctx, target.id, result.messageId, void 0, ms) : void 0;
 		return answer(target, kind, id, result.messageId, {
 			card,
@@ -2998,6 +3214,7 @@ async function sendCard(ctx, params, kind) {
 	});
 	if (result.error) throw new CliError(result.refused ? "refused" : "unavailable", result.error);
 	if (!result.messageId) throw new CliError("bad_request", "Nothing to send");
+	carried(carriersOf(ctx), carrierKey(target.linkId, kind, id), result.messageId);
 	let message = await node(ctx).getMessage(target.linkId, result.messageId);
 	if (wait !== "none") message = await waitForMessage(ctx, target.linkId, result.messageId, wait, ms);
 	return answer(target, kind, id, result.messageId, {
@@ -3024,6 +3241,7 @@ async function updateCard(ctx, params, kind) {
 	const target = chatOrGroup(ctx, str(params, "chat", true));
 	const id = str(params, kind, true);
 	const patch = fieldsOf(params);
+	guardSecrets(patch, params, "update");
 	const message = await cardMessage(ctx, target, kind, id);
 	if ((message.edit?.seq ?? 0) >= STATUS_CARD_LIMITS.edits) throw new CliError("refused", `This ${kind}'s message took ${STATUS_CARD_LIMITS.edits} updates, the most one takes: start a new card with ghostly ${kind} send (a new --id, or the same one: the newest card of an id stands for it)`, {
 		messageId: message.id,
@@ -3065,7 +3283,7 @@ async function updateCard(ctx, params, kind) {
 		pace.last = Date.now();
 		await editCard(ctx, target, message.id, card, text);
 	}
-	let edited = target.group ? (await node(ctx).groupMessages({ groupId: target.id })).find((m) => m.id === message.id) : await node(ctx).getMessage(target.linkId, message.id);
+	let edited = await node(ctx).getMessage(target.linkId, message.id);
 	if (wait === "confirmed" && edited?.edit?.pending) edited = await waitForEdit(ctx, target.linkId, message.id, ms);
 	const edges = wait === "sent" && edited?.edit ? await waitForGroupFrame(ctx, target.id, message.id, edited.edit.seq, ms) : void 0;
 	return answer(target, kind, id, message.id, {
@@ -3245,8 +3463,7 @@ function pressable(link) {
 	return peer ? peer.includes(BUTTONS_CAPABILITY) : null;
 }
 /** The message of mine with buttons that `button update` names, by its id here (or the id both sides know). */
-function buttonsMessage(messages, ref, group) {
-	const message = messages.find((m) => m.sender === "me" && m.id === ref) ?? messages.find((m) => m.sender === "me" && m.wireId === ref);
+function buttonsMessage(message, ref, group) {
 	if (!message) throw new CliError("not_found", `No message ${JSON.stringify(ref)} of yours in this ${group ? "group" : "chat"}: the messageId send gave`);
 	if (message.card?.kind !== "buttons") throw new CliError("bad_request", "That message has no buttons: send one with send --button id:Label");
 	return message;
@@ -3266,12 +3483,13 @@ async function updateButtons(ctx, params) {
 		const secret = findSecret(newText);
 		if (secret) throw new CliError("confirm", `The text looks like ${secret.kind === "cashu" ? "a Cashu token (money anyone who reads it can take)" : "a secret (a seed or a private key)"}; update with --force if you mean to`, { kind: secret.kind });
 	}
-	const message = buttonsMessage(target.group ? await node(ctx).groupMessages({ groupId: target.id }) : await node(ctx).getMessages(target.linkId), ref, target.group);
+	const message = buttonsMessage(await messageOf(ctx, target.linkId, ref, (m) => m.sender === "me"), ref, target.group);
 	if ((message.edit?.seq ?? 0) >= STATUS_CARD_LIMITS.edits) throw new CliError("refused", `This message took ${STATUS_CARD_LIMITS.edits} updates, the most one takes: ask again with a new send`, {
 		messageId: message.id,
 		edits: message.edit.seq
 	});
 	const before = message.card;
+	if (chosen !== void 0 && !before.buttons.some((b) => b.id === chosen)) throw new CliError("bad_request", `That message has no button ${JSON.stringify(chosen)}; its buttons: ${before.buttons.map((b) => b.id).join(", ")}`, { card: before });
 	const card = checked({
 		...before,
 		...chosen !== void 0 && { chosen },
@@ -3290,7 +3508,7 @@ async function updateButtons(ctx, params) {
 		card
 	});
 	if (result.error) throw new CliError(result.refused ? "refused" : "unavailable", result.error);
-	let edited = target.group ? (await node(ctx).groupMessages({ groupId: target.id })).find((m) => m.id === message.id) : await node(ctx).getMessage(target.linkId, message.id);
+	let edited = await node(ctx).getMessage(target.linkId, message.id);
 	if (wait === "confirmed" && edited?.edit?.pending) edited = await waitForEdit(ctx, target.linkId, message.id, ms);
 	const edges = wait === "sent" && edited?.edit ? await waitForGroupFrame(ctx, target.id, message.id, edited.edit.seq, ms) : void 0;
 	return {
@@ -3313,8 +3531,7 @@ async function pressButton(ctx, params) {
 	const ref = str(params, "message", true);
 	const buttonId = str(params, "button", true);
 	const where = target.group ? "group" : "chat";
-	const theirs = (target.group ? await node(ctx).groupMessages({ groupId: target.id }) : await node(ctx).getMessages(target.linkId)).filter((m) => m.sender !== "me");
-	const message = theirs.find((m) => m.id === ref) ?? theirs.find((m) => m.wireId === ref);
+	const message = await messageOf(ctx, target.linkId, ref, (m) => m.sender !== "me");
 	if (!message) throw new CliError("not_found", `No message ${JSON.stringify(ref)} from someone else in this ${where}: the id its event or history gave`);
 	if (message.card?.kind !== "buttons") throw new CliError("bad_request", "That message has no buttons");
 	const button = message.card.buttons.find((b) => b.id === buttonId);
@@ -3473,7 +3690,7 @@ function isLive(link) {
 	if (link.textDelivery !== "stream" || link.dataLink !== "open") return false;
 	return !link.profile || link.pairing?.status === "ready" && !!link.pairing.transport;
 }
-function chatJson(link) {
+function chatJson(link, showSecret) {
 	const label = link.label?.trim() || null;
 	const peerName = link.peerNick?.trim() || null;
 	const live = isLive(link);
@@ -3491,15 +3708,15 @@ function chatJson(link) {
 		pairing: link.pairing?.status ?? null,
 		stage: link.pairingProgress?.stage ?? null,
 		verified: !!link.peerVerified,
-		invite: link.pairing?.status === "ready" ? null : link.inviteCode ?? null,
+		invite: link.pairing?.status === "ready" || !link.inviteCode ? null : showSecret === true ? link.inviteCode : "<hidden>",
 		compatibility: !link.profile,
 		peerPicture: !!link.peerAvatar
 	};
 }
 /** A chat's details: the summary plus what its connection panel shows. */
-function chatDetailsJson(link) {
+function chatDetailsJson(link, showSecret) {
 	return {
-		...chatJson(link),
+		...chatJson(link, showSecret),
 		progress: link.pairingProgress ?? null,
 		transports: {
 			mine: link.availableTransports ?? [],
@@ -3669,10 +3886,15 @@ function groupJson(group, showSecret = false) {
 * Group administration and pictures (WISP 1100, phase 3): what the app's group menu and profile screen do. The
 * engine enforces who may do what (the admin); these check the arguments and name members.
 */
-/** A member by key, unique key prefix or name; never this profile itself. */
+/**
+* A member by key, unique key prefix or name; never this profile itself. A whole key is that member, whatever another
+* member calls itself; a prefix and a name stand side by side (two members is an error, not a guess).
