@ghostlytools/cli 1.2.1 → 1.2.2

package/dist/ghostly.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { t as __exportAll } from "./assets/rolldown-runtime-8H4AJuhK.js";
-import { $ as SSHSIG_NAMESPACE, $a as appRef, $c as randomBytes$1, $n as engineError, An as encodeDnsQuery, Ao as RTC_CONFIG, At as didJwsAlg, Ba as cardLine, Bn as resolveLightningDestination, Bt as parseDidSignaturePaste, Cn as homeserverWebEndpoint, Ct as DID_DOCUMENT_MAX_BYTES$1, Dn as dnsProofName, Dt as checkDidJws, En as decodeDnsResponse, Eo as LIMITS, Et as DidError, Fa as PR_CHECKS, Fn as recordsFromWellKnown, Fo as extractParamsFromSdp, Ft as didWebFileUrl, Ha as checkStatusCard, Hc as openRelayPayload, Ht as staticDidDocument, Ia as PR_STATES, Ii as identityStatement, In as recordsName, Io as parseCallSignal, It as didWebHost, Jt as resolveDidDht, Ki as irohDescriptor, Kr as sanitizeTypingStatus, La as RUN_RESULTS, Ln as txtValue, Lo as signalHasVideo, Lt as normalizeDid, Ma as replySnippet, Mn as nip05RootKey, Mo as buildSdpFromSignal, Mt as didWebDocumentUrl, Nc as setLinkTraceSink, Ni as boundVerifiedIdentity, Nn as normalizeDomain, No as callRtcConfig, Nt as didWebFile, On as domainTxtRecord, Ot as checkDidSignature, Pa as ITEM_STATES, Pn as recordsFromTxt, Po as callSignalHeardAt, Pt as didWebFileNames, Qa as appFingerprint, Qc as fromBase64Url$1, Ra as STATUS_CARD_LIMITS, Rn as wellKnownUrl, Rt as parseDid, Sn as pubkyProofPath, So as GhostlyHttpError, St as verifyAtprotoRecordProof, Tn as DOMAIN_FILE_MAX_BYTES, Ur as TYPING_KINDS, Ut as strictBase64Url, Va as cardUrl, Vn as decodeBolt11, Vr as transferEnded, Vt as signingKeys, Wr as TYPING_REFRESH_MS, Xa as APP_PREFIXES, Xc as sanitizeAvatar, Yc as MAX_AVATAR_LENGTH, Z as groupName, Za as APP_STATEMENT_LIMITS, _ as readAppBundle, _n as isPubkyProofFolder, _t as isAtprotoDid, aa as PLAYABLE_AUDIO, ao as signAppObject, ar as fetchesByItself, at as verifySshSignature, bn as pubkyProofCapability, bt as shortAtprotoDid, c as signAppStore, ca as fileMessageText, ci as checkPushEndpoint, co as canonicalJsonBytes, ct as decodeAnyBitcoinAddress, dr as readGroupWantNo, dt as ATPROTO_PROOF_COLLECTION, ea as readImageMeta, el as toBase64Url, eo as checkAppRevokeStatement, er as engineText, et as SshSigError, ft as ATPROTO_PROOF_SCOPE, g as isAppUrl, gn as isPubkyKey, gt as checkAtprotoProofRecord, h as checkAppManifest, hn as PUBKY_PROOF_MAX_BYTES, ht as atprotoProofRkey, ia as sanitizeMime, in as WALLET_NETWORKS, io as readAppRevocations, ir as GROUP_WANT_NO_FRAME, it as sshSignCommand, ji as IdentityCheckUnavailable, jn as isPublicAddress, jo as answersOffer, jt as didSignedMessages, kn as domainWellKnownFile, ko as CALL_SIGNAL_MAX_AGE_MS, kt as didGhostlyServiceEntry, l as APP_BUNDLE_LIMITS, la as parseVoiceMeta, ln as walletNetworkOf, lr as readGroupHave, lt as ATPROTO_DECLARED_SCOPE, m as assembleAppBundle, ma as RateWindow, mt as atprotoProofRecord, n as appStoreDecision, nc as inviteLink, nl as utf8Decode, nr as GROUP_HAVE_FRAME, nt as parseSshSignature, o as checkAppStoreIndex, oa as VOICE_LIMITS, oo as signAppRevocation, or as groupFileFallback, ot as verifyBitcoinMessage, pc as seedSigner, pi as BUTTONS_CAPABILITY, pt as atprotoDidMethod, qi as irohRelayUrl, ra as sanitizeFileName, rl as utf8Encode, rt as sameSshKey, s as readAppStore, sa as baseMime, so as canonicalJson, sr as isGroupMessageId, st as BitcoinAddressError, tl as toZ32, tr as GROUP_FILE_LIMITS, tt as parseSshPublicKey, ua as voicePeaksOf, ur as readGroupWant, ut as ATPROTO_FULL_SCOPE, vn as newPubkyProofFolder, vt as normalizeAtprotoHandle, wn as pubkyHomeserverOf, wt as DID_FILE_MAX_BYTES, xn as pubkyProofFile, xt as AtprotoProofError, yn as normalizePubkyKey, yt as parseAtprotoDidDocument, za as buttonLabelClash, zc as RELAY_PAYLOAD_MAX_BYTES, zn as requestLnurlInvoice, zr as ChatFiles, zt as parseDidDocument } from "./assets/src-aKGjb_yz.js";
+import { $ as groupName, $a as APP_PREFIXES, $c as sanitizeAvatar, $n as readGroupWantNo, At as checkDidSignature, Ba as RUN_RESULTS, Bo as signalHasVideo, Bt as parseDid, Ci as recordsFromWellKnown, Cn as pubkyProofFile, Ct as AtprotoProofError, Dn as requestLnurlInvoice, Dr as ChatFiles, Ei as wellKnownUrl, En as pubkyHomeserverOf, Et as DID_FILE_MAX_BYTES, Fa as replySnippet, Fo as buildSdpFromSignal, Ft as didWebFile, Ga as checkStatusCard, Gc as openRelayPayload, Gt as strictBase64Url, Ha as buttonLabelClash, Hc as RELAY_PAYLOAD_MAX_BYTES, Hn as engineText, Ht as parseDidSignaturePaste, Ic as setLinkTraceSink, Ii as boundVerifiedIdentity, Io as callRtcConfig, It as didWebFileNames, Jn as groupFileFallback, Kn as GROUP_WANT_NO_FRAME, La as ITEM_STATES, Lo as callSignalHeardAt, Lt as didWebFileUrl, Mo as CALL_SIGNAL_MAX_AGE_MS, Mr as TYPING_REFRESH_MS, Mt as didJwsAlg, No as RTC_CONFIG, Nt as didSignedMessages, On as resolveLightningDestination, Ot as DidError, Pi as IdentityCheckUnavailable, Po as answersOffer, Pr as sanitizeTypingStatus, Pt as didWebDocumentUrl, Qc as MAX_AVATAR_LENGTH, Qn as readGroupWant, Ra as PR_CHECKS, Ro as extractParamsFromSdp, Rt as didWebHost, Si as recordsFromTxt, Sn as pubkyProofCapability, St as shortAtprotoDid, Ti as txtValue, Tn as homeserverWebEndpoint, To as GhostlyHttpError, Tt as DID_DOCUMENT_MAX_BYTES$1, Ua as cardLine, Un as GROUP_FILE_LIMITS, Ut as signingKeys, Va as STATUS_CARD_LIMITS, Vn as engineError, Vt as parseDidDocument, Wa as cardUrl, Wn as GROUP_HAVE_FRAME, Wt as staticDidDocument, Xi as irohRelayUrl, Xr as checkPushEndpoint, Xt as resolveDidDht, Yi as irohDescriptor, Yn as isGroupMessageId, Zn as readGroupHave, _ as checkAppManifest, _a as RateWindow, _i as domainWellKnownFile, _n as