@ghostlytools/cli 1.3.1 → 1.3.3

package/dist/assets/{host-CWt-jtqz.js → host-Dj3C1fn3.js}

@@ -1,12 +1,12 @@
-import { Go as answersOffer, Jo as callSignalHeardAt, Ko as buildSdpFromSignal, Oi as isPublicAddress, Uo as CALL_SIGNAL_MAX_AGE_MS, Wo as RTC_CONFIG, Xo as parseCallSignal, Yo as extractParamsFromSdp, Zc as setLinkTraceSink, Zo as signalHasVideo, gl as fromBase64Url, ii as checkPushEndpoint, qo as callRtcConfig } from "./src-DDzSERyc.js";
-import { a as fedimintSdkOn, r as irohRelayProblem } from "./irohWeb-4oChIOIp.js";
-import { r as asCliError, t as CliError } from "./errors-DO5z6h_l.js";
-import { a as findChat } from "./apiKit-CA2x5GJF.js";
-import { _ as flushCardUpdates, c as paymentJson, d as nodeLocalFetch, f as chatJson, g as resumeHolds, h as groupMessageJson, l as reportAppFrames, m as groupJson, p as chatMessageJson, r as callApi, u as servedApps } from "./api-Dq2QXQDk.js";
-import { n as RESTORED_MARK, r as acquireLock } from "./profiles-BHc9pEYg.js";
+import { $o as extractParamsFromSdp, Ai as isPublicAddress, Jo as RTC_CONFIG, Qo as callSignalHeardAt, Xo as buildSdpFromSignal, Yo as answersOffer, Zo as callRtcConfig, es as parseCallSignal, oi as checkPushEndpoint, qo as CALL_SIGNAL_MAX_AGE_MS, tl as setLinkTraceSink, ts as signalHasVideo, xl as fromBase64Url } from "./src-D7gcJElT.js";
+import { a as fedimintSdkOn, r as irohRelayProblem } from "./irohWeb-DSyLp5Re.js";
+import { r as asCliError, t as CliError } from "./errors-B-zMxbcd.js";
+import { a as findChat } from "./apiKit-BsUZPHLn.js";
+import { _ as flushCardUpdates, c as paymentJson, d as nodeLocalFetch, f as chatJson, g as resumeHolds, h as groupMessageJson, l as reportAppFrames, m as groupJson, p as chatMessageJson, r as callApi, u as servedApps } from "./api-B1fADtqd.js";
+import { n as RESTORED_MARK, r as acquireLock } from "./profiles-gPCjLOQq.js";
 import { r as privateFolder, t as ownFolder } from "./privateFolder-Bk9C9oFv.js";
 import { createRequire } from "node:module";
-import { appendFileSync, chmodSync, closeSync, existsSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, writeSync } from "node:fs";
+import { appendFileSync, chmodSync, closeSync, existsSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, writeSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { createHash, randomBytes } from "node:crypto";
@@ -418,11 +418,13 @@ var CallAudio = class {
 		this.schedule();
 	}
 	stop() {
-		this.stopped = true;
 		if (this.timer) clearTimeout(this.timer);
 		this.timer = null;
-		this.options.encoder.delete?.();
-		this.options.decoder.delete?.();
+		if (this.stopped) return;
+		this.stopped = true;
+		for (const codec of [this.options.encoder, this.options.decoder]) try {
+			codec.delete?.();
+		} catch {}
 	}
 	/** Sends the frame that is due now. Exposed for tests, which drive the clock themselves. */
 	tick() {
@@ -551,6 +553,57 @@ var CallAudio = class {
 //#endregion
 //#region src/calls/media.ts
 var loading = null;
+var OPUS_APPLICATION_VOIP = 2048;
+var OPUS_SET_BITRATE = 4002;
+/** The largest packet a codec reads or writes (opusscript's MAX_PACKET_SIZE). */
+var MAX_PACKET_BYTES = 3828;
+/**
+* Room for a frame of PCM as the module reads and writes it, one byte of PCM in each 16-bit element: a concealment (an
+* empty packet) writes 120 ms at 48 kHz, 5,760 samples, 23,040 bytes, at any rate.
