@ghostlytools/cli 1.3.0 → 1.3.2

package/dist/assets/{src-DhfGgAUu.js → src-yMUQvdyL.js}

@@ -1,4 +1,3 @@
-import { At as fromBase64, B as readStatusCard, C as downsamplePeaks, Ct as hasVisible, D as parseVideoMeta, Dt as trimEndOf, Et as stripHidden, Ft as toBase64Url, H as statusCardBytes, I as cardEditNumber, It as toZ32, Lt as utf8Decode, Mt as fromZ32, N as STATUS_CARD_LIMITS, Nt as randomBytes, O as BUTTON_ID, Ot as bytesEqual, Pt as toBase64, Rt as utf8Encode, St as wrapDataChannel, T as parseVoiceMeta, Tt as sanitizeNick, X as APP_PREFIXES, Y as APP_NAME, _t as LIMITS, bt as encodeControl, c as readGroupFileMeta, ct as readAppSignature, dt as verifyAppRevocation, et as appRefPublisher, f as imageSize, ft as verifyAppSignature, g as formatFileSize, gt as CHUNK_KIND, h as FileTransfers, ht as readCanonicalJson, it as isAppRef, jt as fromBase64Url, kt as concatBytes$1, lt as signAppObject, mt as canonicalJsonBytes, nt as isAppHash, ot as readAppRevocationShape, p as parseImageMeta, rt as isAppKey, t as GROUP_FILE_LIMITS, v as sanitizeFileName, vt as decodeChunk, wt as sanitizeDisplayText, xt as sendBody, y as sanitizeMime, yt as decodeControl } from "./groupFiles-DBbjOLuD.js";
 import { xsalsa20poly1305 } from "@noble/ciphers/salsa.js";
 import { ed25519, x25519 } from "@noble/curves/ed25519.js";
 import { hkdf } from "@noble/hashes/hkdf.js";
@@ -13,6 +12,165 @@ import { p256, p384, p521 } from "@noble/curves/nist.js";
 import { gcm } from "@noble/ciphers/aes.js";
 import { ripemd160 } from "@noble/hashes/legacy.js";
 import { bytesToNumberBE } from "@noble/curves/utils.js";
+//#region ../core/src/bytes.ts
+var textEncoder$1 = new TextEncoder();
+var textDecoder$1 = new TextDecoder("utf-8", { fatal: true });
+function utf8Encode(str) {
+	return textEncoder$1.encode(str);
+}
+function utf8Decode(bytes) {
+	return textDecoder$1.decode(bytes);
+}
+function concatBytes$1(...parts) {
+	let length = 0;
+	for (const p of parts) length += p.length;
+	const out = new Uint8Array(length);
+	let offset = 0;
+	for (const p of parts) {
+		out.set(p, offset);
+		offset += p.length;
+	}
+	return out;
+}
+function bytesEqual(a, b) {
+	if (a.length !== b.length) return false;
+	let diff = 0;
+	for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];
+	return diff === 0;
+}
+/** `Uint8Array.prototype.toBase64` (Node 25+, Chrome 140+, Firefox 133+, Safari 18.2+): ~200x the JS below. */
+var nativeToBase64 = Uint8Array.prototype.toBase64;
+var tableOf = (chars) => Uint8Array.from(chars, (c) => c.charCodeAt(0));
+var BASE64_TABLE = tableOf("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/");
+var BASE64URL_TABLE = tableOf("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_");
+/**
+* Base64 where the runtime has no native encoder (Node 22 and 24, older WebViews): the characters go into bytes and
+* become one string at the end. Every file chunk is encoded (files/3 `pf-data`), so this is on a transfer's path.
+*/
+function encodeBase64(bytes, table, pad) {
+	const out = new Uint8Array(Math.ceil(bytes.length / 3) * 4);
+	let o = 0, i = 0;
+	for (; i + 2 < bytes.length; i += 3) {
+		const n = bytes[i] << 16 | bytes[i + 1] << 8 | bytes[i + 2];
+		out[o++] = table[n >>> 18];
+		out[o++] = table[n >>> 12 & 63];
+		out[o++] = table[n >>> 6 & 63];
+		out[o++] = table[n & 63];
+	}
+	const rest = bytes.length - i;
+	if (rest) {
+		const n = bytes[i] << 16 | (rest === 2 ? bytes[i + 1] << 8 : 0);
+		out[o++] = table[n >>> 18];
+		out[o++] = table[n >>> 12 & 63];
+		if (rest === 2) out[o++] = table[n >>> 6 & 63];
+		else if (pad) out[o++] = 61;
+		if (pad) out[o++] = 61;
+	}
+	return textDecoder$1.decode(out.subarray(0, o));
+}
+function toBase64(bytes) {
+	return nativeToBase64 ? nativeToBase64.call(bytes) : encodeBase64(bytes, BASE64_TABLE, true);
+}
+function fromBase64(str) {
+	const binary = atob(str);
+	const bytes = new Uint8Array(binary.length);
+	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+	return bytes;
+}
+function toBase64Url(bytes) {
+	return nativeToBase64 ? nativeToBase64.call(bytes, {
+		alphabet: "base64url",
+		omitPadding: true
+	}) : encodeBase64(bytes, BASE64URL_TABLE, false);
+}
+function fromBase64Url(str) {
+	let b = str.replace(/-/g, "+").replace(/_/g, "/");
+	while (b.length % 4) b += "=";
+	return fromBase64(b);
+}
+var Z32_ALPHABET = "ybndrfg8ejkmcpqxot1uwisza345h769";
+function toZ32(bytes) {
+	let out = "";
+	let bits = 0;
+	let value = 0;
+	for (const byte of bytes) {
+		value = value << 8 | byte;
+		bits += 8;
+		while (bits >= 5) {
+			out += Z32_ALPHABET[value >>> bits - 5 & 31];
+			bits -= 5;
+		}
+		value &= (1 << bits) - 1;
+	}
+	if (bits > 0) out += Z32_ALPHABET[value << 5 - bits & 31];
+	return out;
+}
+function fromZ32(str) {
+	const out = new Uint8Array(Math.floor(str.length * 5 / 8));
+	let bits = 0;
+	let value = 0;
+	let index = 0;
+	for (const char of str) {
+		const v = Z32_ALPHABET.indexOf(char);
+		if (v < 0) throw new Error(`Invalid z-base-32 character: ${char}`);
+		value = value << 5 | v;
+		bits += 5;
+		if (bits >= 8) {
+			out[index++] = value >>> bits - 8 & 255;
+			bits -= 8;
+		}
+		value &= (1 << bits) - 1;
+	}
+	return out;
+}
+function randomBytes(length) {
+	const bytes = new Uint8Array(length);
+	crypto.getRandomValues(bytes);
+	return bytes;
+}
+/**
+* Invisible and direction-changing characters. Unlike a file name, display
+* text may legitimately hold emoji and Indic or Arabic joiners, so the two
+* joiners stay and the rest of Cf goes: bidi overrides and isolates reorder
+* what follows them, and the others hide text or let two different names
+* render identically.
+*/
+var HIDDEN = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu;
+/** Zero-width non-joiner and zero-width joiner. */
+var KEEP = /[\u200c\u200d]/;
+/** `text` without its invisible and direction-changing characters, at any length: for display text with a cut of its own. */
+function stripHidden(text) {
+	return text.replace(HIDDEN, (char) => KEEP.test(char) ? char : "");
+}
+/**
+* What draws nothing when it stands alone and `HIDDEN` leaves in, since text needs it beside something else: the
+* joiners, the fillers, the variation selectors and the other default-ignorable code points, combining marks, white
+* space and the blank Braille pattern.
+*/
+var UNSEEN = /^[\p{Default_Ignorable_Code_Point}\p{M}\p{White_Space}\u2800]*$/u;
+/** Whether `text` holds a character that shows by itself: a name of joiners, fillers or marks alone has none. */
+function hasVisible(text) {
+	return !UNSEEN.test(text);
+}
+/** Undefined when nothing visible is left, so callers can fall back. */
+function sanitizeDisplayText(text, max) {
+	const clean = [...stripHidden(text)].slice(0, max).join("").trim();
+	return hasVisible(clean) ? clean : void 0;
+}
+/** A nickname as it arrived from a peer, ready to show. */
+function sanitizeNick(nick) {
+	return typeof nick === "string" ? sanitizeDisplayText(nick, 64) : void 0;
+}
+/**
+* `text` without the characters of `chars` it ends with, in one pass from the end. A `/[…]+$/` replace would retry
+* from every character of a run that does not reach the end.
+*/
+function trimEndOf(text, chars) {
+	let end = text.length;
+	while (end > 0 && chars.includes(text[end - 1])) end--;
+	return end === text.length ? text : text.slice(0, end);
+}
+//#endregion
 //#region ../core/src/avatar.ts
 /**
 * A profile picture as it travels between paired peers: a small square JPEG in a data URL. The picture
@@ -23,7 +181,7 @@ import { bytesToNumberBE } from "@noble/curves/utils.js";
 var MAX_AVATAR_LENGTH = 48e3;
 var PREFIX$1 = "data:image/jpeg;base64,";
 /** Width and height from a JPEG's frame header, or undefined when there is none before the image data. */
-function jpegSize(bytes) {
+function jpegSize$1(bytes) {
 	if (bytes.length < 4 || bytes[0] !== 255 || bytes[1] !== 216) return;
 	let i = 2;
 	while (i + 4 <= bytes.length) {
@@ -58,7 +216,7 @@ function sanitizeAvatar(value) {
 	}
 	const bytes = new Uint8Array(binary.length);
 	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
-	const size = jpegSize(bytes);
+	const size = jpegSize$1(bytes);
 	if (!size || size.width < 1 || size.height < 1 || size.width > 512 || size.height > 512) return;
 	return value;
 }
@@ -76,8 +234,7 @@ function generateEncryptionKey() {
 function encrypt(plaintext, key) {
 	if (key.length !== KEY_LENGTH) throw new Error("Invalid key length: expected 32 bytes");
 	const nonce = randomBytes(NONCE_LENGTH$3);
-	const box = xsalsa20poly1305(key, nonce).encrypt(utf8Encode(plaintext));
-	return toBase64(concatBytes$1(nonce, box));
+	return toBase64(concatBytes$1(nonce, xsalsa20poly1305(key, nonce).encrypt(utf8Encode(plaintext))));
 }
 /** The length of what `encrypt` returns for a plaintext of this many UTF-8 bytes: base64 of nonce, box and 16-byte tag. */
 function sealedLength(plaintextBytes) {
@@ -561,9 +718,13 @@ var RelayBreaker = class {
 		this.circuits.delete(relay);
 		if (recovered) this.options.onRecover?.(relay);
 	}
-	/** The relay failed a request; a probe that fails trips it again at once. */
+	/**
+	* The relay failed a request; a probe that fails trips it again at once. While it is left alone and no probe is out,
+	* a failure is a request sent before it tripped (a start burst): already counted in, it trips nothing again.
+	*/
 	failure(relay, kind, reason) {
 		const circuit = this.circuit(relay);
+		if (!circuit.probing && circuit.openUntil > this.now()) return;
 		circuit.failures++;
 		circuit.kind = kind;
 		circuit.reason = reason;
@@ -2989,6 +3150,12 @@ var OwnInviteError = class extends Error {
 		this.name = "OwnInviteError";
 	}
 };
+/** The refusal an error (or an error's message, as an RPC hands it over) carries, or null when it is another error. */
+function ownInviteRefusal(error) {
+	if (error instanceof OwnInviteError) return { linkId: error.linkId };
+	const match = (error instanceof Error ? error.message : typeof error === "string" ? error : "").match(/^own-invite(?: (\S+))?: /);
+	return match ? { linkId: match[1] ?? null } : null;
+}
 /** The `ghostly1z…` code of a device invite. */
 function encodeDeviceInvite(invite) {
 	const fields = [
@@ -3496,9 +3663,9 @@ var HANDOFF_CANCEL_REASONS = [
 	"stalled"
 ];
 var KEY$3 = /^[A-Za-z0-9_-]{43}$/;
-var DIGEST$1 = KEY$3;
+var DIGEST$2 = KEY$3;
 var SIGNATURE = /^[A-Za-z0-9_-]{86}$/;
-var ID$4 = /^[A-Za-z0-9_-]{22}$/;
+var ID$5 = /^[A-Za-z0-9_-]{22}$/;
 var B64$4 = /^[A-Za-z0-9_-]*$/;
 var HEX = /^[0-9a-f]{64}$/;
 var VERSION_TEXT = /^[0-9A-Za-z.+_-]{1,40}$/;
@@ -3512,9 +3679,9 @@ var isHandoffPartName = (name) => typeof name === "string" && PART.test(name);
 /** The part a file is: `file/<its SHA-256, base64url>`. */
 var filePartName = (sha256B64) => `file/${sha256B64}`;
 /** The digest a file part names, or null for any other part. */
-var filePartDigest = (name) => name.startsWith("file/") && DIGEST$1.test(name.slice(5)) ? name.slice(5) : null;
+var filePartDigest = (name) => name.startsWith("file/") && DIGEST$2.test(name.slice(5)) ? name.slice(5) : null;
 function isPart(value) {
-	return Array.isArray(value) && value.length === 3 && isHandoffPartName(value[0]) && isCount$1(value[1], MAX_PART) && isText$2(value[2], DIGEST$1) && (filePartDigest(value[0]) === null || filePartDigest(value[0]) === value[2]);
+	return Array.isArray(value) && value.length === 3 && isHandoffPartName(value[0]) && isCount$1(value[1], MAX_PART) && isText$2(value[2], DIGEST$2) && (filePartDigest(value[0]) === null || filePartDigest(value[0]) === value[2]);
 }
 /** Names compared as UTF-8 byte strings, as `H` sorts them. */
 function compareNames(a, b) {
@@ -3636,7 +3803,7 @@ function readHandoffHello(frame) {
 	if (typeof frame.room !== "number" || !Number.isSafeInteger(frame.room) || frame.room < -1) return null;
 	if (typeof frame.metered !== "boolean") return null;
 	if (frame.later !== void 0 && !isCount$1(frame.later)) return null;
-	if (frame.id !== void 0 && !isText$2(frame.id, ID$4)) return null;
+	if (frame.id !== void 0 && !isText$2(frame.id, ID$5)) return null;
 	const kind = DEVICE_KINDS.includes(frame.kind) ? frame.kind : "web";
 	return {
 		v: 1,
@@ -3662,7 +3829,7 @@ var handoffOfferFrame = (turn, id, bytes) => ({
 });
 function readHandoffTurnFrame(frame) {
 	if (frame.t !== "handoff-request" && frame.t !== "handoff-offer") return null;
-	if (!isCount$1(frame.turn, TURN_MAX) || !isText$2(frame.id, ID$4)) return null;
+	if (!isCount$1(frame.turn, TURN_MAX) || !isText$2(frame.id, ID$5)) return null;
 	if (frame.t === "handoff-offer") return isCount$1(frame.bytes) ? {
 		turn: frame.turn,
 		id: frame.id,
@@ -3705,7 +3872,7 @@ function readHandoffPake(frame) {
 	};
 }
 function readHandoffHave(frame) {
-	if (frame.t !== "handoff-have" || !Array.isArray(frame.d) || frame.d.length > 300 || !frame.d.every((d) => isText$2(d, DIGEST$1))) return null;
+	if (frame.t !== "handoff-have" || !Array.isArray(frame.d) || frame.d.length > 300 || !frame.d.every((d) => isText$2(d, DIGEST$2))) return null;
 	const p = {};
 	if (frame.p !== void 0) {
 		if (!frame.p || typeof frame.p !== "object" || Array.isArray(frame.p) || Object.keys(frame.p).length > 300) return null;
@@ -3761,7 +3928,7 @@ function readHandoffAck(frame) {
 }
 /** `H` of a `handoff-verified` that B's key signed for this turn address and turn, or null. */
 function readHandoffVerified(frame, turnAddress, turn, takerKey) {
-	if (frame.t !== "handoff-verified" || !isText$2(frame.h, DIGEST$1) || !isText$2(frame.s, SIGNATURE)) return null;
+	if (frame.t !== "handoff-verified" || !isText$2(frame.h, DIGEST$2) || !isText$2(frame.s, SIGNATURE)) return null;
 	const h = fromBase64Url(frame.h);
 	try {
 		return verify(fromBase64Url(frame.s), handoffVerifiedMessage(turnAddress, turn, h), takerKey) ? h : null;
@@ -3829,7 +3996,7 @@ var handoffAttemptSucceeded = () => ({
 /** Seconds until a locked-out device may try again (for `handoff-busy`). */
 var handoffRetryAfter = (attempts, now) => attempts?.until !== void 0 && attempts.until > now ? Math.ceil((attempts.until - now) / 1e3) : 0;
 var HTTP_SERVICE_PROTO = "ghostly-http/1";
-var MAX_NAME_LENGTH = 48;
+var MAX_NAME_LENGTH$1 = 48;
 var MAX_META_ENTRIES = 8;
 var MAX_META_LENGTH = 64;
 var SERVICE_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,31}$/;
@@ -3910,7 +4077,7 @@ function servicesFromWire(wire) {
 					id: e.i,
 					type: e.t
 				};
-				const name = cleanString(e.n, MAX_NAME_LENGTH);
+				const name = cleanString(e.n, MAX_NAME_LENGTH$1);
 				const proto = cleanString(e.p, MAX_META_LENGTH);
 				if (name) ad.name = name;
 				if (proto) ad.proto = proto;
@@ -4756,6 +4923,325 @@ function buildDataSdp(signal) {
 	return lines.join("\r\n") + "\r\n";
 }
 //#endregion
+//#region ../core/src/frames.ts
+/**
+* Framing on the `ghostly/1` DataChannel (ordered, reliable).
+*
+* - Text messages are control frames: compact JSON with a `t` discriminator,
+*   the same shape Ghostly already uses for `_msgs` and `_call`.
+* - Binary messages are body chunks that belong to a stream opened by a
+*   control frame: `<kind u8><stream id u32 BE><flags u8><payload>`.
+*
+* Everything here handles data from the remote peer and must never trust it.