PUBKY_PROOF_MAX_BYTES, _t as atprotoProofRkey, ac as inviteLink, al as utf8Decode, at as sameSshKey, bi as nip05RootKey, bn as newPubkyProofFolder, bt as normalizeAtprotoHandle, c as readAppStore, ca as PLAYABLE_AUDIO, co as signAppObject, ct as verifyBitcoinMessage, d as APP_BUNDLE_LIMITS, da as fileMessageText, dn as walletNetworkOf, do as canonicalJsonBytes, dt as ATPROTO_DECLARED_SCOPE, eo as APP_STATEMENT_LIMITS, fa as parseVoiceMeta, ft as ATPROTO_FULL_SCOPE, g as assembleAppBundle, gc as seedSigner, gi as domainTxtRecord, gt as atprotoProofRecord, hi as dnsProofName, ht as atprotoDidMethod, il as toZ32, it as parseSshSignature, jr as TYPING_KINDS, jt as didGhostlyServiceEntry, kn as decodeBolt11, ko as LIMITS, kr as transferEnded, kt as checkDidJws, la as VOICE_LIMITS, lo as signAppRevocation, lt as BitcoinAddressError, mi as decodeDnsResponse, mt as ATPROTO_PROOF_SCOPE, n as appStoreDecision, nl as randomBytes$1, no as appRef, nt as SshSigError, oa as sanitizeFileName, ol as utf8Encode, on as WALLET_NETWORKS, ot as sshSignCommand, pa as voicePeaksOf, pi as DOMAIN_FILE_MAX_BYTES, pt as ATPROTO_PROOF_COLLECTION, qn as fetchesByItself, ra as readImageMeta, rl as toBase64Url, ro as checkAppRevokeStatement, rt as parseSshPublicKey, s as checkAppStoreIndex, sa as sanitizeMime, so as readAppRevocations, st as verifySshSignature, ti as BUTTONS_CAPABILITY, tl as fromBase64Url$1, to as appFingerprint, tt as SSHSIG_NAMESPACE, u as signAppStore, ua as baseMime, uo as canonicalJson, ut as decodeAnyBitcoinAddress, v as isAppUrl, vi as encodeDnsQuery, vn as isPubkyKey, vt as checkAtprotoProofRecord, wi as recordsName, wn as pubkyProofPath, wt as verifyAtprotoRecordProof, xi as normalizeDomain, xn as normalizePubkyKey, xt as parseAtprotoDidDocument, y as readAppBundle, yi as isPublicAddress, yn as isPubkyProofFolder, yt as isAtprotoDid, za as PR_STATES, zi as identityStatement, zo as parseCallSignal, zt as normalizeDid } from "./assets/src-XzcHzneo.js";
 import { c as fileStore, f as store$1, i as STORES, m as wrap, o as databaseName, p as transact, u as openDb } from "./assets/idb-CTF6LF5B.js";
 import { a as fileBytesOf, i as fileBytes, l as FILE_BYTES_STEP } from "./assets/fileBytes-BcYZhNgF.js";
 import { createRequire } from "node:module";
@@ -35,7 +35,7 @@ import { IDBFactory, IDBKeyRange as IDBKeyRange$1, IDBTransaction } from "fake-i
 import { format } from "node:util";
 var package_default = {
 	name: "@ghostlytools/cli",
-	version: "1.2.1",
+	version: "1.2.2",
 	type: "module",
 	description: "Ghostly for bots and terminals: the app's own engine, headless on Node, behind a daemon and a `ghostly` command with JSON output.",
 	license: "MIT",
@@ -285,15 +285,21 @@ function parseArgs(argv, spec, idSlot = () => false) {
 }
 /** The global option a word names (`--profile`, `--profile=bot`, `-p`), else undefined. */
 function globalOption(arg) {
+	const name = globalName(arg);
+	return name ? GLOBAL_OPTIONS[name] : void 0;
+}
+/** The name of the global option a word names (`profile` for `-p`), else undefined. */
+function globalName(arg) {
 	const eq = arg.indexOf("=");
 	const name = arg.startsWith("--") ? arg.slice(2, eq === -1 ? void 0 : eq) : arg.length === 2 && arg.startsWith("-") ? Object.entries(GLOBAL_OPTIONS).find(([, o]) => o.short === arg.slice(1))?.[0] : void 0;
-	return name && Object.hasOwn(GLOBAL_OPTIONS, name) ? GLOBAL_OPTIONS[name] : void 0;
+	return name && Object.hasOwn(GLOBAL_OPTIONS, name) ? name : void 0;
 }
 /**
 * Global options given before the command (`ghostly --profile bot send …`) move after it, where every command's
 * parser reads them. Stops at `--` and at the first word that is not a global option. They go before the first word
 * after the command's that starts with a dash (its first option, or the `--` that ends them), else at the end: never
-* between an option and its value, which may itself be `--` (`--pretty profile set --name --`).
+* between an option and its value, which may itself be `--` (`--pretty profile set --name --`). One that takes a value
+* and is the last word has none: a usage error.
 */
 function liftGlobals(argv) {
 	const lifted = [];
@@ -304,6 +310,7 @@ function liftGlobals(argv) {
 		const option = globalOption(arg);
 		if (!option || arg === "--") break;
 		const takesValue = option.type !== "boolean" && eq === -1;
+		if (takesValue && i + 1 >= argv.length) throw new CliError("usage", `--${globalName(arg)} needs a value`);
 		lifted.push(...argv.slice(i, i + (takesValue ? 2 : 1)));
 		i += takesValue ? 2 : 1;
 	}
@@ -335,14 +342,26 @@ var SECRET_CONTEXT = /priv(?:ate)?[\s_-]*key|secret|seed|mnemonic|nsec|xprv|\bwi
 /** How far from a 64-hex string a word like "seed" still counts as saying what it is. */
 var CONTEXT_REACH = 48;
 var CASHU_TOKEN = /\bcashu([AB])([A-Za-z0-9_\-+/]{20,}={0,2})/g;
+/**
+* Characters that take no room on screen: format characters (zero-width space, soft hyphen, word joiner, the joiners,
+* direction marks), control characters that are not white space, variation selectors, the grapheme joiner and the
+* Hangul fillers. A page, a PDF or a terminal puts some of them into long strings as places to break a line.
+*/
+var INVISIBLE = /(?![\t\n\v\f\r\x85])[\p{Cc}\p{Cf}]|\u034f|[\u115f\u1160\u3164\uffa0]|[\ufe00-\ufe0f]|[\u{e0100}-\u{e01ef}]/gu;
 var base58check = createBase58check(sha256);
-/** The first secret in `text`, keys and seeds before ecash; null for anything else. */
+/**
+* The first secret in `text`, keys and seeds before ecash; null for anything else. The text is read as it is and as
+* it reads without its invisible characters: a key with one inside is whole again once the reader takes it out.
