@ghostlytools/cli 1.3.0 → 1.3.1

package/dist/assets/{src-DhfGgAUu.js → src-DDzSERyc.js}

@@ -1,4 +1,3 @@
-import { At as fromBase64, B as readStatusCard, C as downsamplePeaks, Ct as hasVisible, D as parseVideoMeta, Dt as trimEndOf, Et as stripHidden, Ft as toBase64Url, H as statusCardBytes, I as cardEditNumber, It as toZ32, Lt as utf8Decode, Mt as fromZ32, N as STATUS_CARD_LIMITS, Nt as randomBytes, O as BUTTON_ID, Ot as bytesEqual, Pt as toBase64, Rt as utf8Encode, St as wrapDataChannel, T as parseVoiceMeta, Tt as sanitizeNick, X as APP_PREFIXES, Y as APP_NAME, _t as LIMITS, bt as encodeControl, c as readGroupFileMeta, ct as readAppSignature, dt as verifyAppRevocation, et as appRefPublisher, f as imageSize, ft as verifyAppSignature, g as formatFileSize, gt as CHUNK_KIND, h as FileTransfers, ht as readCanonicalJson, it as isAppRef, jt as fromBase64Url, kt as concatBytes$1, lt as signAppObject, mt as canonicalJsonBytes, nt as isAppHash, ot as readAppRevocationShape, p as parseImageMeta, rt as isAppKey, t as GROUP_FILE_LIMITS, v as sanitizeFileName, vt as decodeChunk, wt as sanitizeDisplayText, xt as sendBody, y as sanitizeMime, yt as decodeControl } from "./groupFiles-DBbjOLuD.js";
 import { xsalsa20poly1305 } from "@noble/ciphers/salsa.js";
 import { ed25519, x25519 } from "@noble/curves/ed25519.js";
 import { hkdf } from "@noble/hashes/hkdf.js";
@@ -13,6 +12,165 @@ import { p256, p384, p521 } from "@noble/curves/nist.js";
 import { gcm } from "@noble/ciphers/aes.js";
 import { ripemd160 } from "@noble/hashes/legacy.js";
 import { bytesToNumberBE } from "@noble/curves/utils.js";
+//#region ../core/src/bytes.ts
+var textEncoder$1 = new TextEncoder();
+var textDecoder$1 = new TextDecoder("utf-8", { fatal: true });
+function utf8Encode(str) {
+	return textEncoder$1.encode(str);
+}
+function utf8Decode(bytes) {
+	return textDecoder$1.decode(bytes);
+}
+function concatBytes$1(...parts) {
+	let length = 0;
+	for (const p of parts) length += p.length;
+	const out = new Uint8Array(length);
+	let offset = 0;
+	for (const p of parts) {
+		out.set(p, offset);
+		offset += p.length;
+	}
+	return out;
+}
+function bytesEqual(a, b) {
+	if (a.length !== b.length) return false;
+	let diff = 0;
+	for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];
+	return diff === 0;
+}
+/** `Uint8Array.prototype.toBase64` (Node 25+, Chrome 140+, Firefox 133+, Safari 18.2+): ~200x the JS below. */
+var nativeToBase64 = Uint8Array.prototype.toBase64;
+var tableOf = (chars) => Uint8Array.from(chars, (c) => c.charCodeAt(0));
+var BASE64_TABLE = tableOf("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/");
+var BASE64URL_TABLE = tableOf("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_");
+/**
+* Base64 where the runtime has no native encoder (Node 22 and 24, older WebViews): the characters go into bytes and
+* become one string at the end. Every file chunk is encoded (files/3 `pf-data`), so this is on a transfer's path.
+*/
+function encodeBase64(bytes, table, pad) {
+	const out = new Uint8Array(Math.ceil(bytes.length / 3) * 4);
+	let o = 0, i = 0;
+	for (; i + 2 < bytes.length; i += 3) {
+		const n = bytes[i] << 16 | bytes[i + 1] << 8 | bytes[i + 2];
+		out[o++] = table[n >>> 18];
+		out[o++] = table[n >>> 12 & 63];
+		out[o++] = table[n >>> 6 & 63];
+		out[o++] = table[n & 63];
+	}
+	const rest = bytes.length - i;
+	if (rest) {
+		const n = bytes[i] << 16 | (rest === 2 ? bytes[i + 1] << 8 : 0);
+		out[o++] = table[n >>> 18];
+		out[o++] = table[n >>> 12 & 63];
+		if (rest === 2) out[o++] = table[n >>> 6 & 63];
+		else if (pad) out[o++] = 61;
+		if (pad) out[o++] = 61;
+	}
+	return textDecoder$1.decode(out.subarray(0, o));
+}
+function toBase64(bytes) {
+	return nativeToBase64 ? nativeToBase64.call(bytes) : encodeBase64(bytes, BASE64_TABLE, true);
+}
+function fromBase64(str) {
+	const binary = atob(str);
+	const bytes = new Uint8Array(binary.length);
+	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+	return bytes;
+}
+function toBase64Url(bytes) {
+	return nativeToBase64 ? nativeToBase64.call(bytes, {
+		alphabet: "base64url",
+		omitPadding: true
+	}) : encodeBase64(bytes, BASE64URL_TABLE, false);
+}
+function fromBase64Url(str) {
+	let b = str.replace(/-/g, "+").replace(/_/g, "/");
+	while (b.length % 4) b += "=";
+	return fromBase64(b);
+}
+var Z32_ALPHABET = "ybndrfg8ejkmcpqxot1uwisza345h769";
+function toZ32(bytes) {
+	let out = "";
+	let bits = 0;
+	let value = 0;
+	for (const byte of bytes) {
+		value = value << 8 | byte;
+		bits += 8;
+		while (bits >= 5) {
+			out += Z32_ALPHABET[value >>> bits - 5 & 31];
+			bits -= 5;
+		}
+		value &= (1 << bits) - 1;
+	}
+	if (bits > 0) out += Z32_ALPHABET[value << 5 - bits & 31];
+	return out;
+}
+function fromZ32(str) {
+	const out = new Uint8Array(Math.floor(str.length * 5 / 8));
+	let bits = 0;
+	let value = 0;
+	let index = 0;
+	for (const char of str) {
+		const v = Z32_ALPHABET.indexOf(char);
+		if (v < 0) throw new Error(`Invalid z-base-32 character: ${char}`);
+		value = value << 5 | v;
+		bits += 5;
+		if (bits >= 8) {
+			out[index++] = value >>> bits - 8 & 255;
+			bits -= 8;
+		}
+		value &= (1 << bits) - 1;
+	}
+	return out;
+}
+function randomBytes(length) {
+	const bytes = new Uint8Array(length);
+	crypto.getRandomValues(bytes);
+	return bytes;
+}
+/**
+* Invisible and direction-changing characters. Unlike a file name, display
+* text may legitimately hold emoji and Indic or Arabic joiners, so the two
+* joiners stay and the rest of Cf goes: bidi overrides and isolates reorder
+* what follows them, and the others hide text or let two different names
+* render identically.
+*/
+var HIDDEN = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu;
+/** Zero-width non-joiner and zero-width joiner. */
+var KEEP = /[\u200c\u200d]/;
+/** `text` without its invisible and direction-changing characters, at any length: for display text with a cut of its own. */
+function stripHidden(text) {
+	return text.replace(HIDDEN, (char) => KEEP.test(char) ? char : "");
+}
+/**
+* What draws nothing when it stands alone and `HIDDEN` leaves in, since text needs it beside something else: the
+* joiners, the fillers, the variation selectors and the other default-ignorable code points, combining marks, white
+* space and the blank Braille pattern.
+*/
+var UNSEEN = /^[\p{Default_Ignorable_Code_Point}\p{M}\p{White_Space}\u2800]*$/u;
+/** Whether `text` holds a character that shows by itself: a name of joiners, fillers or marks alone has none. */
+function hasVisible(text) {
+	return !UNSEEN.test(text);
+}
+/** Undefined when nothing visible is left, so callers can fall back. */
+function sanitizeDisplayText(text, max) {
+	const clean = [...stripHidden(text)].slice(0, max).join("").trim();
+	return hasVisible(clean) ? clean : void 0;
+}
+/** A nickname as it arrived from a peer, ready to show. */
+function sanitizeNick(nick) {
+	return typeof nick === "string" ? sanitizeDisplayText(nick, 64) : void 0;
+}
+/**
+* `text` without the characters of `chars` it ends with, in one pass from the end. A `/[…]+$/` replace would retry
+* from every character of a run that does not reach the end.
+*/
+function trimEndOf(text, chars) {
+	let end = text.length;
+	while (end > 0 && chars.includes(text[end - 1])) end--;
+	return end === text.length ? text : text.slice(0, end);
+}
+//#endregion
 //#region ../core/src/avatar.ts
 /**
 * A profile picture as it travels between paired peers: a small square JPEG in a data URL. The picture
@@ -23,7 +181,7 @@ import { bytesToNumberBE } from "@noble/curves/utils.js";
 var MAX_AVATAR_LENGTH = 48e3;
 var PREFIX$1 = "data:image/jpeg;base64,";
 /** Width and height from a JPEG's frame header, or undefined when there is none before the image data. */
-function jpegSize(bytes) {
+function jpegSize$1(bytes) {
 	if (bytes.length < 4 || bytes[0] !== 255 || bytes[1] !== 216) return;
 	let i = 2;
 	while (i + 4 <= bytes.length) {
@@ -58,7 +216,7 @@ function sanitizeAvatar(value) {
 	}
 	const bytes = new Uint8Array(binary.length);
 	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
-	const size = jpegSize(bytes);
+	const size = jpegSize$1(bytes);
 	if (!size || size.width < 1 || size.height < 1 || size.width > 512 || size.height > 512) return;
 	return value;
 }
@@ -76,8 +234,7 @@ function generateEncryptionKey() {
 function encrypt(plaintext, key) {
 	if (key.length !== KEY_LENGTH) throw new Error("Invalid key length: expected 32 bytes");
 	const nonce = randomBytes(NONCE_LENGTH$3);
-	const box = xsalsa20poly1305(key, nonce).encrypt(utf8Encode(plaintext));
-	return toBase64(concatBytes$1(nonce, box));
+	return toBase64(concatBytes$1(nonce, xsalsa20poly1305(key, nonce).encrypt(utf8Encode(plaintext))));
 }
 /** The length of what `encrypt` returns for a plaintext of this many UTF-8 bytes: base64 of nonce, box and 16-byte tag. */
 function sealedLength(plaintextBytes) {
@@ -561,9 +718,13 @@ var RelayBreaker = class {
 		this.circuits.delete(relay);
 		if (recovered) this.options.onRecover?.(relay);
 	}
-	/** The relay failed a request; a probe that fails trips it again at once. */
+	/**
+	* The relay failed a request; a probe that fails trips it again at once. While it is left alone and no probe is out,
+	* a failure is a request sent before it tripped (a start burst): already counted in, it trips nothing again.
+	*/
 	failure(relay, kind, reason) {
 		const circuit = this.circuit(relay);
+		if (!circuit.probing && circuit.openUntil > this.now()) return;
 		circuit.failures++;
 		circuit.kind = kind;
 		circuit.reason = reason;
@@ -2989,6 +3150,12 @@ var OwnInviteError = class extends Error {
 		this.name = "OwnInviteError";
 	}
 };
+/** The refusal an error (or an error's message, as an RPC hands it over) carries, or null when it is another error. */
+function ownInviteRefusal(error) {
+	if (error instanceof OwnInviteError) return { linkId: error.linkId };
+	const match = (error instanceof Error ? error.message : typeof error === "string" ? error : "").match(/^own-invite(?: (\S+))?: /);
+	return match ? { linkId: match[1] ?? null } : null;
+}
 /** The `ghostly1z…` code of a device invite. */
 function encodeDeviceInvite(invite) {
 	const fields = [
@@ -3496,9 +3663,9 @@ var HANDOFF_CANCEL_REASONS = [
 	"stalled"
 ];
 var KEY$3 = /^[A-Za-z0-9_-]{43}$/;
-var DIGEST$1 = KEY$3;
+var DIGEST$2 = KEY$3;
 var SIGNATURE = /^[A-Za-z0-9_-]{86}$/;
-var ID$4 = /^[A-Za-z0-9_-]{22}$/;
+var ID$5 = /^[A-Za-z0-9_-]{22}$/;
 var B64$4 = /^[A-Za-z0-9_-]*$/;
 var HEX = /^[0-9a-f]{64}$/;
 var VERSION_TEXT = /^[0-9A-Za-z.+_-]{1,40}$/;
@@ -3512,9 +3679,9 @@ var isHandoffPartName = (name) => typeof name === "string" && PART.test(name);
 /** The part a file is: `file/<its SHA-256, base64url>`. */
 var filePartName = (sha256B64) => `file/${sha256B64}`;
 /** The digest a file part names, or null for any other part. */
-var filePartDigest = (name) => name.startsWith("file/") && DIGEST$1.test(name.slice(5)) ? name.slice(5) : null;
+var filePartDigest = (name) => name.startsWith("file/") && DIGEST$2.test(name.slice(5)) ? name.slice(5) : null;
 function isPart(value) {
-	return Array.isArray(value) && value.length === 3 && isHandoffPartName(value[0]) && isCount$1(value[1], MAX_PART) && isText$2(value[2], DIGEST$1) && (filePartDigest(value[0]) === null || filePartDigest(value[0]) === value[2]);
+	return Array.isArray(value) && value.length === 3 && isHandoffPartName(value[0]) && isCount$1(value[1], MAX_PART) && isText$2(value[2], DIGEST$2) && (filePartDigest(value[0]) === null || filePartDigest(value[0]) === value[2]);
 }
 /** Names compared as UTF-8 byte strings, as `H` sorts them. */
 function compareNames(a, b) {
@@ -3636,7 +3803,7 @@ function readHandoffHello(frame) {
 	if (typeof frame.room !== "number" || !Number.isSafeInteger(frame.room) || frame.room < -1) return null;
 	if (typeof frame.metered !== "boolean") return null;
 	if (frame.later !== void 0 && !isCount$1(frame.later)) return null;
-	if (frame.id !== void 0 && !isText$2(frame.id, ID$4)) return null;
+	if (frame.id !== void 0 && !isText$2(frame.id, ID$5)) return null;
 	const kind = DEVICE_KINDS.includes(frame.kind) ? frame.kind : "web";
 	return {
 		v: 1,
@@ -3662,7 +3829,7 @@ var handoffOfferFrame = (turn, id, bytes) => ({
 });
 function readHandoffTurnFrame(frame) {
 	if (frame.t !== "handoff-request" && frame.t !== "handoff-offer") return null;
-	if (!isCount$1(frame.turn, TURN_MAX) || !isText$2(frame.id, ID$4)) return null;
+	if (!isCount$1(frame.turn, TURN_MAX) || !isText$2(frame.id, ID$5)) return null;
 	if (frame.t === "handoff-offer") return isCount$1(frame.bytes) ? {
 		turn: frame.turn,
 		id: frame.id,
@@ -3705,7 +3872,7 @@ function readHandoffPake(frame) {
 	};
 }
 function readHandoffHave(frame) {
-	if (frame.t !== "handoff-have" || !Array.isArray(frame.d) || frame.d.length > 300 || !frame.d.every((d) => isText$2(d, DIGEST$1))) return null;
+	if (frame.t !== "handoff-have" || !Array.isArray(frame.d) || frame.d.length > 300 || !frame.d.every((d) => isText$2(d, DIGEST$2))) return null;
 	const p = {};
 	if (frame.p !== void 0) {
 		if (!frame.p || typeof frame.p !== "object" || Array.isArray(frame.p) || Object.keys(frame.p).length > 300) return null;
@@ -3761,7 +3928,7 @@ function readHandoffAck(frame) {
 }
 /** `H` of a `handoff-verified` that B's key signed for this turn address and turn, or null. */
 function readHandoffVerified(frame, turnAddress, turn, takerKey) {
-	if (frame.t !== "handoff-verified" || !isText$2(frame.h, DIGEST$1) || !isText$2(frame.s, SIGNATURE)) return null;
+	if (frame.t !== "handoff-verified" || !isText$2(frame.h, DIGEST$2) || !isText$2(frame.s, SIGNATURE)) return null;
 	const h = fromBase64Url(frame.h);
 	try {
 		return verify(fromBase64Url(frame.s), handoffVerifiedMessage(turnAddress, turn, h), takerKey) ? h : null;
@@ -3829,7 +3996,7 @@ var handoffAttemptSucceeded = () => ({
 /** Seconds until a locked-out device may try again (for `handoff-busy`). */
 var handoffRetryAfter = (attempts, now) => attempts?.until !== void 0 && attempts.until > now ? Math.ceil((attempts.until - now) / 1e3) : 0;
 var HTTP_SERVICE_PROTO = "ghostly-http/1";
-var MAX_NAME_LENGTH = 48;
+var MAX_NAME_LENGTH$1 = 48;
 var MAX_META_ENTRIES = 8;
 var MAX_META_LENGTH = 64;
 var SERVICE_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,31}$/;
@@ -3910,7 +4077,7 @@ function servicesFromWire(wire) {
 					id: e.i,
 					type: e.t
 				};
-				const name = cleanString(e.n, MAX_NAME_LENGTH);
+				const name = cleanString(e.n, MAX_NAME_LENGTH$1);
 				const proto = cleanString(e.p, MAX_META_LENGTH);
 				if (name) ad.name = name;
 				if (proto) ad.proto = proto;
@@ -4756,6 +4923,325 @@ function buildDataSdp(signal) {
 	return lines.join("\r\n") + "\r\n";
 }
 //#endregion
+//#region ../core/src/frames.ts
+/**
+* Framing on the `ghostly/1` DataChannel (ordered, reliable).
+*
+* - Text messages are control frames: compact JSON with a `t` discriminator,
+*   the same shape Ghostly already uses for `_msgs` and `_call`.
+* - Binary messages are body chunks that belong to a stream opened by a
+*   control frame: `<kind u8><stream id u32 BE><flags u8><payload>`.
+*
+* Everything here handles data from the remote peer and must never trust it.