+*/
 function findMember(group, ref) {
 	const lower = ref.toLowerCase();
-	const matches = group.members.filter((m) => !m.me && (m.key === ref || m.key.startsWith(ref) || m.nick?.trim().toLowerCase() === lower));
+	const others = group.members.filter((m) => !m.me);
+	const byKey = others.filter((m) => m.key === ref);
+	const matches = byKey.length ? byKey : others.filter((m) => m.key.startsWith(ref) || m.nick?.trim().toLowerCase() === lower);
 	if (matches.length === 1) return matches[0];
 	throw new CliError(matches.length ? "bad_request" : "not_found", matches.length ? `${JSON.stringify(ref)} names more than one member` : `No member ${JSON.stringify(ref)} in ${group.name}`);
 }
@@ -3789,6 +4011,63 @@ var GROUP_ADMIN_METHODS = {
 	}
 };
 //#endregion
+//#region src/turnRefs.ts
+/**
+* The id an agent turn names its message by (docs/CLI.md § Agent turns). A message is stored under an id its sender
+* chose most of (`peer_<the id they sent>`), so a turn carries this one instead, made here from the chat (or group) and
+* that id: `t_` and 32 hex digits, in which nobody can write a word. Every command that takes a message's id takes it.
+*/
+function turnRef(where, messageId) {
+	return "t_" + createHash("sha256").update(`${where}\n${messageId}`).digest("hex").slice(0, 32);
+}
+var TURN_REF = /^t_[0-9a-f]{32}$/;
+var isRef = (value) => typeof value === "string" && TURN_REF.test(value);
+/**
+* `params` with each turn's id in `message`, `reply` and `messages` as the id its message is stored under: looked for
+* among the chat's (or group's) newest messages first, where a turn's almost always is, then in all of them. One that
+* names no message stays as given, and its command says so as for any unknown id.
+*/
+async function withStoredIds(ctx, params) {
+	const wanted = new Set([
+		params.message,
+		params.reply,
+		...Array.isArray(params.messages) ? params.messages : []
+	].filter(isRef));
+	if (!wanted.size) return params;
+	let target = null;
+	try {
+		if (typeof params.group === "string") {
+			const group = findGroup(state(ctx).groups, params.group);
+			target = {
+				id: group.id,
+				linkId: `group:${group.id}`,
+				group: true
+			};
+		} else if (typeof params.chat === "string") target = chatOrGroup(ctx, params.chat);
+	} catch {}
+	if (!target) return params;
+	const { id, linkId, group } = target;
+	const found = /* @__PURE__ */ new Map();
+	const look = (messages) => {
+		for (const message of messages) {
+			const ref = turnRef(id, message.id);
+			if (wanted.has(ref)) found.set(ref, message.id);
+		}
+		return found.size === wanted.size;
+	};
+	if (!look((await node(ctx).messagePage({
+		linkId,
+		limit: 200
+	})).messages)) look(group ? await node(ctx).groupMessages({ groupId: id }) : await node(ctx).getMessages(linkId));
+	const stored = (value) => isRef(value) ? found.get(value) ?? value : value;
+	return {
+		...params,
+		...params.message !== void 0 && { message: stored(params.message) },
+		...params.reply !== void 0 && { reply: stored(params.reply) },
+		...Array.isArray(params.messages) && { messages: params.messages.map(stored) }
+	};
+}
+//#endregion
 //#region ../browser/src/proofs/bitcoinWallets.ts
 /** What a proof proves and what it does not; shown next to every Bitcoin proof, given or received. */
 var BITCOIN_PROOF_LIMITS = [
@@ -12369,6 +12648,25 @@ function checkTextSize(text) {
 		max: LIMITS.maxChatMessageBytes
 	});
 }
+/**
+* The engine's state as `engine getState` prints it without `--show-secret`: the settings' credentials, a group's
+* entry link (anyone who reads it can join) and a pending chat's invite code (whoever reads it can take the chat)
+* are `<hidden>`.
+*/
+function hideStateSecrets(state) {
+	return {
+		...state,
+		settings: redactSettings(state.settings),
+		...state.groups ? { groups: state.groups.map((g) => g.entryLink ? {
+			...g,
+			entryLink: "<hidden>"
+		} : g) } : {},
+		...state.links ? { links: state.links.map((l) => l.inviteCode ? {
+			...l,
+			inviteCode: "<hidden>"
+		} : l) } : {}
+	};
+}
 /** Settings as a bot may read them: storage credentials and other secrets masked unless asked for. */
 function redactSettings(settings, showSecret = false) {
 	if (showSecret) return settings;
@@ -12396,7 +12694,9 @@ var SETTABLE = {
 	online: "boolean",
 	shareProfile: "boolean",
 	sendTyping: "boolean",
-	nick: "string"
+	nick: "string",
+	autoDownloads: "boolean",
+	serveFiles: "boolean"
 };
 var TRANSPORT_NAMES = {
 	auto: "auto",
@@ -12504,7 +12804,7 @@ var METHODS = {
 	async "settings.set"(ctx, params) {
 		const patch = {};
 		for (const [key, value] of Object.entries(params)) {
-			const kind = SETTABLE[key];
+			const kind = Object.hasOwn(SETTABLE, key) ? SETTABLE[key] : void 0;
 			if (!kind) throw new CliError("bad_request", `${key} is not a setting the CLI changes (${Object.keys(SETTABLE).join(", ")})`);
 			if (kind === "strings" && !(Array.isArray(value) && value.every((v) => typeof v === "string"))) throw new CliError("bad_request", `${key} must be a list of strings`);
 			if (kind === "string" && typeof value !== "string") throw new CliError("bad_request", `${key} must be a string`);
@@ -12559,13 +12859,14 @@ var METHODS = {
 		node(ctx).setActiveLink({ linkId });
 		return { chat: linkId };
 	},
-	async "chat.list"(ctx) {
-		return { chats: state(ctx).links.map(chatJson).sort((a, b) => b.lastMessageAt - a.lastMessageAt || b.createdAt - a.createdAt) };
+	async "chat.list"(ctx, params) {
+		const showSecret = bool(params, "showSecret");
+		return { chats: state(ctx).links.map((link) => chatJson(link, showSecret)).sort((a, b) => b.lastMessageAt - a.lastMessageAt || b.createdAt - a.createdAt) };
 	},
 	async "chat.get"(ctx, params) {
 		const link = chatOf(ctx, params);
 		return {
-			...chatDetailsJson(link),
+			...chatDetailsJson(link, bool(params, "showSecret")),
 			heldUntil: holdOf(ctx, link.id)
 		};
 	},
@@ -12631,7 +12932,7 @@ var METHODS = {
 			messageId,
 			text
 		});
-		if (result.error) throw editRefused(await node(ctx).getMessages(link.id), messageId, "chat", result.error, result.refused);
+		if (result.error) throw editRefused(await messageOf(ctx, link.id, messageId), messageId, "chat", result.error, result.refused);
 		const id = result.messageId ?? messageId;
 		let message = await node(ctx).getMessage(link.id, id);
 		if (wait === "confirmed" && message?.edit?.pending) message = await waitForEdit(ctx, link.id, id, num(params, "timeout", 30, {
@@ -12685,7 +12986,7 @@ var METHODS = {
 	},
 	/** WISP 400 § Reactions: one emoji per person per message, a new one replaces mine; `remove` takes mine back. */
 	async "chat.react"(ctx, params) {
-		const link = chatOf(ctx, params);
+		const link = notAGroup(ctx, params, () => chatOf(ctx, params), "group react", "<message> <emoji>");
 		return {
 			chat: link.id,
 			...await react(ctx, link.id, params)
@@ -12722,10 +13023,12 @@ var METHODS = {
 		if (!messageIds.length) throw new CliError("bad_request", "Name the messages to forward (their ids, from history or an event)");
 		const to = list(params, "to").map((ref) => chatOrGroup(ctx, ref));
 		if (!to.length) throw new CliError("bad_request", "Forward to which chat? Name one or more with --to");
-		const history = from.group ? await node(ctx).groupMessages({ groupId: from.id }) : await node(ctx).getMessages(from.id);
-		const chosen = messageIds.map((id) => history.find((m) => m.id === id) ?? (() => {
-			throw new CliError("not_found", `No message ${id} in this ${from.group ? "group" : "chat"}`);
-		})());
+		const chosen = [];
+		for (const id of messageIds) {
+			const message = await node(ctx).getMessage(from.linkId, id);
+			if (!message) throw new CliError("not_found", `No message ${id} in this ${from.group ? "group" : "chat"}`);
+			chosen.push(message);
+		}
 		if (!bool(params, "force")) for (const message of chosen) {
 			const secret = message.file ? null : findSecret(message.text);
 			if (secret) throw new CliError("confirm", `A message looks like ${secret.kind === "cashu" ? "a Cashu token (money anyone who reads it can take)" : "a secret (a seed or a private key)"}; forward it with --force if you mean to`, {
@@ -12759,7 +13062,7 @@ var METHODS = {
 				await waitForGroupFrame(ctx, to[i].id, messageId, void 0, ms);
 				continue;
 			}