+*/
+var LIMITS = {
+	/** Largest control frame accepted, headers included. */
+	maxControlFrameBytes: 61440,
+	/** Longest payment endpoint value (a Cashu token, an invoice) a payment frame may carry; a longer one is dropped. */
+	maxPaymentEndpointChars: 32768,
+	/** Largest DataChannel message sent. 16 KiB is safe across WebRTC stacks. */
+	maxChunkMessageBytes: 16384,
+	maxRequestBodyBytes: 8388608,
+	maxResponseBodyBytes: 67108864,
+	maxHeaderCount: 128,
+	maxHeaderValueBytes: 16384,
+	maxPathBytes: 8192,
+	/** Requests a host serves at once for one peer. */
+	maxConcurrentRequestsPerPeer: 32,
+	/** Requests a client keeps in flight; the rest wait in a queue. */
+	maxClientInFlight: 16,
+	maxChatMessageBytes: 16384,
+	maxFileBytes: 104857600,
+	/** Files a peer may be sending us at once. */
+	maxIncomingFilesPerPeer: 3,
+	/** Received bytes kept for one peer, in flight included. Past it new files are refused. */
+	maxStoredIncomingBytesPerPeer: 524288e3,
+	requestTimeoutMs: 6e4,
+	bodyIdleTimeoutMs: 3e4,
+	/** Stop writing to the channel above this many buffered bytes. */
+	sendHighWaterMark: 1048576,
+	sendLowWaterMark: 262144
+};
+var CHUNK_KIND = {
+	requestBody: 1,
+	responseBody: 2,
+	fileBody: 3
+};
+var CHUNK_HEADER_BYTES = 6;
+var MAX_CHUNK_PAYLOAD_BYTES = LIMITS.maxChunkMessageBytes - CHUNK_HEADER_BYTES;
+function encodeControl(frame) {
+	const json = JSON.stringify(frame);
+	if (utf8Encode(json).length > LIMITS.maxControlFrameBytes) throw new Error("Control frame too large");
+	return json;
+}
+function isHeaderList(value) {
+	if (!Array.isArray(value) || value.length > LIMITS.maxHeaderCount) return false;
+	return value.every((h) => Array.isArray(h) && h.length === 2 && typeof h[0] === "string" && typeof h[1] === "string" && h[0].length <= 256 && h[1].length <= LIMITS.maxHeaderValueBytes);
+}
+function isStreamId(value) {
+	return typeof value === "number" && Number.isInteger(value) && value >= 0 && value <= 4294967295;
+}
+function isPayId(value) {
+	return typeof value === "string" && /^[A-Za-z0-9_-]{8,64}$/.test(value);
+}
+/** Decimal text, as in Paykit's Payment Amount: no floats on the wire. */
+function isAmount(value) {
+	return typeof value === "string" && /^(0|[1-9]\d{0,15})(\.\d{1,8})?$/.test(value);
+}
+function isUnit(value) {
+	return typeof value === "string" && /^[a-z0-9]{1,12}$/.test(value);
+}
+function isEndpoint(value) {
+	return Array.isArray(value) && value.length === 2 && typeof value[0] === "string" && value[0].length <= 64 && /^[a-z0-9][a-z0-9-]*(?:\/[1-9][0-9]*)?$/.test(value[0]) && typeof value[1] === "string" && value[1].length <= LIMITS.maxPaymentEndpointChars;
+}
+/** Returns null for anything malformed; callers drop the frame. */
+function decodeControl(text) {
+	if (text.length > LIMITS.maxControlFrameBytes || utf8Encode(text).length > LIMITS.maxControlFrameBytes) return null;
+	let raw;
+	try {
+		raw = JSON.parse(text);
+	} catch {
+		return null;
+	}
+	if (!raw || typeof raw !== "object") return null;
+	const f = raw;
+	switch (f.t) {
+		case "hello":
+			if (typeof f.v !== "number") return null;
+			return {
+				t: "hello",
+				v: f.v,
+				svc: f.svc,
+				nick: sanitizeNick(f.nick)
+			};
+		case "m":
+			if (typeof f.ts !== "number" || typeof f.m !== "string") return null;
+			if (utf8Encode(f.m).length > LIMITS.maxChatMessageBytes) return null;
+			return {
+				t: "m",
+				ts: f.ts,
+				m: f.m
+			};
+		case "call":
+			if (typeof f.s !== "string" || utf8Encode(f.s).length > LIMITS.maxChatMessageBytes) return null;
+			return {
+				t: "call",
+				s: f.s
+			};
+		case "svc": return {
+			t: "svc",
+			svc: f.svc
+		};
+		case "req":
+			if (!isStreamId(f.id) || typeof f.s !== "string" || typeof f.m !== "string") return null;
+			if (typeof f.p !== "string" || f.p.length > LIMITS.maxPathBytes || !isHeaderList(f.h)) return null;
+			return {
+				t: "req",
+				id: f.id,
+				s: f.s,
+				m: f.m,
+				p: f.p,
+				h: f.h,
+				b: f.b === true
+			};
+		case "res":
+			if (!isStreamId(f.id) || typeof f.st !== "number" || !Number.isInteger(f.st)) return null;
+			if (f.st < 100 || f.st > 599 || !isHeaderList(f.h)) return null;
+			return {
+				t: "res",
+				id: f.id,
+				st: f.st,
+				h: f.h,
+				b: f.b === true
+			};
+		case "file":
+			if (!isStreamId(f.id) || typeof f.f !== "string" || typeof f.ts !== "number") return null;
+			if (typeof f.n !== "string" || typeof f.m !== "string") return null;
+			if (typeof f.s !== "number" || !Number.isSafeInteger(f.s) || f.s < 0) return null;
+			return {
+				t: "file",
+				id: f.id,
+				f: f.f,
+				ts: f.ts,
+				n: f.n,
+				s: f.s,
+				m: f.m
+			};
+		case "pay-req":
+		case "pay": {
+			if (!isPayId(f.id) || typeof f.ts !== "number" || !isAmount(f.v) || !isUnit(f.u)) return null;
+			const memo = typeof f.memo === "string" ? f.memo.slice(0, 140) : void 0;
+			if (f.t === "pay-req") {
+				if (!Array.isArray(f.e) || f.e.length === 0 || f.e.length > 8 || !f.e.every(isEndpoint)) return null;
+				return {
+					t: "pay-req",
+					id: f.id,
+					ts: f.ts,
+					v: f.v,
+					u: f.u,
+					memo,
+					e: f.e,
+					a: isPayId(f.a) ? f.a : void 0,
+					n: f.n === "mainnet" || f.n === "testnet" ? f.n : void 0
+				};
+			}
+			if (!isEndpoint(f.e) || f.rid !== void 0 && !isPayId(f.rid)) return null;
+			return {
+				t: "pay",
+				id: f.id,
+				ts: f.ts,
+				rid: f.rid,
+				v: f.v,
+				u: f.u,
+				memo,
+				e: f.e
+			};
+		}
+		case "pay-ask":
+			if (!isPayId(f.id) || typeof f.ts !== "number" || !isAmount(f.v) || !isUnit(f.u)) return null;
+			if (f.m !== "arkade" && f.m !== "usdt" && f.m !== "bark" && f.m !== "bitcoin" && f.m !== "fedimint" && f.m !== "spark") return null;
+			return {
+				t: "pay-ask",
+				id: f.id,
+				ts: f.ts,
+				v: f.v,
+				u: f.u,
+				m: f.m,
+				memo: typeof f.memo === "string" ? f.memo.slice(0, 140) : void 0,
+				n: f.n === "mainnet" || f.n === "testnet" ? f.n : void 0
+			};
+		case "pay-res":
+			if (!isPayId(f.id) || typeof f.ok !== "boolean") return null;
+			if (f.v !== void 0 && !isAmount(f.v)) return null;
+			return {
+				t: "pay-res",
+				id: f.id,
+				ok: f.ok,
+				v: f.v,
+				err: typeof f.err === "string" ? f.err.slice(0, 200) : void 0,
+				...f.c === true && !f.ok ? { c: true } : {}
+			};
+		case "rst":
+			if (!isStreamId(f.id) || f.d !== "q" && f.d !== "s" && f.d !== "f") return null;
+			return {
+				t: "rst",
+				id: f.id,
+				d: f.d,
+				e: typeof f.e === "string" ? f.e.slice(0, 256) : ""
+			};
+		case "ping":
+		case "pong":
+			if (typeof f.ts !== "number") return null;
+			return {
+				t: f.t,
+				ts: f.ts
+			};
+		default: return null;
+	}
+}
+function encodeChunk(chunk) {
+	if (chunk.payload.length > MAX_CHUNK_PAYLOAD_BYTES) throw new Error("Chunk payload too large");
+	const out = new Uint8Array(CHUNK_HEADER_BYTES + chunk.payload.length);
+	const view = new DataView(out.buffer);
+	view.setUint8(0, chunk.kind);
+	view.setUint32(1, chunk.id);
+	view.setUint8(5, chunk.end ? 1 : 0);
+	out.set(chunk.payload, CHUNK_HEADER_BYTES);
+	return out;
+}
+function decodeChunk(data) {
+	if (data.length < CHUNK_HEADER_BYTES || data.length > LIMITS.maxChunkMessageBytes) return null;
+	const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
+	const kind = view.getUint8(0);
+	if (kind !== CHUNK_KIND.requestBody && kind !== CHUNK_KIND.responseBody && kind !== CHUNK_KIND.fileBody) return null;
+	return {
+		kind,
+		id: view.getUint32(1),
+		end: (view.getUint8(5) & 1) !== 0,
+		payload: data.subarray(CHUNK_HEADER_BYTES)
+	};
+}
+function wrapDataChannel(dc) {
+	dc.binaryType = "arraybuffer";
+	dc.bufferedAmountLowThreshold = LIMITS.sendLowWaterMark;
+	const channel = {
+		send(data) {
+			if (dc.readyState !== "open") throw new Error("Data link is not open");
+			if (typeof data === "string") dc.send(data);
+			else dc.send(data);
+		},
+		get bufferedAmount() {
+			return dc.bufferedAmount;
+		},
+		drained() {
+			if (dc.bufferedAmount <= LIMITS.sendLowWaterMark || dc.readyState !== "open") return Promise.resolve();
+			return new Promise((resolve) => {
+				const done = () => {
+					dc.removeEventListener("bufferedamountlow", done);
+					dc.removeEventListener("close", done);
+					resolve();
+				};
+				dc.addEventListener("bufferedamountlow", done);
+				dc.addEventListener("close", done);
+			});
+		},
+		close() {
+			dc.close();
+		},
+		binary: true,
+		onMessage: null,
+		onClose: null
+	};
+	dc.addEventListener("message", (event) => {
+		const data = event.data;
+		if (typeof data === "string") channel.onMessage?.(data);
+		else if (data instanceof ArrayBuffer) channel.onMessage?.(new Uint8Array(data));
+	});
+	dc.addEventListener("close", () => channel.onClose?.());
+	return channel;
+}
+/**
+* Resolves once the channel has room for a body's next chunk; undefined when it has now. A channel with a send budget
+* (native and iroh ones throw past 120 KiB) gives a body a quarter of it, as files/3 keeps to, so a ping or a message
+* still fits beside it; others keep under the high water mark.
+*/
+function bodyRoom(channel, isCancelled) {
+	if (!channel.sendBudget) return channel.bufferedAmount > LIMITS.sendHighWaterMark ? channel.drained() : void 0;
+	const line = channel.sendBudget / 4;
+	if (channel.bufferedAmount < line) return;
+	return (async () => {
+		while (!isCancelled() && channel.bufferedAmount >= line) {
+			await channel.drained().catch(() => {});
+			if (!isCancelled() && channel.bufferedAmount >= line) await new Promise((resolve) => setTimeout(resolve, 20));
+		}
+	})();
+}
+/** Writes a body as chunks, honouring backpressure. Always ends with an END chunk. */
+async function sendBody(channel, kind, id, body, isCancelled = () => false) {
+	for await (const part of body) for (let offset = 0; offset < part.length; offset += MAX_CHUNK_PAYLOAD_BYTES) {
+		if (isCancelled()) return;
+		const room = bodyRoom(channel, isCancelled);
+		if (room) {
+			await room;
+			if (isCancelled()) return;
+		}
+		const payload = part.subarray(offset, offset + MAX_CHUNK_PAYLOAD_BYTES);
+		channel.send(encodeChunk({
+			kind,
+			id,
+			end: false,
+			payload
+		}));
+	}
+	if (isCancelled()) return;
+	channel.send(encodeChunk({
+		kind,
+		id,
+		end: true,
+		payload: /* @__PURE__ */ new Uint8Array(0)
+	}));
+}
+//#endregion
 //#region ../core/src/http.ts
 var LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
 	"localhost",
@@ -5705,7 +6191,7 @@ var LinkSession = class {
 		const stepping = this.fastStepsAfter ? Date.now() - this.fastStepsAfter : -1;
 		if (pace === "fast" && stepping >= 0) return Math.min(4 * interval, Math.max(2 * interval, stepping));
 		if (pace === "fast" || pace === "connected" || since < 0) return interval;
-		if (pace === "background" && this.presence.lastPacketAt === 0 && this.invite()) return unusedInviteWait(Date.now() - this.awaitingSince, interval);
+		if (pace === "background" && !this.presence.online && this.invite()) return unusedInviteWait(Date.now() - this.awaitingSince, interval);
 		return Math.min(interval, Math.max(2 * this.intervals.fast, since));
 	}
 	/**
@@ -6740,6 +7226,8 @@ function parseCommit$1(raw) {
 		sig: c.sig
 	};
 }
+/** Only shape, no signature or parent: a commit as kept, its fields alone (anything else it carried dropped); null when malformed. */
+var parseGroupCommit = parseCommit$1;
 /** The roster a commit must carry, given the previous one; null when the change is not allowed. */
 function expectedRoster(previous, kind, by, subject) {
 	if (kind === "create") return previous === null && !subject ? [[by, "admin"]] : null;
@@ -6794,29 +7282,1020 @@ function verifyChain(raw, groupId) {
 	return { chain };
 }
 /**
-* What a commit is refused with while admin work is off on this device (WISP 06 § Forced takeover: after a forced
-* takeover or a restore, until the person turns on "Manage groups from this device").
-*/
-/**
-* The highest sequence number a frame of my own key, sent by another copy of my profile, may make me adopt (WISP 06):
-* the highest floor a copy can have (2^32 - 2^24) and room above it. The community beacon packs the counter in 32 bits.
+* What a commit is refused with while admin work is off on this device (WISP 06 § Forced takeover: after a forced
+* takeover or a restore, until the person turns on "Manage groups from this device").
+*/
+/**
+* The highest sequence number a frame of my own key, sent by another copy of my profile, may make me adopt (WISP 06):
+* the highest floor a copy can have (2^32 - 2^24) and room above it. The community beacon packs the counter in 32 bits.
+*/
+var OWN_FRAME_LIMIT = 2 ** 32 - 2 ** 23;
+/**
+* Frames said again (WISP 902, both profiles): a member's own frames that no edge took when it said them are
+* remembered (`kept`, the latest) and, once the chain it follows is newer than such a frame's and has not moved for
+* `settledMs`, looked at once for saying again where the members let in while it was behind can read them. A catch-up
+* brings commits one by one, and a frame said again at the first of them would still miss those let in by the next.
+*/
+var SAID_AGAIN = {
+	settledMs: 5e3,
+	kept: 64
+};
+/** `alone` with `key` added last, keeping only keys still `present` (frames still in the log), the latest `kept`. */
+function rememberAlone(alone, key, present) {
+	return [...(alone ?? []).filter((k) => k !== key && present(k)), key].slice(-SAID_AGAIN.kept);
+}
+var GROUP_ADMIN_OFF_ERROR = "Managing this group is off on this device. Turn on Manage groups from this device first.";
+//#endregion
+//#region ../core/src/canonicalJson.ts
+/** True when `s` holds a lone UTF-16 surrogate, which I-JSON (and so JCS) does not allow. */
+function hasLoneSurrogate(s) {
+	for (let i = 0; i < s.length; i++) {
+		const c = s.charCodeAt(i);
+		if (c >= 55296 && c <= 56319) {
+			const next = s.charCodeAt(i + 1);
+			if (next >= 56320 && next <= 57343) {
+				i++;
+				continue;
+			}
+			return true;
+		}
+		if (c >= 56320 && c <= 57343) return true;
+	}
+	return false;
+}
+function write(value, depth) {
+	if (depth > 64) throw new Error("JSON nested deeper than 64 levels");
+	if (value === null) return "null";
+	if (typeof value === "boolean") return value ? "true" : "false";
+	if (typeof value === "number") {
+		if (!Number.isFinite(value)) throw new Error("JSON numbers must be finite");
+		return JSON.stringify(value);
+	}
+	if (typeof value === "string") {
+		if (hasLoneSurrogate(value)) throw new Error("A JSON string holds a lone surrogate");
+		return JSON.stringify(value);
+	}
+	if (Array.isArray(value)) return `[${value.map((v) => write(v, depth + 1)).join(",")}]`;
+	if (typeof value === "object") {
+		const record = value;
+		return `{${Object.keys(value).filter((k) => record[k] !== void 0).sort((a, b) => a < b ? -1 : a > b ? 1 : 0).map((k) => {
+			if (hasLoneSurrogate(k)) throw new Error("A JSON key holds a lone surrogate");
+			return `${JSON.stringify(k)}:${write(record[k], depth + 1)}`;
+		}).join(",")}}`;
+	}
+	throw new Error(`Not a JSON value: ${typeof value}`);
+}
+/** The canonical text of a JSON value. Throws on a value JSON cannot hold (a non-finite number, a lone surrogate). */
+function canonicalJson(value) {
+	return write(value, 0);
+}
+/** The canonical UTF-8 bytes of a JSON value. */
+function canonicalJsonBytes(value) {
+	return utf8Encode(canonicalJson(value));
+}
+/**
+* Reads bytes that must be the canonical form of a JSON value: `not-json` when they are not UTF-8 JSON, `not-canonical`
+* when writing the value again gives other bytes.
+*/
+function readCanonicalJson(bytes) {
+	let value;
+	try {
+		value = JSON.parse(utf8Decode(bytes));
+	} catch (error) {
+		return {
+			ok: false,
+			reason: "not-json",
+			detail: error instanceof Error ? error.message : String(error)
+		};
+	}
+	let again;
+	try {
+		again = canonicalJsonBytes(value);
+	} catch (error) {
+		return {
+			ok: false,
+			reason: "not-canonical",
+			detail: error instanceof Error ? error.message : String(error)
+		};
+	}
+	if (!bytesEqual(again, bytes)) return {
+		ok: false,
+		reason: "not-canonical"
+	};
+	return {
+		ok: true,
+		value
+	};
+}
+//#endregion
+//#region ../core/src/appStatements.ts
+/** The prefixes of phase 1. The others of the WISP (reports, reviews, licences, rotation, publisher proofs) come later. */
+var APP_PREFIXES = {
+	app: "ghostly-app/1",
+	store: "ghostly-store/1",
+	revoke: "ghostly-revoke/1"
+};
+var APP_STATEMENT_LIMITS = {
+	/** A signature statement's canonical bytes: 52 + 86 characters of values and the keys around them. */
+	signatureBytes: 1024,
+	/** Digests named by one revocation. */
+	revokeDigests: 64,
+	/** A revocation's reason, in characters. */
+	reason: 200,
+	/** Revocations in one `ghostly-revoke.json`. */
+	revocations: 4096
+};
+/** A z-base32 Ed25519 public key: 52 characters that decode to 32 bytes and encode back to the same text. */
+function isAppKey(value) {
+	if (typeof value !== "string" || !/^[ybndrfg8ejkmcpqxot1uwisza345h769]{52}$/.test(value)) return false;
+	const bytes = fromZ32(value);
+	return bytes.length === 32 && toZ32(bytes) === value;
+}
+/** A SHA-256 in base64url without padding: 43 characters that decode to 32 bytes and encode back to the same text. */
+function isAppHash(value) {
+	if (typeof value !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(value)) return false;
+	return toBase64Url(fromBase64Url(value)) === value;
+}
+/** An app reference, `<publisher key>/<name>`. */
+var APP_NAME = /^[a-z][a-z0-9-]{0,31}$/;
+function isAppRef(value) {
+	if (typeof value !== "string") return false;
+	return value.indexOf("/") === 52 && isAppKey(value.slice(0, 52)) && APP_NAME.test(value.slice(53));
+}
+function appRef(publisher, name) {
+	return `${publisher}/${name}`;
+}
+/** The publisher key of a reference. */
+function appRefPublisher(ref) {
+	return ref.slice(0, 52);
+}
+/**
+* The publisher fingerprint people see: the first 16 z-base32 characters of the key (80 bits), in four groups.
+*/
+function appFingerprint(key) {
+	return (key.slice(0, 16).match(/.{1,4}/g) ?? []).join(" ");
+}
+/** The bytes a signature covers: the prefix, a zero byte, then the SHA-256 of the object's canonical bytes. */
+function appSignedBytes(prefix, canonical) {
+	const p = utf8Encode(prefix);
+	const out = new Uint8Array(p.length + 1 + 32);
+	out.set(p, 0);
+	out.set(sha256(canonical), p.length + 1);
+	return out;
+}
+/** Signs an object under a prefix: its canonical bytes and the signature statement. */
+async function signAppObject(prefix, value, signer) {
+	const bytes = canonicalJsonBytes(value);
+	const sig = await signer.sign(appSignedBytes(prefix, bytes));
+	return {
+		bytes,
+		signature: {
+			alg: "ed25519",
+			key: toZ32(signer.publicKey),
+			sig: toBase64Url(sig)
+		}
+	};
+}
+/**
+* Ed25519 verification as RFC 8032 writes it (`zip215: false`): canonical encodings of the point and the scalar only,
+* so every parser (this one, a Rust one with `verify_strict`) accepts exactly the same signatures.
+*/
+function strictVerify(signature, message, publicKey) {
+	try {
+		return ed25519.verify(signature, message, publicKey, { zip215: false });
+	} catch {
+		return false;
+	}
+}
+var exactKeys$1 = (value, keys, optional = []) => {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	const have = Object.keys(value);
+	return keys.every((k) => have.includes(k)) && have.every((k) => keys.includes(k) || optional.includes(k));
+};
+/** Checks the shape of a signature statement: exactly `alg`, `key` and `sig`, a 64-byte signature. */
+function isAppSignature(value) {
+	if (!exactKeys$1(value, [
+		"alg",
+		"key",
+		"sig"
+	])) return false;
+	if (value.alg !== "ed25519" || !isAppKey(value.key)) return false;
+	return typeof value.sig === "string" && /^[A-Za-z0-9_-]{86}$/.test(value.sig) && toBase64Url(fromBase64Url(value.sig)) === value.sig;
+}
+/** Reads a signature statement from its bytes, which must be canonical. */
+function readAppSignature(bytes) {
+	if (bytes.length > APP_STATEMENT_LIMITS.signatureBytes) return {
+		ok: false,
+		reason: "bad-signature-statement",
+		detail: "Too large"
+	};
+	const read = readCanonicalJson(bytes);
+	if (!read.ok) return {
+		ok: false,
+		reason: "bad-signature-statement",
+		detail: read.reason
+	};
+	if (!isAppSignature(read.value)) return {
+		ok: false,
+		reason: "bad-signature-statement",
+		detail: "Not {alg, key, sig}"
+	};
+	return {
+		ok: true,
+		signature: read.value
+	};
+}
+/**
+* Verifies a signature over an object's canonical bytes under a prefix, made by `key`: `signature-key` when the
+* statement names another key, `bad-signature` when it does not verify.
