@ghostlytools/cli 1.2.1 → 1.2.3

package/dist/assets/{src-aKGjb_yz.js → src-_FzJkeAJ.js}

@@ -142,9 +142,20 @@ var KEEP = /[\u200c\u200d]/;
 function stripHidden(text) {
 	return text.replace(HIDDEN, (char) => KEEP.test(char) ? char : "");
 }
+/**
+* What draws nothing when it stands alone and `HIDDEN` leaves in, since text needs it beside something else: the
+* joiners, the fillers, the variation selectors and the other default-ignorable code points, combining marks, white
+* space and the blank Braille pattern.
+*/
+var UNSEEN = /^[\p{Default_Ignorable_Code_Point}\p{M}\p{White_Space}\u2800]*$/u;
+/** Whether `text` holds a character that shows by itself: a name of joiners, fillers or marks alone has none. */
+function hasVisible(text) {
+	return !UNSEEN.test(text);
+}
 /** Undefined when nothing visible is left, so callers can fall back. */
 function sanitizeDisplayText(text, max) {
-	return [...stripHidden(text)].slice(0, max).join("").trim() || void 0;
+	const clean = [...stripHidden(text)].slice(0, max).join("").trim();
+	return hasVisible(clean) ? clean : void 0;
 }
 /** A nickname as it arrived from a peer, ready to show. */
 function sanitizeNick(nick) {
@@ -1992,6 +2003,33 @@ function turnSequence(turn, rev, author) {
 	if (!Number.isInteger(author) || author < 0 || author >= 4) throw new Error("An author is a slot, 0 to 3");
 	return turn * 2 ** 20 + rev * 4 + author;
 }
+var VERIFIER_DOMAIN = "ghostly-turn-verifier/1";
+var VERIFIER_TAG = Uint8Array.of(103, 118);
+var VERIFIER_TAG_AT = 3;
+var VERIFIER_MARK_AT = 5;
+/** The mark of a verifier (its `setup` and `record` as stored), or of a profile that has none (null). 3 bytes. */
+function turnVerifierMark(verifier) {
+	return sha256(utf8Encode(`${VERIFIER_DOMAIN}\n${verifier?.setup ?? ""}\n${verifier?.record ?? ""}`)).slice(0, 3);
+}
+/**
+* A record's `instance` that states `mark` (`turnVerifierMark`), or, with no mark, one that states nothing: 8 random
+* bytes that never carry the marker (a tombstone, a record written where the profile's verifier is not at hand).
+*/
+function turnInstance(mark, random = randomBytes) {
+	if (mark && mark.length !== 3) throw new Error("A verifier mark is 3 bytes");
+	const instance = random(8).slice(0, 8);
+	if (instance.length !== 8) throw new Error("An instance is 8 bytes");
+	if (mark) {
+		instance.set(VERIFIER_TAG, VERIFIER_TAG_AT);
+		instance.set(mark, VERIFIER_MARK_AT);
+	} else if (turnStatedVerifier(instance)) instance[VERIFIER_TAG_AT] ^= 255;
+	return instance;
+}
+/** The verifier mark an `instance` states, or null when it states none (a record written by an app from before). */
+function turnStatedVerifier(instance) {
+	if (instance.length !== 8 || instance[VERIFIER_TAG_AT] !== VERIFIER_TAG[0] || instance[4] !== VERIFIER_TAG[1]) return null;
+	return instance.slice(VERIFIER_MARK_AT);
+}
 var TurnRecordError = class extends Error {
 	refusal;
 	constructor(refusal, detail) {
@@ -2008,7 +2046,8 @@ var isZero = (bytes) => bytes.every((b) => b === 0);
 * A device's name as its slot holds it: UTF-8, cut at a character boundary to 16 bytes, and with no NUL (the padding).
 * A character is what a person sees as one (a grapheme), so a cut never leaves half an emoji or a lone joiner.
 * A name is display text a device chooses for itself and every device of the set shows: it is cleaned as a nickname is
-* (`sanitizeDisplayText`: no control, invisible or direction-changing character) and trimmed, made and read alike.
+* (`sanitizeDisplayText`: no control, invisible or direction-changing character, and empty when nothing of it shows)
+* and trimmed, made and read alike.
 */
 function turnName(name) {
 	const clean = stripHidden(name).trim();
@@ -2021,7 +2060,7 @@ function turnName(name) {
 		out += character;
 		length += size;
 	}
-	return out.trimEnd();
+	return hasVisible(out) ? out.trimEnd() : "";
 }
 function u32$3(value) {
 	return Uint8Array.of(value >>> 24 & 255, value >>> 16 & 255, value >>> 8 & 255, value & 255);
@@ -4297,6 +4336,7 @@ function parseCallSignal(json, now = Date.now()) {
 		if (raw.t !== "a" || typeof raw.re !== "number" || !Number.isFinite(raw.re)) return null;
 		restart.re = raw.re;
 	}
+	const closed = raw.vr === 0 ? { vr: 0 } : {};
 	if (raw.o !== void 0 && (typeof raw.o !== "number" || !Number.isFinite(raw.o))) return null;
 	const answers = raw.t === "a" && raw.o !== void 0 ? { o: raw.o } : {};
 	return {
@@ -4312,6 +4352,7 @@ function parseCallSignal(json, now = Date.now()) {
 		...picture,
 		...payloadTypes,
 		...restart,
+		...closed,
 		...answers,
 		...heard
 	};
@@ -4410,7 +4451,7 @@ function buildSdpFromSignal(signal) {
 		} else if (mediaType === "v") {
 			lines.push(`m=video 9 UDP/TLS/RTP/SAVPF ${vp8}`, "c=IN IP4 0.0.0.0", "a=rtcp:9 IN IP4 0.0.0.0");
 			for (const c of signal.c ?? []) lines.push(`a=candidate:${c}`);
-			lines.push("a=end-of-candidates", `a=ice-ufrag:${signal.u}`, `a=ice-pwd:${signal.p}`, `a=fingerprint:${fingerprint}`, `a=setup:${signal.s}`, `a=mid:${mid}`, "a=sendrecv", `a=msid:stream video0`, "a=rtcp-mux", "a=rtcp-rsize", `a=rtpmap:${vp8} VP8/90000`, `a=rtcp-fb:${vp8} ccm fir`, `a=rtcp-fb:${vp8} nack`, `a=rtcp-fb:${vp8} nack pli`, `a=rtcp-fb:${vp8} goog-remb`, `a=ssrc:${videoSsrc} cname:pkarr`, `a=ssrc:${videoSsrc} msid:stream video0`);
+			lines.push("a=end-of-candidates", `a=ice-ufrag:${signal.u}`, `a=ice-pwd:${signal.p}`, `a=fingerprint:${fingerprint}`, `a=setup:${signal.s}`, `a=mid:${mid}`, ...signal.vr === 0 ? ["a=inactive"] : ["a=sendrecv", "a=msid:stream video0"], "a=rtcp-mux", "a=rtcp-rsize", `a=rtpmap:${vp8} VP8/90000`, `a=rtcp-fb:${vp8} ccm fir`, `a=rtcp-fb:${vp8} nack`, `a=rtcp-fb:${vp8} nack pli`, `a=rtcp-fb:${vp8} goog-remb`, ...signal.vr === 0 ? [] : [`a=ssrc:${videoSsrc} cname:pkarr`, `a=ssrc:${videoSsrc} msid:stream video0`]);
 		}
 	});
 	return lines.join("\r\n") + "\r\n";
@@ -5607,10 +5648,14 @@ var LinkSession = class {
 	pollAgain = false;
 	publishing = null;
 	publishAgain = false;
+	/** What waits to go out is the presence heartbeat alone (`PRESENCE_HEARTBEAT`): nothing in the packet changed. */
+	upkeepOnly = false;
 	pollTimer = null;
 	heartbeatTimer = null;
 	lastActivity = Date.now();
 	startedAt = Date.now();
+	/** From when a peer never seen is awaited (`AWAITING_PEER_MS`): never later than this start, whatever the clock said when the chat was made. */
+	awaitingSince;
 	intervals;
 	fastPollUntil = 0;
 	/** An offer to a saved contact is out: from then on its fast window looks less often (`OFFER_FAST_MS`); 0 for none. */
@@ -5665,6 +5710,7 @@ var LinkSession = class {
 		this.intervals = options.pollIntervals ?? DHT_POLL_INTERVALS;
 		this.events = options.events ?? {};
 		this.firstPublish = options.firstPublish ?? "at-start";
+		this.awaitingSince = Math.min(options.awaitingSince ?? this.startedAt, this.startedAt);
 	}
 	get peerPresence() {
 		return this.presence;
@@ -5868,11 +5914,12 @@ var LinkSession = class {
 			t: timestamp,
 			m: text
 		}];
+		this.upkeepOnly = false;
 		try {
 			if (await this.publishOnce(true) === 0) return "Message could not be published — DHT payload limit exceeded.";
 		} catch (error) {
 			if (this.publishRetryTimer) clearTimeout(this.publishRetryTimer);
-			this.publishRetryTimer = setTimeout(() => void this.publish().catch(() => {}), this.retryDelay(error));
+			this.publishRetryTimer = setTimeout(() => void this.publish(true).catch(() => {}), this.retryDelay(error));
 			if (!isDiscoveryBudgetError(error)) this.events.onStatus?.("error");
 			return null;
 		}
@@ -5928,7 +5975,7 @@ var LinkSession = class {
 		if (this.connected) return "connected";
 		if (Date.now() < this.fastPollUntil) return "fast";
 		if (Date.now() < this.watchUntil) return "active";
-		if (!this.active && this.presence.lastPacketAt === 0 && Date.now() - this.startedAt < 6e5) return "active";
+		if (!this.active && this.presence.lastPacketAt === 0 && Date.now() - this.awaitingSince < 6e5) return "active";
 		if (!this.active) return "background";
 		return Date.now() - this.lastActivity > 6e4 ? "idle" : "active";
 	}
@@ -5936,13 +5983,18 @@ var LinkSession = class {
 		if (this.heartbeatTimer) clearTimeout(this.heartbeatTimer);
 		this.heartbeatTimer = setTimeout(() => {
 			if (!this.running) return;
-			if (this.getServices() !== void 0) this.publish().catch(() => {});
+			if (this.getServices() !== void 0) this.publish(true).catch(() => {});
 			this.scheduleHeartbeat();
 		}, PRESENCE_HEARTBEAT);
 	}
-	/** Coalesces publishes: at most one in flight and one queued behind it. */
-	publish() {
+	/**
+	* Coalesces publishes: at most one in flight and one queued behind it. `upkeep`: nothing new to say (the heartbeat, a
+	* retry of what waits): with nothing else asked for since, the packet goes as upkeep (`publishOnce`).
+	*/
+	publish(upkeep = false) {
 		if (this.silent) return Promise.resolve();
+		if (!upkeep) this.upkeepOnly = false;
+		else if (!this.publishing && !this.publishRetryTimer) this.upkeepOnly = true;
 		if (this.publishing) {
 			this.publishAgain = true;
 			return this.publishing;
@@ -5953,12 +6005,12 @@ var LinkSession = class {
 			try {
 				do {
 					this.publishAgain = false;
-					await this.publishOnce(this.running);
+					await this.publishOnce(this.running, this.upkeepOnly);
 				} while (this.publishAgain && this.running);
 			} catch (error) {
 				if (this.running) {
 					if (!isDiscoveryBudgetError(error)) this.discoveryResult("publish", error);
-					this.publishRetryTimer = setTimeout(() => void this.publish().catch(() => {}), this.retryDelay(error));
+					this.publishRetryTimer = setTimeout(() => void this.publish(true).catch(() => {}), this.retryDelay(error));
 				}
 				throw error;
 			} finally {
@@ -5967,7 +6019,7 @@ var LinkSession = class {
 		})();
 		return this.publishing;
 	}
-	async publishOnce(advertise) {
+	async publishOnce(advertise, upkeep = false) {
 		const rtcSignal = advertise ? this.rtcSignal : null;
 		const built = buildLinkRecords(this.identity.pubKeyZ32, {
 			messages: this.sentBuffer,
@@ -5980,7 +6032,7 @@ var LinkSession = class {
 		}, this.encKey);
 		const started = Date.now();
 		try {
-			const options = rtcSignal && rtcSignal !== this.rtcSignalOut ? { signal: true } : this.watching() ? { watch: true } : void 0;
+			const options = rtcSignal && rtcSignal !== this.rtcSignalOut ? { signal: true } : this.watching() ? { watch: true } : upkeep && this.connected ? { background: true } : void 0;
 			await this.transport.publish(this.identity, built.records, options);
 		} catch (error) {
 			const ms = Date.now() - started, waiting = isDiscoveryBudgetError(error);
@@ -6339,6 +6391,8 @@ var DataLink = class {
 	answered = null;
 	/** Answers refused since a connection last opened, each followed by a new offer at once (`ANSWER_REFUSED_REDIALS`). */
 	refusedAnswers = 0;
+	/** The last answer dropped as not for this side's offer (`answer-dropped`): each is said once. */
+	droppedAnswerTs = 0;
 	constructor(options) {
 		this.options = options;
 	}
@@ -6447,6 +6501,12 @@ var DataLink = class {
 			} catch (error) {
 				if (this.pc === pc) this.answerRefused(error);
 			}
+		} else if (signal.t === "a" && signal.ts !== this.droppedAnswerTs) {
+			this.droppedAnswerTs = signal.ts;
+			traceLink(this.options.myPubKeyZ32, "answer-dropped", {
+				state: this.state,
+				...this.myOfferTs && signal.o !== void 0 ? { offerMs: signal.o - this.myOfferTs } : {}
+			});
 		}
 	}
 	/**
@@ -6520,7 +6580,10 @@ var DataLink = class {
 			again
 		});
 		this.reset();
-		if (!again) return;
+		if (!again) {
+			this.options.onAnswersRefused?.();
+			return;
+		}
 		this.refusedAnswers++;
 		this.options.onAnswerReplaced?.();
 	}
@@ -7227,11 +7290,23 @@ async function signAppRevocation(statement, signer) {
 		signature
 	};
 }
+/** What a checked revocation is kept by: the SHA-256 of its canonical bytes (statement and signature), base64url. */
+function appRevocationId(revocation) {
+	return toBase64Url(sha256(canonicalJsonBytes(revocation)));
+}
 /**
 * Reads one signed revocation (a parsed value, from `ghostly-revoke.json` or a store index's `revoked`): its shape, then
-* the signature under `ghostly-revoke/1` by the publisher its `app` names.
+* the signature under `ghostly-revoke/1` by the publisher its `app` names. One that `checked` holds verified before, so
+* its signature is not checked again; one that verifies now is added to it.
 */
-function readAppRevocation(value) {
+function readAppRevocation(value, checked) {
+	const read = readAppRevocationShape(value);
+	if (!read.ok) return read;
+	const verified = verifyAppRevocation(read.revocation, checked);
+	return verified.ok ? read : verified;
+}
+/** The first half of `readAppRevocation`: the shape of a signed revocation, with no signature checked. */
+function readAppRevocationShape(value) {
 	if (!exactKeys$1(value, ["statement", "signature"])) return {
 		ok: false,
 		reason: "bad-revocation",
@@ -7247,17 +7322,22 @@ function readAppRevocation(value) {
 		ok: false,
 		reason: "bad-signature-statement"
 	};
-	const statement = value.statement;
-	const checked = verifyAppSignature(APP_PREFIXES.revoke, canonicalJsonBytes(statement), value.signature, appRefPublisher(statement.app));
-	if (!checked.ok) return checked;
 	return {
 		ok: true,
 		revocation: {
-			statement,
+			statement: value.statement,
 			signature: value.signature
 		}
 	};
 }
+/** The second half: the signature of a revocation of the right shape, unless `checked` holds it. */
+function verifyAppRevocation(revocation, checked) {
+	const id = checked && appRevocationId(revocation);
+	if (id !== void 0 && checked.has(id)) return { ok: true };
+	const verified = verifyAppSignature(APP_PREFIXES.revoke, canonicalJsonBytes(revocation.statement), revocation.signature, appRefPublisher(revocation.statement.app));
+	if (verified.ok && id !== void 0) checked.add(id);
+	return verified;
+}
 /**
 * Reads `ghostly-revoke.json`: canonical bytes holding a list of signed revocations. One that does not verify refuses the
 * file, as a store index's `revoked` does.
@@ -8031,8 +8111,13 @@ var COMMUNITY_REACTION_FRAME = "reaction";
 var REACTION_LIMITS = {
 	/** UTF-8 bytes of one emoji: a family or a subdivision flag fits, a run of emoji does not. */
 	emojiBytes: 32,
-	/** Reaction frames a receiver takes per window on one chat; the rest are dropped unconfirmed and come again. */
+	/**
+	* Reaction frames a receiver takes per window on one chat; the rest are dropped unconfirmed and come again. In a
+	* group nothing comes again (a community's catch-up hands a frame once), so there the rest wait for the next window.
+	*/
 	receive: 30,
+	/** Group members' reactions past a window, kept per group until it has room: as many as a community's store hands back. */
+	held: 256,
 	/** Reactions a sender says per window on one chat; the newest of each message waits for room. */
 	send: 20,
 	windowMs: 1e4,
@@ -9413,6 +9498,16 @@ var DhtDelivery = class DhtDelivery {
 		}
 		this.fastUntil = 0;
 		this.signalReads = 0;
+		if (this.options.credentials.peerKey && (!this.state.wasLive || this.state.inviteTaken)) this.serialize(async () => {
+			const taken = this.state.inviteTaken;
+			if (taken) traceLink(this.from, "invite-untaken", {});
+			const { inviteTaken: _taken, ...kept } = this.state;
+			await this.persist({
+				...kept,
+				wasLive: true
+			});
+			if (taken) this.changed();
+		}).catch(() => {});
 		if (this.options.credentials.peerKey && this.state.peerMode) this.tick();
 		else this.schedule();
 	}
@@ -9724,7 +9819,8 @@ var DhtDelivery = class DhtDelivery {
 		const receipt = this.state.receipt && this.state.receipt.expires > now && this.state.receipt.attempts < MAX_ATTEMPTS ? this.state.receipt : void 0;
 		const receiptDue = !!receipt && !receipt.settled && (receipt.next ?? 0) <= now;
 		const reseal = this.resealDue;
-		if (!force && (!pending || pending.next > now) && !receiptDue && !this.reactionsDue && !reseal && this.controlDue > now) return;
+		const keepAlive = !force && (!pending || pending.next > now) && !receiptDue && !this.reactionsDue && !reseal;
+		if (keepAlive && this.controlDue > now) return;
 		const expires = pending?.expires ?? now - 12e4 + CONTROL_TTL;
 		const issued = Math.min(now, Math.max(now - DHT_ISSUED_BACK_MS, expires - (pending ? DHT_MESSAGE_TTL : CONTROL_TTL), (pending?.message[1] ?? 0) - 3e4));
 		const { body, records, reactions } = this.fitted(this.state.sequence + 1, issued, expires, pending?.message ?? null, receipt?.id ?? null, pending?.reply, pending?.edit, pending?.forwarded, pending?.file);
@@ -9758,7 +9854,7 @@ var DhtDelivery = class DhtDelivery {
 		});
 		if (pending) this.lastPublished = DhtDelivery.facts(body, records, identity.pubKeyZ32);
 		try {
-			await this.options.transport.publish(identity, records);
+			await this.options.transport.publish(identity, records, keepAlive && this.live ? { background: true } : void 0);
 		} catch (error) {
 			this.reactionsDue ||= reactionsWereDue;
 			if (isDiscoveryBudgetError(error)) await this.heldBack(error, now, before, pending, receipt);
@@ -9868,14 +9964,15 @@ var DhtDelivery = class DhtDelivery {
 	}
 	/**
 	* The contact's envelope is sealed to another key (`open`): it pinned someone else who used the same invite first, so
-	* nothing of this side's will ever be read. Said once this side is not proven the one it pinned (never seen in the
-	* pinned mailbox, no text confirmed, never live). The hint is sealed under the invite's key, which any copy of it
-	* holds: a passive warning, taken back by the contact's next envelope that opens here.
+	* nothing of this side's will ever be read. Said only while this side is not proven the one it pinned: no envelope
+	* sealed to this side read (`peerPinned`), no text confirmed, never live (`wasLive`). The hint is sealed under the
+	* invite's key, which any copy of it holds, so past that proof it says nothing of the contact: a passive warning,
+	* taken back by the contact's next envelope that opens here, or by a live session.
 	*/
 	async sealedToAnother(sender) {
 		const expected = this.options.credentials.peerKey ?? this.options.credentials.expectedPeerKey;
 		if (this.state.inviteTaken || !expected || sender !== expected) return;
-		if (this.state.peerPinned === "seen" || this.state.confirmed || this.live) return;
+		if (this.state.peerPinned || this.state.confirmed || this.state.wasLive || this.live) return;
 		traceLink(this.from, "invite-taken", {});
 		await this.persist({
 			...this.state,
@@ -10419,6 +10516,43 @@ function irohDescriptor(descriptor, spelling = "dotted") {
 	};
 }
 /**
+* A relay server's URL, short: https, or wss for a browser's relay; plain http or ws only on this machine's loopback,
+* as a test relay is (the same rule as the relay settings).
+*/
+var RELAY_URL = /^((https|wss):\/\/[^\s]{1,120}|(http|ws):\/\/(127\.0\.0\.1|localhost|\[::1\])(:\d{1,5})?(\/[^\s]{0,100})?)$/;
+var HEX_KEY = /^[0-9a-f]{64}$/;
+/** An Iroh direct address as the adapters parse it: an IPv4 or bracketed IPv6 address and its port. */
+var SOCKET_ADDRESS = /^(\d{1,3}(\.\d{1,3}){3}|\[[0-9A-Fa-f:.]{2,45}(%[A-Za-z0-9._-]{1,16})?\]):\d{1,5}$/;
+var MAX_ADDRESSES = 8;
+/**
+* A contact's native descriptors as it tells them on a session (`paired-policy`, `paired-adapters`) or as this app
+* kept them: only what the adapters dial, each field in the shape its adapter makes. The keys are 64 hex characters,
+* a relay passes `RELAY_URL` (the rule its capability record is read by), an Iroh descriptor lists at most eight
+* socket addresses. A descriptor that is anything else is left out, as one the contact never told; a field this app
+* does not know is not kept.
+*/
+function checkedDescriptors(value) {
+	const out = {};
+	if (!value || typeof value !== "object" || Array.isArray(value)) return out;
+	const raw = value;
+	const relay = (v) => typeof v === "string" && RELAY_URL.test(v);
+	const relayed = (v) => v === void 0 || typeof v === "boolean";
+	const iroh = raw["iroh/1"];
+	if (iroh && typeof iroh === "object" && typeof iroh.id === "string" && HEX_KEY.test(iroh.id) && (iroh.relay === void 0 || iroh.relay === null || relay(iroh.relay)) && relayed(iroh.relayed) && Array.isArray(iroh.addresses) && iroh.addresses.length <= MAX_ADDRESSES && iroh.addresses.every((a) => typeof a === "string" && SOCKET_ADDRESS.test(a))) out["iroh/1"] = {
+		id: iroh.id,
+		relay: iroh.relay ?? null,
+		addresses: [...iroh.addresses],
+		...iroh.relayed !== void 0 ? { relayed: iroh.relayed } : {}
+	};
+	const hyper = raw["hyperdht/1"];
+	if (hyper && typeof hyper === "object" && typeof hyper.publicKey === "string" && HEX_KEY.test(hyper.publicKey) && (hyper.relay === void 0 || relay(hyper.relay)) && relayed(hyper.relayed)) out["hyperdht/1"] = {
+		publicKey: hyper.publicKey,
+		...hyper.relay !== void 0 ? { relay: hyper.relay } : {},
+		...hyper.relayed !== void 0 ? { relayed: hyper.relayed } : {}
+	};
+	return out;
+}
+/**
 * Relay only (WISP 100, "Relayed"): the transport reaches this contact only through a relay server, never
 * directly. A descriptor says so with `relayed: true`, and an Iroh descriptor with no direct address is relayed
 * too (a browser's, WISP 102). Either side being relay only makes the whole path relayed. Both sides hold both
@@ -10458,15 +10592,13 @@ function parsePolicy(raw) {
 	if (!raw || typeof raw !== "object") return null;
 	const p = raw;
 	if (!Number.isSafeInteger(p.revision) || p.revision < 0 || !Number.isSafeInteger(p.intent) || p.intent < 0 || !TRANSPORTS.includes(p.preferred) || typeof p.fallback !== "boolean" || !Array.isArray(p.available) || p.available.length > 3 || new Set(p.available).size !== p.available.length || p.available.some((t) => !TRANSPORTS.includes(t)) || !p.descriptors || typeof p.descriptors !== "object" || JSON.stringify(p.descriptors).length > 4096) return null;
-	const descriptors = {};
-	for (const t of ["iroh/1", "hyperdht/1"]) if (p.descriptors[t]) descriptors[t] = p.descriptors[t];
 	return {
 		revision: p.revision,
 		intent: p.intent,
 		preferred: p.preferred,
 		fallback: p.fallback,
 		available: [...p.available],
-		descriptors
+		descriptors: checkedDescriptors(p.descriptors)
 	};
 }
 /** Runs only inside a participation-authenticated channel. Both roles may propose;
@@ -12042,11 +12174,6 @@ var HEX64$1 = /^[0-9a-f]{64}$/;
 var SIG$4 = /^[A-Za-z0-9_-]{86}$/;
 var Z32$2 = /^[ybndrfg8ejkmcpqxot1uwisza345h769]{52}$/;
 var KEY$1 = /^[A-Za-z0-9_-]{43}$/;
-/**
-* A relay server's URL, short: https, or wss for a browser's relay; plain http or ws only on this machine's loopback,
-* as a test relay is (the same rule as the relay settings).
