@ghostlytools/cli 1.2.1 → 1.2.3

package/dist/ghostly.mjs

@@ -1,18 +1,18 @@
 #!/usr/bin/env node
 import { t as __exportAll } from "./assets/rolldown-runtime-8H4AJuhK.js";
-import { $ as SSHSIG_NAMESPACE, $a as appRef, $c as randomBytes$1, $n as engineError, An as encodeDnsQuery, Ao as RTC_CONFIG, At as didJwsAlg, Ba as cardLine, Bn as resolveLightningDestination, Bt as parseDidSignaturePaste, Cn as homeserverWebEndpoint, Ct as DID_DOCUMENT_MAX_BYTES$1, Dn as dnsProofName, Dt as checkDidJws, En as decodeDnsResponse, Eo as LIMITS, Et as DidError, Fa as PR_CHECKS, Fn as recordsFromWellKnown, Fo as extractParamsFromSdp, Ft as didWebFileUrl, Ha as checkStatusCard, Hc as openRelayPayload, Ht as staticDidDocument, Ia as PR_STATES, Ii as identityStatement, In as recordsName, Io as parseCallSignal, It as didWebHost, Jt as resolveDidDht, Ki as irohDescriptor, Kr as sanitizeTypingStatus, La as RUN_RESULTS, Ln as txtValue, Lo as signalHasVideo, Lt as normalizeDid, Ma as replySnippet, Mn as nip05RootKey, Mo as buildSdpFromSignal, Mt as didWebDocumentUrl, Nc as setLinkTraceSink, Ni as boundVerifiedIdentity, Nn as normalizeDomain, No as callRtcConfig, Nt as didWebFile, On as domainTxtRecord, Ot as checkDidSignature, Pa as ITEM_STATES, Pn as recordsFromTxt, Po as callSignalHeardAt, Pt as didWebFileNames, Qa as appFingerprint, Qc as fromBase64Url$1, Ra as STATUS_CARD_LIMITS, Rn as wellKnownUrl, Rt as parseDid, Sn as pubkyProofPath, So as GhostlyHttpError, St as verifyAtprotoRecordProof, Tn as DOMAIN_FILE_MAX_BYTES, Ur as TYPING_KINDS, Ut as strictBase64Url, Va as cardUrl, Vn as decodeBolt11, Vr as transferEnded, Vt as signingKeys, Wr as TYPING_REFRESH_MS, Xa as APP_PREFIXES, Xc as sanitizeAvatar, Yc as MAX_AVATAR_LENGTH, Z as groupName, Za as APP_STATEMENT_LIMITS, _ as readAppBundle, _n as isPubkyProofFolder, _t as isAtprotoDid, aa as PLAYABLE_AUDIO, ao as signAppObject, ar as fetchesByItself, at as verifySshSignature, bn as pubkyProofCapability, bt as shortAtprotoDid, c as signAppStore, ca as fileMessageText, ci as checkPushEndpoint, co as canonicalJsonBytes, ct as decodeAnyBitcoinAddress, dr as readGroupWantNo, dt as ATPROTO_PROOF_COLLECTION, ea as readImageMeta, el as toBase64Url, eo as checkAppRevokeStatement, er as engineText, et as SshSigError, ft as ATPROTO_PROOF_SCOPE, g as isAppUrl, gn as isPubkyKey, gt as checkAtprotoProofRecord, h as checkAppManifest, hn as PUBKY_PROOF_MAX_BYTES, ht as atprotoProofRkey, ia as sanitizeMime, in as WALLET_NETWORKS, io as readAppRevocations, ir as GROUP_WANT_NO_FRAME, it as sshSignCommand, ji as IdentityCheckUnavailable, jn as isPublicAddress, jo as answersOffer, jt as didSignedMessages, kn as domainWellKnownFile, ko as CALL_SIGNAL_MAX_AGE_MS, kt as didGhostlyServiceEntry, l as APP_BUNDLE_LIMITS, la as parseVoiceMeta, ln as walletNetworkOf, lr as readGroupHave, lt as ATPROTO_DECLARED_SCOPE, m as assembleAppBundle, ma as RateWindow, mt as atprotoProofRecord, n as appStoreDecision, nc as inviteLink, nl as utf8Decode, nr as GROUP_HAVE_FRAME, nt as parseSshSignature, o as checkAppStoreIndex, oa as VOICE_LIMITS, oo as signAppRevocation, or as groupFileFallback, ot as verifyBitcoinMessage, pc as seedSigner, pi as BUTTONS_CAPABILITY, pt as atprotoDidMethod, qi as irohRelayUrl, ra as sanitizeFileName, rl as utf8Encode, rt as sameSshKey, s as readAppStore, sa as baseMime, so as canonicalJson, sr as isGroupMessageId, st as BitcoinAddressError, tl as toZ32, tr as GROUP_FILE_LIMITS, tt as parseSshPublicKey, ua as voicePeaksOf, ur as readGroupWant, ut as ATPROTO_FULL_SCOPE, vn as newPubkyProofFolder, vt as normalizeAtprotoHandle, wn as pubkyHomeserverOf, wt as DID_FILE_MAX_BYTES, xn as pubkyProofFile, xt as AtprotoProofError, yn as normalizePubkyKey, yt as parseAtprotoDidDocument, za as buttonLabelClash, zc as RELAY_PAYLOAD_MAX_BYTES, zn as requestLnurlInvoice, zr as ChatFiles, zt as parseDidDocument } from "./assets/src-aKGjb_yz.js";
+import { $n as readGroupHave, An as resolveLightningDestination, At as DidError, Ba as PR_CHECKS, Bo as extractParamsFromSdp, Bt as didWebHost, Ci as normalizeDomain, Cn as normalizePubkyKey, Ct as parseAtprotoDidDocument, Di as txtValue, Dn as homeserverWebEndpoint, Do as GhostlyHttpError, Dt as DID_DOCUMENT_MAX_BYTES$1, Ei as recordsName, En as pubkyProofPath, Et as verifyAtprotoRecordProof, Fo as RTC_CONFIG, Ft as didSignedMessages, Ga as cardLine, Gn as GROUP_FILE_LIMITS, Gt as signingKeys, Ha as RUN_RESULTS, Ho as signalHasVideo, Ht as parseDid, Ii as IdentityCheckUnavailable, Io as answersOffer, Ir as sanitizeTypingStatus, It as didWebDocumentUrl, Jn as GROUP_WANT_NO_FRAME, Ka as cardUrl, Kn as GROUP_HAVE_FRAME, Kt as staticDidDocument, La as replySnippet, Lo as buildSdpFromSignal, Lt as didWebFile, Mt as checkDidSignature, Nr as TYPING_KINDS, Nt as didGhostlyServiceEntry, Oi as wellKnownUrl, On as pubkyHomeserverOf, Ot as DID_FILE_MAX_BYTES, Po as CALL_SIGNAL_MAX_AGE_MS, Pr as TYPING_REFRESH_MS, Pt as didJwsAlg, Qi as irohRelayUrl, Qr as checkPushEndpoint, Qt as resolveDidDht, Ri as boundVerifiedIdentity, Ro as callRtcConfig, Rt as didWebFileNames, Si as nip05RootKey, Sn as newPubkyProofFolder, St as normalizeAtprotoHandle, Ti as recordsFromWellKnown, Tn as pubkyProofFile, Tt as AtprotoProofError, Ua as STATUS_CARD_LIMITS, Un as engineError, Ut as parseDidDocument, Va as PR_STATES, Vc as setLinkTraceSink, Vi as identityStatement, Vo as parseCallSignal, Vt as normalizeDid, Wa as buttonLabelClash, Wn as engineText, Wt as parseDidSignaturePaste, Xc as openRelayPayload, Xn as groupFileFallback, Yn as fetchesByItself, Zi as irohDescriptor, Zn as isGroupMessageId, _ as checkAppManifest, _i as dnsProofName, _t as atprotoDidMethod, aa as readImageMeta, ao as checkAppRevokeStatement, at as parseSshPublicKey, bi as encodeDnsQuery, bn as isPubkyKey, bt as checkAtprotoProofRecord, c as readAppStore, ca as sanitizeFileName, cl as toBase64Url, cn as WALLET_NETWORKS, ct as sshSignCommand, d as APP_BUNDLE_LIMITS, da as VOICE_LIMITS, dl as utf8Encode, do as signAppRevocation, dt as BitcoinAddressError, er as readGroupWant, fa as baseMime, fo as canonicalJson, ft as decodeAnyBitcoinAddress, g as assembleAppBundle, gi as decodeDnsResponse, gt as ATPROTO_PROOF_SCOPE, ha as voicePeaksOf, hi as DOMAIN_FILE_MAX_BYTES, ht as ATPROTO_PROOF_COLLECTION, il as sanitizeAvatar, io as appRef, it as SshSigError, jn as decodeBolt11, jo as LIMITS, jr as transferEnded, jt as checkDidJws, kn as requestLnurlInvoice, kr as ChatFiles, la as sanitizeMime, ll as toZ32, lo as readAppRevocations, lt as verifySshSignature, ma as parseVoiceMeta, mt as ATPROTO_FULL_SCOPE, n as appStoreDecision, no as APP_STATEMENT_LIMITS, ol as fromBase64Url$1, ot as parseSshSignature, pa as fileMessageText, pn as walletNetworkOf, po as canonicalJsonBytes, pt as ATPROTO_DECLARED_SCOPE, qa as checkStatusCard, qc as RELAY_PAYLOAD_MAX_BYTES, qt as strictBase64Url, ri as BUTTONS_CAPABILITY, rl as MAX_AVATAR_LENGTH, ro as appFingerprint, rt as SSHSIG_NAMESPACE, s as checkAppStoreIndex, sc as inviteLink, sl as randomBytes$1, st as sameSshKey, to as APP_PREFIXES, tr as readGroupWantNo, tt as groupName, u as signAppStore, ua as PLAYABLE_AUDIO, ul as utf8Decode, uo as signAppObject, ut as verifyBitcoinMessage, v as isAppUrl, vc as seedSigner, vi as domainTxtRecord, vt as atprotoProofRecord, wi as recordsFromTxt, wn as pubkyProofCapability, wt as shortAtprotoDid, xi as isPublicAddress, xn as isPubkyProofFolder, xt as isAtprotoDid, y as readAppBundle, ya as RateWindow, yi as domainWellKnownFile, yn as PUBKY_PROOF_MAX_BYTES, yt as atprotoProofRkey, za as ITEM_STATES, zo as callSignalHeardAt, zt as didWebFileUrl } from "./assets/src-_FzJkeAJ.js";
 import { c as fileStore, f as store$1, i as STORES, m as wrap, o as databaseName, p as transact, u as openDb } from "./assets/idb-CTF6LF5B.js";
 import { a as fileBytesOf, i as fileBytes, l as FILE_BYTES_STEP } from "./assets/fileBytes-BcYZhNgF.js";
 import { createRequire } from "node:module";
 import { spawn } from "node:child_process";
 import { connect, createServer, isIP } from "node:net";
-import { appendFileSync, chmodSync, closeSync, existsSync, fsyncSync, lstatSync, mkdirSync, openAsBlob, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, writeSync } from "node:fs";
+import { accessSync, appendFileSync, chmodSync, closeSync, constants, existsSync, fsyncSync, lstatSync, mkdirSync, openAsBlob, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, writeSync } from "node:fs";
 import { ed25519 } from "@noble/curves/ed25519.js";
 import { sha256 } from "@noble/hashes/sha2.js";
 import { createBase58check } from "@scure/base";
 import { schnorr } from "@noble/curves/secp256k1.js";
 import { wordlist } from "@scure/bip39/wordlists/english.js";
-import { access, constants, link, mkdir, open, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
+import { access, constants as constants$1, link, mkdir, open, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { createHash, createPrivateKey, generateKeyPairSync, randomBytes, timingSafeEqual } from "node:crypto";
 import { decode, npubEncode } from "nostr-tools/nip19";
@@ -35,7 +35,7 @@ import { IDBFactory, IDBKeyRange as IDBKeyRange$1, IDBTransaction } from "fake-i
 import { format } from "node:util";
 var package_default = {
 	name: "@ghostlytools/cli",
-	version: "1.2.1",
+	version: "1.2.3",
 	type: "module",
 	description: "Ghostly for bots and terminals: the app's own engine, headless on Node, behind a daemon and a `ghostly` command with JSON output.",
 	license: "MIT",
@@ -285,15 +285,21 @@ function parseArgs(argv, spec, idSlot = () => false) {
 }
 /** The global option a word names (`--profile`, `--profile=bot`, `-p`), else undefined. */
 function globalOption(arg) {
+	const name = globalName(arg);
+	return name ? GLOBAL_OPTIONS[name] : void 0;
+}
+/** The name of the global option a word names (`profile` for `-p`), else undefined. */
+function globalName(arg) {
 	const eq = arg.indexOf("=");
 	const name = arg.startsWith("--") ? arg.slice(2, eq === -1 ? void 0 : eq) : arg.length === 2 && arg.startsWith("-") ? Object.entries(GLOBAL_OPTIONS).find(([, o]) => o.short === arg.slice(1))?.[0] : void 0;
-	return name && Object.hasOwn(GLOBAL_OPTIONS, name) ? GLOBAL_OPTIONS[name] : void 0;
+	return name && Object.hasOwn(GLOBAL_OPTIONS, name) ? name : void 0;
 }
 /**
 * Global options given before the command (`ghostly --profile bot send …`) move after it, where every command's
 * parser reads them. Stops at `--` and at the first word that is not a global option. They go before the first word
 * after the command's that starts with a dash (its first option, or the `--` that ends them), else at the end: never
-* between an option and its value, which may itself be `--` (`--pretty profile set --name --`).