+*/
 function findSecret(text) {
-	if (hasMnemonic(text)) return { kind: "mnemonic" };
-	if (NSEC.test(text)) return { kind: "nsec" };
-	if (EXTENDED_PRIVATE.test(text) || hasWif(text)) return { kind: "bitcoin-key" };
-	if (hasHexSecret(text)) return { kind: "hex-key" };
-	return findCashu(text);
+	const visible = text.replace(INVISIBLE, "");
+	const readings = visible === text ? [text] : [text, visible];
+	if (readings.some(hasMnemonic)) return { kind: "mnemonic" };
+	if (readings.some((reading) => NSEC.test(reading))) return { kind: "nsec" };
+	if (readings.some((reading) => EXTENDED_PRIVATE.test(reading) || hasWif(reading))) return { kind: "bitcoin-key" };
+	if (readings.some(hasHexSecret)) return { kind: "hex-key" };
+	const tokens = readings.map(findCashu);
+	return tokens.find((found) => found?.kind === "cashu" && found.amount !== null) ?? tokens.find((found) => found) ?? null;
 }
 /**
 * 12 to 24 words in a row from the English BIP39 list whose checksum holds, anywhere in the text; or a message that
@@ -875,7 +894,8 @@ function findGroup(groups, ref) {
 * A chat or a group, where a command takes either: `group:<id>` is a group; anything else a chat first (`findChat`),
 * then a group. A chat found only by the name its contact gave itself never takes what also names a group: a group's
 * own id is that group, and a prefix or the name of a group this profile is in is refused, with both ids. With neither,
-* the error says what `findChat` would.
+* one `not_found` names both and where to look (a contact's key: no chat with it); a name that matches more than one
+* chat or group stays that error.
 */
 function findChatOrGroup(links, groups, ref) {
 	if (ref.startsWith("group:")) return { group: findGroup(groups, ref.slice(6)) };
@@ -887,7 +907,9 @@ function findChatOrGroup(links, groups, ref) {
 		try {
 			return { group: findGroup(groups, ref) };
 		} catch (inner) {
-			throw inner instanceof CliError && inner.code !== "not_found" ? inner : error;
+			if (!(inner instanceof CliError) || inner.code !== "not_found") throw inner;
+			if (CONTACT_KEY.test(ref)) throw error;
+			throw new CliError("not_found", `No chat or group ${JSON.stringify(ref)} (ghostly chat list, ghostly group list)`);
 		}
 	}
 	if (!chat.theirName) return { link: chat.link };
@@ -916,6 +938,16 @@ function chatOrGroup(ctx, ref) {
 	};
 }
 var groupOf = (ctx, params) => findGroup(state(ctx).groups, str(params, "group", true));
+/**
+* A message of a chat or a group (`group:<id>`) named by its id here, read as one row; only a name that is no such
+* row's key (the id both sides know, `wireId`) reads the whole history. `keep`: only a message it accepts (mine, or
+* someone else's). The history is synchronous work on the daemon's one thread, about 120 ms at 10,000 messages.
+*/
+async function messageOf(ctx, linkId, ref, keep = () => true) {
+	const found = await node(ctx).getMessage(linkId, ref);
+	if (found && keep(found)) return found;
+	return (linkId.startsWith("group:") ? await node(ctx).groupMessages({ groupId: linkId.slice(6) }) : await node(ctx).getMessages(linkId)).find((m) => keep(m) && m.wireId === ref);
+}
 /** Resolves with `check`'s first defined answer: now, or on a later state; `timeout` error after `ms`. */
 function waitForState(ctx, check, ms, what) {
 	const now = check(state(ctx));
@@ -1131,6 +1163,12 @@ var storedGroupFiles = {
 	read: (file, offset, length) => readStored(file, offset, length),
 	room: async () => (await fileBytes()).room()
 };
+/**
+* Ended transfers an edge keeps the record of. A late frame for one of them is still answered as files/3 says (an abort
+* to an asker going on with a transfer cancelled here); older ones are forgotten, so an edge's records stay few
+* however many transfers it has seen.
+*/
+var ENDED_KEPT = 8;
 /** Why a want waits, as the person reads it (the app shows its own words for each `wait`). */
 var WAITING_NOTES = {
 	nobody: "Nobody you are connected to has this file yet",
@@ -1164,7 +1202,10 @@ var GroupFileDesk = class {
 	constructor(deps) {
 		this.deps = deps;
 	}
-	/** At start: each group's files as they were kept. One fetched by itself, or asked for, and not here yet is asked for again. */
+	/**
+	* At start: each group's files as they were kept. One fetched by itself, or asked for, and not here yet is asked for
+	* again; with automatic downloads off, one chosen by itself before waits for a Download instead.
+	*/
 	async load(groupIds) {
 		for (const groupId of groupIds) for (const file of await this.deps.store.list(groupId).catch(() => [])) {
 			if (!file.group || !file.metadata || !file.digest || this.kept.has(file.id)) continue;
@@ -1205,7 +1246,8 @@ var GroupFileDesk = class {
 				retry: true,
 				error: file.transfer.error ?? DAMAGED$1
 			});
-			else if (kept.auto || kept.asked) this.wants.set(kept.id, this.newWant());
+			else if (kept.asked || kept.auto && this.deps.settings().autoDownloads) this.wants.set(kept.id, this.newWant());
+			else if (kept.auto) await this.stop(kept, false);
 			else this.show(kept, {
 				state: "transferring",
 				stage: "asking",
@@ -1230,6 +1272,56 @@ var GroupFileDesk = class {
 		}
 	}
 	/**
+	* The person stops a file that is coming, or that this device would fetch (Cancel, Decline): nobody is asked for it
+	* any more, the transfer under way ends, what came of it is deleted, and it waits for a Download. Paused (`keep`),
+	* what came stays, and Resume (`download`) goes on from there.
+	*/
+	async halt(fileId, keep = false) {
+		const kept = this.kept.get(fileId);
+		if (!kept) throw new Error("No such file");
+		if (keep && !this.wants.has(fileId)) return;
+		await this.stop(kept, keep);
+	}
+	/** Automatic downloads were turned off: files chosen by themselves and not here yet stop coming, and wait for a Download. */
+	async autoDownloadsOff() {
+		for (const kept of [...this.kept.values()]) if (kept.auto && !kept.asked && this.wants.has(kept.id)) await this.stop(kept, false);
+	}
+	async stop(kept, keep) {
+		if (kept.held || kept.mine) return;
+		const want = this.wants.get(kept.id);
+		this.wants.delete(kept.id);
+		const edge = want?.wire && want.linkId ? this.edgesById.get(want.linkId) : void 0;
+		const record = edge?.files.get("in", want.wire);
+		const { size } = kept.meta;
+		if (!keep) {
+			kept.stored = 0;
+			kept.fresh = true;
+		}
+		if (edge && record && !transferEnded(record)) {
+			if (!keep) kept.dropped = record.id;
+			edge.files.cancel("in", record.id);
+			edge.taking.delete(record.id);
+		} else if (!keep) kept.idle = (kept.idle ?? Promise.resolve()).then(() => this.deps.store.write(kept.id)).then((writer) => writer.discard()).catch(() => {});
+		this.show(kept, keep ? {
+			state: "transferring",
+			stage: "paused",
+			pausedBy: "me",
+			transferred: kept.stored ?? 0,
+			size,
+			direction: "in"
+		} : {
+			state: "transferring",
+			stage: "asking",
+			transferred: 0,
+			size,
+			direction: "in"
+		});
+		if (kept.auto || kept.asked) {
+			kept.auto = kept.asked = false;
+			await this.deps.store.patch(kept.id, { group: this.groupField(kept) }).catch(() => {});
+		}
+	}
+	/**
 	* An error when this group took as many announcements of mine as it takes in a minute, or as its members take from
 	* one member in `announceWindowMs` (past that they would get the text, not the file); null when one may go now.