-*/
-var RELAY = /^((https|wss):\/\/[^\s]{1,120}|(http|ws):\/\/(127\.0\.0\.1|localhost|\[::1\])(:\d{1,5})?(\/[^\s]{0,100})?)$/;
 var hexToKey = (hex) => toBase64Url(Uint8Array.from(hex.match(/../g), (b) => parseInt(b, 16)));
 var keyToHex = (key) => Array.from(fromBase64Url(key), (b) => b.toString(16).padStart(2, "0")).join("");
 /**
@@ -12058,12 +12185,12 @@ function capsDescriptors(descriptors) {
 	const iroh = descriptors?.["iroh/1"];
 	if (iroh && typeof iroh.id === "string" && HEX64$1.test(iroh.id)) out["iroh/1"] = {
 		id: hexToKey(iroh.id),
-		...typeof iroh.relay === "string" && RELAY.test(iroh.relay) ? { relay: iroh.relay } : {}
+		...typeof iroh.relay === "string" && RELAY_URL.test(iroh.relay) ? { relay: iroh.relay } : {}
 	};
 	const hyper = descriptors?.["hyperdht/1"];
 	if (hyper && typeof hyper.publicKey === "string" && HEX64$1.test(hyper.publicKey)) out["hyperdht/1"] = {
 		publicKey: hexToKey(hyper.publicKey),
-		...typeof hyper.relay === "string" && RELAY.test(hyper.relay) ? { relay: hyper.relay } : {}
+		...typeof hyper.relay === "string" && RELAY_URL.test(hyper.relay) ? { relay: hyper.relay } : {}
 	};
 	return out;
 }
@@ -12098,14 +12225,14 @@ function parseDescriptors(value) {
 	const out = {};
 	const iroh = raw["iroh/1"], hyper = raw["hyperdht/1"];
 	if (iroh !== void 0) {
-		if (!iroh || typeof iroh.id !== "string" || !KEY$1.test(iroh.id) || iroh.relay !== void 0 && (typeof iroh.relay !== "string" || !RELAY.test(iroh.relay))) return null;
+		if (!iroh || typeof iroh.id !== "string" || !KEY$1.test(iroh.id) || iroh.relay !== void 0 && (typeof iroh.relay !== "string" || !RELAY_URL.test(iroh.relay))) return null;
 		out["iroh/1"] = {
 			id: iroh.id,
 			...iroh.relay !== void 0 ? { relay: iroh.relay } : {}
 		};
 	}
 	if (hyper !== void 0) {
-		if (!hyper || typeof hyper.publicKey !== "string" || !KEY$1.test(hyper.publicKey) || hyper.relay !== void 0 && (typeof hyper.relay !== "string" || !RELAY.test(hyper.relay))) return null;
+		if (!hyper || typeof hyper.publicKey !== "string" || !KEY$1.test(hyper.publicKey) || hyper.relay !== void 0 && (typeof hyper.relay !== "string" || !RELAY_URL.test(hyper.relay))) return null;
 		out["hyperdht/1"] = {
 			publicKey: hyper.publicKey,
 			...hyper.relay !== void 0 ? { relay: hyper.relay } : {}
@@ -12568,373 +12695,654 @@ async function fitSignedPairedSignalWith(signal, signer, from, to, fits) {
 	}
 }
 //#endregion
-//#region ../core/src/storeForward.ts
-/**
-* Store-and-forward for an away contact (WISP 404 draft, `hold/1`).
-*
-* What a person sends while the contact is away is sealed into a *bundle* (signed by the sender's
-* participation key, then encrypted to a key only the two of them can derive), put in the sender's
-* own storage (WISP 1000), and named in a *manifest* the storage also holds. A small signed, encrypted
-* *pointer* record on a per-link Pkarr key tells the contact where the manifest is (a URL that expires)
-* and which of the contact's own bundles have been received. Storage and relays see ciphertext, sizes
-* and timing only. Nothing here promises forward secrecy or retention beyond the bounds below.
-*/
-var HOLD_CAPABILITY = "hold/1";
-var HOLD_LIMITS = {
-	/** One bundle, ciphertext and header included: a picture, not a video. */
-	maxBundleBytes: 8388608,
-	/** All bundles held for one contact at once. */
-	maxMailboxBytes: 67108864,
-	maxMailboxBundles: 64,
-	/** A bundle not picked up by then is dropped by its sender. The longest a presigned URL lives, too. */
-	ttlMs: 6048e5,
-	maxTextBytes: 16384,
-	maxPaymentRequestBytes: 65536,
-	maxManifestBytes: 65536,
-	/**
-	* How far past one lifetime from now an expiry may reach by the reader's clock: the sender's clock may be ahead, and
-	* a day covers any clock that is merely wrong. Nothing else about a pointer or a bundle is held against this clock.
-	*/
-	clockSkewMs: 864e5
-};
-/**
-* How far before its own clock a sender dates its pointer and its manifest, and ends the lifetimes it gives. A reader
-* refuses nothing for those dates: `rev` orders pointers and `seq` orders items, both kept by the reader. Apps up to
-* 1.0.2 refuse a pointer or a manifest dated more than a minute past their clock, and an expiry more than a minute
-* past one lifetime from now, each without a word: the items of a sender whose clock ran two minutes fast were never
-* fetched. Dated back, a sender up to about eleven minutes ahead is read by them.
-*/
-var HOLD_DATED_BACK_MS = 6e5;
-var KINDS$1 = [
-	"text",
-	"file",
-	"pay-req",
-	"manifest"
+//#region ../core/src/domainProofs.ts
+var DNS_LABEL = "_ghostly";
+var WELL_KNOWN_PATH = "/.well-known/ghostly.json";
+var NIP05_PATH = "/.well-known/nostr.json?name=_";
+/** Everything read from a domain is bounded; these match the fetch limits. */
+var DOMAIN_FILE_MAX_BYTES = 16384;
+var z32 = /^[ybndrfg8ejkmcpqxot1uwisza345h769]{52}$/;
+var hex64 = /^[a-f0-9]{64}$/;
+/** Names that never resolve publicly (RFC 6761, 6762, 7686, 8375, 9476) or that
+* only ever mean a private network. A proof for them could only point inward. */
+var SPECIAL_USE = [
+	"localhost",
+	"local",
+	"internal",
+	"lan",
+	"home",
+	"corp",
+	"intranet",
+	"private",
+	"test",
+	"example",
+	"invalid",
+	"onion",
+	"alt",
+	"arpa"
 ];
-var WIRE_ID = /^[A-Za-z0-9_-]{8,64}$/;
-var MAILBOX = /^[A-Za-z0-9_-]{22}$/;
-var SIG$3 = /^[A-Za-z0-9_-]{86}$/;
-var MAGIC$2 = utf8Encode("GHLD");
-var VERSION = 1;
-var NONCE$2 = 24;
-/** Why a bundle, manifest or pointer was refused. Never a reason to trust it a little. */
-var HoldRefusedError = class extends Error {
-	reason;
-	constructor(reason, message) {
-		super(message);
-		this.reason = reason;
-	}
-};
-var bodyDigest = (body) => toBase64Url(sha256(body));
-var newMailbox = () => toBase64Url(randomBytes(16)).slice(0, 22);
 /**
-* Everything derived once per link for this feature: my pointer key, the contact's pointer address and
-* the key that seals bundles and pointers between the two participation keys. Needs a pinned contact.
+* Normalizes what a person typed ("Example.COM.", "https://example.com/") into
+* a lowercase ASCII host name, or throws with a message fit for the UI.
+* Internationalized names become punycode (xn--), the form DNS carries.
 */
-var HoldKeys = class {
-	from;
-	to;
-	me;
-	peer;
-	/** Publishes my pointer. */
-	identity;
-	/** Where the contact publishes its pointer. */
-	peerAddress;
-	seed;
-	sealKey;
-	constructor(params, participationSeedB64, peerKey) {
-		this.from = identityFromSeedB64(params.seedB64).pubKeyZ32;
-		this.to = params.peerPubKeyZ32;
-		const mine = identityFromSeedB64(participationSeedB64);
-		this.seed = mine.seed;
-		this.me = mine.pubKeyZ32;
-		this.peer = peerKey;
-		const secret = fromBase64Url(params.encKeyB64);
-		const context = JSON.stringify(["ghostly-hold/1", [this.from, this.to].sort()]);
-		const derive = (label) => hkdf(sha256, secret, utf8Encode(context), utf8Encode(label), 32);
-		this.identity = identityFromSeed(derive(`pointer:${this.from}`));
-		this.peerAddress = identityFromSeed(derive(`pointer:${this.to}`)).pubKeyZ32;
-		const shared = x25519.getSharedSecret(ed25519.utils.toMontgomerySecret(this.seed), ed25519.utils.toMontgomery(publicKeyFromZ32(peerKey)));
-		this.sealKey = hkdf(sha256, shared, derive("envelope"), utf8Encode("ghostly-hold-envelope/1"), 32);
-	}
-	/** Seals one item for the contact: signed with my participation key, encrypted to our shared key. */
-	seal(item, body) {
-		const fields = [
-			VERSION,
-			this.from,
-			this.to,
-			this.me,
-			this.peer,
-			item.mailbox,
-			item.seq,
-			item.id,
-			item.ts,
-			item.kind,
-			item.meta ?? null,
-			bodyDigest(body),
-			item.expires
-		];
-		const signature = toBase64Url(sign(utf8Encode(JSON.stringify(["ghostly-hold-bundle", fields])), this.seed));
-		const header = utf8Encode(JSON.stringify([fields, signature]));
-		const length = /* @__PURE__ */ new Uint8Array(4);
-		new DataView(length.buffer).setUint32(0, header.length);
-		const nonce = randomBytes(NONCE$2);
-		const box = xsalsa20poly1305(this.sealKey, nonce).encrypt(concatBytes$1(length, header, body));
-		return concatBytes$1(MAGIC$2, new Uint8Array([VERSION]), nonce, box);
-	}
-	/**
-	* Opens a bundle the contact sealed for me. Everything is checked before anything is returned: the
-	* authenticated encryption, the header's shape, that it names this link, this contact and me, the
-	* signature, the body digest and the limits of its kind.
-	*/
-	open(bytes, expect = {}) {
-		const now = expect.now ?? Date.now();
-		if (bytes.length > (expect.maxBytes ?? HOLD_LIMITS.maxBundleBytes)) throw new HoldRefusedError("size", "The held item is larger than allowed");
-		if (bytes.length < MAGIC$2.length + 1 + NONCE$2 + 16 + 4 || !MAGIC$2.every((b, i) => bytes[i] === b)) throw new HoldRefusedError("format", "Not a held item");
-		if (bytes[MAGIC$2.length] !== VERSION) throw new HoldRefusedError("format", "Held item from a newer Ghostly");
-		let plain;
-		try {
-			plain = xsalsa20poly1305(this.sealKey, bytes.subarray(MAGIC$2.length + 1, MAGIC$2.length + 1 + NONCE$2)).decrypt(bytes.subarray(MAGIC$2.length + 1 + NONCE$2));
-		} catch {
-			throw new HoldRefusedError("tampered", "The held item was changed or is not for this chat");
-		}
-		if (plain.length < 4) throw new HoldRefusedError("format", "Not a held item");
-		const headerLength = new DataView(plain.buffer, plain.byteOffset, 4).getUint32(0);
-		if (headerLength > 131072 || 4 + headerLength > plain.length) throw new HoldRefusedError("format", "Not a held item");
-		let parsed;
+function normalizeDomain(input) {
+	if (typeof input !== "string") throw new Error("Enter a domain name, like example.com");
+	let value = input.trim();
+	if (!value || value.length > 300) throw new Error("Enter a domain name, like example.com");
+	if (/^[a-z][a-z0-9+.-]*:\/\//i.test(value)) {
+		let url;
 		try {
-			parsed = JSON.parse(utf8Decode(plain.subarray(4, 4 + headerLength)));
+			url = new URL(value);
 		} catch {
-			throw new HoldRefusedError("format", "Not a held item");
+			throw new Error("Enter a domain name, like example.com");
 		}
-		if (!Array.isArray(parsed) || parsed.length !== 2 || !Array.isArray(parsed[0]) || parsed[0].length !== 13 || typeof parsed[1] !== "string" || !SIG$3.test(parsed[1])) throw new HoldRefusedError("format", "Not a held item");
-		const [fields, signature] = parsed;
-		const [v, from, to, author, recipient, mailbox, seq, id, ts, kind, meta, digest, expires] = fields;
-		if (v !== VERSION || typeof from !== "string" || typeof to !== "string" || typeof author !== "string" || typeof recipient !== "string" || typeof mailbox !== "string" || !MAILBOX.test(mailbox) || !Number.isSafeInteger(seq) || seq < 0 || typeof id !== "string" || !WIRE_ID.test(id) || !Number.isSafeInteger(ts) || ts <= 0 || typeof kind !== "string" || !KINDS$1.includes(kind) || typeof digest !== "string" || !Number.isSafeInteger(expires)) throw new HoldRefusedError("format", "Not a held item");
-		if (from !== this.to || to !== this.from || recipient !== this.me) throw new HoldRefusedError("not-for-me", "The held item is for another chat");
-		if (author !== this.peer) throw new HoldRefusedError("author", "The held item was not signed by this contact");
-		if (expect.mailbox && mailbox !== expect.mailbox) throw new HoldRefusedError("not-for-me", "The held item is from another mailbox");
-		let valid;
+		if (url.protocol !== "https:" || url.username || url.password || url.port || url.pathname !== "/" && url.pathname !== "" || url.search || url.hash) throw new Error("Enter only the domain name, without a path or port");
+		value = url.hostname;
+	} else {
+		if (/[/:@?#\s\\]/.test(value)) throw new Error("Enter only the domain name, without a path or port");
 		try {
-			valid = verify(fromBase64Url(signature), utf8Encode(JSON.stringify(["ghostly-hold-bundle", fields])), publicKeyFromZ32(author));
+			value = new URL(`https://${value}`).hostname;
 		} catch {
-			valid = false;
+			throw new Error("That is not a valid domain name");
 		}
-		if (!valid) throw new HoldRefusedError("signature", "The held item's signature does not check out");
-		const body = plain.subarray(4 + headerLength);
-		if (bodyDigest(body) !== digest) throw new HoldRefusedError("digest", "The held item's content does not match its header");
-		if (expires <= ts || expires > now + HOLD_LIMITS.ttlMs + HOLD_LIMITS.clockSkewMs) throw new HoldRefusedError("limits", "The held item's lifetime is out of bounds");
-		const header = {
-			v: 1,
-			from,
-			to,
-			author,
-			recipient,
-			mailbox,
-			seq,
-			id,
-			ts,
-			kind,
-			meta,
-			digest,
-			expires
-		};
-		checkKind(header, body);
-		return {
-			header,
-			body
-		};
 	}
-	/** My pointer, as records to publish under `identity`. Throws when it cannot fit a packet. */
-	pointerRecords(pointer, now = Date.now()) {
-		const body = [
-			VERSION,
-			pointer.rev,
-			pointer.issued,
-			pointer.expires,
-			pointer.manifestUrl,
-			pointer.top,
-			pointer.ack,
-			pointer.count,
-			pointer.bytes,
-			pointer.refused.slice(-32)
-		];
-		const signature = toBase64Url(sign(utf8Encode(JSON.stringify([
-			"ghostly-hold-pointer",
-			this.from,
-			this.to,
-			body
-		])), this.seed));
-		const ttl = Math.min(86400, Math.max(60, Math.ceil((pointer.expires - now) / 1e3)));
-		const records = [{
-			label: "_hold",
-			value: encrypt(JSON.stringify([body, signature]), this.sealKey),
-			ttl
-		}];
-		if (measureRecords(this.identity.pubKeyZ32, records) > 1e3) throw new Error("The storage address is too long for a DHT packet. Use a shorter endpoint or prefix.");
-		return records;
-	}
-	/**
-	* The contact's pointer out of its packet, or null when the packet is not one of its pointers. Its `issued` is the
-	* contact's clock and refuses nothing: an older pointer cannot take a newer one's place because of `rev`.
-	*/
-	readPointer(packet) {
-		if (packet.pubKeyZ32 !== this.peerAddress || measureRecords(packet.pubKeyZ32, packet.records) > 1e3) return null;
-		const records = packet.records.filter((r) => r.label === "_hold");
-		if (records.length !== 1) return null;
-		const plain = tryDecrypt(records[0].value, this.sealKey);
-		if (!plain) return null;
-		let parsed;
-		try {
-			parsed = JSON.parse(plain);
-		} catch {
-			return null;
-		}
-		if (!Array.isArray(parsed) || parsed.length !== 2 || !Array.isArray(parsed[0]) || parsed[0].length !== 9 && parsed[0].length !== 10 || typeof parsed[1] !== "string" || !SIG$3.test(parsed[1])) return null;
-		const [body, signature] = parsed;
-		const [v, rev, issued, expires, manifestUrl, top, ack, count, bytes, refused = []] = body;
-		if (v !== VERSION || ![
-			rev,
-			issued,
-			expires,
-			top,
-			ack,
-			count,
-			bytes
-		].every((n) => Number.isSafeInteger(n) && n >= 0) || manifestUrl !== null && (typeof manifestUrl !== "string" || manifestUrl.length > 2048) || !Array.isArray(refused) || refused.length > 32 || !refused.every((n) => Number.isSafeInteger(n) && n > 0)) return null;
-		try {
-			if (!verify(fromBase64Url(signature), utf8Encode(JSON.stringify([
-				"ghostly-hold-pointer",
-				this.to,
-				this.from,
-				body
-			])), publicKeyFromZ32(this.peer))) return null;
-		} catch {
-			return null;
-		}
-		return {
-			rev,
-			issued,
-			expires,
-			manifestUrl,
-			top,
-			ack,
-			count,
-			bytes,
-			refused
-		};
-	}
-};
-/** A URL a bundle or manifest may be fetched from: HTTPS, or HTTP to this machine while testing. */
-function isHoldUrl(value) {
-	if (typeof value !== "string" || value.length > 2048) return false;
+	value = value.toLowerCase().replace(/\.$/, "");
+	if (value.length > 244) throw new Error("That domain name is too long");
+	const labels = value.split(".");
+	if (labels.length < 2) throw new Error("Use a full domain name, like example.com");
+	for (const label of labels) if (!/^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/.test(label)) throw new Error("That is not a valid domain name");
+	const tld = labels[labels.length - 1];
+	if (/^[0-9]+$/.test(tld) || /^\[/.test(value)) throw new Error("Use a domain name, not an IP address");
+	if (SPECIAL_USE.includes(tld) || labels.length >= 2 && labels.slice(-2).join(".") === "home.arpa") throw new Error("That name only works on private networks");
+	return value;
+}
+var dnsProofName = (domain) => `${DNS_LABEL}.${normalizeDomain(domain)}`;
+var wellKnownUrl = (domain, method = "https") => `https://${normalizeDomain(domain)}${method === "nip05" ? NIP05_PATH : WELL_KNOWN_PATH}`;
+function validDomainRecord(r) {
+	if (!r || typeof r.key !== "string" || typeof r.proof !== "string" || !z32.test(r.key) || !hex64.test(r.proof)) return false;
 	try {
-		const url = new URL(value);
-		return url.protocol === "https:" || url.protocol === "http:" && [
-			"localhost",
-			"127.0.0.1",
-			"[::1]"
-		].includes(url.hostname);
+		return toZ32(fromZ32(r.key)) === r.key;
 	} catch {
 		return false;
 	}
 }
-/** The limits of each kind, on the way in. */
-function checkKind(header, body) {
-	const bad = (message) => new HoldRefusedError("limits", message);
-	switch (header.kind) {
-		case "text":
-			if (body.length > HOLD_LIMITS.maxTextBytes) throw bad("The held text is too long");
-			try {
-				utf8Decode(body);
-			} catch {
-				throw bad("The held text is not text");
-			}
-			return;
-		case "pay-req":
-			if (body.length > HOLD_LIMITS.maxPaymentRequestBytes) throw bad("The held payment request is too large");
-			return;
-		case "file": {
-			const meta = header.meta;
-			if (!meta || typeof meta !== "object" || typeof meta.name !== "string" || meta.name.length > 255 || typeof meta.mime !== "string" || meta.mime.length > 255 || meta.size !== body.length) throw bad("The held file does not match its description");
-			return;
-		}
-		case "manifest":
-			if (body.length !== 0) throw bad("A manifest carries no body");
-			readManifest(header.meta);
-			return;
+/** The TXT record value, in the `tag=value; …` style people know from DKIM. */
+function domainTxtRecord(r) {
+	if (!validDomainRecord(r)) throw new Error("Invalid domain record");
+	return `v=ghostly1; key=${r.key}; proof=${r.proof}`;
+}
+/** Parses one TXT string. Undefined for anything that is not ours or not exactly
+* well-formed; unknown extra tags are ignored for forward compatibility. */
+function parseDomainTxt(value) {
+	if (typeof value !== "string" || utf8Encode(value).length > 1024) return;
+	const tags = /* @__PURE__ */ new Map();
+	const parts = value.split(";").map((p) => p.trim()).filter(Boolean);
+	for (const part of parts) {
+		const eq = part.indexOf("=");
+		if (eq < 1) return;
+		const name = part.slice(0, eq).trim().toLowerCase();
+		if (tags.has(name)) return;
+		tags.set(name, part.slice(eq + 1).trim());
+	}
+	if (!parts[0]?.toLowerCase().startsWith("v=") || tags.get("v") !== "ghostly1") return;
+	const r = {
+		key: tags.get("key"),
+		proof: tags.get("proof")
+	};
+	return validDomainRecord(r) ? r : void 0;
+}
+var addRecord = (list, r) => {
+	if (!list.some((x) => x.key === r.key && x.proof === r.proof)) list.push(r);
+};
+/** All records among the TXT strings of `_ghostly.<domain>`; other strings are skipped. */
+function recordsFromTxt(values) {
+	const out = [];
+	for (const value of values.slice(0, 32)) {
+		const r = parseDomainTxt(value);
+		if (r) addRecord(out, r);
 	}
+	return out.slice(0, 8);
 }
-/** The entries of a manifest, checked: strictly increasing sequences, bounded sizes, fetchable URLs. */
-function readManifest(meta) {
-	const bad = (message) => new HoldRefusedError("limits", message);
-	const entries = meta?.entries;
-	if (!Array.isArray(entries) || entries.length > HOLD_LIMITS.maxMailboxBundles) throw bad("The manifest lists too many items");
-	let last = 0, total = 0;
+/** The body of `/.well-known/ghostly.json`. */
+function domainWellKnownFile(records) {
+	if (!records.length || records.length > 8 || !records.every(validDomainRecord)) throw new Error("Invalid domain records");
+	return JSON.stringify({
+		ghostly: 1,
+		proofs: records.map((r) => ({
+			key: r.key,
+			proof: r.proof
+		}))
+	}, null, 2) + "\n";
+}
+function parseJson(text) {
+	if (typeof text !== "string" || utf8Encode(text).length > 16384) throw new Error("File too large");
+	return JSON.parse(text);
+}
+/** Records from `ghostly.json`. Throws on a malformed file; [] when it names none. */
+function recordsFromWellKnown(text) {
+	const body = parseJson(text);
+	if (!body || typeof body !== "object" || Array.isArray(body) || body.ghostly !== 1 || !Array.isArray(body.proofs)) throw new Error("Not a Ghostly domain file");
 	const out = [];
-	for (const entry of entries) {
-		if (!Array.isArray(entry) || entry.length !== 6) throw bad("The manifest is malformed");
-		const [seq, id, kind, bytes, url, expires] = entry;
-		if (!Number.isSafeInteger(seq) || seq <= last || typeof id !== "string" || !WIRE_ID.test(id) || typeof kind !== "string" || !KINDS$1.includes(kind) || kind === "manifest" || !Number.isSafeInteger(bytes) || bytes < 0 || bytes > HOLD_LIMITS.maxBundleBytes || !isHoldUrl(url) || !Number.isSafeInteger(expires)) throw bad("The manifest is malformed");
-		last = seq;
-		total += bytes;
-		if (total > HOLD_LIMITS.maxMailboxBytes) throw bad("The manifest lists more than a mailbox may hold");
-		out.push([
-			seq,
-			id,
-			kind,
-			bytes,
-			url,
-			expires
-		]);
+	for (const entry of body.proofs.slice(0, 32)) {
+		if (!entry || typeof entry !== "object") continue;
+		const r = {
+			key: entry.key,
+			proof: entry.proof
+		};
+		if (validDomainRecord(r)) addRecord(out, r);
 	}
-	return out;
+	return out.slice(0, 8);
 }
-//#endregion
-//#region ../core/src/pairedSession.ts
-/**
-* What this app does that grants nothing, said outside `capabilities`: apps before 0.5 accept at most 16
-* of those, and a full offer is already there. The field is not in the transcript (an app that does not
-* know it could not sign it), so nothing that needs authenticating may go here; the DTLS binding of the
-* transcript still ties it to this connection. `ping/1`: this app answers `paired-ping`, from the open.