-			const sent = (await node(ctx).getMessages(to[i].id)).find((m) => m.id === messageId);
+			const sent = await node(ctx).getMessage(to[i].id, messageId);
 			if (sent?.file) await FILE_METHODS["file.wait"](ctx, {
 				chat: to[i].id,
 				file: sent.file.id,
@@ -12791,7 +13094,7 @@ var METHODS = {
 	async "chat.delete"(ctx, params) {
 		const link = chatOf(ctx, params);
 		const messageId = str(params, "message", true);
-		if (!(await node(ctx).getMessages(link.id)).some((m) => m.id === messageId)) throw new CliError("not_found", `No message ${messageId} in this chat`);
+		if (!await node(ctx).getMessage(link.id, messageId)) throw new CliError("not_found", `No message ${messageId} in this chat`);
 		await node(ctx).deleteMessage({
 			linkId: link.id,
 			messageId
@@ -12826,7 +13129,8 @@ var METHODS = {
 	},
 	async "chat.transport"(ctx, params) {
 		const link = chatOf(ctx, params);
-		const transport = TRANSPORT_NAMES[str(params, "transport", true)];
+		const name = str(params, "transport", true);
+		const transport = Object.hasOwn(TRANSPORT_NAMES, name) ? TRANSPORT_NAMES[name] : void 0;
 		if (!transport) throw new CliError("bad_request", `transport must be one of auto, dht, webrtc, iroh, hyperdht`);
 		await node(ctx).setChatTransport({
 			linkId: link.id,
@@ -12906,7 +13210,13 @@ var METHODS = {
 		};
 	},
 	async "group.join"(ctx, params) {
-		const { groupId } = await node(ctx).joinGroupByLink({ link: str(params, "link", true) });
+		let groupId;
+		try {
+			({groupId} = await node(ctx).joinGroupByLink({ link: str(params, "link", true) }));
+		} catch (error) {
+			if (error instanceof Error && error.message === "This is not a link to a group") throw new CliError("bad_request", error.message);
+			throw error;
+		}
 		return { group: groupId };
 	},
 	async "group.list"(ctx, params) {
@@ -12975,15 +13285,16 @@ var METHODS = {
 		}
 		const mentions = mentionsFor(text, list(params, "mentions"), group);
 		const wait = oneOf(params, "wait", ["none", "sent"], "none");
-		const before = (await node(ctx).groupMessages({ groupId: group.id })).find((m) => m.id === messageId)?.edit?.seq ?? 0;
+		const linkId = `group:${group.id}`;
+		const before = (await node(ctx).getMessage(linkId, messageId))?.edit?.seq ?? 0;
 		const result = await node(ctx).editMessage({
-			linkId: `group:${group.id}`,
+			linkId,
 			messageId,
 			text,
 			...mentions.length ? { mentions } : {}
 		});
-		if (result.error) throw editRefused(await node(ctx).groupMessages({ groupId: group.id }), messageId, "group", result.error, result.refused);
-		const message = (await node(ctx).groupMessages({ groupId: group.id })).find((m) => m.id === messageId);
+		if (result.error) throw editRefused(await messageOf(ctx, linkId, messageId), messageId, "group", result.error, result.refused);
+		const message = await node(ctx).getMessage(linkId, messageId);
 		const edits = message?.edit?.seq ?? 0;
 		if (edits === before) return {
 			group: group.id,
@@ -13149,12 +13460,32 @@ function groupSendRefused(error) {
 	return new CliError("unavailable", error);
 }
 /**
+* A chat command given a group's id, prefix or name: `not_found` that says it is a group, with the group command that
+* takes it (`react` on a group, where `group react` is meant). A name no chat and no group has stays the chat's error.
+*/
+function notAGroup(ctx, params, chat, command, rest) {
+	try {
+		return chat();
+	} catch (error) {
+		if (!(error instanceof CliError) || error.code !== "not_found") throw error;
+		const ref = str(params, "chat", true);
+		let group;
+		try {
+			group = findGroup(state(ctx).groups, ref);
+		} catch {
+			throw error;
+		}
+		const shown = /^[\w.:-]+$/.test(ref) ? ref : JSON.stringify(ref);
+		throw new CliError("not_found", `${JSON.stringify(ref)} is a group, not a chat: ghostly ${command} ${shown} ${rest}`, { group: group.id });
+	}
+}
+/**
 * An edit the engine refused. A message that is not in the chat or group at all is `not_found` (exit 3), naming the id
 * to give, as `button update` and `task update` do; before, a mistyped or lost id read "Only your own text messages
 * can be edited" (`refused`, exit 1), as if the message were someone else's.
 */
-function editRefused(messages, ref, where, error, refused) {
-	if (refused && !messages.some((m) => m.id === ref || m.wireId === ref)) return new CliError("not_found", `No message ${JSON.stringify(ref)} in this ${where}: give the messageId ${where === "group" ? "group send" : "send"} printed`);
+function editRefused(message, ref, where, error, refused) {
+	if (refused && !message) return new CliError("not_found", `No message ${JSON.stringify(ref)} in this ${where}: give the messageId ${where === "group" ? "group send" : "send"} printed`);
 	return new CliError(refused ? "refused" : "unavailable", error);
 }
 /**
@@ -13209,12 +13540,12 @@ function history(messages, params, json = messageJson) {
 	};
 }
 Object.keys(METHODS);
-/** Runs one method of the API. */
+/** Runs one method of the API: one the table lists itself (`constructor`, which every object has, is none). */
 async function callApi(ctx, method, params = {}) {
-	const run = METHODS[method];
+	const run = Object.hasOwn(METHODS, method) ? METHODS[method] : void 0;
 	if (!run) throw new CliError("not_found", `No method ${method}`);
 	if (params === null || typeof params !== "object" || Array.isArray(params)) throw new CliError("bad_request", "params must be an object");
-	return run(ctx, params);
+	return run(ctx, await withStoredIds(ctx, params));
 }
 //#endregion
 //#region src/privateFolder.ts
@@ -14317,7 +14648,23 @@ var showSecret = { "show-secret": {
 	type: "boolean",
 	description: "Print the group's entry link (anyone who has it can join)"
 } };
+/** A pending chat's invite code lets whoever reads it take the chat: printed only when asked for. */
+var showInvite = { "show-secret": {
+	type: "boolean",
+	description: "Print a pending chat's invite code (whoever has it can take the chat)"
+} };
 var secret = (options) => options["show-secret"] === true ? { showSecret: true } : {};
+/**
+* `--for` of the typing commands: the seconds it is kept on, 1 to 600, and never with `--stop`. A usage error (exit 2)
+* that names the flag: before, the API's own check answered ("for must be a number from 1 to 600", exit 1).
+*/
+function typingFor(options) {
+	const seconds = options.for;
+	if (seconds === void 0) return void 0;
+	if (typeof seconds !== "number" || !(seconds >= 1 && seconds <= 600)) throw new CliError("usage", `--for takes a number of seconds from 1 to 600, not ${JSON.stringify(seconds)}`);
+	if (options.stop === true) throw new CliError("usage", "--for keeps it on: not with --stop");
+	return seconds;
+}
 /** A history cursor: a timestamp when it is all digits, else a message id. */
 function cursor(value) {
 	if (value === void 0) return void 0;
@@ -14359,6 +14706,10 @@ var cardOptions = {
 	text: {
 		type: "string",
 		description: "The text older apps show instead (default: written from the card)"
+	},
+	force: {
+		type: "boolean",
+		description: "Send even if the card's text looks like a seed, a key or ecash"
 	}
 };
 /** `--link label=https://…` or a bare link, as a card's links. */
@@ -14392,7 +14743,26 @@ function itemOf(value) {
 		text: value.slice(colon + 1).trim()
 	};
 }
-/** A task's fields from its flags; what was not given is left out, so an update changes only what it names. */
+/** `--progress`, `--left`: a percent, or a usage error that names the flag. */
+function percent(options, flag) {
+	const value = options[flag];
+	if (value !== void 0 && !(typeof value === "number" && value >= 0 && value <= 100)) throw new CliError("usage", `--${flag} takes a percent from 0 to 100, not ${JSON.stringify(value)}`);
+}
+/** The flags of a task's pull request, and the field of `pr` each one gives. */
+var PR_FLAGS = [
+	["pr-url", "url"],
+	["pr-number", "number"],
+	["additions", "additions"],
+	["deletions", "deletions"],
+	["files", "files"],
+	["pr-state", "state"],
+	["pr-checks", "checks"]
+];
+/**
+* A task's fields from its flags; what was not given is left out, so an update changes only what it names. What a flag
+* got wrong is a usage error (exit 2) that names the flag: before, it reached the card's own check and failed as
+* `bad_request` (exit 1) in the card's words ("Status card: done is at most total").