+*/
+var LIMITS = {
+	/** Largest control frame accepted, headers included. */
+	maxControlFrameBytes: 61440,
+	/** Longest payment endpoint value (a Cashu token, an invoice) a payment frame may carry; a longer one is dropped. */
+	maxPaymentEndpointChars: 32768,
+	/** Largest DataChannel message sent. 16 KiB is safe across WebRTC stacks. */
+	maxChunkMessageBytes: 16384,
+	maxRequestBodyBytes: 8388608,
+	maxResponseBodyBytes: 67108864,
+	maxHeaderCount: 128,
+	maxHeaderValueBytes: 16384,
+	maxPathBytes: 8192,
+	/** Requests a host serves at once for one peer. */
+	maxConcurrentRequestsPerPeer: 32,
+	/** Requests a client keeps in flight; the rest wait in a queue. */
+	maxClientInFlight: 16,
+	maxChatMessageBytes: 16384,
+	maxFileBytes: 104857600,
+	/** Files a peer may be sending us at once. */
+	maxIncomingFilesPerPeer: 3,
+	/** Received bytes kept for one peer, in flight included. Past it new files are refused. */
+	maxStoredIncomingBytesPerPeer: 524288e3,
+	requestTimeoutMs: 6e4,
+	bodyIdleTimeoutMs: 3e4,
+	/** Stop writing to the channel above this many buffered bytes. */
+	sendHighWaterMark: 1048576,
+	sendLowWaterMark: 262144
+};
+var CHUNK_KIND = {
+	requestBody: 1,
+	responseBody: 2,
+	fileBody: 3
+};
+var CHUNK_HEADER_BYTES = 6;
+var MAX_CHUNK_PAYLOAD_BYTES = LIMITS.maxChunkMessageBytes - CHUNK_HEADER_BYTES;
+function encodeControl(frame) {
+	const json = JSON.stringify(frame);
+	if (utf8Encode(json).length > LIMITS.maxControlFrameBytes) throw new Error("Control frame too large");
+	return json;
+}
+function isHeaderList(value) {
+	if (!Array.isArray(value) || value.length > LIMITS.maxHeaderCount) return false;
+	return value.every((h) => Array.isArray(h) && h.length === 2 && typeof h[0] === "string" && typeof h[1] === "string" && h[0].length <= 256 && h[1].length <= LIMITS.maxHeaderValueBytes);
+}
+function isStreamId(value) {
+	return typeof value === "number" && Number.isInteger(value) && value >= 0 && value <= 4294967295;
+}
+function isPayId(value) {
+	return typeof value === "string" && /^[A-Za-z0-9_-]{8,64}$/.test(value);
+}
+/** Decimal text, as in Paykit's Payment Amount: no floats on the wire. */
+function isAmount(value) {
+	return typeof value === "string" && /^(0|[1-9]\d{0,15})(\.\d{1,8})?$/.test(value);
+}
+function isUnit(value) {
+	return typeof value === "string" && /^[a-z0-9]{1,12}$/.test(value);
+}
+function isEndpoint(value) {
+	return Array.isArray(value) && value.length === 2 && typeof value[0] === "string" && value[0].length <= 64 && /^[a-z0-9][a-z0-9-]*(?:\/[1-9][0-9]*)?$/.test(value[0]) && typeof value[1] === "string" && value[1].length <= LIMITS.maxPaymentEndpointChars;
+}
+/** Returns null for anything malformed; callers drop the frame. */
+function decodeControl(text) {
+	if (text.length > LIMITS.maxControlFrameBytes || utf8Encode(text).length > LIMITS.maxControlFrameBytes) return null;
+	let raw;
+	try {
+		raw = JSON.parse(text);
+	} catch {
+		return null;
+	}
+	if (!raw || typeof raw !== "object") return null;
+	const f = raw;
+	switch (f.t) {
+		case "hello":
+			if (typeof f.v !== "number") return null;
+			return {
+				t: "hello",
+				v: f.v,
+				svc: f.svc,
+				nick: sanitizeNick(f.nick)
+			};
+		case "m":
+			if (typeof f.ts !== "number" || typeof f.m !== "string") return null;
+			if (utf8Encode(f.m).length > LIMITS.maxChatMessageBytes) return null;
+			return {
+				t: "m",
+				ts: f.ts,
+				m: f.m
+			};
+		case "call":
+			if (typeof f.s !== "string" || utf8Encode(f.s).length > LIMITS.maxChatMessageBytes) return null;
+			return {
+				t: "call",
+				s: f.s
+			};
+		case "svc": return {
+			t: "svc",
+			svc: f.svc
+		};
+		case "req":
+			if (!isStreamId(f.id) || typeof f.s !== "string" || typeof f.m !== "string") return null;
+			if (typeof f.p !== "string" || f.p.length > LIMITS.maxPathBytes || !isHeaderList(f.h)) return null;
+			return {
+				t: "req",
+				id: f.id,
+				s: f.s,
+				m: f.m,
+				p: f.p,
+				h: f.h,
+				b: f.b === true
+			};
+		case "res":
+			if (!isStreamId(f.id) || typeof f.st !== "number" || !Number.isInteger(f.st)) return null;
+			if (f.st < 100 || f.st > 599 || !isHeaderList(f.h)) return null;
+			return {
+				t: "res",
+				id: f.id,
+				st: f.st,
+				h: f.h,
+				b: f.b === true
+			};
+		case "file":
+			if (!isStreamId(f.id) || typeof f.f !== "string" || typeof f.ts !== "number") return null;
+			if (typeof f.n !== "string" || typeof f.m !== "string") return null;
+			if (typeof f.s !== "number" || !Number.isSafeInteger(f.s) || f.s < 0) return null;
+			return {
+				t: "file",
+				id: f.id,
+				f: f.f,
+				ts: f.ts,
+				n: f.n,
+				s: f.s,
+				m: f.m
+			};
+		case "pay-req":
+		case "pay": {
+			if (!isPayId(f.id) || typeof f.ts !== "number" || !isAmount(f.v) || !isUnit(f.u)) return null;
+			const memo = typeof f.memo === "string" ? f.memo.slice(0, 140) : void 0;
+			if (f.t === "pay-req") {
+				if (!Array.isArray(f.e) || f.e.length === 0 || f.e.length > 8 || !f.e.every(isEndpoint)) return null;
+				return {
+					t: "pay-req",
+					id: f.id,
+					ts: f.ts,
+					v: f.v,
+					u: f.u,
+					memo,
+					e: f.e,
+					a: isPayId(f.a) ? f.a : void 0,
+					n: f.n === "mainnet" || f.n === "testnet" ? f.n : void 0
+				};
+			}
+			if (!isEndpoint(f.e) || f.rid !== void 0 && !isPayId(f.rid)) return null;
+			return {
+				t: "pay",
+				id: f.id,
+				ts: f.ts,
+				rid: f.rid,
+				v: f.v,
+				u: f.u,
+				memo,
+				e: f.e
+			};
+		}
+		case "pay-ask":
+			if (!isPayId(f.id) || typeof f.ts !== "number" || !isAmount(f.v) || !isUnit(f.u)) return null;
+			if (f.m !== "arkade" && f.m !== "usdt" && f.m !== "bark" && f.m !== "bitcoin" && f.m !== "fedimint" && f.m !== "spark") return null;
+			return {
+				t: "pay-ask",
+				id: f.id,
+				ts: f.ts,
+				v: f.v,
+				u: f.u,
+				m: f.m,
+				memo: typeof f.memo === "string" ? f.memo.slice(0, 140) : void 0,
+				n: f.n === "mainnet" || f.n === "testnet" ? f.n : void 0
+			};
+		case "pay-res":
+			if (!isPayId(f.id) || typeof f.ok !== "boolean") return null;
+			if (f.v !== void 0 && !isAmount(f.v)) return null;
+			return {
+				t: "pay-res",
+				id: f.id,
+				ok: f.ok,
+				v: f.v,
+				err: typeof f.err === "string" ? f.err.slice(0, 200) : void 0,
+				...f.c === true && !f.ok ? { c: true } : {}
+			};
+		case "rst":
+			if (!isStreamId(f.id) || f.d !== "q" && f.d !== "s" && f.d !== "f") return null;
+			return {
+				t: "rst",
+				id: f.id,
+				d: f.d,
+				e: typeof f.e === "string" ? f.e.slice(0, 256) : ""
+			};
+		case "ping":
+		case "pong":
+			if (typeof f.ts !== "number") return null;
+			return {
+				t: f.t,
+				ts: f.ts
+			};
+		default: return null;
+	}
+}
+function encodeChunk(chunk) {
+	if (chunk.payload.length > MAX_CHUNK_PAYLOAD_BYTES) throw new Error("Chunk payload too large");
+	const out = new Uint8Array(CHUNK_HEADER_BYTES + chunk.payload.length);
+	const view = new DataView(out.buffer);
+	view.setUint8(0, chunk.kind);
+	view.setUint32(1, chunk.id);
+	view.setUint8(5, chunk.end ? 1 : 0);
+	out.set(chunk.payload, CHUNK_HEADER_BYTES);
+	return out;
+}
+function decodeChunk(data) {
+	if (data.length < CHUNK_HEADER_BYTES || data.length > LIMITS.maxChunkMessageBytes) return null;
+	const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
+	const kind = view.getUint8(0);
+	if (kind !== CHUNK_KIND.requestBody && kind !== CHUNK_KIND.responseBody && kind !== CHUNK_KIND.fileBody) return null;
+	return {
+		kind,
+		id: view.getUint32(1),
+		end: (view.getUint8(5) & 1) !== 0,
+		payload: data.subarray(CHUNK_HEADER_BYTES)
+	};
+}
+function wrapDataChannel(dc) {
+	dc.binaryType = "arraybuffer";
+	dc.bufferedAmountLowThreshold = LIMITS.sendLowWaterMark;
+	const channel = {
+		send(data) {
+			if (dc.readyState !== "open") throw new Error("Data link is not open");
+			if (typeof data === "string") dc.send(data);
+			else dc.send(data);
+		},
+		get bufferedAmount() {
+			return dc.bufferedAmount;
+		},
+		drained() {
+			if (dc.bufferedAmount <= LIMITS.sendLowWaterMark || dc.readyState !== "open") return Promise.resolve();
+			return new Promise((resolve) => {
+				const done = () => {
+					dc.removeEventListener("bufferedamountlow", done);
+					dc.removeEventListener("close", done);
+					resolve();
+				};
+				dc.addEventListener("bufferedamountlow", done);
+				dc.addEventListener("close", done);
+			});
+		},
+		close() {
+			dc.close();
+		},
+		binary: true,
+		onMessage: null,
+		onClose: null
+	};
+	dc.addEventListener("message", (event) => {
+		const data = event.data;
+		if (typeof data === "string") channel.onMessage?.(data);
+		else if (data instanceof ArrayBuffer) channel.onMessage?.(new Uint8Array(data));
+	});
+	dc.addEventListener("close", () => channel.onClose?.());
+	return channel;
+}
+/**
+* Resolves once the channel has room for a body's next chunk; undefined when it has now. A channel with a send budget
+* (native and iroh ones throw past 120 KiB) gives a body a quarter of it, as files/3 keeps to, so a ping or a message
+* still fits beside it; others keep under the high water mark.
+*/
+function bodyRoom(channel, isCancelled) {
+	if (!channel.sendBudget) return channel.bufferedAmount > LIMITS.sendHighWaterMark ? channel.drained() : void 0;
+	const line = channel.sendBudget / 4;
+	if (channel.bufferedAmount < line) return;
+	return (async () => {
+		while (!isCancelled() && channel.bufferedAmount >= line) {
+			await channel.drained().catch(() => {});
+			if (!isCancelled() && channel.bufferedAmount >= line) await new Promise((resolve) => setTimeout(resolve, 20));
+		}
+	})();
+}
+/** Writes a body as chunks, honouring backpressure. Always ends with an END chunk. */
+async function sendBody(channel, kind, id, body, isCancelled = () => false) {
+	for await (const part of body) for (let offset = 0; offset < part.length; offset += MAX_CHUNK_PAYLOAD_BYTES) {
+		if (isCancelled()) return;
+		const room = bodyRoom(channel, isCancelled);
+		if (room) {
+			await room;
+			if (isCancelled()) return;
+		}
+		const payload = part.subarray(offset, offset + MAX_CHUNK_PAYLOAD_BYTES);
+		channel.send(encodeChunk({
+			kind,
+			id,
+			end: false,
+			payload
+		}));
+	}
+	if (isCancelled()) return;
+	channel.send(encodeChunk({
+		kind,
+		id,
+		end: true,
+		payload: /* @__PURE__ */ new Uint8Array(0)
+	}));
+}
+//#endregion
 //#region ../core/src/http.ts
 var LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
 	"localhost",
@@ -5705,7 +6191,7 @@ var LinkSession = class {
 		const stepping = this.fastStepsAfter ? Date.now() - this.fastStepsAfter : -1;
 		if (pace === "fast" && stepping >= 0) return Math.min(4 * interval, Math.max(2 * interval, stepping));
 		if (pace === "fast" || pace === "connected" || since < 0) return interval;
-		if (pace === "background" && this.presence.lastPacketAt === 0 && this.invite()) return unusedInviteWait(Date.now() - this.awaitingSince, interval);
+		if (pace === "background" && !this.presence.online && this.invite()) return unusedInviteWait(Date.now() - this.awaitingSince, interval);
 		return Math.min(interval, Math.max(2 * this.intervals.fast, since));
 	}
 	/**
@@ -6791,32 +7277,1023 @@ function verifyChain(raw, groupId) {
 		if ("error" in result) return result;
 		chain.push(result.commit);
 	}
-	return { chain };
+	return { chain };
+}
+/**
+* What a commit is refused with while admin work is off on this device (WISP 06 § Forced takeover: after a forced
+* takeover or a restore, until the person turns on "Manage groups from this device").
+*/
+/**
+* The highest sequence number a frame of my own key, sent by another copy of my profile, may make me adopt (WISP 06):
+* the highest floor a copy can have (2^32 - 2^24) and room above it. The community beacon packs the counter in 32 bits.
+*/
+var OWN_FRAME_LIMIT = 2 ** 32 - 2 ** 23;
+/**
+* Frames said again (WISP 902, both profiles): a member's own frames that no edge took when it said them are
+* remembered (`kept`, the latest) and, once the chain it follows is newer than such a frame's and has not moved for
+* `settledMs`, looked at once for saying again where the members let in while it was behind can read them. A catch-up
+* brings commits one by one, and a frame said again at the first of them would still miss those let in by the next.
+*/
+var SAID_AGAIN = {
+	settledMs: 5e3,
+	kept: 64
+};
+/** `alone` with `key` added last, keeping only keys still `present` (frames still in the log), the latest `kept`. */
+function rememberAlone(alone, key, present) {
+	return [...(alone ?? []).filter((k) => k !== key && present(k)), key].slice(-SAID_AGAIN.kept);
+}
+var GROUP_ADMIN_OFF_ERROR = "Managing this group is off on this device. Turn on Manage groups from this device first.";
+//#endregion
+//#region ../core/src/canonicalJson.ts
+/** True when `s` holds a lone UTF-16 surrogate, which I-JSON (and so JCS) does not allow. */
+function hasLoneSurrogate(s) {
+	for (let i = 0; i < s.length; i++) {
+		const c = s.charCodeAt(i);
+		if (c >= 55296 && c <= 56319) {
+			const next = s.charCodeAt(i + 1);
+			if (next >= 56320 && next <= 57343) {
+				i++;
+				continue;
+			}
+			return true;
+		}
+		if (c >= 56320 && c <= 57343) return true;
+	}
+	return false;
+}
+function write(value, depth) {
+	if (depth > 64) throw new Error("JSON nested deeper than 64 levels");
+	if (value === null) return "null";
+	if (typeof value === "boolean") return value ? "true" : "false";
+	if (typeof value === "number") {
+		if (!Number.isFinite(value)) throw new Error("JSON numbers must be finite");
+		return JSON.stringify(value);
+	}
+	if (typeof value === "string") {
+		if (hasLoneSurrogate(value)) throw new Error("A JSON string holds a lone surrogate");
+		return JSON.stringify(value);
+	}
+	if (Array.isArray(value)) return `[${value.map((v) => write(v, depth + 1)).join(",")}]`;
+	if (typeof value === "object") {
+		const record = value;
+		return `{${Object.keys(value).filter((k) => record[k] !== void 0).sort((a, b) => a < b ? -1 : a > b ? 1 : 0).map((k) => {
+			if (hasLoneSurrogate(k)) throw new Error("A JSON key holds a lone surrogate");
+			return `${JSON.stringify(k)}:${write(record[k], depth + 1)}`;
+		}).join(",")}}`;
+	}
+	throw new Error(`Not a JSON value: ${typeof value}`);
+}
+/** The canonical text of a JSON value. Throws on a value JSON cannot hold (a non-finite number, a lone surrogate). */
+function canonicalJson(value) {
+	return write(value, 0);
+}
+/** The canonical UTF-8 bytes of a JSON value. */
+function canonicalJsonBytes(value) {
+	return utf8Encode(canonicalJson(value));
+}
+/**
+* Reads bytes that must be the canonical form of a JSON value: `not-json` when they are not UTF-8 JSON, `not-canonical`
+* when writing the value again gives other bytes.
+*/
+function readCanonicalJson(bytes) {
+	let value;
+	try {
+		value = JSON.parse(utf8Decode(bytes));
+	} catch (error) {
+		return {
+			ok: false,
+			reason: "not-json",
+			detail: error instanceof Error ? error.message : String(error)
+		};
+	}
+	let again;
+	try {
+		again = canonicalJsonBytes(value);
+	} catch (error) {
+		return {
+			ok: false,
+			reason: "not-canonical",
+			detail: error instanceof Error ? error.message : String(error)
+		};
+	}
+	if (!bytesEqual(again, bytes)) return {
+		ok: false,
+		reason: "not-canonical"
+	};
+	return {
+		ok: true,
+		value
+	};
+}
+//#endregion
+//#region ../core/src/appStatements.ts
+/** The prefixes of phase 1. The others of the WISP (reports, reviews, licences, rotation, publisher proofs) come later. */
+var APP_PREFIXES = {
+	app: "ghostly-app/1",
+	store: "ghostly-store/1",
+	revoke: "ghostly-revoke/1"
+};
+var APP_STATEMENT_LIMITS = {
+	/** A signature statement's canonical bytes: 52 + 86 characters of values and the keys around them. */
+	signatureBytes: 1024,
+	/** Digests named by one revocation. */
+	revokeDigests: 64,
+	/** A revocation's reason, in characters. */
+	reason: 200,
+	/** Revocations in one `ghostly-revoke.json`. */
+	revocations: 4096
+};
+/** A z-base32 Ed25519 public key: 52 characters that decode to 32 bytes and encode back to the same text. */
+function isAppKey(value) {
+	if (typeof value !== "string" || !/^[ybndrfg8ejkmcpqxot1uwisza345h769]{52}$/.test(value)) return false;
+	const bytes = fromZ32(value);
+	return bytes.length === 32 && toZ32(bytes) === value;
+}
+/** A SHA-256 in base64url without padding: 43 characters that decode to 32 bytes and encode back to the same text. */
+function isAppHash(value) {
+	if (typeof value !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(value)) return false;
+	return toBase64Url(fromBase64Url(value)) === value;
+}
+/** An app reference, `<publisher key>/<name>`. */
+var APP_NAME = /^[a-z][a-z0-9-]{0,31}$/;
+function isAppRef(value) {
+	if (typeof value !== "string") return false;
+	return value.indexOf("/") === 52 && isAppKey(value.slice(0, 52)) && APP_NAME.test(value.slice(53));
+}
+function appRef(publisher, name) {
+	return `${publisher}/${name}`;
+}
+/** The publisher key of a reference. */
+function appRefPublisher(ref) {
+	return ref.slice(0, 52);
+}
+/**
+* The publisher fingerprint people see: the first 16 z-base32 characters of the key (80 bits), in four groups.
+*/
+function appFingerprint(key) {
+	return (key.slice(0, 16).match(/.{1,4}/g) ?? []).join(" ");
+}
+/** The bytes a signature covers: the prefix, a zero byte, then the SHA-256 of the object's canonical bytes. */
+function appSignedBytes(prefix, canonical) {
+	const p = utf8Encode(prefix);
+	const out = new Uint8Array(p.length + 1 + 32);
+	out.set(p, 0);
+	out.set(sha256(canonical), p.length + 1);
+	return out;
+}
+/** Signs an object under a prefix: its canonical bytes and the signature statement. */
+async function signAppObject(prefix, value, signer) {
+	const bytes = canonicalJsonBytes(value);
+	const sig = await signer.sign(appSignedBytes(prefix, bytes));
+	return {
+		bytes,
+		signature: {
+			alg: "ed25519",
+			key: toZ32(signer.publicKey),
+			sig: toBase64Url(sig)
+		}
+	};
+}
+/**
+* Ed25519 verification as RFC 8032 writes it (`zip215: false`): canonical encodings of the point and the scalar only,
+* so every parser (this one, a Rust one with `verify_strict`) accepts exactly the same signatures.
+*/
+function strictVerify(signature, message, publicKey) {
+	try {
+		return ed25519.verify(signature, message, publicKey, { zip215: false });
+	} catch {
+		return false;
+	}
+}
+var exactKeys$1 = (value, keys, optional = []) => {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	const have = Object.keys(value);
+	return keys.every((k) => have.includes(k)) && have.every((k) => keys.includes(k) || optional.includes(k));
+};
+/** Checks the shape of a signature statement: exactly `alg`, `key` and `sig`, a 64-byte signature. */
+function isAppSignature(value) {
+	if (!exactKeys$1(value, [
+		"alg",
+		"key",
+		"sig"
+	])) return false;
+	if (value.alg !== "ed25519" || !isAppKey(value.key)) return false;
+	return typeof value.sig === "string" && /^[A-Za-z0-9_-]{86}$/.test(value.sig) && toBase64Url(fromBase64Url(value.sig)) === value.sig;
+}
+/** Reads a signature statement from its bytes, which must be canonical. */
+function readAppSignature(bytes) {
+	if (bytes.length > APP_STATEMENT_LIMITS.signatureBytes) return {
+		ok: false,
+		reason: "bad-signature-statement",
+		detail: "Too large"
+	};
+	const read = readCanonicalJson(bytes);
+	if (!read.ok) return {
+		ok: false,
+		reason: "bad-signature-statement",
+		detail: read.reason
+	};
+	if (!isAppSignature(read.value)) return {
+		ok: false,
+		reason: "bad-signature-statement",
+		detail: "Not {alg, key, sig}"
+	};
+	return {
+		ok: true,
+		signature: read.value
+	};
+}
+/**
+* Verifies a signature over an object's canonical bytes under a prefix, made by `key`: `signature-key` when the
+* statement names another key, `bad-signature` when it does not verify.