+*/
+function verifyAppSignature(prefix, canonical, signature, key) {
+	if (!isAppSignature(signature)) return {
+		ok: false,
+		reason: "bad-signature-statement"
+	};
+	if (signature.key !== key) return {
+		ok: false,
+		reason: "signature-key"
+	};
+	return strictVerify(fromBase64Url(signature.sig), appSignedBytes(prefix, canonical), fromZ32(key)) ? { ok: true } : {
+		ok: false,
+		reason: "bad-signature"
+	};
+}
+var isSequence = (v) => typeof v === "number" && Number.isSafeInteger(v) && v >= 1;
+var isPlainLine = (v, max) => typeof v === "string" && [...v].length <= max && !/\p{Cc}/u.test(v);
+/** Checks a revocation statement's shape; the reason it is refused, or null. */
+function checkAppRevokeStatement(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return "Not an object";
+	const v = value;
+	const byDigests = "digests" in v;
+	if (!exactKeys$1(v, [
+		"ghostlyRevoke",
+		"app",
+		byDigests ? "digests" : "upTo"
+	], ["reason"])) return "Keys are not ghostlyRevoke, app, and exactly one of digests and upTo (reason optional)";
+	if (v.ghostlyRevoke !== 1) return "ghostlyRevoke is not 1";
+	if (!isAppRef(v.app)) return "app is not a reference";
+	if (byDigests) {
+		const d = v.digests;
+		if (!Array.isArray(d) || d.length < 1 || d.length > APP_STATEMENT_LIMITS.revokeDigests) return "digests is not 1 to 64 digests";
+		if (!d.every(isAppHash) || new Set(d).size !== d.length) return "digests holds a bad or repeated digest";
+	} else if (!isSequence(v.upTo)) return "upTo is not a sequence";
+	if (v.reason !== void 0 && !isPlainLine(v.reason, APP_STATEMENT_LIMITS.reason)) return "reason is not one line of 200 characters";
+	return null;
+}
+/** Signs a revocation with the publisher's key. */
+async function signAppRevocation(statement, signer) {
+	const problem = checkAppRevokeStatement(statement);
+	if (problem) throw new Error(`Not a revocation: ${problem}`);
+	if (toZ32(signer.publicKey) !== appRefPublisher(statement.app)) throw new Error("A revocation is signed by its app's publisher");
+	const { signature } = await signAppObject(APP_PREFIXES.revoke, statement, signer);
+	return {
+		statement,
+		signature
+	};
+}
+/** What a checked revocation is kept by: the SHA-256 of its canonical bytes (statement and signature), base64url. */
+function appRevocationId(revocation) {
+	return toBase64Url(sha256(canonicalJsonBytes(revocation)));
+}
+/**
+* Reads one signed revocation (a parsed value, from `ghostly-revoke.json` or a store index's `revoked`): its shape, then
+* the signature under `ghostly-revoke/1` by the publisher its `app` names. One that `checked` holds verified before, so
+* its signature is not checked again; one that verifies now is added to it.
+*/
+function readAppRevocation(value, checked) {
+	const read = readAppRevocationShape(value);
+	if (!read.ok) return read;
+	const verified = verifyAppRevocation(read.revocation, checked);
+	return verified.ok ? read : verified;
+}
+/** The first half of `readAppRevocation`: the shape of a signed revocation, with no signature checked. */
+function readAppRevocationShape(value) {
+	if (!exactKeys$1(value, ["statement", "signature"])) return {
+		ok: false,
+		reason: "bad-revocation",
+		detail: "Keys are not statement and signature"
+	};
+	const problem = checkAppRevokeStatement(value.statement);
+	if (problem) return {
+		ok: false,
+		reason: "bad-revocation",
+		detail: problem
+	};
+	if (!isAppSignature(value.signature)) return {
+		ok: false,
+		reason: "bad-signature-statement"
+	};
+	return {
+		ok: true,
+		revocation: {
+			statement: value.statement,
+			signature: value.signature
+		}
+	};
+}
+/** The second half: the signature of a revocation of the right shape, unless `checked` holds it. */
+function verifyAppRevocation(revocation, checked) {
+	const id = checked && appRevocationId(revocation);
+	if (id !== void 0 && checked.has(id)) return { ok: true };
+	const verified = verifyAppSignature(APP_PREFIXES.revoke, canonicalJsonBytes(revocation.statement), revocation.signature, appRefPublisher(revocation.statement.app));
+	if (verified.ok && id !== void 0) checked.add(id);
+	return verified;
+}
+/**
+* Reads `ghostly-revoke.json`: canonical bytes holding a list of signed revocations. One that does not verify refuses the
+* file, as a store index's `revoked` does.
+*/
+function readAppRevocations(bytes) {
+	const read = readCanonicalJson(bytes);
+	if (!read.ok) return read;
+	if (!Array.isArray(read.value) || read.value.length > APP_STATEMENT_LIMITS.revocations) return {
+		ok: false,
+		reason: "bad-revocation",
+		detail: "Not a list of at most 4096 revocations"
+	};
+	const revocations = [];
+	for (const entry of read.value) {
+		const one = readAppRevocation(entry);
+		if (!one.ok) return one;
+		revocations.push(one.revocation);
+	}
+	return {
+		ok: true,
+		revocations
+	};
+}
+//#endregion
+//#region ../core/src/messageTime.ts
+/**
+* How far ahead of this device's clock a number a peer made from its clock may be (a pin's number, a status card's
+* times): clocks drift, but a time past this is the peer's choice, not its clock.
+*/
+var MESSAGE_CLOCK_SKEW_MS = 3e5;
+/**
+* The time a line of a group's history is kept under (a membership change, a rename): what its commit says, but at
+* most `MESSAGE_CLOCK_SKEW_MS` past this clock, and now when it is not a positive number. Messages do not use it:
+* they are placed where they arrive (below).
+*/
+function receivedTimestamp(ts, now = Date.now()) {
+	if (!Number.isFinite(ts) || ts <= 0) return now;
+	return Math.min(ts, now + MESSAGE_CLOCK_SKEW_MS);
+}
+/** The latest moment a date can hold. */
+var MAX_DATE_MS = 864e13;
+/** The time a sender says, as it is kept: a positive time a date can hold, or nothing. */
+function claimedTime(ts) {
+	return typeof ts === "number" && Number.isFinite(ts) && ts > 0 && ts <= MAX_DATE_MS ? ts : void 0;
+}
+/**
+* The place of a row stored now: this clock, and past the last place given in its chat, so rows that come in the
+* same millisecond (a hold pickup, a group's catch-up) keep the order they came in.
+*/
+function arrivalKey(now, last = 0) {
+	return Math.max(now, last + 1);
+}
+/** The time a message shows: what its sender said, never later than when it came. A row of mine shows its own time. */
+function shownTime(message) {
+	return message.sentAt === void 0 ? message.timestamp : Math.min(message.sentAt, message.timestamp);
+}
+/**
+* When something a peer dated happened (an edit), for this device: what the peer says, now at the latest, and now
+* when it says nothing a date can hold.
+*/
+function heardTime(ts, now = Date.now()) {
+	return Math.min(claimedTime(ts) ?? now, now);
+}
+//#endregion
+//#region ../core/src/statusCards.ts
+var STATUS_CARD_LIMITS = {
+	/** A card's JSON, as sent (UTF-8 bytes): with the fallback text it stays well inside every message bound. */
+	bytes: 8192,
+	/** The sender's id for the card: stable across its updates. */
+	id: 64,
+	title: 120,
+	/** The current step, a list item, a run's summary. */
+	line: 200,
+	branch: 120,
+	schedule: 80,
+	cron: 64,
+	linkLabel: 40,
+	url: 512,
+	items: 20,
+	links: 4,
+	runs: 10,
+	/** Any count on a card (a PR's number, lines, files; steps). */
+	count: 1e9,
+	/** How far ahead a routine's next run may be. */
+	nextRunMs: 316224e5,
+	/** Edits a message with a card takes (a text takes `MAX_EDITS_PER_MESSAGE`): a bot updates a long task often. */
+	edits: 5e3,
+	/** Labels on a task, and a label's length in characters. */
+	tags: 3,
+	tag: 24,
+	/** Buttons on a message (WISP 406 · Message Buttons). */
+	buttons: 6,
+	/** A button's id: what a press names. */
+	buttonId: 32,
+	/** A button's label, in characters. */
+	buttonLabel: 40,
+	/** An app card's title and version, in characters (WISP 405 § An app): the manifest's bounds. */
+	appTitle: 40,
+	appVersion: 32,
+	/** A usage card's label ("Claude") and account, in characters (WISP 405 § Usage). */
+	usageLabel: 24,
+	/** A usage window's name ("5 h", "week"), in characters. */
+	usageWindow: 16,
+	/** Windows beside a usage card's own, shown in its details. */
+	usageWindows: 3
+};
+/** How a button looks: `primary` is the one highlighted, `danger` warns; `neutral` when none is said. */
+var BUTTON_STYLES = [
+	"primary",
+	"neutral",
+	"danger"
+];
+var TASK_STATUSES = [
+	"queued",
+	"running",
+	"blocked",
+	"done",
+	"failed",
+	"cancelled"
+];
+/** A task that is still going: shown first, and counted on the chat's Tasks button. */
+var ACTIVE_TASK_STATUSES = [
+	"queued",
+	"running",
+	"blocked"
+];
+var ITEM_STATES = [
+	"pending",
+	"running",
+	"done",
+	"failed",
+	"skipped"
+];
+var ROUTINE_STATES = ["active", "paused"];
+var RUN_RESULTS = [
+	"ok",
+	"failed",
+	"skipped"
+];
+/**
+* Where a task's pull request stands: `draft` (not ready for review), `open` (ready for review), `merged`, `closed`
+* (closed without a merge). A reader that does not know the field shows the pull request as before.
+*/
+var PR_STATES = [
+	"draft",
+	"open",
+	"merged",
+	"closed"
+];
+/** How a pull request's checks stand. */
+var PR_CHECKS = [
+	"passing",
+	"failing",
+	"pending"
+];
+var ID$4 = /^[A-Za-z0-9_.:][A-Za-z0-9_.:-]{0,63}$/;
+/** A button's id: 1 to 32 of `A-Z a-z 0-9 _ . : -`, not starting with `-`. */
+var BUTTON_ID = /^[A-Za-z0-9_.:][A-Za-z0-9_.:-]{0,31}$/;
+var CRON = /^[0-9A-Za-z*,/?#\- ]{1,64}$/;
+/**
+* Whether a typed answer is a button's label or id (WISP 406 · Message Buttons): ignoring case and spaces at the ends.
+* Not the device's locale's case: the presser's and the author's apps must agree ("I" is not "ı" anywhere).
+*/
+var sameButtonText = (a, b) => a.trim().toLowerCase() === b.trim().toLowerCase();
+/**
+* Two buttons a typed answer could not tell apart, or none: a label that reads as an earlier label (`label`), or a
+* label that reads as another button's id (`id`), both as `sameButtonText` compares them. The labels as a reader keeps
+* them (one line, cleaned). `at` is the button that clashes, `with` the one it clashes with.
+*/
+function buttonLabelClash(buttons) {
+	const labels = buttons.map((button) => isObject$4(button) ? cardLine(button.label, Infinity) : void 0);
+	const ids = buttons.map((button) => isObject$4(button) && typeof button.id === "string" ? button.id : void 0);
+	for (const [at, label] of labels.entries()) {
+		if (!label) continue;
+		const twin = labels.findIndex((other, i) => i < at && !!other && sameButtonText(other, label));
+		if (twin !== -1) return {
+			at,
+			with: twin,
+			kind: "label"
+		};
+		const named = ids.findIndex((id, i) => i !== at && id !== void 0 && sameButtonText(id, label));
+		if (named !== -1) return {
+			at,
+			with: named,
+			kind: "id"
+		};
+	}
+}
+/** An app card's id, made from its reference: the app's name, a dot, the first 16 characters of the publisher key. */
+function appCardId(ref) {
+	return `${ref.slice(53)}.${ref.slice(0, 16)}`;
+}
+/** An app card's `sequence`: a whole number from 0 to 2^53 - 1. */
+var appSequence = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+var isObject$4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/** One line of display text: runs of space (line breaks included) become one space, then the display rules for names. */
+function cardLine(value, max) {
+	if (typeof value !== "string") return void 0;
+	return sanitizeDisplayText(value.replace(/\s+/gu, " "), max);
+}
+/**
+* An https link a card may show: no credentials, a host, no spaces or control characters, at most
+* `STATUS_CARD_LIMITS.url` characters. Returned as the parser writes it (a non-ASCII host in punycode).
+*/
+function cardUrl(value) {
+	if (typeof value !== "string" || !value || value.length > STATUS_CARD_LIMITS.url || /[\s\p{Cc}\p{Cf}]/u.test(value)) return void 0;
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		return;
+	}
+	if (url.protocol !== "https:" || !url.hostname || url.username || url.password) return void 0;
+	return url.href.length <= STATUS_CARD_LIMITS.url ? url.href : void 0;
+}
+var count = (value, min = 0) => typeof value === "number" && Number.isSafeInteger(value) && value >= min && value <= STATUS_CARD_LIMITS.count ? value : void 0;
+/** A time on a card as a reader keeps it: a positive whole number, never later than `latest`. */
+var time = (value, latest) => typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? Math.min(value, latest) : void 0;
+var oneOf = (values, value) => typeof value === "string" && values.includes(value) ? value : void 0;
+function readLinks(raw) {
+	if (!Array.isArray(raw)) return [];
+	const links = [];
+	for (const entry of raw.slice(0, STATUS_CARD_LIMITS.links)) {
+		if (!isObject$4(entry)) continue;
+		const url = cardUrl(entry.url);
+		if (!url) continue;
+		const label = cardLine(entry.label, STATUS_CARD_LIMITS.linkLabel);
+		links.push({
+			url,
+			...label && { label }
+		});
+	}
+	return links;
+}
+/** A task's labels as a reader keeps them: the first `STATUS_CARD_LIMITS.tags` that hold, each one clean line, none twice. */
+function readTags(raw) {
+	if (!Array.isArray(raw)) return [];
+	const tags = [];
+	for (const entry of raw) {
+		const tag = cardLine(entry, STATUS_CARD_LIMITS.tag);
+		if (tag && !tags.includes(tag)) tags.push(tag);
+		if (tags.length === STATUS_CARD_LIMITS.tags) break;
+	}
+	return tags;
+}
+function readRun(raw, now) {
+	if (!isObject$4(raw)) return void 0;
+	const at = time(raw.at, now + MESSAGE_CLOCK_SKEW_MS), result = oneOf(RUN_RESULTS, raw.result);
+	if (!at || !result) return void 0;
+	const summary = cardLine(raw.summary, STATUS_CARD_LIMITS.line);
+	return {
+		at,
+		result,
+		...summary && { summary }
+	};
+}
+/** A percent as a reader keeps it: a finite number, rounded and clamped into 0 to 100. */
+var percent = (value) => typeof value === "number" && Number.isFinite(value) ? Math.round(Math.min(100, Math.max(0, value))) : void 0;
+/** A time ahead of the reader (a reset, a next run) as it keeps it: whole, positive, at most a year ahead. */
+var ahead = (value, now) => typeof value === "number" && Number.isSafeInteger(value) && value > 0 && value <= now + STATUS_CARD_LIMITS.nextRunMs ? value : void 0;
+/** A usage card as a reader keeps it (WISP 405 § Usage): dropped without a percent left or a used of limit. */
+function readUsage(raw, id, now) {
+	const left = percent(raw.left);
+	let used = count(raw.used), limit = count(raw.limit, 1);
+	if (used === void 0 || limit === void 0 || used > limit) used = limit = void 0;
+	if (left === void 0 && limit === void 0) return void 0;
+	const label = cardLine(raw.label, STATUS_CARD_LIMITS.usageLabel), account = cardLine(raw.account, STATUS_CARD_LIMITS.usageLabel);
+	const window = cardLine(raw.window, STATUS_CARD_LIMITS.usageWindow);
+	const resetsAt = ahead(raw.resetsAt, now), updatedAt = time(raw.updatedAt, now + MESSAGE_CLOCK_SKEW_MS);
+	const windows = [];
+	if (Array.isArray(raw.windows)) for (const entry of raw.windows.slice(0, STATUS_CARD_LIMITS.usageWindows)) {
+		if (!isObject$4(entry)) continue;
+		const name = cardLine(entry.window, STATUS_CARD_LIMITS.usageWindow), share = percent(entry.left);
+		if (!name || share === void 0) continue;
+		const at = ahead(entry.resetsAt, now);
+		windows.push({
+			window: name,
+			left: share,
+			...at && { resetsAt: at }
+		});
+	}
+	return {
+		kind: "usage",
+		id,
+		...left !== void 0 && { left },
+		...used !== void 0 && limit !== void 0 && {
+			used,
+			limit
+		},
+		...label && { label },
+		...account && { account },
+		...window && { window },
+		...resetsAt && { resetsAt },
+		...updatedAt && { updatedAt },
+		...windows.length && { windows }
+	};
+}
+/** How much of a usage card's quota is left, 0 to 100: its own percent, else worked out from used of limit. */
+function usageLeft(card) {
+	if (card.left !== void 0) return card.left;
+	return card.used !== void 0 && card.limit ? Math.round((card.limit - card.used) / card.limit * 100) : 0;
+}
+/** The bytes a card takes on the wire: what `STATUS_CARD_LIMITS.bytes` bounds. */
+function statusCardBytes(card) {
+	try {
+		return utf8Encode(JSON.stringify(card) ?? "").length;
+	} catch {
+		return Infinity;
+	}
+}
+/**
+* A card as a reader takes it from the wire (`sc`), or undefined when it cannot stand: not an object, past
+* `STATUS_CARD_LIMITS.bytes`, a kind this app does not know, no valid id, title or name, status or state. Fields that do
+* not hold are left out and lists are cut to their bound; times are kept no later than the reader's clock allows (a
+* routine's next run up to a year ahead). The message is always kept: without a card it shows its text.
 */
-var OWN_FRAME_LIMIT = 2 ** 32 - 2 ** 23;
+function readStatusCard(raw, now = Date.now()) {
+	if (!isObject$4(raw) || statusCardBytes(raw) > STATUS_CARD_LIMITS.bytes) return void 0;
+	const id = typeof raw.id === "string" && ID$4.test(raw.id) ? raw.id : void 0;
+	if (!id) return void 0;
+	if (raw.kind === "app") {
+		if (!isAppRef(raw.ref) || id !== appCardId(raw.ref) || !isAppHash(raw.digest) || !appSequence(raw.sequence)) return void 0;
+		const title = cardLine(raw.title, STATUS_CARD_LIMITS.appTitle);
+		if (!title) return void 0;
+		const version = cardLine(raw.version, STATUS_CARD_LIMITS.appVersion), url = cardUrl(raw.url);
+		return {
+			kind: "app",
+			id,
+			ref: raw.ref,
+			digest: raw.digest,
+			sequence: raw.sequence,
+			title,
+			...version && { version },
+			...url && { url },
+			...raw.opened === true && { opened: true }
+		};
+	}
+	const latest = now + MESSAGE_CLOCK_SKEW_MS;
+	if (raw.kind === "usage") return readUsage(raw, id, now);
+	const links = readLinks(raw.links);
+	if (raw.kind === "task") {
+		const title = cardLine(raw.title, STATUS_CARD_LIMITS.title), status = oneOf(TASK_STATUSES, raw.status);
+		if (!title || !status) return void 0;
+		const progress = typeof raw.progress === "number" && Number.isFinite(raw.progress) ? Math.round(Math.min(100, Math.max(0, raw.progress))) : void 0;
+		let done = count(raw.done), total = count(raw.total, 1);
+		if (done === void 0 || total === void 0 || done > total) done = total = void 0;
+		const step = cardLine(raw.step, STATUS_CARD_LIMITS.line), branch = cardLine(raw.branch, STATUS_CARD_LIMITS.branch);
+		let pr;
+		if (isObject$4(raw.pr)) {
+			const url = cardUrl(raw.pr.url);
+			if (url) {
+				const number = count(raw.pr.number, 1), additions = count(raw.pr.additions), deletions = count(raw.pr.deletions), files = count(raw.pr.files);
+				const state = oneOf(PR_STATES, raw.pr.state), checks = oneOf(PR_CHECKS, raw.pr.checks);
+				pr = {
+					url,
+					...number !== void 0 && { number },
+					...additions !== void 0 && { additions },
+					...deletions !== void 0 && { deletions },
+					...files !== void 0 && { files },
+					...state && { state },
+					...checks && { checks }
+				};
+			}
+		}
+		const items = [];
+		if (Array.isArray(raw.items)) for (const entry of raw.items.slice(0, STATUS_CARD_LIMITS.items)) {
+			if (!isObject$4(entry)) continue;
+			const text = cardLine(entry.text, STATUS_CARD_LIMITS.line);
+			if (text) items.push({
+				text,
+				state: oneOf(ITEM_STATES, entry.state) ?? "pending"
+			});
+		}
+		const startedAt = time(raw.startedAt, latest), updatedAt = time(raw.updatedAt, latest);
+		const tags = readTags(raw.tags);
+		const parent = typeof raw.parent === "string" && ID$4.test(raw.parent) && raw.parent !== id ? raw.parent : void 0;
+		return {
+			kind: "task",
+			id,
+			title,
+			status,
+			...progress !== void 0 && { progress },
+			...done !== void 0 && total !== void 0 && {
+				done,
+				total
+			},
+			...step && { step },
+			...pr && { pr },
+			...branch && { branch },
+			...startedAt && { startedAt },
+			...updatedAt && { updatedAt },
+			...items.length && { items },
+			...links.length && { links },
+			...tags.length && { tags },
+			...parent && { parent }
+		};
+	}
+	if (raw.kind === "routine") {
+		const name = cardLine(raw.name, STATUS_CARD_LIMITS.title), schedule = cardLine(raw.schedule, STATUS_CARD_LIMITS.schedule), state = oneOf(ROUTINE_STATES, raw.state);
+		if (!name || !schedule || !state) return void 0;
+		const cron = typeof raw.cron === "string" && CRON.test(raw.cron.trim()) ? raw.cron.trim() : void 0;
+		const lastRun = readRun(raw.lastRun, now);
+		const nextRunAt = typeof raw.nextRunAt === "number" && Number.isSafeInteger(raw.nextRunAt) && raw.nextRunAt > 0 && raw.nextRunAt <= now + STATUS_CARD_LIMITS.nextRunMs ? raw.nextRunAt : void 0;
+		const runs = [];
+		if (Array.isArray(raw.runs)) for (const entry of raw.runs.slice(0, STATUS_CARD_LIMITS.runs)) {
+			const run = readRun(entry, now);
+			if (run) runs.push(run);
+		}
+		return {
+			kind: "routine",
+			id,
+			name,
+			schedule,
+			state,
+			...cron && { cron },
+			...lastRun && { lastRun },
+			...nextRunAt && { nextRunAt },
+			...runs.length && { runs },
+			...links.length && { links }
+		};
+	}
+	if (raw.kind === "buttons") {
+		if (!Array.isArray(raw.buttons)) return void 0;
+		const buttons = [], seen = /* @__PURE__ */ new Set();
+		for (const entry of raw.buttons.slice(0, STATUS_CARD_LIMITS.buttons)) {
+			if (!isObject$4(entry) || typeof entry.id !== "string" || !BUTTON_ID.test(entry.id) || seen.has(entry.id)) continue;
+			const label = cardLine(entry.label, STATUS_CARD_LIMITS.buttonLabel);
+			if (!label) continue;
+			seen.add(entry.id);
+			const style = oneOf(BUTTON_STYLES, entry.style);
+			buttons.push({
+				id: entry.id,
+				label,
+				...style && style !== "neutral" && { style },
+				...entry.once === true && { once: true }
+			});
+		}
+		if (!buttons.length) return void 0;
+		const chosen = typeof raw.chosen === "string" && seen.has(raw.chosen) ? raw.chosen : void 0;
+		return {
+			kind: "buttons",
+			id,
+			buttons,
+			...chosen && { chosen },
+			...raw.closed === true && { closed: true }
+		};
+	}
+}
 /**
-* Frames said again (WISP 902, both profiles): a member's own frames that no edge took when it said them are
-* remembered (`kept`, the latest) and, once the chain it follows is newer than such a frame's and has not moved for
-* `settledMs`, looked at once for saying again where the members let in while it was behind can read them. A catch-up
-* brings commits one by one, and a frame said again at the first of them would still miss those let in by the next.