 	*/
@@ -1696,20 +1788,35 @@ var GroupFileDesk = class {
 		const reserved = active.reduce((sum, a) => sum + a.size, 0);
 		return this.served.bytes + reserved + kept.meta.size > GROUP_FILE_LIMITS.serveBytesPerDay ? "busy" : null;
 	}
-	/** Transfers served now, all groups together: to whom, their size, and whether bytes are still to go. */
+	/**
+	* Transfers served now, all groups together: to whom, what each takes of the day (its size, or what it sent when that
+	* is more), and whether bytes are still to go.
+	*/
 	servingNow() {
 		const active = [];
 		for (const edge of this.edgesById.values()) for (const wire of edge.serving.keys()) {
 			const record = edge.files.get("out", wire);
 			if (record && !transferEnded(record)) active.push({
 				peer: edge.peer,
-				size: record.file.size,
+				size: Math.max(record.file.size, edge.files.sent(wire)),
 				sending: record.confirmed < record.file.size
 			});
 		}
 		return active;
 	}
 	/**
+	* An asker has a served transfer send parts again (WISP 503 § Serving limits): every byte sent counts toward the day,
+	* so it goes on only while the day has room for it.
+	*/
+	mayResend() {
+		const today = Math.floor(this.deps.now() / 864e5);
+		if (this.served.day !== today) this.served = {
+			day: today,
+			bytes: 0
+		};
+		return this.served.bytes + this.servingNow().reduce((sum, a) => sum + a.size, 0) < GROUP_FILE_LIMITS.serveBytesPerDay;
+	}
+	/**
 	* Served transfers that no longer count end, their places free for others (WISP 503 § Serving limits): the asker's
 	* session closed, it is not in the roster any more, or its bytes have not moved for `wantWaitMs` (the asker has moved
 	* on by then).
@@ -1762,6 +1869,7 @@ var GroupFileDesk = class {
 			serving: /* @__PURE__ */ new Map(),
 			servedMoved: /* @__PURE__ */ new Map(),
 			taking: /* @__PURE__ */ new Map(),
+			ended: [],
 			have: /* @__PURE__ */ new Set(),
 			haveAt: 0,
 			busy: /* @__PURE__ */ new Set()
@@ -1779,7 +1887,8 @@ var GroupFileDesk = class {
 			openSource: (record) => this.openSource(edge, record),
 			changed: (record, transferred) => this.transferChanged(edge, record, transferred),
 			room: () => this.deps.store.room(),
-			writable: () => this.deps.writable?.(linkId)
+			writable: () => this.deps.writable?.(linkId),
+			resend: (record) => !edge.serving.has(record.id) || this.mayResend()
 		});
 		this.edgesById.set(linkId, edge);
 		return edge;
@@ -1818,7 +1927,7 @@ var GroupFileDesk = class {
 					if (resumed) kept.fresh = kept.unclear = true;
 					else kept.damaged.add(edge.peer);
 				}
-				return kept.idle = (damaged ? writer.discard() : writer.close()).catch(() => {});
+				return kept.idle = (damaged || kept.dropped === record.id ? writer.discard() : writer.close()).catch(() => {});
 			}
 		};
 	}
@@ -1831,7 +1940,14 @@ var GroupFileDesk = class {
 			digest: async () => kept.meta.d
 		};
 	}
+	/** A transfer on the edge ended: its record stays among the last `ENDED_KEPT`, and the oldest past that is forgotten. */
+	transferOver(edge, record) {
+		if (edge.ended.some(([direction, id]) => direction === record.direction && id === record.id)) return;
+		edge.ended.push([record.direction, record.id]);
+		while (edge.ended.length > ENDED_KEPT) edge.files.forget(...edge.ended.shift());
+	}
 	transferChanged(edge, record, transferred) {
+		if (transferEnded(record)) this.transferOver(edge, record);
 		if (record.direction === "out") {
 			if (transferEnded(record) && edge.serving.has(record.id)) {
 				const today = Math.floor(this.deps.now() / 864e5);
@@ -1839,7 +1955,7 @@ var GroupFileDesk = class {
 					day: today,
 					bytes: 0
 				};
-				this.served.bytes += record.confirmed;
+				this.served.bytes += edge.files.sent(record.id);
 				edge.serving.delete(record.id);
 				edge.servedMoved.delete(record.id);
 				const serving = this.deps.settings().serveFiles;
@@ -2671,15 +2787,16 @@ var FILE_METHODS = {
 	/**
 	* files/3: answer an offer, or pause, resume or cancel a transfer, either way; `resend` a file sent from here that
 	* stopped moving (or failed), `request` again one that stopped arriving. Without a chat, the file's id names it.
-	* A group's file (WISP 503) takes `accept` (download one this device did not fetch by itself) and `request`.
+	* A group's file (WISP 503) takes `accept` (download one this device did not fetch by itself), `request`, and `cancel`,
+	* `decline`, `pause` and `resume` for one that is coming.