+*/
+function verifyAppSignature(prefix, canonical, signature, key) {
+	if (!isAppSignature(signature)) return {
+		ok: false,
+		reason: "bad-signature-statement"
+	};
+	if (signature.key !== key) return {
+		ok: false,
+		reason: "signature-key"
+	};
+	return strictVerify(fromBase64Url(signature.sig), appSignedBytes(prefix, canonical), fromZ32(key)) ? { ok: true } : {
+		ok: false,
+		reason: "bad-signature"
+	};
+}
+var isSequence = (v) => typeof v === "number" && Number.isSafeInteger(v) && v >= 1;
+var isPlainLine = (v, max) => typeof v === "string" && [...v].length <= max && !/\p{Cc}/u.test(v);
+/** Checks a revocation statement's shape; the reason it is refused, or null. */
+function checkAppRevokeStatement(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return "Not an object";
+	const v = value;
+	const byDigests = "digests" in v;
+	if (!exactKeys$1(v, [
+		"ghostlyRevoke",
+		"app",
+		byDigests ? "digests" : "upTo"
+	], ["reason"])) return "Keys are not ghostlyRevoke, app, and exactly one of digests and upTo (reason optional)";
+	if (v.ghostlyRevoke !== 1) return "ghostlyRevoke is not 1";
+	if (!isAppRef(v.app)) return "app is not a reference";
+	if (byDigests) {
+		const d = v.digests;
+		if (!Array.isArray(d) || d.length < 1 || d.length > APP_STATEMENT_LIMITS.revokeDigests) return "digests is not 1 to 64 digests";
+		if (!d.every(isAppHash) || new Set(d).size !== d.length) return "digests holds a bad or repeated digest";
+	} else if (!isSequence(v.upTo)) return "upTo is not a sequence";
+	if (v.reason !== void 0 && !isPlainLine(v.reason, APP_STATEMENT_LIMITS.reason)) return "reason is not one line of 200 characters";
+	return null;
+}
+/** Signs a revocation with the publisher's key. */
+async function signAppRevocation(statement, signer) {
+	const problem = checkAppRevokeStatement(statement);
+	if (problem) throw new Error(`Not a revocation: ${problem}`);
+	if (toZ32(signer.publicKey) !== appRefPublisher(statement.app)) throw new Error("A revocation is signed by its app's publisher");
+	const { signature } = await signAppObject(APP_PREFIXES.revoke, statement, signer);
+	return {
+		statement,
+		signature
+	};
+}
+/** What a checked revocation is kept by: the SHA-256 of its canonical bytes (statement and signature), base64url. */
+function appRevocationId(revocation) {
+	return toBase64Url(sha256(canonicalJsonBytes(revocation)));
+}
+/**
+* Reads one signed revocation (a parsed value, from `ghostly-revoke.json` or a store index's `revoked`): its shape, then
+* the signature under `ghostly-revoke/1` by the publisher its `app` names. One that `checked` holds verified before, so
+* its signature is not checked again; one that verifies now is added to it.
+*/
+function readAppRevocation(value, checked) {
+	const read = readAppRevocationShape(value);
+	if (!read.ok) return read;
+	const verified = verifyAppRevocation(read.revocation, checked);
+	return verified.ok ? read : verified;
+}
+/** The first half of `readAppRevocation`: the shape of a signed revocation, with no signature checked. */
+function readAppRevocationShape(value) {
+	if (!exactKeys$1(value, ["statement", "signature"])) return {
+		ok: false,
+		reason: "bad-revocation",
+		detail: "Keys are not statement and signature"
+	};
+	const problem = checkAppRevokeStatement(value.statement);
+	if (problem) return {
+		ok: false,
+		reason: "bad-revocation",
+		detail: problem
+	};
+	if (!isAppSignature(value.signature)) return {
+		ok: false,
+		reason: "bad-signature-statement"
+	};
+	return {
+		ok: true,
+		revocation: {
+			statement: value.statement,
+			signature: value.signature
+		}
+	};
+}
+/** The second half: the signature of a revocation of the right shape, unless `checked` holds it. */
+function verifyAppRevocation(revocation, checked) {
+	const id = checked && appRevocationId(revocation);
+	if (id !== void 0 && checked.has(id)) return { ok: true };
+	const verified = verifyAppSignature(APP_PREFIXES.revoke, canonicalJsonBytes(revocation.statement), revocation.signature, appRefPublisher(revocation.statement.app));
+	if (verified.ok && id !== void 0) checked.add(id);
+	return verified;
+}
+/**
+* Reads `ghostly-revoke.json`: canonical bytes holding a list of signed revocations. One that does not verify refuses the
+* file, as a store index's `revoked` does.
+*/
+function readAppRevocations(bytes) {
+	const read = readCanonicalJson(bytes);
+	if (!read.ok) return read;
+	if (!Array.isArray(read.value) || read.value.length > APP_STATEMENT_LIMITS.revocations) return {
+		ok: false,
+		reason: "bad-revocation",
+		detail: "Not a list of at most 4096 revocations"
+	};
+	const revocations = [];
+	for (const entry of read.value) {
+		const one = readAppRevocation(entry);
+		if (!one.ok) return one;
+		revocations.push(one.revocation);
+	}
+	return {
+		ok: true,
+		revocations
+	};
+}
+//#endregion
+//#region ../core/src/messageTime.ts
+/**
+* How far ahead of this device's clock a number a peer made from its clock may be (a pin's number, a status card's
+* times): clocks drift, but a time past this is the peer's choice, not its clock.
+*/
+var MESSAGE_CLOCK_SKEW_MS = 3e5;
+/**
+* The time a line of a group's history is kept under (a membership change, a rename): what its commit says, but at
+* most `MESSAGE_CLOCK_SKEW_MS` past this clock, and now when it is not a positive number. Messages do not use it:
+* they are placed where they arrive (below).
+*/
+function receivedTimestamp(ts, now = Date.now()) {
+	if (!Number.isFinite(ts) || ts <= 0) return now;
+	return Math.min(ts, now + MESSAGE_CLOCK_SKEW_MS);
+}
+/** The latest moment a date can hold. */
+var MAX_DATE_MS = 864e13;
+/** The time a sender says, as it is kept: a positive time a date can hold, or nothing. */
+function claimedTime(ts) {
+	return typeof ts === "number" && Number.isFinite(ts) && ts > 0 && ts <= MAX_DATE_MS ? ts : void 0;
+}
+/**
+* The place of a row stored now: this clock, and past the last place given in its chat, so rows that come in the
+* same millisecond (a hold pickup, a group's catch-up) keep the order they came in.
+*/
+function arrivalKey(now, last = 0) {
+	return Math.max(now, last + 1);
+}
+/** The time a message shows: what its sender said, never later than when it came. A row of mine shows its own time. */
+function shownTime(message) {
+	return message.sentAt === void 0 ? message.timestamp : Math.min(message.sentAt, message.timestamp);
+}
+/**
+* When something a peer dated happened (an edit), for this device: what the peer says, now at the latest, and now
+* when it says nothing a date can hold.
+*/
+function heardTime(ts, now = Date.now()) {
+	return Math.min(claimedTime(ts) ?? now, now);
+}
+//#endregion
+//#region ../core/src/statusCards.ts
+var STATUS_CARD_LIMITS = {
+	/** A card's JSON, as sent (UTF-8 bytes): with the fallback text it stays well inside every message bound. */
+	bytes: 8192,
+	/** The sender's id for the card: stable across its updates. */
+	id: 64,
+	title: 120,
+	/** The current step, a list item, a run's summary. */
+	line: 200,
+	branch: 120,
+	schedule: 80,
+	cron: 64,
+	linkLabel: 40,
+	url: 512,
+	items: 20,
+	links: 4,
+	runs: 10,
+	/** Any count on a card (a PR's number, lines, files; steps). */
+	count: 1e9,
+	/** How far ahead a routine's next run may be. */
+	nextRunMs: 316224e5,
+	/** Edits a message with a card takes (a text takes `MAX_EDITS_PER_MESSAGE`): a bot updates a long task often. */
+	edits: 5e3,
+	/** Labels on a task, and a label's length in characters. */
+	tags: 3,
+	tag: 24,
+	/** Buttons on a message (WISP 406 · Message Buttons). */
+	buttons: 6,
+	/** A button's id: what a press names. */
+	buttonId: 32,
+	/** A button's label, in characters. */
+	buttonLabel: 40,
+	/** An app card's title and version, in characters (WISP 405 § An app): the manifest's bounds. */
+	appTitle: 40,
+	appVersion: 32,
+	/** A usage card's label ("Claude") and account, in characters (WISP 405 § Usage). */
+	usageLabel: 24,
+	/** A usage window's name ("5 h", "week"), in characters. */
+	usageWindow: 16,
+	/** Windows beside a usage card's own, shown in its details. */
+	usageWindows: 3
+};
+/** How a button looks: `primary` is the one highlighted, `danger` warns; `neutral` when none is said. */
+var BUTTON_STYLES = [
+	"primary",
+	"neutral",
+	"danger"
+];
+var TASK_STATUSES = [
+	"queued",
+	"running",
+	"blocked",
+	"done",
+	"failed",
+	"cancelled"
+];
+/** A task that is still going: shown first, and counted on the chat's Tasks button. */
+var ACTIVE_TASK_STATUSES = [
+	"queued",
+	"running",
+	"blocked"
+];
+var ITEM_STATES = [
+	"pending",
+	"running",
+	"done",
+	"failed",
+	"skipped"
+];
+var ROUTINE_STATES = ["active", "paused"];
+var RUN_RESULTS = [
+	"ok",
+	"failed",
+	"skipped"
+];
+/**
+* Where a task's pull request stands: `draft` (not ready for review), `open` (ready for review), `merged`, `closed`
+* (closed without a merge). A reader that does not know the field shows the pull request as before.
+*/
+var PR_STATES = [
+	"draft",
+	"open",
+	"merged",
+	"closed"
+];
+/** How a pull request's checks stand. */
+var PR_CHECKS = [
+	"passing",
+	"failing",
+	"pending"
+];
+var ID$4 = /^[A-Za-z0-9_.:][A-Za-z0-9_.:-]{0,63}$/;
+/** A button's id: 1 to 32 of `A-Z a-z 0-9 _ . : -`, not starting with `-`. */
+var BUTTON_ID = /^[A-Za-z0-9_.:][A-Za-z0-9_.:-]{0,31}$/;
+var CRON = /^[0-9A-Za-z*,/?#\- ]{1,64}$/;
+/**
+* Whether a typed answer is a button's label or id (WISP 406 · Message Buttons): ignoring case and spaces at the ends.
+* Not the device's locale's case: the presser's and the author's apps must agree ("I" is not "ı" anywhere).
+*/
+var sameButtonText = (a, b) => a.trim().toLowerCase() === b.trim().toLowerCase();
+/**
+* Two buttons a typed answer could not tell apart, or none: a label that reads as an earlier label (`label`), or a
+* label that reads as another button's id (`id`), both as `sameButtonText` compares them. The labels as a reader keeps
+* them (one line, cleaned). `at` is the button that clashes, `with` the one it clashes with.
+*/
+function buttonLabelClash(buttons) {
+	const labels = buttons.map((button) => isObject$4(button) ? cardLine(button.label, Infinity) : void 0);
+	const ids = buttons.map((button) => isObject$4(button) && typeof button.id === "string" ? button.id : void 0);
+	for (const [at, label] of labels.entries()) {
+		if (!label) continue;
+		const twin = labels.findIndex((other, i) => i < at && !!other && sameButtonText(other, label));
+		if (twin !== -1) return {
+			at,
+			with: twin,
+			kind: "label"
+		};
+		const named = ids.findIndex((id, i) => i !== at && id !== void 0 && sameButtonText(id, label));
+		if (named !== -1) return {
+			at,
+			with: named,
+			kind: "id"
+		};
+	}
+}
+/** An app card's id, made from its reference: the app's name, a dot, the first 16 characters of the publisher key. */
+function appCardId(ref) {
+	return `${ref.slice(53)}.${ref.slice(0, 16)}`;
+}
+/** An app card's `sequence`: a whole number from 0 to 2^53 - 1. */
+var appSequence = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+var isObject$4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/** One line of display text: runs of space (line breaks included) become one space, then the display rules for names. */
+function cardLine(value, max) {
+	if (typeof value !== "string") return void 0;
+	return sanitizeDisplayText(value.replace(/\s+/gu, " "), max);
+}
+/**
+* An https link a card may show: no credentials, a host, no spaces or control characters, at most
+* `STATUS_CARD_LIMITS.url` characters. Returned as the parser writes it (a non-ASCII host in punycode).
+*/
+function cardUrl(value) {
+	if (typeof value !== "string" || !value || value.length > STATUS_CARD_LIMITS.url || /[\s\p{Cc}\p{Cf}]/u.test(value)) return void 0;
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		return;
+	}
+	if (url.protocol !== "https:" || !url.hostname || url.username || url.password) return void 0;
+	return url.href.length <= STATUS_CARD_LIMITS.url ? url.href : void 0;
+}
+var count = (value, min = 0) => typeof value === "number" && Number.isSafeInteger(value) && value >= min && value <= STATUS_CARD_LIMITS.count ? value : void 0;
+/** A time on a card as a reader keeps it: a positive whole number, never later than `latest`. */
+var time = (value, latest) => typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? Math.min(value, latest) : void 0;
+var oneOf = (values, value) => typeof value === "string" && values.includes(value) ? value : void 0;
+function readLinks(raw) {
+	if (!Array.isArray(raw)) return [];
+	const links = [];
+	for (const entry of raw.slice(0, STATUS_CARD_LIMITS.links)) {
+		if (!isObject$4(entry)) continue;
+		const url = cardUrl(entry.url);
+		if (!url) continue;
+		const label = cardLine(entry.label, STATUS_CARD_LIMITS.linkLabel);
+		links.push({
+			url,
+			...label && { label }
+		});
+	}
+	return links;
+}
+/** A task's labels as a reader keeps them: the first `STATUS_CARD_LIMITS.tags` that hold, each one clean line, none twice. */
+function readTags(raw) {
+	if (!Array.isArray(raw)) return [];
+	const tags = [];
+	for (const entry of raw) {
+		const tag = cardLine(entry, STATUS_CARD_LIMITS.tag);
+		if (tag && !tags.includes(tag)) tags.push(tag);
+		if (tags.length === STATUS_CARD_LIMITS.tags) break;
+	}
+	return tags;
+}
+function readRun(raw, now) {
+	if (!isObject$4(raw)) return void 0;
+	const at = time(raw.at, now + MESSAGE_CLOCK_SKEW_MS), result = oneOf(RUN_RESULTS, raw.result);
+	if (!at || !result) return void 0;
+	const summary = cardLine(raw.summary, STATUS_CARD_LIMITS.line);
+	return {
+		at,
+		result,
+		...summary && { summary }
+	};
+}
+/** A percent as a reader keeps it: a finite number, rounded and clamped into 0 to 100. */
+var percent = (value) => typeof value === "number" && Number.isFinite(value) ? Math.round(Math.min(100, Math.max(0, value))) : void 0;
+/** A time ahead of the reader (a reset, a next run) as it keeps it: whole, positive, at most a year ahead. */
+var ahead = (value, now) => typeof value === "number" && Number.isSafeInteger(value) && value > 0 && value <= now + STATUS_CARD_LIMITS.nextRunMs ? value : void 0;
+/** A usage card as a reader keeps it (WISP 405 § Usage): dropped without a percent left or a used of limit. */
+function readUsage(raw, id, now) {
+	const left = percent(raw.left);
+	let used = count(raw.used), limit = count(raw.limit, 1);
+	if (used === void 0 || limit === void 0 || used > limit) used = limit = void 0;
+	if (left === void 0 && limit === void 0) return void 0;
+	const label = cardLine(raw.label, STATUS_CARD_LIMITS.usageLabel), account = cardLine(raw.account, STATUS_CARD_LIMITS.usageLabel);
+	const window = cardLine(raw.window, STATUS_CARD_LIMITS.usageWindow);
+	const resetsAt = ahead(raw.resetsAt, now), updatedAt = time(raw.updatedAt, now + MESSAGE_CLOCK_SKEW_MS);
+	const windows = [];
+	if (Array.isArray(raw.windows)) for (const entry of raw.windows.slice(0, STATUS_CARD_LIMITS.usageWindows)) {
+		if (!isObject$4(entry)) continue;
+		const name = cardLine(entry.window, STATUS_CARD_LIMITS.usageWindow), share = percent(entry.left);
+		if (!name || share === void 0) continue;
+		const at = ahead(entry.resetsAt, now);
+		windows.push({
+			window: name,
+			left: share,
+			...at && { resetsAt: at }
+		});
+	}
+	return {
+		kind: "usage",
+		id,
+		...left !== void 0 && { left },
+		...used !== void 0 && limit !== void 0 && {
+			used,
+			limit
+		},
+		...label && { label },
+		...account && { account },
+		...window && { window },
+		...resetsAt && { resetsAt },
+		...updatedAt && { updatedAt },
+		...windows.length && { windows }
+	};
+}
+/** How much of a usage card's quota is left, 0 to 100: its own percent, else worked out from used of limit. */
+function usageLeft(card) {
+	if (card.left !== void 0) return card.left;
+	return card.used !== void 0 && card.limit ? Math.round((card.limit - card.used) / card.limit * 100) : 0;
+}
+/** The bytes a card takes on the wire: what `STATUS_CARD_LIMITS.bytes` bounds. */
+function statusCardBytes(card) {
+	try {
+		return utf8Encode(JSON.stringify(card) ?? "").length;
+	} catch {
+		return Infinity;
+	}
 }
 /**
-* What a commit is refused with while admin work is off on this device (WISP 06 § Forced takeover: after a forced
-* takeover or a restore, until the person turns on "Manage groups from this device").
-*/
-/**
-* The highest sequence number a frame of my own key, sent by another copy of my profile, may make me adopt (WISP 06):
-* the highest floor a copy can have (2^32 - 2^24) and room above it. The community beacon packs the counter in 32 bits.
+* A card as a reader takes it from the wire (`sc`), or undefined when it cannot stand: not an object, past
+* `STATUS_CARD_LIMITS.bytes`, a kind this app does not know, no valid id, title or name, status or state. Fields that do
+* not hold are left out and lists are cut to their bound; times are kept no later than the reader's clock allows (a
+* routine's next run up to a year ahead). The message is always kept: without a card it shows its text.
 */
-var OWN_FRAME_LIMIT = 2 ** 32 - 2 ** 23;
+function readStatusCard(raw, now = Date.now()) {
+	if (!isObject$4(raw) || statusCardBytes(raw) > STATUS_CARD_LIMITS.bytes) return void 0;
+	const id = typeof raw.id === "string" && ID$4.test(raw.id) ? raw.id : void 0;
+	if (!id) return void 0;
+	if (raw.kind === "app") {
+		if (!isAppRef(raw.ref) || id !== appCardId(raw.ref) || !isAppHash(raw.digest) || !appSequence(raw.sequence)) return void 0;
+		const title = cardLine(raw.title, STATUS_CARD_LIMITS.appTitle);
+		if (!title) return void 0;
+		const version = cardLine(raw.version, STATUS_CARD_LIMITS.appVersion), url = cardUrl(raw.url);
+		return {
+			kind: "app",
+			id,
+			ref: raw.ref,
+			digest: raw.digest,
+			sequence: raw.sequence,
+			title,
+			...version && { version },
+			...url && { url },
+			...raw.opened === true && { opened: true }
+		};
+	}
+	const latest = now + MESSAGE_CLOCK_SKEW_MS;
+	if (raw.kind === "usage") return readUsage(raw, id, now);
+	const links = readLinks(raw.links);
+	if (raw.kind === "task") {
+		const title = cardLine(raw.title, STATUS_CARD_LIMITS.title), status = oneOf(TASK_STATUSES, raw.status);
+		if (!title || !status) return void 0;
+		const progress = typeof raw.progress === "number" && Number.isFinite(raw.progress) ? Math.round(Math.min(100, Math.max(0, raw.progress))) : void 0;
+		let done = count(raw.done), total = count(raw.total, 1);
+		if (done === void 0 || total === void 0 || done > total) done = total = void 0;
+		const step = cardLine(raw.step, STATUS_CARD_LIMITS.line), branch = cardLine(raw.branch, STATUS_CARD_LIMITS.branch);
+		let pr;
+		if (isObject$4(raw.pr)) {
+			const url = cardUrl(raw.pr.url);
+			if (url) {
+				const number = count(raw.pr.number, 1), additions = count(raw.pr.additions), deletions = count(raw.pr.deletions), files = count(raw.pr.files);
+				const state = oneOf(PR_STATES, raw.pr.state), checks = oneOf(PR_CHECKS, raw.pr.checks);
+				pr = {
+					url,
+					...number !== void 0 && { number },
+					...additions !== void 0 && { additions },
+					...deletions !== void 0 && { deletions },
+					...files !== void 0 && { files },
+					...state && { state },
+					...checks && { checks }
+				};
+			}
+		}
+		const items = [];
+		if (Array.isArray(raw.items)) for (const entry of raw.items.slice(0, STATUS_CARD_LIMITS.items)) {
+			if (!isObject$4(entry)) continue;
+			const text = cardLine(entry.text, STATUS_CARD_LIMITS.line);
+			if (text) items.push({
+				text,
+				state: oneOf(ITEM_STATES, entry.state) ?? "pending"
+			});
+		}
+		const startedAt = time(raw.startedAt, latest), updatedAt = time(raw.updatedAt, latest);
+		const tags = readTags(raw.tags);
+		const parent = typeof raw.parent === "string" && ID$4.test(raw.parent) && raw.parent !== id ? raw.parent : void 0;
+		return {
+			kind: "task",
+			id,
+			title,
+			status,
+			...progress !== void 0 && { progress },
+			...done !== void 0 && total !== void 0 && {
+				done,
+				total
+			},
+			...step && { step },
+			...pr && { pr },
+			...branch && { branch },
+			...startedAt && { startedAt },
+			...updatedAt && { updatedAt },
+			...items.length && { items },
+			...links.length && { links },
+			...tags.length && { tags },
+			...parent && { parent }
+		};
+	}
+	if (raw.kind === "routine") {
+		const name = cardLine(raw.name, STATUS_CARD_LIMITS.title), schedule = cardLine(raw.schedule, STATUS_CARD_LIMITS.schedule), state = oneOf(ROUTINE_STATES, raw.state);
+		if (!name || !schedule || !state) return void 0;
+		const cron = typeof raw.cron === "string" && CRON.test(raw.cron.trim()) ? raw.cron.trim() : void 0;
+		const lastRun = readRun(raw.lastRun, now);
+		const nextRunAt = typeof raw.nextRunAt === "number" && Number.isSafeInteger(raw.nextRunAt) && raw.nextRunAt > 0 && raw.nextRunAt <= now + STATUS_CARD_LIMITS.nextRunMs ? raw.nextRunAt : void 0;
+		const runs = [];
+		if (Array.isArray(raw.runs)) for (const entry of raw.runs.slice(0, STATUS_CARD_LIMITS.runs)) {
+			const run = readRun(entry, now);
+			if (run) runs.push(run);
+		}
+		return {
+			kind: "routine",
+			id,
+			name,
+			schedule,
+			state,
+			...cron && { cron },
+			...lastRun && { lastRun },
+			...nextRunAt && { nextRunAt },
+			...runs.length && { runs },
+			...links.length && { links }
+		};
+	}
+	if (raw.kind === "buttons") {
+		if (!Array.isArray(raw.buttons)) return void 0;
+		const buttons = [], seen = /* @__PURE__ */ new Set();
+		for (const entry of raw.buttons.slice(0, STATUS_CARD_LIMITS.buttons)) {
+			if (!isObject$4(entry) || typeof entry.id !== "string" || !BUTTON_ID.test(entry.id) || seen.has(entry.id)) continue;
+			const label = cardLine(entry.label, STATUS_CARD_LIMITS.buttonLabel);
+			if (!label) continue;
+			seen.add(entry.id);
+			const style = oneOf(BUTTON_STYLES, entry.style);
+			buttons.push({
+				id: entry.id,
+				label,
+				...style && style !== "neutral" && { style },
+				...entry.once === true && { once: true }
+			});
+		}
+		if (!buttons.length) return void 0;
+		const chosen = typeof raw.chosen === "string" && seen.has(raw.chosen) ? raw.chosen : void 0;
+		return {
+			kind: "buttons",
+			id,
+			buttons,
+			...chosen && { chosen },
+			...raw.closed === true && { closed: true }
+		};
+	}
+}
 /**
-* Frames said again (WISP 902, both profiles): a member's own frames that no edge took when it said them are
-* remembered (`kept`, the latest) and, once the chain it follows is newer than such a frame's and has not moved for
-* `settledMs`, looked at once for saying again where the members let in while it was behind can read them. A catch-up
-* brings commits one by one, and a frame said again at the first of them would still miss those let in by the next.