+* A card as a sender may send it, or why not: the reader's rule, but anything it would leave out or cut is refused
+* here instead (an unknown status, a link that is not https, a list past its bound, a line too long), so a bot learns
+* at once and nothing it said is lost on the way. Line breaks and invisible characters are cleaned, as a reader would.
 */
-var SAID_AGAIN = {
-	settledMs: 5e3,
-	kept: 64
+function checkStatusCard(raw, now = Date.now()) {
+	if (!isObject$4(raw)) return { error: "A card is an object" };
+	const bytes = statusCardBytes(raw);
+	if (bytes > STATUS_CARD_LIMITS.bytes) return { error: `The card takes ${bytes} bytes; at most ${STATUS_CARD_LIMITS.bytes}` };
+	if (raw.kind !== "task" && raw.kind !== "routine" && raw.kind !== "buttons" && raw.kind !== "app" && raw.kind !== "usage") return { error: "kind is task, routine, buttons, app or usage" };
+	if (typeof raw.id !== "string" || !ID$4.test(raw.id)) return { error: `id is 1 to ${STATUS_CARD_LIMITS.id} of A-Z a-z 0-9 _ . : - and does not start with -` };
+	const line = (field, value, max, required = false) => {
+		if (value === void 0 && !required) return null;
+		if (typeof value !== "string" || !cardLine(value, Infinity)) return `${field} is text`;
+		if ([...cardLine(value, Infinity)].length > max) return `${field} is at most ${max} characters`;
+		return null;
+	};
+	const url = (field, value) => cardUrl(value) ? null : `${field} must be an https link of at most ${STATUS_CARD_LIMITS.url} characters`;
+	const whole = (field, value, min = 0) => value === void 0 || count(value, min) !== void 0 ? null : `${field} is a whole number from ${min}`;
+	const errors = [];
+	if (raw.links !== void 0) {
+		if (!Array.isArray(raw.links) || raw.links.length > STATUS_CARD_LIMITS.links) errors.push(`links is a list of at most ${STATUS_CARD_LIMITS.links}`);
+		else for (const [i, link] of raw.links.entries()) {
+			if (!isObject$4(link)) {
+				errors.push(`links[${i}] is an object`);
+				continue;
+			}
+			errors.push(url(`links[${i}].url`, link.url), line(`links[${i}].label`, link.label, STATUS_CARD_LIMITS.linkLabel));
+		}
+	}
+	const share = (field, value) => value === void 0 || typeof value === "number" && Number.isFinite(value) && value >= 0 && value <= 100 ? null : `${field} is a number from 0 to 100`;
+	const reset = (field, value) => value === void 0 || ahead(value, now) !== void 0 ? null : `${field} is a time in milliseconds, within a year`;
+	if (raw.kind === "usage") {
+		if (raw.links !== void 0) errors.push("a usage card takes no links");
+		if (raw.left === void 0 && raw.used === void 0) errors.push("left (a percent) or used and limit");
+		errors.push(share("left", raw.left));
+		if (raw.used === void 0 !== (raw.limit === void 0)) errors.push("used and limit go together");
+		else if (raw.used !== void 0) {
+			errors.push(whole("used", raw.used), whole("limit", raw.limit, 1));
+			if (typeof raw.used === "number" && typeof raw.limit === "number" && raw.used > raw.limit) errors.push("used is at most limit");
+		}
+		errors.push(line("label", raw.label, STATUS_CARD_LIMITS.usageLabel), line("account", raw.account, STATUS_CARD_LIMITS.usageLabel), line("window", raw.window, STATUS_CARD_LIMITS.usageWindow), reset("resetsAt", raw.resetsAt));
+		if (raw.updatedAt !== void 0 && !(typeof raw.updatedAt === "number" && Number.isSafeInteger(raw.updatedAt) && raw.updatedAt > 0 && raw.updatedAt <= now + 3e5)) errors.push("updatedAt is a time in milliseconds, not in the future");
+		if (raw.windows !== void 0) {
+			if (!Array.isArray(raw.windows) || raw.windows.length > STATUS_CARD_LIMITS.usageWindows) errors.push(`windows is a list of at most ${STATUS_CARD_LIMITS.usageWindows}`);
+			else for (const [i, entry] of raw.windows.entries()) {
+				if (!isObject$4(entry)) {
+					errors.push(`windows[${i}] is an object`);
+					continue;
+				}
+				errors.push(line(`windows[${i}].window`, entry.window, STATUS_CARD_LIMITS.usageWindow, true));
+				errors.push(entry.left === void 0 ? `windows[${i}].left is a number from 0 to 100` : share(`windows[${i}].left`, entry.left), reset(`windows[${i}].resetsAt`, entry.resetsAt));
+			}
+		}
+	} else if (raw.kind === "app") {
+		if (raw.links !== void 0) errors.push("an app card takes no links");
+		if (!isAppRef(raw.ref)) errors.push("ref is <publisher key in z-base32>/<name>");
+		else if (raw.id !== appCardId(raw.ref)) errors.push(`id is ${appCardId(raw.ref)}, made from ref`);
+		if (!isAppHash(raw.digest)) errors.push("digest is a SHA-256 in base64url without padding");
+		if (!appSequence(raw.sequence)) errors.push("sequence is a whole number from 0 to 2^53 - 1");
+		errors.push(line("title", raw.title, STATUS_CARD_LIMITS.appTitle, true), line("version", raw.version, STATUS_CARD_LIMITS.appVersion));
+		if (raw.url !== void 0) errors.push(url("url", raw.url));
+		if (raw.opened !== void 0 && raw.opened !== true) errors.push("opened is true or left out");
+	} else if (raw.kind === "buttons") {
+		if (raw.links !== void 0) errors.push("buttons take no links");
+		if (!Array.isArray(raw.buttons) || !raw.buttons.length || raw.buttons.length > STATUS_CARD_LIMITS.buttons) errors.push(`buttons is a list of 1 to ${STATUS_CARD_LIMITS.buttons}`);
+		else {
+			const ids = /* @__PURE__ */ new Set();
+			for (const [i, button] of raw.buttons.entries()) {
+				if (!isObject$4(button)) {
+					errors.push(`buttons[${i}] is an object`);
+					continue;
+				}
+				if (typeof button.id !== "string" || !BUTTON_ID.test(button.id)) errors.push(`buttons[${i}].id is 1 to ${STATUS_CARD_LIMITS.buttonId} of A-Z a-z 0-9 _ . : - and does not start with -`);
+				else if (ids.has(button.id)) errors.push(`buttons[${i}].id "${button.id}" is used twice`);
+				else ids.add(button.id);
+				errors.push(line(`buttons[${i}].label`, button.label, STATUS_CARD_LIMITS.buttonLabel, true));
+				if (button.style !== void 0 && !oneOf(BUTTON_STYLES, button.style)) errors.push(`buttons[${i}].style is one of ${BUTTON_STYLES.join(", ")}`);
+				if (button.once !== void 0 && button.once !== true) errors.push(`buttons[${i}].once is true or left out`);
+			}
+			const clash = buttonLabelClash(raw.buttons);
+			if (clash) errors.push(`buttons[${clash.at}].label ${JSON.stringify(cardLine(raw.buttons[clash.at].label, Infinity))} ${clash.kind === "label" ? `repeats buttons[${clash.with}].label` : `is buttons[${clash.with}].id`} (ignoring case and spaces at the ends)`);
+			if (raw.chosen !== void 0 && !(typeof raw.chosen === "string" && ids.has(raw.chosen))) errors.push("chosen names one of the buttons");
+		}
+		if (raw.closed !== void 0 && raw.closed !== true) errors.push("closed is true or left out");
+	} else if (raw.kind === "task") {
+		errors.push(line("title", raw.title, STATUS_CARD_LIMITS.title, true));
+		if (!oneOf(TASK_STATUSES, raw.status)) errors.push(`status is one of ${TASK_STATUSES.join(", ")}`);
+		if (raw.progress !== void 0 && !(typeof raw.progress === "number" && Number.isFinite(raw.progress) && raw.progress >= 0 && raw.progress <= 100)) errors.push("progress is a number from 0 to 100");
+		if (raw.done === void 0 !== (raw.total === void 0)) errors.push("done and total go together");
+		else if (raw.done !== void 0) {
+			errors.push(whole("done", raw.done), whole("total", raw.total, 1));
+			if (typeof raw.done === "number" && typeof raw.total === "number" && raw.done > raw.total) errors.push("done is at most total");
+		}
+		errors.push(line("step", raw.step, STATUS_CARD_LIMITS.line), line("branch", raw.branch, STATUS_CARD_LIMITS.branch));
+		if (raw.pr !== void 0) {
+			if (!isObject$4(raw.pr)) errors.push("pr is an object");
+			else {
+				errors.push(url("pr.url", raw.pr.url), whole("pr.number", raw.pr.number, 1), whole("pr.additions", raw.pr.additions), whole("pr.deletions", raw.pr.deletions), whole("pr.files", raw.pr.files));
+				if (raw.pr.state !== void 0 && !oneOf(PR_STATES, raw.pr.state)) errors.push(`pr.state is one of ${PR_STATES.join(", ")}`);
+				if (raw.pr.checks !== void 0 && !oneOf(PR_CHECKS, raw.pr.checks)) errors.push(`pr.checks is one of ${PR_CHECKS.join(", ")}`);
+			}
+		}
+		if (raw.tags !== void 0) {
+			if (!Array.isArray(raw.tags) || raw.tags.length > STATUS_CARD_LIMITS.tags) errors.push(`tags is a list of at most ${STATUS_CARD_LIMITS.tags}`);
+			else {
+				const seen = /* @__PURE__ */ new Set();
+				for (const [i, tag] of raw.tags.entries()) {
+					const problem = line(`tags[${i}]`, tag, STATUS_CARD_LIMITS.tag, true);
+					errors.push(problem);
+					if (problem) continue;
+					const clean = cardLine(tag, Infinity);
+					if (seen.has(clean)) errors.push(`tags[${i}] ${JSON.stringify(clean)} is there twice`);
+					seen.add(clean);
+				}
+			}
+		}
+		if (raw.parent !== void 0) {
+			if (typeof raw.parent !== "string" || !ID$4.test(raw.parent)) errors.push(`parent is another task's id: 1 to ${STATUS_CARD_LIMITS.id} of A-Z a-z 0-9 _ . : - and does not start with -`);
+			else if (raw.parent === raw.id) errors.push("parent is another task's id, not its own");
+		}
+		for (const field of ["startedAt", "updatedAt"]) {
+			const value = raw[field];
+			if (value !== void 0 && !(typeof value === "number" && Number.isSafeInteger(value) && value > 0 && value <= now + 3e5)) errors.push(`${field} is a time in milliseconds, not in the future`);
+		}
+		if (raw.items !== void 0) {
+			if (!Array.isArray(raw.items) || raw.items.length > STATUS_CARD_LIMITS.items) errors.push(`items is a list of at most ${STATUS_CARD_LIMITS.items}`);
+			else for (const [i, item] of raw.items.entries()) {
+				if (!isObject$4(item)) {
+					errors.push(`items[${i}] is an object`);
+					continue;
+				}
+				errors.push(line(`items[${i}].text`, item.text, STATUS_CARD_LIMITS.line, true));
+				if (item.state !== void 0 && !oneOf(ITEM_STATES, item.state)) errors.push(`items[${i}].state is one of ${ITEM_STATES.join(", ")}`);
+			}
+		}
+	} else {
+		errors.push(line("name", raw.name, STATUS_CARD_LIMITS.title, true), line("schedule", raw.schedule, STATUS_CARD_LIMITS.schedule, true));
+		if (!oneOf(ROUTINE_STATES, raw.state)) errors.push(`state is one of ${ROUTINE_STATES.join(", ")}`);
+		if (raw.cron !== void 0 && !(typeof raw.cron === "string" && CRON.test(raw.cron.trim()))) errors.push(`cron is a cron line of at most ${STATUS_CARD_LIMITS.cron} characters`);
+		if (raw.nextRunAt !== void 0 && !(typeof raw.nextRunAt === "number" && Number.isSafeInteger(raw.nextRunAt) && raw.nextRunAt > 0 && raw.nextRunAt <= now + STATUS_CARD_LIMITS.nextRunMs)) errors.push("nextRunAt is a time in milliseconds, within a year");
+		const run = (field, value) => {
+			if (!isObject$4(value)) return errors.push(`${field} is an object`);
+			if (!(typeof value.at === "number" && Number.isSafeInteger(value.at) && value.at > 0 && value.at <= now + 3e5)) errors.push(`${field}.at is a time in milliseconds, not in the future`);
+			if (!oneOf(RUN_RESULTS, value.result)) errors.push(`${field}.result is one of ${RUN_RESULTS.join(", ")}`);
+			errors.push(line(`${field}.summary`, value.summary, STATUS_CARD_LIMITS.line));
+		};
+		if (raw.lastRun !== void 0) run("lastRun", raw.lastRun);
+		if (raw.runs !== void 0) {
+			if (!Array.isArray(raw.runs) || raw.runs.length > STATUS_CARD_LIMITS.runs) errors.push(`runs is a list of at most ${STATUS_CARD_LIMITS.runs}`);
+			else raw.runs.forEach((entry, i) => run(`runs[${i}]`, entry));
+		}
+	}
+	const error = errors.find((e) => typeof e === "string");
+	if (error) return { error };
+	const card = readStatusCard(raw, now);
+	return card ? { card } : { error: "The card does not hold" };
+}
+/** The progress a task shows, 0 to 100: its own, else its steps done of total; undefined when it says neither. */
+function taskProgress(card) {
+	if (card.progress !== void 0) return card.progress;
+	return card.done !== void 0 && card.total ? Math.round(card.done / card.total * 100) : void 0;
+}
+var TASK_MARK = {
+	queued: "⏳",
+	running: "🔄",
+	blocked: "⛔",
+	done: "✅",
+	failed: "❌",
+	cancelled: "🚫"
 };
-/** `alone` with `key` added last, keeping only keys still `present` (frames still in the log), the latest `kept`. */
-function rememberAlone(alone, key, present) {
-	return [...(alone ?? []).filter((k) => k !== key && present(k)), key].slice(-SAID_AGAIN.kept);
+var STATUS_WORD = {
+	queued: "Queued",
+	running: "Running",
+	blocked: "Blocked",
+	done: "Done",
+	failed: "Failed",
+	cancelled: "Cancelled"
+};
+var RESULT_WORD = {
+	ok: "ok",
+	failed: "failed",
+	skipped: "skipped"
+};
+/** A time as the fallback text says it: in UTC, to the minute ("2026-09-30 01:00 UTC"). */
+function cardTimeUtc(ms) {
+	return `${new Date(ms).toISOString().slice(0, 16).replace("T", " ")} UTC`;
+}
+/**
+* The text a card's message carries: what an app without cards shows, the DHT floor carries, the chat list previews
+* and search finds. Plain lines, the first naming the card, no bars or layout that would read badly elsewhere.