 	*/
 	async "file.action"(ctx, params) {
 		const fileId = str(params, "file", true);
 		const { linkId, where } = fileChat(ctx, params, fileId);
 		const action = oneOf(params, "action", ACTIONS, "accept");
 		if ("group" in where) {
-			if (action !== "accept" && action !== "request") throw new CliError("bad_request", "A group's file is downloaded (file accept) or asked for again (file request)");
-			if (state(ctx).transfers[fileId]?.state === "done") throw new CliError("refused", "Nothing to ask for: the file is all here");
+			if (action === "resend") throw new CliError("bad_request", "A group's file is downloaded (file accept) or asked for again (file request)");
+			if (state(ctx).transfers[fileId]?.state === "done") throw new CliError("refused", action === "accept" || action === "request" || action === "resume" ? "Nothing to ask for: the file is all here" : "Nothing to stop: the file is all here");
 			try {
 				await node(ctx).fileAction({
 					linkId,
@@ -3346,8 +3463,7 @@ function pressable(link) {
 	return peer ? peer.includes(BUTTONS_CAPABILITY) : null;
 }
 /** The message of mine with buttons that `button update` names, by its id here (or the id both sides know). */
-function buttonsMessage(messages, ref, group) {
-	const message = messages.find((m) => m.sender === "me" && m.id === ref) ?? messages.find((m) => m.sender === "me" && m.wireId === ref);
+function buttonsMessage(message, ref, group) {
 	if (!message) throw new CliError("not_found", `No message ${JSON.stringify(ref)} of yours in this ${group ? "group" : "chat"}: the messageId send gave`);
 	if (message.card?.kind !== "buttons") throw new CliError("bad_request", "That message has no buttons: send one with send --button id:Label");
 	return message;
@@ -3367,7 +3483,7 @@ async function updateButtons(ctx, params) {
 		const secret = findSecret(newText);
 		if (secret) throw new CliError("confirm", `The text looks like ${secret.kind === "cashu" ? "a Cashu token (money anyone who reads it can take)" : "a secret (a seed or a private key)"}; update with --force if you mean to`, { kind: secret.kind });
 	}
-	const message = buttonsMessage(target.group ? await node(ctx).groupMessages({ groupId: target.id }) : await node(ctx).getMessages(target.linkId), ref, target.group);
+	const message = buttonsMessage(await messageOf(ctx, target.linkId, ref, (m) => m.sender === "me"), ref, target.group);
 	if ((message.edit?.seq ?? 0) >= STATUS_CARD_LIMITS.edits) throw new CliError("refused", `This message took ${STATUS_CARD_LIMITS.edits} updates, the most one takes: ask again with a new send`, {
 		messageId: message.id,
 		edits: message.edit.seq
@@ -3392,7 +3508,7 @@ async function updateButtons(ctx, params) {
 		card
 	});
 	if (result.error) throw new CliError(result.refused ? "refused" : "unavailable", result.error);
-	let edited = target.group ? (await node(ctx).groupMessages({ groupId: target.id })).find((m) => m.id === message.id) : await node(ctx).getMessage(target.linkId, message.id);
+	let edited = await node(ctx).getMessage(target.linkId, message.id);
 	if (wait === "confirmed" && edited?.edit?.pending) edited = await waitForEdit(ctx, target.linkId, message.id, ms);
 	const edges = wait === "sent" && edited?.edit ? await waitForGroupFrame(ctx, target.id, message.id, edited.edit.seq, ms) : void 0;
 	return {
@@ -3415,8 +3531,7 @@ async function pressButton(ctx, params) {
 	const ref = str(params, "message", true);
 	const buttonId = str(params, "button", true);
 	const where = target.group ? "group" : "chat";
-	const theirs = (target.group ? await node(ctx).groupMessages({ groupId: target.id }) : await node(ctx).getMessages(target.linkId)).filter((m) => m.sender !== "me");
-	const message = theirs.find((m) => m.id === ref) ?? theirs.find((m) => m.wireId === ref);
+	const message = await messageOf(ctx, target.linkId, ref, (m) => m.sender !== "me");
 	if (!message) throw new CliError("not_found", `No message ${JSON.stringify(ref)} from someone else in this ${where}: the id its event or history gave`);
 	if (message.card?.kind !== "buttons") throw new CliError("bad_request", "That message has no buttons");
 	const button = message.card.buttons.find((b) => b.id === buttonId);
@@ -3575,7 +3690,7 @@ function isLive(link) {
 	if (link.textDelivery !== "stream" || link.dataLink !== "open") return false;
 	return !link.profile || link.pairing?.status === "ready" && !!link.pairing.transport;
 }
-function chatJson(link) {
+function chatJson(link, showSecret) {
 	const label = link.label?.trim() || null;
 	const peerName = link.peerNick?.trim() || null;
 	const live = isLive(link);
@@ -3593,15 +3708,15 @@ function chatJson(link) {
 		pairing: link.pairing?.status ?? null,
 		stage: link.pairingProgress?.stage ?? null,
 		verified: !!link.peerVerified,
-		invite: link.pairing?.status === "ready" ? null : link.inviteCode ?? null,
+		invite: link.pairing?.status === "ready" || !link.inviteCode ? null : showSecret === true ? link.inviteCode : "<hidden>",
 		compatibility: !link.profile,
 		peerPicture: !!link.peerAvatar
 	};
 }
 /** A chat's details: the summary plus what its connection panel shows. */
-function chatDetailsJson(link) {
+function chatDetailsJson(link, showSecret) {
 	return {
-		...chatJson(link),
+		...chatJson(link, showSecret),
 		progress: link.pairingProgress ?? null,
 		transports: {
 			mine: link.availableTransports ?? [],
@@ -12533,6 +12648,25 @@ function checkTextSize(text) {
 		max: LIMITS.maxChatMessageBytes
 	});
 }
+/**
+* The engine's state as `engine getState` prints it without `--show-secret`: the settings' credentials, a group's
+* entry link (anyone who reads it can join) and a pending chat's invite code (whoever reads it can take the chat)
+* are `<hidden>`.
+*/
+function hideStateSecrets(state) {
+	return {
+		...state,
+		settings: redactSettings(state.settings),
+		...state.groups ? { groups: state.groups.map((g) => g.entryLink ? {
+			...g,
+			entryLink: "<hidden>"
+		} : g) } : {},
+		...state.links ? { links: state.links.map((l) => l.inviteCode ? {
+			...l,
+			inviteCode: "<hidden>"
+		} : l) } : {}
+	};
+}
 /** Settings as a bot may read them: storage credentials and other secrets masked unless asked for. */
 function redactSettings(settings, showSecret = false) {
 	if (showSecret) return settings;
@@ -12560,7 +12694,9 @@ var SETTABLE = {
 	online: "boolean",
 	shareProfile: "boolean",
 	sendTyping: "boolean",
-	nick: "string"
+	nick: "string",
+	autoDownloads: "boolean",
+	serveFiles: "boolean"
 };
 var TRANSPORT_NAMES = {
 	auto: "auto",
@@ -12723,13 +12859,14 @@ var METHODS = {
 		node(ctx).setActiveLink({ linkId });
 		return { chat: linkId };
 	},
-	async "chat.list"(ctx) {
-		return { chats: state(ctx).links.map(chatJson).sort((a, b) => b.lastMessageAt - a.lastMessageAt || b.createdAt - a.createdAt) };
+	async "chat.list"(ctx, params) {
+		const showSecret = bool(params, "showSecret");
+		return { chats: state(ctx).links.map((link) => chatJson(link, showSecret)).sort((a, b) => b.lastMessageAt - a.lastMessageAt || b.createdAt - a.createdAt) };
 	},
 	async "chat.get"(ctx, params) {
 		const link = chatOf(ctx, params);
 		return {
-			...chatDetailsJson(link),
+			...chatDetailsJson(link, bool(params, "showSecret")),
 			heldUntil: holdOf(ctx, link.id)
 		};
 	},
@@ -12795,7 +12932,7 @@ var METHODS = {
 			messageId,
 			text
 		});
-		if (result.error) throw editRefused(await node(ctx).getMessages(link.id), messageId, "chat", result.error, result.refused);
+		if (result.error) throw editRefused(await messageOf(ctx, link.id, messageId), messageId, "chat", result.error, result.refused);
 		const id = result.messageId ?? messageId;
 		let message = await node(ctx).getMessage(link.id, id);
 		if (wait === "confirmed" && message?.edit?.pending) message = await waitForEdit(ctx, link.id, id, num(params, "timeout", 30, {
@@ -12849,7 +12986,7 @@ var METHODS = {
 	},
 	/** WISP 400 § Reactions: one emoji per person per message, a new one replaces mine; `remove` takes mine back. */
 	async "chat.react"(ctx, params) {
-		const link = chatOf(ctx, params);
+		const link = notAGroup(ctx, params, () => chatOf(ctx, params), "group react", "<message> <emoji>");
 		return {
 			chat: link.id,
 			...await react(ctx, link.id, params)
@@ -12886,10 +13023,12 @@ var METHODS = {
 		if (!messageIds.length) throw new CliError("bad_request", "Name the messages to forward (their ids, from history or an event)");