-*/
-var OFFER_EXTENSIONS = ["ping/1"];
-var MAX_HANDSHAKE_BYTES = 4096;
-/**
-* Frames received and not handled yet, at most: their count and their size together. Frames are handled one at a time,
-* each awaited (a group frame is decrypted, checked and stored before the next), and the peer sends at the network's
-* pace. A member back in a group answers a sync with a burst: a commit per epoch, its kept messages, the ones it hands
-* on, edits, reactions. With a bound of 64 frames a phone handling them a few milliseconds each failed its session
-* mid catch-up ("Session receive limit exceeded" then, "Session receive queue full" now, 2026-10-07). The size bound keeps the old worst case in memory
-* (64 frames of 60 KiB); the count only bounds a flood of tiny frames.
-*/
-var SESSION_RECEIVE_PENDING = {
-	frames: 1024,
-	bytes: 3932160
+/** NIP-05: only the root name `_` speaks for the domain itself. Undefined when absent. */
+function nip05RootKey(text) {
+	const body = parseJson(text);
+	if (!body || typeof body !== "object" || !body.names || typeof body.names !== "object" || Array.isArray(body.names)) throw new Error("Not a NIP-05 file");
+	const root = body.names["_"];
+	return typeof root === "string" && hex64.test(root) ? root : void 0;
+}
+var recordsName = (records, r) => records.some((x) => x.key === r.key && x.proof === r.proof);
+var DNS_TYPE = {
+	A: 1,
+	CNAME: 5,
+	TXT: 16,
+	AAAA: 28
 };
-var KEY = /^[ybndrfg8ejkmcpqxot1uwisza345h769]{52}$/;
-var NONCE$1 = /^[A-Za-z0-9_-]{43}$/;
-var SIG$2 = /^[A-Za-z0-9_-]{86}$/;
-var FINGERPRINT = /^[a-f0-9]{64}$/;
-var isList = (v, maximum = 8) => Array.isArray(v) && v.length > 0 && v.length <= maximum && v.every((x) => typeof x === "string" && /^[a-z0-9/-]{1,40}$/.test(x)) && new Set(v).size === v.length;
-function parseOffer(v) {
-	if (!Array.isArray(v.versions) || v.versions.length === 0 || v.versions.length > 8 || !v.versions.every((n) => Number.isSafeInteger(n) && n > 0) || new Set(v.versions).size !== v.versions.length || !isList(v.transports) || !isList(v.capabilities, 32) || typeof v.key !== "string" || !KEY.test(v.key) || typeof v.nonce !== "string" || !NONCE$1.test(v.nonce)) return null;
-	const extensions = isList(v.extensions, 32) ? v.extensions : void 0;
-	return {
-		t: "pair-offer",
-		versions: v.versions,
-		transports: v.transports,
-		capabilities: v.capabilities,
-		...extensions && { extensions },
-		key: v.key,
-		nonce: v.nonce
-	};
+/** A recursive query for one name and type. ID 0, as RFC 8484 recommends for caching;
+* the AD bit asks the resolver to report DNSSEC validation (RFC 6840 §5.7). */
+function encodeDnsQuery(name, type) {
+	const labels = name.replace(/\.$/, "").split(".");
+	const parts = [Uint8Array.of(0, 0, 1, 32, 0, 1, 0, 0, 0, 0, 0, 0)];
+	for (const label of labels) {
+		const bytes = utf8Encode(label);
+		if (!bytes.length || bytes.length > 63) throw new Error("Invalid DNS name");
+		parts.push(Uint8Array.of(bytes.length), bytes);
+	}
+	const code = DNS_TYPE[type];
+	parts.push(Uint8Array.of(0, code >> 8, code & 255, 0, 1));
+	return concatBytes$1(...parts);
 }
-var offerTuple = (o) => [
-	o.key,
-	o.nonce,
-	o.versions,
-	o.transports,
+function readName(data, start) {
+	const labels = [];
+	let pos = start, next = -1, jumps = 0, length = 0;
+	for (;;) {
+		if (pos >= data.length) throw new Error("DNS name out of bounds");
+		const len = data[pos];
+		if ((len & 192) === 192) {
+			if (pos + 1 >= data.length) throw new Error("DNS pointer out of bounds");
+			if (next < 0) next = pos + 2;
+			pos = (len & 63) << 8 | data[pos + 1];
+			if (++jumps > 32) throw new Error("DNS name loops");
+			continue;
+		}
+		if (len & 192) throw new Error("Unsupported DNS label");
+		pos += 1;
+		if (len === 0) break;
+		if (pos + len > data.length) throw new Error("DNS label out of bounds");
+		length += len + 1;
+		if (length > 255) throw new Error("DNS name too long");
+		labels.push(utf8Decode(data.subarray(pos, pos + len)).toLowerCase());
+		pos += len;
+	}
+	return {
+		name: labels.join("."),
+		next: next < 0 ? pos : next
+	};
+}
+/**
+* Decodes a resolver's answer to `encodeDnsQuery(name, type)`. Refuses a reply
+* to another question or a truncated one, and keeps only records of the asked
+* type owned by the name or by the CNAME chain the answer itself follows.
+*/
+function decodeDnsResponse(data, name, type) {
+	if (data.length < 12) throw new Error("DNS response too short");
+	const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
+	const flags = view.getUint16(2);
+	if (!(flags & 32768) || flags & 30720 || flags & 512) throw new Error("Unusable DNS response");
+	const questions = view.getUint16(4), count = view.getUint16(6);
+	const want = name.replace(/\.$/, "").toLowerCase(), code = DNS_TYPE[type];
+	if (questions !== 1) throw new Error("DNS response is for another question");
+	const q = readName(data, 12);
+	if (q.name !== want || q.next + 4 > data.length || view.getUint16(q.next) !== code) throw new Error("DNS response is for another question");
+	let pos = q.next + 4;
+	const all = [];
+	for (let i = 0; i < count && i < 64; i++) {
+		const owner = readName(data, pos);
+		pos = owner.next;
+		if (pos + 10 > data.length) throw new Error("DNS record out of bounds");
+		const rtype = view.getUint16(pos), ttl = view.getUint32(pos + 4), len = view.getUint16(pos + 8);
+		pos += 10;
+		if (pos + len > data.length) throw new Error("DNS record out of bounds");
+		const rdata = rtype === DNS_TYPE.CNAME ? utf8Encode(readName(data, pos).name) : data.slice(pos, pos + len);
+		all.push({
+			name: owner.name,
+			type: rtype,
+			ttl,
+			data: rdata
+		});
+		pos += len;
+	}
+	const owners = /* @__PURE__ */ new Set([want]);
+	for (let hop = 0; hop < 8; hop++) {
+		const cname = all.find((a) => a.type === DNS_TYPE.CNAME && owners.has(a.name) && !owners.has(utf8Decode(a.data)));
+		if (!cname) break;
+		owners.add(utf8Decode(cname.data));
+	}
+	return {
+		rcode: flags & 15,
+		authenticated: !!(flags & 32),
+		answers: all.filter((a) => a.type === code && owners.has(a.name))
+	};
+}
+/** The TXT character-strings of one record, joined as RFC 7208 §3.3 does. */
+function txtValue(rdata) {
+	const parts = [];
+	for (let p = 0; p < rdata.length;) {
+		const len = rdata[p];
+		if (p + 1 + len > rdata.length) throw new Error("DNS text out of bounds");
+		parts.push(rdata.subarray(p + 1, p + 1 + len));
+		p += 1 + len;
+	}
+	return new TextDecoder("utf-8", { fatal: true }).decode(concatBytes$1(...parts));
+}
+/** False for loopback, private, link-local, shared (CGNAT), multicast, reserved
+* and unspecified addresses, including IPv4 embedded in IPv6. */
+function isPublicAddress(address) {
+	if (address.length === 4) {
+		const [a, b, c] = address;
+		return !(a === 0 || a === 10 || a === 127 || a >= 224 || a === 100 && b >= 64 && b <= 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 192 && b === 0 && c === 0 || a === 198 && (b === 18 || b === 19));
+	}
+	if (address.length !== 16) return false;
+	const zeroTo = (n) => address.subarray(0, n).every((x) => x === 0);
+	if (zeroTo(15) && (address[15] === 0 || address[15] === 1)) return false;
+	if (zeroTo(10) && address[10] === 255 && address[11] === 255) return isPublicAddress(address.subarray(12));
+	if (address[0] === 0 && address[1] === 100 && address[2] === 255 && address[3] === 155 && address.subarray(4, 12).every((x) => x === 0)) return isPublicAddress(address.subarray(12));
+	if (zeroTo(12)) return false;
+	if ((address[0] & 254) === 252) return false;
+	if (address[0] === 254 && (address[1] & 192) === 128) return false;
+	if (address[0] === 254 && (address[1] & 192) === 192) return false;
+	if (address[0] === 255) return false;
+	if (address[0] === 1 && address.subarray(1, 8).every((x) => x === 0)) return false;
+	return (address[0] & 224) === 32;
+}
+//#endregion
+//#region ../core/src/storeForward.ts
+/**
+* Store-and-forward for an away contact (WISP 404 draft, `hold/1`).
+*
+* What a person sends while the contact is away is sealed into a *bundle* (signed by the sender's
+* participation key, then encrypted to a key only the two of them can derive), put in the sender's
+* own storage (WISP 1000), and named in a *manifest* the storage also holds. A small signed, encrypted
+* *pointer* record on a per-link Pkarr key tells the contact where the manifest is (a URL that expires)
+* and which of the contact's own bundles have been received. Storage and relays see ciphertext, sizes
+* and timing only. Nothing here promises forward secrecy or retention beyond the bounds below.
+*/
+var HOLD_CAPABILITY = "hold/1";
+var HOLD_LIMITS = {
+	/** One bundle, ciphertext and header included: a picture, not a video. */
+	maxBundleBytes: 8388608,
+	/** All bundles held for one contact at once. */
+	maxMailboxBytes: 67108864,
+	maxMailboxBundles: 64,
+	/** A bundle not picked up by then is dropped by its sender. The longest a presigned URL lives, too. */
+	ttlMs: 6048e5,
+	maxTextBytes: 16384,
+	maxPaymentRequestBytes: 65536,
+	maxManifestBytes: 65536,
+	/**
+	* How far past one lifetime from now an expiry may reach by the reader's clock: the sender's clock may be ahead, and
+	* a day covers any clock that is merely wrong. Nothing else about a pointer or a bundle is held against this clock.
+	*/
+	clockSkewMs: 864e5
+};
+/**
+* How far before its own clock a sender dates its pointer and its manifest, and ends the lifetimes it gives. A reader
+* refuses nothing for those dates: `rev` orders pointers and `seq` orders items, both kept by the reader. Apps up to
+* 1.0.2 refuse a pointer or a manifest dated more than a minute past their clock, and an expiry more than a minute
+* past one lifetime from now, each without a word: the items of a sender whose clock ran two minutes fast were never
+* fetched. Dated back, a sender up to about eleven minutes ahead is read by them.
+*/
+var HOLD_DATED_BACK_MS = 6e5;
+var KINDS$1 = [
+	"text",
+	"file",
+	"pay-req",
+	"manifest"
+];
+var WIRE_ID = /^[A-Za-z0-9_-]{8,64}$/;
+var MAILBOX = /^[A-Za-z0-9_-]{22}$/;
+var SIG$3 = /^[A-Za-z0-9_-]{86}$/;
+var MAGIC$2 = utf8Encode("GHLD");
+var VERSION = 1;
+var NONCE$2 = 24;
+/** Why a bundle, manifest or pointer was refused. Never a reason to trust it a little. */
+var HoldRefusedError = class extends Error {
+	reason;
+	constructor(reason, message) {
+		super(message);
+		this.reason = reason;
+	}
+};
+var bodyDigest = (body) => toBase64Url(sha256(body));
+var newMailbox = () => toBase64Url(randomBytes(16)).slice(0, 22);
+/**
+* Everything derived once per link for this feature: my pointer key, the contact's pointer address and
+* the key that seals bundles and pointers between the two participation keys. Needs a pinned contact.
+*/
+var HoldKeys = class {
+	from;
+	to;
+	me;
+	peer;
+	/** Publishes my pointer. */
+	identity;
+	/** Where the contact publishes its pointer. */
+	peerAddress;
+	seed;
+	sealKey;
+	constructor(params, participationSeedB64, peerKey) {
+		this.from = identityFromSeedB64(params.seedB64).pubKeyZ32;
+		this.to = params.peerPubKeyZ32;
+		const mine = identityFromSeedB64(participationSeedB64);
+		this.seed = mine.seed;
+		this.me = mine.pubKeyZ32;
+		this.peer = peerKey;
+		const secret = fromBase64Url(params.encKeyB64);
+		const context = JSON.stringify(["ghostly-hold/1", [this.from, this.to].sort()]);
+		const derive = (label) => hkdf(sha256, secret, utf8Encode(context), utf8Encode(label), 32);
+		this.identity = identityFromSeed(derive(`pointer:${this.from}`));
+		this.peerAddress = identityFromSeed(derive(`pointer:${this.to}`)).pubKeyZ32;
+		const shared = x25519.getSharedSecret(ed25519.utils.toMontgomerySecret(this.seed), ed25519.utils.toMontgomery(publicKeyFromZ32(peerKey)));
+		this.sealKey = hkdf(sha256, shared, derive("envelope"), utf8Encode("ghostly-hold-envelope/1"), 32);
+	}
+	/** Seals one item for the contact: signed with my participation key, encrypted to our shared key. */
+	seal(item, body) {
+		const fields = [
+			VERSION,
+			this.from,
+			this.to,
+			this.me,
+			this.peer,
+			item.mailbox,
+			item.seq,
+			item.id,
+			item.ts,
+			item.kind,
+			item.meta ?? null,
+			bodyDigest(body),
+			item.expires
+		];
+		const signature = toBase64Url(sign(utf8Encode(JSON.stringify(["ghostly-hold-bundle", fields])), this.seed));
+		const header = utf8Encode(JSON.stringify([fields, signature]));
+		const length = /* @__PURE__ */ new Uint8Array(4);
+		new DataView(length.buffer).setUint32(0, header.length);
+		const nonce = randomBytes(NONCE$2);
+		const box = xsalsa20poly1305(this.sealKey, nonce).encrypt(concatBytes$1(length, header, body));
+		return concatBytes$1(MAGIC$2, new Uint8Array([VERSION]), nonce, box);
+	}
+	/**
+	* Opens a bundle the contact sealed for me. Everything is checked before anything is returned: the
+	* authenticated encryption, the header's shape, that it names this link, this contact and me, the
+	* signature, the body digest and the limits of its kind. `loopback`: see `isHoldUrl`.
+	*/
+	open(bytes, expect = {}) {
+		const now = expect.now ?? Date.now();
+		if (bytes.length > (expect.maxBytes ?? HOLD_LIMITS.maxBundleBytes)) throw new HoldRefusedError("size", "The held item is larger than allowed");
+		if (bytes.length < MAGIC$2.length + 1 + NONCE$2 + 16 + 4 || !MAGIC$2.every((b, i) => bytes[i] === b)) throw new HoldRefusedError("format", "Not a held item");
+		if (bytes[MAGIC$2.length] !== VERSION) throw new HoldRefusedError("format", "Held item from a newer Ghostly");
+		let plain;
+		try {
+			plain = xsalsa20poly1305(this.sealKey, bytes.subarray(MAGIC$2.length + 1, MAGIC$2.length + 1 + NONCE$2)).decrypt(bytes.subarray(MAGIC$2.length + 1 + NONCE$2));
+		} catch {
+			throw new HoldRefusedError("tampered", "The held item was changed or is not for this chat");
+		}
+		if (plain.length < 4) throw new HoldRefusedError("format", "Not a held item");
+		const headerLength = new DataView(plain.buffer, plain.byteOffset, 4).getUint32(0);
+		if (headerLength > 131072 || 4 + headerLength > plain.length) throw new HoldRefusedError("format", "Not a held item");
+		let parsed;
+		try {
+			parsed = JSON.parse(utf8Decode(plain.subarray(4, 4 + headerLength)));
+		} catch {
+			throw new HoldRefusedError("format", "Not a held item");
+		}
+		if (!Array.isArray(parsed) || parsed.length !== 2 || !Array.isArray(parsed[0]) || parsed[0].length !== 13 || typeof parsed[1] !== "string" || !SIG$3.test(parsed[1])) throw new HoldRefusedError("format", "Not a held item");
+		const [fields, signature] = parsed;
+		const [v, from, to, author, recipient, mailbox, seq, id, ts, kind, meta, digest, expires] = fields;
+		if (v !== VERSION || typeof from !== "string" || typeof to !== "string" || typeof author !== "string" || typeof recipient !== "string" || typeof mailbox !== "string" || !MAILBOX.test(mailbox) || !Number.isSafeInteger(seq) || seq < 0 || typeof id !== "string" || !WIRE_ID.test(id) || !Number.isSafeInteger(ts) || ts <= 0 || typeof kind !== "string" || !KINDS$1.includes(kind) || typeof digest !== "string" || !Number.isSafeInteger(expires)) throw new HoldRefusedError("format", "Not a held item");
+		if (from !== this.to || to !== this.from || recipient !== this.me) throw new HoldRefusedError("not-for-me", "The held item is for another chat");
+		if (author !== this.peer) throw new HoldRefusedError("author", "The held item was not signed by this contact");
+		if (expect.mailbox && mailbox !== expect.mailbox) throw new HoldRefusedError("not-for-me", "The held item is from another mailbox");
+		let valid;
+		try {
+			valid = verify(fromBase64Url(signature), utf8Encode(JSON.stringify(["ghostly-hold-bundle", fields])), publicKeyFromZ32(author));
+		} catch {
+			valid = false;
+		}
+		if (!valid) throw new HoldRefusedError("signature", "The held item's signature does not check out");
+		const body = plain.subarray(4 + headerLength);
+		if (bodyDigest(body) !== digest) throw new HoldRefusedError("digest", "The held item's content does not match its header");
+		if (expires <= ts || expires > now + HOLD_LIMITS.ttlMs + HOLD_LIMITS.clockSkewMs) throw new HoldRefusedError("limits", "The held item's lifetime is out of bounds");
+		const header = {
+			v: 1,
+			from,
+			to,
+			author,
+			recipient,
+			mailbox,
+			seq,
+			id,
+			ts,
+			kind,
+			meta,
+			digest,
+			expires
+		};
+		checkKind(header, body, expect.loopback);
+		return {
+			header,
+			body
+		};
+	}
+	/** My pointer, as records to publish under `identity`. Throws when it cannot fit a packet. */
+	pointerRecords(pointer, now = Date.now()) {
+		const body = [
+			VERSION,
+			pointer.rev,
+			pointer.issued,
+			pointer.expires,
+			pointer.manifestUrl,
+			pointer.top,
+			pointer.ack,
+			pointer.count,
+			pointer.bytes,
+			pointer.refused.slice(-32)
+		];
+		const signature = toBase64Url(sign(utf8Encode(JSON.stringify([
+			"ghostly-hold-pointer",
+			this.from,
+			this.to,
+			body
+		])), this.seed));
+		const ttl = Math.min(86400, Math.max(60, Math.ceil((pointer.expires - now) / 1e3)));
+		const records = [{
+			label: "_hold",
+			value: encrypt(JSON.stringify([body, signature]), this.sealKey),
+			ttl
+		}];
+		if (measureRecords(this.identity.pubKeyZ32, records) > 1e3) throw new Error("The storage address is too long for a DHT packet. Use a shorter endpoint or prefix.");
+		return records;
+	}
+	/**
+	* The contact's pointer out of its packet, or null when the packet is not one of its pointers. Its `issued` is the
+	* contact's clock and refuses nothing: an older pointer cannot take a newer one's place because of `rev`. The
+	* manifest's address is held to what an item's is (`isHoldUrl`): it is fetched as soon as the pointer is read.
+	*/
+	readPointer(packet, loopback = false) {
+		if (packet.pubKeyZ32 !== this.peerAddress || measureRecords(packet.pubKeyZ32, packet.records) > 1e3) return null;
+		const records = packet.records.filter((r) => r.label === "_hold");
+		if (records.length !== 1) return null;
+		const plain = tryDecrypt(records[0].value, this.sealKey);
+		if (!plain) return null;
+		let parsed;
+		try {
+			parsed = JSON.parse(plain);
+		} catch {
+			return null;
+		}
+		if (!Array.isArray(parsed) || parsed.length !== 2 || !Array.isArray(parsed[0]) || parsed[0].length !== 9 && parsed[0].length !== 10 || typeof parsed[1] !== "string" || !SIG$3.test(parsed[1])) return null;
+		const [body, signature] = parsed;
+		const [v, rev, issued, expires, manifestUrl, top, ack, count, bytes, refused = []] = body;
+		if (v !== VERSION || ![
+			rev,
+			issued,
+			expires,
+			top,
+			ack,
+			count,
+			bytes
+		].every((n) => Number.isSafeInteger(n) && n >= 0) || manifestUrl !== null && !isHoldUrl(manifestUrl, loopback) || !Array.isArray(refused) || refused.length > 32 || !refused.every((n) => Number.isSafeInteger(n) && n > 0)) return null;
+		try {
+			if (!verify(fromBase64Url(signature), utf8Encode(JSON.stringify([
+				"ghostly-hold-pointer",
+				this.to,
+				this.from,
+				body
+			])), publicKeyFromZ32(this.peer))) return null;
+		} catch {
+			return null;
+		}
+		return {
+			rev,
+			issued,
+			expires,
+			manifestUrl,
+			top,
+			ack,
+			count,
+			bytes,
+			refused
+		};
+	}
+};
+/**
+* A URL a bundle or manifest may be fetched from. The contact chose it and this device fetches it on its own, so it
+* is HTTPS, without a user or password, at a name or a public IPv4 address: never this machine or its network.
+* `loopback` adds plain HTTP to this machine, for a test against a local server; no shipped app passes it.