+* A card as a sender may send it, or why not: the reader's rule, but anything it would leave out or cut is refused
+* here instead (an unknown status, a link that is not https, a list past its bound, a line too long), so a bot learns
+* at once and nothing it said is lost on the way. Line breaks and invisible characters are cleaned, as a reader would.
 */
-var SAID_AGAIN = {
-	settledMs: 5e3,
-	kept: 64
+function checkStatusCard(raw, now = Date.now()) {
+	if (!isObject$4(raw)) return { error: "A card is an object" };
+	const bytes = statusCardBytes(raw);
+	if (bytes > STATUS_CARD_LIMITS.bytes) return { error: `The card takes ${bytes} bytes; at most ${STATUS_CARD_LIMITS.bytes}` };
+	if (raw.kind !== "task" && raw.kind !== "routine" && raw.kind !== "buttons" && raw.kind !== "app" && raw.kind !== "usage") return { error: "kind is task, routine, buttons, app or usage" };
+	if (typeof raw.id !== "string" || !ID$4.test(raw.id)) return { error: `id is 1 to ${STATUS_CARD_LIMITS.id} of A-Z a-z 0-9 _ . : - and does not start with -` };
+	const line = (field, value, max, required = false) => {
+		if (value === void 0 && !required) return null;
+		if (typeof value !== "string" || !cardLine(value, Infinity)) return `${field} is text`;
+		if ([...cardLine(value, Infinity)].length > max) return `${field} is at most ${max} characters`;
+		return null;
+	};
+	const url = (field, value) => cardUrl(value) ? null : `${field} must be an https link of at most ${STATUS_CARD_LIMITS.url} characters`;
+	const whole = (field, value, min = 0) => value === void 0 || count(value, min) !== void 0 ? null : `${field} is a whole number from ${min}`;
+	const errors = [];
+	if (raw.links !== void 0) {
+		if (!Array.isArray(raw.links) || raw.links.length > STATUS_CARD_LIMITS.links) errors.push(`links is a list of at most ${STATUS_CARD_LIMITS.links}`);
+		else for (const [i, link] of raw.links.entries()) {
+			if (!isObject$4(link)) {
+				errors.push(`links[${i}] is an object`);
+				continue;
+			}
+			errors.push(url(`links[${i}].url`, link.url), line(`links[${i}].label`, link.label, STATUS_CARD_LIMITS.linkLabel));
+		}
+	}
+	const share = (field, value) => value === void 0 || typeof value === "number" && Number.isFinite(value) && value >= 0 && value <= 100 ? null : `${field} is a number from 0 to 100`;
+	const reset = (field, value) => value === void 0 || ahead(value, now) !== void 0 ? null : `${field} is a time in milliseconds, within a year`;
+	if (raw.kind === "usage") {
+		if (raw.links !== void 0) errors.push("a usage card takes no links");
+		if (raw.left === void 0 && raw.used === void 0) errors.push("left (a percent) or used and limit");
+		errors.push(share("left", raw.left));
+		if (raw.used === void 0 !== (raw.limit === void 0)) errors.push("used and limit go together");
+		else if (raw.used !== void 0) {
+			errors.push(whole("used", raw.used), whole("limit", raw.limit, 1));
+			if (typeof raw.used === "number" && typeof raw.limit === "number" && raw.used > raw.limit) errors.push("used is at most limit");
+		}
+		errors.push(line("label", raw.label, STATUS_CARD_LIMITS.usageLabel), line("account", raw.account, STATUS_CARD_LIMITS.usageLabel), line("window", raw.window, STATUS_CARD_LIMITS.usageWindow), reset("resetsAt", raw.resetsAt));
+		if (raw.updatedAt !== void 0 && !(typeof raw.updatedAt === "number" && Number.isSafeInteger(raw.updatedAt) && raw.updatedAt > 0 && raw.updatedAt <= now + 3e5)) errors.push("updatedAt is a time in milliseconds, not in the future");
+		if (raw.windows !== void 0) {
+			if (!Array.isArray(raw.windows) || raw.windows.length > STATUS_CARD_LIMITS.usageWindows) errors.push(`windows is a list of at most ${STATUS_CARD_LIMITS.usageWindows}`);
+			else for (const [i, entry] of raw.windows.entries()) {
+				if (!isObject$4(entry)) {
+					errors.push(`windows[${i}] is an object`);
+					continue;
+				}
+				errors.push(line(`windows[${i}].window`, entry.window, STATUS_CARD_LIMITS.usageWindow, true));
+				errors.push(entry.left === void 0 ? `windows[${i}].left is a number from 0 to 100` : share(`windows[${i}].left`, entry.left), reset(`windows[${i}].resetsAt`, entry.resetsAt));
+			}
+		}
+	} else if (raw.kind === "app") {
+		if (raw.links !== void 0) errors.push("an app card takes no links");
+		if (!isAppRef(raw.ref)) errors.push("ref is <publisher key in z-base32>/<name>");
+		else if (raw.id !== appCardId(raw.ref)) errors.push(`id is ${appCardId(raw.ref)}, made from ref`);
+		if (!isAppHash(raw.digest)) errors.push("digest is a SHA-256 in base64url without padding");
+		if (!appSequence(raw.sequence)) errors.push("sequence is a whole number from 0 to 2^53 - 1");
+		errors.push(line("title", raw.title, STATUS_CARD_LIMITS.appTitle, true), line("version", raw.version, STATUS_CARD_LIMITS.appVersion));
+		if (raw.url !== void 0) errors.push(url("url", raw.url));
+		if (raw.opened !== void 0 && raw.opened !== true) errors.push("opened is true or left out");
+	} else if (raw.kind === "buttons") {
+		if (raw.links !== void 0) errors.push("buttons take no links");
+		if (!Array.isArray(raw.buttons) || !raw.buttons.length || raw.buttons.length > STATUS_CARD_LIMITS.buttons) errors.push(`buttons is a list of 1 to ${STATUS_CARD_LIMITS.buttons}`);
+		else {
+			const ids = /* @__PURE__ */ new Set();
+			for (const [i, button] of raw.buttons.entries()) {
+				if (!isObject$4(button)) {
+					errors.push(`buttons[${i}] is an object`);
+					continue;
+				}
+				if (typeof button.id !== "string" || !BUTTON_ID.test(button.id)) errors.push(`buttons[${i}].id is 1 to ${STATUS_CARD_LIMITS.buttonId} of A-Z a-z 0-9 _ . : - and does not start with -`);
+				else if (ids.has(button.id)) errors.push(`buttons[${i}].id "${button.id}" is used twice`);
+				else ids.add(button.id);
+				errors.push(line(`buttons[${i}].label`, button.label, STATUS_CARD_LIMITS.buttonLabel, true));
+				if (button.style !== void 0 && !oneOf(BUTTON_STYLES, button.style)) errors.push(`buttons[${i}].style is one of ${BUTTON_STYLES.join(", ")}`);
+				if (button.once !== void 0 && button.once !== true) errors.push(`buttons[${i}].once is true or left out`);
+			}
+			const clash = buttonLabelClash(raw.buttons);
+			if (clash) errors.push(`buttons[${clash.at}].label ${JSON.stringify(cardLine(raw.buttons[clash.at].label, Infinity))} ${clash.kind === "label" ? `repeats buttons[${clash.with}].label` : `is buttons[${clash.with}].id`} (ignoring case and spaces at the ends)`);
+			if (raw.chosen !== void 0 && !(typeof raw.chosen === "string" && ids.has(raw.chosen))) errors.push("chosen names one of the buttons");
+		}
+		if (raw.closed !== void 0 && raw.closed !== true) errors.push("closed is true or left out");
+	} else if (raw.kind === "task") {
+		errors.push(line("title", raw.title, STATUS_CARD_LIMITS.title, true));
+		if (!oneOf(TASK_STATUSES, raw.status)) errors.push(`status is one of ${TASK_STATUSES.join(", ")}`);
+		if (raw.progress !== void 0 && !(typeof raw.progress === "number" && Number.isFinite(raw.progress) && raw.progress >= 0 && raw.progress <= 100)) errors.push("progress is a number from 0 to 100");
+		if (raw.done === void 0 !== (raw.total === void 0)) errors.push("done and total go together");
+		else if (raw.done !== void 0) {
+			errors.push(whole("done", raw.done), whole("total", raw.total, 1));
+			if (typeof raw.done === "number" && typeof raw.total === "number" && raw.done > raw.total) errors.push("done is at most total");
+		}
+		errors.push(line("step", raw.step, STATUS_CARD_LIMITS.line), line("branch", raw.branch, STATUS_CARD_LIMITS.branch));
+		if (raw.pr !== void 0) {
+			if (!isObject$4(raw.pr)) errors.push("pr is an object");
+			else {
+				errors.push(url("pr.url", raw.pr.url), whole("pr.number", raw.pr.number, 1), whole("pr.additions", raw.pr.additions), whole("pr.deletions", raw.pr.deletions), whole("pr.files", raw.pr.files));
+				if (raw.pr.state !== void 0 && !oneOf(PR_STATES, raw.pr.state)) errors.push(`pr.state is one of ${PR_STATES.join(", ")}`);
+				if (raw.pr.checks !== void 0 && !oneOf(PR_CHECKS, raw.pr.checks)) errors.push(`pr.checks is one of ${PR_CHECKS.join(", ")}`);
+			}
+		}
+		if (raw.tags !== void 0) {
+			if (!Array.isArray(raw.tags) || raw.tags.length > STATUS_CARD_LIMITS.tags) errors.push(`tags is a list of at most ${STATUS_CARD_LIMITS.tags}`);
+			else {
+				const seen = /* @__PURE__ */ new Set();
+				for (const [i, tag] of raw.tags.entries()) {
+					const problem = line(`tags[${i}]`, tag, STATUS_CARD_LIMITS.tag, true);
+					errors.push(problem);
+					if (problem) continue;
+					const clean = cardLine(tag, Infinity);
+					if (seen.has(clean)) errors.push(`tags[${i}] ${JSON.stringify(clean)} is there twice`);
+					seen.add(clean);
+				}
+			}
+		}
+		if (raw.parent !== void 0) {
+			if (typeof raw.parent !== "string" || !ID$4.test(raw.parent)) errors.push(`parent is another task's id: 1 to ${STATUS_CARD_LIMITS.id} of A-Z a-z 0-9 _ . : - and does not start with -`);
+			else if (raw.parent === raw.id) errors.push("parent is another task's id, not its own");
+		}
+		for (const field of ["startedAt", "updatedAt"]) {
+			const value = raw[field];
+			if (value !== void 0 && !(typeof value === "number" && Number.isSafeInteger(value) && value > 0 && value <= now + 3e5)) errors.push(`${field} is a time in milliseconds, not in the future`);
+		}
+		if (raw.items !== void 0) {
+			if (!Array.isArray(raw.items) || raw.items.length > STATUS_CARD_LIMITS.items) errors.push(`items is a list of at most ${STATUS_CARD_LIMITS.items}`);
+			else for (const [i, item] of raw.items.entries()) {
+				if (!isObject$4(item)) {
+					errors.push(`items[${i}] is an object`);
+					continue;
+				}
+				errors.push(line(`items[${i}].text`, item.text, STATUS_CARD_LIMITS.line, true));
+				if (item.state !== void 0 && !oneOf(ITEM_STATES, item.state)) errors.push(`items[${i}].state is one of ${ITEM_STATES.join(", ")}`);
+			}
+		}
+	} else {
+		errors.push(line("name", raw.name, STATUS_CARD_LIMITS.title, true), line("schedule", raw.schedule, STATUS_CARD_LIMITS.schedule, true));
+		if (!oneOf(ROUTINE_STATES, raw.state)) errors.push(`state is one of ${ROUTINE_STATES.join(", ")}`);
+		if (raw.cron !== void 0 && !(typeof raw.cron === "string" && CRON.test(raw.cron.trim()))) errors.push(`cron is a cron line of at most ${STATUS_CARD_LIMITS.cron} characters`);
+		if (raw.nextRunAt !== void 0 && !(typeof raw.nextRunAt === "number" && Number.isSafeInteger(raw.nextRunAt) && raw.nextRunAt > 0 && raw.nextRunAt <= now + STATUS_CARD_LIMITS.nextRunMs)) errors.push("nextRunAt is a time in milliseconds, within a year");
+		const run = (field, value) => {
+			if (!isObject$4(value)) return errors.push(`${field} is an object`);
+			if (!(typeof value.at === "number" && Number.isSafeInteger(value.at) && value.at > 0 && value.at <= now + 3e5)) errors.push(`${field}.at is a time in milliseconds, not in the future`);
+			if (!oneOf(RUN_RESULTS, value.result)) errors.push(`${field}.result is one of ${RUN_RESULTS.join(", ")}`);
+			errors.push(line(`${field}.summary`, value.summary, STATUS_CARD_LIMITS.line));
+		};
+		if (raw.lastRun !== void 0) run("lastRun", raw.lastRun);
+		if (raw.runs !== void 0) {
+			if (!Array.isArray(raw.runs) || raw.runs.length > STATUS_CARD_LIMITS.runs) errors.push(`runs is a list of at most ${STATUS_CARD_LIMITS.runs}`);
+			else raw.runs.forEach((entry, i) => run(`runs[${i}]`, entry));
+		}
+	}
+	const error = errors.find((e) => typeof e === "string");
+	if (error) return { error };
+	const card = readStatusCard(raw, now);
+	return card ? { card } : { error: "The card does not hold" };
+}
+/** The progress a task shows, 0 to 100: its own, else its steps done of total; undefined when it says neither. */
+function taskProgress(card) {
+	if (card.progress !== void 0) return card.progress;
+	return card.done !== void 0 && card.total ? Math.round(card.done / card.total * 100) : void 0;
+}
+var TASK_MARK = {
+	queued: "⏳",
+	running: "🔄",
+	blocked: "⛔",
+	done: "✅",
+	failed: "❌",
+	cancelled: "🚫"
 };
-/** `alone` with `key` added last, keeping only keys still `present` (frames still in the log), the latest `kept`. */
-function rememberAlone(alone, key, present) {
-	return [...(alone ?? []).filter((k) => k !== key && present(k)), key].slice(-SAID_AGAIN.kept);
+var STATUS_WORD = {
+	queued: "Queued",
+	running: "Running",
+	blocked: "Blocked",
+	done: "Done",
+	failed: "Failed",
+	cancelled: "Cancelled"
+};
+var RESULT_WORD = {
+	ok: "ok",
+	failed: "failed",
+	skipped: "skipped"
+};
+/** A time as the fallback text says it: in UTC, to the minute ("2026-09-30 01:00 UTC"). */
+function cardTimeUtc(ms) {
+	return `${new Date(ms).toISOString().slice(0, 16).replace("T", " ")} UTC`;
+}
+/**
+* The text a card's message carries: what an app without cards shows, the DHT floor carries, the chat list previews
+* and search finds. Plain lines, the first naming the card, no bars or layout that would read badly elsewhere.