 		const to = list(params, "to").map((ref) => chatOrGroup(ctx, ref));
 		if (!to.length) throw new CliError("bad_request", "Forward to which chat? Name one or more with --to");
-		const history = from.group ? await node(ctx).groupMessages({ groupId: from.id }) : await node(ctx).getMessages(from.id);
-		const chosen = messageIds.map((id) => history.find((m) => m.id === id) ?? (() => {
-			throw new CliError("not_found", `No message ${id} in this ${from.group ? "group" : "chat"}`);
-		})());
+		const chosen = [];
+		for (const id of messageIds) {
+			const message = await node(ctx).getMessage(from.linkId, id);
+			if (!message) throw new CliError("not_found", `No message ${id} in this ${from.group ? "group" : "chat"}`);
+			chosen.push(message);
+		}
 		if (!bool(params, "force")) for (const message of chosen) {
 			const secret = message.file ? null : findSecret(message.text);
 			if (secret) throw new CliError("confirm", `A message looks like ${secret.kind === "cashu" ? "a Cashu token (money anyone who reads it can take)" : "a secret (a seed or a private key)"}; forward it with --force if you mean to`, {
@@ -12923,7 +13062,7 @@ var METHODS = {
 				await waitForGroupFrame(ctx, to[i].id, messageId, void 0, ms);
 				continue;
 			}
-			const sent = (await node(ctx).getMessages(to[i].id)).find((m) => m.id === messageId);
+			const sent = await node(ctx).getMessage(to[i].id, messageId);
 			if (sent?.file) await FILE_METHODS["file.wait"](ctx, {
 				chat: to[i].id,
 				file: sent.file.id,
@@ -12955,7 +13094,7 @@ var METHODS = {
 	async "chat.delete"(ctx, params) {
 		const link = chatOf(ctx, params);
 		const messageId = str(params, "message", true);
-		if (!(await node(ctx).getMessages(link.id)).some((m) => m.id === messageId)) throw new CliError("not_found", `No message ${messageId} in this chat`);
+		if (!await node(ctx).getMessage(link.id, messageId)) throw new CliError("not_found", `No message ${messageId} in this chat`);
 		await node(ctx).deleteMessage({
 			linkId: link.id,
 			messageId
@@ -13071,7 +13210,13 @@ var METHODS = {
 		};
 	},
 	async "group.join"(ctx, params) {
-		const { groupId } = await node(ctx).joinGroupByLink({ link: str(params, "link", true) });
+		let groupId;
+		try {
+			({groupId} = await node(ctx).joinGroupByLink({ link: str(params, "link", true) }));
+		} catch (error) {
+			if (error instanceof Error && error.message === "This is not a link to a group") throw new CliError("bad_request", error.message);
+			throw error;
+		}
 		return { group: groupId };
 	},
 	async "group.list"(ctx, params) {
@@ -13140,15 +13285,16 @@ var METHODS = {
 		}
 		const mentions = mentionsFor(text, list(params, "mentions"), group);
 		const wait = oneOf(params, "wait", ["none", "sent"], "none");
-		const before = (await node(ctx).groupMessages({ groupId: group.id })).find((m) => m.id === messageId)?.edit?.seq ?? 0;
+		const linkId = `group:${group.id}`;
+		const before = (await node(ctx).getMessage(linkId, messageId))?.edit?.seq ?? 0;
 		const result = await node(ctx).editMessage({
-			linkId: `group:${group.id}`,
+			linkId,
 			messageId,
 			text,
 			...mentions.length ? { mentions } : {}
 		});
-		if (result.error) throw editRefused(await node(ctx).groupMessages({ groupId: group.id }), messageId, "group", result.error, result.refused);
-		const message = (await node(ctx).groupMessages({ groupId: group.id })).find((m) => m.id === messageId);
+		if (result.error) throw editRefused(await messageOf(ctx, linkId, messageId), messageId, "group", result.error, result.refused);
+		const message = await node(ctx).getMessage(linkId, messageId);
 		const edits = message?.edit?.seq ?? 0;
 		if (edits === before) return {
 			group: group.id,
@@ -13314,12 +13460,32 @@ function groupSendRefused(error) {
 	return new CliError("unavailable", error);
 }
 /**
+* A chat command given a group's id, prefix or name: `not_found` that says it is a group, with the group command that
+* takes it (`react` on a group, where `group react` is meant). A name no chat and no group has stays the chat's error.
+*/
+function notAGroup(ctx, params, chat, command, rest) {
+	try {
+		return chat();
+	} catch (error) {
+		if (!(error instanceof CliError) || error.code !== "not_found") throw error;
+		const ref = str(params, "chat", true);
+		let group;
+		try {
+			group = findGroup(state(ctx).groups, ref);
+		} catch {
+			throw error;
+		}
+		const shown = /^[\w.:-]+$/.test(ref) ? ref : JSON.stringify(ref);
+		throw new CliError("not_found", `${JSON.stringify(ref)} is a group, not a chat: ghostly ${command} ${shown} ${rest}`, { group: group.id });
+	}
+}
+/**
 * An edit the engine refused. A message that is not in the chat or group at all is `not_found` (exit 3), naming the id
 * to give, as `button update` and `task update` do; before, a mistyped or lost id read "Only your own text messages
 * can be edited" (`refused`, exit 1), as if the message were someone else's.
 */
-function editRefused(messages, ref, where, error, refused) {
-	if (refused && !messages.some((m) => m.id === ref || m.wireId === ref)) return new CliError("not_found", `No message ${JSON.stringify(ref)} in this ${where}: give the messageId ${where === "group" ? "group send" : "send"} printed`);
+function editRefused(message, ref, where, error, refused) {
+	if (refused && !message) return new CliError("not_found", `No message ${JSON.stringify(ref)} in this ${where}: give the messageId ${where === "group" ? "group send" : "send"} printed`);
 	return new CliError(refused ? "refused" : "unavailable", error);
 }
 /**
@@ -14482,6 +14648,11 @@ var showSecret = { "show-secret": {
 	type: "boolean",
 	description: "Print the group's entry link (anyone who has it can join)"
 } };
+/** A pending chat's invite code lets whoever reads it take the chat: printed only when asked for. */
+var showInvite = { "show-secret": {
+	type: "boolean",
+	description: "Print a pending chat's invite code (whoever has it can take the chat)"
+} };
 var secret = (options) => options["show-secret"] === true ? { showSecret: true } : {};
 /**
 * `--for` of the typing commands: the seconds it is kept on, 1 to 600, and never with `--stop`. A usage error (exit 2)
@@ -15050,8 +15221,10 @@ var commands$6 = {
 	},
 	"chat list": {
 		method: "chat.list",
-		usage: "chat list",
-		summary: "Chats, newest first"
+		usage: "chat list [--show-secret]",
+		summary: "Chats, newest first (a pending invite code only with --show-secret)",
+		options: showInvite,
+		params: ({ options }) => secret(options)
 	},
 	"chat remove": {
 		method: "chat.remove",
@@ -15079,10 +15252,14 @@ var commands$6 = {
 	},
 	"chat show": {
 		method: "chat.get",
-		usage: "chat show <chat>",
-		summary: "One chat and its connection",
+		usage: "chat show <chat> [--show-secret]",
+		summary: "One chat and its connection (its pending invite code only with --show-secret)",
 		args: ["chat"],
-		params: (_, { chat }) => ({ chat })
+		options: showInvite,
+		params: ({ options }, { chat }) => ({
+			chat,
+			...secret(options)
+		})
 	},
 	"chat transport": {
 		method: "chat.transport",
@@ -19348,6 +19525,7 @@ async function openPersistentIndexedDb(dir) {
 	const factory = new IDBFactory();
 	const raw = factory;
 	const classes = await probeClasses(factory);
+	dropIndexEntriesByRecord(classes, (a, b) => factory.cmp(a, b));
 	let writing = true;
 	let restoring = true;
 	let journalFd = null;
@@ -19535,7 +19713,8 @@ async function probeClasses(factory) {
 	const classes = {
 		Database: rawDb.constructor,
 		ObjectStore: rawStore.constructor,
-		Index: rawStore.rawIndexes.get("i").constructor
+		Index: rawStore.rawIndexes.get("i").constructor,
+		RecordStore: rawStore.records.constructor
 	};
 	db.close();
 	await new Promise((resolve) => {
@@ -19544,6 +19723,76 @@ async function probeClasses(factory) {
 	});
 	return classes;
 }
+/** The classes whose index upkeep is already by record: they are fake-indexeddb's own, shared by every store opened. */
+var byRecord = /* @__PURE__ */ new WeakSet();
+/**
+* fake-indexeddb drops an overwritten or deleted record from an index by walking every entry of it (an index is in
+* its own key's order, not the record's): each delivery mark, edit or reaction cost time with every message of the
+* profile, 170 ms at 10,000, and a long chat slowed every other one. The store has the records it just replaced or
+* removed in hand, and they say which entries to drop; a call that comes any other way still walks.