+*/
+var PCM_ROOM_BYTES = 23040;
+/** The most PCM a decode hands back, as opusscript's: its largest frame, 60 ms at 48 kHz (CallAudio's `conceal`). */
+var MAX_PCM_OUT = 5760;
+/**
+* An Opus encoder or decoder on opusscript's libopus, with buffers that hold what libopus writes. opusscript's own
+* wrapper (0.1.1) keeps 5,760 bytes for its PCM and reaches it through views at twice the buffer's address, past it: a
+* 20 ms frame at 48 kHz takes 3,840 bytes there and a concealment 23,040. With three calls or more, as calls ended and
+* others started, one codec's audio landed on another's state: noise, then "memory access out of bounds" in every
+* call until the daemon restarted. The bytes in and out are the same as opusscript's.
+*/
+function opusCodec(native, rate) {
+	const handler = new native.OpusScriptHandler(rate, 1, OPUS_APPLICATION_VOIP);
+	const pcm = native._malloc(PCM_ROOM_BYTES), packet = native._malloc(MAX_PACKET_BYTES);
+	let deleted = false;
+	const codec = {
+		encode(frame, frameSize) {
+			if (deleted || frame.length * 2 > PCM_ROOM_BYTES) throw new Error("Encode error: Bad argument");
+			native.HEAPU16.set(frame, pcm / 2);
+			const length = handler._encode(pcm, frame.length, packet, frameSize);
+			if (length < 0) throw new Error(`Encode error: ${length}`);
+			return Buffer.from(native.HEAPU8.subarray(packet, packet + length));
+		},
+		decode(data) {
+			if (deleted || data.length > MAX_PACKET_BYTES) throw new Error("Decode error: Bad argument");
+			native.HEAPU8.set(data, packet);
+			const samples = handler._decode(packet, data.length, pcm);
+			if (samples < 0) throw new Error(`Decode error: ${samples}`);
+			return Buffer.from(native.HEAPU16.subarray(pcm / 2, pcm / 2 + Math.min(samples * 2, MAX_PCM_OUT)));
+		},
+		delete() {
+			if (deleted) return;
+			deleted = true;
+			native.OpusScriptHandler.destroy_handler(handler);
+			native._free(pcm);
+			native._free(packet);
+		}
+	};
+	if (handler._encoder_ctl(OPUS_SET_BITRATE, 32e3) < 0) {
+		codec.delete?.();
+		throw new Error("Encoder CTL error");
+	}
+	return codec;
+}
 /** The media stack, or why calls are not available here (the reason the call buttons of the contact's app show). */
 function loadCallStack() {
 	return loading ??= (async () => {
@@ -558,12 +611,8 @@ function loadCallStack() {
 		try {
 			const ndc = await import("node-datachannel");
 			const lib = ndc.PeerConnection ? ndc : ndc.default;
-			const OpusScript = (await import("opusscript")).default;
-			const opus = (rate) => {
-				const codec = new OpusScript(rate, 1, OpusScript.Application.VOIP);
-				codec.setBitrate(32e3);
-				return codec;
-			};
+			const native = createRequire(import.meta.url)("opusscript/build/opusscript_native_wasm.js")();
+			const opus = (rate) => opusCodec(native, rate);
 			opus(48e3).delete?.();
 			return {
 				ndc: lib,
@@ -612,7 +661,8 @@ function describePair(pair) {
 var refuseAnswers = Number(process.env.GHOSTLY_CALL_REFUSE_ANSWERS) || 0;
 /** How long a description waits for its candidates: a server reflexive one and a little after it, or this long. */
 var GATHER_MS = 5e3;
-var SETTLE_MS = 400;
+/** The signal keeps the first server reflexive candidate only: the apps' calls and the chats' data link settle as long. */
+var SETTLE_MS = 150;
 /**
 * With a candidate in (a host one comes in milliseconds), the server reflexive one is waited for this long at most,
 * not the whole of `GATHER_MS`: a STUN server that answers does in tens of milliseconds, and one that never does (UDP
@@ -629,8 +679,9 @@ var HOST_GATHER_MS = 2e3;