+* between an option and its value, which may itself be `--` (`--pretty profile set --name --`). One that takes a value
+* and is the last word has none: a usage error.
 */
 function liftGlobals(argv) {
 	const lifted = [];
@@ -304,6 +310,7 @@ function liftGlobals(argv) {
 		const option = globalOption(arg);
 		if (!option || arg === "--") break;
 		const takesValue = option.type !== "boolean" && eq === -1;
+		if (takesValue && i + 1 >= argv.length) throw new CliError("usage", `--${globalName(arg)} needs a value`);
 		lifted.push(...argv.slice(i, i + (takesValue ? 2 : 1)));
 		i += takesValue ? 2 : 1;
 	}
@@ -335,14 +342,26 @@ var SECRET_CONTEXT = /priv(?:ate)?[\s_-]*key|secret|seed|mnemonic|nsec|xprv|\bwi
 /** How far from a 64-hex string a word like "seed" still counts as saying what it is. */
 var CONTEXT_REACH = 48;
 var CASHU_TOKEN = /\bcashu([AB])([A-Za-z0-9_\-+/]{20,}={0,2})/g;
+/**
+* Characters that take no room on screen: format characters (zero-width space, soft hyphen, word joiner, the joiners,
+* direction marks), control characters that are not white space, variation selectors, the grapheme joiner and the
+* Hangul fillers. A page, a PDF or a terminal puts some of them into long strings as places to break a line.
+*/
+var INVISIBLE = /(?![\t\n\v\f\r\x85])[\p{Cc}\p{Cf}]|\u034f|[\u115f\u1160\u3164\uffa0]|[\ufe00-\ufe0f]|[\u{e0100}-\u{e01ef}]/gu;
 var base58check = createBase58check(sha256);
-/** The first secret in `text`, keys and seeds before ecash; null for anything else. */
+/**
+* The first secret in `text`, keys and seeds before ecash; null for anything else. The text is read as it is and as
+* it reads without its invisible characters: a key with one inside is whole again once the reader takes it out.
+*/
 function findSecret(text) {
-	if (hasMnemonic(text)) return { kind: "mnemonic" };
-	if (NSEC.test(text)) return { kind: "nsec" };
-	if (EXTENDED_PRIVATE.test(text) || hasWif(text)) return { kind: "bitcoin-key" };
-	if (hasHexSecret(text)) return { kind: "hex-key" };
-	return findCashu(text);
+	const visible = text.replace(INVISIBLE, "");
+	const readings = visible === text ? [text] : [text, visible];
+	if (readings.some(hasMnemonic)) return { kind: "mnemonic" };
+	if (readings.some((reading) => NSEC.test(reading))) return { kind: "nsec" };
+	if (readings.some((reading) => EXTENDED_PRIVATE.test(reading) || hasWif(reading))) return { kind: "bitcoin-key" };
+	if (readings.some(hasHexSecret)) return { kind: "hex-key" };
+	const tokens = readings.map(findCashu);
+	return tokens.find((found) => found?.kind === "cashu" && found.amount !== null) ?? tokens.find((found) => found) ?? null;
 }
 /**
 * 12 to 24 words in a row from the English BIP39 list whose checksum holds, anywhere in the text; or a message that
@@ -875,7 +894,8 @@ function findGroup(groups, ref) {
 * A chat or a group, where a command takes either: `group:<id>` is a group; anything else a chat first (`findChat`),
 * then a group. A chat found only by the name its contact gave itself never takes what also names a group: a group's
 * own id is that group, and a prefix or the name of a group this profile is in is refused, with both ids. With neither,
-* the error says what `findChat` would.
+* one `not_found` names both and where to look (a contact's key: no chat with it); a name that matches more than one
+* chat or group stays that error.
 */
 function findChatOrGroup(links, groups, ref) {
 	if (ref.startsWith("group:")) return { group: findGroup(groups, ref.slice(6)) };
@@ -887,7 +907,9 @@ function findChatOrGroup(links, groups, ref) {
 		try {
 			return { group: findGroup(groups, ref) };
 		} catch (inner) {
-			throw inner instanceof CliError && inner.code !== "not_found" ? inner : error;
+			if (!(inner instanceof CliError) || inner.code !== "not_found") throw inner;
+			if (CONTACT_KEY.test(ref)) throw error;
+			throw new CliError("not_found", `No chat or group ${JSON.stringify(ref)} (ghostly chat list, ghostly group list)`);
 		}
 	}
 	if (!chat.theirName) return { link: chat.link };
@@ -916,6 +938,16 @@ function chatOrGroup(ctx, ref) {
 	};
 }
 var groupOf = (ctx, params) => findGroup(state(ctx).groups, str(params, "group", true));
+/**
+* A message of a chat or a group (`group:<id>`) named by its id here, read as one row; only a name that is no such
+* row's key (the id both sides know, `wireId`) reads the whole history. `keep`: only a message it accepts (mine, or
+* someone else's). The history is synchronous work on the daemon's one thread, about 120 ms at 10,000 messages.
+*/
+async function messageOf(ctx, linkId, ref, keep = () => true) {
+	const found = await node(ctx).getMessage(linkId, ref);
+	if (found && keep(found)) return found;
+	return (linkId.startsWith("group:") ? await node(ctx).groupMessages({ groupId: linkId.slice(6) }) : await node(ctx).getMessages(linkId)).find((m) => keep(m) && m.wireId === ref);
+}
 /** Resolves with `check`'s first defined answer: now, or on a later state; `timeout` error after `ms`. */
 function waitForState(ctx, check, ms, what) {
 	const now = check(state(ctx));
@@ -1131,6 +1163,12 @@ var storedGroupFiles = {
 	read: (file, offset, length) => readStored(file, offset, length),
 	room: async () => (await fileBytes()).room()
 };
+/**
+* Ended transfers an edge keeps the record of. A late frame for one of them is still answered as files/3 says (an abort
+* to an asker going on with a transfer cancelled here); older ones are forgotten, so an edge's records stay few
+* however many transfers it has seen.
+*/
+var ENDED_KEPT = 8;
 /** Why a want waits, as the person reads it (the app shows its own words for each `wait`). */
 var WAITING_NOTES = {
 	nobody: "Nobody you are connected to has this file yet",
@@ -1164,7 +1202,10 @@ var GroupFileDesk = class {
 	constructor(deps) {
 		this.deps = deps;
 	}
-	/** At start: each group's files as they were kept. One fetched by itself, or asked for, and not here yet is asked for again. */
+	/**
+	* At start: each group's files as they were kept. One fetched by itself, or asked for, and not here yet is asked for
+	* again; with automatic downloads off, one chosen by itself before waits for a Download instead.
+	*/
 	async load(groupIds) {
 		for (const groupId of groupIds) for (const file of await this.deps.store.list(groupId).catch(() => [])) {
 			if (!file.group || !file.metadata || !file.digest || this.kept.has(file.id)) continue;
@@ -1205,7 +1246,8 @@ var GroupFileDesk = class {
 				retry: true,
 				error: file.transfer.error ?? DAMAGED$1
 			});
-			else if (kept.auto || kept.asked) this.wants.set(kept.id, this.newWant());
+			else if (kept.asked || kept.auto && this.deps.settings().autoDownloads) this.wants.set(kept.id, this.newWant());
+			else if (kept.auto) await this.stop(kept, false);
 			else this.show(kept, {
 				state: "transferring",
 				stage: "asking",
@@ -1230,8 +1272,58 @@ var GroupFileDesk = class {
 		}
 	}
 	/**
+	* The person stops a file that is coming, or that this device would fetch (Cancel, Decline): nobody is asked for it
+	* any more, the transfer under way ends, what came of it is deleted, and it waits for a Download. Paused (`keep`),
+	* what came stays, and Resume (`download`) goes on from there.
+	*/
+	async halt(fileId, keep = false) {
+		const kept = this.kept.get(fileId);
+		if (!kept) throw new Error("No such file");
+		if (keep && !this.wants.has(fileId)) return;
+		await this.stop(kept, keep);
+	}
+	/** Automatic downloads were turned off: files chosen by themselves and not here yet stop coming, and wait for a Download. */
+	async autoDownloadsOff() {
+		for (const kept of [...this.kept.values()]) if (kept.auto && !kept.asked && this.wants.has(kept.id)) await this.stop(kept, false);
+	}
+	async stop(kept, keep) {
+		if (kept.held || kept.mine) return;
+		const want = this.wants.get(kept.id);
+		this.wants.delete(kept.id);
+		const edge = want?.wire && want.linkId ? this.edgesById.get(want.linkId) : void 0;
+		const record = edge?.files.get("in", want.wire);
+		const { size } = kept.meta;
+		if (!keep) {
+			kept.stored = 0;
+			kept.fresh = true;
+		}
+		if (edge && record && !transferEnded(record)) {
+			if (!keep) kept.dropped = record.id;
+			edge.files.cancel("in", record.id);
+			edge.taking.delete(record.id);
+		} else if (!keep) kept.idle = (kept.idle ?? Promise.resolve()).then(() => this.deps.store.write(kept.id)).then((writer) => writer.discard()).catch(() => {});
+		this.show(kept, keep ? {
+			state: "transferring",
+			stage: "paused",
+			pausedBy: "me",
+			transferred: kept.stored ?? 0,
+			size,
+			direction: "in"
+		} : {
+			state: "transferring",
+			stage: "asking",
+			transferred: 0,
+			size,
+			direction: "in"
+		});
+		if (kept.auto || kept.asked) {
+			kept.auto = kept.asked = false;
+			await this.deps.store.patch(kept.id, { group: this.groupField(kept) }).catch(() => {});
+		}
+	}
+	/**
 	* An error when this group took as many announcements of mine as it takes in a minute, or as its members take from
-	* one member in `announceWindowMs` (past that they would get the text, not the file); null when one may go now.