+*/
+function dropIndexEntriesByRecord(classes, cmp) {
+	const storeProto = classes.ObjectStore.prototype;
+	const recordsProto = classes.RecordStore.prototype;
+	if (byRecord.has(storeProto)) return;
+	byRecord.add(storeProto);
+	const { storeRecord, deleteRecord } = storeProto;
+	const { put, delete: remove, deleteByValue } = recordsProto;
+	let gone = null;
+	storeProto.storeRecord = function(record, noOverwrite, rollbackLog) {
+		if (!this.rawIndexes.size) return storeRecord.call(this, record, noOverwrite, rollbackLog);
+		const records = this.records, indexes = this.rawIndexes, outer = gone;
+		records.put = (next, keep) => {
+			const replaced = put.call(this.records, next, keep);
+			gone = {
+				indexes,
+				records: replaced ? [replaced] : []
+			};
+			return replaced;
+		};
+		try {
+			return storeRecord.call(this, record, noOverwrite, rollbackLog);
+		} finally {
+			delete records.put;
+			gone = outer;
+		}
+	};
+	storeProto.deleteRecord = function(key, rollbackLog) {
+		if (!this.rawIndexes.size) return deleteRecord.call(this, key, rollbackLog);
+		const records = this.records, indexes = this.rawIndexes, outer = gone;
+		records.delete = (range) => {
+			const removed = remove.call(this.records, range);
+			gone = {
+				indexes,
+				records: removed
+			};
+			return removed;
+		};
+		try {
+			deleteRecord.call(this, key, rollbackLog);
+		} finally {
+			delete records.delete;
+			gone = outer;
+		}
+	};
+	recordsProto.deleteByValue = function(key) {
+		let index;
+		if (gone) {
+			for (const candidate of gone.indexes.values()) if (candidate.records === this) index = candidate;
+		}
+		if (!gone || !index) return deleteByValue.call(this, key);
+		const dropped = [];
+		for (const entry of indexEntries(index, gone.records, cmp)) {
+			if (this.keysAreUnique) {
+				const held = this.get(entry.key);
+				if (!held || cmp(held.value, entry.value) !== 0) continue;
+			}
+			this.records.delete(entry);
+			dropped.push(entry);
+		}
+		return dropped;
+	};
+}
 /**
 * The snapshot's records come in key order (as `writeSnapshot` walks them), so each store's tree and each index's are
 * built whole from sorted arrays: storing record by record compared every key down the tree, a 70,000-message profile
@@ -19939,14 +20188,14 @@ async function startRuntime(paths, options = {}) {
 	(await import("./assets/ghostly_iroh_web-Dvzh3Y6E.js")).initSync({ module: irohWasmBytes() });
 	const [{ registerFileBytes }, { NodeFileBytes }] = await Promise.all([import("./assets/fileBytes-BcYZhNgF.js").then((n) => n.o), import("./assets/fileBytes-Dbifu5I5.js")]);
 	registerFileBytes("native", async () => new NodeFileBytes(paths.files), true);
-	const [{ EngineServer }, { createHyperEndpoint }] = await Promise.all([import("./assets/server-D5FBZYW8.js").then((n) => n.t), import("./assets/endpoint-pgFkR2AS.js")]);
+	const [{ EngineServer }, { createHyperEndpoint }] = await Promise.all([import("./assets/server-Cy4ox7oD.js").then((n) => n.t), import("./assets/endpoint-pgFkR2AS.js")]);
 	const network = hyperdhtNetwork();
 	const dht = mainlineNetwork();
-	const mainline = dht.off ? null : new (await (import("./assets/mainline-DVYdrus6.js"))).Mainline({
+	const mainline = dht.off ? null : new (await (import("./assets/mainline-1v8OTYvp.js"))).Mainline({
 		bootstrap: dht.bootstrap,
 		host: dht.host
 	});
-	const transport = mainline || pinned ? new (await (import("./assets/mainline-DVYdrus6.js"))).RelaysAndDht(mainline, pinned ? { relays: pinned } : {}, !!pinned) : null;
+	const transport = mainline || pinned ? new (await (import("./assets/mainline-1v8OTYvp.js"))).RelaysAndDht(mainline, pinned ? { relays: pinned } : {}, !!pinned) : null;
 	const server = new EngineServer({
 		...transport ? { transport } : {},
 		irohWeb: true,
@@ -20603,7 +20852,7 @@ var SPECIAL = [
 		"The profile's settings",
 		{ "show-secret": o("boolean", "Show credentials too") }
 	],
-	["settings set <key> <json-value>", "Change one: relays, irohRelays, hyperdhtRelay, readRelays, iceServers, publicProfiles, online, shareProfile, sendTyping, nick"],
+	["settings set <key> <json-value>", "Change one: relays, irohRelays, hyperdhtRelay, readRelays, iceServers, publicProfiles, online, shareProfile, sendTyping, autoDownloads, serveFiles, nick"],
 	[
 		"engine <method> [json-params | -] [--confirm-real] [--show-secret]",
 		"Any call of the app's engine, with its own parameters",
@@ -20649,6 +20898,14 @@ function help() {
 		"2 usage, 3 not found, 4 timed out, 5 needs --force/--yes/--confirm-real. See packages/cli/README.md."
 	].join("\n");
 }
+/** What `ghostly help help` answers. */
+var HELP_USAGE = [
+	"Usage: ghostly help [<command>...]",
+	"",
+	"  Help for every command, or for one command or a group of them (also ghostly <command> --help)",
+	"",
+	"Options for every command: --profile, -p <name>  --home <dir>  --pretty  --help, -h"
+].join("\n");
 /** Every command's help row: usage, summary and, for the table and text commands, their options. */
 function helpRows() {
 	return [
@@ -20675,6 +20932,7 @@ function commandWords(usage) {
 * options; for a group (`ghostly help file`), the group's commands.