+*/
 function taskFields(options) {
 	const fields = { ...cardJson(options.json) };
 	const set = (key, value) => {
@@ -14401,6 +14771,7 @@ function taskFields(options) {
 	set("id", options.id);
 	set("title", options.title);
 	set("status", options.status);
+	percent(options, "progress");
 	set("progress", options.progress);
 	set("step", options.step);
 	set("branch", options.branch);
@@ -14409,22 +14780,18 @@ function taskFields(options) {
 		if (!match) throw new CliError("usage", `--steps takes done/total, like 2/5, not ${JSON.stringify(options.steps)}`);
 		fields.done = Number(match[1]);
 		fields.total = Number(match[2]);
+		if (Number(match[2]) < 1 || Number(match[1]) > Number(match[2])) throw new CliError("usage", `--steps takes done/total with done at most total, like 2/5, not ${JSON.stringify(options.steps)}`);
 	}
+	if (options["pr-url"] !== void 0 && !cardUrl(options["pr-url"])) throw new CliError("usage", `--pr-url takes an https link of at most ${STATUS_CARD_LIMITS.url} characters, not ${JSON.stringify(options["pr-url"])}`);
+	for (const [flag, words] of [["pr-state", PR_STATES], ["pr-checks", PR_CHECKS]]) if (options[flag] !== void 0 && !words.includes(options[flag])) throw new CliError("usage", `--${flag} takes ${listed(words)}, not ${JSON.stringify(options[flag])}`);
 	const pr = {};
-	for (const [flag, key] of [
-		["pr-url", "url"],
-		["pr-number", "number"],
-		["additions", "additions"],
-		["deletions", "deletions"],
-		["files", "files"],
-		["pr-state", "state"],
-		["pr-checks", "checks"]
-	]) if (options[flag] !== void 0) pr[key] = options[flag];
+	for (const [flag, key] of PR_FLAGS) if (options[flag] !== void 0) pr[key] = options[flag];
 	if (Object.keys(pr).length) fields.pr = {
 		...fields.pr && typeof fields.pr === "object" ? fields.pr : {},
 		...pr
 	};
 	if (Array.isArray(options.item) && options.item.length) fields.items = options.item.map(itemOf);
+	if (Array.isArray(options.tag) && options.tag.length > STATUS_CARD_LIMITS.tags) throw new CliError("usage", `--tag is given at most ${STATUS_CARD_LIMITS.tags} times, not ${options.tag.length}`);
 	if (Array.isArray(options.tag) && options.tag.length) fields.tags = options.tag;
 	set("parent", options.parent);
 	const links = cardLinks(options.link);
@@ -14441,6 +14808,25 @@ function needs(card, fields, usage) {
 	if (missing.length) throw new CliError("usage", `${missing.join(" and ")} ${missing.length > 1 ? "are" : "is"} needed: ghostly ${usage}`);
 	return card;
 }
+/**
+* A new task's pull request goes by its link: `--pr-state` and the like without `--pr-url` (or `pr.url` in `--json`)
+* are a usage error that names them. An update's card may have the link already, so only a send asks.
+*/
+function prLinked(card, options, usage) {
+	const given = PR_FLAGS.filter(([flag]) => options[flag] !== void 0).map(([flag]) => `--${flag}`);
+	if (!given.length || card.pr.url !== void 0) return card;
+	throw new CliError("usage", `${given.join(" and ")} ${given.length > 1 ? "go" : "goes"} with --pr-url: ghostly ${usage}`);
+}
+/**
+* A usage card says how much is left: `--left`, or `--used` with `--limit`, as flags or in `--json`. The one that is
+* missing is a usage error that names the flag.
+*/
+function quota(card, usage) {
+	const used = card.used !== void 0;
+	if (used !== (card.limit !== void 0)) throw new CliError("usage", `--${used ? "used" : "limit"} goes with --${used ? "limit" : "used"}: ghostly ${usage}`);
+	if (card.left === void 0 && !used) throw new CliError("usage", `--left is needed (or --used with --limit): ghostly ${usage}`);
+	return card;
+}
 /** A time a command names: milliseconds, or a date the JavaScript Date reads (`2026-09-30T01:00:00Z`). */
 function cardTime(value, flag) {
 	if (value === void 0) return void 0;
@@ -14589,6 +14975,7 @@ function usageWindowOf(value) {
 /** A usage card's fields from its flags (WISP 405 § Usage); `--json` gives any of them, the flags win over it. */
 function usageFields(options) {
 	const fields = { ...cardJson(options.json) };
+	percent(options, "left");
 	for (const key of [
 		"id",
 		"left",
@@ -14646,7 +15033,8 @@ var usageOptions = {
 		description: "Every 1:1 chat with a contact, instead of one chat"
 	},
 	json: cardOptions.json,
-	text: cardOptions.text
+	text: cardOptions.text,
+	force: cardOptions.force
 };
 //#endregion
 //#region src/commands/calls.ts
@@ -14718,6 +15106,7 @@ var commands$7 = {
 };
 //#endregion
 //#region src/commands/chats.ts
+var BUTTON_UPDATE = "button update <chat|group> <message> [--chosen <button>] [--close] [--text <text>] [--force] [--wait none|confirmed|sent] [--timeout s]";
 /** Invites, chats and messages: one entry per command, in alphabetical order (test/commands.test.ts checks). */
 var commands$6 = {
 	"button press": {
@@ -14746,7 +15135,7 @@ var commands$6 = {
 	},
 	"button update": {
 		method: "button.update",
-		usage: "button update <chat|group> <message> [--chosen <button>] [--close] [--text <text>] [--force] [--wait none|confirmed|sent] [--timeout s]",
+		usage: BUTTON_UPDATE,
 		summary: "Show the answer on a message's buttons (--chosen), close them, or change its text (the messageId send --button gave)",
 		args: ["chat", "message"],
 		options: {
@@ -14769,16 +15158,19 @@ var commands$6 = {
 			},
 			timeout: groupWait.timeout
 		},
-		params: ({ options }, a) => ({
-			chat: a.chat,
-			message: a.message,
-			chosen: options.chosen,
-			close: options.close === true,
-			text: options.text,
-			force: options.force === true,
-			wait: options.wait,
-			timeout: options.timeout
-		})
+		params: ({ options }, a) => {
+			if (!options.chosen && options.close !== true && !options.text) throw new CliError("usage", `Give --chosen, --close or --text: ghostly ${BUTTON_UPDATE}`);
+			return {
+				chat: a.chat,
+				message: a.message,
+				chosen: options.chosen,
+				close: options.close === true,
+				text: options.text,
+				force: options.force === true,
+				wait: options.wait,
+				timeout: options.timeout
+			};
+		}
 	},
 	"chat connect": {
 		method: "chat.connect",
@@ -14829,8 +15221,10 @@ var commands$6 = {
 	},
 	"chat list": {
 		method: "chat.list",
-		usage: "chat list",
-		summary: "Chats, newest first"
+		usage: "chat list [--show-secret]",
+		summary: "Chats, newest first (a pending invite code only with --show-secret)",
+		options: showInvite,
+		params: ({ options }) => secret(options)
 	},
 	"chat remove": {
 		method: "chat.remove",
@@ -14858,10 +15252,14 @@ var commands$6 = {
 	},
 	"chat show": {
 		method: "chat.get",
-		usage: "chat show <chat>",
-		summary: "One chat and its connection",
+		usage: "chat show <chat> [--show-secret]",
+		summary: "One chat and its connection (its pending invite code only with --show-secret)",
 		args: ["chat"],
-		params: (_, { chat }) => ({ chat })
+		options: showInvite,
+		params: ({ options }, { chat }) => ({
+			chat,
+			...secret(options)
+		})
 	},
 	"chat transport": {
 		method: "chat.transport",
@@ -14882,10 +15280,13 @@ var commands$6 = {
 			type: "string",
 			description: "The code the contact reads out"
 		} },
-		params: ({ options }, { chat }) => ({
-			chat,
-			code: options.code
-		})
+		params: ({ options }, { chat }) => {
+			if (typeof options.code !== "string" || !options.code.trim()) throw new CliError("usage", "--code is needed: ghostly chat verify <chat> --code <code>");
+			return {
+				chat,
+				code: options.code
+			};
+		}
 	},
 	"chat wait": {
 		method: "chat.wait",