+*/
+function statusCardText(card) {
+	if (card.kind === "app") {
+		const named = `${card.title}${card.version ? ` ${card.version}` : ""}`;
+		return [card.opened ? `🧩 Opened ${named} in this chat (Ghostly app)` : `🧩 ${named} (Ghostly app)`, ...card.url ? [card.url] : []].join("\n");
+	}
+	if (card.kind === "usage") {
+		const left = `${usageLeft(card)}% left${card.window ? ` (${card.window})` : ""}`;
+		return [
+			`📊 ${card.label ?? "Usage"}`,
+			...card.account ? [card.account] : [],
+			left,
+			...card.used !== void 0 && card.limit !== void 0 ? [`${card.used} of ${card.limit} used`] : [],
+			...card.resetsAt ? [`resets ${cardTimeUtc(card.resetsAt)}`] : [],
+			...(card.windows ?? []).map((w) => `${w.window} ${w.left}%`)
+		].join(" · ");
+	}
+	if (card.kind === "buttons") return `Reply: ${card.buttons.map((b) => b.label).join(" / ")}`;
+	if (card.kind === "task") {
+		const progress = taskProgress(card);
+		const state = [
+			STATUS_WORD[card.status],
+			...progress !== void 0 ? [`${progress}%`] : [],
+			...card.done !== void 0 && card.total ? [`${card.done} of ${card.total} steps`] : []
+		].join(" · ");
+		const standing = card.pr && [...card.pr.state ? [card.pr.state] : [], ...card.pr.checks ? [`checks ${card.pr.checks}`] : []].join(", ");
+		const pr = card.pr && [
+			`PR${card.pr.number !== void 0 ? ` #${card.pr.number}` : ""}`,
+			...card.pr.additions !== void 0 || card.pr.deletions !== void 0 ? [`+${card.pr.additions ?? 0} -${card.pr.deletions ?? 0}`] : [],
+			...standing ? [`(${standing})`] : []
+		].join(" ") + `: ${card.pr.url}`;
+		const now = card.step && ACTIVE_TASK_STATUSES.includes(card.status) ? [`Now: ${card.step}`] : [];
+		return [
+			`${TASK_MARK[card.status]} ${card.title}`,
+			state,
+			...now,
+			...pr ? [pr] : [],
+			...card.tags?.length ? [`Tags: ${card.tags.join(", ")}`] : [],
+			...card.parent ? [`Part of: ${card.parent}`] : []
+		].join("\n");
+	}
+	const last = card.lastRun && `Last run: ${RESULT_WORD[card.lastRun.result]}, ${cardTimeUtc(card.lastRun.at)}${card.lastRun.summary ? ` · ${card.lastRun.summary}` : ""}`;
+	return [
+		`🔁 ${card.name}`,
+		`${card.schedule} · ${card.state === "active" ? "active" : "paused"}`,
+		...last ? [last] : [],
+		...card.nextRunAt && card.state === "active" ? [`Next run: ${cardTimeUtc(card.nextRunAt)}`] : []
+	].join("\n");
+}
+/** Whether a message's edit number holds: a text's bound, or a card message's when the edit carries a card. */
+function cardEditNumber(e) {
+	return Number.isSafeInteger(e) && e >= 1 && e <= STATUS_CARD_LIMITS.edits;
 }
-var GROUP_ADMIN_OFF_ERROR = "Managing this group is off on this device. Turn on Manage groups from this device first.";
 //#endregion
 //#region ../core/src/replies.ts
 var REPLY_LIMITS = {
@@ -6840,8 +8319,7 @@ var INLINE_PICTURE = /^data:image\//i;
 */
 function replySnippet(text) {
 	if (INLINE_PICTURE.test(text.trimStart())) return "🖼️ Picture";
-	const flat = text.slice(0, REPLY_LIMITS.raw * 2).replace(/\s+/gu, " ");
-	const clean = sanitizeDisplayText(flat, REPLY_LIMITS.snippet + 1) ?? "";
+	const clean = sanitizeDisplayText(text.slice(0, REPLY_LIMITS.raw * 2).replace(/\s+/gu, " "), REPLY_LIMITS.snippet + 1) ?? "";
 	const points = [...clean];
 	return points.length > REPLY_LIMITS.snippet ? `${points.slice(0, REPLY_LIMITS.snippet - 1).join("").trimEnd()}…` : clean;
 }
@@ -7217,7 +8695,7 @@ function previewImageSize(value) {
 	if (binary.length > LINK_PREVIEW_LIMITS.imageBytes) return;
 	const bytes = new Uint8Array(binary.length);
 	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
-	return jpegSize(bytes);
+	return jpegSize$1(bytes);
 }
 /** The thumbnail if it is one Ghostly shows: a JPEG data URL within the limits whose header declares a sane size. */
 function sanitizePreviewImage(value) {
@@ -7378,6 +8856,485 @@ var RateWindow = class {
 	}
 };
 //#endregion
+//#region ../core/src/image.ts
+var IMAGE_LIMITS = {
+	/** Pixels on either side: the most a JPEG can say, well past what anyone sends as a picture. */
+	maxEdge: 65535,
+	/** How much of a file is read for its size: past a JPEG's EXIF, thumbnails and colour profile. */
+	headBytes: 262144
+};
+/** Whether a file is a picture, by its type. */
+function isImageMime(mime) {
+	return mime.split(";")[0].trim().toLowerCase().startsWith("image/");
+}
+var edge = (n) => typeof n === "number" && Number.isSafeInteger(n) && n > 0 && n <= IMAGE_LIMITS.maxEdge;
+/** A peer's `image` description, or undefined when it is not one. It never refuses the file. */
+function parseImageMeta(value, mime) {
+	if (mime !== void 0 && !isImageMime(mime)) return void 0;
+	if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+	const { width, height } = value;
+	return edge(width) && edge(height) ? {
+		width,
+		height
+	} : void 0;
+}
+var u16be = (b, at) => b[at] << 8 | b[at + 1];
+var u16le = (b, at) => b[at] | b[at + 1] << 8;
+var u24le = (b, at) => b[at] | b[at + 1] << 8 | b[at + 2] << 16;
+var u32be = (b, at) => (b[at] << 24 >>> 0) + (b[at + 1] << 16) + (b[at + 2] << 8) + b[at + 3];
+var ascii = (b, at, text) => [...text].every((c, i) => b[at + i] === c.charCodeAt(0));
+var sized = (width, height) => edge(width) && edge(height) ? {
+	width,
+	height
+} : void 0;
+/** SOFn markers: every frame type but DHT (C4), JPG (C8) and DAC (CC). */
+var JPEG_FRAME = /* @__PURE__ */ new Set([
+	192,
+	193,
+	194,
+	195,
+	197,
+	198,
+	199,
+	201,
+	202,
+	203,
+	205,
+	206,
+	207
+]);
+/** The EXIF orientation in an APP1 segment's TIFF block (1 when it says none). */
+function exifOrientation(b, tiff, end) {
+	if (tiff + 8 > end) return 1;
+	const little = ascii(b, tiff, "II");
+	if (!little && !ascii(b, tiff, "MM")) return 1;
+	const u16 = (at) => little ? u16le(b, at) : u16be(b, at);
+	const u32 = (at) => little ? u16le(b, at) + u16le(b, at + 2) * 65536 : u32be(b, at);
+	if (u16(tiff + 2) !== 42) return 1;
+	const ifd = tiff + u32(tiff + 4);
+	if (ifd + 2 > end) return 1;
+	const count = u16(ifd);
+	for (let i = 0; i < count; i++) {
+		const entry = ifd + 2 + i * 12;
+		if (entry + 12 > end) return 1;
+		if (u16(entry) === 274) {
+			const value = u16(entry + 8);
+			return value >= 1 && value <= 8 ? value : 1;
+		}
+	}
+	return 1;
+}
+function jpegSize(b) {
+	let at = 2, orientation = 1;
+	while (at + 4 <= b.length) {
+		if (b[at] !== 255) return void 0;
+		const marker = b[at + 1];
+		if (marker === 255) {
+			at++;
+			continue;
+		}
+		if (marker === 1 || marker >= 208 && marker <= 215) {
+			at += 2;
+			continue;
+		}
+		if (marker === 217 || marker === 218) return void 0;
+		const length = u16be(b, at + 2);
+		if (length < 2) return void 0;
+		const end = Math.min(b.length, at + 2 + length);
+		if (marker === 225 && ascii(b, at + 4, "Exif\0\0")) orientation = exifOrientation(b, at + 10, end);
+		if (JPEG_FRAME.has(marker)) {
+			if (at + 9 > b.length) return void 0;
+			const height = u16be(b, at + 5), width = u16be(b, at + 7);
+			return orientation >= 5 ? sized(height, width) : sized(width, height);
+		}
+		at += 2 + length;
+	}
+}
+function webpSize(b) {
+	if (b.length < 30) return void 0;
+	if (ascii(b, 12, "VP8 ")) {
+		if (b[23] !== 157 || b[24] !== 1 || b[25] !== 42) return void 0;
+		return sized(u16le(b, 26) & 16383, u16le(b, 28) & 16383);
+	}
+	if (ascii(b, 12, "VP8L")) {
+		if (b[20] !== 47) return void 0;
+		const bits = b[21] | b[22] << 8 | b[23] << 16 | b[24] << 24;
+		return sized((bits & 16383) + 1, (bits >>> 14 & 16383) + 1);
+	}
+	if (ascii(b, 12, "VP8X")) return sized(u24le(b, 24) + 1, u24le(b, 27) + 1);
+}
+/**
+* A picture's size as it is shown, read from its first bytes (PNG, JPEG, GIF, WebP), or undefined when they do not
+* say. Only the header is read: a JPEG whose frame header sits past `IMAGE_LIMITS.headBytes` goes without.
+*/
+function imageSize(head) {
+	const b = head;
+	try {
+		if (b.length >= 24 && b[0] === 137 && ascii(b, 1, "PNG\r\n\n") && ascii(b, 12, "IHDR")) return sized(u32be(b, 16), u32be(b, 20));
+		if (b.length >= 10 && (ascii(b, 0, "GIF87a") || ascii(b, 0, "GIF89a"))) return sized(u16le(b, 6), u16le(b, 8));
+		if (b.length >= 4 && b[0] === 255 && b[1] === 216 && b[2] === 255) return jpegSize(b);
+		if (b.length >= 16 && ascii(b, 0, "RIFF") && ascii(b, 8, "WEBP")) return webpSize(b);
+	} catch {}
+}
+/**
+* The description a picture is sent with, read from the start of the file, or undefined when it is not a picture
+* or its first bytes do not say (it then goes without one).
+*/
+async function readImageMeta(source, mime) {
+	if (!isImageMime(mime)) return void 0;
+	try {
+		return imageSize(new Uint8Array(await source.slice(0, IMAGE_LIMITS.headBytes).arrayBuffer()));
+	} catch {
+		return;
+	}
+}
+//#endregion
+//#region ../core/src/video.ts
+var VIDEO_LIMITS = {
+	/** The poster's bytes: with the rest of an offer, a frame stays far below the 60 KiB a session carries. */
+	maxPosterBytes: 12288,
+	/** The poster's longest side, in pixels, as the sender draws it. */
+	posterEdge: 320,
+	/** Ten hours: longer is a mistake, not a video. */
+	maxDurationMs: 36e6,
+	/** Pixels on either side (8K and a bit). */
+	maxEdge: 16384
+};
+/** Whether a file is a video, by its type: shown in a video bubble whether or not it came with a description. */
+function isVideoMime(mime) {
+	return mime.split(";")[0].trim().toLowerCase().startsWith("video/");
+}
+var BASE64URL = /^[A-Za-z0-9_-]+$/;
+var JPEG_START = [
+	255,
+	216,
+	255
+];
+/**
+* A peer's `video` description, or undefined when it is not one. It never refuses the file. A poster that is
+* too large, not a JPEG, or says it is more pixels than a sender draws (`posterEdge`) is dropped on its own; the
+* length and size are kept. It is shown before the file is accepted, so a few bytes must not ask for a huge bitmap.
+*/
+function parseVideoMeta(value, mime) {
+	if (mime !== void 0 && !isVideoMime(mime)) return void 0;
+	if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+	const { duration, width, height, poster } = value;
+	if (typeof duration !== "number" || !Number.isSafeInteger(duration) || duration <= 0 || duration > VIDEO_LIMITS.maxDurationMs) return void 0;
+	const edge = (n) => typeof n === "number" && Number.isSafeInteger(n) && n > 0 && n <= VIDEO_LIMITS.maxEdge;
+	if (!edge(width) || !edge(height)) return void 0;
+	const meta = {
+		duration,
+		width,
+		height
+	};
+	if (typeof poster === "string" && poster.length <= Math.ceil(VIDEO_LIMITS.maxPosterBytes * 4 / 3) && BASE64URL.test(poster)) try {
+		const bytes = fromBase64Url(poster);
+		const size = bytes.length <= VIDEO_LIMITS.maxPosterBytes && JPEG_START.every((b, i) => bytes[i] === b) ? imageSize(bytes) : void 0;
+		if (size && Math.max(size.width, size.height) <= VIDEO_LIMITS.posterEdge) meta.poster = poster;
+	} catch {}
+	return meta;
+}
+/** `0:07`, `12:45`, `1:02:03`: as a player shows a video's length. */
+function formatVideoDuration(ms) {
+	const total = Math.max(0, Math.floor((Number.isFinite(ms) ? ms : 0) / 1e3));
+	const hours = Math.floor(total / 3600), minutes = Math.floor(total % 3600 / 60), seconds = String(total % 60).padStart(2, "0");
+	return hours ? `${hours}:${String(minutes).padStart(2, "0")}:${seconds}` : `${minutes}:${seconds}`;
+}
+//#endregion
+//#region ../core/src/voice.ts
+var VOICE_LIMITS = {
+	/** Fifteen minutes: at the bitrate recorded (32 kbit/s) about 3.6 MB, well inside a held item's 8 MiB. */
+	maxDurationMs: 9e5,
+	/** Bars drawn for a recording. */
+	bars: 64,
+	/** Bars accepted from a peer. */
+	maxBars: 128,
+	/** Asked of the recorder; opus speech is clear well below it. */
+	audioBitsPerSecond: 32e3
+};
+/**
+* Audio a player may be handed as it is. None of these runs anything in the page's origin,
+* so received bytes of these types are served with their type (see `safeBlobType`).
+*/
+var PLAYABLE_AUDIO = /^audio\/(webm|ogg|opus|mp4|mpeg|mp3|aac|x-m4a|wav|x-wav|wave|flac|x-flac)$/;
+/** The part of a type before its parameters, in lower case: `audio/webm;codecs=opus` → `audio/webm`. */
+function baseMime(mime) {
+	return mime.split(";")[0].trim().toLowerCase();
+}
+/**
+* A peer's `voice` description, or undefined when it is not one. It never refuses the file:
+* a bad description only means the file is shown as a file.
+*/
+function parseVoiceMeta(value, mime) {
+	if (mime !== void 0 && !PLAYABLE_AUDIO.test(baseMime(mime))) return void 0;
+	if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+	const { duration, peaks } = value;
+	if (typeof duration !== "number" || !Number.isSafeInteger(duration) || duration <= 0 || duration > VOICE_LIMITS.maxDurationMs + 5e3) return void 0;
+	if (!Array.isArray(peaks) || peaks.length === 0 || peaks.length > VOICE_LIMITS.maxBars) return void 0;
+	if (!peaks.every((peak) => typeof peak === "number" && Number.isInteger(peak) && peak >= 0 && peak <= 255)) return void 0;
+	return {
+		duration,
+		peaks: [...peaks]
+	};
+}
+/**
+* How the level is metered while recording (apps/ui/src/lib/voiceRecorder.ts): every `intervalMs`, the RMS of the last
+* `window` samples an AnalyserNode holds (at a 48 kHz context, about 21 ms of sound).
+*/
+var VOICE_METER = {
+	intervalMs: 50,
+	window: 1024,
+	windowRate: 48e3
+};
+/** One reading of the meter, 0-1: the RMS of the samples, lifted because speech sits low on a linear scale. */
+function voiceLevel(samples) {
+	if (samples.length === 0) return 0;
+	let sum = 0;
+	for (let i = 0; i < samples.length; i++) sum += samples[i] * samples[i];
+	return Math.min(1, Math.sqrt(sum / samples.length) * 4);
+}
+/**
+* The readings the recorder would have taken of this sound (mono, -1 to 1), for a recording made elsewhere: one
+* every `intervalMs` of it, each over the window that ends there, as long in time as the analyser's.
+*/
+function voiceLevelsOf(mono, sampleRate) {
+	if (!(sampleRate > 0) || mono.length === 0) return [];
+	const window = Math.max(1, Math.round(VOICE_METER.window * sampleRate / VOICE_METER.windowRate));
+	const levels = [];
+	for (let step = 1;; step++) {
+		const end = Math.round(step * VOICE_METER.intervalMs * sampleRate / 1e3);
+		if (end > mono.length) break;
+		levels.push(voiceLevel(mono.subarray(Math.max(0, end - window), end)));
+	}
+	return levels;
+}
+/** The waveform sent with a recording made elsewhere, drawn as the recorder draws its own. */
+function voicePeaksOf(mono, sampleRate, bars = VOICE_LIMITS.bars) {
+	return downsamplePeaks(voiceLevelsOf(mono, sampleRate), bars);
+}
+/** Below this a recording is silence, and is drawn flat rather than stretched to fill the bars. */
+var QUIET = .02;
+/**
+* Bars from the loudness measured while recording (RMS, 0-1, oldest first): the loudest
+* sample of each stretch, scaled so the loudest bar is full height.
+*/
+function downsamplePeaks(levels, bars = VOICE_LIMITS.bars) {
+	const count = Math.max(1, Math.min(VOICE_LIMITS.maxBars, Math.floor(bars)));
+	const clean = Array.from(levels, (level) => Number.isFinite(level) ? Math.min(1, Math.max(0, level)) : 0);
+	if (clean.length === 0) return new Array(count).fill(0);
+	const loudest = Math.max(QUIET, ...clean);
+	const out = [];
+	for (let bar = 0; bar < count; bar++) {
+		const from = Math.floor(bar * clean.length / count);
+		const to = Math.max(from + 1, Math.floor((bar + 1) * clean.length / count));
+		let peak = 0;
+		for (let i = from; i < to && i < clean.length; i++) peak = Math.max(peak, clean[i]);
+		out.push(Math.round(peak / loudest * 255));
+	}
+	return out;
+}
+/** `0:07`, `12:45`: minutes and seconds, as a player shows them. */
+function formatVoiceDuration(ms) {
+	const total = Math.max(0, Math.floor((Number.isFinite(ms) ? ms : 0) / 1e3));
+	return `${Math.floor(total / 60)}:${String(total % 60).padStart(2, "0")}`;
+}
+/** The line a file message shows in the chat list and in notifications. */
+function fileMessageText(file) {
+	if (file.voice) return `🎤 Voice message (${formatVoiceDuration(file.voice.duration)})`;
+	if (file.video) return `🎬 Video (${formatVideoDuration(file.video.duration)})`;
+	return `📎 ${file.name}`;
+}
+//#endregion
+//#region ../core/src/files.ts
+var FILE_ID = /^[A-Za-z0-9_-]{8,64}$/;
+var MIME = /^[a-z0-9][a-z0-9!#$&^_.+-]{0,63}\/[a-z0-9][a-z0-9!#$&^_.+-]{0,63}$/i;
+var MAX_NAME_LENGTH = 200;
+/**
+* Invisible and direction-changing characters: bidi overrides turn
+* "invoice\u202Efdp.exe" into what reads as "invoiceexe.pdf", zero-width ones hide
+* text. Cf covers both; line and paragraph separators break the layout.
+*/
+var INVISIBLE = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu;
+/**
+* Names Windows keeps for devices, whatever the case, with any extension, and with spaces before the dot:
+* "CON", "nul.txt", "COM1 .log" open a device there, not a file.
+*/
+var WINDOWS_DEVICE = /^(CON|PRN|AUX|NUL|CONIN\$|CONOUT\$|COM[0-9¹²³]|LPT[0-9¹²³])\s*(\.|$)/i;
+/**
+* At most `MAX_NAME_LENGTH` characters. A longer name loses the end of its stem, not its extension (up to 15
+* characters after the last dot): "…report.pdf" stays a PDF to the system it is saved on.
+*/
+function shorten(name) {
+	const chars = [...name];
+	if (chars.length <= MAX_NAME_LENGTH) return name;
+	const extension = [.../\.[^.\s]{1,15}$/u.exec(name)?.[0] ?? ""];
+	return chars.slice(0, MAX_NAME_LENGTH - extension.length).join("").trimEnd() + extension.join("");
+}
+/** A file name is display text and a download suggestion, never a path. */
+function sanitizeFileName(name) {
+	const clean = shorten(name.replace(INVISIBLE, "").replace(/[/\\:]/g, "").replace(/^[\s.]+/, "").trim());
+	if (WINDOWS_DEVICE.test(clean)) return shorten("_" + clean);
+	return clean || "file";
+}
+function sanitizeMime(mime) {
+	return MIME.test(mime) ? mime.toLowerCase() : "application/octet-stream";
+}
+/** A size for people: B, KB, MB, GB, TB (powers of 1024), one decimal from KB up. */
+function formatFileSize(bytes) {
+	if (bytes < 1024) return `${bytes} B`;
+	const units = [
+		"KB",
+		"MB",
+		"GB",
+		"TB"
+	];
+	let value = bytes / 1024, unit = 0;
+	while (value >= 1024 && unit < units.length - 1) {
+		value /= 1024;
+		unit++;
+	}
+	return `${value.toFixed(1)} ${units[unit]}`;
+}
+var FileTransfers = class {
+	channel;
+	events;
+	nextStreamId = 1;
+	incoming = /* @__PURE__ */ new Map();
+	outgoing = /* @__PURE__ */ new Map();
+	constructor(channel, events) {
+		this.channel = channel;
+		this.events = events;
+	}
+	/** Streams a file to the peer. Resolves once every byte is handed to the channel. */
+	async send(file, source) {
+		if (file.size > LIMITS.maxFileBytes) throw new Error("File is too large");
+		const id = this.nextStreamId++;
+		const state = {
+			fileId: file.id,
+			cancelled: false
+		};
+		this.outgoing.set(id, state);
+		try {
+			this.channel.send(encodeControl({
+				t: "file",
+				id,
+				f: file.id,
+				ts: file.timestamp,
+				n: sanitizeFileName(file.name),
+				s: file.size,
+				m: sanitizeMime(file.mime)
+			}));
+			let sent = 0;
+			const counted = async function* () {
+				for await (const part of source) {
+					sent += part.length;
+					yield part;
+					this.events.onProgress?.(file.id, sent, "out");
+				}
+			}.call(this);
+			await sendBody(this.channel, CHUNK_KIND.fileBody, id, counted, () => state.cancelled);
+			if (state.cancelled) throw new Error("The peer refused the file");
+			if (sent !== file.size) throw new Error("File changed while it was being sent");
+			this.events.onComplete?.(file.id, "out");
+		} catch (error) {
+			if (!state.cancelled) try {
+				this.channel.send(encodeControl({
+					t: "rst",
+					id,
+					d: "f",
+					e: "aborted"
+				}));
+			} catch {}
+			this.events.onFailed?.(file.id, error instanceof Error ? error.message : String(error), "out");
+			throw error;
+		} finally {
+			this.outgoing.delete(id);
+		}
+	}
+	handleFile(frame) {
+		if (this.incoming.has(frame.id)) return;
+		const refuse = (reason) => {
+			try {
+				this.channel.send(encodeControl({
+					t: "rst",
+					id: frame.id,
+					d: "f",
+					e: reason
+				}));
+			} catch {}
+		};
+		if (!FILE_ID.test(frame.f)) return refuse("invalid file id");
+		if (frame.s > LIMITS.maxFileBytes) return refuse("file too large");
+		if (this.incoming.size >= LIMITS.maxIncomingFilesPerPeer) return refuse("too many transfers");
+		const file = {
+			id: frame.f,
+			name: sanitizeFileName(frame.n),
+			size: frame.s,
+			mime: sanitizeMime(frame.m),
+			timestamp: frame.ts
+		};
+		const sink = this.events.onIncoming(file);
+		if (!sink || typeof sink === "string") return refuse(sink || "refused");
+		const entry = {
+			file,
+			sink,
+			received: 0,
+			queue: Promise.resolve()
+		};
+		this.incoming.set(frame.id, entry);
+		this.armIdleTimer(frame.id, entry);
+	}
+	handleChunk(chunk) {
+		const entry = this.incoming.get(chunk.id);
+		if (!entry) return;
+		entry.received += chunk.payload.length;
+		if (entry.received > entry.file.size) return this.failIncoming(chunk.id, "more data than announced", true);
+		if (chunk.payload.length > 0) {
+			const payload = chunk.payload.slice();
+			entry.queue = entry.queue.then(() => entry.sink.write(payload));
+			this.events.onProgress?.(entry.file.id, entry.received, "in");
+		}
+		if (!chunk.end) return this.armIdleTimer(chunk.id, entry);
+		if (entry.received !== entry.file.size) return this.failIncoming(chunk.id, "incomplete file", false);
+		clearTimeout(entry.idleTimer);
+		this.incoming.delete(chunk.id);
+		entry.queue.then(() => entry.sink.close()).then(() => this.events.onComplete?.(entry.file.id, "in"), () => {
+			entry.sink.abort();
+			this.events.onFailed?.(entry.file.id, "could not store the file", "in");
+		});
+	}
+	handleReset(frame) {
+		if (this.incoming.has(frame.id)) this.failIncoming(frame.id, frame.e || "cancelled by the sender", false);
+		const sending = this.outgoing.get(frame.id);
+		if (sending) sending.cancelled = true;
+	}
+	/** The link went away: nothing in flight can finish. */
+	closeAll() {
+		for (const id of [...this.incoming.keys()]) this.failIncoming(id, "connection lost", false);
+		for (const sending of this.outgoing.values()) sending.cancelled = true;
+	}
+	armIdleTimer(id, entry) {
+		clearTimeout(entry.idleTimer);
+		entry.idleTimer = setTimeout(() => this.failIncoming(id, "transfer stalled", true), LIMITS.bodyIdleTimeoutMs);
+	}
+	failIncoming(id, reason, notifyPeer) {
+		const entry = this.incoming.get(id);
+		if (!entry) return;
+		clearTimeout(entry.idleTimer);
+		this.incoming.delete(id);
+		entry.sink.abort();
+		if (notifyPeer) try {
+			this.channel.send(encodeControl({
+				t: "rst",
+				id,
+				d: "f",
+				e: reason
+			}));
+		} catch {}
+		this.events.onFailed?.(entry.file.id, reason, "in");
+	}
+};
+//#endregion
 //#region ../core/src/dhtFiles.ts
 /**
 * A file's bubble on the DHT floor (WISP 403 § Files): while the contact is away, a file's offer (its name, size, type,
@@ -7617,6 +9574,14 @@ var DhtDelivery = class DhtDelivery {
 		};
 	}
 	/**
+	* This side joined, and its inviter never answered (`DhtDeliveryState.unanswered`): no envelope of its newer than the
+	* one that pinned it, none sealed to this side, no text confirmed, never live (as `sealedToAnother` asks too).