 */
 function commandHelp(words) {
+	if (words[0] === "help") return HELP_USAGE;
 	const named = (list) => helpRows().filter((row) => {
 		const own = commandWords(row.usage);
 		return list.every((word, i) => own[i] === word);
@@ -20954,32 +21212,42 @@ async function daemonCommand(argv) {
 	}
 	if (sub === "stop") {
 		knownProfile(g);
+		const stopFor = seconds(parsed, 20);
 		const client = await connectDaemon(g.paths.socket);
 		if (!client) throw new CliError("not_found", `No daemon runs profile ${g.profile}`);
 		print({
 			stopped: true,
-			pid: await stopDaemon(g, client, Number(parsed.options.timeout) || 20)
+			pid: await stopDaemon(g, client, stopFor)
 		});
 		return;
 	}
 	if (sub === "restart") {
+		const stopFor = seconds(parsed, 20), startFor = seconds(parsed, 60);
 		const client = await connectDaemon(g.paths.socket);
 		const before = client ? (await client.call("status").catch(() => null))?.version ?? null : null;
 		print({
 			restarted: true,
-			stopped: client ? await stopDaemon(g, client, Number(parsed.options.timeout) || 20) : null,
+			stopped: client ? await stopDaemon(g, client, stopFor) : null,
 			before,
 			version: VERSION,
-			...await startDetached(g, Number(parsed.options.timeout) || 60)
+			...await startDetached(g, startFor)
 		});
 		return;
 	}
 	if (sub) throw new CliError("usage", "ghostly daemon [--detach] | daemon status | daemon stop | daemon restart");
+	const startFor = seconds(parsed, 60);
 	if (!parsed.options.detach) {
 		await runDaemon(g);
 		return;
 	}
-	print(await startDetached(g, Number(parsed.options.timeout) || 60));
+	print(await startDetached(g, startFor));
+}
+/** `--timeout <s>`, or `fallback` without one: seconds above 0 (0 or less would not wait at all). */
+function seconds(parsed, fallback) {
+	const value = parsed.options.timeout;
+	if (value === void 0) return fallback;
+	if (typeof value !== "number" || !(value > 0)) throw new CliError("usage", "--timeout takes a number of seconds above 0");
+	return value;
 }
 /**
 * Asks the daemon to stop and waits until its process is gone, not only until it let go of the profile (it releases
@@ -21039,6 +21307,10 @@ async function startDetached(g, seconds) {
 	}
 	if (!client) {
 		heldBy(g, child.pid);
+		if (child.exitCode === null && child.pid !== void 0 && processAlive(child.pid)) throw new CliError("timeout", `The daemon (process ${child.pid}) is still starting; ghostly daemon status shows when it is up`, {
+			pid: child.pid,
+			log: g.paths.log
+		});
 		throw new CliError("engine", `The daemon did not start; see ${g.paths.log}`);
 	}
 	client.close();
@@ -21226,17 +21498,7 @@ async function engineCommand(argv) {
 		params,
 		confirmReal
 	}));
-	if (method === "getState" && !showSecret && result && typeof result === "object") {
-		const state = result;
-		result = {
-			...state,
-			settings: redactSettings(state.settings),
-			...state.groups ? { groups: state.groups.map((g) => g.entryLink ? {
-				...g,
-				entryLink: "<hidden>"
-			} : g) } : {}
-		};
-	}
+	if (method === "getState" && !showSecret && result && typeof result === "object") result = hideStateSecrets(result);
 	print(result);
 }
 async function settingsCommand(sub, argv) {
@@ -21469,6 +21731,7 @@ async function main(input) {
 		return 0;
 	}
 	if (argv[0] === "--version" || argv[0] === "version") {
+		pretty = argv.slice(1).some((word) => word === "--pretty" || word === "--pretty=true");
 		print({ version: VERSION });
 		return 0;
 	}
@@ -21564,7 +21827,29 @@ async function run(argv) {
 	}
 }
 //#endregion
+//#region src/runtime/webStorage.ts
+/**
+* Node 25 and newer define `globalThis.localStorage` as a getter that, without `--localstorage-file`, answers
+* `undefined` and writes an ExperimentalWarning on stderr the first time it is read. The engine reads it where a
+* browser keeps a setting (`globalThis.localStorage?.getItem(...)`), so every command that opens a profile printed the
+* warning. Without the flag the CLI has no localStorage, as on Node 22: the getter is replaced by `undefined` before
+* anything reads it. With the flag, Node's storage stays.
+*/
+function quietWebStorage(scope = globalThis, execArgv = process.execArgv, nodeOptions = process.env.NODE_OPTIONS) {
+	const own = Object.getOwnPropertyDescriptor(scope, "localStorage");
+	if (!own?.get || !own.configurable) return;
+	const flag = (arg) => arg === "--localstorage-file" || arg.startsWith("--localstorage-file=");
+	if (execArgv.some(flag) || (nodeOptions ?? "").split(/\s+/).some(flag)) return;
+	Object.defineProperty(scope, "localStorage", {
+		value: void 0,
+		writable: true,
+		configurable: true,
+		enumerable: false
+	});
+}
+//#endregion
 //#region src/bin.ts
+quietWebStorage();
 run(process.argv.slice(2));
 //#endregion
 export { BACKUP_MEDIA_TYPE as $, requireTurn as A, paymentWireId as At, networkLabel as B, breezDatabasesFor as C, storedGroupFiles as Ct, sourceKey as D, replyRef as Dt, ProviderSources as E, receivedPairedReply as Et, sealSeed as F, streamStored as Ft, BITCOIN_INVOICE_ON_TESTNET as G, cashuMint as H, unsealSeed as I, fakesLightning as J, DEFAULT_MINTS as K, ModeChanged as L, setSingleWriterGate as M, readStored as Mt, intentRepository as N, removeStored as Nt, awayFrom as O, replyTo as Ot, newDeviceKey as P, storedSize as Pt, paysItsOwnInvoices as Q, ModeGate as R, breezDatabaseInUse as S, groupOfFile as St, lightningPaying as T, pairedWireReply as Tt, MESSAGE_DETAILS_MAX_BYTES as U, CASHU_MINT_SOURCE as V, WALLET_TYPES as W, isWorthlessMint as X, isTestMint as Y, mintNetwork as Z, LightningCards as _, verifyIdentity as _t, irohRelayProblem as a, reserveAdapterIds as at, normalizePhrase as b, groupFileId as bt, createFailure as c, SourceConfigError as ct, paymentNetwork as d, networkMode as dt, MAX_BACKUP_BYTES as et, paymentNetworksOf as f, redact as ft, CASHU_CARD as g, boundedIdentityFetch as gt, rpcHost as h, setOwnDidSource as ht, createIrohWebEndpoint as i, registeredOnchainProviders as it, setAwayWallets as j, FileAppender as jt, refuseAway as k, paymentAlias as kt, createTiming as l, SourceUnreachableError as lt, networkReason as m, resolveAtprotoDid as mt, loadFedimintSdk as n, onAdaptersChanged as nt, WALLET_NAMES as o, NothingSpentError as ot, walletInstances as p, assertPublicServer as pt, TEST_MINT as q, DEFAULT_IROH_RELAYS as r, registeredLightningProviders as rt, assertConfirmedReal as s, PROVIDER_PLATFORMS as st, fedimintDatabase as t, identityProviders as tt, crossNetwork as u, isNothingSpentError as ut, cardsKey as v, chosenResolver as vt, dropBreezDatabase as w, groupReply as wt, breezDatabase as x, groupFileText as xt, isRecoveryPhrase as y, GroupFileDesk as yt, WrongNetworkError as z };