+	* one member in `announceWindowMs` (past that they would not fetch the file by themselves); null when one may go now.
 	*/
 	mayAnnounce(groupId) {
 		const wait = Math.max(...this.sentPaces(groupId).map((pace) => pace.wait()));
@@ -1248,9 +1340,9 @@ var GroupFileDesk = class {
 		this.own.delete(`${groupId}\n${meta.d}`);
 	}
 	/**
-	* A message of the group announces a file (mine, or a member's): the file its row shows, or none when the member
-	* announced more than the group takes (its text shows). A member's is kept here unfetched, and fetched now when it is
-	* one this device takes by itself. The same message again (a catch-up, a whole copy) is the same file.
+	* A message of the group announces a file (mine, or a member's): the file its row shows. A member's is kept here
+	* unfetched, and fetched now when it is one this device takes by itself and the member announced no more than the
+	* group fetches that way. The same message again (a catch-up, a whole copy) is the same file.
 	*/
 	async announced(groupId, m, me) {
 		const known = this.byMessage.get(`${groupId}\n${m.id}`);
@@ -1292,9 +1384,9 @@ var GroupFileDesk = class {
 			this.queueHave(kept);
 			return messageFile(kept);
 		}
-		if (!this.pace(this.takenPace, `${groupId}\n${m.sender}`, GROUP_FILE_LIMITS.announceTaken, GROUP_FILE_LIMITS.announceWindowMs).take()) return void 0;
+		const paced = this.pace(this.takenPace, `${groupId}\n${m.sender}`, GROUP_FILE_LIMITS.announceTaken, GROUP_FILE_LIMITS.announceWindowMs).take();
 		const id = groupFileId(groupId, "in");
-		const auto = this.deps.settings().autoDownloads && fetchesByItself(m.file, this.keptAutomatically(groupId));
+		const auto = paced && this.deps.settings().autoDownloads && fetchesByItself(m.file, this.keptAutomatically(groupId));
 		const holders = this.ahead.get(`${groupId}\n${m.id}`) ?? [];
 		this.ahead.delete(`${groupId}\n${m.id}`);
 		const kept = {
@@ -1696,20 +1788,35 @@ var GroupFileDesk = class {
 		const reserved = active.reduce((sum, a) => sum + a.size, 0);
 		return this.served.bytes + reserved + kept.meta.size > GROUP_FILE_LIMITS.serveBytesPerDay ? "busy" : null;
 	}
-	/** Transfers served now, all groups together: to whom, their size, and whether bytes are still to go. */
+	/**
+	* Transfers served now, all groups together: to whom, what each takes of the day (its size, or what it sent when that
+	* is more), and whether bytes are still to go.
+	*/
 	servingNow() {
 		const active = [];
 		for (const edge of this.edgesById.values()) for (const wire of edge.serving.keys()) {
 			const record = edge.files.get("out", wire);
 			if (record && !transferEnded(record)) active.push({
 				peer: edge.peer,
-				size: record.file.size,
+				size: Math.max(record.file.size, edge.files.sent(wire)),
 				sending: record.confirmed < record.file.size
 			});
 		}
 		return active;
 	}
 	/**
+	* An asker has a served transfer send parts again (WISP 503 § Serving limits): every byte sent counts toward the day,
+	* so it goes on only while the day has room for it.
+	*/
+	mayResend() {
+		const today = Math.floor(this.deps.now() / 864e5);
+		if (this.served.day !== today) this.served = {
+			day: today,
+			bytes: 0
+		};
+		return this.served.bytes + this.servingNow().reduce((sum, a) => sum + a.size, 0) < GROUP_FILE_LIMITS.serveBytesPerDay;
+	}
+	/**
 	* Served transfers that no longer count end, their places free for others (WISP 503 § Serving limits): the asker's
 	* session closed, it is not in the roster any more, or its bytes have not moved for `wantWaitMs` (the asker has moved
 	* on by then).
@@ -1762,6 +1869,7 @@ var GroupFileDesk = class {
 			serving: /* @__PURE__ */ new Map(),
 			servedMoved: /* @__PURE__ */ new Map(),
 			taking: /* @__PURE__ */ new Map(),
+			ended: [],
 			have: /* @__PURE__ */ new Set(),
 			haveAt: 0,
 			busy: /* @__PURE__ */ new Set()
@@ -1779,7 +1887,8 @@ var GroupFileDesk = class {
 			openSource: (record) => this.openSource(edge, record),
 			changed: (record, transferred) => this.transferChanged(edge, record, transferred),
 			room: () => this.deps.store.room(),
-			writable: () => this.deps.writable?.(linkId)
+			writable: () => this.deps.writable?.(linkId),
+			resend: (record) => !edge.serving.has(record.id) || this.mayResend()
 		});
 		this.edgesById.set(linkId, edge);
 		return edge;
@@ -1818,7 +1927,7 @@ var GroupFileDesk = class {
 					if (resumed) kept.fresh = kept.unclear = true;
 					else kept.damaged.add(edge.peer);
 				}
-				return kept.idle = (damaged ? writer.discard() : writer.close()).catch(() => {});
+				return kept.idle = (damaged || kept.dropped === record.id ? writer.discard() : writer.close()).catch(() => {});
 			}
 		};
 	}
@@ -1831,7 +1940,14 @@ var GroupFileDesk = class {
 			digest: async () => kept.meta.d
 		};
 	}
+	/** A transfer on the edge ended: its record stays among the last `ENDED_KEPT`, and the oldest past that is forgotten. */
+	transferOver(edge, record) {
+		if (edge.ended.some(([direction, id]) => direction === record.direction && id === record.id)) return;
+		edge.ended.push([record.direction, record.id]);
+		while (edge.ended.length > ENDED_KEPT) edge.files.forget(...edge.ended.shift());
+	}
 	transferChanged(edge, record, transferred) {
+		if (transferEnded(record)) this.transferOver(edge, record);
 		if (record.direction === "out") {
 			if (transferEnded(record) && edge.serving.has(record.id)) {
 				const today = Math.floor(this.deps.now() / 864e5);
@@ -1839,7 +1955,7 @@ var GroupFileDesk = class {
 					day: today,
 					bytes: 0
 				};
-				this.served.bytes += record.confirmed;
+				this.served.bytes += edge.files.sent(record.id);
 				edge.serving.delete(record.id);
 				edge.servedMoved.delete(record.id);
 				const serving = this.deps.settings().serveFiles;
@@ -2584,7 +2700,7 @@ var FILE_METHODS = {
 			throw new CliError("not_found", `No file ${path}`);
 		}
 		if (!info.isFile()) throw new CliError("bad_request", `${path} is not a file`);
-		await access(path, constants.R_OK);
+		await access(path, constants$1.R_OK);
 		if ("group" in target) return sendToGroup(ctx, params, target.group, path, info.size);
 		const { link } = target;
 		if (link.profile && link.dataLink === "open" && !link.capabilities?.files) throw new CliError("unavailable", "The contact's app takes no files");
@@ -2671,15 +2787,16 @@ var FILE_METHODS = {
 	/**
 	* files/3: answer an offer, or pause, resume or cancel a transfer, either way; `resend` a file sent from here that
 	* stopped moving (or failed), `request` again one that stopped arriving. Without a chat, the file's id names it.
-	* A group's file (WISP 503) takes `accept` (download one this device did not fetch by itself) and `request`.
+	* A group's file (WISP 503) takes `accept` (download one this device did not fetch by itself), `request`, and `cancel`,
+	* `decline`, `pause` and `resume` for one that is coming.