 async function openConnection(stack, options, offer, held = false) {
 	const { ndc } = stack;
 	const bind = process.env.GHOSTLY_CALL_BIND;
+	const iceServers = callIceServers(options.iceServers);
 	const pc = new ndc.PeerConnection("ghostly-call", {
-		iceServers: callIceServers(options.iceServers),
+		iceServers,
 		...bind ? { bindAddress: bind } : {}
 	});
 	const born = Date.now();
@@ -674,7 +725,7 @@ async function openConnection(stack, options, offer, held = false) {
 			videoTrack = pc.addTrack(video);
 			videoTrack.onMessage(() => {});
 		}
-		const gathered = gathering(pc);
+		const gathered = gathering(pc, { turn: callUsesTurn(iceServers) });
 		if (offer) pc.setRemoteDescription(buildSdpFromSignal(held ? {
 			...offer,
 			c: []
@@ -864,8 +915,18 @@ function mdnsNote(signal, log) {
 		lookup(host, { all: true }).then((found) => log(`${host} resolves here to ${found.map((a) => a.address).join(", ")}`), () => log(`${host} does not resolve here: the call connects only if the contact's checks reach this side`));
 	}
 }
-/** Resolves once the local description has its candidates (see GATHER_MS and HOST_GATHER_MS). */
-function gathering(pc) {
+/** Whether a call's ICE servers (`callIceServers`) have a TURN server: its relay candidate is then the one waited for. */
+function callUsesTurn(servers) {
+	return servers.some((server) => typeof server !== "string");
+}
+/**
+* Resolves once the local description has its candidates (see GATHER_MS and HOST_GATHER_MS). `turn`: the connection
+* has a TURN server, and its relay candidate is waited for rather than the reflexive one, as the apps' calls do
+* (`waitForIceGathering`): an allocation takes two round trips, and a TURN server 100 ms away gave its relay after the
+* description had gone without it, on the networks where only the relay connects.
+*/
+function gathering(pc, { turn = false } = {}) {
+	const wanted = turn ? / typ relay/ : / typ srflx/;
 	return new Promise((resolve) => {
 		let settle = null;
 		let any = false;
@@ -884,7 +945,7 @@ function gathering(pc) {
 		});
 		pc.onLocalCandidate((candidate) => {
 			any = true;
-			if (!settle && / typ srflx/.test(candidate)) settle = setTimeout(done, SETTLE_MS);
+			if (!settle && wanted.test(candidate)) settle = setTimeout(done, SETTLE_MS);
 		});
 	});
 }
@@ -915,6 +976,8 @@ var CallManager = class {
 	clearing = /* @__PURE__ */ new Map();
 	/** Per chat: when this side's last call there ended before it was answered (`CALL_PACE_MS`). */
 	unansweredAt = /* @__PURE__ */ new Map();
+	/** The early answers being made, those of ended calls too (MAX_EARLY_ANSWERS). */
+	makings = /* @__PURE__ */ new Set();
 	auto;
 	configPath;
 	stopping = false;
@@ -1087,11 +1150,15 @@ var CallManager = class {
 	*/
 	prepare(call) {
 		if (this.host.answers === false || call.ended || call.state !== "ringing") return;
+		this.stopEarly(call);
 		call.earlyTimer = setTimeout(() => this.prepare(call), this.host.earlyAnswerMs ?? 3e4);
 		call.earlyTimer.unref?.();
 		if (call.making) return;
+		const held = [...this.calls.values()].filter((c) => c !== call && c.early).length;
+		if (this.makings.size + held >= 4 || [...this.makings].some((m) => m.chat === call.chat)) return;
 		const offer = call.offer;
 		const making = {
+			chat: call.chat,
 			done: this.stack().then((stack) => EarlyAnswer.open(stack, offer, {
 				iceServers: this.host.engine.getState().settings?.iceServers ?? [],
 				log: (line) => process.stderr.write(`ghostly: call ${call.id}: ${line}\n`)