+	*/
+	get unanswered() {
+		const pinnedAt = this.state.unanswered;
+		return pinnedAt !== void 0 && this.state.peerSequence <= pinnedAt && !this.state.peerPinned && !this.state.confirmed && !this.state.wasLive && !this.live;
+	}
+	/**
 	* Something signed by a participation key other than the pinned one came in over the chat's invite-derived keys (this
 	* mailbox, the link's signals, a connection to an endpoint whose address a copy of the invite could read): ignored,
 	* and said in the view as a passive warning.
@@ -8325,6 +10290,7 @@ var DhtDelivery = class DhtDelivery {
 		}
 		if (message !== null && (!Array.isArray(message) || message.length !== 3 || typeof message[0] !== "string" || !ID$2.test(message[0]) || !Number.isSafeInteger(message[1]) || message[1] <= 0 || message[1] > issued + 3e4 || typeof message[2] !== "string" || utf8Encode(message[2]).length > 256 || expires - issued > 3e5)) return "none";
 		if (receipt !== null && (typeof receipt !== "string" || !ID$2.test(receipt))) return "none";
+		const unanswered = !this.options.credentials.peerKey && !!this.options.credentials.expectedPeerKey && !sender && !this.live;
 		await this.options.pin(author);
 		this.options.credentials.peerKey = author;
 		this.options.credentials.requireSignedSignals = true;
@@ -8375,6 +10341,7 @@ var DhtDelivery = class DhtDelivery {
 			receipt: nextReceipt,
 			confirmed,
 			...peerPinned && { peerPinned },
+			...unanswered && { unanswered: sequence },
 			pending: confirmed && this.state.pending?.message[0] === confirmed ? void 0 : this.state.pending,
 			...newest > (this.state.reactionsTaken ?? 0) && { reactionsTaken: newest }
 		});
@@ -8496,10 +10463,13 @@ var DhtDelivery = class DhtDelivery {
 		if (this.state.pending && this.state.pending.expires > now) return DHT_POLL_MS;
 		return this.active ? ACTIVE_DHT_POLL_MS : STREAM_POLL_MS;
 	}
-	/** How long ago this side's invite was made, while nobody used it and it is no longer awaited (`AWAITING_PEER_MS`). */
+	/**
+	* How long ago this side's invite was made (or joined), while nobody used it (or its inviter never answered,
+	* `unanswered`) and it is no longer awaited (`AWAITING_PEER_MS`).
+	*/
 	unusedInviteAge(now) {
 		const madeAt = this.options.inviteMadeAt;
-		if (madeAt === void 0 || this.options.credentials.peerKey || this.state.peerSequence) return void 0;
+		if (madeAt === void 0 || (this.options.credentials.peerKey || this.state.peerSequence) && !this.unanswered) return void 0;
 		const age = now - Math.min(madeAt, this.startedAt);
 		return age >= 6e5 ? age : void 0;
 	}
@@ -11631,6 +13601,8 @@ function readManifest(meta, loopback = false) {
 */
 var OFFER_EXTENSIONS = ["ping/1"];
 var MAX_HANDSHAKE_BYTES = 4096;
+/** One frame from the peer, at most (UTF-16 units for text, bytes for binary): a bigger one breaks the protocol. */
+var SESSION_FRAME_MAX = 61440;
 /**
 * Frames received and not handled yet, at most: their count and their size together. Frames are handled one at a time,
 * each awaited (a group frame is decrypted, checked and stored before the next), and the peer sends at the network's
@@ -11641,7 +13613,7 @@ var MAX_HANDSHAKE_BYTES = 4096;
 */
 var SESSION_RECEIVE_PENDING = {
 	frames: 1024,
-	bytes: 3932160
+	bytes: 64 * SESSION_FRAME_MAX
 };
 var KEY = /^[ybndrfg8ejkmcpqxot1uwisza345h769]{52}$/;
 var NONCE$1 = /^[A-Za-z0-9_-]{43}$/;
@@ -11992,6 +13964,9 @@ var PairedHttp = class {
 				return channel.bufferedAmount;
 			},
 			drained: () => channel.drained(),
+			get sendBudget() {
+				return channel.sendBudget;
+			},
 			close: () => {},
 			onMessage: null,
 			onClose: null
@@ -12491,8 +14466,7 @@ function vapidAuthorization(endpoint, keys, subject, now = Date.now()) {
 		exp: Math.floor(now / 1e3) + TOKEN_SECONDS,
 		sub: subject
 	})}`;
-	const signature = p256.sign(utf8Encode(unsigned), fromBase64Url(keys.privateKey));
-	return `vapid t=${unsigned}.${toBase64Url(signature)}, k=${keys.publicKey}`;
+	return `vapid t=${unsigned}.${toBase64Url(p256.sign(utf8Encode(unsigned), fromBase64Url(keys.privateKey)))}, k=${keys.publicKey}`;
 }
 /**
 * `plaintext` encrypted for a subscription (RFC 8291 with RFC 8188 `aes128gcm`, one record). `sender` fixes
@@ -12810,8 +14784,7 @@ var LINK_OR_MARKUP = /[a-z][a-z0-9+.-]*:\/\/|\bwww\.|\b(?:mailto|javascript|data
 */
 function sanitizeTypingStatus(value) {
 	if (typeof value !== "string") return void 0;
-	const oneLine = value.slice(0, 160).replace(/\s+/g, " ");
-	const clean = sanitizeDisplayText(oneLine, 40);
+	const clean = sanitizeDisplayText(value.slice(0, 160).replace(/\s+/g, " "), 40);
 	if (!clean || LINK_OR_MARKUP.test(clean)) return void 0;
 	return clean;
 }
@@ -13060,7 +15033,7 @@ var FILE_LIMITS = {
 	resendBytes: 268435456
 };
 var ID = /^[A-Za-z0-9_-]{8,64}$/;
-var DIGEST = /^[A-Za-z0-9_-]{43}$/;
+var DIGEST$1 = /^[A-Za-z0-9_-]{43}$/;
 var DATA = /^[A-Za-z0-9_-]+$/;
 var FILE_FRAMES = /* @__PURE__ */ new Set([
 	"pf-offer",
@@ -13913,7 +15886,7 @@ var ChatFiles = class {
 			return;
 		}
 		if (record.state !== "active" || incoming.verifying || !incoming.target) return;
-		if (frame.size !== record.file.size || typeof frame.digest !== "string" || !DIGEST.test(frame.digest)) return;
+		if (frame.size !== record.file.size || typeof frame.digest !== "string" || !DIGEST$1.test(frame.digest)) return;
 		const digest = frame.digest;
 		await incoming.writing;
 		if (transferEnded(record) || record.state !== "active") return;
@@ -14952,6 +16925,151 @@ var CarriedTransport = class {
 	}
 };
 //#endregion
+//#region ../core/src/groupFiles.ts
+/**
+* Files and voice messages in groups (WISP 503 · Group Files). A file is announced as a group message carrying its
+* description; its bytes go over `files/3` between two members, from a member that holds it to one that asks for it.
+* The limits below are the profile's first numbers, kept in one place so they are easy to change.
+*/
+var GROUP_FILE_LIMITS = {
+	/** The largest file a group takes. */
+	maxBytes: 104857600,
+	/** A file this size or smaller is fetched without asking, a voice message too (one recorded is well inside it). */
+	autoBytes: 8388608,
+	/** What a device keeps of a group's files it fetched without asking; past it, every file is asked about. */
+	autoBytesPerGroup: 268435456,
+	/** Bytes of group files a device serves to others in a day, when serving is on. */
+	serveBytesPerDay: 1073741824,
+	/** Transfers a holder serves at once, all groups together. */
+	serveAtOnce: 3,
+	/** File announcements a member sends to one group in a minute. */
+	announcePerMinute: 8,
+	/** File announcements of one member of a group fetched by themselves in `announceWindowMs`; past it, kept for a Download. */
+	announceTaken: 30,
+	announceWindowMs: 6e5,
+	/** Holders remembered per file. */
+	holders: 8,
+	/**
+	* Message ids a `group-have` named before their message came (a member back from away hears who holds what as its
+	* catch-up begins), remembered with their holders for when it does.
+	*/
+	heardAhead: 256,
+	/** Message ids in one `group-have`. */
+	haveIds: 32,
+	/**
+	* `group-have` frames a private group's edge takes in `haveWindowMs`: what is to say is gathered for a second, then
+	* goes. A community's, from a member, goes every `communityHaveEveryMs`.
+	*/
+	haveFrames: 10,
+	haveWindowMs: 1e4,
+	communityHaveEveryMs: 6e4,
+	/**
+	* How long a want waits for an offer before the next holder is asked; a transfer that does not move for as long is
+	* left for the next holder too.
+	*/
+	wantWaitMs: 3e4,
+	/**
+	* How long a served transfer with all its bytes confirmed waits for the member's word that its check passed once the
+	* member's next want has overtaken it.
+	*/
+	doneWaitMs: 5e3,
+	/** A file session closes this long after its last transfer ends. */
+	sessionIdleMs: 6e4,
+	/** File sessions opening at once, and open at once, all groups together. */
+	sessionsOpening: 2,
+	sessionsOpen: 4,
+	/** The longest file name and type kept from a description. */
+	nameChars: 255,
+	mimeChars: 255
+};
+/**
+* The frames of WISP 503 § Getting the bytes, on an edge between two apps that announced `GROUP_VERSION_FILES`:
+* `group-want {g, id}` asks a holder for the file of message `id`; `group-want-no {g, id, why}` is a holder's no;
+* `group-have {g, ids}` says which files a member keeps (in a community, an application frame `{t, ids}` instead).
+*/
+var GROUP_WANT_FRAME = "group-want";
+var GROUP_WANT_NO_FRAME = "group-want-no";
+var GROUP_HAVE_FRAME = "group-have";
+var REFUSALS = [
+	"gone",
+	"busy",
+	"refused"
+];
+/** A group message's id, as a private group (`<s>:<e>:<n>`) or a community (`<s>:<e>:<h>:<n>`) names it. */
+var MESSAGE_ID = /^[a-z0-9]{52}:\d{1,15}(:[A-Za-z0-9_-]{1,64})?:\d{1,15}$/;
+var isGroupMessageId = (value) => typeof value === "string" && MESSAGE_ID.test(value);
+function frameOf(value, t, groupId) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+	const f = value;
+	return f.t === t && (groupId === void 0 || f.g === groupId) ? f : null;
+}
+/** A `group-want` of group `groupId`: the message whose file is asked for, or null. */
+function readGroupWant(value, groupId) {
+	const f = frameOf(value, GROUP_WANT_FRAME, groupId);
+	return f && isGroupMessageId(f.id) ? { id: f.id } : null;
+}
+/** A holder's `group-want-no` of group `groupId`, or null. A reason this app does not know reads as `busy`. */
+function readGroupWantNo(value, groupId) {
+	const f = frameOf(value, GROUP_WANT_NO_FRAME, groupId);
+	if (!f || !isGroupMessageId(f.id)) return null;
+	return {
+		id: f.id,
+		why: typeof f.why === "string" && REFUSALS.includes(f.why) ? f.why : "busy"
+	};
+}
+/**
+* The message ids of a `group-have`: of group `groupId` on an edge, or (no `groupId`) a community's application frame.
+* At most `haveIds` message ids; a frame with more, or anything else, is null.
+*/
+function readGroupHave(value, groupId) {
+	const f = frameOf(value, GROUP_HAVE_FRAME, groupId);
+	if (!f || !Array.isArray(f.ids) || !f.ids.length || f.ids.length > GROUP_FILE_LIMITS.haveIds || !f.ids.every(isGroupMessageId)) return null;
+	return [...new Set(f.ids)];
+}
+var DIGEST = /^[A-Za-z0-9_-]{43}$/;
+/**
+* A description read from the wire, cleaned: the name made a display name (never a path), the type untrusted, the
+* size within the group limit, the digest the right shape. A malformed voice, video or picture description is dropped
+* on its own and the file is still a file; anything else malformed is no file at all (null), and the text shows.
+*/
+function readGroupFileMeta(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+	const v = value;
+	if (typeof v.name !== "string" || !v.name.trim() || [...v.name].length > GROUP_FILE_LIMITS.nameChars) return null;
+	if (typeof v.mime !== "string" || v.mime.length > GROUP_FILE_LIMITS.mimeChars) return null;
+	if (!Number.isSafeInteger(v.size) || v.size < 1 || v.size > GROUP_FILE_LIMITS.maxBytes) return null;
+	if (typeof v.d !== "string" || !DIGEST.test(v.d)) return null;
+	const mime = sanitizeMime(v.mime);
+	const voice = v.voice === void 0 ? void 0 : parseVoiceMeta(v.voice, mime);
+	const video = v.video === void 0 ? void 0 : parseVideoMeta(v.video, mime);
+	const image = v.image === void 0 ? void 0 : parseImageMeta(v.image, mime);
+	return {
+		name: sanitizeFileName(v.name),
+		mime,
+		size: v.size,
+		d: v.d,
+		...voice ? { voice } : {},
+		...video ? { video } : {},
+		...image ? { image } : {}
+	};
+}
+/**
+* The text an announcement carries when its author wrote no caption: what an app without group files shows instead
+* of the file. English, as wire text is; an app that knows the file shows the file, not this line.
+*/
+function groupFileFallback(file) {
+	if (file.voice) return `🎤 Voice message (${formatVoiceDuration(file.voice.duration)}): update Ghostly to hear it`;
+	return `${fileMessageText(file)} (${formatFileSize(file.size)}): update Ghostly to get files in groups`;
+}
+/**
+* Whether a device fetches a file by itself (WISP 503 § Automatic and asked downloads): up to `autoBytes` while what
+* it took that way from the group stays within `autoBytesPerGroup`. A voice message too: one recorded (15 minutes at
+* most, about 3.6 MB) always fits, and a bigger file the author called a voice message is asked about like any other.
+*/
+function fetchesByItself(file, keptAutomatically, limits = GROUP_FILE_LIMITS) {
+	return file.size <= limits.autoBytes && keptAutomatically + file.size <= limits.autoBytesPerGroup;
+}
+//#endregion
 //#region ../core/src/pairingProgress.ts
 var FIRST_STAGE = {
 	inviter: "publishing",
@@ -15393,6 +17511,12 @@ function filesCap(channel) {
 */
 var FILES_IN_USE_MS = 2e3;
 /**
+* How far an app's data may get ahead of a file's bytes while the file waits for room on the channel (WISP 1200 § In a
+* chat): a frame goes only while the app has sent less than this more than the file since. A small frame (a Chess move)
+* still goes at once; one streaming at its limit gets about half the link, and the file the other half.
+*/
+var APP_AHEAD_OF_FILES = 16384;
+/**
 * A `paired-message` frame. The preview (`pv`) is left out when the frame would pass `MAX_PAIRED_MESSAGE_FRAME`
 * with it: the text matters, the card does not. A reply (`r`, WISP 401 § Replies) is a few hundred bytes at most
 * and always goes, and so does a forwarded message's hop count (`fw`, WISP 401 § Forwards) and a status card (`sc`,
@@ -15422,6 +17546,16 @@ function pairedMessageFrame(id, ts, m, preview, reply, forwarded, card) {
 	});
 	return withPreview.length <= 57344 ? withPreview : plain;
 }
+/** A text whose `paired-message` frame would pass what a session takes: it never arrives, and is refused at send. */
+var PAIRED_FRAME_TOO_LARGE = "Message too long once encoded. Shorten it or send it as a file.";
+/**
+* The `paired-message` frame of this text fits a session (`SESSION_FRAME_MAX`, UTF-16 units of the JSON). Within 16 KiB
+* of UTF-8 a text can still pass it: JSON writes each control character as six (`\u0001`). The preview is left out,
+* as the frame drops one that does not fit.
+*/
+function pairedMessageFits(ts, m, reply, forwarded, card) {
+	return pairedMessageFrame("A".repeat(22), ts, m, void 0, reply, forwarded, card).length <= SESSION_FRAME_MAX;
+}
 /**
 * A native descriptor from the contact's capability record against the one known (a session's, or an older record's).
 * The record carries only how to dial, never an address: the Iroh endpoint id and the relay it is homed on, the
@@ -15740,7 +17874,9 @@ var GhostLink = class {
 			});
 			options.events?.onPairingProgress?.(progress);
 		}) : null;
-		const invite = options.pairingProgress?.role === "inviter" && !!options.pairing && !options.pairing.credentials.peerKey;
+		const invite = !!options.pairingProgress && !!options.pairing && !options.pairing.credentials.peerKey;
+		let unanswered = options.dht?.state?.unanswered !== void 0;
+		const backsOff = invite || unanswered;
 		this.dht = options.params.profile && options.pairing && options.dht ? new DhtDelivery({
 			params: options.params,
 			mode: this.deliveryMode,
@@ -15750,7 +17886,7 @@ var GhostLink = class {
 			save: options.dht.save,
 			pollMs: options.dht.pollMs,
 			firstControlAfterMs: options.dht.firstControlAfterMs,
-			...invite && { inviteMadeAt: options.madeAt ?? Date.now() },
+			...backsOff && { inviteMadeAt: options.madeAt ?? Date.now() },
 			capsRev: options.dht.capsRev,
 			peerCapsRev: options.dht.peerCapsRev,
 			peerAcceptsText: options.dht.peerAcceptsText,
@@ -15809,6 +17945,9 @@ var GhostLink = class {
 			},
 			changed: (view) => {
 				options.events?.onDhtDelivery?.(view);
+				const stillUnanswered = this.dht.unanswered;
+				if (unanswered && !stillUnanswered) this.session.lookNow();
+				unanswered = stillUnanswered;
 				if (view.inviteTaken) this.tracker?.failed("taken", false, INVITE_TAKEN);
 				else this.tracker?.untaken();
 				this.streamBlockChanged();
@@ -15837,7 +17976,7 @@ var GhostLink = class {
 			lastSeenTimestamp: options.lastSeenTimestamp,
 			pollIntervals: options.pollIntervals,
 			awaitingSince: options.madeAt,
-			...invite && { invite: () => !options.pairing.credentials.peerKey },
+			...backsOff && { invite: () => !options.pairing.credentials.peerKey || !!this.dht?.unanswered },
 			getServices: options.getServices,
 			firstPublish: options.firstPublish ?? (this.tracker && options.pairingProgress?.role === "joiner" && options.rtcAvailable !== false || this.resuming ? "after-first-poll" : "at-start"),
 			events: {
@@ -17372,9 +19511,30 @@ var GhostLink = class {
 			epoch,
 			rest
 		};
+		if (!this.peerTransports.includes("webrtc/1")) {
+			traceLink(this.myPubKeyZ32, "offer-unanswerable", { transports: rest });
+			this.clearRace();
+			this.raceTimer = setTimeout(() => {
+				this.raceTimer = null;
+				this.endUnanswerableOffer(epoch);
+			}, 0);
+			return;
+		}
 		traceLink(this.myPubKeyZ32, "race-standing", { transports: rest });
 		this.scheduleRace(epoch, made.at);
 	}
+	/** The offer ends (`raceStandingOffer`), and with it going idle what is ranked after WebRTC is dialled (`dialAfterRtc`). */
+	endUnanswerableOffer(epoch) {
+		if (epoch !== this.connectionEpoch || this.channel || this.stopped || !this.offerOut || this.afterRtc?.epoch !== epoch) return;
+		if (this.dialing) {
+			this.raceTimer = setTimeout(() => {
+				this.raceTimer = null;
+				this.endUnanswerableOffer(epoch);
+			}, RACE_RETRY_MS);
+			return;
+		}
+		this.dataLink.close();
+	}
 	/**
 	* Back after an absence, this side answers an offer the contact made while it was away (it dials whatever its key):
 	* the contact looks for that answer at the pace of an offer out a while (every 8 s on the relays), and its attempt may
@@ -17557,6 +19717,13 @@ var GhostLink = class {
 		this.attemptEnded();
 		this.rejectWaiters(new GhostlyHttpError("unreachable", "Could not connect to the peer"));
 	}
+	/**
+	* This side does not dial on its own: the contact's app does (the lower key), and none of what makes this side dial
+	* anyway holds (a first pairing's role, a restart, WebRTC set aside). Its own dial, chosen by hand, is not retried.