+*/
+function isHoldUrl(value, loopback = false) {
+	if (typeof value !== "string" || value.length > 2048) return false;
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		return false;
+	}
+	if (url.username || url.password) return false;
+	const host = url.hostname.toLowerCase().replace(/\.$/, "");
+	if (loopback && url.protocol === "http:" && [
+		"localhost",
+		"127.0.0.1",
+		"[::1]"
+	].includes(host)) return true;
+	if (url.protocol !== "https:" || !host || host.startsWith("[") || host === "localhost" || host.endsWith(".localhost")) return false;
+	return !/^\d+\.\d+\.\d+\.\d+$/.test(host) || isPublicAddress(Uint8Array.from(host.split("."), Number));
+}
+/** The limits of each kind, on the way in. */
+function checkKind(header, body, loopback = false) {
+	const bad = (message) => new HoldRefusedError("limits", message);
+	switch (header.kind) {
+		case "text":
+			if (body.length > HOLD_LIMITS.maxTextBytes) throw bad("The held text is too long");
+			try {
+				utf8Decode(body);
+			} catch {
+				throw bad("The held text is not text");
+			}
+			return;
+		case "pay-req":
+			if (body.length > HOLD_LIMITS.maxPaymentRequestBytes) throw bad("The held payment request is too large");
+			return;
+		case "file": {
+			const meta = header.meta;
+			if (!meta || typeof meta !== "object" || typeof meta.name !== "string" || meta.name.length > 255 || typeof meta.mime !== "string" || meta.mime.length > 255 || meta.size !== body.length) throw bad("The held file does not match its description");
+			return;
+		}
+		case "manifest":
+			if (body.length !== 0) throw bad("A manifest carries no body");
+			readManifest(header.meta, loopback);
+			return;
+	}
+}
+/** The entries of a manifest, checked: strictly increasing sequences, bounded sizes, fetchable URLs. */
+function readManifest(meta, loopback = false) {
+	const bad = (message) => new HoldRefusedError("limits", message);
+	const entries = meta?.entries;
+	if (!Array.isArray(entries) || entries.length > HOLD_LIMITS.maxMailboxBundles) throw bad("The manifest lists too many items");
+	let last = 0, total = 0;
+	const out = [];
+	for (const entry of entries) {
+		if (!Array.isArray(entry) || entry.length !== 6) throw bad("The manifest is malformed");
+		const [seq, id, kind, bytes, url, expires] = entry;
+		if (!Number.isSafeInteger(seq) || seq <= last || typeof id !== "string" || !WIRE_ID.test(id) || typeof kind !== "string" || !KINDS$1.includes(kind) || kind === "manifest" || !Number.isSafeInteger(bytes) || bytes < 0 || bytes > HOLD_LIMITS.maxBundleBytes || !isHoldUrl(url, loopback) || !Number.isSafeInteger(expires)) throw bad("The manifest is malformed");
+		last = seq;
+		total += bytes;
+		if (total > HOLD_LIMITS.maxMailboxBytes) throw bad("The manifest lists more than a mailbox may hold");
+		out.push([
+			seq,
+			id,
+			kind,
+			bytes,
+			url,
+			expires
+		]);
+	}
+	return out;
+}
+//#endregion
+//#region ../core/src/pairedSession.ts
+/**
+* What this app does that grants nothing, said outside `capabilities`: apps before 0.5 accept at most 16
+* of those, and a full offer is already there. The field is not in the transcript (an app that does not
+* know it could not sign it), so nothing that needs authenticating may go here; the DTLS binding of the
+* transcript still ties it to this connection. `ping/1`: this app answers `paired-ping`, from the open.
+*/
+var OFFER_EXTENSIONS = ["ping/1"];
+var MAX_HANDSHAKE_BYTES = 4096;
+/**
+* Frames received and not handled yet, at most: their count and their size together. Frames are handled one at a time,
+* each awaited (a group frame is decrypted, checked and stored before the next), and the peer sends at the network's
+* pace. A member back in a group answers a sync with a burst: a commit per epoch, its kept messages, the ones it hands
+* on, edits, reactions. With a bound of 64 frames a phone handling them a few milliseconds each failed its session
+* mid catch-up ("Session receive limit exceeded" then, "Session receive queue full" now, 2026-10-07). The size bound keeps the old worst case in memory
+* (64 frames of 60 KiB); the count only bounds a flood of tiny frames.
+*/
+var SESSION_RECEIVE_PENDING = {
+	frames: 1024,
+	bytes: 3932160
+};
+var KEY = /^[ybndrfg8ejkmcpqxot1uwisza345h769]{52}$/;
+var NONCE$1 = /^[A-Za-z0-9_-]{43}$/;
+var SIG$2 = /^[A-Za-z0-9_-]{86}$/;
+var FINGERPRINT = /^[a-f0-9]{64}$/;
+var isList = (v, maximum = 8) => Array.isArray(v) && v.length > 0 && v.length <= maximum && v.every((x) => typeof x === "string" && /^[a-z0-9/-]{1,40}$/.test(x)) && new Set(v).size === v.length;
+function parseOffer(v) {
+	if (!Array.isArray(v.versions) || v.versions.length === 0 || v.versions.length > 8 || !v.versions.every((n) => Number.isSafeInteger(n) && n > 0) || new Set(v.versions).size !== v.versions.length || !isList(v.transports) || !isList(v.capabilities, 32) || typeof v.key !== "string" || !KEY.test(v.key) || typeof v.nonce !== "string" || !NONCE$1.test(v.nonce)) return null;
+	const extensions = isList(v.extensions, 32) ? v.extensions : void 0;
+	return {
+		t: "pair-offer",
+		versions: v.versions,
+		transports: v.transports,
+		capabilities: v.capabilities,
+		...extensions && { extensions },
+		key: v.key,
+		nonce: v.nonce
+	};
+}
+var offerTuple = (o) => [
+	o.key,
+	o.nonce,
+	o.versions,
+	o.transports,
 	o.capabilities
 ];
 var PairedSession = class {
@@ -14271,6 +14679,8 @@ var TypingReceiver = class {
 * receiver says where it stands (accept from an offset, wait, done, refuse) and the sender goes on from
 * there. Nothing but the offset a receiver confirms moves a sender forward. A receiver may say `pf-accept`
 * again at any time (nothing arrived for a while, or its person asked again): the sender goes on from that offset.
+* What a sender sends again that way is bounded (`FILE_LIMITS.resendBytes`, and the host's `resend`): past it the
+* sender ends the transfer.
 */
 var FILE_LIMITS = {
 	/** Bytes in one `pf-data` frame: a frame stays far below the 60 KiB a session carries. */
@@ -14304,7 +14714,12 @@ var FILE_LIMITS = {
 	/** A sender reads its file this much at a time. */
 	readBytes: 1048576,
 	/** The session refused a data frame (its send budget was full): the sender looks again after this long. */
-	sendRetryMs: 250
+	sendRetryMs: 250,
+	/**
+	* What a sender sends of one file beyond its size (parts sent again after a drop, a restart of the receiver, or a
+	* `pf-accept` from an earlier offset): twice the file's size and this much. Past it the sender ends the transfer (WISP 501 § Resume).
+	*/
+	resendBytes: 268435456
 };
 var ID = /^[A-Za-z0-9_-]{8,64}$/;
 var DIGEST$1 = /^[A-Za-z0-9_-]{43}$/;
@@ -14390,6 +14805,7 @@ var ChatFiles = class {
 			const entry = { record: { ...record } };
 			if (record.direction === "out") entry.out = {
 				next: record.confirmed,
+				sent: 0,
 				generation: 0
 			};
 			else entry.in = {
@@ -14421,6 +14837,10 @@ var ChatFiles = class {
 		const entry = this.entries.get(key(direction, id));
 		return entry ? this.moved(entry) : 0;
 	}
+	/** Bytes of data sent for a file so far, parts sent again included: what sending it cost, whatever the receiver confirmed. */
+	sent(id) {
+		return this.entries.get(key("out", id))?.out?.sent ?? 0;
+	}
 	moved(entry) {
 		return entry.in && !transferEnded(entry.record) ? Math.max(entry.in.stored, entry.record.confirmed) : entry.record.confirmed;
 	}
@@ -14501,6 +14921,7 @@ var ChatFiles = class {
 			},
 			out: {
 				next: 0,
+				sent: 0,
 				generation: 0
 			}
 		};
@@ -14574,6 +14995,15 @@ var ChatFiles = class {
 		const { record } = entry, out = entry.out;
 		return this.attached && record.state === "active" && out.next < record.file.size && out.next - record.confirmed < FILE_LIMITS.windowBytes;
 	}
+	/**
+	* Whether the next `length` bytes go. Within the file's size they always do; past it the receiver is having parts
+	* sent again, which nothing it says bounds, so this side does.
+	*/
+	mayResend(entry, length) {
+		const { record } = entry, size = record.file.size, sent = entry.out.sent + length;
+		if (sent <= size) return true;
+		return sent - size <= 2 * size + FILE_LIMITS.resendBytes && this.host.resend?.({ ...record }, sent) !== false;
+	}
 	async pump(entry) {
 		const out = entry.out;
 		if (out.pumping === out.generation) return;
@@ -14587,6 +15017,14 @@ var ChatFiles = class {
 				const room = this.host.writable?.();
 				if (room) await room;
 				if (generation !== out.generation || !this.shouldPump(entry) || out.next !== offset) break;
+				if (!this.mayResend(entry, chunk.length)) {
+					this.send({
+						t: "pf-abort",
+						id: entry.record.id
+					});
+					this.end(entry, "failed", "Your contact asked for the same part of this file too many times");
+					break;
+				}
 				if (!this.send({
 					t: "pf-data",
 					id: entry.record.id,
@@ -14597,6 +15035,7 @@ var ChatFiles = class {
 					break;
 				}
 				out.next = offset + chunk.length;
+				out.sent += chunk.length;
 			}
 		} catch (error) {
 			if (generation === out.generation) {
@@ -15305,6 +15744,7 @@ var ChatFiles = class {
 		clearTimeout(entry.out.wake);
 		entry.out = {
 			next: 0,
+			sent: 0,
 			generation: entry.out.generation + 1
 		};
 		this.changed(entry);
@@ -16098,7 +16538,7 @@ var GROUP_FILE_LIMITS = {
 	serveAtOnce: 3,
 	/** File announcements a member sends to one group in a minute. */
 	announcePerMinute: 8,
-	/** File announcements taken from one member of a group in `announceWindowMs`; past it, shown as text, unfetched. */
+	/** File announcements of one member of a group fetched by themselves in `announceWindowMs`; past it, kept for a Download. */
 	announceTaken: 30,
 	announceWindowMs: 6e5,
 	/** Holders remembered per file. */
@@ -16569,6 +17009,7 @@ var RTC_UNSTARTED_MS = 6e5;
 var RACE_RETRY_MS = 2e3;
 var DEMOTE_MS = 36e5;
 var AUTO_CONNECT_MAX_RETRY_MS = 18e4;
+var ANSWERS_REFUSED_PAUSE_MS = 2e3;
 /**
 * A first pairing is different: the contact is right there, having just read the invite, so an attempt
 * that did not make it in `PAIRING_ATTEMPT_MS` is given up and the next one starts after `PAIRING_RETRY_MS`
@@ -16844,6 +17285,9 @@ var GhostLink = class {
 	afterRtc;
 	/** When the transports after WebRTC are dialled while its offer is still out (`race`). */
 	raceTimer = null;
+	/** Pauses taken after a run of refused answers since WebRTC last opened, and the one under way (`ANSWERS_REFUSED_PAUSES`). */
+	refusedPauses = 0;
+	refusedPause = null;
 	/** Set while `race` dials: the offer ending meanwhile is followed up by the race. */
 	racing = false;
 	/**
@@ -17052,7 +17496,7 @@ var GhostLink = class {
 			}
 		}) : null;
 		this.streamWasBlocked = this.streamBlocked;
-		this.peerDescriptors = options.native?.peerDescriptors ?? {};
+		this.peerDescriptors = checkedDescriptors(options.native?.peerDescriptors);
 		this.peerTransports = options.native?.peerTransports;
 		this.saidTransports = !!options.packetTransports && !!options.packetTransportsSaid;
 		this.peerPacketSaid = !!options.packetTransports && !!options.native?.peerTransports;
@@ -17068,6 +17512,7 @@ var GhostLink = class {
 			nick: options.nick,
 			lastSeenTimestamp: options.lastSeenTimestamp,
 			pollIntervals: options.pollIntervals,
+			awaitingSince: options.madeAt,
 			getServices: options.getServices,
 			firstPublish: options.firstPublish ?? (this.tracker && options.pairingProgress?.role === "joiner" && options.rtcAvailable !== false || this.resuming ? "after-first-poll" : "at-start"),
 			events: {
@@ -17181,6 +17626,7 @@ var GhostLink = class {
 			offerStanding: (ts) => !this.leaving && !this.stopped && !this.streamBlocked && this.peerOfferTs() === ts,
 			onAnswerReplaced: () => this.redial(),
 			onDirect: (evidence) => events.onDirectEvidence?.(evidence),
+			onAnswersRefused: () => this.answersRefused(),
 			onOpen: (channel) => {
 				if (this.streamBlocked || this.keyStopped) {
 					channel.close();
@@ -17203,7 +17649,10 @@ var GhostLink = class {
 				this.trackDataLink(state);
 				if (this.activeBinding) return;
 				events.onDataLinkState?.(state);
-				if (state === "open") this.afterRtc = void 0;
+				if (state === "open") {
+					this.afterRtc = void 0;
+					this.refusedPauses = 0;
+				}
 				if (state === "offering") {
 					this.offerUnsent = true;
 					this.dialUnseen = false;
@@ -17614,6 +18063,7 @@ var GhostLink = class {
 	async stop(announce = true) {
 		this.stopped = true;
 		this.clearRace();
+		if (this.refusedPause) clearTimeout(this.refusedPause);
 		if (this.retryLook) clearTimeout(this.retryLook);
 		if (this.dhtPinGrace) clearTimeout(this.dhtPinGrace);
 		if (this.waiting?.timer) clearTimeout(this.waiting.timer);
@@ -19018,6 +19468,24 @@ var GhostLink = class {
 		});
 		this.autoDial();
 	}
+	/** WebRTC here refused a run of answers to this side's offers (`ANSWERS_REFUSED_PAUSES`): the next offer goes after a short pause. */
+	answersRefused() {
+		if (this.refusedPause || this.stopped) return;
+		if (this.refusedPauses >= 3) {
+			traceLink(this.myPubKeyZ32, "answers-refused-out", {});
+			this.options.events?.onAnswersRefused?.();
+			return;
+		}
+		const ms = ANSWERS_REFUSED_PAUSE_MS * 2 ** this.refusedPauses++;
+		traceLink(this.myPubKeyZ32, "answers-refused-pause", {
+			pause: this.refusedPauses,
+			ms
+		});
+		this.refusedPause = setTimeout(() => {
+			this.refusedPause = null;
+			this.redial();
+		}, ms);
+	}
 	/**
 	* A failed dial waits `dialWait` before the next, and only a look at the contact's record dials: the next one came at
 	* the link's own pace (30 s in the background), which knows nothing of the backoff. A member let in to a group
@@ -20318,11 +20786,7 @@ var GhostLink = class {
 					}
 					if (frame?.t === "paired-adapters") {
 						if (!frame.descriptors || typeof frame.descriptors !== "object" || JSON.stringify(frame.descriptors).length > 4096) return;
-						const descriptors = {};
-						for (const transport of ["iroh/1", "hyperdht/1"]) {
-							const value = frame.descriptors[transport];
-							if (value) descriptors[transport] = value;
-						}
+						const descriptors = checkedDescriptors(frame.descriptors);
 						const transports = [...this.paired?.peerTransports ?? []];
 						const fallback = this.paired?.peerAllowsFallback ?? false;
 						await this.options.events?.onTransportDiscovery?.(descriptors, transports, fallback);
@@ -20767,772 +21231,501 @@ var GhostLink = class {
 				break;
 			case "pay-res":
 				this.options.events?.onPaymentResult?.({
-					id: frame.id,
-					ok: frame.ok,
-					credited: frame.v,
-					error: frame.err,
-					...frame.c ? { closed: true } : {}
-				});
-				break;
-			case "rst":
-				if (frame.d === "q") this.httpHost?.handleReset(frame);
-				else if (frame.d === "s") this.httpClient?.handleReset(frame);
-				else this.files?.handleReset(frame);
-				break;
-			case "ping": try {
-				this.channel?.send(encodeControl({
-					t: "pong",
-					ts: frame.ts
-				}));
-			} catch {}
-		}
-	}
-};
-//#endregion
-//#region ../core/src/payments.ts
-/**
-* Payments between two linked peers. Ghostly does not move money itself: it
-* carries payment requests, in-band payments such as ecash tokens, and
-* receipts over the data link, and a platform wallet executes them.
-*
-* Vocabulary and identifiers follow Pubky's Paykit so that publishing the same
-* endpoints through Paykit later is a change of transport, not of model:
-* an endpoint is an identifier plus a payload, an amount is decimal text plus
-* an asset.
-*/
-var ENDPOINT = {
-	/** Payload: a BOLT11 invoice. */
-	bolt11: "btc-lightning-bolt11",
-	/**
-	* Payload in a request: JSON `{ "mints": ["https://…"] }`, the mints the
-	* payee accepts ecash from. Payload in a payment: a `cashuB…` token.
-	*/
-	cashu: "cashu",
-	arkade: "btc-arkade/1",
-	/** Second's Ark (Bark). Payload in a request: a payment target; in a payment: a receipt hint. */
-	bark: "btc-bark/1",
-	usdt: "usdt-erc20/1",
-	/** On-chain Bitcoin. Payload in a request: a payment target (a fresh address); in a payment: a receipt hint `{ txid }`. */
-	bitcoin: "btc-onchain/1",
-	/**
-	* Fedimint ecash. Payload in a request: JSON `{ "federations": ["<federation id>", …] }`, the federations the
-	* payee has joined and takes ecash from. Payload in a payment: the notes themselves (out-of-band notes, a
-	* bearer string only the federation that issued them redeems).
-	*/
-	fedimint: "fedimint-ecash/1",
-	/**
-	* Spark, wallet to wallet. Payload in a request: a payment target whose address is a Spark invoice made for
-	* that request; in a payment: a receipt hint `{ id }` (the payer's transfer id).
-	*/
-	spark: "btc-spark/1"
-};
-function cashuRequestPayload(mints) {
-	return JSON.stringify({ mints });
-}
-/** Mints named by a `cashu` endpoint of a request. Anything malformed yields none. */
-function parseCashuRequestPayload(payload) {
-	try {
-		const { mints } = JSON.parse(payload);
-		if (!Array.isArray(mints)) return [];
-		return mints.filter((m) => typeof m === "string" && /^https?:\/\//.test(m)).slice(0, 8);
-	} catch {
-		return [];
-	}
-}
-/** A Fedimint federation id: 32 bytes, lowercase hex. */
-var isFederationId = (value) => typeof value === "string" && /^[0-9a-f]{64}$/.test(value);
-function fedimintRequestPayload(federations) {
-	return JSON.stringify({ federations });
-}
-/** Federations named by a `fedimint-ecash/1` endpoint of a request. Anything malformed yields none. */
-function parseFedimintRequestPayload(payload) {
-	try {
-		const { federations } = JSON.parse(payload);
-		if (!Array.isArray(federations)) return [];
-		return [...new Set(federations.filter(isFederationId))].slice(0, 8);
-	} catch {
-		return [];
-	}
-}
-function findEndpoint(endpoints, identifier) {
-	return endpoints.find(([id]) => id === identifier)?.[1];
-}
-//#endregion
-//#region ../core/src/bolt11.ts
-var CHARSET = "qpzry9x8gf2tvdw0s3jn54khce6mua7l";
-var GENERATOR = [
-	996825010,
-	642813549,
-	513874426,
-	1027748829,
-	705979059
-];
-var NETWORKS = {
-	bc: "bitcoin",
-	tb: "testnet",
-	tbs: "signet",
-	bcrt: "regtest"
-};
-var MSAT_PER_UNIT = {
-	"": 100000000000n,
-	m: 100000000n,
-	u: 100000n,
-	n: 100n
-};
-var TIMESTAMP_WORDS = 7;
-var DEFAULT_EXPIRY = 3600;
-var MAX_LENGTH$1 = 7089;
-function polymod(values) {
-	let chk = 1;
-	for (const value of values) {
-		const top = chk >>> 25;
-		chk = (chk & 33554431) << 5 ^ value;
-		for (let i = 0; i < 5; i++) if (top >>> i & 1) chk ^= GENERATOR[i];
-	}
-	return chk >>> 0;
-}
-function expandHrp(hrp) {
-	const high = [];
-	const low = [];
-	for (const char of hrp) {
-		high.push(char.charCodeAt(0) >>> 5);
-		low.push(char.charCodeAt(0) & 31);
-	}
-	return [
-		...high,
-		0,
-		...low
-	];
-}
-function wordsToInt(words) {
-	return words.reduce((value, word) => value * 32 + word, 0);
-}
-/** Regroups 5-bit words into bytes, dropping the padding bits at the end. */
-function wordsToBytes(words) {
-	const bytes = [];
-	let buffer = 0;
-	let bits = 0;
-	for (const word of words) {
-		buffer = buffer << 5 | word;
-		bits += 5;
-		if (bits >= 8) {
-			bits -= 8;
-			bytes.push(buffer >>> bits & 255);
-		}
-	}
-	return new Uint8Array(bytes);
-}
-function decodeBolt11(text) {
-	const invoice = text.trim().toLowerCase().replace(/^lightning:/, "");
-	if (invoice.length > MAX_LENGTH$1) return null;
-	const separator = invoice.lastIndexOf("1");
-	if (separator < 4) return null;
-	const hrp = invoice.slice(0, separator);
-	const prefix = /^ln(bcrt|tbs|bc|tb)(?:([0-9]+)([munp]?))?$/.exec(hrp);
-	if (!prefix) return null;
-	const words = [];
-	for (const char of invoice.slice(separator + 1)) {
-		const word = CHARSET.indexOf(char);
-		if (word < 0) return null;
-		words.push(word);
-	}
-	if (words.length < 117) return null;
-	if (polymod([...expandHrp(hrp), ...words]) !== 1) return null;
-	let amountMsat = null;
-	if (prefix[2] !== void 0) {
-		const digits = BigInt(prefix[2]);
-		if (prefix[3] === "p") {
-			if (digits % 10n !== 0n) return null;
-			amountMsat = digits / 10n;
-		} else amountMsat = digits * MSAT_PER_UNIT[prefix[3]];
-	}
-	const data = words.slice(0, -110);
-	const createdAt = wordsToInt(data.slice(0, TIMESTAMP_WORDS));
-	let expiry = DEFAULT_EXPIRY;
-	let description;
-	let paymentHash;
-	let descriptionHash;
-	for (let at = TIMESTAMP_WORDS; at + 3 <= data.length;) {
-		const tag = CHARSET[data[at]];
-		const length = data[at + 1] * 32 + data[at + 2];
-		const field = data.slice(at + 3, at + 3 + length);
-		if (field.length < length) return null;
-		at += 3 + length;
-		if (tag === "d") description = new TextDecoder().decode(wordsToBytes(field)).trim() || void 0;
-		else if (tag === "x") expiry = wordsToInt(field);
-		else if (tag === "p" && length === 52) paymentHash = [...wordsToBytes(field)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
-		else if (tag === "h" && length === 52) descriptionHash = [...wordsToBytes(field)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+					id: frame.id,
+					ok: frame.ok,
+					credited: frame.v,
+					error: frame.err,
+					...frame.c ? { closed: true } : {}
+				});
+				break;
+			case "rst":
+				if (frame.d === "q") this.httpHost?.handleReset(frame);
+				else if (frame.d === "s") this.httpClient?.handleReset(frame);
+				else this.files?.handleReset(frame);
+				break;
+			case "ping": try {
+				this.channel?.send(encodeControl({
+					t: "pong",
+					ts: frame.ts
+				}));
+			} catch {}
+		}
 	}
-	return {
-		invoice,
-		network: NETWORKS[prefix[1]],
-		amountMsat,
-		amountSat: amountMsat === null ? null : Number((amountMsat + 999n) / 1000n),
-		createdAt,
-		expiresAt: createdAt + expiry,
-		description,
-		descriptionHash,
-		paymentHash
-	};
-}
-//#endregion
-//#region ../core/src/lnurl.ts
-var LNURL_LIMITS = {
-	timeoutMs: 15e3,
-	maxBytes: 65536,
-	maxRedirects: 5,
-	maxUrlLength: 2048,
-	maxMetadataLength: 8192,
-	maxComment: 2e3
 };
-var ADDRESS = /^([a-z0-9._+-]{1,64})@([a-z0-9-]+(?:\.[a-z0-9-]+)*(?::\d{1,5})?)$/i;
-var LNURL_BECH32 = /^lnurl1[02-9ac-hj-np-z]{6,}$/i;
-var REDIRECTS = [
-	301,
-	302,
-	303,
-	307,
-	308
-];
+//#endregion
+//#region ../core/src/payments.ts
 /**
-* A host that is not on the public internet, as far as its name tells: this machine, a single label, `.local` and its
-* kin, private and reserved IP addresses. (What a public name resolves to is checked where the client resolves names
-* itself, as Ghostly Desktop does.)
+* Payments between two linked peers. Ghostly does not move money itself: it
+* carries payment requests, in-band payments such as ecash tokens, and
+* receipts over the data link, and a platform wallet executes them.
+*
+* Vocabulary and identifiers follow Pubky's Paykit so that publishing the same
+* endpoints through Paykit later is a change of transport, not of model:
+* an endpoint is an identifier plus a payload, an amount is decimal text plus
+* an asset.