@@ -14996,18 +15397,22 @@ var commands$6 = {
 	},
 	"pin": {
 		method: "chat.pin",
-		usage: "pin <chat|group> <message> [--remove]",
+		usage: "pin <chat|group> <message> | --remove",
 		summary: "Pin a message at the top of a chat or group (one per chat: it replaces the pinned one); --remove unpins",
-		args: ["chat", "message"],
+		args: ["chat", "message...?"],
 		options: { remove: {
 			type: "boolean",
-			description: "Unpin the chat's pinned message"
+			description: "Unpin the chat's pinned message (it names no message)"
 		} },
-		params: ({ options }, a) => ({
-			chat: a.chat,
-			message: a.message,
-			remove: options.remove === true
-		})
+		params: ({ options }, a) => {
+			if (a.message === void 0 && options.remove !== true) throw new CliError("usage", "Missing <message>: ghostly pin <chat|group> <message> | --remove");
+			if (a.message?.includes(" ")) throw new CliError("usage", "Too many arguments: ghostly pin <chat|group> <message> | --remove");
+			return {
+				chat: a.chat,
+				message: a.message,
+				remove: options.remove === true
+			};
+		}
 	},
 	"react": {
 		method: "chat.react",
@@ -15031,7 +15436,7 @@ var commands$6 = {
 	},
 	"routine send": {
 		method: "routine.send",
-		usage: "routine send <chat|group> --name <name> --schedule \"every day 01:00\" [--cron \"0 1 * * *\"] [--state active|paused] [--next <time>] [--run ok|failed|skipped[:summary]] [--link url]... [--id id] [--json json|-|file] [--wait none|sent|delivered] [--timeout s]",
+		usage: "routine send <chat|group> --name <name> --schedule \"every day 01:00\" [--cron \"0 1 * * *\"] [--state active|paused] [--next <time>] [--run ok|failed|skipped[:summary]] [--link url]... [--id id] [--json json|-|file] [--force] [--wait none|sent|delivered] [--timeout s]",
 		summary: "Send a routine card (something a bot runs on a schedule: its last run and the next) to a chat or group",
 		args: ["chat"],
 		options: {
@@ -15048,13 +15453,14 @@ var commands$6 = {
 			card: needs(routineFields(options), [["name", "name"], ["schedule", "schedule"]], "routine send <chat|group> --name <name> --schedule \"every day 01:00\""),
 			run: runOf(options.run),
 			text: options.text,
+			force: options.force === true,
 			wait: options.wait,
 			timeout: options.timeout
 		})
 	},
 	"routine update": {
 		method: "routine.update",
-		usage: "routine update <chat|group> <routine> [--run ok|failed|skipped[:summary]] [--next <time>] [--state active|paused] [--schedule ...] [--json json|-|file] [--wait none|confirmed|sent] [--timeout s]",
+		usage: "routine update <chat|group> <routine> [--run ok|failed|skipped[:summary]] [--next <time>] [--state active|paused] [--schedule ...] [--json json|-|file] [--force] [--wait none|confirmed|sent] [--timeout s]",
 		summary: "Update a routine card you sent: record a run, the next one, a pause (at most one update per 2.5 s; sooner ones merge)",
 		args: ["chat", "routine"],
 		options: {
@@ -15071,13 +15477,14 @@ var commands$6 = {
 			card: routineFields(options),
 			run: runOf(options.run),
 			text: options.text,
+			force: options.force === true,
 			wait: options.wait,
 			timeout: options.timeout
 		})
 	},
 	"task send": {
 		method: "task.send",
-		usage: "task send <chat|group> --title <title> [--status s] [--progress n | --steps a/b] [--step \"...\"] [--item state:text]... [--pr-url url --pr-number n --additions n --deletions n --files n --pr-state s --pr-checks c] [--branch b] [--tag label]... [--parent task] [--link url]... [--id id] [--json json|-|file] [--wait none|sent|delivered] [--timeout s]",
+		usage: "task send <chat|group> --title <title> [--status s] [--progress n | --steps a/b] [--step \"...\"] [--item state:text]... [--pr-url url --pr-number n --additions n --deletions n --files n --pr-state s --pr-checks c] [--branch b] [--tag label]... [--parent task] [--link url]... [--id id] [--json json|-|file] [--force] [--wait none|sent|delivered] [--timeout s]",
 		summary: "Send a task card (a bot's work: status, progress, its PR) to a chat or group; prints its id and message",
 		args: ["chat"],
 		options: {
@@ -15091,15 +15498,16 @@ var commands$6 = {
 		},
 		params: ({ options }, { chat }) => ({
 			chat,
-			card: needs(taskFields(options), [["title", "title"]], "task send <chat|group> --title <title>"),
+			card: prLinked(needs(taskFields(options), [["title", "title"]], "task send <chat|group> --title <title>"), options, "task send <chat|group> --title <title> --pr-url <url>"),
 			text: options.text,
+			force: options.force === true,
 			wait: options.wait,
 			timeout: options.timeout
 		})
 	},
 	"task update": {
 		method: "task.update",
-		usage: "task update <chat|group> <task> [--status s] [--progress n | --steps a/b] [--step \"...\"] [--item state:text]... [--pr-url ...] [--pr-state s] [--pr-checks c] [--tag label]... [--parent task] [--json json|-|file] [--wait none|confirmed|sent] [--timeout s]",
+		usage: "task update <chat|group> <task> [--status s] [--progress n | --steps a/b] [--step \"...\"] [--item state:text]... [--pr-url ...] [--pr-state s] [--pr-checks c] [--tag label]... [--parent task] [--json json|-|file] [--force] [--wait none|confirmed|sent] [--timeout s]",
 		summary: "Update a task card you sent: the fields given, merged over it (at most one update per 2.5 s; sooner ones merge)",
 		args: ["chat", "task"],
 		options: {
@@ -15115,6 +15523,7 @@ var commands$6 = {
 			task: a.task,
 			card: taskFields(options),
 			text: options.text,
+			force: options.force === true,
 			wait: options.wait,
 			timeout: options.timeout
 		})
@@ -15147,12 +15556,12 @@ var commands$6 = {
 			stop: options.stop === true,
 			kind: options.kind,
 			status: options.status,
-			for: options.for
+			for: typingFor(options)
 		})
 	},
 	"usage send": {
 		method: "usage.send",
-		usage: "usage send [<chat|group>] [--all] --left <percent> [--window \"5 h\"] [--resets <time>] [--label Claude] [--account <name>] [--also week=80@<time>]... [--used n --limit n] [--id id] [--json json|-|file] [--wait none|sent] [--timeout s]",
+		usage: "usage send [<chat|group>] [--all] --left <percent> [--window \"5 h\"] [--resets <time>] [--label Claude] [--account <name>] [--also week=80@<time>]... [--used n --limit n] [--id id] [--json json|-|file] [--force] [--wait none|sent] [--timeout s]",
 		summary: "Say how much of your quota is left (a bot's usage card, one per chat, updated in place); --all for every 1:1 chat",
 		args: ["chat?"],
 		options: {
@@ -15164,8 +15573,9 @@ var commands$6 = {
 			return {
 				chat,
 				all: options.all === true,
-				card: usageFields(options),
+				card: quota(usageFields(options), "usage send <chat|--all> --left <percent>"),
 				text: options.text,
+				force: options.force === true,
 				wait: options.wait,
 				timeout: options.timeout
 			};
@@ -15662,7 +16072,7 @@ var commands$3 = {
 			stop: options.stop === true,
 			kind: options.kind,
 			status: options.status,
-			for: options.for
+			for: typingFor(options)
 		})
 	}
 };
@@ -16455,6 +16865,12 @@ var PlaybackQueue = class {
 		this.length = 0;
 		return ms;
 	}
+	/** Drops up to that much from the front, in whole frames (audio whose time went by); returns how much, in milliseconds. */
+	skip(ms) {
+		const frames = Math.min(Math.floor(ms / 20), Math.floor(this.length / this.frame));
+		if (frames > 0) this.take(frames * this.frame);
+		return Math.max(0, frames) * 20;
+	}
 	take(bytes) {
 		const out = Buffer.allocUnsafe(bytes);
 		let filled = 0;