@@ -1103,15 +1170,19 @@ var CallManager = class {
 			claimed: false
 		};
 		call.making = making;
+		this.makings.add(making);
 		making.done.then((early) => {
+			this.makings.delete(making);
 			if (call.making === making) call.making = null;
-			if (making.claimed || !early) return;
-			if (call.ended || call.state !== "ringing") {
-				early.close();
-				return;
+			if (!making.claimed && early) {
+				if (call.ended || call.state !== "ringing") early.close();
+				else {
+					call.early?.close();
+					call.early = early;
+				}
 			}
-			call.early?.close();
-			call.early = early;
+			const next = this.byChat(making.chat);
+			if (next && next !== call && next.direction === "in" && !next.making && !next.early) this.prepare(next);
 		});
 	}
 	/** The answered call's early answer: the one made, if still good, or the one being made; none from then on. */
@@ -1403,7 +1474,11 @@ var CallManager = class {
 		this.calls.delete(call.id);
 		if (call.direction === "out" && call.connectedAt === null && call.state === "ringing" && (reason === "hangup" || reason === "unanswered")) this.unansweredAt.set(call.chat, this.now);
 		if (report) process.stderr.write(`ghostly: call ${call.id}: ended (${reason})${call.media ? `, ice ${call.media.ice.state}` : ""}\n`);
-		call.media?.close();
+		try {
+			call.media?.close();
+		} catch (error) {
+			process.stderr.write(`ghostly: call ${call.id}: closing its media failed: ${error instanceof Error ? error.message : String(error)}\n`);
+		}
 		this.stopEarly(call);
 		call.early?.close();
 		call.early = null;
@@ -1562,6 +1637,8 @@ function readAuto(path) {
 		return off;
 	}
 }
+/** A journal past this is trimmed, and only this much of its end is ever read. */
+var JOURNAL_MAX_BYTES = 33554432;
 var SEEN_DB = "ghostly-cli";
 var SEEN = "seen";
 /**
@@ -1587,6 +1664,7 @@ var EventHub = class {
 	seenDb;
 	seq = 0;
 	journalLines = 0;
+	journalBytes = 0;
 	listeners = /* @__PURE__ */ new Set();
 	stateListeners = /* @__PURE__ */ new Set();
 	callListeners = /* @__PURE__ */ new Set();
@@ -1623,13 +1701,24 @@ var EventHub = class {
 	}
 	/** Loads the journal's last seq and the seen set; call before `sink` is attached. */
 	async open() {
-		if (existsSync(this.journalPath)) {
-			const lines = readFileSync(this.journalPath, "utf8").split("\n").filter(Boolean);
-			this.journalLines = lines.length;
-			for (let i = lines.length - 1; i >= 0; i--) try {
-				this.seq = JSON.parse(lines[i]).seq;
-				break;
+		try {
+			if (existsSync(this.journalPath)) {
+				const { lines, size } = journalTail(this.journalPath);
+				this.journalLines = lines.length;
+				this.journalBytes = size;
+				for (let i = lines.length - 1; i >= 0; i--) try {
+					this.seq = JSON.parse(lines[i]).seq;
+					break;
+				} catch {}
+				if (size > 33554432 || lines.length > 2e4) this.trimJournal();
+			}
+		} catch (error) {
+			process.stderr.write(`ghostly: the event journal could not be read, a new one begins: ${error instanceof Error ? error.message : String(error)}\n`);
+			try {
+				renameSync(this.journalPath, this.journalPath + ".unreadable");
 			} catch {}
+			this.journalLines = 0;
+			this.journalBytes = 0;
 		}
 		this.db = await new Promise((resolve, reject) => {
 			const request = indexedDB.open(this.seenDb, 1);
@@ -1754,13 +1843,10 @@ var EventHub = class {
 	replay(since) {
 		if (!existsSync(this.journalPath) || since >= this.seq) return [];
 		const out = [];
-		for (const line of readFileSync(this.journalPath, "utf8").split("\n")) {
-			if (!line) continue;
-			try {