 */
-function isLocalHost(hostname) {
-	const host = hostname.toLowerCase().replace(/\.$/, "").replace(/^\[|\]$/g, "");
-	if (!host.includes(".") && !host.includes(":")) return true;
-	if (/(^|\.)(localhost|local|internal|lan|home\.arpa)$/.test(host)) return true;
-	const v4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
-	if (v4) {
-		const [a, b] = [Number(v4[1]), Number(v4[2])];
-		return a === 0 || a === 10 || a === 127 || a >= 224 || a === 169 && b === 254 || a === 172 && b >= 16 && b < 32 || a === 192 && b === 168 || a === 100 && b >= 64 && b < 128 || a === 198 && (b === 18 || b === 19) || a === 192 && b === 0;
-	}
-	if (host.includes(":")) return !/^[23][0-9a-f]{0,3}:/.test(host) || host.includes(".") || /^2001:0?db8:/.test(host);
-	return false;
+var ENDPOINT = {
+	/** Payload: a BOLT11 invoice. */
+	bolt11: "btc-lightning-bolt11",
+	/**
+	* Payload in a request: JSON `{ "mints": ["https://…"] }`, the mints the
+	* payee accepts ecash from. Payload in a payment: a `cashuB…` token.
+	*/
+	cashu: "cashu",
+	arkade: "btc-arkade/1",
+	/** Second's Ark (Bark). Payload in a request: a payment target; in a payment: a receipt hint. */
+	bark: "btc-bark/1",
+	usdt: "usdt-erc20/1",
+	/** On-chain Bitcoin. Payload in a request: a payment target (a fresh address); in a payment: a receipt hint `{ txid }`. */
+	bitcoin: "btc-onchain/1",
+	/**
+	* Fedimint ecash. Payload in a request: JSON `{ "federations": ["<federation id>", …] }`, the federations the
+	* payee has joined and takes ecash from. Payload in a payment: the notes themselves (out-of-band notes, a
+	* bearer string only the federation that issued them redeems).
+	*/
+	fedimint: "fedimint-ecash/1",
+	/**
+	* Spark, wallet to wallet. Payload in a request: a payment target whose address is a Spark invoice made for
+	* that request; in a payment: a receipt hint `{ id }` (the payer's transfer id).
+	*/
+	spark: "btc-spark/1"
+};
+function cashuRequestPayload(mints) {
+	return JSON.stringify({ mints });
 }
-var isLoopback = (hostname) => [
-	"localhost",
-	"127.0.0.1",
-	"[::1]"
-].includes(hostname);
-/** HTTPS, or plain HTTP only for a hidden service or a test server on this machine; never credentials. */
-function acceptUrl(text) {
-	if (text.length > LNURL_LIMITS.maxUrlLength) throw new Error("That LNURL is too long");
-	let url;
+/** Mints named by a `cashu` endpoint of a request. Anything malformed yields none. */
+function parseCashuRequestPayload(payload) {
 	try {
-		url = new URL(text);
+		const { mints } = JSON.parse(payload);
+		if (!Array.isArray(mints)) return [];
+		return mints.filter((m) => typeof m === "string" && /^https?:\/\//.test(m)).slice(0, 8);
 	} catch {
-		throw new Error("That LNURL does not point to a valid address");
-	}
-	const plainAllowed = url.hostname.endsWith(".onion") || isLoopback(url.hostname);
-	if (url.protocol !== "https:" && !(url.protocol === "http:" && plainAllowed)) throw new Error("Lightning addresses and LNURLs must use HTTPS");
-	if (url.username || url.password) throw new Error("That LNURL carries credentials, which is not allowed");
-	return url;
-}
-/** Reads what was pasted as a Lightning address or an LNURL; null when it is neither. Throws when it is one, but a bad one. */
-function parseLightningDestination(input) {
-	const text = input.trim().replace(/^(lightning:|⚡\s*)/i, "").trim();
-	if (!text) return null;
-	if (LNURL_BECH32.test(text)) {
-		let decoded;
-		try {
-			decoded = bech32.decode(text.toLowerCase(), LNURL_LIMITS.maxUrlLength);
-		} catch {
-			throw new Error("That LNURL is not valid");
-		}
-		const url = acceptUrl(new TextDecoder().decode(bech32.fromWords(decoded.words)));
-		return {
-			kind: "lnurl",
-			text: text.toLowerCase(),
-			url: url.href,
-			domain: url.host
-		};
-	}
-	if (/^lnurlp:\/\//i.test(text)) {
-		const bare = text.slice(9);
-		const host = bare.split(/[/?#]/)[0].toLowerCase();
-		const url = acceptUrl(`${host.endsWith(".onion") || isLoopback(host.replace(/:\d+$/, "")) ? "http" : "https"}://${bare}`);
-		return {
-			kind: "lnurl",
-			text: `lnurlp://${bare}`,
-			url: url.href,
-			domain: url.host
-		};
-	}
-	const address = ADDRESS.exec(text);
-	if (!address) return null;
-	const name = address[1].toLowerCase(), domain = address[2].toLowerCase();
-	const hostname = domain.replace(/:\d+$/, "");
-	if (!hostname.includes(".") && !isLoopback(hostname)) return null;
-	const url = acceptUrl(`${hostname.endsWith(".onion") || isLoopback(hostname) ? "http" : "https"}://${domain}/.well-known/lnurlp/${name}`);
-	return {
-		kind: "address",
-		text: `${name}@${domain}`,
-		url: url.href,
-		domain: url.host,
-		name
-	};
-}
-var hex$1 = (bytes) => Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
-var reason = (value) => typeof value === "string" ? value.replace(/\s+/g, " ").slice(0, 200) : "";
-var isRecord = (value) => !!value && typeof value === "object" && !Array.isArray(value);
-async function readBounded(response, maxBytes) {
-	const reader = response.body?.getReader?.();
-	if (!reader) {
-		const text = await response.text();
-		if (text.length > maxBytes) throw new Error("The server's answer is too large");
-		return text;
-	}
-	const chunks = [];
-	let size = 0;
-	for (;;) {
-		const { done, value } = await reader.read();
-		if (done) break;
-		size += value.byteLength;
-		if (size > maxBytes) {
-			await reader.cancel().catch(() => {});
-			throw new Error("The server's answer is too large");
-		}
-		chunks.push(value);
-	}
-	const all = new Uint8Array(size);
-	let at = 0;
-	for (const chunk of chunks) {
-		all.set(chunk, at);
-		at += chunk.byteLength;
+		return [];
 	}
-	return new TextDecoder().decode(all);
 }
-/** One GET to an LNURL service (and to each checked redirect of it): bounded in time and size, no credentials, no referrer, and the answer must be JSON. */
-async function fetchLnurlJson(url, options = {}) {
-	const target = acceptUrl(url);
-	const doFetch = options.fetch ?? globalThis.fetch;
-	if (!doFetch) throw new Error("No way to reach the network here");
-	const controller = new AbortController();
-	const timer = setTimeout(() => controller.abort(/* @__PURE__ */ new Error("The server took too long to answer")), options.timeoutMs ?? LNURL_LIMITS.timeoutMs);
-	const onAbort = () => controller.abort(options.signal?.reason);
-	options.signal?.addEventListener("abort", onAbort, { once: true });
-	try {
-		let response;
-		for (let at = target, hops = 0;; hops++) {
-			try {
-				response = await doFetch(at.href, {
-					signal: controller.signal,
-					headers: { accept: "application/json" },
-					credentials: "omit",
-					referrerPolicy: "no-referrer",
-					redirect: "manual"
-				});
-			} catch {
-				if (controller.signal.aborted) throw controller.signal.reason instanceof Error ? controller.signal.reason : /* @__PURE__ */ new Error("The request was cancelled");
-				throw engineError("lnurlUnreachable", { host: target.host });
-			}
-			if (response.url) acceptUrl(response.url);
-			if (response.type === "opaqueredirect") throw new Error(`${target.host} redirects to another address, which cannot be checked here`);
-			const location = REDIRECTS.includes(response.status) ? response.headers.get("location") : null;
-			if (!location) break;
-			await response.body?.cancel().catch(() => {});
-			if (hops >= LNURL_LIMITS.maxRedirects) throw new Error(`${target.host} redirects too many times`);
-			let next;
-			try {
-				next = new URL(location, at);
-			} catch {
-				throw new Error(`${target.host} redirects to an invalid address`);
-			}
-			next = acceptUrl(next.href);
-			if (next.host !== at.host) {
-				if (next.protocol !== "https:") throw new Error("Lightning addresses and LNURLs must use HTTPS");
-				if (isLocalHost(next.hostname)) throw new Error(`${target.host} redirects to a local address`);
-			}
-			at = next;
-		}
-		const text = await readBounded(response, options.maxBytes ?? LNURL_LIMITS.maxBytes);
-		let body;
-		try {
-			body = JSON.parse(text);
-		} catch {
-			throw new Error(`${target.host} did not answer with JSON${response.ok ? "" : ` (HTTP ${response.status})`}`);
-		}
-		if (isRecord(body) && body.status === "ERROR") throw new Error(`${target.host} refused: ${reason(body.reason) || "no reason given"}`);
-		if (!response.ok) throw new Error(`${target.host} answered HTTP ${response.status}`);
-		return body;
-	} finally {
-		clearTimeout(timer);
-		options.signal?.removeEventListener("abort", onAbort);
-	}
+/** A Fedimint federation id: 32 bytes, lowercase hex. */
+var isFederationId = (value) => typeof value === "string" && /^[0-9a-f]{64}$/.test(value);
+function fedimintRequestPayload(federations) {
+	return JSON.stringify({ federations });
 }
-/** Checks a service's `payRequest` answer (LUD-06), and reads what a person needs to see of it. */
-function parsePayParams(body, destination) {
-	if (!isRecord(body)) throw new Error(`${destination.domain} did not answer with a pay request`);
-	if (body.tag !== "payRequest") throw new Error(`${destination.domain} answered with something other than a pay request${typeof body.tag === "string" ? ` (${reason(body.tag)})` : ""}`);
-	if (typeof body.callback !== "string") throw new Error("The pay request has no callback");
-	const callback = acceptUrl(body.callback);
-	const { minSendable, maxSendable, metadata, commentAllowed } = body;
-	if (!Number.isSafeInteger(minSendable) || !Number.isSafeInteger(maxSendable) || minSendable <= 0 || maxSendable < minSendable) throw new Error("The pay request has invalid amount limits");
-	const minSat = Math.ceil(minSendable / 1e3), maxSat = Math.floor(maxSendable / 1e3);
-	if (minSat > maxSat) throw new Error("The pay request only takes fractions of a sat, which cannot be paid here");
-	if (typeof metadata !== "string" || metadata.length > LNURL_LIMITS.maxMetadataLength) throw new Error("The pay request has no usable metadata");
-	let entries;
+/** Federations named by a `fedimint-ecash/1` endpoint of a request. Anything malformed yields none. */
+function parseFedimintRequestPayload(payload) {
 	try {
-		entries = JSON.parse(metadata);
+		const { federations } = JSON.parse(payload);
+		if (!Array.isArray(federations)) return [];
+		return [...new Set(federations.filter(isFederationId))].slice(0, 8);
 	} catch {
-		throw new Error("The pay request's metadata is not JSON");
+		return [];
 	}
-	if (!Array.isArray(entries) || !entries.every((e) => Array.isArray(e) && typeof e[0] === "string")) throw new Error("The pay request's metadata is malformed");
-	const entry = (type) => entries.find((e) => e[0] === type)?.[1];
-	const description = entry("text/plain");
-	if (typeof description !== "string") throw new Error("The pay request says nothing about what it is for (no text/plain metadata)");
-	const identifier = [entry("text/identifier"), entry("text/email")].find((v) => typeof v === "string")?.toLowerCase();
-	if (destination.kind === "address" && identifier && identifier !== destination.text) throw new Error(`${destination.domain} answered for ${identifier}, not ${destination.text}`);
-	const comment = Number.isSafeInteger(commentAllowed) && commentAllowed > 0 ? Math.min(commentAllowed, LNURL_LIMITS.maxComment) : 0;
-	return {
-		destination,
-		callback: callback.href,
-		callbackDomain: callback.host,
-		minSendable,
-		maxSendable,
-		minSat,
-		maxSat,
-		metadata,
-		descriptionHash: hex$1(sha256(new TextEncoder().encode(metadata))),
-		description: description.slice(0, 280),
-		identifier,
-		commentAllowed: comment
-	};
 }
-/** Where to ask for the invoice of `amountSat` (and a comment, LUD-12). Throws when the amount or comment is not allowed. */
-function invoiceCallbackUrl(params, amountSat, comment) {
-	if (!Number.isSafeInteger(amountSat) || amountSat <= 0) throw new Error("Enter a whole number of sats");
-	if (amountSat < params.minSat || amountSat > params.maxSat) throw params.minSat === params.maxSat ? engineError("lnurlExactly", {
-		domain: params.destination.domain,
-		amount: params.minSat.toLocaleString()
-	}) : engineError("lnurlRange", {
-		domain: params.destination.domain,
-		min: params.minSat.toLocaleString(),
-		max: params.maxSat.toLocaleString()
-	});
-	const url = new URL(params.callback);
-	url.searchParams.set("amount", String(amountSat * 1e3));
-	const text = comment?.trim();
-	if (text) {
-		if (!params.commentAllowed) throw new Error(`${params.destination.domain} does not take a comment`);
-		if (text.length > params.commentAllowed) throw new Error(`The comment can be at most ${params.commentAllowed} characters`);
-		url.searchParams.set("comment", text);
+function findEndpoint(endpoints, identifier) {
+	return endpoints.find(([id]) => id === identifier)?.[1];
+}
+//#endregion
+//#region ../core/src/bolt11.ts
+var CHARSET = "qpzry9x8gf2tvdw0s3jn54khce6mua7l";
+var GENERATOR = [
+	996825010,
+	642813549,
+	513874426,
+	1027748829,
+	705979059
+];
+var NETWORKS = {
+	bc: "bitcoin",
+	tb: "testnet",
+	tbs: "signet",
+	bcrt: "regtest"
+};
+var MSAT_PER_UNIT = {
+	"": 100000000000n,
+	m: 100000000n,
+	u: 100000n,
+	n: 100n
+};
+var TIMESTAMP_WORDS = 7;
+var DEFAULT_EXPIRY = 3600;
+var MAX_LENGTH$1 = 7089;
+function polymod(values) {
+	let chk = 1;
+	for (const value of values) {
+		const top = chk >>> 25;
+		chk = (chk & 33554431) << 5 ^ value;
+		for (let i = 0; i < 5; i++) if (top >>> i & 1) chk ^= GENERATOR[i];
 	}
-	return url.href;
+	return chk >>> 0;
 }
-/**
-* Checks the invoice a service answered with (LUD-06): the amount asked, a payment hash, not expired, and
-* a commitment to the metadata the person was shown: the `h` tag is its sha256, or the invoice carries the
-* metadata itself as its description (the same commitment, unhashed).
-*/
-function parseInvoiceCallback(body, params, amountSat) {
-	if (!isRecord(body) || typeof body.pr !== "string") throw new Error(`${params.callbackDomain} did not answer with an invoice`);
-	const invoice = decodeBolt11(body.pr);
-	if (!invoice) throw new Error(`${params.callbackDomain} answered with an invoice that does not decode`);
-	if (invoice.amountMsat !== BigInt(amountSat) * 1000n) throw new Error(`The invoice asks for ${invoice.amountSat === null ? "any amount" : `${invoice.amountSat.toLocaleString()} sats`}, not the ${amountSat.toLocaleString()} sats you chose`);
-	if (!invoice.paymentHash) throw new Error("The invoice has no payment hash");
-	if (invoice.descriptionHash !== params.descriptionHash && invoice.description !== params.metadata) throw new Error("The invoice does not commit to what the service said the payment is for");
-	if (invoice.expiresAt * 1e3 < Date.now()) throw new Error("The invoice the service answered with has already expired");
-	let successAction;
-	const action = body.successAction;
-	if (isRecord(action)) {
-		if (action.tag === "message" && typeof action.message === "string") successAction = {
-			tag: "message",
-			message: reason(action.message)
-		};
-		else if (action.tag === "url" && typeof action.url === "string" && /^https:\/\//i.test(action.url) && action.url.length <= LNURL_LIMITS.maxUrlLength) successAction = {
-			tag: "url",
-			description: reason(action.description),
-			url: action.url
-		};
+function expandHrp(hrp) {
+	const high = [];
+	const low = [];
+	for (const char of hrp) {
+		high.push(char.charCodeAt(0) >>> 5);
+		low.push(char.charCodeAt(0) & 31);
+	}
+	return [
+		...high,
+		0,
+		...low
+	];
+}
+function wordsToInt(words) {
+	return words.reduce((value, word) => value * 32 + word, 0);
+}
+/** Regroups 5-bit words into bytes, dropping the padding bits at the end. */
+function wordsToBytes(words) {
+	const bytes = [];
+	let buffer = 0;
+	let bits = 0;
+	for (const word of words) {
+		buffer = buffer << 5 | word;
+		bits += 5;
+		if (bits >= 8) {
+			bits -= 8;
+			bytes.push(buffer >>> bits & 255);
+		}
+	}
+	return new Uint8Array(bytes);
+}
+function decodeBolt11(text) {
+	const invoice = text.trim().toLowerCase().replace(/^lightning:/, "");
+	if (invoice.length > MAX_LENGTH$1) return null;
+	const separator = invoice.lastIndexOf("1");
+	if (separator < 4) return null;
+	const hrp = invoice.slice(0, separator);
+	const prefix = /^ln(bcrt|tbs|bc|tb)(?:([0-9]+)([munp]?))?$/.exec(hrp);
+	if (!prefix) return null;
+	const words = [];
+	for (const char of invoice.slice(separator + 1)) {
+		const word = CHARSET.indexOf(char);
+		if (word < 0) return null;
+		words.push(word);
+	}
+	if (words.length < 117) return null;
+	if (polymod([...expandHrp(hrp), ...words]) !== 1) return null;
+	let amountMsat = null;
+	if (prefix[2] !== void 0) {
+		const digits = BigInt(prefix[2]);
+		if (prefix[3] === "p") {
+			if (digits % 10n !== 0n) return null;
+			amountMsat = digits / 10n;
+		} else amountMsat = digits * MSAT_PER_UNIT[prefix[3]];
+	}
+	const data = words.slice(0, -110);
+	const createdAt = wordsToInt(data.slice(0, TIMESTAMP_WORDS));
+	let expiry = DEFAULT_EXPIRY;
+	let description;
+	let paymentHash;
+	let descriptionHash;
+	for (let at = TIMESTAMP_WORDS; at + 3 <= data.length;) {
+		const tag = CHARSET[data[at]];
+		const length = data[at + 1] * 32 + data[at + 2];
+		const field = data.slice(at + 3, at + 3 + length);
+		if (field.length < length) return null;
+		at += 3 + length;
+		if (tag === "d") description = new TextDecoder().decode(wordsToBytes(field)).trim() || void 0;
+		else if (tag === "x") expiry = wordsToInt(field);
+		else if (tag === "p" && length === 52) paymentHash = [...wordsToBytes(field)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+		else if (tag === "h" && length === 52) descriptionHash = [...wordsToBytes(field)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
 	}
 	return {
 		invoice,
-		successAction
+		network: NETWORKS[prefix[1]],
+		amountMsat,
+		amountSat: amountMsat === null ? null : Number((amountMsat + 999n) / 1000n),
+		createdAt,
+		expiresAt: createdAt + expiry,
+		description,
+		descriptionHash,
+		paymentHash
 	};
 }
-/** Fetches and checks what a Lightning address or LNURL asks for. The service's domain learns of it. */
-async function resolveLightningDestination(text, options = {}) {
-	const destination = parseLightningDestination(text);
-	if (!destination) throw new Error("That is not a Lightning address or an LNURL");
-	return parsePayParams(await fetchLnurlJson(destination.url, options), destination);
-}
-/** Asks the service for an invoice of `amountSat`, and checks it before it is handed to any wallet. */
-async function requestLnurlInvoice(params, amountSat, comment, options = {}) {
-	return parseInvoiceCallback(await fetchLnurlJson(invoiceCallbackUrl(params, amountSat, comment), options), params, amountSat);
-}
 //#endregion
-//#region ../core/src/domainProofs.ts
-var DNS_LABEL = "_ghostly";
-var WELL_KNOWN_PATH = "/.well-known/ghostly.json";
-var NIP05_PATH = "/.well-known/nostr.json?name=_";
-/** Everything read from a domain is bounded; these match the fetch limits. */
-var DOMAIN_FILE_MAX_BYTES = 16384;
-var z32 = /^[ybndrfg8ejkmcpqxot1uwisza345h769]{52}$/;
-var hex64 = /^[a-f0-9]{64}$/;
-/** Names that never resolve publicly (RFC 6761, 6762, 7686, 8375, 9476) or that
-* only ever mean a private network. A proof for them could only point inward. */
-var SPECIAL_USE = [
-	"localhost",
-	"local",
-	"internal",
-	"lan",
-	"home",
-	"corp",
-	"intranet",
-	"private",
-	"test",
-	"example",
-	"invalid",
-	"onion",
-	"alt",
-	"arpa"
+//#region ../core/src/lnurl.ts
+var LNURL_LIMITS = {
+	timeoutMs: 15e3,
+	maxBytes: 65536,
+	maxRedirects: 5,
+	maxUrlLength: 2048,
+	maxMetadataLength: 8192,
+	maxComment: 2e3
+};
+var ADDRESS = /^([a-z0-9._+-]{1,64})@([a-z0-9-]+(?:\.[a-z0-9-]+)*(?::\d{1,5})?)$/i;
+var LNURL_BECH32 = /^lnurl1[02-9ac-hj-np-z]{6,}$/i;
+var REDIRECTS = [
+	301,
+	302,
+	303,
+	307,
+	308
 ];
 /**
-* Normalizes what a person typed ("Example.COM.", "https://example.com/") into
-* a lowercase ASCII host name, or throws with a message fit for the UI.
-* Internationalized names become punycode (xn--), the form DNS carries.
+* A host that is not on the public internet, as far as its name tells: this machine, a single label, `.local` and its
+* kin, private and reserved IP addresses. (What a public name resolves to is checked where the client resolves names
+* itself, as Ghostly Desktop does.)