+*/
+function statusCardText(card) {
+	if (card.kind === "app") {
+		const named = `${card.title}${card.version ? ` ${card.version}` : ""}`;
+		return [card.opened ? `🧩 Opened ${named} in this chat (Ghostly app)` : `🧩 ${named} (Ghostly app)`, ...card.url ? [card.url] : []].join("\n");
+	}
+	if (card.kind === "usage") {
+		const left = `${usageLeft(card)}% left${card.window ? ` (${card.window})` : ""}`;
+		return [
+			`📊 ${card.label ?? "Usage"}`,
+			...card.account ? [card.account] : [],
+			left,
+			...card.used !== void 0 && card.limit !== void 0 ? [`${card.used} of ${card.limit} used`] : [],
+			...card.resetsAt ? [`resets ${cardTimeUtc(card.resetsAt)}`] : [],
+			...(card.windows ?? []).map((w) => `${w.window} ${w.left}%`)
+		].join(" · ");
+	}
+	if (card.kind === "buttons") return `Reply: ${card.buttons.map((b) => b.label).join(" / ")}`;
+	if (card.kind === "task") {
+		const progress = taskProgress(card);
+		const state = [
+			STATUS_WORD[card.status],
+			...progress !== void 0 ? [`${progress}%`] : [],
+			...card.done !== void 0 && card.total ? [`${card.done} of ${card.total} steps`] : []
+		].join(" · ");
+		const standing = card.pr && [...card.pr.state ? [card.pr.state] : [], ...card.pr.checks ? [`checks ${card.pr.checks}`] : []].join(", ");
+		const pr = card.pr && [
+			`PR${card.pr.number !== void 0 ? ` #${card.pr.number}` : ""}`,
+			...card.pr.additions !== void 0 || card.pr.deletions !== void 0 ? [`+${card.pr.additions ?? 0} -${card.pr.deletions ?? 0}`] : [],
+			...standing ? [`(${standing})`] : []
+		].join(" ") + `: ${card.pr.url}`;
+		const now = card.step && ACTIVE_TASK_STATUSES.includes(card.status) ? [`Now: ${card.step}`] : [];
+		return [
+			`${TASK_MARK[card.status]} ${card.title}`,
+			state,
+			...now,
+			...pr ? [pr] : [],
+			...card.tags?.length ? [`Tags: ${card.tags.join(", ")}`] : [],
+			...card.parent ? [`Part of: ${card.parent}`] : []
+		].join("\n");
+	}
+	const last = card.lastRun && `Last run: ${RESULT_WORD[card.lastRun.result]}, ${cardTimeUtc(card.lastRun.at)}${card.lastRun.summary ? ` · ${card.lastRun.summary}` : ""}`;
+	return [
+		`🔁 ${card.name}`,
+		`${card.schedule} · ${card.state === "active" ? "active" : "paused"}`,
+		...last ? [last] : [],
+		...card.nextRunAt && card.state === "active" ? [`Next run: ${cardTimeUtc(card.nextRunAt)}`] : []
+	].join("\n");
+}
+/** Whether a message's edit number holds: a text's bound, or a card message's when the edit carries a card. */
+function cardEditNumber(e) {
+	return Number.isSafeInteger(e) && e >= 1 && e <= STATUS_CARD_LIMITS.edits;
 }
-var GROUP_ADMIN_OFF_ERROR = "Managing this group is off on this device. Turn on Manage groups from this device first.";
 //#endregion
 //#region ../core/src/replies.ts
 var REPLY_LIMITS = {
@@ -6840,8 +8317,7 @@ var INLINE_PICTURE = /^data:image\//i;
 */
 function replySnippet(text) {
 	if (INLINE_PICTURE.test(text.trimStart())) return "🖼️ Picture";
-	const flat = text.slice(0, REPLY_LIMITS.raw * 2).replace(/\s+/gu, " ");
-	const clean = sanitizeDisplayText(flat, REPLY_LIMITS.snippet + 1) ?? "";
+	const clean = sanitizeDisplayText(text.slice(0, REPLY_LIMITS.raw * 2).replace(/\s+/gu, " "), REPLY_LIMITS.snippet + 1) ?? "";
 	const points = [...clean];
 	return points.length > REPLY_LIMITS.snippet ? `${points.slice(0, REPLY_LIMITS.snippet - 1).join("").trimEnd()}…` : clean;
 }
@@ -7217,7 +8693,7 @@ function previewImageSize(value) {
 	if (binary.length > LINK_PREVIEW_LIMITS.imageBytes) return;
 	const bytes = new Uint8Array(binary.length);
 	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
-	return jpegSize(bytes);
+	return jpegSize$1(bytes);
 }
 /** The thumbnail if it is one Ghostly shows: a JPEG data URL within the limits whose header declares a sane size. */
 function sanitizePreviewImage(value) {
@@ -7378,6 +8854,483 @@ var RateWindow = class {
 	}
 };
 //#endregion
+//#region ../core/src/video.ts
+var VIDEO_LIMITS = {
+	/** The poster's bytes: with the rest of an offer, a frame stays far below the 60 KiB a session carries. */
+	maxPosterBytes: 12288,
+	/** The poster's longest side, in pixels, as the sender draws it. */
+	posterEdge: 320,
+	/** Ten hours: longer is a mistake, not a video. */
+	maxDurationMs: 36e6,
+	/** Pixels on either side (8K and a bit). */
+	maxEdge: 16384
+};
+/** Whether a file is a video, by its type: shown in a video bubble whether or not it came with a description. */
+function isVideoMime(mime) {
+	return mime.split(";")[0].trim().toLowerCase().startsWith("video/");
+}
+var BASE64URL = /^[A-Za-z0-9_-]+$/;
+var JPEG_START = [
+	255,
+	216,
+	255
+];
+/**
+* A peer's `video` description, or undefined when it is not one. It never refuses the file. A poster that is
+* too large or not a JPEG is dropped on its own; the length and size are kept.
+*/
+function parseVideoMeta(value, mime) {
+	if (mime !== void 0 && !isVideoMime(mime)) return void 0;
+	if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+	const { duration, width, height, poster } = value;
+	if (typeof duration !== "number" || !Number.isSafeInteger(duration) || duration <= 0 || duration > VIDEO_LIMITS.maxDurationMs) return void 0;
+	const edge = (n) => typeof n === "number" && Number.isSafeInteger(n) && n > 0 && n <= VIDEO_LIMITS.maxEdge;
+	if (!edge(width) || !edge(height)) return void 0;
+	const meta = {
+		duration,
+		width,
+		height
+	};
+	if (typeof poster === "string" && poster.length <= Math.ceil(VIDEO_LIMITS.maxPosterBytes * 4 / 3) && BASE64URL.test(poster)) try {
+		const bytes = fromBase64Url(poster);
+		if (bytes.length <= VIDEO_LIMITS.maxPosterBytes && JPEG_START.every((b, i) => bytes[i] === b)) meta.poster = poster;
+	} catch {}
+	return meta;
+}
+/** `0:07`, `12:45`, `1:02:03`: as a player shows a video's length. */
+function formatVideoDuration(ms) {
+	const total = Math.max(0, Math.floor((Number.isFinite(ms) ? ms : 0) / 1e3));
+	const hours = Math.floor(total / 3600), minutes = Math.floor(total % 3600 / 60), seconds = String(total % 60).padStart(2, "0");
+	return hours ? `${hours}:${String(minutes).padStart(2, "0")}:${seconds}` : `${minutes}:${seconds}`;
+}
+//#endregion
+//#region ../core/src/voice.ts
+var VOICE_LIMITS = {
+	/** Fifteen minutes: at the bitrate recorded (32 kbit/s) about 3.6 MB, well inside a held item's 8 MiB. */
+	maxDurationMs: 9e5,
+	/** Bars drawn for a recording. */
+	bars: 64,
+	/** Bars accepted from a peer. */
+	maxBars: 128,
+	/** Asked of the recorder; opus speech is clear well below it. */
+	audioBitsPerSecond: 32e3
+};
+/**
+* Audio a player may be handed as it is. None of these runs anything in the page's origin,
+* so received bytes of these types are served with their type (see `safeBlobType`).
+*/
+var PLAYABLE_AUDIO = /^audio\/(webm|ogg|opus|mp4|mpeg|mp3|aac|x-m4a|wav|x-wav|wave|flac|x-flac)$/;
+/** The part of a type before its parameters, in lower case: `audio/webm;codecs=opus` → `audio/webm`. */
+function baseMime(mime) {
+	return mime.split(";")[0].trim().toLowerCase();
+}
+/**
+* A peer's `voice` description, or undefined when it is not one. It never refuses the file:
+* a bad description only means the file is shown as a file.
+*/
+function parseVoiceMeta(value, mime) {
+	if (mime !== void 0 && !PLAYABLE_AUDIO.test(baseMime(mime))) return void 0;
+	if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+	const { duration, peaks } = value;
+	if (typeof duration !== "number" || !Number.isSafeInteger(duration) || duration <= 0 || duration > VOICE_LIMITS.maxDurationMs + 5e3) return void 0;
+	if (!Array.isArray(peaks) || peaks.length === 0 || peaks.length > VOICE_LIMITS.maxBars) return void 0;
+	if (!peaks.every((peak) => typeof peak === "number" && Number.isInteger(peak) && peak >= 0 && peak <= 255)) return void 0;
+	return {
+		duration,
+		peaks: [...peaks]
+	};
+}
+/**
+* How the level is metered while recording (apps/ui/src/lib/voiceRecorder.ts): every `intervalMs`, the RMS of the last
+* `window` samples an AnalyserNode holds (at a 48 kHz context, about 21 ms of sound).
+*/
+var VOICE_METER = {
+	intervalMs: 50,
+	window: 1024,
+	windowRate: 48e3
+};
+/** One reading of the meter, 0-1: the RMS of the samples, lifted because speech sits low on a linear scale. */
+function voiceLevel(samples) {
+	if (samples.length === 0) return 0;
+	let sum = 0;
+	for (let i = 0; i < samples.length; i++) sum += samples[i] * samples[i];
+	return Math.min(1, Math.sqrt(sum / samples.length) * 4);
+}
+/**
+* The readings the recorder would have taken of this sound (mono, -1 to 1), for a recording made elsewhere: one
+* every `intervalMs` of it, each over the window that ends there, as long in time as the analyser's.
+*/
+function voiceLevelsOf(mono, sampleRate) {
+	if (!(sampleRate > 0) || mono.length === 0) return [];
+	const window = Math.max(1, Math.round(VOICE_METER.window * sampleRate / VOICE_METER.windowRate));
+	const levels = [];
+	for (let step = 1;; step++) {
+		const end = Math.round(step * VOICE_METER.intervalMs * sampleRate / 1e3);
+		if (end > mono.length) break;
+		levels.push(voiceLevel(mono.subarray(Math.max(0, end - window), end)));
+	}
+	return levels;
+}
+/** The waveform sent with a recording made elsewhere, drawn as the recorder draws its own. */
+function voicePeaksOf(mono, sampleRate, bars = VOICE_LIMITS.bars) {
+	return downsamplePeaks(voiceLevelsOf(mono, sampleRate), bars);
+}
+/** Below this a recording is silence, and is drawn flat rather than stretched to fill the bars. */
+var QUIET = .02;
+/**
+* Bars from the loudness measured while recording (RMS, 0-1, oldest first): the loudest
+* sample of each stretch, scaled so the loudest bar is full height.
+*/
+function downsamplePeaks(levels, bars = VOICE_LIMITS.bars) {
+	const count = Math.max(1, Math.min(VOICE_LIMITS.maxBars, Math.floor(bars)));
+	const clean = Array.from(levels, (level) => Number.isFinite(level) ? Math.min(1, Math.max(0, level)) : 0);
+	if (clean.length === 0) return new Array(count).fill(0);
+	const loudest = Math.max(QUIET, ...clean);
+	const out = [];
+	for (let bar = 0; bar < count; bar++) {
+		const from = Math.floor(bar * clean.length / count);
+		const to = Math.max(from + 1, Math.floor((bar + 1) * clean.length / count));
+		let peak = 0;
+		for (let i = from; i < to && i < clean.length; i++) peak = Math.max(peak, clean[i]);
+		out.push(Math.round(peak / loudest * 255));
+	}
+	return out;
+}
+/** `0:07`, `12:45`: minutes and seconds, as a player shows them. */
+function formatVoiceDuration(ms) {
+	const total = Math.max(0, Math.floor((Number.isFinite(ms) ? ms : 0) / 1e3));
+	return `${Math.floor(total / 60)}:${String(total % 60).padStart(2, "0")}`;
+}
+/** The line a file message shows in the chat list and in notifications. */
+function fileMessageText(file) {
+	if (file.voice) return `🎤 Voice message (${formatVoiceDuration(file.voice.duration)})`;
+	if (file.video) return `🎬 Video (${formatVideoDuration(file.video.duration)})`;
+	return `📎 ${file.name}`;
+}
+//#endregion
+//#region ../core/src/files.ts
+var FILE_ID = /^[A-Za-z0-9_-]{8,64}$/;
+var MIME = /^[a-z0-9][a-z0-9!#$&^_.+-]{0,63}\/[a-z0-9][a-z0-9!#$&^_.+-]{0,63}$/i;
+var MAX_NAME_LENGTH = 200;
+/**
+* Invisible and direction-changing characters: bidi overrides turn
+* "invoice\u202Efdp.exe" into what reads as "invoiceexe.pdf", zero-width ones hide
+* text. Cf covers both; line and paragraph separators break the layout.
+*/
+var INVISIBLE = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu;
+/**
+* Names Windows keeps for devices, whatever the case, with any extension, and with spaces before the dot:
+* "CON", "nul.txt", "COM1 .log" open a device there, not a file.
+*/
+var WINDOWS_DEVICE = /^(CON|PRN|AUX|NUL|CONIN\$|CONOUT\$|COM[0-9¹²³]|LPT[0-9¹²³])\s*(\.|$)/i;
+/**
+* At most `MAX_NAME_LENGTH` characters. A longer name loses the end of its stem, not its extension (up to 15
+* characters after the last dot): "…report.pdf" stays a PDF to the system it is saved on.
+*/
+function shorten(name) {
+	const chars = [...name];
+	if (chars.length <= MAX_NAME_LENGTH) return name;
+	const extension = [.../\.[^.\s]{1,15}$/u.exec(name)?.[0] ?? ""];
+	return chars.slice(0, MAX_NAME_LENGTH - extension.length).join("").trimEnd() + extension.join("");
+}
+/** A file name is display text and a download suggestion, never a path. */
+function sanitizeFileName(name) {
+	const clean = shorten(name.replace(INVISIBLE, "").replace(/[/\\:]/g, "").replace(/^[\s.]+/, "").trim());
+	if (WINDOWS_DEVICE.test(clean)) return shorten("_" + clean);
+	return clean || "file";
+}
+function sanitizeMime(mime) {
+	return MIME.test(mime) ? mime.toLowerCase() : "application/octet-stream";
+}
+/** A size for people: B, KB, MB, GB, TB (powers of 1024), one decimal from KB up. */
+function formatFileSize(bytes) {
+	if (bytes < 1024) return `${bytes} B`;
+	const units = [
+		"KB",
+		"MB",
+		"GB",
+		"TB"
+	];
+	let value = bytes / 1024, unit = 0;
+	while (value >= 1024 && unit < units.length - 1) {
+		value /= 1024;
+		unit++;
+	}
+	return `${value.toFixed(1)} ${units[unit]}`;
+}
+var FileTransfers = class {
+	channel;
+	events;
+	nextStreamId = 1;
+	incoming = /* @__PURE__ */ new Map();
+	outgoing = /* @__PURE__ */ new Map();
+	constructor(channel, events) {
+		this.channel = channel;
+		this.events = events;
+	}
+	/** Streams a file to the peer. Resolves once every byte is handed to the channel. */
+	async send(file, source) {
+		if (file.size > LIMITS.maxFileBytes) throw new Error("File is too large");
+		const id = this.nextStreamId++;
+		const state = {
+			fileId: file.id,
+			cancelled: false
+		};
+		this.outgoing.set(id, state);
+		try {
+			this.channel.send(encodeControl({
+				t: "file",
+				id,
+				f: file.id,
+				ts: file.timestamp,
+				n: sanitizeFileName(file.name),
+				s: file.size,
+				m: sanitizeMime(file.mime)
+			}));
+			let sent = 0;
+			const counted = async function* () {
+				for await (const part of source) {
+					sent += part.length;
+					yield part;
+					this.events.onProgress?.(file.id, sent, "out");
+				}
+			}.call(this);
+			await sendBody(this.channel, CHUNK_KIND.fileBody, id, counted, () => state.cancelled);
+			if (state.cancelled) throw new Error("The peer refused the file");
+			if (sent !== file.size) throw new Error("File changed while it was being sent");
+			this.events.onComplete?.(file.id, "out");
+		} catch (error) {
+			if (!state.cancelled) try {
+				this.channel.send(encodeControl({
+					t: "rst",
+					id,
+					d: "f",
+					e: "aborted"
+				}));
+			} catch {}
+			this.events.onFailed?.(file.id, error instanceof Error ? error.message : String(error), "out");
+			throw error;
+		} finally {
+			this.outgoing.delete(id);
+		}
+	}
+	handleFile(frame) {
+		if (this.incoming.has(frame.id)) return;
+		const refuse = (reason) => {
+			try {
+				this.channel.send(encodeControl({
+					t: "rst",
+					id: frame.id,
+					d: "f",
+					e: reason
+				}));
+			} catch {}
+		};
+		if (!FILE_ID.test(frame.f)) return refuse("invalid file id");
+		if (frame.s > LIMITS.maxFileBytes) return refuse("file too large");
+		if (this.incoming.size >= LIMITS.maxIncomingFilesPerPeer) return refuse("too many transfers");
+		const file = {
+			id: frame.f,
+			name: sanitizeFileName(frame.n),
+			size: frame.s,
+			mime: sanitizeMime(frame.m),
+			timestamp: frame.ts
+		};
+		const sink = this.events.onIncoming(file);
+		if (!sink || typeof sink === "string") return refuse(sink || "refused");
+		const entry = {
+			file,
+			sink,
+			received: 0,
+			queue: Promise.resolve()
+		};
+		this.incoming.set(frame.id, entry);
+		this.armIdleTimer(frame.id, entry);
+	}
+	handleChunk(chunk) {
+		const entry = this.incoming.get(chunk.id);
+		if (!entry) return;
+		entry.received += chunk.payload.length;
+		if (entry.received > entry.file.size) return this.failIncoming(chunk.id, "more data than announced", true);
+		if (chunk.payload.length > 0) {
+			const payload = chunk.payload.slice();
+			entry.queue = entry.queue.then(() => entry.sink.write(payload));
+			this.events.onProgress?.(entry.file.id, entry.received, "in");
+		}
+		if (!chunk.end) return this.armIdleTimer(chunk.id, entry);
+		if (entry.received !== entry.file.size) return this.failIncoming(chunk.id, "incomplete file", false);
+		clearTimeout(entry.idleTimer);
+		this.incoming.delete(chunk.id);
+		entry.queue.then(() => entry.sink.close()).then(() => this.events.onComplete?.(entry.file.id, "in"), () => {
+			entry.sink.abort();
+			this.events.onFailed?.(entry.file.id, "could not store the file", "in");
+		});
+	}
+	handleReset(frame) {
+		if (this.incoming.has(frame.id)) this.failIncoming(frame.id, frame.e || "cancelled by the sender", false);
+		const sending = this.outgoing.get(frame.id);
+		if (sending) sending.cancelled = true;
+	}
+	/** The link went away: nothing in flight can finish. */
+	closeAll() {
+		for (const id of [...this.incoming.keys()]) this.failIncoming(id, "connection lost", false);
+		for (const sending of this.outgoing.values()) sending.cancelled = true;
+	}
+	armIdleTimer(id, entry) {
+		clearTimeout(entry.idleTimer);
+		entry.idleTimer = setTimeout(() => this.failIncoming(id, "transfer stalled", true), LIMITS.bodyIdleTimeoutMs);
+	}
+	failIncoming(id, reason, notifyPeer) {
+		const entry = this.incoming.get(id);
+		if (!entry) return;
+		clearTimeout(entry.idleTimer);
+		this.incoming.delete(id);
+		entry.sink.abort();
+		if (notifyPeer) try {
+			this.channel.send(encodeControl({
+				t: "rst",
+				id,
+				d: "f",
+				e: reason
+			}));
+		} catch {}
+		this.events.onFailed?.(entry.file.id, reason, "in");
+	}
+};
+//#endregion
+//#region ../core/src/image.ts
+var IMAGE_LIMITS = {
+	/** Pixels on either side: the most a JPEG can say, well past what anyone sends as a picture. */
+	maxEdge: 65535,
+	/** How much of a file is read for its size: past a JPEG's EXIF, thumbnails and colour profile. */
+	headBytes: 262144
+};
+/** Whether a file is a picture, by its type. */
+function isImageMime(mime) {
+	return mime.split(";")[0].trim().toLowerCase().startsWith("image/");
+}
+var edge = (n) => typeof n === "number" && Number.isSafeInteger(n) && n > 0 && n <= IMAGE_LIMITS.maxEdge;
+/** A peer's `image` description, or undefined when it is not one. It never refuses the file. */
+function parseImageMeta(value, mime) {
+	if (mime !== void 0 && !isImageMime(mime)) return void 0;
+	if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+	const { width, height } = value;
+	return edge(width) && edge(height) ? {
+		width,
+		height
+	} : void 0;
+}
+var u16be = (b, at) => b[at] << 8 | b[at + 1];
+var u16le = (b, at) => b[at] | b[at + 1] << 8;
+var u24le = (b, at) => b[at] | b[at + 1] << 8 | b[at + 2] << 16;
+var u32be = (b, at) => (b[at] << 24 >>> 0) + (b[at + 1] << 16) + (b[at + 2] << 8) + b[at + 3];
+var ascii = (b, at, text) => [...text].every((c, i) => b[at + i] === c.charCodeAt(0));
+var sized = (width, height) => edge(width) && edge(height) ? {
+	width,
+	height
+} : void 0;
+/** SOFn markers: every frame type but DHT (C4), JPG (C8) and DAC (CC). */
+var JPEG_FRAME = /* @__PURE__ */ new Set([
+	192,
+	193,
+	194,
+	195,
+	197,
+	198,
+	199,
+	201,
+	202,
+	203,
+	205,
+	206,
+	207
+]);
+/** The EXIF orientation in an APP1 segment's TIFF block (1 when it says none). */
+function exifOrientation(b, tiff, end) {
+	if (tiff + 8 > end) return 1;
+	const little = ascii(b, tiff, "II");
+	if (!little && !ascii(b, tiff, "MM")) return 1;
+	const u16 = (at) => little ? u16le(b, at) : u16be(b, at);
+	const u32 = (at) => little ? u16le(b, at) + u16le(b, at + 2) * 65536 : u32be(b, at);
+	if (u16(tiff + 2) !== 42) return 1;
+	const ifd = tiff + u32(tiff + 4);
+	if (ifd + 2 > end) return 1;
+	const count = u16(ifd);
+	for (let i = 0; i < count; i++) {
+		const entry = ifd + 2 + i * 12;
+		if (entry + 12 > end) return 1;
+		if (u16(entry) === 274) {
+			const value = u16(entry + 8);
+			return value >= 1 && value <= 8 ? value : 1;
+		}
+	}
+	return 1;
+}
+function jpegSize(b) {
+	let at = 2, orientation = 1;
+	while (at + 4 <= b.length) {
+		if (b[at] !== 255) return void 0;
+		const marker = b[at + 1];
+		if (marker === 255) {
+			at++;
+			continue;
+		}
+		if (marker === 1 || marker >= 208 && marker <= 215) {
+			at += 2;
+			continue;
+		}
+		if (marker === 217 || marker === 218) return void 0;
+		const length = u16be(b, at + 2);
+		if (length < 2) return void 0;
+		const end = Math.min(b.length, at + 2 + length);
+		if (marker === 225 && ascii(b, at + 4, "Exif\0\0")) orientation = exifOrientation(b, at + 10, end);
+		if (JPEG_FRAME.has(marker)) {
+			if (at + 9 > b.length) return void 0;
+			const height = u16be(b, at + 5), width = u16be(b, at + 7);
+			return orientation >= 5 ? sized(height, width) : sized(width, height);
+		}
+		at += 2 + length;
+	}
+}
+function webpSize(b) {
+	if (b.length < 30) return void 0;
+	if (ascii(b, 12, "VP8 ")) {
+		if (b[23] !== 157 || b[24] !== 1 || b[25] !== 42) return void 0;
+		return sized(u16le(b, 26) & 16383, u16le(b, 28) & 16383);
+	}
+	if (ascii(b, 12, "VP8L")) {
+		if (b[20] !== 47) return void 0;
+		const bits = b[21] | b[22] << 8 | b[23] << 16 | b[24] << 24;
+		return sized((bits & 16383) + 1, (bits >>> 14 & 16383) + 1);
+	}
+	if (ascii(b, 12, "VP8X")) return sized(u24le(b, 24) + 1, u24le(b, 27) + 1);
+}
+/**
+* A picture's size as it is shown, read from its first bytes (PNG, JPEG, GIF, WebP), or undefined when they do not
+* say. Only the header is read: a JPEG whose frame header sits past `IMAGE_LIMITS.headBytes` goes without.