-				const event = JSON.parse(line);
-				if (event.seq > since) out.push(event);
-			} catch {}
-		}
+		for (const line of journalTail(this.journalPath).lines) try {
+			const event = JSON.parse(line);
+			if (event.seq > since) out.push(event);
+		} catch {}
 		if (out.length && out[0].seq > since + 1) out.unshift({
 			seq: since,
 			id: `events.gap:${since}:${out[0].seq}`,
@@ -1783,18 +1869,57 @@ var EventHub = class {
 			at: this.now(),
 			...fields
 		};
-		appendFileSync(this.journalPath, JSON.stringify(event) + "\n", { mode: 384 });
-		if (++this.journalLines > 2e4) this.trimJournal();
+		try {
+			const line = JSON.stringify(event) + "\n";
+			appendFileSync(this.journalPath, line, { mode: 384 });
+			this.journalBytes += Buffer.byteLength(line);
+			if (++this.journalLines > 2e4 || this.journalBytes > 33554432) this.trimJournal();
+		} catch (error) {
+			process.stderr.write(`ghostly: event journal error: ${error instanceof Error ? error.message : String(error)}\n`);
+		}
 		for (const listener of this.listeners) try {
 			listener(event);
 		} catch {}
 		return event;
 	}
+	/** Keeps the last `JOURNAL_KEEP` events, and of them no more than `JOURNAL_KEEP_BYTES`. */
 	trimJournal() {
-		const lines = readFileSync(this.journalPath, "utf8").split("\n").filter(Boolean).slice(-1e4);
-		writeFileSync(this.journalPath + ".tmp", lines.join("\n") + "\n", { mode: 384 });
+		const lines = journalTail(this.journalPath).lines.slice(-1e4);
+		let start = lines.length, bytes = 0;
+		while (start > 0 && bytes + Buffer.byteLength(lines[start - 1]) + 1 <= 16777216) bytes += Buffer.byteLength(lines[--start]) + 1;
+		const kept = lines.slice(start);
+		writeFileSync(this.journalPath + ".tmp", kept.length ? kept.join("\n") + "\n" : "", { mode: 384 });
 		renameSync(this.journalPath + ".tmp", this.journalPath);
-		this.journalLines = lines.length;
+		this.journalLines = kept.length;
+		this.journalBytes = bytes;
+	}
+	/**
+	* What was removed here leaves the journal too: the journal is written again without the events that name it (a
+	* line that names it and cannot be read goes as well), and a journal set aside as unreadable, which cannot be sorted,
+	* is deleted. `ids`: what was removed (a message's id, a chat's or a group's); `gone`: whether an event is of it.
+	*/
+	forget(ids, gone) {
+		if (!ids.length) return;
+		try {
+			rmSync(this.journalPath + ".unreadable", { force: true });
+			if (!existsSync(this.journalPath)) return;
+			const lines = journalTail(this.journalPath).lines;
+			const kept = lines.filter((line) => {
+				if (!ids.some((id) => line.includes(JSON.stringify(id)))) return true;
+				try {
+					return !gone(JSON.parse(line));
+				} catch {
+					return false;
+				}
+			});
+			if (kept.length === lines.length) return;
+			writeFileSync(this.journalPath + ".tmp", kept.length ? kept.join("\n") + "\n" : "", { mode: 384 });
+			renameSync(this.journalPath + ".tmp", this.journalPath);
+			this.journalLines = kept.length;
+			this.journalBytes = kept.reduce((bytes, line) => bytes + Buffer.byteLength(line) + 1, 0);
+		} catch (error) {
+			process.stderr.write(`ghostly: event journal error: ${error instanceof Error ? error.message : String(error)}\n`);
+		}
 	}
 	handle(message) {
 		switch (message.kind) {
@@ -1871,11 +1996,12 @@ var EventHub = class {
 				...typingFields(shape)
 			});
 		}
-		for (const id of [...this.chats.keys()]) {
-			if (links.has(id)) continue;
+		const removedChats = [...this.chats.keys()].filter((id) => !links.has(id));
+		for (const id of removedChats) {