 	*/
 	async "file.action"(ctx, params) {
 		const fileId = str(params, "file", true);
 		const { linkId, where } = fileChat(ctx, params, fileId);
 		const action = oneOf(params, "action", ACTIONS, "accept");
 		if ("group" in where) {
-			if (action !== "accept" && action !== "request") throw new CliError("bad_request", "A group's file is downloaded (file accept) or asked for again (file request)");
-			if (state(ctx).transfers[fileId]?.state === "done") throw new CliError("refused", "Nothing to ask for: the file is all here");
+			if (action === "resend") throw new CliError("bad_request", "A group's file is downloaded (file accept) or asked for again (file request)");
+			if (state(ctx).transfers[fileId]?.state === "done") throw new CliError("refused", action === "accept" || action === "request" || action === "resume" ? "Nothing to ask for: the file is all here" : "Nothing to stop: the file is all here");
 			try {
 				await node(ctx).fileAction({
 					linkId,
@@ -3346,8 +3463,7 @@ function pressable(link) {
 	return peer ? peer.includes(BUTTONS_CAPABILITY) : null;
 }
 /** The message of mine with buttons that `button update` names, by its id here (or the id both sides know). */
-function buttonsMessage(messages, ref, group) {
-	const message = messages.find((m) => m.sender === "me" && m.id === ref) ?? messages.find((m) => m.sender === "me" && m.wireId === ref);
+function buttonsMessage(message, ref, group) {
 	if (!message) throw new CliError("not_found", `No message ${JSON.stringify(ref)} of yours in this ${group ? "group" : "chat"}: the messageId send gave`);
 	if (message.card?.kind !== "buttons") throw new CliError("bad_request", "That message has no buttons: send one with send --button id:Label");
 	return message;
@@ -3367,7 +3483,7 @@ async function updateButtons(ctx, params) {
 		const secret = findSecret(newText);
 		if (secret) throw new CliError("confirm", `The text looks like ${secret.kind === "cashu" ? "a Cashu token (money anyone who reads it can take)" : "a secret (a seed or a private key)"}; update with --force if you mean to`, { kind: secret.kind });
 	}
-	const message = buttonsMessage(target.group ? await node(ctx).groupMessages({ groupId: target.id }) : await node(ctx).getMessages(target.linkId), ref, target.group);
+	const message = buttonsMessage(await messageOf(ctx, target.linkId, ref, (m) => m.sender === "me"), ref, target.group);
 	if ((message.edit?.seq ?? 0) >= STATUS_CARD_LIMITS.edits) throw new CliError("refused", `This message took ${STATUS_CARD_LIMITS.edits} updates, the most one takes: ask again with a new send`, {
 		messageId: message.id,
 		edits: message.edit.seq
@@ -3392,7 +3508,7 @@ async function updateButtons(ctx, params) {
 		card
 	});
 	if (result.error) throw new CliError(result.refused ? "refused" : "unavailable", result.error);
-	let edited = target.group ? (await node(ctx).groupMessages({ groupId: target.id })).find((m) => m.id === message.id) : await node(ctx).getMessage(target.linkId, message.id);
+	let edited = await node(ctx).getMessage(target.linkId, message.id);
 	if (wait === "confirmed" && edited?.edit?.pending) edited = await waitForEdit(ctx, target.linkId, message.id, ms);
 	const edges = wait === "sent" && edited?.edit ? await waitForGroupFrame(ctx, target.id, message.id, edited.edit.seq, ms) : void 0;
 	return {
@@ -3415,8 +3531,7 @@ async function pressButton(ctx, params) {
 	const ref = str(params, "message", true);
 	const buttonId = str(params, "button", true);
 	const where = target.group ? "group" : "chat";
-	const theirs = (target.group ? await node(ctx).groupMessages({ groupId: target.id }) : await node(ctx).getMessages(target.linkId)).filter((m) => m.sender !== "me");
-	const message = theirs.find((m) => m.id === ref) ?? theirs.find((m) => m.wireId === ref);
+	const message = await messageOf(ctx, target.linkId, ref, (m) => m.sender !== "me");
 	if (!message) throw new CliError("not_found", `No message ${JSON.stringify(ref)} from someone else in this ${where}: the id its event or history gave`);
 	if (message.card?.kind !== "buttons") throw new CliError("bad_request", "That message has no buttons");
 	const button = message.card.buttons.find((b) => b.id === buttonId);
@@ -3575,7 +3690,7 @@ function isLive(link) {
 	if (link.textDelivery !== "stream" || link.dataLink !== "open") return false;
 	return !link.profile || link.pairing?.status === "ready" && !!link.pairing.transport;
 }
-function chatJson(link) {
+function chatJson(link, showSecret) {
 	const label = link.label?.trim() || null;
 	const peerName = link.peerNick?.trim() || null;
 	const live = isLive(link);
@@ -3593,15 +3708,15 @@ function chatJson(link) {
 		pairing: link.pairing?.status ?? null,
 		stage: link.pairingProgress?.stage ?? null,
 		verified: !!link.peerVerified,
-		invite: link.pairing?.status === "ready" ? null : link.inviteCode ?? null,
+		invite: link.pairing?.status === "ready" || !link.inviteCode ? null : showSecret === true ? link.inviteCode : "<hidden>",
 		compatibility: !link.profile,
 		peerPicture: !!link.peerAvatar
 	};
 }
 /** A chat's details: the summary plus what its connection panel shows. */
-function chatDetailsJson(link) {
+function chatDetailsJson(link, showSecret) {
 	return {
-		...chatJson(link),
+		...chatJson(link, showSecret),
 		progress: link.pairingProgress ?? null,
 		transports: {
 			mine: link.availableTransports ?? [],
@@ -6057,7 +6172,8 @@ async function verifyIdToken(token, options) {
 }
 //#endregion
 //#region ../browser/src/proofs/oidc/flow.ts
-var STATE = /^(?:d\.\d{1,5}\.)?[A-Za-z0-9_-]{43}$/;
+/** Optional platform prefix (desktop `d.<port>.`, Android deep link `a.`), then 32 random bytes. */
+var STATE = /^(?:d\.\d{1,5}\.|a\.)?[A-Za-z0-9_-]{43}$/;
 function scopeFor$1(provider, reveal) {
 	const scopes = provider.id === "apple" ? [] : ["openid"];
 	const claims = [];
@@ -8612,13 +8728,15 @@ var IDENTITY_METHODS = {
 	},
 	async "identity.cancel"(ctx, params) {
 		const draftId = str(params, "draft", true);
-		drafts.delete(draftId);
+		if (!drafts.delete(draftId)) throw new CliError("not_found", "No such draft here: it is kept by the daemon that made it, for an hour");
 		await node(ctx).cancelIdentityProof({ draftId });
 		return { cancelled: draftId };
 	},
 	async "identity.remove"(ctx, params) {
-		await node(ctx).removeIdentityProof({ id: str(params, "id", true) });
-		return { removed: str(params, "id", true) };
+		const id = str(params, "id", true);
+		if (!state(ctx).identityProofs.some((p) => p.id === id)) throw new CliError("not_found", `No identity proof ${JSON.stringify(id)} (ghostly identity list)`);
+		await node(ctx).removeIdentityProof({ id });
+		return { removed: id };
 	},
 	async "identity.share"(ctx, params) {
 		const link = chatOf(ctx, params);
@@ -8633,13 +8751,15 @@ var IDENTITY_METHODS = {
 	},
 	async "identity.withdraw"(ctx, params) {
 		const link = chatOf(ctx, params);
+		const id = str(params, "id", true);
+		if (!link.identities?.shared.some((s) => s.id === id)) throw new CliError("not_found", `No identity proof ${JSON.stringify(id)} shared in this chat (ghostly identity contact ${link.id})`);
 		await node(ctx).withdrawIdentityProof({
 			linkId: link.id,
-			id: str(params, "id", true)
+			id
 		});
 		return {
 			chat: link.id,
-			withdrawn: str(params, "id", true)
+			withdrawn: id
 		};
 	},
 	/** What a contact shared in a chat, as this device checked it, and what this side shares there. */
@@ -8875,6 +8995,15 @@ async function proxy(request, response, chunks, send, cookies) {
 		plain(response, gone ? 503 : 502, gone ? "This service is not reachable. Services exist while their ghost is online." : `The request failed: ${error instanceof Error ? error.message : String(error)}`);
 	}
 }
+/**
+* The service a command names, by its id: one of this profile's. The engine changes nothing for an id it does not
+* know and says nothing, so a mistyped id read as done ("shared": true, with a contact).
+*/
+function serviceOf(ctx, params) {
+	const serviceId = str(params, "service", true);
+	if (!state(ctx).services.some((s) => s.id === serviceId)) throw new CliError("not_found", `No service ${JSON.stringify(serviceId)} (ghostly service list)`);
+	return serviceId;
+}
 var SERVICE_METHODS = {
 	async "service.list"(ctx) {
 		return { services: state(ctx).services.map((s) => ({
@@ -8901,29 +9030,32 @@ var SERVICE_METHODS = {
 		});
 	},
 	async "service.remove"(ctx, params) {
-		await node(ctx).removeService({ serviceId: str(params, "service", true) });
-		return { removed: str(params, "service", true) };
+		const serviceId = serviceOf(ctx, params);
+		await node(ctx).removeService({ serviceId });
+		return { removed: serviceId };
 	},
 	async "service.enable"(ctx, params) {
+		const serviceId = serviceOf(ctx, params);
 		await node(ctx).setServiceEnabled({
-			serviceId: str(params, "service", true),
+			serviceId,
 			enabled: !bool(params, "off")
 		});
 		return {
-			service: str(params, "service", true),
+			service: serviceId,
 			enabled: !bool(params, "off")
 		};
 	},
 	async "service.share"(ctx, params) {
 		const link = chatOf(ctx, params);
 		const shared = !bool(params, "off");
+		const serviceId = serviceOf(ctx, params);
 		await node(ctx).setServiceShared({
-			serviceId: str(params, "service", true),
+			serviceId,
 			peerPubKeyZ32: link.peerPubKeyZ32,
 			shared
 		});
 		return {
-			service: str(params, "service", true),
+			service: serviceId,
 			chat: link.id,
 			shared
 		};
@@ -12533,6 +12665,25 @@ function checkTextSize(text) {
 		max: LIMITS.maxChatMessageBytes
 	});
 }
+/**
+* The engine's state as `engine getState` prints it without `--show-secret`: the settings' credentials, a group's
+* entry link (anyone who reads it can join) and a pending chat's invite code (whoever reads it can take the chat)
+* are `<hidden>`.
+*/
+function hideStateSecrets(state) {
+	return {
+		...state,
+		settings: redactSettings(state.settings),
+		...state.groups ? { groups: state.groups.map((g) => g.entryLink ? {
+			...g,
+			entryLink: "<hidden>"
+		} : g) } : {},
+		...state.links ? { links: state.links.map((l) => l.inviteCode ? {
+			...l,
+			inviteCode: "<hidden>"
+		} : l) } : {}
+	};
+}
 /** Settings as a bot may read them: storage credentials and other secrets masked unless asked for. */
 function redactSettings(settings, showSecret = false) {
 	if (showSecret) return settings;
@@ -12560,7 +12711,9 @@ var SETTABLE = {
 	online: "boolean",
 	shareProfile: "boolean",
 	sendTyping: "boolean",
-	nick: "string"
+	nick: "string",
+	autoDownloads: "boolean",
+	serveFiles: "boolean"
 };
 var TRANSPORT_NAMES = {
 	auto: "auto",
@@ -12723,13 +12876,14 @@ var METHODS = {
 		node(ctx).setActiveLink({ linkId });
 		return { chat: linkId };
 	},
-	async "chat.list"(ctx) {
-		return { chats: state(ctx).links.map(chatJson).sort((a, b) => b.lastMessageAt - a.lastMessageAt || b.createdAt - a.createdAt) };
+	async "chat.list"(ctx, params) {
+		const showSecret = bool(params, "showSecret");
+		return { chats: state(ctx).links.map((link) => chatJson(link, showSecret)).sort((a, b) => b.lastMessageAt - a.lastMessageAt || b.createdAt - a.createdAt) };
 	},
 	async "chat.get"(ctx, params) {
 		const link = chatOf(ctx, params);
 		return {
-			...chatDetailsJson(link),
+			...chatDetailsJson(link, bool(params, "showSecret")),
 			heldUntil: holdOf(ctx, link.id)
 		};
 	},
@@ -12795,7 +12949,7 @@ var METHODS = {
 			messageId,
 			text
 		});
-		if (result.error) throw editRefused(await node(ctx).getMessages(link.id), messageId, "chat", result.error, result.refused);
+		if (result.error) throw editRefused(await messageOf(ctx, link.id, messageId), messageId, "chat", result.error, result.refused);
 		const id = result.messageId ?? messageId;
 		let message = await node(ctx).getMessage(link.id, id);
 		if (wait === "confirmed" && message?.edit?.pending) message = await waitForEdit(ctx, link.id, id, num(params, "timeout", 30, {
@@ -12849,7 +13003,7 @@ var METHODS = {
 	},
 	/** WISP 400 § Reactions: one emoji per person per message, a new one replaces mine; `remove` takes mine back. */
 	async "chat.react"(ctx, params) {
-		const link = chatOf(ctx, params);