@@ -16682,6 +17098,10 @@ var ReorderBuffer = class {
 		}
 	}
 };
+//#endregion
+//#region src/calls/audio.ts
+/** The longest stall of the sender whose frames are still sent after it (see `catchUp`). */
+var MAX_CATCH_UP_MS = 1e3;
 /**
 * One call's audio: every 20 ms a frame from the queue (the program's audio, or silence) is encoded and sent; what
 * comes in is put back in order, decoded, and handed on in 20 ms frames as soon as it is. Nothing waits on a clock
@@ -16699,7 +17119,17 @@ var CallAudio = class {
 	timer = null;
 	startedAt = 0;
 	ticks = 0;
+	/** What was left in the queue after the last frame sent: the program's audio written ahead of the call. */
+	ahead = 0;
+	/** After a stall that was not replayed: how much of its audio is still to drop, down to what queue, and until when. */
+	owed = 0;
+	kept = 0;
+	owedUntil = 0;
 	talking = false;
+	/** The last silent frame's packet, how many silent frames in a row gave it, and that packet once it is kept (see `settle`). */
+	lastQuiet = null;
+	same = 0;
+	quiet = null;
 	stopped = false;
 	/** Frames sent and received, for `call list`. */
 	sent = 0;
@@ -16734,16 +17164,40 @@ var CallAudio = class {
 	tick() {
 		if (this.stopped) return;
 		const { frame, silent } = this.queue.next();
+		const still = silent || frame.equals(this.silence);
 		let payload;
-		try {
-			payload = this.options.encoder.encode(frame, this.samples);
-		} catch {
-			return;
+		if (still && this.quiet) payload = this.quiet;
+		else {
+			try {
+				payload = this.options.encoder.encode(frame, this.samples);
+			} catch {
+				return;
+			}
+			this.settle(still, payload);
 		}
 		const marker = !silent && !this.talking;
 		this.talking = !silent;
 		this.options.track.send(this.writer.packet(payload, marker));
 		this.sent++;
+		this.ahead = this.queue.queuedMs;
+	}
+	/**
+	* Keeps the packet silence encodes to once the encoder gave it SETTLED_FRAMES times in a row: it is sent again for
+	* the silent frames that follow, without the encoder, until the program's audio is back.
+	*/
+	settle(still, payload) {
+		if (!still) {
+			this.lastQuiet = null;
+			this.quiet = null;
+			this.same = 0;
+			return;
+		}
+		if (this.lastQuiet?.equals(payload)) {
+			if (++this.same >= 25) this.quiet = this.lastQuiet;
+			return;
+		}
+		this.lastQuiet = Buffer.from(payload);
+		this.same = 1;
 	}
 	/** Handles one packet from the track. Exposed for tests. */
 	receive(packet) {
@@ -16778,14 +17232,57 @@ var CallAudio = class {
 		const due = this.startedAt + (this.ticks + 1) * 20;
 		this.timer = setTimeout(() => {
 			if (this.stopped) return;
-			if (now() - due > 1e3) {
-				this.startedAt = now();
-				this.ticks = 0;
-			} else this.ticks++;
-			this.tick();
-			this.schedule();
+			if (now() - due < 20) {
+				this.ticks++;
+				this.drop();
+				this.tick();
+				this.schedule();
+				return;
+			}
+			setImmediate(() => {
+				if (this.stopped) return;
+				this.catchUp(now() - due);
+				this.schedule();
+			});
 		}, Math.max(0, due - now()));
 	}
+	/**
+	* Meets the clock again after the loop was busy: every frame that is due goes out at once, so a loop that turns
+	* slower than a frame for a while (every 40 ms under a large file) keeps up, and a program writing at real time
+	* stays there. The contact's jitter buffer takes the short burst. A stall past MAX_CATCH_UP_MS is not replayed: the
+	* clock starts again and what the program wrote during it is dropped, or it would be heard that much late for the
+	* rest of the call.
+	*/
+	catchUp(late) {
+		const now = this.options.now ?? Date.now;
+		if (late > 1e3) {
+			this.owed = late;
+			this.kept = this.ahead;
+			this.owedUntil = now() + MAX_CATCH_UP_MS;
+			this.startedAt = now();
+			this.ticks = 0;
+			this.drop();
+			this.tick();
+			return;
+		}
+		do {
+			this.ticks++;
+			this.drop();
+			this.tick();
+		} while (this.startedAt + (this.ticks + 1) * 20 <= now());
+	}
+	/**
+	* Drops the audio of a stall that was not replayed, as it is read: a long one does not fit the program's socket, so
+	* the rest of it comes over the next turns. What was queued before the stall (a clip written ahead) is kept.
+	*/
+	drop() {
+		if (this.owed <= 0) return;
+		if ((this.options.now ?? Date.now)() > this.owedUntil) {
+			this.owed = 0;
+			return;
+		}
+		this.owed -= this.queue.skip(Math.min(this.owed, this.queue.queuedMs - this.kept));
+	}
 };
 //#endregion
 //#region src/calls/media.ts
@@ -17258,6 +17755,8 @@ var CallManager = class {
 		this.callable(call.chat);
 		call.rate = rateOf(options.rate, call.rate);
 		const stack = await this.stack();
+		if (call.ended) throw new CliError("unavailable", "The call ended before it was answered");
+		if (call.state !== "ringing") throw new CliError("refused", "That call is not ringing here");
 		call.state = "connecting";
 		this.disarm(call);
 		try {
@@ -17364,10 +17863,18 @@ var CallManager = class {
 		this.calls.set(call.id, call);
 		return call;
 	}
-	/** The call's socket (open from now on: a program may connect before the media is up) and its media. */
+	/**
+	* The call's socket (open from now on: a program may connect before the media is up) and its media. A call that
+	* ended while its socket opened closes it here: `end` found none to close, and nothing lists the call any more.
+	*/
 	async attach(call, create) {
 		const queue = call.queue = new PlaybackQueue(call.rate);
-		call.socket = await AudioSocket.open(audioSocketPath(this.host.profileDir, call.id), call.rate, { onAudio: (chunk) => queue.push(chunk) });
+		const socket = await AudioSocket.open(audioSocketPath(this.host.profileDir, call.id), call.rate, { onAudio: (chunk) => queue.push(chunk) });
+		if (call.ended) {
+			await socket.close();
+			return;
+		}
+		call.socket = socket;
 		await this.connect(call, create);
 	}
 	/**
@@ -17375,6 +17882,7 @@ var CallManager = class {
 	* the call ended, or asked for a newer connection, while this one was made: then it is closed.
 	*/
 	async connect(call, create) {
+		if (call.ended) return false;
 		const attempt = ++call.attempt;
 		call.media?.close();
 		call.media = null;
@@ -19017,6 +19525,7 @@ async function openPersistentIndexedDb(dir) {
 	const factory = new IDBFactory();
 	const raw = factory;
 	const classes = await probeClasses(factory);
+	dropIndexEntriesByRecord(classes, (a, b) => factory.cmp(a, b));
 	let writing = true;
 	let restoring = true;
 	let journalFd = null;
@@ -19204,7 +19713,8 @@ async function probeClasses(factory) {
 	const classes = {
 		Database: rawDb.constructor,
 		ObjectStore: rawStore.constructor,
-		Index: rawStore.rawIndexes.get("i").constructor
+		Index: rawStore.rawIndexes.get("i").constructor,
+		RecordStore: rawStore.records.constructor
 	};
 	db.close();
 	await new Promise((resolve) => {
@@ -19213,6 +19723,76 @@ async function probeClasses(factory) {
 	});
 	return classes;
 }
+/** The classes whose index upkeep is already by record: they are fake-indexeddb's own, shared by every store opened. */
+var byRecord = /* @__PURE__ */ new WeakSet();
+/**
+* fake-indexeddb drops an overwritten or deleted record from an index by walking every entry of it (an index is in
+* its own key's order, not the record's): each delivery mark, edit or reaction cost time with every message of the
+* profile, 170 ms at 10,000, and a long chat slowed every other one. The store has the records it just replaced or
+* removed in hand, and they say which entries to drop; a call that comes any other way still walks.