+	*/
+	awaitsContactDial() {
+		return !(!!this.tracker && !this.tracker.done && this.tracker.progress.stage !== "on-dht" ? this.options.pairingProgress?.role : void 0) && this.myPubKeyZ32 > this.options.params.peerPubKeyZ32 && !this.resuming && !this.dialsPastRtc();
+	}
 	/** A transport of the attempt under way did not connect. */
 	attemptFailed(transport, error) {
 		if (this.isDataLinkOpen) return;
@@ -17579,7 +19746,7 @@ var GhostLink = class {
 			side: attempt.side,
 			failed: attempt.failed,
 			...!attempt.failed.length && reason ? { reason } : {},
-			...attempt.side === "dialled" ? { retryAt: Math.max(Date.now(), this.lastAutoConnectAt + this.dialWait()) } : {}
+			...attempt.side === "dialled" && !this.awaitsContactDial() ? { retryAt: Math.max(Date.now(), this.lastAutoConnectAt + this.dialWait()) } : {}
 		};
 		traceLink(this.myPubKeyZ32, "attempt-ended", {
 			side: attempt.side,
@@ -17618,9 +19785,11 @@ var GhostLink = class {
 			if (this.pairedPending.size >= 128) this.pairedPending.delete(this.pairedPending.keys().next().value);
 			const id = stableId ?? toBase64Url(randomBytes(16));
 			if (!/^[A-Za-z0-9_-]{22}$/.test(id)) return "Invalid message ID";
+			const frame = pairedMessageFrame(id, timestamp, trimmed, preview, reply, forwarded, card);
+			if (frame.length > 61440) return PAIRED_FRAME_TOO_LARGE;
 			this.pairedPending.set(id, timestamp);
 			try {
-				this.channel.send(pairedMessageFrame(id, timestamp, trimmed, preview, reply, forwarded, card));
+				this.channel.send(frame);
 				return null;
 			} catch {
 				this.pairedPending.delete(id);
@@ -17786,14 +19955,13 @@ var GhostLink = class {
 			if (presence.lastPacketAt === this.departed.packet && Date.now() < this.departed.until) return;
 			this.departed = null;
 		}
-		const role = !!this.tracker && !this.tracker.done && this.tracker.progress.stage !== "on-dht" ? this.options.pairingProgress?.role : void 0;
-		if (role === "inviter") {
+		if ((!!this.tracker && !this.tracker.done && this.tracker.progress.stage !== "on-dht" ? this.options.pairingProgress?.role : void 0) === "inviter") {
 			this.peerSeenAt ||= Date.now();
 			if (Date.now() - this.peerSeenAt < 2500 && !this.nothingToAwait()) {
 				this.session.expectPeer();
 				return;
 			}
-		} else if (role !== "joiner" && this.myPubKeyZ32 > this.options.params.peerPubKeyZ32 && !this.resuming && !this.dialsPastRtc()) {
+		} else if (this.awaitsContactDial()) {
 			if (Date.now() - presenceSeenAt(presence) < 3e4 && presence.lastPacketAt !== this.offerAwaitedFor && !this.nothingToDialEitherWay()) {
 				this.offerAwaitedFor = presence.lastPacketAt;
 				this.session.expectPeer();
@@ -18339,23 +20507,30 @@ var GhostLink = class {
 	* kept to send later. While the channel already holds a quarter of what it may queue (its send budget, or the high
 	* water mark of a WebRTC channel), the frame is refused with `too-fast`, so the chat's messages and pings never wait
 	* behind an app's data on a link slower than it sends (WISP 1200 § In a chat). While a file goes, that quarter sits
-	* above what files may hold (`filesWritable`): files keep the channel at their own line for the whole transfer.
+	* above what files may hold (`filesWritable`): files keep the channel at their own line for the whole transfer. While
+	* the file waits for room, the app gets no further than `APP_AHEAD_OF_FILES` ahead of it, so it cannot refill the
+	* channel each time it drains to files' line and keep the file from moving.
 	*/
 	sendAppData(app, data) {
 		if (!this.apps.open.has(app)) return "not-open";
 		if (appDataBytes(data) > 32768) return "too-large";
 		if (!this.channel || !this.isDataLinkOpen) return "offline";
 		if (!this.supportsApps) return "peer-closed";
-		const files = this.filesUse?.channel === this.channel && (this.filesUse.waiting > 0 || Date.now() - this.filesUse.at < FILES_IN_USE_MS) ? filesCap(this.channel) : 0;
-		if (this.channel.bufferedAmount >= files + (this.channel.sendBudget ?? LIMITS.sendHighWaterMark) / 4) return "too-fast";
+		const use = this.filesUse?.channel === this.channel ? this.filesUse : null;
+		const files = use && (use.waiting > 0 || Date.now() - use.at < FILES_IN_USE_MS) ? use : null;
+		if (use && !files) use.appAhead = 0;
+		if (this.channel.bufferedAmount >= (files ? filesCap(this.channel) : 0) + (this.channel.sendBudget ?? LIMITS.sendHighWaterMark) / 4) return "too-fast";
+		if (files && files.waiting > 0 && files.appAhead >= APP_AHEAD_OF_FILES) return "too-fast";
 		const refused = this.apps.canSend(app, data);
 		if (refused) return refused;
+		const frame = JSON.stringify(appDataFrame(app, data));
 		try {
-			this.channel.send(JSON.stringify(appDataFrame(app, data)));
-			return null;
+			this.channel.send(frame);
 		} catch {
 			return "offline";
 		}
+		if (files) files.appAhead = Math.min(files.appAhead + frame.length, APP_AHEAD_OF_FILES + APP_DATA_MAX_BYTES);
+		return null;
 	}
 	/** What the contact had open is gone (`apps/1` is no longer agreed, or this link stopped): each app hears it now. */
 	appsEnded() {
@@ -18405,25 +20580,32 @@ var GhostLink = class {
 	sendFileData(id, offset, data) {
 		if (!this.supportsLargeFiles || !this.channel) return false;
 		try {
-			this.channel.send(this.supportsBinaryFiles ? encodeFileData(id, offset, data) : JSON.stringify({
+			const frame = this.supportsBinaryFiles ? encodeFileData(id, offset, data) : JSON.stringify({
 				t: "pf-data",
 				id,
 				offset,
 				data: toBase64Url(data)
-			}));
-			this.filesUsing(this.channel).at = Date.now();
+			});
+			this.channel.send(frame);
+			const use = this.filesUsing(this.channel);
+			use.at = Date.now();
+			use.appAhead = Math.max(0, use.appAhead - (typeof frame === "string" ? frame.length : frame.byteLength));
 			return true;
 		} catch {
 			return false;
 		}
 	}
-	/** Files on a channel: when they last wrote on it, and how many wait for room. An app's data gets room above theirs. */
+	/**
+	* Files on a channel: when they last wrote on it, how many wait for room, and how many bytes an app's data has sent
+	* on it beyond theirs since. An app's data gets room above theirs.
+	*/
 	filesUse = null;
 	filesUsing(channel) {
 		if (this.filesUse?.channel !== channel) this.filesUse = {
 			channel,
 			at: 0,
-			waiting: 0
+			waiting: 0,
+			appAhead: 0
 		};
 		return this.filesUse;
 	}
@@ -20131,6 +22313,10 @@ function parsePayParams(body, destination) {
 	if (body.tag !== "payRequest") throw new Error(`${destination.domain} answered with something other than a pay request${typeof body.tag === "string" ? ` (${reason(body.tag)})` : ""}`);
 	if (typeof body.callback !== "string") throw new Error("The pay request has no callback");
 	const callback = acceptUrl(body.callback);
+	if (callback.host !== new URL(destination.url).host) {
+		if (callback.protocol !== "https:") throw new Error("Lightning addresses and LNURLs must use HTTPS");
+		if (isLocalHost(callback.hostname)) throw new Error(`${destination.domain} asks for the invoice at a local address`);
+	}
 	const { minSendable, maxSendable, metadata, commentAllowed } = body;
 	if (!Number.isSafeInteger(minSendable) || !Number.isSafeInteger(maxSendable) || minSendable <= 0 || maxSendable < minSendable) throw new Error("The pay request has invalid amount limits");
 	const minSat = Math.ceil(minSendable / 1e3), maxSat = Math.floor(maxSendable / 1e3);
@@ -20549,6 +22735,8 @@ function assertTokenUnits(amount) {
 function assertWholeSats(amount) {
 	if (!Number.isSafeInteger(amount) || amount <= 0 || amount > 0x775f05a074000) throw new Error("Enter a positive whole amount in sats");
 }
+/** Arkade and Bark addresses are bech32m with `ark` on Bitcoin and `tark` on the test networks (one case only). */
+var arkAddressPrefix = (network) => network === "bitcoin" ? "ark1" : "tark1";
 function validatePaymentTarget(value, now = Date.now()) {
 	if (!value || typeof value !== "object") throw new Error("Invalid payment target");
 	const t = value;
@@ -20587,6 +22775,7 @@ function validatePaymentTarget(value, now = Date.now()) {
 		"regtest"
 	].includes(t.network)) throw new Error("Unsupported Bark network");
 	if (typeof t.address !== "string" || !t.address || t.address.length > 4096 || typeof t.provider !== "string" || t.provider.length > 512) throw new Error("Invalid payment destination");
+	if ((t.method === "arkade" || t.method === "bark") && (t.address !== t.address.toLowerCase() && t.address !== t.address.toUpperCase() || !t.address.toLowerCase().startsWith(arkAddressPrefix(t.network)))) throw new Error(`That is not an Ark address on ${t.network === "bitcoin" ? "Bitcoin" : t.network}`);
 	if (t.method !== "bitcoin" && t.method !== "fedimint" && t.method !== "spark") {
 		const url = new URL(t.provider);
 		if (url.username || url.password || url.search || url.hash || url.protocol !== "https:" && !(url.protocol === "http:" && [
@@ -25620,10 +27809,9 @@ function knockIdentity(link) {
 function knockRecords(link, knocks) {
 	const nonce = randomBytes(NONCE_LENGTH);
 	const body = utf8Encode(JSON.stringify(knocks.slice(-6).map((k) => [k.key, k.ts])));
-	const box = xchacha20poly1305(knockMaterial(link, "knock key"), nonce, utf8Encode(link.g)).encrypt(body);
 	return [{
 		label: KNOCK_LABEL,
-		value: toBase64Url(concatBytes$1(nonce, box))
+		value: toBase64Url(concatBytes$1(nonce, xchacha20poly1305(knockMaterial(link, "knock key"), nonce, utf8Encode(link.g)).encrypt(body)))
 	}];
 }
 /** Knocks that open with the link's key and are well formed; anything else is nobody. */
@@ -27245,8 +29433,13 @@ var CommunitySession = class {
 	messageIdOf(f) {
 		return f.s === this.myKey && this.resealedFrom.get(frameKey(f)) || communityMessageId(f.s, f.e, f.h, f.n);
 	}
-	/** Where I am and what I have, for the member at the other end of an edge that just opened. */
-	syncFrame() {
+	/**
+	* Where I am and what I have, for the member at the other end of an edge that just opened. `to`: that member, now
+	* asked: my answer to its own sync asks nothing more for a while. A second sync went, and its answer took the place of
+	* what was left of the first from its start: a member back after 256 messages was handed 288 (2026-10-14).
+	*/
+	syncFrame(to) {
+		if (to) this.asked.set(to, this.hooks.clock?.() ?? Date.now());
 		const have = {};
 		const recent = new Set(this.state.store.map((f) => seenKey(f.e, f.h)));
 		for (const [sender, byKey] of Object.entries(this.state.seen)) for (const [key, entry] of Object.entries(byKey)) {
@@ -28809,6 +31002,6 @@ function appStoreDecision(held, read) {
 	return read.digest === held.digest ? "same" : "equivocation";
 }
 //#endregion
-export { COMMUNITY_EDIT_FRAME as $, HANDOFF_HELLO as $a, EDIT_RATE_WINDOW_MS as $i, SIGNAL_REPLY_MS as $n, readEnrollGrant as $o, STATUS_CARD_CAPABILITY as $r, parseRelayPayload as $s, didDhtFromPublicKey as $t, CommunitySession as A, RELAY_POLL_INTERVALS as Aa, IdentityCheckUnavailable as Ai, pubkyProofPath as An, readHandoffHello as Ao, typingActivity as Ar, nextTurnPosition as As, verifyAtprotoRecordProof as At, knockRecords as B, callRtcConfig as Ba, PeerProofs as Bi, isFederationId as Bn, signTombstone as Bo, deviceWakeRequest as Br, RelayTransport as Bs, didWebDocumentUrl as Bt, sha256Paced as C, rosterHas as Ca, CapsExchange as Ci, PUBKY_PROOF_MAX_BYTES as Cn, handoffStreamKey as Co, FILE_LIMITS as Cr, TURN_RAISE_READ_TIMEOUT_MS as Cs, atprotoProofRkey as Ct, openGroupTyping as D, AWAITING_PEER_MS as Da, IDENTITY_MAX_EVIDENCE as Di, normalizePubkyKey as Dn, readHandoffCancel as Do, TYPING_REFRESH_MS as Dr, TURN_LAST_SEQUENCE as Ds, parseAtprotoDidDocument as Dt, groupTypingEpoch as E, DirectPathWatch as Ea, dialDescriptors as Ei, newPubkyProofFolder as En, readHandoffAck as Eo, TYPING_KINDS as Er, turnPutSummary as Es, normalizeAtprotoHandle as Et, KNOCK_TTL_MS as F, webLocalFetch as Fa, identityStatement as Fi, decodeBolt11 as Fn, SET_ACK as Fo, pinIsNewer as Fr, turnKeys as Fs, checkDidJws as Ft, groupWakeFrame as G, emptyLinkRecords as Ga, irohDescriptor as Gi, LIVENESS_PING_MS as Gn, ENROLL_PROOF as Go, checkPushEndpoint as Gr, budgetRetryMs as Gs, normalizeDid as Gt, readKnocks as H, extractParamsFromSdp as Ha, validExternalKey as Hi, parseFedimintRequestPayload as Hn, ENROLL_DONE as Ho, parseWakeFrame as Hr, normalizeRelayUrl as Hs, didWebFileNames as Ht, decodeGroupEntryLink as I, CALL_SIGNAL_MAX_AGE_MS as Ia, newIdentityBinding as Ii, ENDPOINT as In, SET_UPDATE as Io, pinNumberHolds as Ir, turnName as Is, checkDidSignature as It, GROUP_LIMITS as J, serviceIdFromName as Ja, DHT_MESSAGE_TTL as Ji, engineText as Jn, enrollDigits as Jo, chatAppId as Jr, PacketTooLargeError as Js, parseDidSignaturePaste as Jt, groupWakes as K, HTTP_SERVICE_PROTO as Ka, irohRelayUrl as Ki, pairedMessageFrame as Kn, enrollCancelFrame as Ko, vapidKeysMatch as Kr, isDiscoveryBudgetError as Ks, parseDid as Kt, encodeGroupEntryLink as L, RTC_CONFIG as La, receivedIdentityStatus as Li, cashuRequestPayload as Ln, readSetUpdate as Lo, readPin as Lr, turnStatedVerifier as Ls, didGhostlyServiceEntry as Lt, communityHasFrame as M, GhostlyHttpError as Ma, boundVerifiedIdentity as Mi, pubkyHomeserverOf as Mn, readHandoffTurnFrame as Mo, PIN_LIMITS as Mr, signTurnPacket as Ms, DID_FILE_MAX_BYTES as Mt, decodeCommunityLink as N, formatLocalTarget as Na, emptyIdentityLedger as Ni, requestLnurlInvoice as Nn, readHandoffVerified as No, mayPin as Nr, signTurnRelease as Ns, DID_JWS_MAX_LENGTH as Nt, sealGroupTyping as O, DHT_POLL_INTERVALS as Oa, IDENTITY_MAX_VALIDITY as Oi, pubkyProofCapability as On, readHandoffDone as Oo, TypingSender as Or, TURN_MAX as Os, shortAtprotoDid as Ot, encodeCommunityLink as P, parseLocalTarget as Pa, identityRevocationValue as Pi, resolveLightningDestination as Pn, sealHandoffPiece as Po, nextPinNumber as Pr, turnInstance as Ps, DidError as Pt, frameBytes as Q, HANDOFF_HAVE as Qa, EDIT_BUFFER_MS as Qi, SIGNAL_HOLD_MS as Qn, enrollProofFrame as Qo, EDIT_CAPABILITY as Qr, openRelayPayload as Qs, didDhtDocument as Qt, entryParams as R, answersOffer as Ra, revokesIdentity as Ri, fedimintRequestPayload as Rn, setAckFrame as Ro, WAKE_CALL_INTERVAL_MS as Rr, turnVerifierMark as Rs, didJwsAlg as Rt, readAppBundleAsync as S, commitHash as Sa, wellKnownUrl as Si, isBitcoinAddress as Sn, handoffRetryAfter as So, ChatFiles as Sr, TURN_PUT_WINDOW_MS as Ss, atprotoProofRecord as St, GroupTypingBoard as T, edgeParams as Ta, capsDescriptors as Ti, isPubkyProofFolder as Tn, newHandoffId as To, transferStalled as Tr, classifyTurnRead as Ts, isAtprotoDid as Tt, GROUP_WAKE_FRAME as U, parseCallSignal as Ua, TRANSPORTS as Ui, GhostLink as Un, ENROLL_GRANT as Uo, relayRequest as Ur, setLinkTraceSink as Us, didWebFileUrl as Ut, mergeKnocks as V, callSignalHeardAt as Va, emptyProofLedger as Vi, parseCashuRequestPayload as Vn, verifySetUpdate as Vo, newWakeToken as Vr, currentRelays as Vs, didWebFile as Vt, GroupWakeLimiter as W, signalHasVideo as Wa, automaticTransport as Wi, INVITE_TAKEN as Wn, ENROLL_HELLO as Wo, wakeRequest as Wr, traceLink as Ws, didWebHost as Wt, GROUP_READ_NOTE as X, HANDOFF_CANCEL as Xa, DHT_FILE_CAPABILITY as Xi, GROUP_SIGNAL_FRAME as Xn, enrollGrantFrame as Xo, APPS_CAPABILITY as Xr, createRelayPayload as Xs, staticDidDocument as Xt, GROUP_REACTED_FRAME as Y, HANDOFF_ACK as Ya, peekDhtMailbox as Yi, CarriedTransport as Yn, enrollDoneFrame as Yo, isAppVersion as Yr, RELAY_PAYLOAD_MAX_BYTES as Ys, signingKeys as Yt, GroupSession as Z, HANDOFF_DONE as Za, dhtFileId as Zi, SIGNAL_FRESH_MS as Zn, enrollHelloFrame as Zo, BUTTONS_CAPABILITY as Zr, newerPacket as Zs, strictBase64Url as Zt, assembleAppBundle as _, readReply as _a, normalizeDomain as _i, walletNetworkOf as _n, handoffHelloFrame as _o, rankHubs as _r, deviceLinkPairing as _s, ATPROTO_DECLARED_SCOPE as _t, planAppUpdate as a, COMMUNITY_REACTION_FRAME as aa, MAX_AVATAR_LENGTH as ac, HoldRefusedError as ai, EVM_TEST_CHAINS as an, HANDOFF_VERIFIED as ao, pickMeshHubs as ar, OwnInviteError as as, groupName as at, pacer as b, MAX_GROUP_CHAIN as ba, recordsName as bi, sparkAddressKind as bn, handoffPakeFrame as bo, readLobby as br, seedSigner as bs, ATPROTO_PROOF_SCOPE as bt, readAppStore as c, ReactionWindow as ca, readManifest as