+		const link = notAGroup(ctx, params, () => chatOf(ctx, params), "group react", "<message> <emoji>");
 		return {
 			chat: link.id,
 			...await react(ctx, link.id, params)
@@ -12886,10 +13040,12 @@ var METHODS = {
 		if (!messageIds.length) throw new CliError("bad_request", "Name the messages to forward (their ids, from history or an event)");
 		const to = list(params, "to").map((ref) => chatOrGroup(ctx, ref));
 		if (!to.length) throw new CliError("bad_request", "Forward to which chat? Name one or more with --to");
-		const history = from.group ? await node(ctx).groupMessages({ groupId: from.id }) : await node(ctx).getMessages(from.id);
-		const chosen = messageIds.map((id) => history.find((m) => m.id === id) ?? (() => {
-			throw new CliError("not_found", `No message ${id} in this ${from.group ? "group" : "chat"}`);
-		})());
+		const chosen = [];
+		for (const id of messageIds) {
+			const message = await node(ctx).getMessage(from.linkId, id);
+			if (!message) throw new CliError("not_found", `No message ${id} in this ${from.group ? "group" : "chat"}`);
+			chosen.push(message);
+		}
 		if (!bool(params, "force")) for (const message of chosen) {
 			const secret = message.file ? null : findSecret(message.text);
 			if (secret) throw new CliError("confirm", `A message looks like ${secret.kind === "cashu" ? "a Cashu token (money anyone who reads it can take)" : "a secret (a seed or a private key)"}; forward it with --force if you mean to`, {
@@ -12923,7 +13079,7 @@ var METHODS = {
 				await waitForGroupFrame(ctx, to[i].id, messageId, void 0, ms);
 				continue;
 			}
-			const sent = (await node(ctx).getMessages(to[i].id)).find((m) => m.id === messageId);
+			const sent = await node(ctx).getMessage(to[i].id, messageId);
 			if (sent?.file) await FILE_METHODS["file.wait"](ctx, {
 				chat: to[i].id,
 				file: sent.file.id,
@@ -12943,19 +13099,21 @@ var METHODS = {
 	},
 	async "chat.retry"(ctx, params) {
 		const link = chatOf(ctx, params);
+		const messageId = str(params, "message", true);
+		if (!await node(ctx).getMessage(link.id, messageId)) throw new CliError("not_found", `No message ${messageId} in this chat`);
 		await node(ctx).retryMessage({
 			linkId: link.id,
-			messageId: str(params, "message", true)
+			messageId
 		});
 		return {
 			chat: link.id,
-			messageId: params.message
+			messageId
 		};
 	},
 	async "chat.delete"(ctx, params) {
 		const link = chatOf(ctx, params);
 		const messageId = str(params, "message", true);
-		if (!(await node(ctx).getMessages(link.id)).some((m) => m.id === messageId)) throw new CliError("not_found", `No message ${messageId} in this chat`);
+		if (!await node(ctx).getMessage(link.id, messageId)) throw new CliError("not_found", `No message ${messageId} in this chat`);
 		await node(ctx).deleteMessage({
 			linkId: link.id,
 			messageId
@@ -13071,7 +13229,13 @@ var METHODS = {
 		};
 	},
 	async "group.join"(ctx, params) {
-		const { groupId } = await node(ctx).joinGroupByLink({ link: str(params, "link", true) });
+		let groupId;
+		try {
+			({groupId} = await node(ctx).joinGroupByLink({ link: str(params, "link", true) }));
+		} catch (error) {
+			if (error instanceof Error && error.message === "This is not a link to a group") throw new CliError("bad_request", error.message);
+			throw error;
+		}
 		return { group: groupId };
 	},
 	async "group.list"(ctx, params) {
@@ -13140,15 +13304,16 @@ var METHODS = {
 		}
 		const mentions = mentionsFor(text, list(params, "mentions"), group);
 		const wait = oneOf(params, "wait", ["none", "sent"], "none");
-		const before = (await node(ctx).groupMessages({ groupId: group.id })).find((m) => m.id === messageId)?.edit?.seq ?? 0;
+		const linkId = `group:${group.id}`;
+		const before = (await node(ctx).getMessage(linkId, messageId))?.edit?.seq ?? 0;
 		const result = await node(ctx).editMessage({
-			linkId: `group:${group.id}`,
+			linkId,
 			messageId,
 			text,
 			...mentions.length ? { mentions } : {}
 		});
-		if (result.error) throw editRefused(await node(ctx).groupMessages({ groupId: group.id }), messageId, "group", result.error, result.refused);
-		const message = (await node(ctx).groupMessages({ groupId: group.id })).find((m) => m.id === messageId);
+		if (result.error) throw editRefused(await messageOf(ctx, linkId, messageId), messageId, "group", result.error, result.refused);
+		const message = await node(ctx).getMessage(linkId, messageId);
 		const edits = message?.edit?.seq ?? 0;
 		if (edits === before) return {
 			group: group.id,
@@ -13314,12 +13479,32 @@ function groupSendRefused(error) {
 	return new CliError("unavailable", error);
 }
 /**
+* A chat command given a group's id, prefix or name: `not_found` that says it is a group, with the group command that
+* takes it (`react` on a group, where `group react` is meant). A name no chat and no group has stays the chat's error.
+*/
+function notAGroup(ctx, params, chat, command, rest) {
+	try {
+		return chat();
+	} catch (error) {
+		if (!(error instanceof CliError) || error.code !== "not_found") throw error;
+		const ref = str(params, "chat", true);
+		let group;
+		try {
+			group = findGroup(state(ctx).groups, ref);
+		} catch {
+			throw error;
+		}
+		const shown = /^[\w.:-]+$/.test(ref) ? ref : JSON.stringify(ref);
+		throw new CliError("not_found", `${JSON.stringify(ref)} is a group, not a chat: ghostly ${command} ${shown} ${rest}`, { group: group.id });
+	}
+}
+/**
 * An edit the engine refused. A message that is not in the chat or group at all is `not_found` (exit 3), naming the id
 * to give, as `button update` and `task update` do; before, a mistyped or lost id read "Only your own text messages
 * can be edited" (`refused`, exit 1), as if the message were someone else's.
 */
-function editRefused(messages, ref, where, error, refused) {
-	if (refused && !messages.some((m) => m.id === ref || m.wireId === ref)) return new CliError("not_found", `No message ${JSON.stringify(ref)} in this ${where}: give the messageId ${where === "group" ? "group send" : "send"} printed`);
+function editRefused(message, ref, where, error, refused) {
+	if (refused && !message) return new CliError("not_found", `No message ${JSON.stringify(ref)} in this ${where}: give the messageId ${where === "group" ? "group send" : "send"} printed`);
 	return new CliError(refused ? "refused" : "unavailable", error);
 }
 /**
@@ -14482,6 +14667,11 @@ var showSecret = { "show-secret": {
 	type: "boolean",
 	description: "Print the group's entry link (anyone who has it can join)"
 } };
+/** A pending chat's invite code lets whoever reads it take the chat: printed only when asked for. */
+var showInvite = { "show-secret": {
+	type: "boolean",
+	description: "Print a pending chat's invite code (whoever has it can take the chat)"
+} };
 var secret = (options) => options["show-secret"] === true ? { showSecret: true } : {};
 /**
 * `--for` of the typing commands: the seconds it is kept on, 1 to 600, and never with `--stop`. A usage error (exit 2)
@@ -15050,8 +15240,10 @@ var commands$6 = {
 	},
 	"chat list": {
 		method: "chat.list",
-		usage: "chat list",
-		summary: "Chats, newest first"
+		usage: "chat list [--show-secret]",
+		summary: "Chats, newest first (a pending invite code only with --show-secret)",
+		options: showInvite,
+		params: ({ options }) => secret(options)
 	},
 	"chat remove": {
 		method: "chat.remove",
@@ -15079,10 +15271,14 @@ var commands$6 = {
 	},
 	"chat show": {
 		method: "chat.get",
-		usage: "chat show <chat>",
-		summary: "One chat and its connection",
+		usage: "chat show <chat> [--show-secret]",
+		summary: "One chat and its connection (its pending invite code only with --show-secret)",
 		args: ["chat"],
-		params: (_, { chat }) => ({ chat })
+		options: showInvite,
+		params: ({ options }, { chat }) => ({
+			chat,
+			...secret(options)
+		})
 	},
 	"chat transport": {
 		method: "chat.transport",
@@ -17173,6 +17369,14 @@ var refuseAnswers = Number(process.env.GHOSTLY_CALL_REFUSE_ANSWERS) || 0;
 var GATHER_MS = 5e3;
 var SETTLE_MS = 400;
 /**
+* With a candidate in (a host one comes in milliseconds), the server reflexive one is waited for this long at most,
+* not the whole of `GATHER_MS`: a STUN server that answers does in tens of milliseconds, and one that never does (UDP
+* to it blocked, as on many office, school and hotel networks) made every call ring 5 s late and connect 5 s after
+* the answer. The apps' calls and the chats' data link bound theirs the same way (`HOST_GATHER_MS`,
+* `OFFER_HOST_GATHER_MS`).
+*/
+var HOST_GATHER_MS = 2e3;
+/**
 * One call's peer connection. Its SDP never travels: the compact signal does (`local`), and each side rebuilds the
 * other's SDP from it (`buildSdpFromSignal`), so the payload types, SSRC and mids here are the ones that rebuilt SDP
 * uses: audio is mid 0, Opus is 111 unless the contact's offer says otherwise.
@@ -17244,7 +17448,7 @@ var CallMedia = class CallMedia {
 			const track = pc.addTrack(audioSection);
 			let videoTrack = null;
 			if (offer?.m?.includes("v")) {
-				const video = new ndc.Video(String(offer.m.indexOf("v")), "RecvOnly");
+				const video = new ndc.Video(String(offer.m.indexOf("v")), "Inactive");
 				video.addVP8Codec(offer.vp ?? 96);
 				videoTrack = pc.addTrack(video);
 				videoTrack.onMessage(() => {});
@@ -17263,6 +17467,7 @@ var CallMedia = class CallMedia {
 				ss: [ssrc]
 			};
 			if (offer?.m) local.m = [...offer.m];
+			if (videoTrack) local.vr = 0;
 			const listeners = [];
 			track.onMessage((packet) => {
 				for (const listener of listeners) listener(packet);
@@ -17343,20 +17548,26 @@ function mdnsNote(signal, log) {
 		lookup(host, { all: true }).then((found) => log(`${host} resolves here to ${found.map((a) => a.address).join(", ")}`), () => log(`${host} does not resolve here: the call connects only if the contact's checks reach this side`));
 	}
 }
-/** Resolves once the local description has its candidates (see GATHER_MS). */
+/** Resolves once the local description has its candidates (see GATHER_MS and HOST_GATHER_MS). */
 function gathering(pc) {
 	return new Promise((resolve) => {
 		let settle = null;
+		let any = false;
 		const done = () => {
 			clearTimeout(cap);
+			clearTimeout(bounded);
 			if (settle) clearTimeout(settle);
 			resolve();
 		};
 		const cap = setTimeout(done, GATHER_MS);
+		const bounded = setTimeout(() => {
+			if (any) done();
+		}, HOST_GATHER_MS);
 		pc.onGatheringStateChange((state) => {
 			if (state === "complete") done();
 		});
 		pc.onLocalCandidate((candidate) => {
+			any = true;
 			if (!settle && / typ srflx/.test(candidate)) settle = setTimeout(done, SETTLE_MS);
 		});
 	});
@@ -18012,23 +18223,15 @@ var EventHub = class {
 			request.onsuccess = () => resolve(request.result);
 			request.onerror = () => reject(request.error);
 		});
-		const rows = await new Promise((resolve, reject) => {
-			const out = [];
-			const request = this.db.transaction(SEEN).objectStore(SEEN).openCursor();
-			request.onsuccess = () => {
-				const cursor = request.result;
-				if (!cursor) return resolve(out);
-				out.push({
-					key: cursor.key,
-					value: cursor.value
-				});
-				cursor.continue();
-			};
+		const store = this.db.transaction(SEEN).objectStore(SEEN);
+		const all = (request) => new Promise((resolve, reject) => {
+			request.onsuccess = () => resolve(request.result);
 			request.onerror = () => reject(request.error);
 		});
-		for (const { key, value } of rows) {
-			const [chat, id] = key;
-			this.seenOf(chat).set(id, value);
+		const [keys, values] = await Promise.all([all(store.getAllKeys()), all(store.getAll())]);
+		for (let i = 0; i < keys.length; i++) {
+			const [chat, id] = keys[i];
+			this.seenOf(chat).set(id, values[i]);
 		}
 		this.mentionsNoted = this.firstRun || this.seen.get(FORMAT)?.get(MENTIONS_NOTED) === "yes";
 	}
@@ -18514,8 +18717,13 @@ var EventHub = class {
 		}
 		if (changes.length) this.persist(key, changes);
 	}
+	/**
+	* Relaxed: nobody waits for it, and a note lost to a power cut is made again from the history at the next start
+	* (its event is then reported a second time, as after a crash between a message's row and its note). A disk sync
+	* for each one held the whole daemon for milliseconds, three times per message sent.