 			this.chats.delete(id);
 			if (!quiet) this.emit("chat.removed", `chat.removed:${id}`, { chat: id });
 		}
+		this.forget(removedChats, (event) => removedChats.includes(event.chat) && event.type !== "chat.removed");
 		const groups = new Map(state.groups.map((group) => [group.id, group]));
 		for (const [id, group] of groups) {
 			const shape = groupShape(group), before = this.groups.get(id);
@@ -1914,11 +2040,12 @@ var EventHub = class {
 				member
 			});
 		}
-		for (const id of [...this.groups.keys()]) {
-			if (groups.has(id)) continue;
+		const removedGroups = [...this.groups.keys()].filter((id) => !groups.has(id));
+		for (const id of removedGroups) {
 			this.groups.delete(id);
 			if (!quiet) this.emit("group.removed", `group.removed:${id}`, { group: id });
 		}
+		this.forget(removedGroups, (event) => removedGroups.includes(event.group) && event.type !== "group.removed");
 		for (const [id, payment] of Object.entries(state.payments ?? {})) {
 			const shape = `${payment.state}|${payment.error ?? ""}|${payment.closed ? 1 : 0}`, before = this.payments.get(id);
 			this.payments.set(id, shape);
@@ -2173,10 +2300,12 @@ var EventHub = class {
 				});
 			}
 		}
+		const gone = [];
 		for (const id of deleted ?? [...known.keys()]) {
 			if (present.has(id) || !known.has(id)) continue;
 			known.delete(id);
 			changes.push([id, null]);
+			gone.push(id);
 			if (!quiet) this.emit(group ? "group.deleted" : "message.deleted", `${group ? "group" : "message"}.deleted:${group ?? chat}:${id}`, group ? {
 				group,
 				messageId: id
@@ -2186,6 +2315,8 @@ var EventHub = class {
 			});
 		}
 		if (changes.length) this.persist(chat, changes);
+		const whole = !!group && !deleted && messages.length === 0 && gone.length > 0;
+		this.forget(whole ? [group] : gone, (event) => (group ? event.group === group : event.chat === chat) && !event.type.endsWith(".deleted") && (whole ? "message" in event || "messageId" in event || "replyId" in event : gone.includes(event.messageId) || gone.includes(event.message?.id) || gone.includes(event.replyId)));
 		for (const [fileId, messageId] of files) this.flushFile(fileId, messageId);
 	}
 	/**
@@ -2352,6 +2483,71 @@ function groupShape(group) {
 		pin: group.pin ?? null
 	};
 }
+/**
+* The journal's whole lines within its last `JOURNAL_MAX_BYTES`, and its size: never the whole file as one string, so
+* a journal grown past what a string can hold (or a trim's bound) is still read, and in bounded time.
+*/
+function journalTail(path) {
+	const fd = openSync(path, "r");
+	try {
+		const size = fstatSync(fd).size;
+		const from = Math.max(0, size - JOURNAL_MAX_BYTES - 1);
+		const buffer = Buffer.alloc(size - from);
+		let read = 0;
+		while (read < buffer.length) {
+			const n = readSync(fd, buffer, read, buffer.length - read, from + read);
+			if (!n) break;
+			read += n;
+		}
+		const lines = buffer.toString("utf8", 0, read).split("\n");
+		if (from > 0) lines.shift();
+		return {
+			lines: lines.filter(Boolean),
+			size
+		};
+	} finally {
+		closeSync(fd);
+	}
+}
+//#endregion
+//#region src/joinLog.ts
+/**
+* A join through a group's link, as a daemon says it in its log (stderr): the steps of the knock and of the entry
+* session, one short line each, from the engine's join trace (packages/browser/src/engine/joinTrace.ts). Without them a
+* join that stalled left nothing in the admin's log to tell a knock never seen from a session that never opened
+* (2026-10-16). The reads of the knocks, every few seconds, and an edge's own steps are not said.