 */
-function normalizeDomain(input) {
-	if (typeof input !== "string") throw new Error("Enter a domain name, like example.com");
-	let value = input.trim();
-	if (!value || value.length > 300) throw new Error("Enter a domain name, like example.com");
-	if (/^[a-z][a-z0-9+.-]*:\/\//i.test(value)) {
-		let url;
-		try {
-			url = new URL(value);
-		} catch {
-			throw new Error("Enter a domain name, like example.com");
-		}
-		if (url.protocol !== "https:" || url.username || url.password || url.port || url.pathname !== "/" && url.pathname !== "" || url.search || url.hash) throw new Error("Enter only the domain name, without a path or port");
-		value = url.hostname;
-	} else {
-		if (/[/:@?#\s\\]/.test(value)) throw new Error("Enter only the domain name, without a path or port");
-		try {
-			value = new URL(`https://${value}`).hostname;
-		} catch {
-			throw new Error("That is not a valid domain name");
-		}
+function isLocalHost(hostname) {
+	const host = hostname.toLowerCase().replace(/\.$/, "").replace(/^\[|\]$/g, "");
+	if (!host.includes(".") && !host.includes(":")) return true;
+	if (/(^|\.)(localhost|local|internal|lan|home\.arpa)$/.test(host)) return true;
+	const v4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+	if (v4) {
+		const [a, b] = [Number(v4[1]), Number(v4[2])];
+		return a === 0 || a === 10 || a === 127 || a >= 224 || a === 169 && b === 254 || a === 172 && b >= 16 && b < 32 || a === 192 && b === 168 || a === 100 && b >= 64 && b < 128 || a === 198 && (b === 18 || b === 19) || a === 192 && b === 0;
 	}
-	value = value.toLowerCase().replace(/\.$/, "");
-	if (value.length > 244) throw new Error("That domain name is too long");
-	const labels = value.split(".");
-	if (labels.length < 2) throw new Error("Use a full domain name, like example.com");
-	for (const label of labels) if (!/^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/.test(label)) throw new Error("That is not a valid domain name");
-	const tld = labels[labels.length - 1];
-	if (/^[0-9]+$/.test(tld) || /^\[/.test(value)) throw new Error("Use a domain name, not an IP address");
-	if (SPECIAL_USE.includes(tld) || labels.length >= 2 && labels.slice(-2).join(".") === "home.arpa") throw new Error("That name only works on private networks");
-	return value;
+	if (host.includes(":")) return !/^[23][0-9a-f]{0,3}:/.test(host) || host.includes(".") || /^2001:0?db8:/.test(host);
+	return false;
 }
-var dnsProofName = (domain) => `${DNS_LABEL}.${normalizeDomain(domain)}`;
-var wellKnownUrl = (domain, method = "https") => `https://${normalizeDomain(domain)}${method === "nip05" ? NIP05_PATH : WELL_KNOWN_PATH}`;
-function validDomainRecord(r) {
-	if (!r || typeof r.key !== "string" || typeof r.proof !== "string" || !z32.test(r.key) || !hex64.test(r.proof)) return false;
+var isLoopback = (hostname) => [
+	"localhost",
+	"127.0.0.1",
+	"[::1]"
+].includes(hostname);
+/** HTTPS, or plain HTTP only for a hidden service or a test server on this machine; never credentials. */
+function acceptUrl(text) {
+	if (text.length > LNURL_LIMITS.maxUrlLength) throw new Error("That LNURL is too long");
+	let url;
 	try {
-		return toZ32(fromZ32(r.key)) === r.key;
+		url = new URL(text);
 	} catch {
-		return false;
+		throw new Error("That LNURL does not point to a valid address");
 	}
+	const plainAllowed = url.hostname.endsWith(".onion") || isLoopback(url.hostname);
+	if (url.protocol !== "https:" && !(url.protocol === "http:" && plainAllowed)) throw new Error("Lightning addresses and LNURLs must use HTTPS");
+	if (url.username || url.password) throw new Error("That LNURL carries credentials, which is not allowed");
+	return url;
 }
-/** The TXT record value, in the `tag=value; …` style people know from DKIM. */
-function domainTxtRecord(r) {
-	if (!validDomainRecord(r)) throw new Error("Invalid domain record");
-	return `v=ghostly1; key=${r.key}; proof=${r.proof}`;
-}
-/** Parses one TXT string. Undefined for anything that is not ours or not exactly
-* well-formed; unknown extra tags are ignored for forward compatibility. */
-function parseDomainTxt(value) {
-	if (typeof value !== "string" || utf8Encode(value).length > 1024) return;
-	const tags = /* @__PURE__ */ new Map();
-	const parts = value.split(";").map((p) => p.trim()).filter(Boolean);
-	for (const part of parts) {
-		const eq = part.indexOf("=");
-		if (eq < 1) return;
-		const name = part.slice(0, eq).trim().toLowerCase();
-		if (tags.has(name)) return;
-		tags.set(name, part.slice(eq + 1).trim());
+/** Reads what was pasted as a Lightning address or an LNURL; null when it is neither. Throws when it is one, but a bad one. */
+function parseLightningDestination(input) {
+	const text = input.trim().replace(/^(lightning:|⚡\s*)/i, "").trim();
+	if (!text) return null;
+	if (LNURL_BECH32.test(text)) {
+		let decoded;
+		try {
+			decoded = bech32.decode(text.toLowerCase(), LNURL_LIMITS.maxUrlLength);
+		} catch {
+			throw new Error("That LNURL is not valid");
+		}
+		const url = acceptUrl(new TextDecoder().decode(bech32.fromWords(decoded.words)));
+		return {
+			kind: "lnurl",
+			text: text.toLowerCase(),
+			url: url.href,
+			domain: url.host
+		};
 	}
-	if (!parts[0]?.toLowerCase().startsWith("v=") || tags.get("v") !== "ghostly1") return;
-	const r = {
-		key: tags.get("key"),
-		proof: tags.get("proof")
+	if (/^lnurlp:\/\//i.test(text)) {
+		const bare = text.slice(9);
+		const host = bare.split(/[/?#]/)[0].toLowerCase();
+		const url = acceptUrl(`${host.endsWith(".onion") || isLoopback(host.replace(/:\d+$/, "")) ? "http" : "https"}://${bare}`);
+		return {
+			kind: "lnurl",
+			text: `lnurlp://${bare}`,
+			url: url.href,
+			domain: url.host
+		};
+	}
+	const address = ADDRESS.exec(text);
+	if (!address) return null;
+	const name = address[1].toLowerCase(), domain = address[2].toLowerCase();
+	const hostname = domain.replace(/:\d+$/, "");
+	if (!hostname.includes(".") && !isLoopback(hostname)) return null;
+	const url = acceptUrl(`${hostname.endsWith(".onion") || isLoopback(hostname) ? "http" : "https"}://${domain}/.well-known/lnurlp/${name}`);
+	return {
+		kind: "address",
+		text: `${name}@${domain}`,
+		url: url.href,
+		domain: url.host,
+		name
 	};
-	return validDomainRecord(r) ? r : void 0;
 }
-var addRecord = (list, r) => {
-	if (!list.some((x) => x.key === r.key && x.proof === r.proof)) list.push(r);
-};
-/** All records among the TXT strings of `_ghostly.<domain>`; other strings are skipped. */
-function recordsFromTxt(values) {
-	const out = [];
-	for (const value of values.slice(0, 32)) {
-		const r = parseDomainTxt(value);
-		if (r) addRecord(out, r);
+var hex$1 = (bytes) => Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+var reason = (value) => typeof value === "string" ? value.replace(/\s+/g, " ").slice(0, 200) : "";
+var isRecord = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+async function readBounded(response, maxBytes) {
+	const reader = response.body?.getReader?.();
+	if (!reader) {
+		const text = await response.text();
+		if (text.length > maxBytes) throw new Error("The server's answer is too large");
+		return text;
 	}
-	return out.slice(0, 8);
-}
-/** The body of `/.well-known/ghostly.json`. */
-function domainWellKnownFile(records) {
-	if (!records.length || records.length > 8 || !records.every(validDomainRecord)) throw new Error("Invalid domain records");
-	return JSON.stringify({
-		ghostly: 1,
-		proofs: records.map((r) => ({
-			key: r.key,
-			proof: r.proof
-		}))
-	}, null, 2) + "\n";
-}
-function parseJson(text) {
-	if (typeof text !== "string" || utf8Encode(text).length > 16384) throw new Error("File too large");
-	return JSON.parse(text);
-}
-/** Records from `ghostly.json`. Throws on a malformed file; [] when it names none. */
-function recordsFromWellKnown(text) {
-	const body = parseJson(text);
-	if (!body || typeof body !== "object" || Array.isArray(body) || body.ghostly !== 1 || !Array.isArray(body.proofs)) throw new Error("Not a Ghostly domain file");
-	const out = [];
-	for (const entry of body.proofs.slice(0, 32)) {
-		if (!entry || typeof entry !== "object") continue;
-		const r = {
-			key: entry.key,
-			proof: entry.proof
-		};
-		if (validDomainRecord(r)) addRecord(out, r);
+	const chunks = [];
+	let size = 0;
+	for (;;) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		size += value.byteLength;
+		if (size > maxBytes) {
+			await reader.cancel().catch(() => {});
+			throw new Error("The server's answer is too large");
+		}
+		chunks.push(value);
 	}
-	return out.slice(0, 8);
-}
-/** NIP-05: only the root name `_` speaks for the domain itself. Undefined when absent. */
-function nip05RootKey(text) {
-	const body = parseJson(text);
-	if (!body || typeof body !== "object" || !body.names || typeof body.names !== "object" || Array.isArray(body.names)) throw new Error("Not a NIP-05 file");
-	const root = body.names["_"];
-	return typeof root === "string" && hex64.test(root) ? root : void 0;
+	const all = new Uint8Array(size);
+	let at = 0;
+	for (const chunk of chunks) {
+		all.set(chunk, at);
+		at += chunk.byteLength;
+	}
+	return new TextDecoder().decode(all);
 }
-var recordsName = (records, r) => records.some((x) => x.key === r.key && x.proof === r.proof);
-var DNS_TYPE = {
-	A: 1,
-	CNAME: 5,
-	TXT: 16,
-	AAAA: 28
-};
-/** A recursive query for one name and type. ID 0, as RFC 8484 recommends for caching;
-* the AD bit asks the resolver to report DNSSEC validation (RFC 6840 §5.7). */
-function encodeDnsQuery(name, type) {
-	const labels = name.replace(/\.$/, "").split(".");
-	const parts = [Uint8Array.of(0, 0, 1, 32, 0, 1, 0, 0, 0, 0, 0, 0)];
-	for (const label of labels) {
-		const bytes = utf8Encode(label);
-		if (!bytes.length || bytes.length > 63) throw new Error("Invalid DNS name");
-		parts.push(Uint8Array.of(bytes.length), bytes);
+/** One GET to an LNURL service (and to each checked redirect of it): bounded in time and size, no credentials, no referrer, and the answer must be JSON. */
+async function fetchLnurlJson(url, options = {}) {
+	const target = acceptUrl(url);
+	const doFetch = options.fetch ?? globalThis.fetch;
+	if (!doFetch) throw new Error("No way to reach the network here");
+	const controller = new AbortController();
+	const timer = setTimeout(() => controller.abort(/* @__PURE__ */ new Error("The server took too long to answer")), options.timeoutMs ?? LNURL_LIMITS.timeoutMs);
+	const onAbort = () => controller.abort(options.signal?.reason);
+	options.signal?.addEventListener("abort", onAbort, { once: true });
+	try {
+		let response;
+		for (let at = target, hops = 0;; hops++) {
+			try {
+				response = await doFetch(at.href, {
+					signal: controller.signal,
+					headers: { accept: "application/json" },
+					credentials: "omit",
+					referrerPolicy: "no-referrer",
+					redirect: "manual"
+				});
+			} catch {
+				if (controller.signal.aborted) throw controller.signal.reason instanceof Error ? controller.signal.reason : /* @__PURE__ */ new Error("The request was cancelled");
+				throw engineError("lnurlUnreachable", { host: target.host });
+			}
+			if (response.url) acceptUrl(response.url);
+			if (response.type === "opaqueredirect") throw new Error(`${target.host} redirects to another address, which cannot be checked here`);
+			const location = REDIRECTS.includes(response.status) ? response.headers.get("location") : null;
+			if (!location) break;
+			await response.body?.cancel().catch(() => {});
+			if (hops >= LNURL_LIMITS.maxRedirects) throw new Error(`${target.host} redirects too many times`);
+			let next;
+			try {
+				next = new URL(location, at);
+			} catch {
+				throw new Error(`${target.host} redirects to an invalid address`);
+			}
+			next = acceptUrl(next.href);
+			if (next.host !== at.host) {
+				if (next.protocol !== "https:") throw new Error("Lightning addresses and LNURLs must use HTTPS");
+				if (isLocalHost(next.hostname)) throw new Error(`${target.host} redirects to a local address`);
+			}
+			at = next;
+		}
+		const text = await readBounded(response, options.maxBytes ?? LNURL_LIMITS.maxBytes);
+		let body;
+		try {
+			body = JSON.parse(text);
+		} catch {
+			throw new Error(`${target.host} did not answer with JSON${response.ok ? "" : ` (HTTP ${response.status})`}`);
+		}
+		if (isRecord(body) && body.status === "ERROR") throw new Error(`${target.host} refused: ${reason(body.reason) || "no reason given"}`);
+		if (!response.ok) throw new Error(`${target.host} answered HTTP ${response.status}`);
+		return body;
+	} finally {
+		clearTimeout(timer);
+		options.signal?.removeEventListener("abort", onAbort);
 	}
-	const code = DNS_TYPE[type];
-	parts.push(Uint8Array.of(0, code >> 8, code & 255, 0, 1));
-	return concatBytes$1(...parts);
 }
-function readName(data, start) {
-	const labels = [];
-	let pos = start, next = -1, jumps = 0, length = 0;
-	for (;;) {
-		if (pos >= data.length) throw new Error("DNS name out of bounds");
-		const len = data[pos];
-		if ((len & 192) === 192) {
-			if (pos + 1 >= data.length) throw new Error("DNS pointer out of bounds");
-			if (next < 0) next = pos + 2;
-			pos = (len & 63) << 8 | data[pos + 1];
-			if (++jumps > 32) throw new Error("DNS name loops");
-			continue;
-		}
-		if (len & 192) throw new Error("Unsupported DNS label");
-		pos += 1;
-		if (len === 0) break;
-		if (pos + len > data.length) throw new Error("DNS label out of bounds");
-		length += len + 1;
-		if (length > 255) throw new Error("DNS name too long");
-		labels.push(utf8Decode(data.subarray(pos, pos + len)).toLowerCase());
-		pos += len;
+/** Checks a service's `payRequest` answer (LUD-06), and reads what a person needs to see of it. */
+function parsePayParams(body, destination) {
+	if (!isRecord(body)) throw new Error(`${destination.domain} did not answer with a pay request`);
+	if (body.tag !== "payRequest") throw new Error(`${destination.domain} answered with something other than a pay request${typeof body.tag === "string" ? ` (${reason(body.tag)})` : ""}`);
+	if (typeof body.callback !== "string") throw new Error("The pay request has no callback");
+	const callback = acceptUrl(body.callback);
+	const { minSendable, maxSendable, metadata, commentAllowed } = body;
+	if (!Number.isSafeInteger(minSendable) || !Number.isSafeInteger(maxSendable) || minSendable <= 0 || maxSendable < minSendable) throw new Error("The pay request has invalid amount limits");
+	const minSat = Math.ceil(minSendable / 1e3), maxSat = Math.floor(maxSendable / 1e3);
+	if (minSat > maxSat) throw new Error("The pay request only takes fractions of a sat, which cannot be paid here");
+	if (typeof metadata !== "string" || metadata.length > LNURL_LIMITS.maxMetadataLength) throw new Error("The pay request has no usable metadata");
+	let entries;
+	try {
+		entries = JSON.parse(metadata);
+	} catch {
+		throw new Error("The pay request's metadata is not JSON");
 	}
+	if (!Array.isArray(entries) || !entries.every((e) => Array.isArray(e) && typeof e[0] === "string")) throw new Error("The pay request's metadata is malformed");
+	const entry = (type) => entries.find((e) => e[0] === type)?.[1];
+	const description = entry("text/plain");
+	if (typeof description !== "string") throw new Error("The pay request says nothing about what it is for (no text/plain metadata)");
+	const identifier = [entry("text/identifier"), entry("text/email")].find((v) => typeof v === "string")?.toLowerCase();
+	if (destination.kind === "address" && identifier && identifier !== destination.text) throw new Error(`${destination.domain} answered for ${identifier}, not ${destination.text}`);
+	const comment = Number.isSafeInteger(commentAllowed) && commentAllowed > 0 ? Math.min(commentAllowed, LNURL_LIMITS.maxComment) : 0;
 	return {
-		name: labels.join("."),
-		next: next < 0 ? pos : next
+		destination,
+		callback: callback.href,
+		callbackDomain: callback.host,
+		minSendable,
+		maxSendable,
+		minSat,
+		maxSat,
+		metadata,
+		descriptionHash: hex$1(sha256(new TextEncoder().encode(metadata))),
+		description: description.slice(0, 280),
+		identifier,
+		commentAllowed: comment
 	};
 }
+/** Where to ask for the invoice of `amountSat` (and a comment, LUD-12). Throws when the amount or comment is not allowed. */
+function invoiceCallbackUrl(params, amountSat, comment) {
+	if (!Number.isSafeInteger(amountSat) || amountSat <= 0) throw new Error("Enter a whole number of sats");
+	if (amountSat < params.minSat || amountSat > params.maxSat) throw params.minSat === params.maxSat ? engineError("lnurlExactly", {
+		domain: params.destination.domain,
+		amount: params.minSat.toLocaleString()
+	}) : engineError("lnurlRange", {
+		domain: params.destination.domain,
+		min: params.minSat.toLocaleString(),
+		max: params.maxSat.toLocaleString()
+	});
+	const url = new URL(params.callback);
+	url.searchParams.set("amount", String(amountSat * 1e3));
+	const text = comment?.trim();
+	if (text) {
+		if (!params.commentAllowed) throw new Error(`${params.destination.domain} does not take a comment`);
+		if (text.length > params.commentAllowed) throw new Error(`The comment can be at most ${params.commentAllowed} characters`);
+		url.searchParams.set("comment", text);
+	}
+	return url.href;
+}
 /**
-* Decodes a resolver's answer to `encodeDnsQuery(name, type)`. Refuses a reply
-* to another question or a truncated one, and keeps only records of the asked
-* type owned by the name or by the CNAME chain the answer itself follows.
+* Checks the invoice a service answered with (LUD-06): the amount asked, a payment hash, not expired, and
+* a commitment to the metadata the person was shown: the `h` tag is its sha256, or the invoice carries the
+* metadata itself as its description (the same commitment, unhashed).
 */
-function decodeDnsResponse(data, name, type) {
-	if (data.length < 12) throw new Error("DNS response too short");
-	const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
-	const flags = view.getUint16(2);
-	if (!(flags & 32768) || flags & 30720 || flags & 512) throw new Error("Unusable DNS response");
-	const questions = view.getUint16(4), count = view.getUint16(6);
-	const want = name.replace(/\.$/, "").toLowerCase(), code = DNS_TYPE[type];
-	if (questions !== 1) throw new Error("DNS response is for another question");
-	const q = readName(data, 12);
-	if (q.name !== want || q.next + 4 > data.length || view.getUint16(q.next) !== code) throw new Error("DNS response is for another question");
-	let pos = q.next + 4;
-	const all = [];
-	for (let i = 0; i < count && i < 64; i++) {
-		const owner = readName(data, pos);
-		pos = owner.next;
-		if (pos + 10 > data.length) throw new Error("DNS record out of bounds");
-		const rtype = view.getUint16(pos), ttl = view.getUint32(pos + 4), len = view.getUint16(pos + 8);
-		pos += 10;
-		if (pos + len > data.length) throw new Error("DNS record out of bounds");
-		const rdata = rtype === DNS_TYPE.CNAME ? utf8Encode(readName(data, pos).name) : data.slice(pos, pos + len);
-		all.push({
-			name: owner.name,
-			type: rtype,
-			ttl,
-			data: rdata
-		});
-		pos += len;
-	}
-	const owners = /* @__PURE__ */ new Set([want]);
-	for (let hop = 0; hop < 8; hop++) {
-		const cname = all.find((a) => a.type === DNS_TYPE.CNAME && owners.has(a.name) && !owners.has(utf8Decode(a.data)));
-		if (!cname) break;
-		owners.add(utf8Decode(cname.data));
+function parseInvoiceCallback(body, params, amountSat) {
+	if (!isRecord(body) || typeof body.pr !== "string") throw new Error(`${params.callbackDomain} did not answer with an invoice`);
+	const invoice = decodeBolt11(body.pr);
+	if (!invoice) throw new Error(`${params.callbackDomain} answered with an invoice that does not decode`);
+	if (invoice.amountMsat !== BigInt(amountSat) * 1000n) throw new Error(`The invoice asks for ${invoice.amountSat === null ? "any amount" : `${invoice.amountSat.toLocaleString()} sats`}, not the ${amountSat.toLocaleString()} sats you chose`);
+	if (!invoice.paymentHash) throw new Error("The invoice has no payment hash");
+	if (invoice.descriptionHash !== params.descriptionHash && invoice.description !== params.metadata) throw new Error("The invoice does not commit to what the service said the payment is for");
+	if (invoice.expiresAt * 1e3 < Date.now()) throw new Error("The invoice the service answered with has already expired");
+	let successAction;
+	const action = body.successAction;
+	if (isRecord(action)) {
+		if (action.tag === "message" && typeof action.message === "string") successAction = {
+			tag: "message",
+			message: reason(action.message)
+		};
+		else if (action.tag === "url" && typeof action.url === "string" && /^https:\/\//i.test(action.url) && action.url.length <= LNURL_LIMITS.maxUrlLength) successAction = {
+			tag: "url",
+			description: reason(action.description),
+			url: action.url
+		};
 	}
 	return {
-		rcode: flags & 15,
-		authenticated: !!(flags & 32),
-		answers: all.filter((a) => a.type === code && owners.has(a.name))
+		invoice,
+		successAction
 	};
 }
-/** The TXT character-strings of one record, joined as RFC 7208 §3.3 does. */
-function txtValue(rdata) {
-	const parts = [];
-	for (let p = 0; p < rdata.length;) {
-		const len = rdata[p];
-		if (p + 1 + len > rdata.length) throw new Error("DNS text out of bounds");
-		parts.push(rdata.subarray(p + 1, p + 1 + len));
-		p += 1 + len;
-	}
-	return new TextDecoder("utf-8", { fatal: true }).decode(concatBytes$1(...parts));
+/** Fetches and checks what a Lightning address or LNURL asks for. The service's domain learns of it. */
+async function resolveLightningDestination(text, options = {}) {
+	const destination = parseLightningDestination(text);
+	if (!destination) throw new Error("That is not a Lightning address or an LNURL");
+	return parsePayParams(await fetchLnurlJson(destination.url, options), destination);
 }
-/** False for loopback, private, link-local, shared (CGNAT), multicast, reserved
-* and unspecified addresses, including IPv4 embedded in IPv6. */
-function isPublicAddress(address) {
-	if (address.length === 4) {
-		const [a, b, c] = address;
-		return !(a === 0 || a === 10 || a === 127 || a >= 224 || a === 100 && b >= 64 && b <= 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 192 && b === 0 && c === 0 || a === 198 && (b === 18 || b === 19));
-	}
-	if (address.length !== 16) return false;
-	const zeroTo = (n) => address.subarray(0, n).every((x) => x === 0);
-	if (zeroTo(15) && (address[15] === 0 || address[15] === 1)) return false;
-	if (zeroTo(10) && address[10] === 255 && address[11] === 255) return isPublicAddress(address.subarray(12));
-	if (address[0] === 0 && address[1] === 100 && address[2] === 255 && address[3] === 155 && address.subarray(4, 12).every((x) => x === 0)) return isPublicAddress(address.subarray(12));
-	if (zeroTo(12)) return false;
-	if ((address[0] & 254) === 252) return false;
-	if (address[0] === 254 && (address[1] & 192) === 128) return false;
-	if (address[0] === 254 && (address[1] & 192) === 192) return false;
-	if (address[0] === 255) return false;
-	if (address[0] === 1 && address.subarray(1, 8).every((x) => x === 0)) return false;
-	return (address[0] & 224) === 32;
+/** Asks the service for an invoice of `amountSat`, and checks it before it is handed to any wallet. */
+async function requestLnurlInvoice(params, amountSat, comment, options = {}) {
+	return parseInvoiceCallback(await fetchLnurlJson(invoiceCallbackUrl(params, amountSat, comment), options), params, amountSat);
 }
 //#endregion
 //#region ../core/src/pkdns.ts
@@ -24907,7 +25100,9 @@ var GROUP_LIMITS = {
 	*/
 	catchUpSlice: 16,
 	/** Between two slices, when the member's app cannot say it handled one (`handled` resolves `false`). */
-	catchUpPauseMs: 500
+	catchUpPauseMs: 500,
+	/** A received message is in the saved state within this long (`persistSoon`): a burst of them is one save, not one each. */
+	saveWithinMs: 1e3
 };
 /** What every member should know about who can read what, in the words the apps show. */
 var GROUP_READ_NOTE = `Everyone in the group can read everything sent while they are a member. Someone removed keeps what they already received and cannot read what comes after; someone who joins later cannot read what came before. Messages go directly to each member; whoever was away gets what they missed from any member who has it (the group's last ${GROUP_LIMITS.relay} messages) when they meet again.`;
@@ -25088,6 +25283,7 @@ function readFirstPlace(o, epoch) {
 /** One of my own frames, among mine: `e:n`. */
 var ownKey = (f) => `${f.e}:${f.n}`;
 /** What a frame weighs in a log, roughly: its boxes plus the fixed fields around them. */
+/** What a kept frame counts for against `GROUP_LIMITS.relayBytes`. */
 var frameBytes = (f) => f.c.length + (f.m?.c.length ?? 0) + (f.r?.c.length ?? 0) + (f.sc?.c.length ?? 0) + (f.fl?.c.length ?? 0) + 400;
 /** Only the fields an edit frame has, as `clean` does for a message. */
 var cleanEdit = (f) => ({
@@ -25207,6 +25403,8 @@ var GroupSession = class {
 	pendingMeta;
 	/** While `handle` runs: the frames it took that a hub passes on (`handle`'s result). */
 	passOn = null;
+	/** Set while a save of what received messages changed is due (`persistSoon`). */
+	saveTimer;
 	/** Syncs answered per member, a few a minute (`GROUP_LIMITS.syncAnswers`). In memory only. */
 	syncsAnswered = /* @__PURE__ */ new Map();
 	/** Catch-up answers still going out, a slice at a time (`handOut`). */
@@ -25410,11 +25608,14 @@ var GroupSession = class {
 		const floor = this.hooks.seqFloor?.() ?? 0;
 		return Number.isSafeInteger(floor) && floor > 0 ? floor : 0;
 	}
-	/** How many messages, per sender, are known to be missing in the current epoch. */
-	missing(sender) {
+	/**
+	* How many messages, per sender, are known to be missing in the current epoch. `past`: only the numbers above it,
+	* for a caller that knows nobody holds the ones up to it any more.