+	*/
 	persist(chat, changes) {
-		const store = this.db.transaction(SEEN, "readwrite").objectStore(SEEN);
+		const store = this.db.transaction(SEEN, "readwrite", { durability: "relaxed" }).objectStore(SEEN);
 		for (const [id, state] of changes) if (state === null) store.delete([chat, id]);
 		else store.put(state, [chat, id]);
 	}
@@ -18890,7 +19098,7 @@ function federationInfo(federationId, config) {
 	};
 }
 /** The first value a subscription gives that is final, or the last one within `waitMs`. */
-function watch(subscribe, final, waitMs) {
+function watch$1(subscribe, final, waitMs) {
 	return new Promise((resolve) => {
 		let last, done = false, cancel = () => {};
 		const finish = () => {
@@ -18961,13 +19169,13 @@ var RealClient = class {
 		return this.wallet.mint.tryCancelSpendNotes(operationId);
 	}
 	spendState(operationId, waitMs) {
-		return watch((ok, fail) => this.wallet.mint.subscribeSpendNotes(operationId, (s) => ok(SPEND[s] ?? "created"), fail), spendFinal, waitMs);
+		return watch$1((ok, fail) => this.wallet.mint.subscribeSpendNotes(operationId, (s) => ok(SPEND[s] ?? "created"), fail), spendFinal, waitMs);
 	}
 	redeem(notes, ghostly) {
 		return this.wallet.mint.reissueExternalNotes(notes, { ghostly });
 	}
 	redeemState(operationId, waitMs) {
-		return watch((ok, fail) => this.wallet.mint.subscribeReissueExternalNotes(operationId, (s) => ok(typeof s === "string" ? REDEEM[s] ?? "created" : s && typeof s === "object" && "Failed" in s ? "failed" : "created"), (error) => {
+		return watch$1((ok, fail) => this.wallet.mint.subscribeReissueExternalNotes(operationId, (s) => ok(typeof s === "string" ? REDEEM[s] ?? "created" : s && typeof s === "object" && "Failed" in s ? "failed" : "created"), (error) => {
 			ok("failed");
 			fail(error);
 		}), (s) => s === "done" || s === "failed", waitMs);
@@ -18980,7 +19188,7 @@ var RealClient = class {
 		};
 	}
 	receiveState(operationId, waitMs) {
-		return watch((ok, fail) => this.wallet.lightning.subscribeLnReceive(operationId, (s) => ok(receiveOf(s)), fail), (s) => s === "claimed" || s === "canceled", waitMs);
+		return watch$1((ok, fail) => this.wallet.lightning.subscribeLnReceive(operationId, (s) => ok(receiveOf(s)), fail), (s) => s === "claimed" || s === "canceled", waitMs);
 	}
 	async gatewayFee(amountMsats) {
 		await this.wallet.lightning.updateGatewayCache().catch(() => {});
@@ -18998,7 +19206,7 @@ var RealClient = class {
 		};
 	}
 	async payState(operationId, internal, waitMs) {
-		const state = await watch((ok, fail) => internal ? this.wallet.lightning.subscribeInternalPayment(operationId, ok, fail) : this.wallet.lightning.subscribeLnPay(operationId, ok, fail), (s) => typeof s === "object" && !!s && ("success" in s || "preimage" in s || "refunded" in s || "refund_success" in s || "unexpected_error" in s || "funding_failed" in s) || s === "canceled", waitMs);
+		const state = await watch$1((ok, fail) => internal ? this.wallet.lightning.subscribeInternalPayment(operationId, ok, fail) : this.wallet.lightning.subscribeLnPay(operationId, ok, fail), (s) => typeof s === "object" && !!s && ("success" in s || "preimage" in s || "refunded" in s || "refund_success" in s || "unexpected_error" in s || "funding_failed" in s) || s === "canceled", waitMs);
 		if (state && typeof state === "object") {
 			const s = state;
 			if (s.success?.preimage || s.preimage) return {
@@ -19333,6 +19541,10 @@ var SNAPSHOT = "snapshot.bin";
 var JOURNAL = "journal.bin";
 /** A journal past this is folded into the snapshot at the next quiet moment. */
 var COMPACT_BYTES = 33554432;
+/** How long `close` waits for the transactions still running: one left open for good does not keep the process. */
+var CLOSE_WAIT_MS = 5e3;
+/** How long a relaxed transaction's entry may wait for a sync when no other transaction brings one. */
+var RELAXED_SYNC_MS = 1e3;
 var BLOB = "__ghostlyBlob";
 var RANGE = "__ghostlyRange";
 var PROBE = "__ghostly_storage_probe__";
@@ -19348,18 +19560,21 @@ async function openPersistentIndexedDb(dir) {
 	const factory = new IDBFactory();
 	const raw = factory;
 	const classes = await probeClasses(factory);
+	dropIndexEntriesByRecord(classes, (a, b) => factory.cmp(a, b));
 	let writing = true;
 	let restoring = true;
 	let journalFd = null;
 	let queue = Promise.resolve();
 	let queued = 0;
 	let schemaDirty = false;
+	/** Set while the journal holds relaxed entries no sync has covered yet. */
+	let relaxed = null;
 	const pending = /* @__PURE__ */ new WeakMap();
 	const snapshotPath = join(dir, SNAPSHOT);
 	const journalPath = join(dir, JOURNAL);
 	const snapshotFound = existsSync(snapshotPath), journalFound = existsSync(journalPath);
-	if (snapshotFound) restore(classes, raw._databases, deserialize(readFileSync(snapshotPath)), (a, b) => factory.cmp(a, b));
-	if (journalFound) replay(raw._databases, readFileSync(journalPath));
+	if (snapshotFound) restore(classes, raw._databases, deserialize(readFileSync(snapshotPath)), keyOrder((a, b) => factory.cmp(a, b)));
+	if (journalFound) replay(raw._databases, readFileSync(journalPath), keyOrder((a, b) => factory.cmp(a, b)));
 	restoring = false;
 	if (journalFound || !snapshotFound) await writeSnapshot();
 	const storeProto = classes.ObjectStore.prototype;
@@ -19406,7 +19621,7 @@ async function openPersistentIndexedDb(dir) {
 			if (this.mode === "versionchange") schemaDirty = true;
 			else {
 				const ops = pending.get(this._rollbackLog);
-				if (ops?.length) append(ops);
+				if (ops?.length) append(ops, this.durability === "relaxed");
 			}
 			pending.delete(this._rollbackLog);
 			if (schemaDirty) enqueue(writeSnapshot);
@@ -19428,34 +19643,54 @@ async function openPersistentIndexedDb(dir) {
 		});
 		return request;
 	};
-	function append(ops) {
+	function append(ops, lazy) {
 		if (queued === 0 && !ops.some((op) => op.kind === "put" && hasBlob(op.value))) {
-			writeEntry(serialize(ops));
+			writeEntry(serialize(ops), lazy);
 			return;
 		}
 		enqueue(async () => writeEntry(serialize(await Promise.all(ops.map(async (op) => op.kind === "put" ? {
 			...op,
 			value: await blobsToDisk(op.value)
-		} : op)))));
+		} : op))), lazy));
 	}
 	function enqueue(work) {
 		queued++;
-		queue = queue.then(work).catch((error) => {
-			process.stderr.write(`ghostly: storage write failed: ${error instanceof Error ? error.message : String(error)}\n`);
-		}).finally(() => {
+		queue = queue.then(work).catch(failed).finally(() => {
 			queued--;
 		});
 		return queue;
 	}
-	function writeEntry(entry) {
+	function failed(error) {
+		process.stderr.write(`ghostly: storage write failed: ${error instanceof Error ? error.message : String(error)}\n`);
+	}
+	/**
+	* `lazy`: a relaxed transaction's entry. A sync blocks the whole process for milliseconds, and what such a
+	* transaction wrote can be made again (the event set's note of a message it already reported): written, it outlives
+	* the process; a power cut may take its last second.
+	*/
+	function writeEntry(entry, lazy = false) {
 		if (!writing) return;
 		journalFd ??= openSync(journalPath, "a", 384);
 		const header = Buffer.alloc(4);
 		header.writeUInt32BE(entry.length);
 		writeSync(journalFd, Buffer.concat([header, entry]));
-		fsyncSync(journalFd);
+		if (lazy) relaxed ??= setTimeout(() => {
+			try {
+				sync();
+			} catch (error) {
+				failed(error);
+			}
+		}, RELAXED_SYNC_MS).unref();
+		else sync();
 		if (statSync(journalPath).size > COMPACT_BYTES) enqueue(writeSnapshot);
 	}
+	function sync() {
+		if (relaxed) {
+			clearTimeout(relaxed);
+			relaxed = null;
+		}
+		if (journalFd !== null) fsyncSync(journalFd);
+	}
 	async function writeSnapshot() {
 		schemaDirty = false;
 		const snapshot = {
@@ -19498,12 +19733,29 @@ async function openPersistentIndexedDb(dir) {
 			closeSync(fd);
 		}
 		renameSync(temporary, snapshotPath);
+		if (relaxed) {
+			clearTimeout(relaxed);
+			relaxed = null;
+		}
 		if (journalFd !== null) {
 			closeSync(journalFd);
 			journalFd = null;
 		}
 		rmSync(journalPath, { force: true });
 	}
+	/**
+	* Resolves once no transaction is left to run. The engine does not wait for every write (`void db.deleteLink(…)`),
+	* and fake-indexeddb runs a transaction on a later turn of the event loop: a command that closed in the turn it wrote
+	* in (no chat to say goodbye to) took its last snapshot before the write, and answered done for what was not on disk.
+	* Two quiet turns in a row: a write that begins when another ends (a chat's messages after its row) is seen too.