+*/
+function imageSize(head) {
+	const b = head;
+	try {
+		if (b.length >= 24 && b[0] === 137 && ascii(b, 1, "PNG\r\n\n") && ascii(b, 12, "IHDR")) return sized(u32be(b, 16), u32be(b, 20));
+		if (b.length >= 10 && (ascii(b, 0, "GIF87a") || ascii(b, 0, "GIF89a"))) return sized(u16le(b, 6), u16le(b, 8));
+		if (b.length >= 4 && b[0] === 255 && b[1] === 216 && b[2] === 255) return jpegSize(b);
+		if (b.length >= 16 && ascii(b, 0, "RIFF") && ascii(b, 8, "WEBP")) return webpSize(b);
+	} catch {}
+}
+/**
+* The description a picture is sent with, read from the start of the file, or undefined when it is not a picture
+* or its first bytes do not say (it then goes without one).
+*/
+async function readImageMeta(source, mime) {
+	if (!isImageMime(mime)) return void 0;
+	try {
+		return imageSize(new Uint8Array(await source.slice(0, IMAGE_LIMITS.headBytes).arrayBuffer()));
+	} catch {
+		return;
+	}
+}
+//#endregion
 //#region ../core/src/dhtFiles.ts
 /**
 * A file's bubble on the DHT floor (WISP 403 § Files): while the contact is away, a file's offer (its name, size, type,
@@ -7617,6 +9570,14 @@ var DhtDelivery = class DhtDelivery {
 		};
 	}
 	/**
+	* This side joined, and its inviter never answered (`DhtDeliveryState.unanswered`): no envelope of its newer than the
+	* one that pinned it, none sealed to this side, no text confirmed, never live (as `sealedToAnother` asks too).
+	*/
+	get unanswered() {
+		const pinnedAt = this.state.unanswered;
+		return pinnedAt !== void 0 && this.state.peerSequence <= pinnedAt && !this.state.peerPinned && !this.state.confirmed && !this.state.wasLive && !this.live;
+	}
+	/**
 	* Something signed by a participation key other than the pinned one came in over the chat's invite-derived keys (this
 	* mailbox, the link's signals, a connection to an endpoint whose address a copy of the invite could read): ignored,
 	* and said in the view as a passive warning.
@@ -8325,6 +10286,7 @@ var DhtDelivery = class DhtDelivery {
 		}
 		if (message !== null && (!Array.isArray(message) || message.length !== 3 || typeof message[0] !== "string" || !ID$2.test(message[0]) || !Number.isSafeInteger(message[1]) || message[1] <= 0 || message[1] > issued + 3e4 || typeof message[2] !== "string" || utf8Encode(message[2]).length > 256 || expires - issued > 3e5)) return "none";
 		if (receipt !== null && (typeof receipt !== "string" || !ID$2.test(receipt))) return "none";
+		const unanswered = !this.options.credentials.peerKey && !!this.options.credentials.expectedPeerKey && !sender && !this.live;
 		await this.options.pin(author);
 		this.options.credentials.peerKey = author;
 		this.options.credentials.requireSignedSignals = true;
@@ -8375,6 +10337,7 @@ var DhtDelivery = class DhtDelivery {
 			receipt: nextReceipt,
 			confirmed,
 			...peerPinned && { peerPinned },
+			...unanswered && { unanswered: sequence },
 			pending: confirmed && this.state.pending?.message[0] === confirmed ? void 0 : this.state.pending,
 			...newest > (this.state.reactionsTaken ?? 0) && { reactionsTaken: newest }
 		});
@@ -8496,10 +10459,13 @@ var DhtDelivery = class DhtDelivery {
 		if (this.state.pending && this.state.pending.expires > now) return DHT_POLL_MS;
 		return this.active ? ACTIVE_DHT_POLL_MS : STREAM_POLL_MS;
 	}
-	/** How long ago this side's invite was made, while nobody used it and it is no longer awaited (`AWAITING_PEER_MS`). */
+	/**
+	* How long ago this side's invite was made (or joined), while nobody used it (or its inviter never answered,
+	* `unanswered`) and it is no longer awaited (`AWAITING_PEER_MS`).
+	*/
 	unusedInviteAge(now) {
 		const madeAt = this.options.inviteMadeAt;
-		if (madeAt === void 0 || this.options.credentials.peerKey || this.state.peerSequence) return void 0;
+		if (madeAt === void 0 || (this.options.credentials.peerKey || this.state.peerSequence) && !this.unanswered) return void 0;
 		const age = now - Math.min(madeAt, this.startedAt);
 		return age >= 6e5 ? age : void 0;
 	}
@@ -11631,6 +13597,8 @@ function readManifest(meta, loopback = false) {
 */
 var OFFER_EXTENSIONS = ["ping/1"];
 var MAX_HANDSHAKE_BYTES = 4096;
+/** One frame from the peer, at most (UTF-16 units for text, bytes for binary): a bigger one breaks the protocol. */
+var SESSION_FRAME_MAX = 61440;
 /**
 * Frames received and not handled yet, at most: their count and their size together. Frames are handled one at a time,
 * each awaited (a group frame is decrypted, checked and stored before the next), and the peer sends at the network's
@@ -11641,7 +13609,7 @@ var MAX_HANDSHAKE_BYTES = 4096;
 */
 var SESSION_RECEIVE_PENDING = {
 	frames: 1024,
-	bytes: 3932160
+	bytes: 64 * SESSION_FRAME_MAX
 };
 var KEY = /^[ybndrfg8ejkmcpqxot1uwisza345h769]{52}$/;
 var NONCE$1 = /^[A-Za-z0-9_-]{43}$/;
@@ -11992,6 +13960,9 @@ var PairedHttp = class {
 				return channel.bufferedAmount;
 			},
 			drained: () => channel.drained(),
+			get sendBudget() {
+				return channel.sendBudget;
+			},
 			close: () => {},
 			onMessage: null,
 			onClose: null
@@ -12491,8 +14462,7 @@ function vapidAuthorization(endpoint, keys, subject, now = Date.now()) {
 		exp: Math.floor(now / 1e3) + TOKEN_SECONDS,
 		sub: subject
 	})}`;
-	const signature = p256.sign(utf8Encode(unsigned), fromBase64Url(keys.privateKey));
-	return `vapid t=${unsigned}.${toBase64Url(signature)}, k=${keys.publicKey}`;
+	return `vapid t=${unsigned}.${toBase64Url(p256.sign(utf8Encode(unsigned), fromBase64Url(keys.privateKey)))}, k=${keys.publicKey}`;
 }
 /**
 * `plaintext` encrypted for a subscription (RFC 8291 with RFC 8188 `aes128gcm`, one record). `sender` fixes
@@ -12810,8 +14780,7 @@ var LINK_OR_MARKUP = /[a-z][a-z0-9+.-]*:\/\/|\bwww\.|\b(?:mailto|javascript|data
 */
 function sanitizeTypingStatus(value) {
 	if (typeof value !== "string") return void 0;
-	const oneLine = value.slice(0, 160).replace(/\s+/g, " ");
-	const clean = sanitizeDisplayText(oneLine, 40);
+	const clean = sanitizeDisplayText(value.slice(0, 160).replace(/\s+/g, " "), 40);
 	if (!clean || LINK_OR_MARKUP.test(clean)) return void 0;
 	return clean;
 }
@@ -13060,7 +15029,7 @@ var FILE_LIMITS = {
 	resendBytes: 268435456
 };
 var ID = /^[A-Za-z0-9_-]{8,64}$/;
-var DIGEST = /^[A-Za-z0-9_-]{43}$/;
+var DIGEST$1 = /^[A-Za-z0-9_-]{43}$/;
 var DATA = /^[A-Za-z0-9_-]+$/;
 var FILE_FRAMES = /* @__PURE__ */ new Set([
 	"pf-offer",
@@ -13913,7 +15882,7 @@ var ChatFiles = class {
 			return;
 		}
 		if (record.state !== "active" || incoming.verifying || !incoming.target) return;
-		if (frame.size !== record.file.size || typeof frame.digest !== "string" || !DIGEST.test(frame.digest)) return;
+		if (frame.size !== record.file.size || typeof frame.digest !== "string" || !DIGEST$1.test(frame.digest)) return;
 		const digest = frame.digest;
 		await incoming.writing;
 		if (transferEnded(record) || record.state !== "active") return;
@@ -14952,6 +16921,146 @@ var CarriedTransport = class {
 	}
 };
 //#endregion
+//#region ../core/src/groupFiles.ts
+/**
+* Files and voice messages in groups (WISP 503 · Group Files). A file is announced as a group message carrying its
+* description; its bytes go over `files/3` between two members, from a member that holds it to one that asks for it.
+* The limits below are the profile's first numbers, kept in one place so they are easy to change.
+*/
+var GROUP_FILE_LIMITS = {
+	/** The largest file a group takes. */
+	maxBytes: 104857600,
+	/** A file this size or smaller is fetched without asking (voice messages always are, up to `VOICE_LIMITS`). */
+	autoBytes: 8388608,
+	/** What a device keeps of a group's files it fetched without asking; past it, every file is asked about. */
+	autoBytesPerGroup: 268435456,
+	/** Bytes of group files a device serves to others in a day, when serving is on. */
+	serveBytesPerDay: 1073741824,
+	/** Transfers a holder serves at once, all groups together. */
+	serveAtOnce: 3,
+	/** File announcements a member sends to one group in a minute. */
+	announcePerMinute: 8,
+	/** File announcements of one member of a group fetched by themselves in `announceWindowMs`; past it, kept for a Download. */
+	announceTaken: 30,
+	announceWindowMs: 6e5,
+	/** Holders remembered per file. */
+	holders: 8,
+	/**
+	* Message ids a `group-have` named before their message came (a member back from away hears who holds what as its
+	* catch-up begins), remembered with their holders for when it does.
+	*/
+	heardAhead: 256,
+	/** Message ids in one `group-have`. */
+	haveIds: 32,
+	/**
+	* `group-have` frames a private group's edge takes in `haveWindowMs`: what is to say is gathered for a second, then
+	* goes. A community's, from a member, goes every `communityHaveEveryMs`.
+	*/
+	haveFrames: 10,
+	haveWindowMs: 1e4,
+	communityHaveEveryMs: 6e4,
+	/**
+	* How long a want waits for an offer before the next holder is asked; a transfer that does not move for as long is
+	* left for the next holder too.
+	*/
+	wantWaitMs: 3e4,
+	/** A file session closes this long after its last transfer ends. */
+	sessionIdleMs: 6e4,
+	/** File sessions opening at once, and open at once, all groups together. */
+	sessionsOpening: 2,
+	sessionsOpen: 4,
+	/** The longest file name and type kept from a description. */
+	nameChars: 255,
+	mimeChars: 255
+};
+/**
+* The frames of WISP 503 § Getting the bytes, on an edge between two apps that announced `GROUP_VERSION_FILES`:
+* `group-want {g, id}` asks a holder for the file of message `id`; `group-want-no {g, id, why}` is a holder's no;
+* `group-have {g, ids}` says which files a member keeps (in a community, an application frame `{t, ids}` instead).
+*/
+var GROUP_WANT_FRAME = "group-want";
+var GROUP_WANT_NO_FRAME = "group-want-no";
+var GROUP_HAVE_FRAME = "group-have";
+var REFUSALS = [
+	"gone",
+	"busy",
+	"refused"
+];
+/** A group message's id, as a private group (`<s>:<e>:<n>`) or a community (`<s>:<e>:<h>:<n>`) names it. */
+var MESSAGE_ID = /^[a-z0-9]{52}:\d{1,15}(:[A-Za-z0-9_-]{1,64})?:\d{1,15}$/;
+var isGroupMessageId = (value) => typeof value === "string" && MESSAGE_ID.test(value);
+function frameOf(value, t, groupId) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+	const f = value;
+	return f.t === t && (groupId === void 0 || f.g === groupId) ? f : null;
+}
+/** A `group-want` of group `groupId`: the message whose file is asked for, or null. */
+function readGroupWant(value, groupId) {
+	const f = frameOf(value, GROUP_WANT_FRAME, groupId);
+	return f && isGroupMessageId(f.id) ? { id: f.id } : null;
+}
+/** A holder's `group-want-no` of group `groupId`, or null. A reason this app does not know reads as `busy`. */
+function readGroupWantNo(value, groupId) {
+	const f = frameOf(value, GROUP_WANT_NO_FRAME, groupId);
+	if (!f || !isGroupMessageId(f.id)) return null;
+	return {
+		id: f.id,
+		why: typeof f.why === "string" && REFUSALS.includes(f.why) ? f.why : "busy"
+	};
+}
+/**
+* The message ids of a `group-have`: of group `groupId` on an edge, or (no `groupId`) a community's application frame.
+* At most `haveIds` message ids; a frame with more, or anything else, is null.
+*/
+function readGroupHave(value, groupId) {
+	const f = frameOf(value, GROUP_HAVE_FRAME, groupId);
+	if (!f || !Array.isArray(f.ids) || !f.ids.length || f.ids.length > GROUP_FILE_LIMITS.haveIds || !f.ids.every(isGroupMessageId)) return null;
+	return [...new Set(f.ids)];
+}
+var DIGEST = /^[A-Za-z0-9_-]{43}$/;
+/**
+* A description read from the wire, cleaned: the name made a display name (never a path), the type untrusted, the
+* size within the group limit, the digest the right shape. A malformed voice, video or picture description is dropped
+* on its own and the file is still a file; anything else malformed is no file at all (null), and the text shows.
+*/
+function readGroupFileMeta(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+	const v = value;
+	if (typeof v.name !== "string" || !v.name.trim() || [...v.name].length > GROUP_FILE_LIMITS.nameChars) return null;
+	if (typeof v.mime !== "string" || v.mime.length > GROUP_FILE_LIMITS.mimeChars) return null;
+	if (!Number.isSafeInteger(v.size) || v.size < 1 || v.size > GROUP_FILE_LIMITS.maxBytes) return null;
+	if (typeof v.d !== "string" || !DIGEST.test(v.d)) return null;
+	const mime = sanitizeMime(v.mime);
+	const voice = v.voice === void 0 ? void 0 : parseVoiceMeta(v.voice, mime);
+	const video = v.video === void 0 ? void 0 : parseVideoMeta(v.video, mime);
+	const image = v.image === void 0 ? void 0 : parseImageMeta(v.image, mime);
+	return {
+		name: sanitizeFileName(v.name),
+		mime,
+		size: v.size,
+		d: v.d,
+		...voice ? { voice } : {},
+		...video ? { video } : {},
+		...image ? { image } : {}
+	};
+}
+/**
+* The text an announcement carries when its author wrote no caption: what an app without group files shows instead
+* of the file. English, as wire text is; an app that knows the file shows the file, not this line.
+*/
+function groupFileFallback(file) {
+	if (file.voice) return `🎤 Voice message (${formatVoiceDuration(file.voice.duration)}): update Ghostly to hear it`;
+	return `${fileMessageText(file)} (${formatFileSize(file.size)}): update Ghostly to get files in groups`;
+}
+/**
+* Whether a device fetches a file by itself (WISP 503 § Automatic and asked downloads): a voice message always, any
+* other file up to `autoBytes` while what it took that way from the group stays within `autoBytesPerGroup`.
+*/
+function fetchesByItself(file, keptAutomatically, limits = GROUP_FILE_LIMITS) {
+	if (file.voice) return true;
+	return file.size <= limits.autoBytes && keptAutomatically + file.size <= limits.autoBytesPerGroup;
+}
+//#endregion
 //#region ../core/src/pairingProgress.ts
 var FIRST_STAGE = {
 	inviter: "publishing",
@@ -15393,6 +17502,12 @@ function filesCap(channel) {
 */
 var FILES_IN_USE_MS = 2e3;
 /**
+* How far an app's data may get ahead of a file's bytes while the file waits for room on the channel (WISP 1200 § In a
+* chat): a frame goes only while the app has sent less than this more than the file since. A small frame (a Chess move)
+* still goes at once; one streaming at its limit gets about half the link, and the file the other half.
+*/
+var APP_AHEAD_OF_FILES = 16384;
+/**
 * A `paired-message` frame. The preview (`pv`) is left out when the frame would pass `MAX_PAIRED_MESSAGE_FRAME`
 * with it: the text matters, the card does not. A reply (`r`, WISP 401 § Replies) is a few hundred bytes at most
 * and always goes, and so does a forwarded message's hop count (`fw`, WISP 401 § Forwards) and a status card (`sc`,
@@ -15422,6 +17537,16 @@ function pairedMessageFrame(id, ts, m, preview, reply, forwarded, card) {
 	});
 	return withPreview.length <= 57344 ? withPreview : plain;
 }
+/** A text whose `paired-message` frame would pass what a session takes: it never arrives, and is refused at send. */
+var PAIRED_FRAME_TOO_LARGE = "Message too long once encoded. Shorten it or send it as a file.";
+/**
+* The `paired-message` frame of this text fits a session (`SESSION_FRAME_MAX`, UTF-16 units of the JSON). Within 16 KiB
+* of UTF-8 a text can still pass it: JSON writes each control character as six (`\u0001`). The preview is left out,
+* as the frame drops one that does not fit.
+*/
+function pairedMessageFits(ts, m, reply, forwarded, card) {
+	return pairedMessageFrame("A".repeat(22), ts, m, void 0, reply, forwarded, card).length <= SESSION_FRAME_MAX;
+}
 /**
 * A native descriptor from the contact's capability record against the one known (a session's, or an older record's).