+*/
+function dropIndexEntriesByRecord(classes, cmp) {
+	const storeProto = classes.ObjectStore.prototype;
+	const recordsProto = classes.RecordStore.prototype;
+	if (byRecord.has(storeProto)) return;
+	byRecord.add(storeProto);
+	const { storeRecord, deleteRecord } = storeProto;
+	const { put, delete: remove, deleteByValue } = recordsProto;
+	let gone = null;
+	storeProto.storeRecord = function(record, noOverwrite, rollbackLog) {
+		if (!this.rawIndexes.size) return storeRecord.call(this, record, noOverwrite, rollbackLog);
+		const records = this.records, indexes = this.rawIndexes, outer = gone;
+		records.put = (next, keep) => {
+			const replaced = put.call(this.records, next, keep);
+			gone = {
+				indexes,
+				records: replaced ? [replaced] : []
+			};
+			return replaced;
+		};
+		try {
+			return storeRecord.call(this, record, noOverwrite, rollbackLog);
+		} finally {
+			delete records.put;
+			gone = outer;
+		}
+	};
+	storeProto.deleteRecord = function(key, rollbackLog) {
+		if (!this.rawIndexes.size) return deleteRecord.call(this, key, rollbackLog);
+		const records = this.records, indexes = this.rawIndexes, outer = gone;
+		records.delete = (range) => {
+			const removed = remove.call(this.records, range);
+			gone = {
+				indexes,
+				records: removed
+			};
+			return removed;
+		};
+		try {
+			deleteRecord.call(this, key, rollbackLog);
+		} finally {
+			delete records.delete;
+			gone = outer;
+		}
+	};
+	recordsProto.deleteByValue = function(key) {
+		let index;
+		if (gone) {
+			for (const candidate of gone.indexes.values()) if (candidate.records === this) index = candidate;
+		}
+		if (!gone || !index) return deleteByValue.call(this, key);
+		const dropped = [];
+		for (const entry of indexEntries(index, gone.records, cmp)) {
+			if (this.keysAreUnique) {
+				const held = this.get(entry.key);
+				if (!held || cmp(held.value, entry.value) !== 0) continue;
+			}
+			this.records.delete(entry);
+			dropped.push(entry);
+		}
+		return dropped;
+	};
+}
 /**
 * The snapshot's records come in key order (as `writeSnapshot` walks them), so each store's tree and each index's are
 * built whole from sorted arrays: storing record by record compared every key down the tree, a 70,000-message profile
@@ -19608,14 +20188,14 @@ async function startRuntime(paths, options = {}) {
 	(await import("./assets/ghostly_iroh_web-Dvzh3Y6E.js")).initSync({ module: irohWasmBytes() });
 	const [{ registerFileBytes }, { NodeFileBytes }] = await Promise.all([import("./assets/fileBytes-BcYZhNgF.js").then((n) => n.o), import("./assets/fileBytes-Dbifu5I5.js")]);
 	registerFileBytes("native", async () => new NodeFileBytes(paths.files), true);
-	const [{ EngineServer }, { createHyperEndpoint }] = await Promise.all([import("./assets/server-BGXmSYx_.js").then((n) => n.t), import("./assets/endpoint-pgFkR2AS.js")]);
+	const [{ EngineServer }, { createHyperEndpoint }] = await Promise.all([import("./assets/server-Cy4ox7oD.js").then((n) => n.t), import("./assets/endpoint-pgFkR2AS.js")]);
 	const network = hyperdhtNetwork();
 	const dht = mainlineNetwork();
-	const mainline = dht.off ? null : new (await (import("./assets/mainline-BueFJx3f.js"))).Mainline({
+	const mainline = dht.off ? null : new (await (import("./assets/mainline-1v8OTYvp.js"))).Mainline({
 		bootstrap: dht.bootstrap,
 		host: dht.host
 	});
-	const transport = mainline || pinned ? new (await (import("./assets/mainline-BueFJx3f.js"))).RelaysAndDht(mainline, pinned ? { relays: pinned } : {}, !!pinned) : null;
+	const transport = mainline || pinned ? new (await (import("./assets/mainline-1v8OTYvp.js"))).RelaysAndDht(mainline, pinned ? { relays: pinned } : {}, !!pinned) : null;
 	const server = new EngineServer({
 		...transport ? { transport } : {},
 		irohWeb: true,
@@ -19926,19 +20506,21 @@ function toTurn(event) {
 }
 function turn(event, source, where, message) {
 	const file = message.file;
+	const place = where.chat ?? where.group ?? "", messageId = turnRef(place, message.id);
 	return {
 		seq: event.seq,
-		id: `agent.turn:${event.id}`,
+		id: `agent.turn:${source}:${place}:${messageId}`,
 		type: "agent.turn",
 		at: event.at,
 		source,
 		...where,
-		messageId: message.id,
+		messageId,
 		timestamp: message.timestamp,
 		...message.press ? { press: message.press } : {},
 		untrusted: {
 			text: message.text,
 			name: message.nick ?? null,
+			messageId: message.id,
 			...message.replyTo ? { replyTo: {
 				id: message.replyTo.id,
 				snippet: message.replyTo.snippet
@@ -20127,7 +20709,14 @@ function requireProfile(g) {
 		createProfile(g.home, g.profile);
 		return;
 	}
-	throw new CliError("not_found", `No profile ${g.profile}: make it with \`ghostly profile create ${g.profile}\``);
+	throw noProfile(g);
+}
+function noProfile(g) {
+	return new CliError("not_found", `No profile ${g.profile}: make it with \`ghostly profile create ${g.profile}\``);
+}
+/** For a command that only reads: a mistyped profile is named as one, and `default` is not made by asking about it. */
+function knownProfile(g) {
+	if (g.profile !== "default" && !profileExists(g.home, g.profile)) throw noProfile(g);
 }
 /** Said on stderr when the daemon runs another release than this command (it started before an upgrade). */
 function versionWarning(daemon, cli) {
@@ -20263,7 +20852,7 @@ var SPECIAL = [
 		"The profile's settings",
 		{ "show-secret": o("boolean", "Show credentials too") }
 	],
-	["settings set <key> <json-value>", "Change one: relays, irohRelays, hyperdhtRelay, readRelays, iceServers, publicProfiles, online, shareProfile, sendTyping, nick"],
+	["settings set <key> <json-value>", "Change one: relays, irohRelays, hyperdhtRelay, readRelays, iceServers, publicProfiles, online, shareProfile, sendTyping, autoDownloads, serveFiles, nick"],
 	[
 		"engine <method> [json-params | -] [--confirm-real] [--show-secret]",
 		"Any call of the app's engine, with its own parameters",
@@ -20309,6 +20898,14 @@ function help() {
 		"2 usage, 3 not found, 4 timed out, 5 needs --force/--yes/--confirm-real. See packages/cli/README.md."
 	].join("\n");
 }
+/** What `ghostly help help` answers. */
+var HELP_USAGE = [
+	"Usage: ghostly help [<command>...]",
+	"",
+	"  Help for every command, or for one command or a group of them (also ghostly <command> --help)",
+	"",
+	"Options for every command: --profile, -p <name>  --home <dir>  --pretty  --help, -h"
+].join("\n");
 /** Every command's help row: usage, summary and, for the table and text commands, their options. */
 function helpRows() {
 	return [
@@ -20335,6 +20932,7 @@ function commandWords(usage) {
 * options; for a group (`ghostly help file`), the group's commands.