+	*/
+	async function settled() {
+		const until = Date.now() + CLOSE_WAIT_MS;
+		for (let quiet = 0; quiet < 2 && Date.now() < until;) {
+			await new Promise((resolve) => setImmediate(resolve));
+			quiet = [...raw._databases.values()].some((db) => db.transactions.some((transaction) => transaction._state !== "finished")) ? 0 : quiet + 1;
+		}
+	}
 	const installed = globalThis;
 	installed.indexedDB = factory;
 	installed.IDBKeyRange = IDBKeyRange$1;
@@ -19512,6 +19764,7 @@ async function openPersistentIndexedDb(dir) {
 		flush: () => queue,
 		compact: () => enqueue(writeSnapshot),
 		async close() {
+			await settled();
 			await enqueue(writeSnapshot);
 			writing = false;
 			if (journalFd !== null) {
@@ -19535,7 +19788,8 @@ async function probeClasses(factory) {
 	const classes = {
 		Database: rawDb.constructor,
 		ObjectStore: rawStore.constructor,
-		Index: rawStore.rawIndexes.get("i").constructor
+		Index: rawStore.rawIndexes.get("i").constructor,
+		RecordStore: rawStore.records.constructor
 	};
 	db.close();
 	await new Promise((resolve) => {
@@ -19544,6 +19798,108 @@ async function probeClasses(factory) {
 	});
 	return classes;
 }
+/** The classes whose index upkeep is already by record: they are fake-indexeddb's own, shared by every store opened. */
+var byRecord = /* @__PURE__ */ new WeakSet();
+/**
+* fake-indexeddb drops an overwritten or deleted record from an index by walking every entry of it (an index is in
+* its own key's order, not the record's): each delivery mark, edit or reaction cost time with every message of the
+* profile, 170 ms at 10,000, and a long chat slowed every other one. The store has the records it just replaced or
+* removed in hand, and they say which entries to drop; a call that comes any other way still walks.
+*/
+function dropIndexEntriesByRecord(classes, cmp) {
+	const storeProto = classes.ObjectStore.prototype;
+	const recordsProto = classes.RecordStore.prototype;
+	if (byRecord.has(storeProto)) return;
+	byRecord.add(storeProto);
+	const { storeRecord, deleteRecord } = storeProto;
+	const { put, delete: remove, deleteByValue } = recordsProto;
+	let gone = null;
+	storeProto.storeRecord = function(record, noOverwrite, rollbackLog) {
+		if (!this.rawIndexes.size) return storeRecord.call(this, record, noOverwrite, rollbackLog);
+		const records = this.records, indexes = this.rawIndexes, outer = gone;
+		records.put = (next, keep) => {
+			const replaced = put.call(this.records, next, keep);
+			gone = {
+				indexes,
+				records: replaced ? [replaced] : []
+			};
+			return replaced;
+		};
+		try {
+			return storeRecord.call(this, record, noOverwrite, rollbackLog);
+		} finally {
+			delete records.put;
+			gone = outer;
+		}
+	};
+	storeProto.deleteRecord = function(key, rollbackLog) {
+		if (!this.rawIndexes.size) return deleteRecord.call(this, key, rollbackLog);
+		const records = this.records, indexes = this.rawIndexes, outer = gone;
+		records.delete = (range) => {
+			const removed = remove.call(this.records, range);
+			gone = {
+				indexes,
+				records: removed
+			};
+			return removed;
+		};
+		try {
+			deleteRecord.call(this, key, rollbackLog);
+		} finally {
+			delete records.delete;
+			gone = outer;
+		}
+	};
+	recordsProto.deleteByValue = function(key) {
+		let index;
+		if (gone) {
+			for (const candidate of gone.indexes.values()) if (candidate.records === this) index = candidate;
+		}
+		if (!gone || !index) return deleteByValue.call(this, key);
+		return dropEntries(index, gone.records, cmp);
+	};
+}
+/** Drops from an index the entries of records that left its store, and gives back the ones it dropped. */
+function dropEntries(index, records, cmp) {
+	const dropped = [];
+	for (const entry of indexEntries(index, records, cmp)) {
+		if (index.records.keysAreUnique) {
+			const held = index.records.get(entry.key);
+			if (!held || cmp(held.value, entry.value) !== 0) continue;
+		}
+		index.records.records.delete(entry);
+		dropped.push(entry);
+	}
+	return dropped;
+}
+/**
+* `cmp` for keys that are stored already (a record's, an index entry's): numbers, strings and arrays of them are
+* ordered here, as IndexedDB orders them (a number before a string before an array; strings by code unit; arrays item
+* by item, then the shorter first). Anything else (a date, bytes, a value that is no key) is left to `cmp`, which
+* checks and copies both keys at every call: on the way back from a snapshot that was a third of a large store's time.
+*/
+function keyOrder(cmp) {
+	const order = (a, b) => {
+		const first = typeof a, second = typeof b;
+		if (first === "number" && second === "number") return a === b ? 0 : a > b ? 1 : a < b ? -1 : cmp(a, b);
+		if (first === "string" && second === "string") return a === b ? 0 : a > b ? 1 : -1;
+		if (first === "number" && second === "string") return -1;
+		if (first === "string" && second === "number") return 1;
+		if (Array.isArray(a)) {
+			if (second === "number" || second === "string") return 1;
+			if (!Array.isArray(b)) return cmp(a, b);
+			const length = Math.min(a.length, b.length);
+			for (let at = 0; at < length; at++) {
+				const item = order(a[at], b[at]);
+				if (item !== 0) return item;
+			}
+			return a.length === b.length ? 0 : a.length > b.length ? 1 : -1;
+		}
+		if (Array.isArray(b) && (first === "number" || first === "string")) return -1;
+		return cmp(a, b);
+	};
+	return order;
+}
 /**
 * The snapshot's records come in key order (as `writeSnapshot` walks them), so each store's tree and each index's are
 * built whole from sorted arrays: storing record by record compared every key down the tree, a 70,000-message profile
@@ -19639,21 +19995,27 @@ function fill(store, sorted) {
 /**
 * Replays whole entries; a torn last entry (the process died mid-write) was never acknowledged and is dropped.
 *
-* A store's indexes are set aside while its ops replay and rebuilt once at the end: fake-indexeddb drops an
+* A store's indexes are set aside while its ops replay and brought in step once at the end: fake-indexeddb drops an
 * overwritten or deleted record from an index by walking every record of it, so a crash after a busy chat took
-* tens of seconds to minutes to start, one write at a time against the whole profile.
+* tens of seconds to minutes to start, one write at a time against the whole profile. Only the rows the journal
+* touched change in an index (what each was before goes, what it is now comes in): a journal of one message costs one
+* message, not the profile's history once per index. A store the journal cleared has its indexes built again whole.
 */
-function replay(databases, journal) {
+function replay(databases, journal, cmp) {
 	const touched = /* @__PURE__ */ new Map();
 	try {
 		replayEntries(databases, journal, touched);
 	} finally {
-		for (const [store, indexes] of touched) {
+		for (const [store, { indexes, was, now }] of touched) {
+			const records = store.records;
+			delete records.put;
+			delete records.delete;
 			store.rawIndexes = indexes;
 			for (const index of indexes.values()) {
-				index.records.clear();
+				if (!was) index.records.clear();
 				if (!index.initialized) continue;
-				for (const record of store.records.values()) index.storeRecord(record);
+				if (was) dropEntries(index, [...was], cmp);
+				for (const record of was ? now : store.records.values()) if (!absent(index.keyPath, record.value)) index.storeRecord(record);
 			}
 		}
 	}
@@ -19673,19 +20035,50 @@ function replayEntries(databases, journal, touched) {
 		for (const op of ops) {
 			const store = databases.get(op.db)?.rawObjectStores.get(op.store);
 			if (!store) continue;
-			if (!touched.has(store)) {
-				touched.set(store, store.rawIndexes);
-				store.rawIndexes = /* @__PURE__ */ new Map();
-			}
+			let change = touched.get(store);
+			if (!change) touched.set(store, change = watch(store));
 			if (op.kind === "put") store.storeRecord({
 				key: op.key,
 				value: blobsFromDisk(op.value)
 			}, false);
 			else if (op.kind === "delete") store.deleteRecord(keyFromDisk(op.key));
-			else store.clear();
+			else {
+				change.was = null;
+				store.clear();
+			}
 		}
 	}
 }
+/**
+* Sets a store's indexes aside and notes, as its records are written over and removed, which ones left and which
+* ones came: the record store hands back what a put replaced and what a delete removed, so a row costs no lookup.
+* A record that came and left again was never in an index.
+*/
+function watch(store) {
+	const change = {
+		indexes: store.rawIndexes,
+		was: store.rawIndexes.size ? /* @__PURE__ */ new Set() : null,
+		now: /* @__PURE__ */ new Set()
+	};
+	store.rawIndexes = /* @__PURE__ */ new Map();
+	if (!change.was) return change;
+	const { put, delete: remove } = store.records;
+	const left = (record) => {
+		if (!change.now.delete(record)) change.was?.add(record);
+	};
+	store.records.put = (next, keep) => {
+		const replaced = put.call(store.records, next, keep);
+		if (replaced) left(replaced);
+		change.now.add(next);
+		return replaced;
+	};
+	store.records.delete = (key) => {
+		const removed = remove.call(store.records, key);
+		removed.forEach(left);
+		return removed;
+	};
+	return change;
+}
 function keyToDisk(key) {
 	if (key instanceof IDBKeyRange$1) return { [RANGE]: {
 		lower: key.lower,
@@ -19939,14 +20332,14 @@ async function startRuntime(paths, options = {}) {
 	(await import("./assets/ghostly_iroh_web-Dvzh3Y6E.js")).initSync({ module: irohWasmBytes() });
 	const [{ registerFileBytes }, { NodeFileBytes }] = await Promise.all([import("./assets/fileBytes-BcYZhNgF.js").then((n) => n.o), import("./assets/fileBytes-Dbifu5I5.js")]);
 	registerFileBytes("native", async () => new NodeFileBytes(paths.files), true);
-	const [{ EngineServer }, { createHyperEndpoint }] = await Promise.all([import("./assets/server-D5FBZYW8.js").then((n) => n.t), import("./assets/endpoint-pgFkR2AS.js")]);
+	const [{ EngineServer }, { createHyperEndpoint }] = await Promise.all([import("./assets/server-DHMXMwNn.js").then((n) => n.t), import("./assets/endpoint-pgFkR2AS.js")]);
 	const network = hyperdhtNetwork();
 	const dht = mainlineNetwork();
-	const mainline = dht.off ? null : new (await (import("./assets/mainline-DVYdrus6.js"))).Mainline({
+	const mainline = dht.off ? null : new (await (import("./assets/mainline-DriRu_hb.js"))).Mainline({
 		bootstrap: dht.bootstrap,
 		host: dht.host
 	});
-	const transport = mainline || pinned ? new (await (import("./assets/mainline-DVYdrus6.js"))).RelaysAndDht(mainline, pinned ? { relays: pinned } : {}, !!pinned) : null;
+	const transport = mainline || pinned ? new (await (import("./assets/mainline-DriRu_hb.js"))).RelaysAndDht(mainline, pinned ? { relays: pinned } : {}, !!pinned) : null;
 	const server = new EngineServer({
 		...transport ? { transport } : {},
 		irohWeb: true,
@@ -20091,10 +20484,14 @@ var guarded = false;
 /**
 * A daemon says an error nobody caught (with its stack, on stderr: the daemon's log when detached) and keeps serving:
 * one request gone wrong must not take the profile offline. One-shot commands do not call this; they still fail loudly.
+*
+* `outputs`: what it writes to. A write there that fails (a pipe whose reader is gone: the process that started the
+* daemon died) is dropped, not an error nobody caught: saying it would be one more failed write, and the next, with
+* no turn left for anything else (a full core, and no stop on SIGTERM).