 * The record carries only how to dial, never an address: the Iroh endpoint id and the relay it is homed on, the
@@ -15740,7 +17865,9 @@ var GhostLink = class {
 			});
 			options.events?.onPairingProgress?.(progress);
 		}) : null;
-		const invite = options.pairingProgress?.role === "inviter" && !!options.pairing && !options.pairing.credentials.peerKey;
+		const invite = !!options.pairingProgress && !!options.pairing && !options.pairing.credentials.peerKey;
+		let unanswered = options.dht?.state?.unanswered !== void 0;
+		const backsOff = invite || unanswered;
 		this.dht = options.params.profile && options.pairing && options.dht ? new DhtDelivery({
 			params: options.params,
 			mode: this.deliveryMode,
@@ -15750,7 +17877,7 @@ var GhostLink = class {
 			save: options.dht.save,
 			pollMs: options.dht.pollMs,
 			firstControlAfterMs: options.dht.firstControlAfterMs,
-			...invite && { inviteMadeAt: options.madeAt ?? Date.now() },
+			...backsOff && { inviteMadeAt: options.madeAt ?? Date.now() },
 			capsRev: options.dht.capsRev,
 			peerCapsRev: options.dht.peerCapsRev,
 			peerAcceptsText: options.dht.peerAcceptsText,
@@ -15809,6 +17936,9 @@ var GhostLink = class {
 			},
 			changed: (view) => {
 				options.events?.onDhtDelivery?.(view);
+				const stillUnanswered = this.dht.unanswered;
+				if (unanswered && !stillUnanswered) this.session.lookNow();
+				unanswered = stillUnanswered;
 				if (view.inviteTaken) this.tracker?.failed("taken", false, INVITE_TAKEN);
 				else this.tracker?.untaken();
 				this.streamBlockChanged();
@@ -15837,7 +17967,7 @@ var GhostLink = class {
 			lastSeenTimestamp: options.lastSeenTimestamp,
 			pollIntervals: options.pollIntervals,
 			awaitingSince: options.madeAt,
-			...invite && { invite: () => !options.pairing.credentials.peerKey },
+			...backsOff && { invite: () => !options.pairing.credentials.peerKey || !!this.dht?.unanswered },
 			getServices: options.getServices,
 			firstPublish: options.firstPublish ?? (this.tracker && options.pairingProgress?.role === "joiner" && options.rtcAvailable !== false || this.resuming ? "after-first-poll" : "at-start"),
 			events: {
@@ -17372,9 +19502,30 @@ var GhostLink = class {
 			epoch,
 			rest
 		};
+		if (!this.peerTransports.includes("webrtc/1")) {
+			traceLink(this.myPubKeyZ32, "offer-unanswerable", { transports: rest });
+			this.clearRace();
+			this.raceTimer = setTimeout(() => {
+				this.raceTimer = null;
+				this.endUnanswerableOffer(epoch);
+			}, 0);
+			return;
+		}
 		traceLink(this.myPubKeyZ32, "race-standing", { transports: rest });
 		this.scheduleRace(epoch, made.at);
 	}
+	/** The offer ends (`raceStandingOffer`), and with it going idle what is ranked after WebRTC is dialled (`dialAfterRtc`). */
+	endUnanswerableOffer(epoch) {
+		if (epoch !== this.connectionEpoch || this.channel || this.stopped || !this.offerOut || this.afterRtc?.epoch !== epoch) return;
+		if (this.dialing) {
+			this.raceTimer = setTimeout(() => {
+				this.raceTimer = null;
+				this.endUnanswerableOffer(epoch);
+			}, RACE_RETRY_MS);
+			return;
+		}
+		this.dataLink.close();
+	}
 	/**
 	* Back after an absence, this side answers an offer the contact made while it was away (it dials whatever its key):
 	* the contact looks for that answer at the pace of an offer out a while (every 8 s on the relays), and its attempt may
@@ -17557,6 +19708,13 @@ var GhostLink = class {
 		this.attemptEnded();
 		this.rejectWaiters(new GhostlyHttpError("unreachable", "Could not connect to the peer"));
 	}
+	/**
+	* This side does not dial on its own: the contact's app does (the lower key), and none of what makes this side dial
+	* anyway holds (a first pairing's role, a restart, WebRTC set aside). Its own dial, chosen by hand, is not retried.
+	*/
+	awaitsContactDial() {
+		return !(!!this.tracker && !this.tracker.done && this.tracker.progress.stage !== "on-dht" ? this.options.pairingProgress?.role : void 0) && this.myPubKeyZ32 > this.options.params.peerPubKeyZ32 && !this.resuming && !this.dialsPastRtc();
+	}
 	/** A transport of the attempt under way did not connect. */
 	attemptFailed(transport, error) {
 		if (this.isDataLinkOpen) return;
@@ -17579,7 +19737,7 @@ var GhostLink = class {
 			side: attempt.side,
 			failed: attempt.failed,
 			...!attempt.failed.length && reason ? { reason } : {},
-			...attempt.side === "dialled" ? { retryAt: Math.max(Date.now(), this.lastAutoConnectAt + this.dialWait()) } : {}
+			...attempt.side === "dialled" && !this.awaitsContactDial() ? { retryAt: Math.max(Date.now(), this.lastAutoConnectAt + this.dialWait()) } : {}
 		};
 		traceLink(this.myPubKeyZ32, "attempt-ended", {
 			side: attempt.side,
@@ -17618,9 +19776,11 @@ var GhostLink = class {
 			if (this.pairedPending.size >= 128) this.pairedPending.delete(this.pairedPending.keys().next().value);
 			const id = stableId ?? toBase64Url(randomBytes(16));
 			if (!/^[A-Za-z0-9_-]{22}$/.test(id)) return "Invalid message ID";
+			const frame = pairedMessageFrame(id, timestamp, trimmed, preview, reply, forwarded, card);
+			if (frame.length > 61440) return PAIRED_FRAME_TOO_LARGE;
 			this.pairedPending.set(id, timestamp);
 			try {
-				this.channel.send(pairedMessageFrame(id, timestamp, trimmed, preview, reply, forwarded, card));
+				this.channel.send(frame);
 				return null;
 			} catch {
 				this.pairedPending.delete(id);
@@ -17786,14 +19946,13 @@ var GhostLink = class {
 			if (presence.lastPacketAt === this.departed.packet && Date.now() < this.departed.until) return;
 			this.departed = null;
 		}
-		const role = !!this.tracker && !this.tracker.done && this.tracker.progress.stage !== "on-dht" ? this.options.pairingProgress?.role : void 0;
-		if (role === "inviter") {
+		if ((!!this.tracker && !this.tracker.done && this.tracker.progress.stage !== "on-dht" ? this.options.pairingProgress?.role : void 0) === "inviter") {
 			this.peerSeenAt ||= Date.now();
 			if (Date.now() - this.peerSeenAt < 2500 && !this.nothingToAwait()) {
 				this.session.expectPeer();
 				return;
 			}
-		} else if (role !== "joiner" && this.myPubKeyZ32 > this.options.params.peerPubKeyZ32 && !this.resuming && !this.dialsPastRtc()) {
+		} else if (this.awaitsContactDial()) {
 			if (Date.now() - presenceSeenAt(presence) < 3e4 && presence.lastPacketAt !== this.offerAwaitedFor && !this.nothingToDialEitherWay()) {
 				this.offerAwaitedFor = presence.lastPacketAt;
 				this.session.expectPeer();
@@ -18339,23 +20498,30 @@ var GhostLink = class {
 	* kept to send later. While the channel already holds a quarter of what it may queue (its send budget, or the high
 	* water mark of a WebRTC channel), the frame is refused with `too-fast`, so the chat's messages and pings never wait
 	* behind an app's data on a link slower than it sends (WISP 1200 § In a chat). While a file goes, that quarter sits
-	* above what files may hold (`filesWritable`): files keep the channel at their own line for the whole transfer.
+	* above what files may hold (`filesWritable`): files keep the channel at their own line for the whole transfer. While
+	* the file waits for room, the app gets no further than `APP_AHEAD_OF_FILES` ahead of it, so it cannot refill the
+	* channel each time it drains to files' line and keep the file from moving.
 	*/
 	sendAppData(app, data) {
 		if (!this.apps.open.has(app)) return "not-open";
 		if (appDataBytes(data) > 32768) return "too-large";
 		if (!this.channel || !this.isDataLinkOpen) return "offline";
 		if (!this.supportsApps) return "peer-closed";
-		const files = this.filesUse?.channel === this.channel && (this.filesUse.waiting > 0 || Date.now() - this.filesUse.at < FILES_IN_USE_MS) ? filesCap(this.channel) : 0;
-		if (this.channel.bufferedAmount >= files + (this.channel.sendBudget ?? LIMITS.sendHighWaterMark) / 4) return "too-fast";
+		const use = this.filesUse?.channel === this.channel ? this.filesUse : null;
+		const files = use && (use.waiting > 0 || Date.now() - use.at < FILES_IN_USE_MS) ? use : null;
+		if (use && !files) use.appAhead = 0;
+		if (this.channel.bufferedAmount >= (files ? filesCap(this.channel) : 0) + (this.channel.sendBudget ?? LIMITS.sendHighWaterMark) / 4) return "too-fast";
+		if (files && files.waiting > 0 && files.appAhead >= APP_AHEAD_OF_FILES) return "too-fast";
 		const refused = this.apps.canSend(app, data);
 		if (refused) return refused;
+		const frame = JSON.stringify(appDataFrame(app, data));
 		try {
-			this.channel.send(JSON.stringify(appDataFrame(app, data)));
-			return null;
+			this.channel.send(frame);
 		} catch {
 			return "offline";
 		}
+		if (files) files.appAhead = Math.min(files.appAhead + frame.length, APP_AHEAD_OF_FILES + APP_DATA_MAX_BYTES);
+		return null;
 	}
 	/** What the contact had open is gone (`apps/1` is no longer agreed, or this link stopped): each app hears it now. */
 	appsEnded() {
@@ -18405,25 +20571,32 @@ var GhostLink = class {
 	sendFileData(id, offset, data) {
 		if (!this.supportsLargeFiles || !this.channel) return false;
 		try {
-			this.channel.send(this.supportsBinaryFiles ? encodeFileData(id, offset, data) : JSON.stringify({
+			const frame = this.supportsBinaryFiles ? encodeFileData(id, offset, data) : JSON.stringify({
 				t: "pf-data",
 				id,
 				offset,
 				data: toBase64Url(data)
-			}));
-			this.filesUsing(this.channel).at = Date.now();
+			});
+			this.channel.send(frame);
+			const use = this.filesUsing(this.channel);
+			use.at = Date.now();
+			use.appAhead = Math.max(0, use.appAhead - (typeof frame === "string" ? frame.length : frame.byteLength));
 			return true;
 		} catch {
 			return false;
 		}
 	}
-	/** Files on a channel: when they last wrote on it, and how many wait for room. An app's data gets room above theirs. */
+	/**
+	* Files on a channel: when they last wrote on it, how many wait for room, and how many bytes an app's data has sent
+	* on it beyond theirs since. An app's data gets room above theirs.
+	*/
 	filesUse = null;
 	filesUsing(channel) {
 		if (this.filesUse?.channel !== channel) this.filesUse = {
 			channel,
 			at: 0,
-			waiting: 0
+			waiting: 0,
+			appAhead: 0
 		};
 		return this.filesUse;
 	}
@@ -25620,10 +27793,9 @@ function knockIdentity(link) {
 function knockRecords(link, knocks) {
 	const nonce = randomBytes(NONCE_LENGTH);
 	const body = utf8Encode(JSON.stringify(knocks.slice(-6).map((k) => [k.key, k.ts])));
-	const box = xchacha20poly1305(knockMaterial(link, "knock key"), nonce, utf8Encode(link.g)).encrypt(body);
 	return [{
 		label: KNOCK_LABEL,
-		value: toBase64Url(concatBytes$1(nonce, box))
+		value: toBase64Url(concatBytes$1(nonce, xchacha20poly1305(knockMaterial(link, "knock key"), nonce, utf8Encode(link.g)).encrypt(body)))
 	}];
 }
 /** Knocks that open with the link's key and are well formed; anything else is nobody. */
@@ -27245,8 +29417,13 @@ var CommunitySession = class {
 	messageIdOf(f) {
 		return f.s === this.myKey && this.resealedFrom.get(frameKey(f)) || communityMessageId(f.s, f.e, f.h, f.n);
 	}
-	/** Where I am and what I have, for the member at the other end of an edge that just opened. */
-	syncFrame() {
+	/**
+	* Where I am and what I have, for the member at the other end of an edge that just opened. `to`: that member, now
+	* asked: my answer to its own sync asks nothing more for a while. A second sync went, and its answer took the place of
+	* what was left of the first from its start: a member back after 256 messages was handed 288 (2026-10-14).
+	*/
+	syncFrame(to) {
+		if (to) this.asked.set(to, this.hooks.clock?.() ?? Date.now());
 		const have = {};
 		const recent = new Set(this.state.store.map((f) => seenKey(f.e, f.h)));
 		for (const [sender, byKey] of Object.entries(this.state.seen)) for (const [key, entry] of Object.entries(byKey)) {
@@ -28809,6 +30986,6 @@ function appStoreDecision(held, read) {
 	return read.digest === held.digest ? "same" : "equivocation";
 }
 //#endregion
-export { COMMUNITY_EDIT_FRAME as $, HANDOFF_HELLO as $a, EDIT_RATE_WINDOW_MS as $i, SIGNAL_REPLY_MS as $n, readEnrollGrant as $o, STATUS_CARD_CAPABILITY as $r, parseRelayPayload as $s, didDhtFromPublicKey as $t, CommunitySession as A, RELAY_POLL_INTERVALS as Aa, IdentityCheckUnavailable as Ai, pubkyProofPath as An, readHandoffHello as Ao, typingActivity as Ar, nextTurnPosition as As, verifyAtprotoRecordProof as At, knockRecords as B, callRtcConfig as Ba, PeerProofs as Bi, isFederationId as Bn, signTombstone as Bo, deviceWakeRequest as Br, RelayTransport as Bs, didWebDocumentUrl as Bt, sha256Paced as C, rosterHas as Ca, CapsExchange as Ci, PUBKY_PROOF_MAX_BYTES as Cn, handoffStreamKey as Co, FILE_LIMITS as Cr, TURN_RAISE_READ_TIMEOUT_MS as Cs, atprotoProofRkey as Ct, openGroupTyping as D, AWAITING_PEER_MS as Da, IDENTITY_MAX_EVIDENCE as Di, normalizePubkyKey as Dn, readHandoffCancel as Do, TYPING_REFRESH_MS as Dr, TURN_LAST_SEQUENCE as Ds, parseAtprotoDidDocument as Dt, groupTypingEpoch as E, DirectPathWatch as Ea, dialDescriptors as Ei, newPubkyProofFolder as En, readHandoffAck as Eo, TYPING_KINDS as Er, turnPutSummary as Es, normalizeAtprotoHandle as Et, KNOCK_TTL_MS as F, webLocalFetch as Fa, identityStatement as Fi, decodeBolt11 as Fn, SET_ACK as Fo, pinIsNewer as Fr, turnKeys as Fs, checkDidJws as Ft, groupWakeFrame as G, emptyLinkRecords as Ga, irohDescriptor as Gi, LIVENESS_PING_MS as Gn, ENROLL_PROOF as Go, checkPushEndpoint as Gr, budgetRetryMs as Gs, normalizeDid as Gt, readKnocks as H, extractParamsFromSdp as Ha, validExternalKey as Hi, parseFedimintRequestPayload as Hn, ENROLL_DONE as Ho, parseWakeFrame as Hr, normalizeRelayUrl as Hs, didWebFileNames as Ht, decodeGroupEntryLink as I, CALL_SIGNAL_MAX_AGE_MS as Ia, newIdentityBinding as Ii, ENDPOINT as In, SET_UPDATE as Io, pinNumberHolds as Ir, turnName as Is, checkDidSignature as It, GROUP_LIMITS as J, serviceIdFromName as Ja, DHT_MESSAGE_TTL as Ji, engineText as Jn, enrollDigits as Jo, chatAppId as Jr, PacketTooLargeError as Js, parseDidSignaturePaste as Jt, groupWakes as K, HTTP_SERVICE_PROTO as Ka, irohRelayUrl as Ki, pairedMessageFrame as Kn, enrollCancelFrame as Ko, vapidKeysMatch as Kr, isDiscoveryBudgetError as Ks, parseDid as Kt, encodeGroupEntryLink as L, RTC_CONFIG as La, receivedIdentityStatus as Li, cashuRequestPayload as Ln, readSetUpdate as Lo, readPin as Lr, turnStatedVerifier as Ls, didGhostlyServiceEntry as Lt, communityHasFrame as M, GhostlyHttpError as Ma, boundVerifiedIdentity as Mi, pubkyHomeserverOf as Mn, readHandoffTurnFrame as Mo, PIN_LIMITS as Mr, signTurnPacket as Ms, DID_FILE_MAX_BYTES as Mt, decodeCommunityLink as N, formatLocalTarget as Na, emptyIdentityLedger as Ni, requestLnurlInvoice as Nn, readHandoffVerified as No, mayPin as Nr, signTurnRelease as Ns, DID_JWS_MAX_LENGTH as Nt, sealGroupTyping as O, DHT_POLL_INTERVALS as Oa, IDENTITY_MAX_VALIDITY as Oi, pubkyProofCapability as On, readHandoffDone as Oo, TypingSender as Or, TURN_MAX as Os, shortAtprotoDid as Ot, encodeCommunityLink as P, parseLocalTarget as Pa, identityRevocationValue as Pi, resolveLightningDestination as Pn, sealHandoffPiece as Po, nextPinNumber as Pr, turnInstance as Ps, DidError as Pt, frameBytes as Q, HANDOFF_HAVE as Qa, EDIT_BUFFER_MS as Qi, SIGNAL_HOLD_MS as Qn, enrollProofFrame as Qo, EDIT_CAPABILITY as Qr, openRelayPayload as Qs, didDhtDocument as Qt, entryParams as R, answersOffer as Ra, revokesIdentity as Ri, fedimintRequestPayload as Rn, setAckFrame as Ro, WAKE_CALL_INTERVAL_MS as Rr, turnVerifierMark as Rs, didJwsAlg as Rt, readAppBundleAsync as S, commitHash as Sa, wellKnownUrl as Si, isBitcoinAddress as Sn, handoffRetryAfter as So, ChatFiles as Sr, TURN_PUT_WINDOW_MS as Ss, atprotoProofRecord as St, GroupTypingBoard as T, edgeParams as Ta, capsDescriptors as Ti, isPubkyProofFolder as Tn, newHandoffId as To, transferStalled as Tr, classifyTurnRead as Ts, isAtprotoDid as Tt, GROUP_WAKE_FRAME as U, parseCallSignal as Ua, TRANSPORTS as Ui, GhostLink as Un, ENROLL_GRANT as Uo, relayRequest as Ur, setLinkTraceSink as Us, didWebFileUrl as Ut, mergeKnocks as V, callSignalHeardAt as Va, emptyProofLedger as Vi, parseCashuRequestPayload as Vn, verifySetUpdate as Vo, newWakeToken as Vr, currentRelays as Vs, didWebFile as Vt, GroupWakeLimiter as W, signalHasVideo as Wa, automaticTransport as Wi, INVITE_TAKEN as Wn, ENROLL_HELLO as Wo, wakeRequest as Wr, traceLink as Ws, didWebHost as Wt, GROUP_READ_NOTE as X, HANDOFF_CANCEL as Xa, DHT_FILE_CAPABILITY as Xi, GROUP_SIGNAL_FRAME as Xn, enrollGrantFrame as Xo, APPS_CAPABILITY as Xr, createRelayPayload as Xs, staticDidDocument as Xt, GROUP_REACTED_FRAME as Y, HANDOFF_ACK as Ya, peekDhtMailbox as Yi, CarriedTransport as Yn, enrollDoneFrame as Yo, isAppVersion as Yr, RELAY_PAYLOAD_MAX_BYTES as Ys, signingKeys as Yt, GroupSession as Z, HANDOFF_DONE as Za, dhtFileId as Zi, SIGNAL_FRESH_MS as Zn, enrollHelloFrame as Zo, BUTTONS_CAPABILITY as