 */
 function commandHelp(words) {
+	if (words[0] === "help") return HELP_USAGE;
 	const named = (list) => helpRows().filter((row) => {
 		const own = commandWords(row.usage);
 		return list.every((word, i) => own[i] === word);
@@ -20591,6 +21189,7 @@ async function daemonCommand(argv) {
 		"restart"
 	].includes(sub)) noMoreThan(0, parsed.positionals, sub ? `daemon ${sub}` : "daemon [--detach]");
 	if (sub === "status") {
+		knownProfile(g);
 		const client = await connectDaemon(g.paths.socket);
 		if (!client) {
 			print({
@@ -20612,32 +21211,43 @@ async function daemonCommand(argv) {
 		return;
 	}
 	if (sub === "stop") {
+		knownProfile(g);
+		const stopFor = seconds(parsed, 20);
 		const client = await connectDaemon(g.paths.socket);
 		if (!client) throw new CliError("not_found", `No daemon runs profile ${g.profile}`);
 		print({
 			stopped: true,
-			pid: await stopDaemon(g, client, Number(parsed.options.timeout) || 20)
+			pid: await stopDaemon(g, client, stopFor)
 		});
 		return;
 	}
 	if (sub === "restart") {
+		const stopFor = seconds(parsed, 20), startFor = seconds(parsed, 60);
 		const client = await connectDaemon(g.paths.socket);
 		const before = client ? (await client.call("status").catch(() => null))?.version ?? null : null;
 		print({
 			restarted: true,
-			stopped: client ? await stopDaemon(g, client, Number(parsed.options.timeout) || 20) : null,
+			stopped: client ? await stopDaemon(g, client, stopFor) : null,
 			before,
 			version: VERSION,
-			...await startDetached(g, Number(parsed.options.timeout) || 60)
+			...await startDetached(g, startFor)
 		});
 		return;
 	}
 	if (sub) throw new CliError("usage", "ghostly daemon [--detach] | daemon status | daemon stop | daemon restart");
+	const startFor = seconds(parsed, 60);
 	if (!parsed.options.detach) {
 		await runDaemon(g);
 		return;
 	}
-	print(await startDetached(g, Number(parsed.options.timeout) || 60));
+	print(await startDetached(g, startFor));
+}
+/** `--timeout <s>`, or `fallback` without one: seconds above 0 (0 or less would not wait at all). */
+function seconds(parsed, fallback) {
+	const value = parsed.options.timeout;
+	if (value === void 0) return fallback;
+	if (typeof value !== "number" || !(value > 0)) throw new CliError("usage", "--timeout takes a number of seconds above 0");
+	return value;
 }
 /**
 * Asks the daemon to stop and waits until its process is gone, not only until it let go of the profile (it releases
@@ -20697,6 +21307,10 @@ async function startDetached(g, seconds) {
 	}
 	if (!client) {
 		heldBy(g, child.pid);
+		if (child.exitCode === null && child.pid !== void 0 && processAlive(child.pid)) throw new CliError("timeout", `The daemon (process ${child.pid}) is still starting; ghostly daemon status shows when it is up`, {
+			pid: child.pid,
+			log: g.paths.log
+		});
 		throw new CliError("engine", `The daemon did not start; see ${g.paths.log}`);
 	}
 	client.close();
@@ -20884,17 +21498,7 @@ async function engineCommand(argv) {
 		params,
 		confirmReal
 	}));
-	if (method === "getState" && !showSecret && result && typeof result === "object") {
-		const state = result;
-		result = {
-			...state,
-			settings: redactSettings(state.settings),
-			...state.groups ? { groups: state.groups.map((g) => g.entryLink ? {
-				...g,
-				entryLink: "<hidden>"
-			} : g) } : {}
-		};
-	}
+	if (method === "getState" && !showSecret && result && typeof result === "object") result = hideStateSecrets(result);
 	print(result);
 }
 async function settingsCommand(sub, argv) {
@@ -21127,12 +21731,14 @@ async function main(input) {
 		return 0;
 	}
 	if (argv[0] === "--version" || argv[0] === "version") {
+		pretty = argv.slice(1).some((word) => word === "--pretty" || word === "--pretty=true");
 		print({ version: VERSION });
 		return 0;
 	}
 	const [first, second] = argv;
 	const two = second && !second.startsWith("-") ? `${first} ${second}` : "";
-	if (first === "profile" && !COMMANDS[two]) {
+	const text = (name) => Object.hasOwn(TEXT_COMMANDS, name), table = (name) => Object.hasOwn(COMMANDS, name);
+	if (first === "profile" && !table(two)) {
 		await profileCommand(second, argv.slice(2));
 		return 0;
 	}
@@ -21160,19 +21766,19 @@ async function main(input) {
 		await callPipeCommand(argv.slice(2));
 		return -1;
 	}
-	if (two && TEXT_COMMANDS[two]) {
+	if (two && text(two)) {
 		await textCommand(two, argv.slice(2));
 		return 0;
 	}
-	if (two && COMMANDS[two]) {
+	if (two && table(two)) {
 		await tableCommand(two, argv.slice(2));
 		return 0;
 	}
-	if (TEXT_COMMANDS[first]) {
+	if (text(first)) {
 		await textCommand(first, argv.slice(1));
 		return 0;
 	}
-	if (COMMANDS[first]) {
+	if (table(first)) {
 		await tableCommand(first, argv.slice(1));
 		return 0;
 	}
@@ -21221,7 +21827,29 @@ async function run(argv) {
 	}
 }
 //#endregion
+//#region src/runtime/webStorage.ts
+/**
+* Node 25 and newer define `globalThis.localStorage` as a getter that, without `--localstorage-file`, answers
+* `undefined` and writes an ExperimentalWarning on stderr the first time it is read. The engine reads it where a
+* browser keeps a setting (`globalThis.localStorage?.getItem(...)`), so every command that opens a profile printed the
+* warning. Without the flag the CLI has no localStorage, as on Node 22: the getter is replaced by `undefined` before
+* anything reads it. With the flag, Node's storage stays.
+*/
+function quietWebStorage(scope = globalThis, execArgv = process.execArgv, nodeOptions = process.env.NODE_OPTIONS) {
+	const own = Object.getOwnPropertyDescriptor(scope, "localStorage");
+	if (!own?.get || !own.configurable) return;
+	const flag = (arg) => arg === "--localstorage-file" || arg.startsWith("--localstorage-file=");
+	if (execArgv.some(flag) || (nodeOptions ?? "").split(/\s+/).some(flag)) return;
+	Object.defineProperty(scope, "localStorage", {
+		value: void 0,
+		writable: true,
+		configurable: true,
+		enumerable: false
+	});
+}
+//#endregion
 //#region src/bin.ts
+quietWebStorage();
 run(process.argv.slice(2));
 //#endregion
 export { BACKUP_MEDIA_TYPE as $, requireTurn as A, paymentWireId as At, networkLabel as B, breezDatabasesFor as C, storedGroupFiles as Ct, sourceKey as D, replyRef as Dt, ProviderSources as E, receivedPairedReply as Et, sealSeed as F, streamStored as Ft, BITCOIN_INVOICE_ON_TESTNET as G, cashuMint as H, unsealSeed as I, fakesLightning as J, DEFAULT_MINTS as K, ModeChanged as L, setSingleWriterGate as M, readStored as Mt, intentRepository as N, removeStored as Nt, awayFrom as O, replyTo as Ot, newDeviceKey as P, storedSize as Pt, paysItsOwnInvoices as Q, ModeGate as R, breezDatabaseInUse as S, groupOfFile as St, lightningPaying as T, pairedWireReply as Tt, MESSAGE_DETAILS_MAX_BYTES as U, CASHU_MINT_SOURCE as V, WALLET_TYPES as W, isWorthlessMint as X, isTestMint as Y, mintNetwork as Z, LightningCards as _, verifyIdentity as _t, irohRelayProblem as a, reserveAdapterIds as at, normalizePhrase as b, groupFileId as bt, createFailure as c, SourceConfigError as ct, paymentNetwork as d, networkMode as dt, MAX_BACKUP_BYTES as et, paymentNetworksOf as f, redact as ft, CASHU_CARD as g, boundedIdentityFetch as gt, rpcHost as h, setOwnDidSource as ht, createIrohWebEndpoint as i, registeredOnchainProviders as it, setAwayWallets as j, FileAppender as jt, refuseAway as k, paymentAlias as kt, createTiming as l, SourceUnreachableError as lt, networkReason as m, resolveAtprotoDid as mt, loadFedimintSdk as n, onAdaptersChanged as nt, WALLET_NAMES as o, NothingSpentError as ot, walletInstances as p, assertPublicServer as pt, TEST_MINT as q, DEFAULT_IROH_RELAYS as r, registeredLightningProviders as rt, assertConfirmedReal as s, PROVIDER_PLATFORMS as st, fedimintDatabase as t, identityProviders as tt, crossNetwork as u, isNothingSpentError as ut, cardsKey as v, chosenResolver as vt, dropBreezDatabase as w, groupReply as wt, breezDatabase as x, groupFileText as xt, isRecoveryPhrase as y, GroupFileDesk as yt, WrongNetworkError as z };