 */
 function keepServing(proc = process, write = (text) => {
 	process.stderr.write(text);
-}) {
+}, outputs = proc === process ? [process.stdout, process.stderr] : []) {
 	if (proc === process) {
 		if (guarded) return;
 		guarded = true;
@@ -20104,6 +20501,7 @@ function keepServing(proc = process, write = (text) => {
 			write(`ghostly: ${what}, the daemon keeps serving: ${error instanceof Error ? error.stack ?? error.message : String(error)}\n`);
 		} catch {}
 	};
+	for (const output of outputs) output.on("error", () => {});
 	proc.on("unhandledRejection", log("unhandled rejection"));
 	proc.on("uncaughtException", log("uncaught exception"));
 }
@@ -20307,6 +20705,18 @@ function readCursor(path) {
 	const value = Number(readFileSync(path, "utf8").trim());
 	return Number.isInteger(value) && value >= 0 ? value : void 0;
 }
+/**
+* Whether a cursor can be kept at `path`, asked before anything starts: its folder is there and takes a file. Before, a
+* folder that was not there was found at the first event: the listener ran, said "event N failed: ENOENT" for each one
+* and never wrote the cursor, so the next start began at the journal's end and skipped what came while it was down.
+* Throws what the file system says (`asCliError` names the path and the code: not_found, refused).
+*/
+function checkCursor(path) {
+	if (!path) return;
+	const folder = dirname(resolve(path));
+	if (!statSync(folder).isDirectory()) throw new CliError("not_found", `No such file or folder: ${folder}`);
+	accessSync(folder, constants.W_OK | constants.X_OK);
+}
 function writeCursor(path, seq) {
 	rmSync(path + ".tmp", { force: true });
 	writeFileSync(path + ".tmp", String(seq) + "\n", {
@@ -20603,7 +21013,7 @@ var SPECIAL = [
 		"The profile's settings",
 		{ "show-secret": o("boolean", "Show credentials too") }
 	],
-	["settings set <key> <json-value>", "Change one: relays, irohRelays, hyperdhtRelay, readRelays, iceServers, publicProfiles, online, shareProfile, sendTyping, nick"],
+	["settings set <key> <json-value>", "Change one: relays, irohRelays, hyperdhtRelay, readRelays, iceServers, publicProfiles, online, shareProfile, sendTyping, autoDownloads, serveFiles, nick"],
 	[
 		"engine <method> [json-params | -] [--confirm-real] [--show-secret]",
 		"Any call of the app's engine, with its own parameters",
@@ -20649,6 +21059,14 @@ function help() {
 		"2 usage, 3 not found, 4 timed out, 5 needs --force/--yes/--confirm-real. See packages/cli/README.md."
 	].join("\n");
 }
+/** What `ghostly help help` answers. */
+var HELP_USAGE = [
+	"Usage: ghostly help [<command>...]",
+	"",
+	"  Help for every command, or for one command or a group of them (also ghostly <command> --help)",
+	"",
+	"Options for every command: --profile, -p <name>  --home <dir>  --pretty  --help, -h"
+].join("\n");
 /** Every command's help row: usage, summary and, for the table and text commands, their options. */
 function helpRows() {
 	return [
@@ -20675,6 +21093,7 @@ function commandWords(usage) {
 * options; for a group (`ghostly help file`), the group's commands.
 */
 function commandHelp(words) {
+	if (words[0] === "help") return HELP_USAGE;
 	const named = (list) => helpRows().filter((row) => {
 		const own = commandWords(row.usage);
 		return list.every((word, i) => own[i] === word);
@@ -20954,32 +21373,42 @@ async function daemonCommand(argv) {
 	}
 	if (sub === "stop") {
 		knownProfile(g);
+		const stopFor = seconds(parsed, 20);
 		const client = await connectDaemon(g.paths.socket);
 		if (!client) throw new CliError("not_found", `No daemon runs profile ${g.profile}`);
 		print({
 			stopped: true,
-			pid: await stopDaemon(g, client, Number(parsed.options.timeout) || 20)
+			pid: await stopDaemon(g, client, stopFor)
 		});
 		return;
 	}
 	if (sub === "restart") {
+		const stopFor = seconds(parsed, 20), startFor = seconds(parsed, 60);
 		const client = await connectDaemon(g.paths.socket);
 		const before = client ? (await client.call("status").catch(() => null))?.version ?? null : null;
 		print({
 			restarted: true,
-			stopped: client ? await stopDaemon(g, client, Number(parsed.options.timeout) || 20) : null,
+			stopped: client ? await stopDaemon(g, client, stopFor) : null,
 			before,
 			version: VERSION,
-			...await startDetached(g, Number(parsed.options.timeout) || 60)
+			...await startDetached(g, startFor)
 		});
 		return;
 	}
 	if (sub) throw new CliError("usage", "ghostly daemon [--detach] | daemon status | daemon stop | daemon restart");
+	const startFor = seconds(parsed, 60);
 	if (!parsed.options.detach) {
 		await runDaemon(g);
 		return;
 	}
-	print(await startDetached(g, Number(parsed.options.timeout) || 60));
+	print(await startDetached(g, startFor));
+}
+/** `--timeout <s>`, or `fallback` without one: seconds above 0 (0 or less would not wait at all). */
+function seconds(parsed, fallback) {
+	const value = parsed.options.timeout;
+	if (value === void 0) return fallback;
+	if (typeof value !== "number" || !(value > 0)) throw new CliError("usage", "--timeout takes a number of seconds above 0");
+	return value;
 }
 /**
 * Asks the daemon to stop and waits until its process is gone, not only until it let go of the profile (it releases
@@ -21039,6 +21468,10 @@ async function startDetached(g, seconds) {
 	}
 	if (!client) {
 		heldBy(g, child.pid);
+		if (child.exitCode === null && child.pid !== void 0 && processAlive(child.pid)) throw new CliError("timeout", `The daemon (process ${child.pid}) is still starting; ghostly daemon status shows when it is up`, {
+			pid: child.pid,
+			log: g.paths.log
+		});
 		throw new CliError("engine", `The daemon did not start; see ${g.paths.log}`);
 	}
 	client.close();
@@ -21089,6 +21522,7 @@ async function listenCommand(argv) {
 			description: ""
 		}
 	});
+	noMoreThan(0, parsed.positionals, SPECIAL.find(([usage]) => usage.startsWith("listen "))[0]);
 	const g = globals(parsed);
 	pretty = false;
 	if (parsed.options.webhook) checkWebhook(String(parsed.options.webhook));
@@ -21097,6 +21531,7 @@ async function listenCommand(argv) {
 	if (turns && types.length) throw new CliError("usage", "--turns takes the place of --type: a turn is a message received, or a group message that mentions you");
 	const from = parsed.options.from ?? [], groups = parsed.options.group ?? [];
 	const cursor = parsed.options.cursor;
+	checkCursor(cursor);
 	let since = parsed.options.since ?? readCursor(cursor);
 	let handle = null;
 	const start = async (call, peerOf) => {
@@ -21226,17 +21661,7 @@ async function engineCommand(argv) {
 		params,
 		confirmReal
 	}));
-	if (method === "getState" && !showSecret && result && typeof result === "object") {
-		const state = result;
-		result = {
-			...state,
-			settings: redactSettings(state.settings),
-			...state.groups ? { groups: state.groups.map((g) => g.entryLink ? {
-				...g,
-				entryLink: "<hidden>"
-			} : g) } : {}
-		};
-	}
+	if (method === "getState" && !showSecret && result && typeof result === "object") result = hideStateSecrets(result);
 	print(result);
 }
 async function settingsCommand(sub, argv) {
@@ -21469,6 +21894,7 @@ async function main(input) {
 		return 0;
 	}
 	if (argv[0] === "--version" || argv[0] === "version") {
+		pretty = argv.slice(1).some((word) => word === "--pretty" || word === "--pretty=true");
 		print({ version: VERSION });
 		return 0;
 	}
@@ -21564,7 +21990,29 @@ async function run(argv) {
 	}
 }
 //#endregion
+//#region src/runtime/webStorage.ts
+/**
+* Node 25 and newer define `globalThis.localStorage` as a getter that, without `--localstorage-file`, answers
+* `undefined` and writes an ExperimentalWarning on stderr the first time it is read. The engine reads it where a
+* browser keeps a setting (`globalThis.localStorage?.getItem(...)`), so every command that opens a profile printed the
+* warning. Without the flag the CLI has no localStorage, as on Node 22: the getter is replaced by `undefined` before
+* anything reads it. With the flag, Node's storage stays.
+*/
+function quietWebStorage(scope = globalThis, execArgv = process.execArgv, nodeOptions = process.env.NODE_OPTIONS) {
+	const own = Object.getOwnPropertyDescriptor(scope, "localStorage");
+	if (!own?.get || !own.configurable) return;
+	const flag = (arg) => arg === "--localstorage-file" || arg.startsWith("--localstorage-file=");
+	if (execArgv.some(flag) || (nodeOptions ?? "").split(/\s+/).some(flag)) return;
+	Object.defineProperty(scope, "localStorage", {
+		value: void 0,
+		writable: true,
+		configurable: true,
+		enumerable: false
+	});
+}
+//#endregion
 //#region src/bin.ts
+quietWebStorage();
 run(process.argv.slice(2));
 //#endregion
 export { BACKUP_MEDIA_TYPE as $, requireTurn as A, paymentWireId as At, networkLabel as B, breezDatabasesFor as C, storedGroupFiles as Ct, sourceKey as D, replyRef as Dt, ProviderSources as E, receivedPairedReply as Et, sealSeed as F, streamStored as Ft, BITCOIN_INVOICE_ON_TESTNET as G, cashuMint as H, unsealSeed as I, fakesLightning as J, DEFAULT_MINTS as K, ModeChanged as L, setSingleWriterGate as M, readStored as Mt, intentRepository as N, removeStored as Nt, awayFrom as O, replyTo as Ot, newDeviceKey as P, storedSize as Pt, paysItsOwnInvoices as Q, ModeGate as R, breezDatabaseInUse as S, groupOfFile as St, lightningPaying as T, pairedWireReply as Tt, MESSAGE_DETAILS_MAX_BYTES as U, CASHU_MINT_SOURCE as V, WALLET_TYPES as W, isWorthlessMint as X, isTestMint as Y, mintNetwork as Z, LightningCards as _, verifyIdentity as _t, irohRelayProblem as a, reserveAdapterIds as at, normalizePhrase as b, groupFileId as bt, createFailure as c, SourceConfigError as ct, paymentNetwork as d, networkMode as dt, MAX_BACKUP_BYTES as et, paymentNetworksOf as f, redact as ft, CASHU_CARD as g, boundedIdentityFetch as gt, rpcHost as h, setOwnDidSource as ht, createIrohWebEndpoint as i, registeredOnchainProviders as it, setAwayWallets as j, FileAppender as jt, refuseAway as k, paymentAlias as kt, createTiming as l, SourceUnreachableError as lt, networkReason as m, resolveAtprotoDid as mt, loadFedimintSdk as n, onAdaptersChanged as nt, WALLET_NAMES as o, NothingSpentError as ot, walletInstances as p, assertPublicServer as pt, TEST_MINT as q, DEFAULT_IROH_RELAYS as r, registeredLightningProviders as rt, assertConfirmedReal as s, PROVIDER_PLATFORMS as st, fedimintDatabase as t, identityProviders as tt, crossNetwork as u, isNothingSpentError as ut, cardsKey as v, chosenResolver as vt, dropBreezDatabase as w, groupReply as wt, breezDatabase as x, groupFileText as xt, isRecoveryPhrase as y, GroupFileDesk as yt, WrongNetworkError as z };