+	*/
+	missing(sender, past = -1) {
 		const entry = this.state.seen[sender]?.[this.epoch];
 		if (!entry) return 0;
-		const lowest = Math.max(0, entry.high - GROUP_LIMITS.window + 1);
+		const lowest = Math.max(0, entry.high - GROUP_LIMITS.window + 1, past + 1);
 		return Math.max(0, entry.high - lowest + 1 - (1 + entry.window.filter((n) => n >= lowest).length));
 	}
 	/**
@@ -25426,7 +25627,7 @@ var GroupSession = class {
 		const out = /* @__PURE__ */ new Map();
 		for (const [sender, epochs] of Object.entries(this.state.seen)) {
 			if (sender === this.myKey || !rosterHas(this.roster, sender)) continue;
-			const marks = Object.entries(epochs).filter(([, entry]) => this.gaps(entry).length).map(([e, entry]) => `${e}:${entry.high}:${entry.window.length}`);
+			const marks = Object.entries(epochs).map(([e, entry]) => [e, this.gaps(entry)]).filter(([, gaps]) => gaps.length).map(([e, gaps]) => `${e}:${gaps.join(".")}`);
 			if (marks.length) out.set(sender, marks.join(","));
 		}
 		return out;
@@ -25455,8 +25656,31 @@ var GroupSession = class {
 		return operation;
 	}
 	persist() {
+		if (this.saveTimer) {
+			clearTimeout(this.saveTimer);
+			this.saveTimer = void 0;
+		}
 		return this.hooks.save(structuredClone(this.state));
 	}
+	/**
+	* A save within `GROUP_LIMITS.saveWithinMs`, for what a received message changes (what was seen, what is kept to hand
+	* on): the state holds the whole hand-on log, and a member back in a busy group wrote all of it once per message.
+	* The message itself is stored before (`hooks.message`). An app killed before the save takes those frames again when
+	* it syncs: its store has the messages already, and the state then catches up.
+	*/
+	persistSoon() {
+		if (this.saveTimer) return;
+		this.saveTimer = setTimeout(() => {
+			this.saveTimer = void 0;
+			this.serialize(() => this.hooks.save(structuredClone(this.state))).catch(() => {});
+		}, GROUP_LIMITS.saveWithinMs);
+	}
+	/** Writes what is waiting to be saved now (before a restart, in tests). */
+	flush() {
+		return this.serialize(async () => {
+			if (this.saveTimer) await this.persist();
+		});
+	}
 	secret(epoch) {
 		const s = this.state.secrets[epoch];
 		return s ? fromBase64Url(s) : void 0;
@@ -25848,7 +26072,7 @@ var GroupSession = class {
 			const text = edit.text.trim();
 			if (!validEditText(text)) return { error: text ? "Message exceeds 16 KiB" : "An edit cannot be empty" };
 			if (!this.secret(ref.e)) return { error: "This message is too old to edit: its epoch's key is gone" };
-			const named = validMentions(wireMentions(edit.mentions ?? []), text, rosterAdmin(commit.m) === this.myKey);
+			const named = validMentions(wireMentions(edit.mentions ?? []), text, rosterAdmin(commit.m) === this.myKey && this.isAdmin);
 			const plain = JSON.stringify({
 				text,
 				...named.length ? { m: named } : {},
@@ -26167,12 +26391,12 @@ var GroupSession = class {
 		if (firstFrame && rosterHas(this.state.chain[first.e]?.m ?? [], this.myKey) && this.isDuplicate(firstFrame)) {
 			this.markSeen(raw);
 			this.keep(clean(raw));
-			await this.persist();
+			this.persistSoon();
 			if (rosterHas(this.roster, raw.s)) this.took(clean(raw));
 			return;
 		}
 		const id = first && !this.provisional.has(own) ? groupMessageId(raw.s, first.e, first.n) : own;
-		const mentions = this.openMentions(key, raw, text, rosterAdmin(commit.m) === raw.s);
+		const mentions = this.openMentions(key, raw, text, rosterAdmin(commit.m) === raw.s && this.admin === raw.s);
 		const reply = this.openReply(key, raw);
 		const forwarded = readForwarded(raw.f);
 		const card = this.openCard(key, raw);
@@ -26190,7 +26414,8 @@ var GroupSession = class {
 			...forwarded ? { forwarded } : {},
 			...card ? { card } : {},
 			...file ? { file } : {},
-			...completes ? { completes: true } : {}
+			...completes ? { completes: true } : {},
+			...whole ? { frame: clean(raw) } : {}
 		});
 		if (!whole) {
 			this.provisional.add(id);
@@ -26203,7 +26428,7 @@ var GroupSession = class {
 		this.markSeen(raw);
 		if (firstFrame && rosterHas(this.state.chain[firstFrame.e]?.m ?? [], this.myKey)) this.markSeen(firstFrame);
 		this.keep(clean(raw));
-		await this.persist();
+		this.persistSoon();
 		if (rosterHas(this.roster, raw.s)) this.took(clean(raw));
 	}
 	/**
@@ -26235,7 +26460,7 @@ var GroupSession = class {
 			return;
 		}
 		if (!body || typeof body !== "object" || !validEditText(body.text)) return;
-		const k = validMentions(body.m, body.text, rosterAdmin(commit.m) === raw.s);
+		const k = validMentions(body.m, body.text, rosterAdmin(commit.m) === raw.s && this.admin === raw.s);
 		const sc = body.sc === void 0 ? void 0 : readStatusCard(body.sc);
 		if (!validEditNumber(raw.v) && !sc) return;
 		const copy = (this.state.relay ?? []).find((f) => f.s === raw.s && f.e === raw.e && f.n === raw.n);
@@ -26863,6 +27088,10 @@ var COMMUNITY_LIMITS = {
 	side: 512,
 	/** Commits waiting for their parent. */
 	pendingCommits: 64,
+	/** Epoch secrets waiting for their commit. */
+	pendingSecrets: 32,
+	/** How long a commit waits for its parent, or a secret for its commit: many catch-ups; after it, a catch-up brings both again. */
+	pendingMs: 12e4,
 	waiting: 64,
 	waitingBytes: 1048576,
 	replay: 256,
@@ -26922,6 +27151,17 @@ var FRESH = /* @__PURE__ */ new Set([
 	"rotate"
 ]);
 /**
+* Commits that make the membership history longer and the group no smaller. A committer signs one only while the
+* history keeps room for everyone else to get out after it: two commits a member (a leave or a remove is one, and a
+* leaving admin hands the role over first). The history is never compacted, and one that filled with people in it
+* took no leave, remove or handover any more. Its own rule: a history up to `COMMUNITY_LIMITS.chain` verifies as before.
+*/
+var GROWS = /* @__PURE__ */ new Set([
+	"add",
+	"rotate",
+	"link"
+]);
+/**
 * Kinds only the admin commits. They are final: a branch that drops one never replaces the branch
 * that has it, however long, so no member can undo a removal, a hand-over, a rotation or a link change
 * by outgrowing it with admissions.
@@ -27600,13 +27840,20 @@ var CommunitySession = class {
 		if (typeof p !== "string" || !Number.isSafeInteger(e)) return false;
 		const parent = this.known.get(p), parentRoster = parent ? this.rosterAt(p) : void 0;
 		if (!parent || !parentRoster) {
-			if (this.pendingCommits.size < COMMUNITY_LIMITS.pendingCommits) {
-				this.pendingCommits.set(p + ":" + String(e), {
+			const commit = parseCommit(raw);
+			if (!commit || commit.g !== this.id || !verify(fromBase64Url(commit.sig), utf8Encode(tuple(commit)), publicKeyFromZ32(commit.by))) return false;
+			if (this.wasAdmin(commit.by)) {
+				const now = this.hooks.clock?.() ?? Date.now(), key = p + ":" + String(e);
+				this.dropStale(this.pendingCommits, now);
+				this.pendingCommits.delete(key);
+				if (this.pendingCommits.size >= COMMUNITY_LIMITS.pendingCommits) this.pendingCommits.delete(this.pendingCommits.keys().next().value);
+				this.pendingCommits.set(key, {
 					from,
-					commit: raw
+					commit,
+					at: now
 				});
-				this.ask(from);
 			}
+			this.ask(from);
 			return false;
 		}
 		const result = verifyCommunityCommit(raw, parent, parentRoster, this.id);
@@ -27642,7 +27889,7 @@ var CommunitySession = class {
 		const sealed = this.pendingSecrets.get(h);
 		if (sealed) {
 			this.pendingSecrets.delete(h);
-			this.takeSecret(h, sealed);
+			this.takeSecret(h, sealed.sealed);
 		}
 		await this.chooseBranch();
 		for (const [key, pending] of [...this.pendingCommits]) if (key.startsWith(h + ":")) {
@@ -27656,6 +27903,18 @@ var CommunitySession = class {
 		}
 		return true;
 	}
+	/** Is, or was on the branch I follow, the admin (and was not taken out since). */
+	wasAdmin(key) {
+		if (this.wasRemoved(key)) return false;
+		return this.admin === key || this.state.chain.some((c, i) => i === 0 ? c.by === key : c.k === "role" && c.s === key);
+	}
+	/** What waited longer than `pendingMs` goes (the oldest first: a Map keeps the order they came in). */
+	dropStale(pending, now) {
+		for (const [key, { at }] of pending) {
+			if (now - at < COMMUNITY_LIMITS.pendingMs) break;
+			pending.delete(key);
+		}
+	}
 	/**
 	* Follows the best branch among the known tips (see `better`); reorganizes the main branch when it
 	* changed. A branch that keeps the admin's changes, or a longer one, wins however far back it parts
@@ -27758,7 +28017,15 @@ var CommunitySession = class {
 	takeSecret(h, sealed) {
 		const c = this.known.get(h);
 		if (!c) {
-			if (isSealed(sealed) && this.pendingSecrets.size < 32) this.pendingSecrets.set(h, sealed);
+			if (!HASH.test(h) || !isSealed(sealed)) return false;
+			const now = this.hooks.clock?.() ?? Date.now();
+			this.dropStale(this.pendingSecrets, now);
+			this.pendingSecrets.delete(h);
+			if (this.pendingSecrets.size >= COMMUNITY_LIMITS.pendingSecrets) this.pendingSecrets.delete(this.pendingSecrets.keys().next().value);
+			this.pendingSecrets.set(h, {
+				sealed,
+				at: now
+			});
 			return false;
 		}
 		if (this.state.secrets[h] || !isSealed(sealed) || !rosterHas(this.rosterAt(h) ?? [], this.myKey)) return false;
@@ -27823,6 +28090,7 @@ var CommunitySession = class {
 		};
 		const roster = communityRoster(this.roster, draftBase);
 		if (!roster) throw new Error("This change is not allowed");
+		if (GROWS.has(kind) && this.state.chain.length + 1 + 2 * (roster.length - 1) > COMMUNITY_LIMITS.chain) throw new Error("This group has reached its membership history limit. Create a new group.");
 		const draft = {
 			...draftBase,
 			m: rosterHash(roster)
@@ -28528,7 +28796,9 @@ var CommunitySession = class {
 	}
 	/** Something is missing here: the current epoch's secret, or the epoch of frames waiting. */
 	get needsCatchUp() {
-		return this.isMember && (!this.state.secrets[this.topHash] || this.waiting.length > 0 || this.pendingCommits.size > 0);
+		if (!this.isMember) return false;
+		this.dropStale(this.pendingCommits, this.hooks.clock?.() ?? Date.now());
+		return !this.state.secrets[this.topHash] || this.waiting.length > 0 || this.pendingCommits.size > 0;
 	}
 	/** Asks a member I have an edge to for what I lack (the engine calls it now and then while `needsCatchUp`). */
 	catchUp(to) {
@@ -28962,6 +29232,8 @@ var APP_BUNDLE_LIMITS = {
 	/** A path, in bytes (paths are ASCII). */
 	pathBytes: 128,
 	iconBytes: 262144,
+	/** The icon's width and height, in pixels: a client decodes it whole to draw it, whatever its bytes. */
+	iconEdge: 1024,
 	screenshots: 8,
 	/** Lengths in Unicode code points. */
 	title: 40,
@@ -29357,6 +29629,11 @@ function readAppBundle(bytes) {
 			reason: "bad-icon",
 			detail: "icon.png is not a square PNG"
 		};
+		if (size.width > APP_BUNDLE_LIMITS.iconEdge) return {
+			ok: false,
+			reason: "bad-icon",
+			detail: "icon.png is larger than 1024 × 1024 pixels"
+		};
 	}
 	return {
 		ok: true,
@@ -29510,6 +29787,13 @@ var STORE_REQUIRED = [
 	"removed",
 	"revoked"
 ];
+/** Runs a check written in steps to its end, in one go. */
+function inOneRun(steps) {
+	for (;;) {
+		const step = steps.next();
+		if (step.done) return step.value;
+	}
+}
 /**
 * Checks an index's fields and bounds, and every revocation it carries (one that does not verify refuses the index:
 * the store copied it, so a broken one is the store's fault). The signature and `expires` are `readAppStore`'s. An
@@ -29517,6 +29801,14 @@ var STORE_REQUIRED = [
 * statement and keeps its exact keys.
 */
 function checkAppStoreIndex(value, options = {}) {
+	const fields = inOneRun(checkAppStoreFieldsSteps(value, options));
+	return fields.ok ? inOneRun(checkAppStoreRevocationsSteps(value)) : fields;
+}
+/**
+* The first half of `checkAppStoreIndex`: the fields and bounds, and the shape of every revocation, with no signature
+* checked. A step after each listing, removal and revocation (see `readAppStoreSteps`).
+*/
+function* checkAppStoreFieldsSteps(value, options = {}) {
 	if (!isObject(value)) return {
 		ok: false,
 		reason: "bad-field",
@@ -29553,38 +29845,65 @@ function checkAppStoreIndex(value, options = {}) {
 			detail: ref
 		};
 		refs.add(ref);
+		yield;
 	}
 	if (!Array.isArray(removed) || removed.length > APP_STORE_LIMITS.removed) return bad("removed");
 	for (const entry of removed) {
 		const checked = checkRemoval(entry, options);
 		if (!checked.ok) return checked;
+		yield;
 	}
 	if (!Array.isArray(revoked) || revoked.length > APP_STORE_LIMITS.revoked) return bad("revoked");
 	for (const entry of revoked) {
-		const read = readAppRevocation(entry);
+		const read = readAppRevocationShape(entry);
 		if (!read.ok) return {
 			ok: false,
 			reason: "bad-revocation",
 			detail: read.detail ?? read.reason
 		};
+		yield;
+	}
+	return fine;
+}
+/** The second half: the signature of each revocation of an index whose fields hold, one step each. */
+function* checkAppStoreRevocationsSteps(index, checked) {
+	for (const revocation of index.revoked) {
+		const verified = verifyAppRevocation(revocation, checked);
+		if (!verified.ok) return {
+			ok: false,
+			reason: "bad-revocation",
+			detail: verified.reason
+		};
+		yield;
 	}
 	return fine;
 }
 /**
-* Reads `ghostly-store.json` with its `ghostly-store.sig`, in this order: size, JSON, canonical bytes, fields and
-* revocations, the signature statement, the key the reader holds for this store (when it holds one), the signature,
-* then `expires` against `now` (seconds): more than 90 days ahead is refused, past is `expired`. A key it does not know
-* is ignored (a later store's optional field) and stays in the bytes the signature covers.
+* Reads `ghostly-store.json` with its `ghostly-store.sig`, in this order: size, JSON, canonical bytes, fields and the
+* shape of each revocation, the signature statement, the key the reader holds for this store (when it holds one), the
+* signature, the signature of each revocation, then `expires` against `now` (seconds): more than 90 days ahead is
+* refused, past is `expired`. The index's own signature comes before its revocations': an index nobody signed costs
+* its reader one signature check, whatever it carries. A key it does not know is ignored (a later store's optional
+* field) and stays in the bytes the signature covers.
 */
 function readAppStore(indexBytes, sigBytes, now, heldKey) {
+	return inOneRun(readAppStoreSteps(indexBytes, sigBytes, now, heldKey));
+}
+/**
+* `readAppStore` in steps, for a reader that shares its thread (a page): it stops after each listing, removal and
+* revocation, and after each revocation's signature check, so the caller can let the thread go between two `next()`
+* and an index of 4096 revocations never holds it for seconds. With `checked`, a revocation it holds is not checked again.
+*/
+function* readAppStoreSteps(indexBytes, sigBytes, now, heldKey, checked) {
 	if (indexBytes.length > APP_STORE_LIMITS.indexBytes) return {
 		ok: false,
 		reason: "too-large"
 	};
 	const read = readCanonicalJson(indexBytes);
 	if (!read.ok) return read;
-	const checked = checkAppStoreIndex(read.value);
-	if (!checked.ok) return checked;
+	yield;
+	const fields = yield* checkAppStoreFieldsSteps(read.value);
+	if (!fields.ok) return fields;
 	const index = read.value;
 	const statement = readAppSignature(sigBytes);
 	if (!statement.ok) return statement;
@@ -29595,6 +29914,9 @@ function readAppStore(indexBytes, sigBytes, now, heldKey) {
 	};
 	const signed = verifyAppSignature(APP_PREFIXES.store, indexBytes, statement.signature, index.key);
 	if (!signed.ok) return signed;
+	yield;
+	const revocations = yield* checkAppStoreRevocationsSteps(index, checked);
+	if (!revocations.ok) return revocations;
 	if (index.expires > now + APP_STORE_LIMITS.expiresAheadS) return {
 		ok: false,
 		reason: "expires-too-far"
@@ -29685,6 +30007,6 @@ function appStoreDecision(held, read) {
 	return read.digest === held.digest ? "same" : "equivocation";
 }
 //#endregion
-export { SSHSIG_NAMESPACE as $, appRef as $a, randomBytes as $c, parseImageMeta as $i, engineError as $n, filePartName as $o, pinNumberHolds as $r, createChatInvite as $s, PaymentPreflightError as $t, decodeGroupEntryLink as A, pairedReplyAuthor as Aa, RelayTransport as Ac, IDENTITY_REVOCATION_LABEL as Ai, encodeDnsQuery as An, RTC_CONFIG as Ao, mergeBeacon as Ar, readSetUpdate as As, didJwsAlg as At, groupWakes as B, cardLine as Ba, createRelayPayload as Bc, lastSharedWithMe as Bi, resolveLightningDestination as Bn, LEGACY_SERVICES as Bo, FILE_LIMITS as Br, enrollCancelReason as Bs, parseDidSignaturePaste as Bt, COMMUNITY_LIMITS as C, nextReactionNumber as Ca, nextTurnPosition as Cc, readManifest as Ci, homeserverWebEndpoint as Cn, formatLocalTarget as Co, COMMUNITY_TOPOLOGY as Cr, readHandoffHello as Cs, DID_DOCUMENT_MAX_BYTES as Ct, decodeCommunityLink as D, readReaction as Da, turnKeys as Dc, dialDescriptors as Di, dnsProofName as Dn, decodeControl as Do, freshHubs as Dr, sealHandoffPiece as Ds, checkDidJws as Dt, communityHasFrame as E, reactionIsNewer as Ea, signTurnRelease as Ec, capsDescriptors as Ei, decodeDnsResponse as En, LIMITS as Eo, doorHubs as Er, readHandoffVerified as Es, DidError as Et, mergeKnocks as F, PR_CHECKS as Fa, budgetRetryMs as Fc, identityRevocationValue as Fi, recordsFromWellKnown as Fn, extractParamsFromSdp as Fo, readBeacon as Fr, ENROLL_DONE as Fs, didWebFileUrl as Ft, COMMUNITY_EDIT_FRAME as G, arrivalKey as Ga, identityFromSeed as Gc, automaticTransport as Gi, findEndpoint as Gn, HANDOFF_HAVE as Go, TypingSender as Gr, enrollProofFrame as Gs, didDhtFromPublicKey as Gt, GROUP_REACTED_FRAME as H, checkStatusCard as Ha, openRelayPayload as Hc, emptyProofLedger as Hi, ENDPOINT as Hn, HANDOFF_ACK as Ho, transferStalled as Hr, enrollDoneFrame as Hs, staticDidDocument as Ht, readKnocks as I, PR_STATES as Ia, isDiscoveryBudgetError as Ic, identityStatement as Ii, recordsName as In, parseCallSignal as Io, readBeaconHead as Ir, ENROLL_GRANT as Is, didWebHost as It, carryMentions as J, receivedTimestamp as Ja, verify as Jc, DHT_FILE_TOO_LARGE as Ji, parseFedimintRequestPayload as Jn, HANDOFF_PAKE as Jo, GROUP_PIN_FRAME as Jr, verifyEnrollProof as Js, resolveDidDht as Jt, GROUP_EDIT_FRAME as K, claimedTime as Ka, identityFromSeedB64 as Kc, irohDescriptor as Ki, isFederationId as Kn, HANDOFF_HELLO as Ko, sanitizeTypingStatus as Kr, readEnrollGrant as Ks, encodeDidDhtDeactivated as Kt, GROUP_WAKE_FRAME as L, RUN_RESULTS as La, withRequestOptions as Lc, newIdentityBinding as Li, txtValue as Ln, signalHasVideo as Lo, readLobby as Lr, ENROLL_HELLO as Ls, normalizeDid as Lt, entryParams as M, replySnippet as Ma, normalizeRelayUrl as Mc, IdentityExchange as Mi, nip05RootKey as Mn, buildSdpFromSignal as Mo, newerHead as Mr, setUpdateFrame as Ms, didWebDocumentUrl as Mt, knockIdentity as N, BUTTON_ID as Na, setLinkTraceSink as Nc, boundVerifiedIdentity as Ni, normalizeDomain as Nn, callRtcConfig as No, pickHubs as Nr, signTombstone as Ns, didWebFile as Nt, encodeCommunityLink as O, validReactionNumber as Oa, turnName as Oc, IDENTITY_MAX_EVIDENCE as Oi, domainTxtRecord as On, encodeControl as Oo, lobbyKeys as Or, SET_ACK as Os, checkDidSignature as Ot, knockRecords as P, ITEM_STATES as Pa, traceLink as Pc, emptyIdentityLedger as Pi, recordsFromTxt