+*/
+var SAID = {
+	"join.start": "joining through its link",
+	"knock.published": "knock left",
+	"knock.seen": "a knock seen: opening an entry session",
+	"link.start": "entry session starting",
+	"link.presence": "entry session: the other side's packet seen",
+	"link.offering": "entry session: offering a connection",
+	"link.answering": "entry session: answering a connection",
+	"link.connecting": "entry session: connecting",
+	"link.open": "entry session open",
+	"link.idle": "entry session not open",
+	"link.native": "entry session: WebRTC connected nothing, going on over a native transport",
+	"invite.sent": "invitation sent on the entry session",
+	"invite.received": "invitation received on the entry session: accepting",
+	"welcome.sent": "welcome sent",
+	"welcome.received": "welcome received: in the group"
+};
+/** The log line for one join-trace line, or null when it is not said. */
+function joinLogLine(traced) {
+	let step;
+	try {
+		step = JSON.parse(traced);
+	} catch {
+		return null;
+	}
+	if (typeof step.step !== "string" || typeof step.g !== "string" || !Object.hasOwn(SAID, step.step)) return null;
+	const role = step.role === "host" || step.role === "guest" ? step.role : void 0;
+	if (step.step.startsWith("link.") && !role) return null;
+	const at = typeof step.t === "number" ? ` at ${new Date(step.t).toISOString()}` : "";
+	return `ghostly: group ${step.g}: ${SAID[step.step]}${role ? ` (${role === "host" ? "letting in" : "joining"})` : ""}${at}`;
+}
 //#endregion
 //#region src/runtime/fedimint.ts
 /**
@@ -4354,10 +4550,12 @@ async function startRuntime(paths, options = {}) {
 	const pinned = pkarrRelays();
 	const pinnedIroh = irohRelays();
 	const trace = process.env.GHOSTLY_LINK_TRACE;
-	if (trace) {
-		setLinkTraceSink((line) => appendFileSync(trace, line + "\n", { mode: 384 }));
-		(await import("./joinTrace-D-fnt2p3.js")).setJoinTraceSink((line) => appendFileSync(trace, line + "\n", { mode: 384 }));
-	}
+	if (trace) setLinkTraceSink((line) => appendFileSync(trace, line + "\n", { mode: 384 }));
+	if (trace || options.logJoins) (await import("./joinTrace-D-fnt2p3.js")).setJoinTraceSink((line) => {
+		if (trace) appendFileSync(trace, line + "\n", { mode: 384 });
+		const said = options.logJoins ? joinLogLine(line) : null;
+		if (said) process.stderr.write(said + "\n");
+	});
 	const store = await openPersistentIndexedDb(paths.db);
 	const restored = join(paths.dir, RESTORED_MARK);
 	if (existsSync(restored)) {
@@ -4380,17 +4578,17 @@ async function startRuntime(paths, options = {}) {
 	if (testMints) (await import("./mints-CqTdA4Gk.js")).declareTestMints(testMints.split(","));
 	await installEventSource();
 	await preloadWalletModules();
-	(await import("./ghostly_iroh_web-Dvzh3Y6E.js")).initSync({ module: irohWasmBytes() });
+	(await import("./ghostly_iroh_web-BsAEFIjl.js")).initSync({ module: irohWasmBytes() });
 	const [{ registerFileBytes }, { NodeFileBytes }] = await Promise.all([import("./fileBytes-CgbibpbV.js"), import("./fileBytes-CfSXjTFa.js")]);
 	registerFileBytes("native", async () => new NodeFileBytes(paths.files), true);
-	const [{ EngineServer }, { createHyperEndpoint }] = await Promise.all([import("./server-Ss0gJ-nw.js"), import("./endpoint-BOTFMpfS.js")]);
+	const [{ EngineServer }, { createHyperEndpoint }] = await Promise.all([import("./server-Bx3RGkBC.js"), import("./endpoint-BOTFMpfS.js")]);
 	const network = hyperdhtNetwork();
 	const dht = mainlineNetwork();
-	const mainline = dht.off ? null : new (await (import("./mainline-ZkiOnevs.js"))).Mainline({
+	const mainline = dht.off ? null : new (await (import("./mainline-CLTo0nGa.js"))).Mainline({
 		bootstrap: dht.bootstrap,
 		host: dht.host
 	});
-	const transport = mainline || pinned ? new (await (import("./mainline-ZkiOnevs.js"))).RelaysAndDht(mainline, pinned ? { relays: pinned } : {}, !!pinned) : null;
+	const transport = mainline || pinned ? new (await (import("./mainline-CLTo0nGa.js"))).RelaysAndDht(mainline, pinned ? { relays: pinned } : {}, !!pinned) : null;
 	const apps = servedApps(paths.dir).length > 0;
 	const server = new EngineServer({
 		...transport ? { transport } : {},
@@ -4438,6 +4636,13 @@ async function startRuntime(paths, options = {}) {
 /** The longest request line the daemon reads (WISP 1100 § Framing). */
 var MAX_LINE = 16777216;
 /**
+* The most a connection may leave unread (answers and events the daemon wrote that its client has not taken): past
+* it, the connection ends. A `listen` stopped with Ctrl+Z, or a client that stops reading, kept every later event in
+* the daemon's memory until it read again (155 MB after 6,000 long texts); `listen` reconnects after the last seq it
+* took, and the journal still has the rest. A replay is the journal's size at most and does not count against it.