Zr, newerPacket as Zs, strictBase64Url as Zt, assembleAppBundle as _, readReply as _a, normalizeDomain as _i, walletNetworkOf as _n, handoffHelloFrame as _o, rankHubs as _r, deviceLinkPairing as _s, ATPROTO_DECLARED_SCOPE as _t, planAppUpdate as a, COMMUNITY_REACTION_FRAME as aa, MAX_AVATAR_LENGTH as ac, HoldRefusedError as ai, EVM_TEST_CHAINS as an, HANDOFF_VERIFIED as ao, pickMeshHubs as ar, OwnInviteError as as, groupName as at, pacer as b, MAX_GROUP_CHAIN as ba, recordsName as bi, sparkAddressKind as bn, handoffPakeFrame as bo, readLobby as br, seedSigner as bs, ATPROTO_PROOF_SCOPE as bt, readAppStore as c, ReactionWindow as ca, readManifest as ci, SEPOLIA_TEST_USDT as cn, handoffAttemptFailed as co, beaconRecords as cr, encodeInviteCode as cs, SshSigError as ct, APP_BUNDLE_LIMITS as d, reactionEmoji as da, dnsProofName as di, USDT_PUBLIC_RPC as dn, handoffCancelFrame as do, lobbyKeys as dr, DEVICES_CAPABILITY as ds, sameSshKey as dt, RateWindow as ea, createIdentity as ec, UPGRADE_CAPABILITY as ei, encodeDidDhtDeactivated as en, HANDOFF_OFFER as eo, groupSignalFrame as er, readEnrollHello as es, GROUP_EDIT_FRAME as et, APP_BUNDLE_MAGIC as f, reactionIsNewer as fa, domainTxtRecord as fi, WALLET_NETWORKS as fn, handoffContext as fo, lobbyRecords as fr, ENROLL_CAPABILITY as fs, sshSignCommand as ft, appViewOf as g, pairedReplyAuthor as ga, nip05RootKey as gi, validatePaymentTarget as gn, handoffEphemeral as go, pickHubs as gr, deviceKeyZ32 as gs, decodeAnyBitcoinAddress as gt, appDigest as h, wireReaction as ha, isPublicAddress as hi, formatPaymentAmount as hn, handoffDigest as ho, newerHead as hr, deviceEchoNonce as hs, BitcoinAddressError as ht, checkAppBeforeRun as i, readForwarded as ia, verify as ic, HoldKeys as ii, ETHEREUM_USDT as in, HANDOFF_TIMINGS as io, meshHubs as ir, readDeviceInvite as is, mentionsMember as it, GROUP_READ_NOTE_COMMUNITY as j, presenceSeenAt as ja, IdentityExchange as ji, homeserverWebEndpoint as jn, readHandoffPake as jo, GROUP_PIN_FRAME as jr, readTurnPacket as js, DID_DOCUMENT_MAX_BYTES as jt, COMMUNITY_LIMITS as k, EXPECT_PEER_MS as ka, IDENTITY_REVOCATION_LABEL as ki, pubkyProofFile as kn, readHandoffHave as ko, sanitizeTypingStatus as kr, firstDeviceSetSecret as ks, AtprotoProofError as kt, readAppStoreSteps as l, nextReactionNumber as la, DOMAIN_FILE_MAX_BYTES as li, SEPOLIA_TEST_USDT_FAUCET as ln, handoffAttemptSucceeded as lo, doorHubs as lr, inviteLink as ls, parseSshPublicKey as lt, APP_PERMISSIONS as m, validReactionNumber as ma, encodeDnsQuery as mi, assertWholeSats as mn, handoffDataFrame as mo, mergeLobby as mr, deviceEchoFrame as ms, verifyBitcoinMessage as mt, appStoreDecision as n, parseLinkPreview as na, identityFromSeedB64 as nc, HOLD_DATED_BACK_MS as ni, resolveDidDht as nn, HANDOFF_PIECE_BYTES as no, MESH_HUBS as nr, createDeviceInvite as ns, carryMentions as nt, APP_STORE_LIMITS as o, GROUP_REACTION_FRAME as oa, sanitizeAvatar as oc, isHoldUrl as oi, ONCHAIN_PROVIDER as on, filePartName as oo, COMMUNITY_TOPOLOGY as or, createChatInvite as os, SSHSIG_MAX_ARMOR as ot, APP_ICON_PATH as p, readReaction as pa, domainWellKnownFile as pi, assertTokenUnits as pn, handoffContextProof as po, mergeBeacon as pr, HANDOFF_CAPABILITY as ps, verifySshSignature as pt, parseGroupWakeFrame as q, LEGACY_SERVICES as qa, DHT_FILE_TOO_LARGE as qi, engineError as qn, enrollCancelReason as qo, APP_DATA_MAX_BYTES as qr, withRequestOptions as qs, parseDidDocument as qt, appUpdateDecision as r, forwardedAgain as ra, publicKeyFromZ32 as rc, HOLD_LIMITS as ri, signDidDhtPacket as rn, HANDOFF_REQUEST as ro, mayBeHub as rr, deviceInviteJoinerParams as rs, parseCommunityEdit as rt, checkAppStoreIndex as s, REACTION_LIMITS as sa, newMailbox as si, PaymentPreflightError as sn, handoffAttemptAllowed as so, beaconKeys as sr, decodeInviteCode as ss, SSHSIG_NAMESPACE as st, appRevocationFor as t, dhtEditId as ta, identityFromSeed as tc, HOLD_CAPABILITY as ti, encodeDidDhtPacket as tn, HANDOFF_PAKE as to, readGroupSignal as tr, verifyEnrollProof as ts, GROUP_EDIT_TEXT_BYTES as tt, signAppStore as u, queueReaction as ua, decodeDnsResponse as ui, TEST_USDT_FAUCET_AMOUNT as un, handoffBusyFrame as uo, freshHubs as ur, inviteOwnership as us, parseSshSignature as ut, checkAppManifest as v, replySnippet as va, recordsFromTxt as vi, SPARK_NETWORKS as vn, handoffManifestFrames as vo, readBeacon as vr, devicePingFrame as vs, ATPROTO_FULL_SCOPE as vt, GROUP_TYPING_FRAME as w, verifyCommitSignature as wa, DHT_TEXT_CAPABILITY as wi, isPubkyKey as wn, handoffVersions as wo, transferEnded as wr, TURN_SETTLE_MS as ws, checkAtprotoProofRecord as wt, readAppBundle as x, MEMBER_KEY as xa, txtValue as xi, sparkInvoiceDetails as xn, handoffReleaseFrame as xo, shouldBeHub as xr, webCryptoSigner as xs, atprotoDidMethod as xt, isAppUrl as y, GROUP_MEMBER_CAP as ya, recordsFromWellKnown as yi, SPARK_PROVIDER as yn, handoffOfferFrame as yo, readBeaconHead as yr, newDeviceSetSecret as ys, ATPROTO_PROOF_COLLECTION as yt, knockIdentity as z, buildSdpFromSignal as za, lastSharedWithMe as zi, findEndpoint as zn, setUpdateFrame as zo, WakeLimiter as zr, DEFAULT_RELAYS as zs, didSignedMessages as zt };
+export { COMMUNITY_EDIT_FRAME as $, cardUrl as $a, budgetRetryMs as $c, PeerProofs as $i, GROUP_WANT_FRAME as $n, HTTP_SERVICE_PROTO as $o, deviceWakeRequest as $r, enrollCancelFrame as $s, didDhtFromPublicKey as $t, CommunitySession as A, COMMUNITY_REACTION_FRAME as Aa, TURN_PUT_WINDOW_MS as Ac, normalizeDomain as Ai, pubkyProofPath as An, DirectPathWatch as Ao, rankHubs as Ar, handoffStreamKey as As, verifyAtprotoRecordProof as At, knockRecords as B, wireReaction as Ba, signTurnPacket as Bc, IDENTITY_MAX_EVIDENCE as Bi, isFederationId as Bn, LIMITS as Bo, TYPING_REFRESH_MS as Br, readHandoffVerified as Bs, didWebDocumentUrl as Bt, sha256Paced as C, EDIT_BUFFER_MS as Ca, deviceEchoNonce as Cc, decodeDnsResponse as Ci, PUBKY_PROOF_MAX_BYTES as Cn, GROUP_MEMBER_CAP as Co, freshHubs as Cr, handoffEphemeral as Cs, atprotoProofRkey as Ct, openGroupTyping as D, parseLinkPreview as Da, newDeviceSetSecret as Dc, encodeDnsQuery as Di, normalizePubkyKey as Dn, rosterHas as Do, mergeLobby as Dr, handoffPakeFrame as Ds, parseAtprotoDidDocument as Dt, groupTypingEpoch as E, dhtEditId as Ea, devicePingFrame as Ec, domainWellKnownFile as Ei, newPubkyProofFolder as En, commitHash as Eo, mergeBeacon as Er, handoffOfferFrame as Es, normalizeAtprotoHandle as Et, KNOCK_TTL_MS as F, queueReaction as Fa, TURN_LAST_SEQUENCE as Fc, wellKnownUrl as Fi, decodeBolt11 as Fn, presenceSeenAt as Fo, ChatFiles as Fr, readHandoffDone as Fs, checkDidJws as Ft, groupWakeFrame as G, ITEM_STATES as Ga, turnStatedVerifier as Gc, boundVerifiedIdentity as Gi, LIVENESS_PING_MS as Gn, answersOffer as Go, PIN_LIMITS as Gr, setAckFrame as Gs, normalizeDid as Gt, readKnocks as H, readReply as Ha, turnInstance as Hc, IDENTITY_REVOCATION_LABEL as Hi, parseFedimintRequestPayload as Hn, encodeControl as Ho, sanitizeTypingStatus as Hr, SET_ACK as Hs, didWebFileNames as Ht, decodeGroupEntryLink as I, reactionEmoji as Ia, TURN_MAX as Ic, CapsExchange as Ii, ENDPOINT as In, GhostlyHttpError as Io, FILE_LIMITS as Ir, readHandoffHave as Is, checkDidSignature as It, GROUP_LIMITS as J, RUN_RESULTS as Ja, RelayTransport as Jc, identityStatement as Ji, pairedMessageFrame as Jn, callSignalHeardAt as Jo, pinIsNewer as Jr, verifySetUpdate as Js, parseDidSignaturePaste as Jt, groupWakes as K, PR_CHECKS as Ka, turnVerifierMark as Kc, emptyIdentityLedger as Ki, PAIRED_FRAME_TOO_LARGE as Kn, buildSdpFromSignal as Ko, mayPin as Kr, setUpdateFrame as Ks, parseDid as Kt, encodeGroupEntryLink as L, reactionIsNewer as La, firstDeviceSetSecret as Lc, DHT_TEXT_CAPABILITY as Li, cashuRequestPayload as Ln, formatLocalTarget as Lo, transferEnded as Lr, readHandoffHello as Ls, didGhostlyServiceEntry as Lt, communityHasFrame as M, REACTION_LIMITS as Ma, TURN_SETTLE_MS as Mc, recordsFromWellKnown as Mi, pubkyHomeserverOf as Mn, DHT_POLL_INTERVALS as Mo, readBeaconHead as Mr, newHandoffId as Ms, DID_FILE_MAX_BYTES as Mt, decodeCommunityLink as N, ReactionWindow as Na, classifyTurnRead as Nc, recordsName as Ni, requestLnurlInvoice as Nn, EXPECT_PEER_MS as No, readLobby as Nr, readHandoffAck as Ns, DID_JWS_MAX_LENGTH as Nt, sealGroupTyping as O, forwardedAgain as Oa, seedSigner as Oc, isPublicAddress as Oi, pubkyProofCapability as On, verifyCommitSignature as Oo, newerHead as Or, handoffReleaseFrame as Os, shortAtprotoDid as Ot, encodeCommunityLink as P, nextReactionNumber as Pa, turnPutSummary as Pc, txtValue as Pi, resolveLightningDestination as Pn, RELAY_POLL_INTERVALS as Po, shouldBeHub as Pr, readHandoffCancel as Ps, DidError as Pt, frameBytes as Q, cardLine as Qa, traceLink as Qc, lastSharedWithMe as Qi, GROUP_HAVE_FRAME as Qn, emptyLinkRecords as Qo, WakeLimiter as Qr, ENROLL_PROOF as Qs, didDhtDocument as Qt, entryParams as R, readReaction as Ra, nextTurnPosition as Rc, capsDescriptors as Ri, fedimintRequestPayload as Rn, parseLocalTarget as Ro, transferStalled as Rr, readHandoffPake as Rs, didJwsAlg as Rt, readAppBundleAsync as S, parseVideoMeta as Sa, deviceEchoFrame as Sc, DOMAIN_FILE_MAX_BYTES as Si, isBitcoinAddress as Sn, readCanonicalJson as So, doorHubs as Sr, handoffDigest as Ss, atprotoProofRecord as St, GroupTypingBoard as T, RateWindow as Ta, deviceLinkPairing as Tc, domainTxtRecord as Ti, isPubkyProofFolder as Tn, MEMBER_KEY as To, lobbyRecords as Tr, handoffManifestFrames as Ts, isAtprotoDid as Tt, GROUP_WAKE_FRAME as U, replySnippet as Ua, turnKeys as Uc, IdentityCheckUnavailable as Ui, GhostLink as Un, CALL_SIGNAL_MAX_AGE_MS as Uo, typingActivity as Ur, SET_UPDATE as Us, didWebFileUrl as Ut, mergeKnocks as V, pairedReplyAuthor as Va, signTurnRelease as Vc, IDENTITY_MAX_VALIDITY as Vi, parseCashuRequestPayload as Vn, decodeControl as Vo, TypingSender as Vr, sealHandoffPiece as Vs, didWebFile as Vt, GroupWakeLimiter as W, BUTTON_ID as Wa, turnName as Wc, IdentityExchange as Wi, INVITE_TAKEN as Wn, RTC_CONFIG as Wo, GROUP_PIN_FRAME as Wr, readSetUpdate as Ws, didWebHost as Wt, GROUP_READ_NOTE as X, appCardId as Xa, normalizeRelayUrl as Xc, receivedIdentityStatus as Xi, engineText as Xn, parseCallSignal as Xo, readPin as Xr, ENROLL_GRANT as Xs, staticDidDocument as Xt, GROUP_REACTED_FRAME as Y, STATUS_CARD_LIMITS as Ya, currentRelays as Yc, newIdentityBinding as Yi, engineError as Yn, extractParamsFromSdp as Yo, pinNumberHolds as Yr, ENROLL_DONE as Ys, signingKeys as Yt, GroupSession as Z, buttonLabelClash as Za, setLinkTraceSink as Zc, revokesIdentity as Zi, GROUP_FILE_LIMITS as Zn, signalHasVideo as Zo, WAKE_CALL_INTERVAL_MS as Zr, ENROLL_HELLO as Zs, strictBase64Url as Zt, assembleAppBundle as _, VOICE_LIMITS as _a, inviteOwnership as _c, HoldKeys as _i, randomBytes as _l, walletNetworkOf as _n, readAppRevocations as _o, meshHubs as _r, handoffBusyFrame as _s, ATPROTO_DECLARED_SCOPE as _t, planAppUpdate as a, irohRelayUrl as aa, enrollProofFrame as ac, vapidKeysMatch as ai, newerPacket as al, EVM_TEST_CHAINS as an, heardTime as ao, readGroupHave as ar, HANDOFF_HAVE as as, groupName as at, pacer as b, parseVoiceMeta as ba, ENROLL_CAPABILITY as bc, newMailbox as bi, utf8Decode as bl, sparkAddressKind as bn, canonicalJson as bo, beaconKeys as br, handoffContextProof as bs, ATPROTO_PROOF_SCOPE as bt, readAppStore as c, peekDhtMailbox as ca, verifyEnrollProof as cc, isAppVersion as ci, createIdentity as cl, SEPOLIA_TEST_USDT as cn, APP_PREFIXES as co, CarriedTransport as cr, HANDOFF_PAKE as cs, SshSigError as ct, APP_BUNDLE_LIMITS as d, parseImageMeta as da, readDeviceInvite as dc, EDIT_CAPABILITY as di, publicKeyFromZ32 as dl, USDT_PUBLIC_RPC as dn, appRef as do, SIGNAL_HOLD_MS as dr, HANDOFF_TIMINGS as ds, sameSshKey as dt, emptyProofLedger as ea, enrollCancelReason as ec, newWakeToken as ei, isDiscoveryBudgetError as el, encodeDidDhtDeactivated as en, checkStatusCard as eo, GROUP_WANT_NO_FRAME as er, LEGACY_SERVICES as es, GROUP_EDIT_FRAME as et, APP_BUNDLE_MAGIC as f, readImageMeta as fa, OwnInviteError as fc, STATUS_CARD_CAPABILITY as fi, verify as fl, WALLET_NETWORKS as fn, checkAppRevokeStatement as fo, SIGNAL_REPLY_MS as fr, HANDOFF_VERIFIED as fs, sshSignCommand as ft, appViewOf as g, PLAYABLE_AUDIO as ga, inviteLink as gc, HOLD_LIMITS as gi, fromBase64Url as gl, validatePaymentTarget as gn, readAppRevocation as go, mayBeHub as gr, handoffAttemptSucceeded as gs, decodeAnyBitcoinAddress as gt, appDigest as h, sanitizeMime as ha, encodeInviteCode as hc, HOLD_DATED_BACK_MS as hi, bytesEqual as hl, formatPaymentAmount as hn, isAppRef as ho, MESH_HUBS as hr, handoffAttemptFailed as hs, BitcoinAddressError as ht, checkAppBeforeRun as i, irohDescriptor as ia, enrollHelloFrame as ic, checkPushEndpoint as ii, createRelayPayload as il, ETHEREUM_USDT as in, claimedTime as io, readGroupFileMeta as ir, HANDOFF_DONE as is, mentionsMember as it, GROUP_READ_NOTE_COMMUNITY as j, GROUP_REACTION_FRAME as ja, TURN_RAISE_READ_TIMEOUT_MS as jc, recordsFromTxt as ji, homeserverWebEndpoint as jn, AWAITING_PEER_MS as jo, readBeacon as jr, handoffVersions as js, DID_DOCUMENT_MAX_BYTES as jt, COMMUNITY_LIMITS as k, readForwarded as ka, webCryptoSigner as kc, nip05RootKey as ki, pubkyProofFile as kn, edgeParams as ko, pickHubs as kr, handoffRetryAfter as ks, AtprotoProofError as kt, readAppStoreSteps as l, DHT_FILE_CAPABILITY as la, createDeviceInvite as lc, APPS_CAPABILITY as li, identityFromSeed as ll, SEPOLIA_TEST_USDT_FAUCET as ln, APP_STATEMENT_LIMITS as lo, GROUP_SIGNAL_FRAME as lr, HANDOFF_PIECE_BYTES as ls, parseSshPublicKey as lt, APP_PERMISSIONS as m, sanitizeFileName as ma, decodeInviteCode as mc, HOLD_CAPABILITY as mi, sanitizeAvatar as ml, assertWholeSats as mn, isAppKey as mo, readGroupSignal as mr, handoffAttemptAllowed as ms, verifyBitcoinMessage as mt, appStoreDecision as n, TRANSPORTS as na, enrollDoneFrame as nc, relayRequest as ni, PacketTooLargeError as nl, resolveDidDht as nn, statusCardText as no, groupFileFallback as nr, HANDOFF_ACK as ns, carryMentions as nt, APP_STORE_LIMITS as o, DHT_FILE_TOO_LARGE as oa, readEnrollGrant as oc, APP_DATA_MAX_BYTES as oi, openRelayPayload as ol, ONCHAIN_PROVIDER as on, receivedTimestamp as oo, readGroupWant as or, HANDOFF_HELLO as os, SSHSIG_MAX_ARMOR as ot, APP_ICON_PATH as p, formatFileSize as pa, createChatInvite as pc, UPGRADE_CAPABILITY as pi, MAX_AVATAR_LENGTH as pl, assertTokenUnits as pn, isAppHash as po, groupSignalFrame as pr, filePartName as ps, verifySshSignature as pt, parseGroupWakeFrame as q, PR_STATES as qa, DEFAULT_RELAYS as qc, identityRevocationValue as qi, pairedMessageFits as qn, callRtcConfig as qo, nextPinNumber as qr, signTombstone as qs, parseDidDocument as qt, appUpdateDecision as r, automaticTransport as ra, enrollGrantFrame as rc, wakeRequest as ri, RELAY_PAYLOAD_MAX_BYTES as rl, signDidDhtPacket as rn, arrivalKey as ro, isGroupMessageId as rr, HANDOFF_CANCEL as rs, parseCommunityEdit as rt, checkAppStoreIndex as s, DHT_MESSAGE_TTL as sa, readEnrollHello as sc, chatAppId as si, parseRelayPayload as sl, PaymentPreflightError as sn, shownTime as so, readGroupWantNo as sr, HANDOFF_OFFER as ss, SSHSIG_NAMESPACE as st, appRevocationFor as t, validExternalKey as ta, enrollDigits as tc, parseWakeFrame as ti, withRequestOptions as tl, encodeDidDhtPacket as tn, sameButtonText as to, fetchesByItself as tr, serviceIdFromName as ts, GROUP_EDIT_TEXT_BYTES as tt, signAppStore as u, dhtFileId as ua, deviceInviteJoinerParams as uc, BUTTONS_CAPABILITY as ui, identityFromSeedB64 as ul, TEST_USDT_FAUCET_AMOUNT as un, appFingerprint as uo, SIGNAL_FRESH_MS as ur, HANDOFF_REQUEST as us, parseSshSignature as ut, checkAppManifest as v, baseMime as va, ownInviteRefusal as vc, HoldRefusedError as vi, toBase64Url as vl, SPARK_NETWORKS as vn, signAppObject as vo, pickMeshHubs as vr, handoffCancelFrame as vs, ATPROTO_FULL_SCOPE as vt, GROUP_TYPING_FRAME as w, EDIT_RATE_WINDOW_MS as wa, deviceKeyZ32 as wc, dnsProofName as wi, isPubkyKey as wn, MAX_GROUP_CHAIN as wo, lobbyKeys as wr, handoffHelloFrame as ws, checkAtprotoProofRecord as wt, readAppBundle as x, voicePeaksOf as xa, HANDOFF_CAPABILITY as xc, readManifest as xi, utf8Encode as xl, sparkInvoiceDetails as xn, canonicalJsonBytes as xo, beaconRecords as xr, handoffDataFrame as xs, atprotoDidMethod as xt, isAppUrl as y, fileMessageText as ya, DEVICES_CAPABILITY as yc, isHoldUrl as yi, toZ32 as yl, SPARK_PROVIDER as yn, signAppRevocation as yo, COMMUNITY_TOPOLOGY as yr, handoffContext as ys, ATPROTO_PROOF_COLLECTION as yt, knockIdentity as z, validReactionNumber as za, readTurnPacket as zc, dialDescriptors as zi, findEndpoint as zn, webLocalFetch as zo, TYPING_KINDS as zr, readHandoffTurnFrame as zs, didSignedMessages as zt };
 
-//# sourceMappingURL=src-DhfGgAUu.js.map
+//# sourceMappingURL=src-DDzSERyc.js.map