as Pn, callSignalHeardAt as Po, rankHubs as Pr, verifySetUpdate as Ps, didWebFileNames as Pt, SSHSIG_MAX_ARMOR as Q, appFingerprint as Qa, fromBase64Url as Qc, dhtFileId as Qi, pairedMessageFrame as Qn, HANDOFF_VERIFIED as Qo, pinIsNewer as Qr, OwnInviteError as Qs, ONCHAIN_PROVIDER as Qt, GroupWakeLimiter as R, STATUS_CARD_LIMITS as Ra, PacketTooLargeError as Rc, receivedIdentityStatus as Ri, wellKnownUrl as Rn, emptyLinkRecords as Ro, shouldBeHub as Rr, ENROLL_PROOF as Rs, parseDid as Rt, sealGroupTyping as S, ReactionWindow as Sa, firstDeviceSetSecret as Sc, newMailbox as Si, pubkyProofPath as Sn, GhostlyHttpError as So, pickMeshHubs as Sr, readHandoffHave as Ss, verifyAtprotoRecordProof as St, GROUP_READ_NOTE_COMMUNITY as T, reactionEmoji as Ta, signTurnPacket as Tc, DHT_TEXT_CAPABILITY as Ti, DOMAIN_FILE_MAX_BYTES as Tn, webLocalFetch as To, beaconRecords as Tr, readHandoffTurnFrame as Ts, DID_JWS_MAX_LENGTH as Tt, GROUP_READ_NOTE as U, sameButtonText as Ua, parseRelayPayload as Uc, validExternalKey as Ui, cashuRequestPayload as Un, HANDOFF_CANCEL as Uo, TYPING_KINDS as Ur, enrollGrantFrame as Us, strictBase64Url as Ut, parseGroupWakeFrame as V, cardUrl as Va, newerPacket as Vc, PeerProofs as Vi, decodeBolt11 as Vn, serviceIdFromName as Vo, transferEnded as Vr, enrollDigits as Vs, signingKeys as Vt, GroupSession as W, statusCardText as Wa, createIdentity as Wc, TRANSPORTS as Wi, fedimintRequestPayload as Wn, HANDOFF_DONE as Wo, TYPING_REFRESH_MS as Wr, enrollHelloFrame as Ws, didDhtDocument as Wt, mentionsMember as X, APP_PREFIXES as Xa, sanitizeAvatar as Xc, peekDhtMailbox as Xi, INVITE_TAKEN as Xn, HANDOFF_REQUEST as Xo, mayPin as Xr, deviceInviteJoinerParams as Xs, ETHEREUM_USDT as Xt, parseCommunityEdit as Y, shownTime as Ya, MAX_AVATAR_LENGTH as Yc, DHT_MESSAGE_TTL as Yi, GhostLink as Yn, HANDOFF_PIECE_BYTES as Yo, PIN_LIMITS as Yr, createDeviceInvite as Ys, signDidDhtPacket as Yt, groupName as Z, APP_STATEMENT_LIMITS as Za, bytesEqual as Zc, DHT_FILE_CAPABILITY as Zi, LIVENESS_PING_MS as Zn, HANDOFF_TIMINGS as Zo, nextPinNumber as Zr, readDeviceInvite as Zs, EVM_TEST_CHAINS as Zt, readAppBundle as _, forwardedAgain as _a, TURN_SETTLE_MS as _c, HOLD_CAPABILITY as _i, isPubkyProofFolder as _n, DirectPathWatch as _o, groupSignalFrame as _r, handoffVersions as _s, isAtprotoDid as _t, planAppUpdate as a, PLAYABLE_AUDIO as aa, ENROLL_CAPABILITY as ac, parseWakeFrame as ai, assertTokenUnits as an, signAppObject as ao, fetchesByItself as ar, handoffContext as as, verifySshSignature as at, groupTypingEpoch as b, GROUP_REACTION_FRAME as ba, TURN_LAST_SEQUENCE as bc, HoldKeys as bi, pubkyProofCapability as bn, RELAY_POLL_INTERVALS as bo, mayBeHub as br, readHandoffCancel as bs, shortAtprotoDid as bt, signAppStore as c, fileMessageText as ca, deviceEchoNonce as cc, checkPushEndpoint as ci, validatePaymentTarget as cn, canonicalJsonBytes as co, readGroupFileMeta as cr, handoffDigest as cs, decodeAnyBitcoinAddress as ct, APP_ICON_PATH as d, parseVideoMeta as da, devicePingFrame as dc, isAppVersion as di, SPARK_PROVIDER as dn, MAX_GROUP_CHAIN as do, readGroupWantNo as dr, handoffManifestFrames as ds, ATPROTO_PROOF_COLLECTION as dt, readImageMeta as ea, decodeInviteCode as ec, readPin as ei, toBase64Url as el, SEPOLIA_TEST_USDT as en, checkAppRevokeStatement as eo, engineText as er, handoffAttemptAllowed as es, SshSigError as et, appDigest as f, EDIT_BUFFER_MS as fa, newDeviceSetSecret as fc, APPS_CAPABILITY as fi, sparkAddressKind as fn, MEMBER_KEY as fo, CarriedTransport as fr, handoffOfferFrame as fs, ATPROTO_PROOF_SCOPE as ft, isAppUrl as g, parseLinkPreview as ga, TURN_RAISE_READ_TIMEOUT_MS as gc, UPGRADE_CAPABILITY as gi, isPubkyKey as gn, edgeParams as go, SIGNAL_REPLY_MS as gr, handoffStreamKey as gs, checkAtprotoProofRecord as gt, checkAppManifest as h, dhtEditId as ha, TURN_PUT_WINDOW_MS as hc, STATUS_CARD_CAPABILITY as hi, PUBKY_PROOF_MAX_BYTES as hn, verifyCommitSignature as ho, SIGNAL_HOLD_MS as hr, handoffRetryAfter as hs, atprotoProofRkey as ht, checkAppBeforeRun as i, sanitizeMime as ia, DEVICES_CAPABILITY as ic, newWakeToken as ii, WALLET_NETWORKS as in, readAppRevocations as io, GROUP_WANT_NO_FRAME as ir, handoffCancelFrame as is, sshSignCommand as it, encodeGroupEntryLink as j, readReply as ja, currentRelays as jc, IdentityCheckUnavailable as ji, isPublicAddress as jn, answersOffer as jo, mergeLobby as jr, setAckFrame as js, didSignedMessages as jt, KNOCK_TTL_MS as k, wireReaction as ka, DEFAULT_RELAYS as kc, IDENTITY_MAX_VALIDITY as ki, domainWellKnownFile as kn, CALL_SIGNAL_MAX_AGE_MS as ko, lobbyRecords as kr, SET_UPDATE as ks, didGhostlyServiceEntry as kt, APP_BUNDLE_LIMITS as l, parseVoiceMeta as la, deviceKeyZ32 as lc, vapidKeysMatch as li, walletNetworkOf as ln, readCanonicalJson as lo, readGroupHave as lr, handoffEphemeral as ls, ATPROTO_DECLARED_SCOPE as lt, assembleAppBundle as m, RateWindow as ma, webCryptoSigner as mc, EDIT_CAPABILITY as mi, isBitcoinAddress as mn, rosterHas as mo, SIGNAL_FRESH_MS as mr, handoffReleaseFrame as ms, atprotoProofRecord as mt, appStoreDecision as n, safeBlobType as na, inviteLink as nc, WakeLimiter as ni, utf8Decode as nl, TEST_USDT_FAUCET_AMOUNT as nn, isAppRef as no, GROUP_HAVE_FRAME as nr, handoffAttemptSucceeded as ns, parseSshSignature as nt, checkAppStoreIndex as o, VOICE_LIMITS as oa, HANDOFF_CAPABILITY as oc, relayRequest as oi, assertWholeSats as on, signAppRevocation as oo, groupFileFallback as or, handoffContextProof as os, verifyBitcoinMessage as ot, appViewOf as p, EDIT_RATE_WINDOW_MS as pa, seedSigner as pc, BUTTONS_CAPABILITY as pi, sparkInvoiceDetails as pn, commitHash as po, GROUP_SIGNAL_FRAME as pr, handoffPakeFrame as ps, atprotoDidMethod as pt, GROUP_EDIT_TEXT_BYTES as q, heardTime as qa, publicKeyFromZ32 as qc, irohRelayUrl as qi, parseCashuRequestPayload as qn, HANDOFF_OFFER as qo, typingActivity as qr, readEnrollHello as qs, encodeDidDhtPacket as qt, appUpdateDecision as r, sanitizeFileName as ra, inviteOwnership as rc, deviceWakeRequest as ri, utf8Encode as rl, USDT_PUBLIC_RPC as rn, readAppRevocation as ro, GROUP_WANT_FRAME as rr, handoffBusyFrame as rs, sameSshKey as rt, readAppStore as s, baseMime as sa, deviceEchoFrame as sc, wakeRequest as si, formatPaymentAmount as sn, canonicalJson as so, isGroupMessageId as sr, handoffDataFrame as ss, BitcoinAddressError as st, appRevocationFor as t, formatFileSize as ta, encodeInviteCode as tc, WAKE_CALL_INTERVAL_MS as ti, toZ32 as tl, SEPOLIA_TEST_USDT_FAUCET as tn, isAppKey as to, GROUP_FILE_LIMITS as tr, handoffAttemptFailed as ts, parseSshPublicKey as tt, APP_BUNDLE_MAGIC as u, voicePeaksOf as ua, deviceLinkPairing as uc, chatAppId as ui, SPARK_NETWORKS as un, GROUP_MEMBER_CAP as uo, readGroupWant as ur, handoffHelloFrame as us, ATPROTO_FULL_SCOPE as ut, GROUP_TYPING_FRAME as v, readForwarded as va, classifyTurnRead as vc, HOLD_DATED_BACK_MS as vi, newPubkyProofFolder as vn, DHT_POLL_INTERVALS as vo, readGroupSignal as vr, newHandoffId as vs, normalizeAtprotoHandle as vt, CommunitySession as w, queueReaction as wa, readTurnPacket as wc, CapsExchange as wi, pubkyHomeserverOf as wn, parseLocalTarget as wo, beaconKeys as wr, readHandoffPake as ws, DID_FILE_MAX_BYTES as wt, openGroupTyping as x, REACTION_LIMITS as xa, TURN_MAX as xc, HoldRefusedError as xi, pubkyProofFile as xn, presenceSeenAt as xo, meshHubs as xr, readHandoffDone as xs, AtprotoProofError as xt, GroupTypingBoard as y, COMMUNITY_REACTION_FRAME as ya, turnPutSummary as yc, HOLD_LIMITS as yi, normalizePubkyKey as yn, EXPECT_PEER_MS as yo, MESH_HUBS as yr, readHandoffAck as ys, parseAtprotoDidDocument as yt, groupWakeFrame as z, buttonLabelClash as za, RELAY_PAYLOAD_MAX_BYTES as zc, revokesIdentity as zi, requestLnurlInvoice as zn, HTTP_SERVICE_PROTO as zo, ChatFiles as zr, enrollCancelFrame as zs, parseDidDocument as zt };
+export { parseCommunityEdit as $, receivedTimestamp as $a, identityFromSeed as $c, DHT_FILE_TOO_LARGE as $i, readGroupHave as $n, HANDOFF_PAKE as $o, vapidKeysMatch as $r, verifyEnrollProof as $s, signDidDhtPacket as $t, encodeCommunityLink as A, reactionEmoji as Aa, signTurnPacket as Ac, DHT_TEXT_CAPABILITY as Ai, resolveLightningDestination as An, webLocalFetch as Ao, FILE_LIMITS as Ar, readHandoffTurnFrame as As, DidError as At, GroupWakeLimiter as B, PR_CHECKS as Ba, normalizeRelayUrl as Bc, identityRevocationValue as Bi, INVITE_TAKEN as Bn, extractParamsFromSdp as Bo, mayPin as Br, ENROLL_DONE as Bs, didWebHost as Bt, openGroupTyping as C, readForwarded as Ca, classifyTurnRead as Cc, normalizeDomain as Ci, normalizePubkyKey as Cn, DHT_POLL_INTERVALS as Co, pickHubs as Cr, newHandoffId as Cs, parseAtprotoDidDocument as Ct, GROUP_READ_NOTE_COMMUNITY as D, ReactionWindow as Da, firstDeviceSetSecret as Dc, txtValue as Di, homeserverWebEndpoint as Dn, GhostlyHttpError as Do, readLobby as Dr, readHandoffHave as Ds, DID_DOCUMENT_MAX_BYTES as Dt, CommunitySession as E, REACTION_LIMITS as Ea, TURN_MAX as Ec, recordsName as Ei, pubkyProofPath as En, presenceSeenAt as Eo, readBeaconHead as Er, readHandoffDone as Es, verifyAtprotoRecordProof as Et, knockIdentity as F, pairedReplyAuthor as Fa, turnStatedVerifier as Fc, IDENTITY_REVOCATION_LABEL as Fi, findEndpoint as Fn, RTC_CONFIG as Fo, TypingSender as Fr, readSetUpdate as Fs, didSignedMessages as Ft, GROUP_REACTED_FRAME as G, cardLine as Ga, withRequestOptions as Gc, lastSharedWithMe as Gi, GROUP_FILE_LIMITS as Gn, LEGACY_SERVICES as Go, WAKE_CALL_INTERVAL_MS as Gr, enrollCancelReason as Gs, signingKeys as Gt, groupWakes as H, RUN_RESULTS as Ha, traceLink as Hc, newIdentityBinding as Hi, pairedMessageFrame as Hn, signalHasVideo as Ho, pinIsNewer as Hr, ENROLL_HELLO as Hs, parseDid as Ht, knockRecords as I, readReply as Ia, turnVerifierMark as Ic, IdentityCheckUnavailable as Ii, isFederationId as In, answersOffer as Io, sanitizeTypingStatus as Ir, setAckFrame as Is, didWebDocumentUrl as It, frameBytes as J, sameButtonText as Ja, createRelayPayload as Jc, validExternalKey as Ji, GROUP_WANT_NO_FRAME as Jn, HANDOFF_CANCEL as Jo, newWakeToken as Jr, enrollGrantFrame as Js, didDhtDocument as Jt, GROUP_READ_NOTE as K, cardUrl as Ka, PacketTooLargeError as Kc, PeerProofs as Ki, GROUP_HAVE_FRAME as Kn, serviceIdFromName as Ko, WakeLimiter as Kr, enrollDigits as Ks, staticDidDocument as Kt, mergeKnocks as L, replySnippet as La, DEFAULT_RELAYS as Lc, IdentityExchange as Li, parseCashuRequestPayload as Ln, buildSdpFromSignal as Lo, typingActivity as Lr, setUpdateFrame as Ls, didWebFile as Lt, decodeGroupEntryLink as M, readReaction as Ma, turnInstance as Mc, dialDescriptors as Mi, ENDPOINT as Mn, decodeControl as Mo, transferStalled as Mr, sealHandoffPiece as Ms, checkDidSignature as Mt, encodeGroupEntryLink as N, validReactionNumber as Na, turnKeys as Nc, IDENTITY_MAX_EVIDENCE as Ni, cashuRequestPayload as Nn, encodeControl as No, TYPING_KINDS as Nr, SET_ACK as Ns, didGhostlyServiceEntry as Nt, communityHasFrame as O, nextReactionNumber as Oa, nextTurnPosition as Oc, wellKnownUrl as Oi, pubkyHomeserverOf as On, formatLocalTarget as Oo, shouldBeHub as Or, readHandoffHello as Os, DID_FILE_MAX_BYTES as Ot, entryParams as P, wireReaction as Pa, turnName as Pc, IDENTITY_MAX_VALIDITY as Pi, fedimintRequestPayload as Pn, CALL_SIGNAL_MAX_AGE_MS as Po, TYPING_REFRESH_MS as Pr, SET_UPDATE as Ps, didJwsAlg as Pt, carryMentions as Q, heardTime as Qa, createIdentity as Qc, irohRelayUrl as Qi, readGroupFileMeta as Qn, HANDOFF_OFFER as Qo, checkPushEndpoint as Qr, readEnrollHello as Qs, resolveDidDht as Qt, readKnocks as R, BUTTON_ID as Ra, RelayTransport as Rc, boundVerifiedIdentity as Ri, parseFedimintRequestPayload as Rn, callRtcConfig as Ro, GROUP_PIN_FRAME as Rr, signTombstone as Rs, didWebFileNames as Rt, groupTypingEpoch as S, forwardedAgain as Sa, TURN_SETTLE_MS as Sc, nip05RootKey as Si, newPubkyProofFolder as Sn, DirectPathWatch as So, newerHead as Sr, handoffVersions as Ss, normalizeAtprotoHandle as St, COMMUNITY_LIMITS as T, GROUP_REACTION_FRAME as Ta, TURN_LAST_SEQUENCE as Tc, recordsFromWellKnown as Ti, pubkyProofFile as Tn, RELAY_POLL_INTERVALS as To, readBeacon as Tr, readHandoffCancel as Ts, AtprotoProofError as Tt, parseGroupWakeFrame as U, STATUS_CARD_LIMITS as Ua, budgetRetryMs as Uc, receivedIdentityStatus as Ui, engineError as Un, emptyLinkRecords as Uo, pinNumberHolds as Ur, ENROLL_PROOF as Us, parseDidDocument as Ut, groupWakeFrame as V, PR_STATES as Va, setLinkTraceSink as Vc, identityStatement as Vi, LIVENESS_PING_MS as Vn, parseCallSignal as Vo, nextPinNumber as Vr, ENROLL_GRANT as Vs, normalizeDid as Vt, GROUP_LIMITS as W, buttonLabelClash as Wa, isDiscoveryBudgetError as Wc, revokesIdentity as Wi, engineText as Wn, HTTP_SERVICE_PROTO as Wo, readPin as Wr, enrollCancelFrame as Ws, parseDidSignaturePaste as Wt, GROUP_EDIT_FRAME as X, arrivalKey as Xa, openRelayPayload as Xc, automaticTransport as Xi, groupFileFallback as Xn, HANDOFF_HAVE as Xo, relayRequest as Xr, enrollProofFrame as Xs, encodeDidDhtDeactivated as Xt, COMMUNITY_EDIT_FRAME as Y, statusCardText as Ya, newerPacket as Yc, TRANSPORTS as Yi, fetchesByItself as Yn, HANDOFF_DONE as Yo, parseWakeFrame as Yr, enrollHelloFrame as Ys, didDhtFromPublicKey as Yt, GROUP_EDIT_TEXT_BYTES as Z, claimedTime as Za, parseRelayPayload as Zc, irohDescriptor as Zi, isGroupMessageId as Zn, HANDOFF_HELLO as Zo, wakeRequest as Zr, readEnrollGrant as Zs, encodeDidDhtPacket as Zt, checkAppManifest as _, EDIT_BUFFER_MS as _a, newDeviceSetSecret as _c, dnsProofName as _i, sparkInvoiceDetails as _n, MEMBER_KEY as _o, freshHubs as _r, handoffOfferFrame as _s, atprotoDidMethod as _t, planAppUpdate as a, readImageMeta as aa, decodeInviteCode as ac, STATUS_CARD_CAPABILITY as ai, bytesEqual as al, SEPOLIA_TEST_USDT_FAUCET as an, checkAppRevokeStatement as ao, SIGNAL_HOLD_MS as ar, handoffAttemptAllowed as as, parseSshPublicKey as at, GROUP_TYPING_FRAME as b, dhtEditId as ba, TURN_PUT_WINDOW_MS as bc, encodeDnsQuery as bi, isPubkyKey as bn, verifyCommitSignature as bo, mergeBeacon as br, handoffRetryAfter as bs, checkAtprotoProofRecord as bt, readAppStore as c, sanitizeFileName as ca, inviteOwnership as cc, HOLD_DATED_BACK_MS as ci, toBase64Url as cl, WALLET_NETWORKS as cn, readAppRevocation as co, readGroupSignal as cr, handoffBusyFrame as cs, sshSignCommand as ct, APP_BUNDLE_LIMITS as d, VOICE_LIMITS as da, HANDOFF_CAPABILITY as dc, HoldRefusedError as di, utf8Encode as dl, formatPaymentAmount as dn, signAppRevocation as do, meshHubs as dr, handoffContextProof as ds, BitcoinAddressError as dt, DHT_MESSAGE_TTL as ea, createDeviceInvite as ec, chatAppId as ei, identityFromSeedB64 as el, ETHEREUM_USDT as en, shownTime as eo, readGroupWant as er, HANDOFF_PIECE_BYTES as es, mentionsMember as et, APP_BUNDLE_MAGIC as f, baseMime as fa, deviceEchoFrame as fc, isHoldUrl as fi, validatePaymentTarget as fn, canonicalJson as fo, pickMeshHubs as fr, handoffDataFrame as fs, decodeAnyBitcoinAddress as ft, assembleAppBundle as g, parseVideoMeta as ga, devicePingFrame as gc, decodeDnsResponse as gi, sparkAddressKind as gn, MAX_GROUP_CHAIN as go, doorHubs as gr, handoffManifestFrames as gs, ATPROTO_PROOF_SCOPE as gt, appViewOf as h, voicePeaksOf as ha, deviceLinkPairing as hc, DOMAIN_FILE_MAX_BYTES as hi, SPARK_PROVIDER as hn, GROUP_MEMBER_CAP as ho, beaconRecords as hr, handoffHelloFrame as hs, ATPROTO_PROOF_COLLECTION as ht, checkAppBeforeRun as i, parseImageMeta as ia, createChatInvite as ic, EDIT_CAPABILITY as ii, sanitizeAvatar as il, SEPOLIA_TEST_USDT as in, appRef as io, SIGNAL_FRESH_MS as ir, filePartName as is, SshSigError as it, KNOCK_TTL_MS as j, reactionIsNewer as ja, signTurnRelease as jc, capsDescriptors as ji, decodeBolt11 as jn, LIMITS as jo, transferEnded as jr, readHandoffVerified as js, checkDidJws as jt, decodeCommunityLink as k, queueReaction as ka, readTurnPacket as kc, CapsExchange as ki, requestLnurlInvoice as kn, parseLocalTarget as ko, ChatFiles as kr, readHandoffPake as ks, DID_JWS_MAX_LENGTH as kt, readAppStoreSteps as l, sanitizeMime as la, DEVICES_CAPABILITY as lc, HOLD_LIMITS as li, toZ32 as ll, assertTokenUnits as ln, readAppRevocations as lo, MESH_HUBS as lr, handoffCancelFrame as ls, verifySshSignature as lt, appDigest as m, parseVoiceMeta as ma, deviceKeyZ32 as mc, readManifest as mi, SPARK_NETWORKS as mn, readCanonicalJson as mo, beaconKeys as mr, handoffEphemeral as ms, ATPROTO_FULL_SCOPE as mt, appStoreDecision as n, DHT_FILE_CAPABILITY as na, readDeviceInvite as nc, APPS_CAPABILITY as ni, verify as nl, ONCHAIN_PROVIDER as nn, APP_STATEMENT_LIMITS as no, CarriedTransport as nr, HANDOFF_TIMINGS as ns, SSHSIG_MAX_ARMOR as nt, APP_STORE_LIMITS as o, formatFileSize as oa, encodeInviteCode as oc, UPGRADE_CAPABILITY as oi, fromBase64Url as ol, TEST_USDT_FAUCET_AMOUNT as on, isAppKey as oo, SIGNAL_REPLY_MS as or, handoffAttemptFailed as os, parseSshSignature as ot, APP_ICON_PATH as p, fileMessageText as pa, deviceEchoNonce as pc, newMailbox as pi, walletNetworkOf as pn, canonicalJsonBytes as po, COMMUNITY_TOPOLOGY as pr, handoffDigest as ps, ATPROTO_DECLARED_SCOPE as pt, GroupSession as q, checkStatusCard as qa, RELAY_PAYLOAD_MAX_BYTES as qc, emptyProofLedger as qi, GROUP_WANT_FRAME as qn, HANDOFF_ACK as qo, deviceWakeRequest as qr, enrollDoneFrame as qs, strictBase64Url as qt, appUpdateDecision as r, dhtFileId as ra, OwnInviteError as rc, BUTTONS_CAPABILITY as ri, MAX_AVATAR_LENGTH as rl, PaymentPreflightError as rn, appFingerprint as ro, GROUP_SIGNAL_FRAME as rr, HANDOFF_VERIFIED as rs, SSHSIG_NAMESPACE as rt, checkAppStoreIndex as s, safeBlobType as sa, inviteLink as sc, HOLD_CAPABILITY as si, randomBytes as sl, USDT_PUBLIC_RPC as sn, isAppRef as so, groupSignalFrame as sr, handoffAttemptSucceeded as ss, sameSshKey as st, appRevocationFor as t, peekDhtMailbox as ta, deviceInviteJoinerParams as tc, isAppVersion as ti, publicKeyFromZ32 as tl, EVM_TEST_CHAINS as tn, APP_PREFIXES as to, readGroupWantNo as tr, HANDOFF_REQUEST as ts, groupName as tt, signAppStore as u, PLAYABLE_AUDIO as ua, ENROLL_CAPABILITY as uc, HoldKeys as ui, utf8Decode as ul, assertWholeSats as un, signAppObject as uo, mayBeHub as ur, handoffContext as us, verifyBitcoinMessage as ut, isAppUrl as v, EDIT_RATE_WINDOW_MS as va, seedSigner as vc, domainTxtRecord as vi, isBitcoinAddress as vn, commitHash as vo, lobbyKeys as vr, handoffPakeFrame as vs, atprotoProofRecord as vt, sealGroupTyping as w, COMMUNITY_REACTION_FRAME as wa, turnPutSummary as wc, recordsFromTxt as wi, pubkyProofCapability as wn, EXPECT_PEER_MS as wo, rankHubs as wr, readHandoffAck as ws, shortAtprotoDid as wt, GroupTypingBoard as x, parseLinkPreview as xa, TURN_RAISE_READ_TIMEOUT_MS as xc, isPublicAddress as xi, isPubkyProofFolder as xn, edgeParams as xo, mergeLobby as xr, handoffStreamKey as xs, isAtprotoDid as xt, readAppBundle as y, RateWindow as ya, webCryptoSigner as yc, domainWellKnownFile as yi, PUBKY_PROOF_MAX_BYTES as yn, rosterHas as yo, lobbyRecords as yr, handoffReleaseFrame as ys, atprotoProofRkey as yt, GROUP_WAKE_FRAME as z, ITEM_STATES as za, currentRelays as zc, emptyIdentityLedger as zi, GhostLink as zn, callSignalHeardAt as zo, PIN_LIMITS as zr, verifySetUpdate as zs, didWebFileUrl as zt };
 
-//# sourceMappingURL=src-aKGjb_yz.js.map
+//# sourceMappingURL=src-_FzJkeAJ.js.map