ci, SEPOLIA_TEST_USDT as cn, handoffAttemptFailed as co, beaconRecords as cr, encodeInviteCode as cs, SshSigError as ct, APP_BUNDLE_LIMITS as d, reactionEmoji as da, dnsProofName as di, USDT_PUBLIC_RPC as dn, handoffCancelFrame as do, lobbyKeys as dr, DEVICES_CAPABILITY as ds, sameSshKey as dt, RateWindow as ea, createIdentity as ec, UPGRADE_CAPABILITY as ei, encodeDidDhtDeactivated as en, HANDOFF_OFFER as eo, groupSignalFrame as er, readEnrollHello as es, GROUP_EDIT_FRAME as et, APP_BUNDLE_MAGIC as f, reactionIsNewer as fa, domainTxtRecord as fi, WALLET_NETWORKS as fn, handoffContext as fo, lobbyRecords as fr, ENROLL_CAPABILITY as fs, sshSignCommand as ft, appViewOf as g, pairedReplyAuthor as ga, nip05RootKey as gi, validatePaymentTarget as gn, handoffEphemeral as go, pickHubs as gr, deviceKeyZ32 as gs, decodeAnyBitcoinAddress as gt, appDigest as h, wireReaction as ha, isPublicAddress as hi, formatPaymentAmount as hn, handoffDigest as ho, newerHead as hr, deviceEchoNonce as hs, BitcoinAddressError as ht, checkAppBeforeRun as i, readForwarded as ia, verify as ic, HoldKeys as ii, ETHEREUM_USDT as in, HANDOFF_TIMINGS as io, meshHubs as ir, readDeviceInvite as is, mentionsMember as it, GROUP_READ_NOTE_COMMUNITY as j, presenceSeenAt as ja, IdentityExchange as ji, homeserverWebEndpoint as jn, readHandoffPake as jo, GROUP_PIN_FRAME as jr, readTurnPacket as js, DID_DOCUMENT_MAX_BYTES as jt, COMMUNITY_LIMITS as k, EXPECT_PEER_MS as ka, IDENTITY_REVOCATION_LABEL as ki, pubkyProofFile as kn, readHandoffHave as ko, sanitizeTypingStatus as kr, firstDeviceSetSecret as ks, AtprotoProofError as kt, readAppStoreSteps as l, nextReactionNumber as la, DOMAIN_FILE_MAX_BYTES as li, SEPOLIA_TEST_USDT_FAUCET as ln, handoffAttemptSucceeded as lo, doorHubs as lr, inviteLink as ls, parseSshPublicKey as lt, APP_PERMISSIONS as m, validReactionNumber as ma, encodeDnsQuery as mi, assertWholeSats as mn, handoffDataFrame as mo, mergeLobby as mr, deviceEchoFrame as ms, verifyBitcoinMessage as mt, appStoreDecision as n, parseLinkPreview as na, identityFromSeedB64 as nc, HOLD_DATED_BACK_MS as ni, resolveDidDht as nn, HANDOFF_PIECE_BYTES as no, MESH_HUBS as nr, createDeviceInvite as ns, carryMentions as nt, APP_STORE_LIMITS as o, GROUP_REACTION_FRAME as oa, sanitizeAvatar as oc, isHoldUrl as oi, ONCHAIN_PROVIDER as on, filePartName as oo, COMMUNITY_TOPOLOGY as or, createChatInvite as os, SSHSIG_MAX_ARMOR as ot, APP_ICON_PATH as p, readReaction as pa, domainWellKnownFile as pi, assertTokenUnits as pn, handoffContextProof as po, mergeBeacon as pr, HANDOFF_CAPABILITY as ps, verifySshSignature as pt, parseGroupWakeFrame as q, LEGACY_SERVICES as qa, DHT_FILE_TOO_LARGE as qi, engineError as qn, enrollCancelReason as qo, APP_DATA_MAX_BYTES as qr, withRequestOptions as qs, parseDidDocument as qt, appUpdateDecision as r, forwardedAgain as ra, publicKeyFromZ32 as rc, HOLD_LIMITS as ri, signDidDhtPacket as rn, HANDOFF_REQUEST as ro, mayBeHub as rr, deviceInviteJoinerParams as rs, parseCommunityEdit as rt, checkAppStoreIndex as s, REACTION_LIMITS as sa, newMailbox as si, PaymentPreflightError as sn, handoffAttemptAllowed as so, beaconKeys as sr, decodeInviteCode as ss, SSHSIG_NAMESPACE as st, appRevocationFor as t, dhtEditId as ta, identityFromSeed as tc, HOLD_CAPABILITY as ti, encodeDidDhtPacket as tn, HANDOFF_PAKE as to, readGroupSignal as tr, verifyEnrollProof as ts, GROUP_EDIT_TEXT_BYTES as tt, signAppStore as u, queueReaction as ua, decodeDnsResponse as ui, TEST_USDT_FAUCET_AMOUNT as un, handoffBusyFrame as uo, freshHubs as ur, inviteOwnership as us, parseSshSignature as ut, checkAppManifest as v, replySnippet as va, recordsFromTxt as vi, SPARK_NETWORKS as vn, handoffManifestFrames as vo, readBeacon as vr, devicePingFrame as vs, ATPROTO_FULL_SCOPE as vt, GROUP_TYPING_FRAME as w, verifyCommitSignature as wa, DHT_TEXT_CAPABILITY as wi, isPubkyKey as wn, handoffVersions as wo, transferEnded as wr, TURN_SETTLE_MS as ws, checkAtprotoProofRecord as wt, readAppBundle as x, MEMBER_KEY as xa, txtValue as xi, sparkInvoiceDetails as xn, handoffReleaseFrame as xo, shouldBeHub as xr, webCryptoSigner as xs, atprotoDidMethod as xt, isAppUrl as y, GROUP_MEMBER_CAP as ya, recordsFromWellKnown as yi, SPARK_PROVIDER as yn, handoffOfferFrame as yo, readBeaconHead as yr, newDeviceSetSecret as ys, ATPROTO_PROOF_COLLECTION as yt, knockIdentity as z, buildSdpFromSignal as za, lastSharedWithMe as zi, findEndpoint as zn, setUpdateFrame as zo, WakeLimiter as zr, DEFAULT_RELAYS as zs, didSignedMessages as zt };
+export { COMMUNITY_EDIT_FRAME as $, cardLine as $a, normalizeRelayUrl as $c, lastSharedWithMe as $i, GROUP_HAVE_FRAME as $n, parseCallSignal as $o, WakeLimiter as $r, ENROLL_GRANT as $s, didDhtFromPublicKey as $t, CommunitySession as A, readForwarded as Aa, newDeviceSetSecret as Ac, nip05RootKey as Ai, pubkyProofFile as An, rosterHas as Ao, pickHubs as Ar, handoffPakeFrame as As, verifyAtprotoRecordProof as At, knockRecords as B, validReactionNumber as Ba, firstDeviceSetSecret as Bc, dialDescriptors as Bi, findEndpoint as Bn, formatLocalTarget as Bo, TYPING_KINDS as Br, readHandoffHello as Bs, didWebDocumentUrl as Bt, sha256Paced as C, readImageMeta as Ca, ENROLL_CAPABILITY as Cc, DOMAIN_FILE_MAX_BYTES as Ci, utf8Decode as Cl, isBitcoinAddress as Cn, readCanonicalJson as Co, doorHubs as Cr, handoffContextProof as Cs, atprotoProofRkey as Ct, openGroupTyping as D, dhtEditId as Da, deviceKeyZ32 as Dc, domainWellKnownFile as Di, newPubkyProofFolder as Dn, commitHash as Do, mergeBeacon as Dr, handoffHelloFrame as Ds, parseAtprotoDidDocument as Dt, groupTypingEpoch as E, RateWindow as Ea, deviceEchoNonce as Ec, domainTxtRecord as Ei, isPubkyProofFolder as En, MEMBER_KEY as Eo, lobbyRecords as Er, handoffEphemeral as Es, normalizeAtprotoHandle as Et, KNOCK_TTL_MS as F, nextReactionNumber as Fa, TURN_SETTLE_MS as Fc, txtValue as Fi, resolveLightningDestination as Fn, DHT_POLL_INTERVALS as Fo, shouldBeHub as Fr, newHandoffId as Fs, checkDidJws as Ft, groupWakeFrame as G, BUTTON_ID as Ga, turnInstance as Gc, IdentityExchange as Gi, INVITE_TAKEN as Gn, encodeControl as Go, GROUP_PIN_FRAME as Gr, SET_ACK as Gs, normalizeDid as Gt, readKnocks as H, pairedReplyAuthor as Ha, readTurnPacket as Hc, IDENTITY_MAX_VALIDITY as Hi, parseCashuRequestPayload as Hn, webLocalFetch as Ho, TypingSender as Hr, readHandoffTurnFrame as Hs, didWebFileNames as Ht, decodeGroupEntryLink as I, queueReaction as Ia, classifyTurnRead as Ic, wellKnownUrl as Ii, decodeBolt11 as In, EXPECT_PEER_MS as Io, ChatFiles as Ir, readHandoffAck as Is, checkDidSignature as It, GROUP_LIMITS as J, PR_STATES as Ja, turnStatedVerifier as Jc, identityRevocationValue as Ji, pairedMessageFits as Jn, answersOffer as Jo, nextPinNumber as Jr, setAckFrame as Js, parseDidSignaturePaste as Jt, groupWakes as K, ITEM_STATES as Ka, turnKeys as Kc, boundVerifiedIdentity as Ki, LIVENESS_PING_MS as Kn, CALL_SIGNAL_MAX_AGE_MS as Ko, PIN_LIMITS as Kr, SET_UPDATE as Ks, parseDid as Kt, encodeGroupEntryLink as L, reactionEmoji as La, turnPutSummary as Lc, CapsExchange as Li, ENDPOINT as Ln, RELAY_POLL_INTERVALS as Lo, FILE_LIMITS as Lr, readHandoffCancel as Ls, didGhostlyServiceEntry as Lt, communityHasFrame as M, GROUP_REACTION_FRAME as Ma, webCryptoSigner as Mc, recordsFromTxt as Mi, homeserverWebEndpoint as Mn, edgeParams as Mo, readBeacon as Mr, handoffRetryAfter as Ms, DID_FILE_MAX_BYTES as Mt, decodeCommunityLink as N, REACTION_LIMITS as Na, TURN_PUT_WINDOW_MS as Nc, recordsFromWellKnown as Ni, pubkyHomeserverOf as Nn, DirectPathWatch as No, readBeaconHead as Nr, handoffStreamKey as Ns, DID_JWS_MAX_LENGTH as Nt, sealGroupTyping as O, parseLinkPreview as Oa, deviceLinkPairing as Oc, encodeDnsQuery as Oi, normalizePubkyKey as On, parseGroupCommit as Oo, mergeLobby as Or, handoffManifestFrames as Os, shortAtprotoDid as Ot, encodeCommunityLink as P, ReactionWindow as Pa, TURN_RAISE_READ_TIMEOUT_MS as Pc, recordsName as Pi, requestLnurlInvoice as Pn, AWAITING_PEER_MS as Po, readLobby as Pr, handoffVersions as Ps, DidError as Pt, frameBytes as Q, buttonLabelClash as Qa, currentRelays as Qc, revokesIdentity as Qi, GROUP_FILE_LIMITS as Qn, extractParamsFromSdp as Qo, WAKE_CALL_INTERVAL_MS as Qr, ENROLL_DONE as Qs, didDhtDocument as Qt, entryParams as R, reactionIsNewer as Ra, TURN_LAST_SEQUENCE as Rc, DHT_TEXT_CAPABILITY as Ri, cashuRequestPayload as Rn, presenceSeenAt as Ro, transferEnded as Rr, readHandoffDone as Rs, didJwsAlg as Rt, readAppBundleAsync as S, parseImageMeta as Sa, DEVICES_CAPABILITY as Sc, readManifest as Si, toZ32 as Sl, sparkInvoiceDetails as Sn, canonicalJsonBytes as So, beaconRecords as Sr, handoffContext as Ss, atprotoProofRecord as St, GroupTypingBoard as T, EDIT_RATE_WINDOW_MS as Ta, deviceEchoFrame as Tc, dnsProofName as Ti, isPubkyKey as Tn, MAX_GROUP_CHAIN as To, lobbyKeys as Tr, handoffDigest as Ts, isAtprotoDid as Tt, GROUP_WAKE_FRAME as U, readReply as Ua, signTurnPacket as Uc, IDENTITY_REVOCATION_LABEL as Ui, parseFedimintRequestPayload as Un, LIMITS as Uo, sanitizeTypingStatus as Ur, readHandoffVerified as Us, didWebFileUrl as Ut, mergeKnocks as V, wireReaction as Va, nextTurnPosition as Vc, IDENTITY_MAX_EVIDENCE as Vi, isFederationId as Vn, parseLocalTarget as Vo, TYPING_REFRESH_MS as Vr, readHandoffPake as Vs, didWebFile as Vt, GroupWakeLimiter as W, replySnippet as Wa, signTurnRelease as Wc, IdentityCheckUnavailable as Wi, GhostLink as Wn, decodeControl as Wo, typingActivity as Wr, sealHandoffPiece as Ws, didWebHost as Wt, GROUP_READ_NOTE as X, STATUS_CARD_LIMITS as Xa, DEFAULT_RELAYS as Xc, newIdentityBinding as Xi, engineError as Xn, callRtcConfig as Xo, pinNumberHolds as Xr, signTombstone as Xs, staticDidDocument as Xt, GROUP_REACTED_FRAME as Y, RUN_RESULTS as Ya, turnVerifierMark as Yc, identityStatement as Yi, pairedMessageFrame as Yn, buildSdpFromSignal as Yo, pinIsNewer as Yr, setUpdateFrame as Ys, signingKeys as Yt, GroupSession as Z, appCardId as Za, RelayTransport as Zc, receivedIdentityStatus as Zi, engineText as Zn, callSignalHeardAt as Zo, readPin as Zr, verifySetUpdate as Zs, strictBase64Url as Zt, assembleAppBundle as _, baseMime as _a, decodeInviteCode as _c, HOLD_LIMITS as _i, sanitizeAvatar as _l, validatePaymentTarget as _n, readAppRevocation as _o, mayBeHub as _r, handoffAttemptAllowed as _s, ATPROTO_DECLARED_SCOPE as _t, planAppUpdate as a, irohDescriptor as aa, enrollDoneFrame as ac, checkPushEndpoint as ai, PacketTooLargeError as al, EVM_TEST_CHAINS as an, claimedTime as ao, readGroupFileMeta as ar, HANDOFF_ACK as as, groupName as at, pacer as b, voicePeaksOf as ba, inviteOwnership as bc, isHoldUrl as bi, randomBytes as bl, SPARK_PROVIDER as bn, signAppRevocation as bo, COMMUNITY_TOPOLOGY as br, handoffBusyFrame as bs, ATPROTO_PROOF_SCOPE as bt, readAppStore as c, DHT_MESSAGE_TTL as ca, enrollProofFrame as cc, chatAppId as ci, newerPacket as cl, SEPOLIA_TEST_USDT as cn, shownTime as co, readGroupWantNo as cr, HANDOFF_HAVE as cs, SshSigError as ct, APP_BUNDLE_LIMITS as d, dhtFileId as da, verifyEnrollProof as dc, BUTTONS_CAPABILITY as di, createIdentity as dl, USDT_PUBLIC_RPC as dn, appFingerprint as do, SIGNAL_FRESH_MS as dr, HANDOFF_PAKE as ds, sameSshKey as dt, PeerProofs as ea, ENROLL_HELLO as ec, deviceWakeRequest as ei, setLinkTraceSink as el, encodeDidDhtDeactivated as en, cardUrl as eo, GROUP_WANT_FRAME as er, signalHasVideo as es, GROUP_EDIT_FRAME as et, APP_BUNDLE_MAGIC as f, formatFileSize as fa, createDeviceInvite as fc, EDIT_CAPABILITY as fi, identityFromSeed as fl, WALLET_NETWORKS as fn, appRef as fo, SIGNAL_HOLD_MS as fr, HANDOFF_PIECE_BYTES as fs, sshSignCommand as ft, appViewOf as g, VOICE_LIMITS as ga, createChatInvite as gc, HOLD_DATED_BACK_MS as gi, MAX_AVATAR_LENGTH as gl, formatPaymentAmount as gn, isAppRef as go, MESH_HUBS as gr, filePartName as gs, decodeAnyBitcoinAddress as gt, appDigest as h, PLAYABLE_AUDIO as ha, OwnInviteError as hc, HOLD_CAPABILITY as hi, verify as hl, assertWholeSats as hn, isAppKey as ho, readGroupSignal as hr, HANDOFF_VERIFIED as hs, BitcoinAddressError as ht, checkAppBeforeRun as i, automaticTransport as ia, enrollDigits as ic, wakeRequest as ii, withRequestOptions as il, ETHEREUM_USDT as in, arrivalKey as io, isGroupMessageId as ir, serviceIdFromName as is, mentionsMember as it, GROUP_READ_NOTE_COMMUNITY as j, COMMUNITY_REACTION_FRAME as ja, seedSigner as jc, normalizeDomain as ji, pubkyProofPath as jn, verifyCommitSignature as jo, rankHubs as jr, handoffReleaseFrame as js, DID_DOCUMENT_MAX_BYTES as jt, COMMUNITY_LIMITS as k, forwardedAgain as ka, devicePingFrame as kc, isPublicAddress as ki, pubkyProofCapability as kn, rosterAdmin as ko, newerHead as kr, handoffOfferFrame as ks, AtprotoProofError as kt, readAppStoreSteps as l, peekDhtMailbox as la, readEnrollGrant as lc, isAppVersion as li, openRelayPayload as ll, SEPOLIA_TEST_USDT_FAUCET as ln, APP_PREFIXES as lo, CarriedTransport as lr, HANDOFF_HELLO as ls, parseSshPublicKey as lt, APP_PERMISSIONS as m, sanitizeMime as ma, readDeviceInvite as mc, UPGRADE_CAPABILITY as mi, publicKeyFromZ32 as ml, assertTokenUnits as mn, isAppHash as mo, groupSignalFrame as mr, HANDOFF_TIMINGS as ms, verifyBitcoinMessage as mt, appStoreDecision as n, validExternalKey as na, enrollCancelFrame as nc, parseWakeFrame as ni, budgetRetryMs as nl, resolveDidDht as nn, sameButtonText as no, fetchesByItself as nr, HTTP_SERVICE_PROTO as ns, carryMentions as nt, APP_STORE_LIMITS as o, irohRelayUrl as oa, enrollGrantFrame as oc, vapidKeysMatch as oi, RELAY_PAYLOAD_MAX_BYTES as ol, ONCHAIN_PROVIDER as on, heardTime as oo, readGroupHave as or, HANDOFF_CANCEL as os, SSHSIG_MAX_ARMOR as ot, APP_ICON_PATH as p, sanitizeFileName as pa, deviceInviteJoinerParams as pc, STATUS_CARD_CAPABILITY as pi, identityFromSeedB64 as pl, arkAddressPrefix as pn, checkAppRevokeStatement as po, SIGNAL_REPLY_MS as pr, HANDOFF_REQUEST as ps, verifySshSignature as pt, parseGroupWakeFrame as q, PR_CHECKS as qa, turnName as qc, emptyIdentityLedger as qi, PAIRED_FRAME_TOO_LARGE as qn, RTC_CONFIG as qo, mayPin as qr, readSetUpdate as qs, parseDidDocument as qt, appUpdateDecision as r, TRANSPORTS as ra, enrollCancelReason as rc, relayRequest as ri, isDiscoveryBudgetError as rl, signDidDhtPacket as rn, statusCardText as ro, groupFileFallback as rr, LEGACY_SERVICES as rs, parseCommunityEdit as rt, checkAppStoreIndex as s, DHT_FILE_TOO_LARGE as sa, enrollHelloFrame as sc, APP_DATA_MAX_BYTES as si, createRelayPayload as sl, PaymentPreflightError as sn, receivedTimestamp as so, readGroupWant as sr, HANDOFF_DONE as ss, SSHSIG_NAMESPACE as st, appRevocationFor as t, emptyProofLedger as ta, ENROLL_PROOF as tc, newWakeToken as ti, traceLink as tl, encodeDidDhtPacket as tn, checkStatusCard as to, GROUP_WANT_NO_FRAME as tr, emptyLinkRecords as ts, GROUP_EDIT_TEXT_BYTES as tt, signAppStore as u, DHT_FILE_CAPABILITY as ua, readEnrollHello as uc, APPS_CAPABILITY as ui, parseRelayPayload as ul, TEST_USDT_FAUCET_AMOUNT as un, APP_STATEMENT_LIMITS as uo, GROUP_SIGNAL_FRAME as ur, HANDOFF_OFFER as us, parseSshSignature as ut, checkAppManifest as v, fileMessageText as va, encodeInviteCode as vc, HoldKeys as vi, bytesEqual as vl, walletNetworkOf as vn, readAppRevocations as vo, meshHubs as vr, handoffAttemptFailed as vs, ATPROTO_FULL_SCOPE as vt, GROUP_TYPING_FRAME as w, EDIT_BUFFER_MS as wa, HANDOFF_CAPABILITY as wc, decodeDnsResponse as wi, utf8Encode as wl, PUBKY_PROOF_MAX_BYTES as wn, GROUP_MEMBER_CAP as wo, freshHubs as wr, handoffDataFrame as ws, checkAtprotoProofRecord as wt, readAppBundle as x, parseVideoMeta as xa, ownInviteRefusal as xc, newMailbox as xi, toBase64Url as xl, sparkAddressKind as xn, canonicalJson as xo, beaconKeys as xr, handoffCancelFrame as xs, atprotoDidMethod as xt, isAppUrl as y, parseVoiceMeta as ya, inviteLink as yc, HoldRefusedError as yi, fromBase64Url as yl, SPARK_NETWORKS as yn, signAppObject as yo, pickMeshHubs as yr, handoffAttemptSucceeded as ys, ATPROTO_PROOF_COLLECTION as yt, knockIdentity as z, readReaction as za, TURN_MAX as zc, capsDescriptors as zi, fedimintRequestPayload as zn, GhostlyHttpError as zo, transferStalled as zr, readHandoffHave as zs, didSignedMessages as zt };
 
-//# sourceMappingURL=src-DhfGgAUu.js.map
+//# sourceMappingURL=src-yMUQvdyL.js.map