+*/
+var MAX_UNREAD = 8388608;
+/**
 * How many of a chat's newest messages the start reads to see whether the events are in step with its history: the
 * whole history of every chat and group, read at every start, took a daemon's start and its memory with every message
 * the profile ever stored (1 s and 70 MB at 100,000).
@@ -4452,7 +4657,10 @@ async function openHost(paths, mode, version, options = {}) {
 	const release = acquireLock(paths);
 	let runtime;
 	try {
-		runtime = await startRuntime(paths, options);
+		runtime = await startRuntime(paths, mode === "daemon" ? {
+			...options,
+			logJoins: true
+		} : options);
 	} catch (error) {
 		release();
 		throw error;
@@ -4596,12 +4804,23 @@ function ownerOnlyUmask() {
 }
 function connection(ctx, socket) {
 	const unsubscribes = [];
-	const write = (value) => {
-		if (!socket.destroyed) socket.write(JSON.stringify(value) + "\n");
+	let limit = MAX_UNREAD;
+	const unsubscribe = () => {
+		for (const off of unsubscribes.splice(0)) off();
+	};
+	const write = (value, replayed = false) => {
+		if (socket.destroyed || socket.writableEnded) return;
+		if (!replayed && socket.writableLength > limit) {
+			unsubscribe();
+			socket.end();
+			return;
+		}
+		socket.write(JSON.stringify(value) + "\n");
 	};
-	socket.on("close", () => {
-		for (const off of unsubscribes) off();
+	socket.on("drain", () => {
+		limit = MAX_UNREAD;
 	});
+	socket.on("close", unsubscribe);
 	socket.on("error", () => {});
 	const lines = createInterface({
 		input: socket,
@@ -4634,8 +4853,25 @@ function connection(ctx, socket) {
 			return;
 		}
 		if (request.method === "events.subscribe") {
+			if (unsubscribes.length) {
+				write({
+					id,
+					error: new CliError("bad_request", "This connection is subscribed already: open another one for a new stream").toJSON()
+				});
+				return;
+			}
 			const params = request.params ?? {};
 			const since = typeof params.since === "number" ? params.since : ctx.hub.lastSeq;
+			let replay;
+			try {
+				replay = ctx.hub.replay(since);
+			} catch (error) {
+				write({
+					id,
+					error: asCliError(error).toJSON()
+				});
+				return;
+			}
 			const queued = [];
 			let replaying = true;
 			unsubscribes.push(ctx.hub.onEvent((event) => {
@@ -4650,10 +4886,11 @@ function connection(ctx, socket) {
 				}
 			});
 			let last = since;
-			for (const event of ctx.hub.replay(since)) {
-				write({ event });
+			for (const event of replay) {
+				write({ event }, true);
 				last = event.seq;
 			}
+			limit = Math.max(limit, socket.writableLength + MAX_UNREAD);
 			replaying = false;
 			for (const event of queued) if (event.seq > last) write({ event });
 			return;
@@ -4668,6 +4905,6 @@ function connection(ctx, socket) {
 	});
 }
 //#endregion
-export { BASELINE_NEWEST, MAX_LINE, keepServing, openHost, serve };
+export { BASELINE_NEWEST, MAX_LINE, MAX_UNREAD, keepServing, openHost, serve };
 
-//# sourceMappingURL=host-CWt-jtqz.js.map
+//# sourceMappingURL=host-Dj3C1fn3.js.map